Malicious encrypted traffic detection method based on behavior intention analysis

Abstract

The invention provides a malicious encrypted traffic detection method based on behavior intention analysis, and belongs to the field of malicious traffic detection in encrypted traffic analysis. Comprising the following steps: providing a differentiated and robust traffic representation method called a traffic behavior matrix, dividing the whole traffic into time slices with fixed lengths, then calculating the accumulated packet lengths of outbound and inbound packets in each time slice, and combining the accumulated packet lengths into a matrix; according to the method, the classification model based on the convolutional neural network is adopted, the classification model learns the robust features of the traffic behavior matrix to ensure the effectiveness of malicious encrypted traffic detection, and malicious encrypted traffic detection in a real scene can be realized through the convolutional neural network model. The problems that malicious encrypted traffic is hidden in massive benign encrypted traffic in an existing real network scene and is difficult to detect, and the accuracy is low when an unbalanced data set is processed are solved.

Description

Technical Field

[0001] The invention relates to a malicious encrypted traffic detection method based on behavior intention analysis, belonging to the field of malicious traffic detection in encrypted traffic analysis. Background Art

[0002] With the rapid development of information and communication technology, more and more websites are using the HTTPS protocol to prevent privacy leakage. However, encryption technology is a double-edged sword, which allows attackers to disguise their attack behaviors, such as malware attacks, denial of service attacks (DoS), and vulnerability mining, through traffic encryption. Malicious encrypted traffic hides the true behavioral intentions of network attacks and increases the difficulty of security detection and defense. Therefore, malicious encrypted traffic detection is of great significance for timely detection of rampant network attacks and deployment of effective defense measures.

[0003] Malicious encrypted traffic detection first extracts highly distinguishable features from encrypted traffic, then inputs them into the classifier, and completes the construction of the classification model after training. An intrusion detection system is a security system used to detect potential intrusions in a network. It detects malicious network activities by real-time analysis and monitoring of network traffic, and takes corresponding protective measures in a timely manner. Malicious traffic disguises itself through encryption, hiding itself in a large amount of normal encrypted traffic. Therefore, an intrusion detection system that can effectively detect malicious encrypted traffic is particularly necessary in a network security system.

[0004] To address the above issues, traditional malicious encrypted traffic detection methods attempt to build signatures by extracting plain text payloads from malicious encrypted traffic. However, encryption technology makes payload-based deep packet inspection methods no longer applicable. In order to deal with malicious encrypted traffic, recent studies have adopted machine learning and deep learning-based methods to detect malicious encrypted traffic. The machine learning-based method extracts contextual flow features, statistical features, and handshake plaintext features, and designs corresponding machine learning models to achieve malicious encrypted traffic detection. The deep learning-based method extracts features, handshake features, statistical and sequential features of each data packet, and builds a specific deep learning model to achieve malicious encrypted traffic detection.

[0005] Traditional machine learning and deep learning methods have achieved remarkable results in malicious encrypted traffic detection tasks. However, in real scenarios, the proportion of malicious encrypted traffic is much lower than that of benign traffic. This asymmetry occurs naturally and originates from the basic characteristics of network traffic and the behavior of attackers. However, existing methods do not take into account the robustness of unbalanced data sets. Due to the risk of overfitting caused by unbalanced data, existing methods often achieve lower accuracy when processing unbalanced data sets. Therefore, the present invention proposes a malicious encrypted traffic detection method based on behavioral intent analysis. Summary of the invention

[0006] The purpose of the present invention is to solve the problems that malicious encrypted traffic is hidden in massive benign encrypted traffic and is difficult to detect in existing real network scenarios, and the accuracy is low when processing unbalanced data sets, and a malicious encrypted traffic detection method based on behavioral intention analysis is proposed.

[0007] Malicious encrypted traffic is concealed, and it hides its behavioral intentions through encrypted traffic to avoid being detected and intercepted by security software. The behavioral intentions of malicious encrypted traffic refer to the goals to be achieved by network attacks, such as unauthorized access, remote file operations, or sensitive data feedback. The present invention designs a new traffic representation method, which constructs a traffic behavior matrix by analyzing the behavioral intentions of malicious encrypted traffic, extracting features including loading order, loading element quantity, loading time, etc., which abstracts the behavioral intention differences between malicious encrypted traffic and benign encrypted traffic. The present invention uses the traffic behavior matrix as a model input and constructs a classifier based on deep learning. The convolutional neural network with cross-entropy loss optimization can extract behavioral intention features and realize malicious encrypted traffic detection. The present invention can be put into practical application scenarios.

