Bad application classification and identification method based on traffic time sequence characteristics

Abstract

The invention relates to the technical field, and discloses a bad application classification and identification method based on traffic time sequence characteristics, and the method comprises the steps: obtaining initial data, carrying out model unsupervised pre-training, segmenting to-be-identified traffic data, adjusting a model through marking data, carrying out proxy classification and website classification, and outputting proxy classification and website classification results. The method has the following effects: accurate classification and proxy type identification of the encrypted traffic are realized by analyzing the traffic time sequence characteristics, and the accuracy of network traffic monitoring and security protection is improved. Compared with the prior art, the method effectively solves the problem that a traditional classification method based on statistical characteristics is insufficient in accuracy when facing complex proxy communication and encrypted traffic, the traffic type can be identified more efficiently, the network security is guaranteed, meanwhile, the dependence on a large amount of marked data is reduced, and the classification efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer network and information security technology, and in particular to a method for classifying and identifying bad applications based on traffic time series characteristics. Background Art

[0002] At present, with the continuous development of network communications, especially with the widespread popularity of Internet applications and services, the types and complexity of network traffic are also increasing. In order to effectively manage and monitor network traffic and ensure the security and efficiency of the network, traffic classification technology has become one of the important technologies in the fields of network security, traffic management and data analysis. Especially when dealing with encrypted traffic, how to accurately identify the type and source of traffic becomes a key issue.

[0003] In one prior art, encrypted traffic is classified by manually counting encrypted traffic features. The traffic classification method based on manually counting encrypted traffic features can classify encrypted traffic to a certain extent, but it has the defect of insufficient accuracy. Especially in the face of complex proxy communication environments, the encryption method and obfuscation technology of traffic lead to the failure of traditional methods of counting encrypted traffic features.

[0004] In summary, the traditional traffic classification method based on manual statistics of encrypted traffic characteristics has low classification accuracy and is difficult to deal with complex proxy communication environments. Summary of the invention

[0005] The present invention provides a method, device, electronic device and storage medium for classifying and identifying bad applications based on traffic timing characteristics, so as to solve the problem that the traditional traffic classification method based on statistical characteristics has low classification accuracy and is difficult to cope with complex proxy communication environments.

[0006] In a first aspect, in order to solve the above technical problems, the present invention provides a method for classifying and identifying bad applications based on traffic time series characteristics, comprising: Obtain training traffic data, labeled data, and traffic data to be identified; Inputting the training traffic data into a model based on a Transformer architecture for unsupervised pre-training to obtain a general traffic recognition model; Extracting single-stream data from the traffic data to be identified, and extracting a payload and a data packet direction sequence from the single-stream data; The general traffic identification model is adjusted by the marking data to obtain a dedicated traffic identification model, and the traffic data to be identified is subjected to proxy classification to obtain a proxy classification result; Inputting the effective load and data packet direction sequence into the dedicated traffic identification model to obtain a load embedding representation feature and a sequence embedding representation feature; The probability value of each website category is calculated according to the load embedding representation feature and the sequence embedding, and the website category with the largest website category probability value is taken as the website classification result; The proxy classification result and the website classification result are output.

[0007] In an optional implementation manner, the extracting single flow data from the to-be-identified traffic data includes: Extract the IP, port and protocol of each data packet from the traffic data to be identified; Integrate data packets with the same IP, port, and protocol into a single stream of data.

[0008] In an optional implementation manner, extracting the payload and the data packet direction sequence from the single stream data includes: The single stream data includes a data packet, a source IP address and a destination IP address of the data packet; Removing the protocol header information of the data packet and retaining the actual communication content as the payload; The transmission direction of the data packet is determined based on the source IP and the destination IP. +1 is used to represent the data packet sent by the client to the server, and -1 is used to represent the data packet returned by the server to the client. The direction of the data packet is recorded in sequence to obtain a data packet direction sequence.

[0009] In an optional implementation, the general traffic identification model is adjusted by the tag data to obtain a dedicated traffic identification model, and the traffic data to be identified is subjected to proxy classification to obtain a proxy classification result, including: The marking data includes a proxy type label for each piece of traffic data; Inputting the labeled data into the general traffic identification model, adjusting the model through supervised training, and obtaining a dedicated traffic identification model; Use the adjusted model to perform proxy classification on the traffic data to be identified.

