Malicious traffic classification method based on convolutional neural network

Abstract

The invention discloses a malicious traffic classification method based on a convolutional neural network. An existing method is high in misjudgment rate and poor in classification effect. According to the malicious traffic classification method based on the convolutional neural network provided by the invention, high-accuracy malicious traffic classification is realized through conversion of original traffic data into a grey-scale map, traffic data potential feature extraction, classification model training and malicious traffic data training. The method comprises the following steps: firstly, preparing training data of a classification model, designing and training a malicious traffic classification model based on a convolutional neural network, preprocessing acquired malicious traffic data, and inputting the preprocessed malicious traffic data into the trained classification model, so as to judge whether the current traffic is malicious traffic or not. According to the method, the improved MobileNetV2 model and the improved Mama model are combined, local features and global features are processed at the same time, the change of an actual network environment can be dealt with, the classification accuracy is improved, and the actual availability and robustness are enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of network security and network defense technology, in particular to the field of malicious traffic classification, and specifically relates to a malicious traffic classification method based on a convolutional neural network. Background Art

[0002] The rapid development of the Internet has brought many conveniences, such as reshaping the way we obtain information, promoting wireless communications across distances, and optimizing the landscape of business operations. However, this revolutionary progress also brings potential risks. Malicious traffic poses a serious threat to the safe and stable operation of the network, which may cause network system paralysis, sensitive data leakage, and infringement of personal privacy. Therefore, the classification of malicious traffic is proposed.

[0003] At present, the research methods for malicious traffic identification are mainly divided into three categories: rule-based methods, machine learning methods, and deep learning methods. Traffic identification methods have also experienced a development from rule-based methods to machine learning methods, deep learning methods, and then to multiple methods in parallel. Early research mainly used rule-based methods to identify malicious traffic, that is, using the characteristics of basic attributes such as communication protocols, port numbers, and message lengths of traffic data to manually formulate security rules to check abnormal behavior. With the development of the network environment, rule-based methods have exposed defects such as high demand for expert knowledge, long time consumption, and difficulty in responding to new traffic encryption and anonymity technologies, and cannot meet the needs of security personnel for traffic analysis.

[0004] In order to adapt to the complex traffic data in the new network environment, researchers introduced algorithms in the field of machine learning such as random forests, logistic regression, and support vector machines to identify high-dimensional features of traffic data. Machine learning methods can effectively analyze complex traffic data, but these methods still rely on traffic statistical features designed by experts, and the performance of features in different actual application scenarios is unstable and requires manual selection and adjustment.

[0005] Different from the above methods, deep learning-based methods do not require pre-set artificial features when analyzing traffic. Instead, they use deep learning methods to directly perform end-to-end analysis and classification. They have become the research focus of automatically extracting traffic features and improving traffic classification effects.

[0006] The above method usually has a good effect on the classification problem of known malicious traffic with a large amount of labeled data, but in actual application scenarios. The data labeling of new malicious traffic data is usually very complicated and requires a lot of time and financial costs. In the case of a small amount of labeled data, the existing methods cannot effectively classify malicious traffic and often make misjudgments. The Chinese invention patent application with application number CN201910858882.8 discloses a network intrusion detection method in a small sample scenario based on meta-learning. The method uses F-Net built with a convolutional neural network to extract the final representation of the network flow, and then uses C-Net to evaluate the difference between the query sample and each category sample in the sampling set in turn, and finally calculates the average of each class, and selects the class represented by the minimum value as the label of the query sample. Its limitation is that only the local features of the malicious traffic data are extracted, without considering the global features of the data, thereby ignoring some effective information of the malicious traffic data. The Chinese invention patent application with application number CN202310253979.2 discloses a small sample abnormal traffic detection method and system. This method converts the data packet into grayscale image data, and then uses a sliding window method to sequentially combine three adjacent grayscale images into RGB images. Finally, a convolutional neural network is used to construct a twin neural network model for subsequent malicious traffic detection tasks. Its limitation is also that only local features are extracted, and the global feature processing of malicious traffic data is ignored. The Chinese invention patent application with application number CN202410770288.4 discloses a malicious traffic identification and classification method and system based on an attention mechanism. This method uses a multi-scale perception fusion attention mechanism to perform feature mapping of different scales on multi-scale network traffic features, and performs attention weighted fusion on network traffic mapping features of different scales to obtain fused scale network traffic features, and then classifies and identifies based on the fused scale network traffic features to determine the malicious classification and identification results of the network traffic. Its limitation is that it does not take into account the characteristics of malicious traffic data with less effective semantic information and more redundant information. A large amount of redundant information is used to learn the features of malicious traffic, which reduces the accuracy of malicious traffic classification.