[0008] The purpose of the present invention is achieved through the following technical solutions.

[0009] The present invention proposes a malicious encrypted traffic detection method based on behavioral intention analysis, comprising the following steps:

[0010] Step 1: Process the traffic into a traffic behavior matrix.

[0011] A complete network attack tends to perform different behaviors in different time periods, thus forming a behavior pattern and expressing a behavior intention. The present invention proposes a differentiated and robust traffic representation method, called the traffic behavior matrix, which can abstract the difference in behavior intention between malicious encrypted traffic and benign encrypted traffic. The traffic behavior matrix aggregates multi-dimensional information, including packet direction, packet size, and time. First, the traffic behavior matrix divides the entire traffic into time segments of fixed length, and then calculates the cumulative packet length of outbound and inbound packets in each time segment and merges them into a matrix. One or more time segments can constitute a certain behavior, and a series of behaviors can constitute a certain behavior pattern, reflecting its behavior intention.

[0012] Drawing on the concept of traces in the field of website fingerprint recognition, this paper abstracts traffic behavior traces from the original encrypted traffic. In encrypted traffic, the packet length can be used to analyze the payload size of packets carrying malicious content. Different malicious encrypted traffic will have different behavioral intentions and exhibit different behavior patterns when carrying different network attacks, which can be represented as traffic behavior traces, using f k =<t k , lk , d k > indicates that f k is a tuple containing the packet timestamp, packet length, and direction, t k is the arrival time of the kth packet, l k is the packet length of the kth packet, d k is the direction of the kth packet, d k The value of is 1 and -1 indicates the outgoing direction and the incoming direction respectively.

[0013] The present invention designs a traffic behavior matrix to express the characteristics of traffic behavior traces, using M∈R 2×N , where N is the number of time slots considered in the traffic behavior matrix. Assuming that the length of each time slot is denoted by s and the maximum load time considered is denoted by T, N can be calculated from f / s. i j∈M represents the cumulative packet length of data packets arriving or leaving in the time period (j-1)×s to j×s, where the first row of the matrix counts the cumulative packet length of arrivals, and the second row counts the cumulative packet length of departures. i is the row index of the matrix, and j is the column index of the matrix.

[0014] For the traffic behavior trace f k For each packet in the present invention, the column index j is obtained by using the upward rounding function. If j is greater than N, the packet will be discarded; otherwise, by looking at its direction d k To calculate the row index i. Then, the elements in M ​​are updated by calculating the cumulative packet length for the data packets in each time slot. Finally, the obtained M is returned as the traffic behavior matrix.

[0015] Step 2: Use the traffic behavior matrix obtained in step 1 to train the convolutional neural network.

[0016] In order to realize the automatic learning of traffic behavior intention features, the present invention adopts a classification model based on convolutional neural network (CNN), which learns the robust features of the traffic behavior matrix obtained in step 1 to ensure the effectiveness of malicious encrypted traffic detection. Next, the present invention will introduce the model from the aspects of model input, model structure, loss function, and avoiding overfitting.

[0017] Model input. Each sample M∈R "×$ As input to the convolutional neural network model.

[0018] Model structure. Unlike models that mainly process one-dimensional input, the present invention designs a new model that can process two-dimensional matrices as input. The present invention adopts a two-dimensional convolutional block to extract information-rich behavioral intention features. The convolutional block consists of two convolutional layers with a linear rectifier function (ReLU) to add nonlinearity, a batch normalization (BN) layer to promote the convergence of the neural network and prevent overfitting, and a maximum pooling layer with a regularization technique dropout.

[0019] After extracting features from the uplink and downlink packets using two 2D convolution blocks respectively, the present invention reshapes the output with 64 channels into a one-dimensional vector with 32 channels to facilitate further feature extraction by a one-dimensional convolution block. This reshaping operation effectively doubles the size of the feature map, enabling deeper networks to capture more complex and advanced features.