[0010] In an optional implementation, performing proxy classification on the traffic data to be identified to obtain a proxy classification result includes: inputting the payload and packet direction sequence into a model; The probability density of each agent type is calculated by the Softmax classifier; The agent type with the largest agent type probability value is selected as the classification result.

[0011] In an optional implementation, the probability density of each agent type is calculated by the Softmax classifier, including: Processing the payload and packet direction sequence through multiple fully connected layers to obtain a first feature vector; Mapping the first feature vector to each category through a linear layer to obtain a first logits value; Apply the Softmax function to the first logits value to obtain the probability value of each agent type, and the calculation method of the agent type probability value is: in, For the The proxy type probability value of the proxy type, For the The first logits value of the proxy type, For the The first logits value of the proxy type, Indicates Types of agents, Indicates Types of agents, Represents the total number of proxy types.

[0012] In an optional implementation, the inputting the effective load and the data packet direction sequence into the dedicated traffic identification model to obtain the load embedding representation feature and the sequence embedding representation feature includes: inputting said payload and packet direction sequence into a dedicated traffic identification model; Processing the payload through the Transformer encoder in the dedicated traffic identification model, extracting key features therein as payload embedding representation features; The packet direction sequence is input into the Transformer feature extractor in the dedicated traffic identification model to capture the timing pattern of packet interaction as a sequence embedding representation feature.

[0013] In an optional implementation, the calculating of each website category probability value according to the load embedding representation feature and the sequence embedding, and taking the website category with the largest website category probability value as the website classification result, includes: Concatenating the load embedding representation feature and the sequence embedding representation feature to obtain a comprehensive feature; The comprehensive features are input into the Softmax classifier for calculation to obtain the probability value of each website type; The website category with the largest website type probability value is taken as the website classification result.

[0014] In an optional implementation, the comprehensive features are input into a Softmax classifier for calculation to obtain probability values ​​of various website types, including: Processing the comprehensive features through multiple fully connected layers to obtain a second feature vector; Mapping the second feature vector to each website category through a linear layer to obtain a second logits value; Apply the Softmax function to the second logits value to obtain the probability value of each website type, and the calculation method of the website type probability value is: in, For the The website type probability value of the website type, For the The second logits value of the website type, For the The second logits value of the website type, Indicates Types of websites, Kind Types of websites, Represents the total number of website types.

[0015] In a second aspect, the present invention provides a device for classifying and identifying bad applications based on traffic time series characteristics, comprising: An initial data acquisition module, used to acquire training traffic data, labeled data, and traffic data to be identified; An unsupervised pre-training module, used for inputting the training traffic data into a model based on a Transformer architecture for unsupervised pre-training to obtain a general traffic recognition model; A data segmentation and feature extraction module, used to extract single-flow data from the traffic data to be identified, and extract a payload and a data packet direction sequence from the single-flow data; An adjustment and proxy classification module, used to adjust the general traffic identification model through the marking data to obtain a dedicated traffic identification model, perform proxy classification on the traffic data to be identified, and obtain a proxy classification result; A feature embedding generation module, used for inputting the effective load and data packet direction sequence into the dedicated traffic identification model to obtain a load embedding representation feature and a sequence embedding representation feature; A website classification module, used to obtain the probability value of each website category according to the load embedding representation feature and the sequence embedding calculation, and take the website category with the largest website category probability value as the website classification result; The result output module is used to output the agent classification result and the website classification result.

[0016] In a third aspect, the present invention also provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements any one of the above-mentioned methods for classifying and identifying bad applications based on traffic timing characteristics.

[0017] In a fourth aspect, the present invention also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for classifying and identifying bad applications based on traffic timing characteristics.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The present invention discloses a method for classifying and identifying bad applications based on traffic time series characteristics, comprising obtaining training traffic data, marking data and traffic data to be identified; inputting the training traffic data into a model based on a Transformer architecture for unsupervised pre-training to obtain a general traffic identification model; extracting single-flow data from the traffic data to be identified, and extracting effective load and data packet direction sequence from the single-flow data; adjusting the general traffic identification model through the marking data to obtain a special traffic identification model, performing proxy classification on the traffic data to be identified, and obtaining a proxy classification result; inputting the effective load and data packet direction sequence into the special traffic identification model to obtain a load embedding representation feature and a sequence embedding representation feature; calculating and obtaining probability values ​​of various website categories according to the load embedding representation feature and the sequence embedding, and taking the website category with the largest probability value of the website category as the website classification result; and outputting the proxy classification result and the website classification result.