[0020] The present invention replaces the normal fully connected layer with a global average pooling layer (GAP layer), and the number of parameters is significantly reduced, which significantly improves the training efficiency and reduces the risk of overfitting. The GAP layer accepts the output of the last convolutional layer and performs an average operation on each feature map in the time dimension, which reduces the spatial dimension of the feature map while retaining the channel information. Deep neural networks often have mediocre performance due to their low computational efficiency and easy overfitting. Although convolutional neural networks (CNNs) have been proposed as a means to solve these problems, fully connected layers are still an important source of parameter redundancy, which will damage the robustness of the classifier. In order to alleviate overfitting and enhance the stability of the classifier, the present invention adopts global average pooling (GAP) as an alternative to the traditional fully connected layer in the final stage of the architecture. GAP effectively reduces the number of parameters of the network, thereby minimizing the risk of overfitting while maintaining classification capabilities. In addition, the inherent flexibility of GAP enables it to accommodate inputs of different shapes. This feature enables the present invention to adjust the input length N without modifying the underlying network structure, thereby facilitating the training of new classifiers. In summary, integrating GAP into the architecture of the present invention not only solves the challenges of computational efficiency and overfitting, but also enhances the adaptability and generalization ability of the classifier.

[0021] The convolutional neural network-based classifier designed by the present invention consists of two consecutive two-dimensional convolution modules, two consecutive one-dimensional convolution modules and a classification module. In the first two-dimensional convolution module, there is a two-dimensional continuous convolution layer and a two-dimensional batch normalization layer before the two-dimensional maximum pooling layer. The second two-dimensional convolution module has the same structure as the first two-dimensional convolution module. Similarly, in the first one-dimensional convolution module, there is a one-dimensional convolution layer and a one-dimensional batch normalization layer before the one-dimensional maximum pooling layer. The second one-dimensional convolution module has the same structure as the first one-dimensional convolution module. The classification module consists of a one-dimensional convolution layer, a one-dimensional batch normalization layer and a GAP layer. The classification granularity is benign / malicious encrypted traffic.

[0022] Loss function. The present invention uses cross entropy loss to optimize convolutional neural networks.

[0023] Malicious encrypted traffic detection is essentially a multi-classification task, so the present invention uses cross entropy loss to measure the prediction value. and the difference between the ground truth y.

[0024] Avoid overfitting. There is a risk of overfitting in the training process of the neural network. In the model of the present invention, the present invention adds a dropout layer at the end of each block, which will stop the neuron with a certain probability, which is determined to be 0.1 in the forward propagation.

[0025] Through the convolutional neural network model proposed in step 2, the present invention can realize malicious encrypted traffic detection in real scenarios.

[0026] Beneficial Effects

[0027] 1. The present invention can detect malicious encrypted traffic in real scenarios where the proportion of malicious encrypted traffic is much lower than that of benign traffic.

[0028] 2. The malicious encrypted traffic detection model designed by the present invention does not require expert knowledge and feature engineering. It is only based on characteristics such as the network traffic transmission time and data packet length, which greatly reduces the time complexity of the algorithm model, enabling the model to achieve high-precision malicious encrypted traffic detection with low time overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of the malicious encrypted traffic detection method based on behavioral intent analysis of the present invention. DETAILED DESCRIPTION

[0030] In order to better illustrate the purpose and advantages of the present invention, the invention is further described below in conjunction with the accompanying drawings and embodiments.

[0031] Example

[0032] For scenarios with different imbalanced datasets, the malicious encrypted traffic detection method based on behavioral intent analysis disclosed in this embodiment is as follows: Figure 1 As shown, the specific implementation steps are as follows:

[0033] Step 1: Process the traffic into a traffic behavior matrix.

[0034] A complete network attack tends to perform different behaviors in different time periods, thus forming a behavior pattern and expressing a behavior intention. The present invention proposes a differentiated and robust traffic representation method, called the traffic behavior matrix, which can abstract the difference in behavior intention between malicious encrypted traffic and benign encrypted traffic. The traffic behavior matrix aggregates multi-dimensional information, including packet direction, packet size, and time. First, the traffic behavior matrix divides the entire traffic into time segments of fixed length, and then calculates the cumulative packet length of outbound and inbound packets in each time segment and merges them into a matrix. One or more time segments can constitute a certain behavior, and a series of behaviors can constitute a certain behavior pattern, reflecting its behavior intention.