[0019] The present invention realizes proxy type identification and website type identification for encrypted traffic by analyzing the timing characteristics of traffic, overcomes the limitations of traditional statistical feature-based methods in complex proxy communications and encrypted traffic, improves the accuracy of network traffic monitoring while ensuring network security, reduces dependence on large amounts of labeled data, and thus improves classification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flowchart of a method for classifying and identifying bad applications based on traffic time series characteristics provided by the first embodiment of the present invention; Figure 2 It is a schematic diagram of the structure of a device for classifying and identifying bad applications based on traffic timing characteristics provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Reference Figure 1 The first embodiment of the present invention provides a method for classifying and identifying bad applications based on traffic time series characteristics, comprising the following steps: S100, obtaining training traffic data, marked data and traffic data to be identified; S200, inputting the training traffic data into a model based on the Transformer architecture for unsupervised pre-training to obtain a general traffic recognition model; S300, extracting single-flow data from the traffic data to be identified, and extracting a payload and a data packet direction sequence from the single-flow data; S400, adjusting the general traffic identification model through the marking data to obtain a dedicated traffic identification model, performing proxy classification on the traffic data to be identified, and obtaining a proxy classification result; S500, inputting the effective load and data packet direction sequence into the dedicated traffic identification model to obtain a load embedding representation feature and a sequence embedding representation feature; S600, obtaining probability values ​​of various website categories according to the load embedding representation features and the sequence embedding calculation, and taking the website category with the largest website category probability value as the website classification result; S700, output the agent classification results and website classification results.

[0023] In step S100, three key data need to be obtained to ensure that the entire bad application classification and identification process can proceed smoothly and achieve effective classification results.

[0024] In one implementation, the three key data include training traffic data, labeling data, and traffic data to be identified, wherein: The training traffic data is used for unsupervised pre-training of the model, helping the model to extract time series features from the raw traffic data. The purpose of unsupervised pre-training is to allow the model to initially learn the distribution characteristics and potential patterns of traffic without explicit label guidance, thereby improving the ability to understand encrypted traffic in proxy communications and laying the foundation for subsequent adjustments.

[0025] Labeled data includes traffic samples that have been clearly classified, that is, each piece of data has a corresponding category label. This part of data is used in the model adjustment stage. By introducing supervised learning, the model can further optimize parameters on specific tasks. Labeled data provides more precise guidance information to ensure that the model is accurate in proxy classification and website classification tasks. This is conducive to improving the performance of the model in practical applications.

[0026] Traffic data to be identified refers to traffic data collected from the actual network that needs to be classified and identified. The specific category of this type of data is unknown, and it needs to be predicted by the trained model to finally obtain the classification results of proxy type and website type. Traffic data to be identified is the object of actual application of the model, and the model needs to demonstrate its learning results on this part of data.

[0027] In step S200, the training traffic data obtained in the previous step needs to be input into a model based on the Transformer architecture for unsupervised pre-training, so as to obtain a recognition model that can process general traffic features.

[0028] In one implementation, the training traffic data is input into a model based on the Transformer architecture. These data do not need to be labeled and are only used as input for feature learning. The training traffic data contains various types of network communication information, and its purpose is to allow the model to learn the time series characteristics and distribution laws of the traffic.

[0029] Among them, Transformer is a deep learning architecture widely used in natural language processing and time series analysis, with feature extraction capabilities. Through the multi-head attention mechanism, the model can effectively capture the global and local time series features in traffic data and adapt to the complex changes of different types of traffic.

[0030] In one implementation, during unsupervised pre-training, the model does not rely on specific label information, but extracts meaningful features by learning the intrinsic structure of the data, for example, the correlation between data or time series patterns. This pre-training method can help the model generalize better in subsequent tasks, especially in encrypted traffic and complex proxy communication scenarios.

[0031] It should be noted that after pre-training, the model has acquired the initial ability to identify different traffic features, forming a general traffic recognition model. This model has the ability to express features, laying the foundation for subsequent adjustments and specific agent classification and website classification tasks.

[0032] In step S300, further feature extraction needs to be performed on the traffic data to be identified.

[0033] In one implementation, the traffic data to be identified contains a large amount of communication information, but this communication information involves interactions between multiple sources and destinations. Therefore, it is necessary to divide the traffic by source IP, destination IP, and protocol type to extract each independent single flow data.

[0034] Among them, single-flow data refers to a series of continuous data transmissions based on the same protocol between the same source IP and destination IP. It can more clearly reflect the data interaction characteristics between the two communication ends and lay the foundation for subsequent traffic analysis. The extraction of single-flow data can effectively reduce the noise of traffic analysis and improve the availability and accuracy of data.

[0035] In one implementation, it is also necessary to extract the payload and packet direction sequence from the single stream data, where: The payload is the part of the data packet that remains after the protocol header is removed. It contains the specific data transmitted at the application layer. It is an important feature for identifying the application type and traffic content. Extracting the payload helps capture the internal characteristics of the traffic, especially when dealing with encrypted traffic or hidden communications. This part of the data is key to determining its use and purpose.

[0036] The packet direction sequence is used to describe the transmission direction of the packet. The sent packet is marked as positive (+1), and the received packet is marked as negative (-1), forming a direction sequence through the time series. This sequence can reveal the timing pattern of the traffic.

[0037] For example, in a typical request-response structure, the direction sequence is "+1, -1, +1, -1", indicating that the client sends a request to the server (+1), and the server returns a response (-1). This alternating pattern reflects the standard client-server interaction process. In the continuous data stream transmission mode, the direction sequence is "+1, +1, +1, +1, -1, -1", indicating that the client continuously sends a large amount of data, and then the server returns in batches. This sequence can be used to identify behaviors such as file uploads or video streaming.

[0038] The above steps ensure that the payload and packet direction sequence can be accurately extracted from the single flow data, providing rich input features for subsequent traffic analysis tasks. Combined with these features, the model can more accurately identify the proxy type and website category of different traffic, thereby improving the classification performance.

[0039] In step S400, the general traffic identification model needs to be further adjusted through the labeled data to improve its classification ability on specific tasks. Although the general traffic identification model has mastered the basic traffic characteristics, in order to be able to more accurately classify the proxy traffic type, it is necessary to use the labeled data to supervise the model. These labeled data contain traffic samples of known categories, each of which corresponds to a specific proxy type, such as ordinary proxy, anonymous proxy or malicious proxy.

[0040] In one implementation, the general traffic identification model is adjusted by the tag data to obtain a dedicated traffic identification model, and the traffic data to be identified is subjected to proxy classification, wherein: The labeled data contains the proxy type label of each traffic data. These labels are annotated by prior knowledge or historical classification results, and can provide clear supervision signals for the model. The quality and diversity of labeled data directly affect the effect of model adjustment. Therefore, in the process of collecting and preparing labeled data, it should be ensured that the data covers a variety of proxy types and communication scenarios, such as ordinary proxies, anonymous proxies, and complex encrypted proxy traffic.

[0041] Next, the labeled data is fed into the general traffic identification model, and the model is adjusted through supervised training. During this process, the model calculates the loss function based on the proxy type label in the labeled data. Common loss functions such as cross entropy loss are used to quantify the gap between the model prediction and the true label. The model parameters are optimized through back propagation, so that the model can more accurately identify the characteristics of different proxy types of traffic. The adjustment process is not only to refine and optimize the original general feature extraction capability of the model, but also to effectively reduce the confusion of features between categories and improve the accuracy of the model in the proxy classification task.

[0042] After the adjustment is completed, the obtained dedicated traffic identification model has the ability to identify the characteristics of proxy traffic. The traffic data to be identified is input into the adjusted model for proxy classification. The model will output the proxy classification result corresponding to each traffic data based on the characteristics of the input data and the learned proxy type feature space.

[0043] In one implementation, the process of using the adjusted model to perform proxy classification on the traffic data to be identified is as follows: First, the extracted payload and packet direction sequences are input into the model. Then, the model calculates the probability density of each proxy type through a Softmax classifier, where First, the payload and packet direction sequences are processed through multiple fully connected layers to obtain the first feature vector.

[0044] Then, the first feature vector is mapped to each category through a linear layer to obtain the first logits value.

[0045] Apply the Softmax function to the first logits value to obtain the probability value of each agent type, and the calculation method of the agent type probability value is: in, For the The proxy type probability value of the proxy type, For the The first logits value of the proxy type, For the The first logits value of the proxy type, Indicates Types of agents, Indicates Types of agents, Represents the total number of proxy types.