[0035] Drawing on the concept of traces in the field of website fingerprint recognition, this paper abstracts traffic behavior traces from the original encrypted traffic. In encrypted traffic, the packet length can be used to analyze the payload size of packets carrying malicious content. Different malicious encrypted traffic will have different behavioral intentions and exhibit different behavior patterns when carrying different network attacks, which can be represented as traffic behavior traces, using f k =<t k , l k , d k > indicates that f k is a tuple containing the packet timestamp, packet length, and direction, t k is the arrival time of the kth packet, l k is the packet length of the kth packet, d k is the direction of the kth packet, d k The value of is 1 and -1, indicating the outgoing direction and the incoming direction respectively.

[0036] The present invention designs a traffic behavior matrix to express the characteristics of traffic behavior traces, using M∈R 2×N , where N is the number of time slots considered in the traffic behavior matrix. Assuming that the length of each time slot is denoted by s and the maximum load time considered is denoted by T, N can be calculated by T / s. i j∈M represents the cumulative packet length of data packets arriving or leaving in the time period (j-1)×s to j×s, where the first row of the matrix counts the cumulative packet length of arrivals, and the second row counts the cumulative packet length of departures. i is the row index of the matrix, and j is the column index of the matrix.

[0037] For the traffic behavior trace f k For each packet in the present invention, the column index j is obtained by using the upward rounding function. If j is greater than N, the packet will be discarded; otherwise, by looking at its direction d k To calculate the row index i. Then, the elements in M ​​are updated by calculating the cumulative packet length for the data packets in each time slot. Finally, the obtained M is returned as the traffic behavior matrix.

[0038] Step 2: Use the traffic behavior matrix obtained in step 1 to train the convolutional neural network.

[0039] In order to realize the automatic learning of traffic behavior intention features, the present invention adopts a classifier based on convolutional neural network (CNN), which learns the robust features of the traffic behavior matrix obtained in step 1 to ensure the effectiveness of malicious encrypted traffic detection. Next, the present invention will introduce the model from the aspects of model input, model structure, loss function, and avoiding overfitting.

[0040] Model input. Each sample M∈R 2×N As input to the convolutional neural network model.

[0041] Model structure. Unlike models that mainly process one-dimensional input, the present invention designs a new model that can process two-dimensional matrices as input. The present invention adopts a two-dimensional convolutional block to extract information-rich behavioral intention features. The convolutional block consists of two convolutional layers with a linear rectifier function (ReLU) to add nonlinearity, a batch normalization (BN) layer to promote the convergence of the neural network and prevent overfitting, and a maximum pooling layer with a regularization technique dropout.

[0042] After extracting features from the uplink and downlink packets using two 2D convolution blocks respectively, the present invention reshapes the output with 64 channels into a one-dimensional vector with 32 channels to facilitate further feature extraction by a one-dimensional convolution block. This reshaping operation effectively doubles the size of the feature map, enabling deeper networks to capture more complex and advanced features.

[0043] The present invention replaces the normal fully connected layer with a global average pooling layer (GAP layer), and the number of parameters is significantly reduced, which significantly improves the training efficiency and reduces the risk of overfitting. The GAP layer accepts the output of the last convolutional layer and performs an average operation on each feature map in the time dimension, which reduces the spatial dimension of the feature map while retaining the channel information. Deep neural networks often have mediocre performance due to their low computational efficiency and easy overfitting. Although convolutional neural networks (CNNs) have been proposed as a means to solve these problems, fully connected layers are still an important source of parameter redundancy, which will damage the robustness of the classifier. In order to alleviate overfitting and enhance the stability of the classifier, the present invention adopts global average pooling (GAP) as an alternative to the traditional fully connected layer in the final stage of the architecture. GAP effectively reduces the number of parameters of the network, thereby minimizing the risk of overfitting while maintaining classification capabilities. In addition, the inherent flexibility of GAP enables it to accommodate inputs of different shapes. This feature enables the present invention to adjust the input length N without modifying the underlying network structure, thereby facilitating the training of new classifiers. In summary, integrating GAP into the architecture of the present invention not only solves the challenges of computational efficiency and overfitting, but also enhances the adaptability and generalization ability of the classifier.