[0046] In the formula, Indicates The probability value of the agent type is the output of the Softmax function. It reflects the model's probability that the input data belongs to the agent type, and the value range is between 0 and 1. If it is close to 1, it means that the model is very confident in the judgment of this category; conversely, if it is close to 0, it means that the possibility is low.

[0047] It is The logits value corresponding to the agent type is the original output score of the model on this category. The logits value is not a probability before applying Softmax, but a positive or negative value. It represents the original confidence of the model in this category. After Softmax processing, these values ​​are converted into a form that can be interpreted as probability.

[0048] is any one of the logits values ​​of all agent type categories, which is related to Together they are used to calculate the Softmax denominator. The Softmax function normalizes the exponential of each logits value to ensure that the sum of the probability values ​​of all categories is 1. is the normalization factor, which ensures that the output result is a valid probability distribution.

[0049] at last, Represents the total number of agent types. This is the number of categories in the classification task, and Softmax will be based on this The total number of categories directly affects the complexity of the calculation and the classification accuracy of the model.

[0050] It should be noted that in the proxy traffic classification task, the Softmax function helps the model generate the probability distribution of each proxy type based on the logits value. The model ultimately selects the proxy type with the highest probability value as the classification result. By using the Softmax function, the model can intuitively quantify the possibility of each proxy type, thereby improving the interpretability and accuracy of the classification task.

[0051] Finally, the probability distribution of each agent type is output, and the agent type with the largest probability value is selected as the classification result.

[0052] In step S500, the payload and packet direction sequence in the traffic data to be identified need to be input into the adjusted dedicated traffic identification model. The model generates two key embedding representations through deep learning processing of these two parts of features: payload embedding representation features and sequence embedding representation features.

[0053] In one implementation, first, the payload and packet direction sequence are input into a dedicated traffic identification model, and the task of the model is to perform deep feature extraction on these two inputs. First, the payload, as the core data part of the traffic, carries the actual transmission content of the application layer. This part of the data is input into the Transformer encoder in the dedicated traffic identification model. The encoder captures the key contextual associations and important features in the payload through its multi-head self-attention mechanism, thereby generating more dimensional payload embedding representation features. These features can not only reflect the important content in the payload, but also retain the differences in data among different agent types.

[0054] At the same time, the packet direction sequence is input into the Transformer feature extractor in the model, which is a module specifically used to learn the temporal dynamic characteristics of traffic. The packet direction sequence describes the transmission direction (such as sending or receiving) of each packet in the communication and its time order. The feature extractor analyzes these temporal patterns and uses the sequence modeling capability of the Transformer to capture the potential laws of traffic in packet interaction behavior and generate sequence embedding representation features. This feature can clearly reveal the differences in interaction patterns of different proxy traffic.

[0055] Through these two embedding representations, the model organically combines the static content features of the payload and the dynamic interaction features of the packet direction, providing a more comprehensive and accurate feature basis for the subsequent proxy type classification task. This feature extraction method improves the model's ability to understand complex traffic patterns, especially when facing classification tasks such as encrypted proxies and hidden proxies.

[0056] In one implementation, the process of calculating the probability values ​​of each website category according to the load embedding representation feature and the sequence embedding representation feature and taking the website category with the largest website category probability value as the website classification result includes the following specific steps: First, the load embedding representation features generated by the model are concatenated with the sequence embedding representation features to form a higher-dimensional comprehensive feature vector. The load embedding representation features contain important information about the content of traffic data, while the sequence embedding representation features capture the dynamic behavior patterns of traffic interactions. By concatenating these two features, we can fully combine static and dynamic information to construct a more comprehensive traffic feature expression, ensuring that the model can identify website categories from multiple dimensions.

[0057] Next, the concatenated comprehensive feature vector is input into the Softmax classifier. The Softmax classifier calculates the logits value of each website category and normalizes these values ​​into a probability distribution to obtain the probability value of each website type. Specifically, the Softmax function calculates the proportion of each category in the total probability distribution based on the logits value of each category. This probability distribution can intuitively reflect the model's confidence that the input data belongs to different website categories.