[0044] The convolutional neural network-based classifier designed by the present invention consists of two consecutive two-dimensional convolution modules, two consecutive one-dimensional convolution modules and a classification module. In the first two-dimensional convolution module, there is a two-dimensional convolution layer with a dimension of [32, 32] and a two-dimensional batch normalization layer before the two-dimensional maximum pooling layer. The second two-dimensional convolution module has the same structure as the first two-dimensional convolution module, and the dimension of the two-dimensional convolution layer is [64, 64]. Similarly, in the first one-dimensional convolution module, there is a one-dimensional convolution layer with a dimension of [128, 128] and a one-dimensional batch normalization layer before the one-dimensional maximum pooling layer. The second one-dimensional convolution module has the same structure as the first one-dimensional convolution module, and the dimension of the one-dimensional convolution layer is [256, 256]. The classification module consists of a one-dimensional convolution layer, a one-dimensional batch normalization layer, and a global average pooling layer GAP. The classification granularity is benign / malicious encrypted traffic.

[0045] Loss function. The present invention uses cross entropy loss to optimize convolutional neural networks.

[0046] Malicious encrypted traffic detection is essentially a multi-classification task, so the present invention uses cross entropy loss to measure the prediction value. and the difference between the ground truth y.

[0047] Avoid overfitting. There is a risk of overfitting in the training process of the neural network. In the model of the present invention, the present invention adds a dropout layer at the end of each block, which will stop the neuron with a certain probability, which is determined to be 0.1 in the forward propagation.

[0048] This embodiment conducts experimental evaluation in scenarios with different proportions of unbalanced data sets. The present invention selects the domestic advanced method FC-Net as the comparison method of the present invention. The F1 value is selected as an indicator for comprehensive evaluation of the performance of the detection model. It combines the precision and recall rate and is the harmonic mean of these two indicators. The detection results are shown in Table 1, which shows that the present invention can achieve better detection effects in scenarios with different proportions of unbalanced data sets.

[0049] Table 1 Malicious encrypted traffic detection effects in scenarios with different proportions of unbalanced datasets

[0050] Benign to malicious traffic ratio Comparison method FC-Net detection F1 value The present invention detects the F1 value 1:1 83.19％ 93.63％ 5:1 78.38％ 90.53％ 10:1 76.75％ 90.12％ 25:1 69.27％ 88.28％

[0051] The above description describes the implementation mode of the present invention in combination with the drawings and embodiments. However, for those skilled in the art, several improvements can be made without departing from the principle of the present invention, and these also belong to the protection scope of the present invention.

Claims

1. A malicious encrypted traffic detection method based on behavioral intention analysis, characterized in that: The following steps are involved: Step 1: Process traffic into a traffic behavior matrix A complete network attack tends to perform different behaviors in different time periods, thus forming a behavior pattern and expressing a behavior intention. The present invention proposes a differentiated and robust traffic representation method, called the traffic behavior matrix, which can abstract the difference in behavior intention between malicious encrypted traffic and benign encrypted traffic. The traffic behavior matrix aggregates multi-dimensional information, including packet direction, packet size and time. First, the traffic behavior matrix divides the entire traffic into time segments of fixed length, and then calculates the cumulative packet length of outbound and inbound packets in each time segment and merges them into a matrix. One or more time segments can constitute a certain behavior, and a series of behaviors can constitute a certain behavior pattern, reflecting its behavior intention; Step 2: Use the traffic behavior matrix obtained in step 1 to train the convolutional neural network In order to realize automatic learning of traffic behavior intention features, the present invention adopts a classification model based on convolutional neural network (CNN). The classification model learns the robust features of the traffic behavior matrix obtained in step 1 to ensure the effectiveness of malicious encrypted traffic detection. The classification model includes model input, model structure, loss function, and avoiding overfitting. Through the convolutional neural network model proposed in step 2, the present invention can realize malicious encrypted traffic detection in real scenarios.

2. A malicious encrypted traffic detection method based on behavioral intention analysis as claimed in claim 1, characterized in that: Step 1 specifically includes the following steps: Drawing on the concept of traces in the field of website fingerprint recognition, the present invention abstracts traffic behavior traces from the original encrypted traffic. In the encrypted traffic, the packet length can be used to analyze the payload size of the packet carrying malicious content. Different malicious encrypted traffic will have different behavioral intentions and show different behavior patterns when carrying different network attacks, which can be represented as traffic behavior traces. k = <t k , l k , d k > indicates that f k is a tuple containing the packet timestamp, packet length, and direction, t k is the arrival time of the kth packet, l k is the packet length of the kth packet, d k is the direction of the kth packet, d k The values ​​of 1 and -1 represent the outgoing and incoming directions respectively; The present invention designs a traffic behavior matrix to express the characteristics of traffic behavior traces, using M∈R 2×N It is represented by, where N is the number of time slots considered in the traffic behavior matrix. Assuming that the length of each time slot is denoted by s and the maximum load time considered is denoted by T, N can be calculated by f / s. The element m ij ∈M represents the cumulative packet length of data packets arriving or leaving in the time period (j-1)×s to j×s, where the first row of the matrix counts the cumulative packet length of arrival, the second row counts the cumulative packet length of departure, i is the row index of the matrix, and j is the column index of the matrix; For the traffic behavior trace f k For each packet in the present invention, the column index j is obtained by using the upward rounding function. If j is greater than N, the packet will be discarded; otherwise, by checking its direction d k To calculate the row index i; then, update the elements in M ​​by calculating the cumulative packet length of the data packets in each time slot; finally, return the obtained M as the traffic behavior matrix.

3. A malicious encrypted traffic detection method based on behavioral intention analysis as described in claim 1 or 2, characterized in that: The classification model in step 2 includes model input, model structure, loss function, and avoiding overfitting, specifically: The model inputs each sample M∈R 2×N As input to the convolutional neural network model; Model structure Different from the model that mainly processes one-dimensional input, the present invention designs a new model that can process two-dimensional matrix as input. The present invention adopts a two-dimensional convolution block to extract information-rich behavioral intention features. The convolution block consists of two convolution layers with a linear rectifier function (ReLU), adding nonlinearity, a batch normalization (BN) layer to promote the convergence of the neural network and prevent overfitting, and a maximum pooling layer with a regularization technique dropout; After extracting features from the uplink data packet and the downlink data packet using two two-dimensional convolution blocks respectively, the present invention reshapes the output with 64 channels into a one-dimensional vector with 32 channels to facilitate further feature extraction through a one-dimensional convolution block. This reshaping operation effectively doubles the size of the feature map, enabling a deeper network to capture more complex and advanced features. The present invention replaces the normal fully connected layer with a global average pooling layer (GAP layer), and the number of parameters is significantly reduced, which significantly improves the training efficiency and reduces the risk of overfitting. The GAP layer accepts the output of the last convolutional layer and performs an average operation on each feature map in the time dimension, which reduces the spatial dimension of the feature map while retaining the channel information. Deep neural networks often have mediocre performance due to their low computational efficiency and easy overfitting. Although convolutional neural networks (CNNs) have been proposed as a means to solve these problems, the fully connected layer is still an important source of parameter redundancy, which will damage the robustness of the classifier. In order to alleviate overfitting, Fitting and enhancing the stability of the classifier. The present invention adopts global average pooling (GAP) as an alternative to the traditional fully connected layer in the final stage of the architecture. GAP effectively reduces the number of parameters of the network, thereby minimizing the risk of overfitting while maintaining the classification ability. In addition, the inherent flexibility of GAP enables it to accommodate inputs of different shapes. This feature enables the present invention to adjust the input length N without modifying the underlying network structure, thereby facilitating the training of new classifiers. In short, integrating GAP into the architecture of the present invention not only solves the challenges of computational efficiency and overfitting, but also enhances the adaptability and generalization ability of the classifier. The convolutional neural network-based classifier designed by the present invention consists of two consecutive two-dimensional convolution modules, two consecutive one-dimensional convolution modules and a classification module. In the first two-dimensional convolution module, there is a two-dimensional continuous convolution layer and a two-dimensional batch normalization layer before the two-dimensional maximum pooling layer, and the second two-dimensional convolution module has the same structure as the first two-dimensional convolution module; similarly, in the first one-dimensional convolution module, there is a one-dimensional convolution layer and a one-dimensional batch normalization layer before the one-dimensional maximum pooling layer, and the second one-dimensional convolution module has the same structure as the first one-dimensional convolution module; The classification module consists of a one-dimensional convolution layer, a one-dimensional batch normalization layer, and a GAP layer, and the classification granularity is benign / malicious encrypted traffic; The loss function of this paper adopts cross entropy loss to optimize the convolutional neural network Malicious encrypted traffic detection is essentially a multi-classification task, so the present invention uses cross entropy loss to measure the prediction value. and the difference between the ground truth y; Avoiding Overfitting There is a risk of overfitting in the training process of the neural network. In the model of the present invention, a dropout layer is added at the end of each block, which will stop the neuron from working with a certain probability, which is determined to be 0.1 in the forward propagation.

Images