[0058] Finally, among all website categories, the website category with the largest probability value is selected as the final classification result. This website category represents the type of website that the model believes best matches the input traffic characteristics after analyzing the comprehensive feature vector. In this way, the model can accurately classify traffic by website, which not only improves the classification accuracy, but also shows adaptability and robustness in a diverse network environment. This method is suitable for traffic classification tasks in complex network scenarios, such as traffic distribution analysis of multi-type website visits and identification of specific website traffic.

[0059] In one implementation, the process of inputting the comprehensive features into a Softmax classifier for calculation to obtain the probability value of each website type includes the following steps: First, the concatenated comprehensive feature vector is input into multiple fully connected layers. These fully connected layers perform deep feature extraction and representation optimization on the comprehensive features through layer-by-layer nonlinear transformation, thereby generating a more abstract and higher-dimensional second feature vector. The role of the fully connected layer is to fully explore the complex relationship between features, so that the model can better capture the differences between website categories.

[0060] Next, the second eigenvector is mapped through a linear layer. The output of the linear layer is the second logits value of each website category, which represents the unnormalized prediction score of the model for each category. The second logits value directly reflects the relative confidence level of the model for each website category before normalization.

[0061] Then, the Softmax function is applied to these second logits values ​​to convert them into numerical values ​​that can be interpreted as probabilities. The Softmax function calculates the probability value of each website category, and the specific formula is as follows: in, For the The website type probability value of the website type, For the The second logits value of the website type, For the The second logits value of the website type, Indicates Types of websites, Kind Types of websites, Represents the total number of website types.

[0062] This normalization not only converts the output of the model into a standardized probability value, but also intuitively expresses the relative likelihood of each website category. In this way, the model ultimately generates corresponding probability values ​​for each website category, which provide a basis for subsequent classification decisions. The Softmax classifier uses the category with the largest probability value as the classification result of the model, thereby completing the task of classifying the website type of the input traffic data.

[0063] In step S600, the model needs to calculate the probability value of each website category based on the load embedding representation features and sequence embedding representation features generated in the previous stage, and finally determine the website category to which the input traffic data belongs.

[0064] In one implementation, the model selects the category with the largest probability value among all website categories as the final website classification result. This process ensures that the model can accurately classify different types of website traffic, providing support for network management and traffic analysis.

[0065] In step S700, the agent classification result and the website classification result need to be output.

[0066] In one implementation, the model assigns a website category label to each piece of traffic data, such as social media, online shopping, video streaming services, etc. This result can be used to analyze user behavior, optimize network resource allocation, or detect whether there are visits to bad websites in the traffic.

[0067] In another implementation, it can also be directly used in real time by the network security system or management platform. For example, when a proxy classification result is displayed as a risky proxy type, or a website classification result is a restricted access website, the system can trigger a security alarm and take protective measures in time. By outputting the proxy classification and website classification results, network managers can obtain comprehensive and detailed traffic analysis, providing strong support for network security and resource optimization.

[0068] The working process of the present invention is described below using a relatively common scenario as an example.

[0069] The system first obtains three types of data: training traffic data, labeled data, and traffic data to be identified. Training traffic data is used for unsupervised pre-training models, labeled data provides supervision information for model adjustment, and traffic data to be identified is the input object for actual classification.

[0070] Then, the training traffic data is input into the model based on the Transformer architecture. The model extracts time series features from the traffic data through unsupervised learning and generates a general traffic recognition model.

[0071] Extract single-flow data from the traffic data to be identified and further extract features: Next, the payload and packet direction sequence are fed into the adjusted model, which calculates the probability value of the proxy type through the Softmax classifier: Then, after the payload and packet direction sequences are fed into a dedicated traffic identification model, the following embedding features are extracted: The payload embedding and sequence embedding are concatenated into comprehensive features and input into the Softmax classifier to calculate the probability value of the website category: Finally, the system outputs the agent classification results and website classification results: In summary, the present invention provides a method for classifying and identifying bad applications based on traffic timing characteristics, which achieves accurate analysis and classification of complex network traffic by obtaining training data and labeled data, building general and special traffic identification models, extracting payload and data packet direction sequences, and combining payload and timing characteristics for proxy classification and website classification. This method can effectively address the shortcomings of traditional classification methods in encrypted traffic and proxy communications, and improve the accuracy and efficiency of traffic identification. Compared with the prior art, the present invention not only reduces the dependence on a large amount of labeled data, but also improves the classification ability and generalization performance of the model in a complex traffic environment, and is particularly suitable for scenarios such as network security monitoring and identification of bad application traffic. The present invention provides strong technical support for network management and security protection by deeply exploring the timing and content characteristics of traffic, and lays the foundation for building an intelligent and refined network traffic analysis system.

[0072] Reference Figure 2 The second embodiment of the present invention provides a device for classifying and identifying bad applications based on traffic time series characteristics, including: An initial data acquisition module, used to acquire training traffic data, labeled data, and traffic data to be identified; An unsupervised pre-training module, used for inputting the training traffic data into a model based on a Transformer architecture for unsupervised pre-training to obtain a general traffic recognition model; A data segmentation and feature extraction module, used to extract single-flow data from the traffic data to be identified, and extract a payload and a data packet direction sequence from the single-flow data; A fine-tuning and proxy classification module, used to adjust the general traffic identification model through the marking data to obtain a dedicated traffic identification model, perform proxy classification on the traffic data to be identified, and obtain a proxy classification result; A feature embedding generation module, used for inputting the effective load and data packet direction sequence into the dedicated traffic identification model to obtain a load embedding representation feature and a sequence embedding representation feature; A website classification module, used to obtain the probability value of each website category according to the load embedding representation feature and the sequence embedding calculation, and take the website category with the largest website category probability value as the website classification result; The result output module is used to output the agent classification result and the website classification result.

[0073] Preferably, the output of the proxy classification results and website classification results can record the classification results in the form of logs, including the proxy type label, website category label and corresponding probability value of each flow data. These logs are convenient for subsequent query, statistics and analysis, and provide data support for long-term network traffic monitoring and trend analysis.

[0074] Preferably, the agent classification results and website classification results can also be directly input into the network security system or management platform for real-time monitoring and dynamic decision-making. For example, when the system detects a risky agent type or access to a restricted website, it can immediately trigger a security policy, such as blocking the connection, issuing an alarm, or adjusting the network resource configuration to ensure the security and stability of the network environment.

[0075] It should be noted that an apparatus for classifying and identifying bad applications based on traffic timing characteristics provided in an embodiment of the present invention is used to execute all process steps of a method for classifying and identifying bad applications based on traffic timing characteristics in the above-mentioned embodiment. The working principles and beneficial effects of the two correspond one to one, and thus will not be elaborated on herein.

[0076] The embodiment of the present invention also provides an electronic device. The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a feature embedding generation program. When the processor executes the computer program, the steps in the above-mentioned method for classifying and identifying bad applications based on traffic time series features are implemented, such as Figure 1 Alternatively, when the processor executes the computer program, the functions of the modules / units in the above-mentioned device embodiments are implemented, such as the feature embedding generation module.

[0077] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the electronic device.

[0078] The electronic device may be a computing device such as a desktop computer, a notebook, a PDA, and a smart tablet. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above components are merely examples of electronic devices and do not constitute a limitation on the electronic device. The electronic device may include more or fewer components than the above components, or may combine certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0079] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device.

[0080] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the electronic device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0081] Wherein, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0082] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0083] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for classifying and identifying bad applications based on traffic time series characteristics, characterized in that: Executed by a computer, including: Obtain training traffic data, labeled data, and traffic data to be identified; Inputting the training traffic data into a model based on a Transformer architecture for unsupervised pre-training to obtain a general traffic recognition model; Extracting single-stream data from the traffic data to be identified, and extracting a payload and a data packet direction sequence from the single-stream data; The general traffic identification model is adjusted by the marking data to obtain a dedicated traffic identification model, and the traffic data to be identified is subjected to proxy classification to obtain a proxy classification result; Inputting the effective load and data packet direction sequence into the dedicated traffic identification model to obtain a load embedding representation feature and a sequence embedding representation feature; The probability value of each website category is calculated according to the load embedding representation feature and the sequence embedding, and the website category with the largest website category probability value is taken as the website classification result; The proxy classification result and the website classification result are output.

2. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 1 is characterized in that: The step of extracting single-flow data from the traffic data to be identified includes: Extract the IP, port and protocol of each data packet from the traffic data to be identified; Integrate data packets with the same IP, port, and protocol into a single stream of data.

3. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 1 is characterized in that: The step of extracting a payload and a data packet direction sequence from the single stream data comprises: The single stream data includes a data packet, a source IP address and a destination IP address of the data packet; Removing the protocol header information of the data packet and retaining the actual communication content as the payload; The transmission direction of the data packet is determined based on the source IP and the destination IP. +1 is used to represent the data packet sent by the client to the server, and -1 is used to represent the data packet returned by the server to the client. The direction of the data packet is recorded in sequence to obtain a data packet direction sequence.

4. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 1 is characterized in that: The step of adjusting the general traffic identification model by using the marking data to obtain a dedicated traffic identification model, and performing proxy classification on the traffic data to be identified to obtain a proxy classification result includes: The marking data includes a proxy type label for each piece of traffic data; Inputting the labeled data into the general traffic identification model, adjusting the model through supervised training, and obtaining a dedicated traffic identification model; Use the adjusted model to perform proxy classification on the traffic data to be identified and obtain the proxy classification result.

5. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 4 is characterized in that: The adjusted model is used to perform proxy classification on the traffic data to be identified, and a proxy classification result is obtained, including: inputting the payload and packet direction sequence into a model; The probability density of each agent type is calculated by the Softmax classifier; The agent type with the largest agent type probability value is selected as the classification result.

6. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 5 is characterized in that: The probability density of each agent type is calculated by the Softmax classifier, including: Processing the payload and packet direction sequence through multiple fully connected layers to obtain a first feature vector; Mapping the first feature vector to each category through a linear layer to obtain a first logits value; Apply the Softmax function to the first logits value to obtain the probability value of each agent type, and the calculation method of the agent type probability value is: in, For the The proxy type probability value of the proxy type, For the The first logits value of the proxy type, For the The first logits value of the proxy type, Indicates Agent types, Indicates Agent types, Represents the total number of proxy types.

7. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 1 is characterized in that: The step of inputting the effective load and the data packet direction sequence into the dedicated traffic identification model to obtain the load embedding representation feature and the sequence embedding representation feature comprises: inputting said payload and packet direction sequence into a dedicated traffic identification model; Processing the payload through the Transformer encoder in the dedicated traffic identification model, extracting key features therein as payload embedding representation features; The packet direction sequence is input into the Transformer feature extractor in the dedicated traffic identification model to capture the timing pattern of packet interaction as a sequence embedding representation feature.

8. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 1 is characterized in that: The method of obtaining the probability value of each website category according to the load embedding representation feature and the sequence embedding calculation, and taking the website category with the largest website category probability value as the website classification result, comprises: Concatenating the load embedding representation feature and the sequence embedding representation feature to obtain a comprehensive feature; The comprehensive features are input into the Softmax classifier for calculation to obtain the probability value of each website type; The website category with the largest website type probability value is taken as the website classification result.

9. The method for classifying and identifying bad applications based on traffic time series characteristics according to claim 8 is characterized in that: The comprehensive features are input into the Softmax classifier for calculation to obtain the probability values ​​of each website type, including: Processing the comprehensive features through multiple fully connected layers to obtain a second feature vector; Mapping the second feature vector to each website category through a linear layer to obtain a second logits value; Apply the Softmax function to the second logits value to obtain the probability value of each website type, and the calculation method of the website type probability value is: in, For the The website type probability value of the website type, For the The second logits value of the website type, For the The second logits value of the website type, Indicates Types of websites, Kind Types of websites, Represents the total number of website types.

10. A device for classifying and identifying bad applications based on traffic time series characteristics, characterized in that: include: An initial data acquisition module, used to acquire training traffic data, labeled data, and traffic data to be identified; An unsupervised pre-training module, used for inputting the training traffic data into a model based on a Transformer architecture for unsupervised pre-training to obtain a general traffic recognition model; A data segmentation and feature extraction module, used to extract single-flow data from the traffic data to be identified, and extract a payload and a data packet direction sequence from the single-flow data; An adjustment and proxy classification module, used to adjust the general traffic identification model through the marking data to obtain a dedicated traffic identification model, perform proxy classification on the traffic data to be identified, and obtain a proxy classification result; A feature embedding generation module, used for inputting the effective load and data packet direction sequence into the dedicated traffic identification model to obtain a load embedding representation feature and a sequence embedding representation feature; A website classification module, used to obtain the probability value of each website category according to the load embedding representation feature and the sequence embedding calculation, and take the website category with the largest website category probability value as the website classification result; The result output module is used to output the agent classification result and the website classification result.

Images