[0007] There are many deficiencies in the existing technology. First, the existing methods usually have good classification effects when there is a large amount of known annotated data, but when data is scarce, the trained models often make misjudgments; second, the existing methods usually use raw traffic data for feature extraction, and the methods used are mostly designed for image data, which leads to poor classification effects; third, the existing methods mostly use neural network models with good effects in other fields, and do not design special models for the characteristics of malicious traffic data with less semantic information. In view of the above problems, the present invention aims to propose a malicious traffic classification method under the condition of a small amount of annotated data, further improve the classification accuracy of malicious traffic data from data preprocessing, potential feature extraction, classification model design and model training, and enhance the usability and robustness in actual scenarios. Summary of the invention

[0008] The purpose of the present invention is to provide a malicious traffic classification method based on a convolutional neural network in a new malicious traffic classification scenario, in order to address the problems of difficult and high labeling costs for data, low classification accuracy and poor practical usability of existing classification methods. The method realizes malicious traffic classification with high accuracy through the steps of converting original traffic data into grayscale images, extracting potential features of traffic data, training classification models and training malicious traffic data.

[0009] The method of the present invention specifically comprises:

[0010] Step (1) Prepare training data for the malicious traffic classification model: Download known malicious traffic data from the Internet as raw traffic data; convert the raw traffic data into grayscale data that is more convenient for classification through slicing, truncation, zero padding, and pixel value mapping operations. The specific steps of data conversion are as follows:

[0011] (1-1) Data slicing: The original PCAP file is split into data streams. The data packets in the PCAP file are grouped according to the five-tuple information and arranged in chronological order; the five-tuple information is the source IP address, destination IP address, source port, destination port, and protocol. This step ensures that each data stream is a set of data packets with the same five-tuple information, thereby maintaining the relevance and order between data packets.

[0012] (1-2) Data uniform length processing: retain the first 784 bytes of each file and discard all information from 785 bytes onwards. If the file length is less than 784 bytes, add 0x00 bytes to the end of the file. The purpose of this is to standardize the length of all data stream files to facilitate subsequent image conversion and model processing.

[0013] (1-3) Pixel value mapping: Map each byte data value to a grayscale pixel value, where 0x00 corresponds to black and 0xff corresponds to white. The final output image format is PNG. This step converts the data stream file from binary form to image form, so that it can be processed by deep learning models such as convolutional neural networks.

[0014] The processed data is used as training data for implementing the malicious traffic classification model in step (3).

[0015] Step (2) Design a malicious traffic classification model: The model is constructed based on a convolutional neural network, an S2M module, a Mamba module, a global pooling layer, and a linear layer. Each convolutional layer is connected to a batch normalization layer and a nonlinear activation layer.

[0016] Specifically, the model consists of a convolutional layer with a convolution kernel size of n×n, multiple cross-designed S2M modules and S2MMamba modules, a global pooling layer and a linear layer. The S2M module separates the token mixer and the channel mixer based on the MobileNetV2 module, and simplifies the structure of the module through the reparameterization technique, and finally obtains the S2M module; the specific steps include using an n×n depth-separable convolutional layer to integrate spatial information along the channel direction, and then using a residual connection and two 1×1 convolutional layers to learn the relationship between different channel features; the S2MMamba module consists of a convolutional layer with a convolution kernel size of n×n, a convolutional layer with a convolution kernel size of 1×1, n Mamba modules, a convolutional layer with a convolution kernel size of 1×1 and a convolutional layer with a convolution kernel size of n×n. The Mamba module consists of neural network layers such as a root mean square normalization layer, a linear layer and a selective state space model.

[0017] Step (3) trains the malicious traffic classification model as follows:

[0018] (3-1) Parameter initialization: Randomly initialize the weight parameter w of the learning network scene and the bias parameter b scene , initialize the iteration round e scene =0, set the initial learning rate η scene , training sample batch size bs scene , maximum iteration round E scene ;

[0019] (3-2) Data batching: according to the set sample batch size bs scene The dataset Divide evenly into P scene batches, and the malicious traffic data subset of each batch is represented as The corresponding label set is

[0020] (3-3) Data input: Randomly select a subset of data from a batch of training data The data is sent to the classification model designed in step (2), and the feature representation of the data is extracted through the convolution layer, the improved MobileViT module and the Mamba module. The global pooling layer and the linear layer are input to obtain the predicted label set of the batch data.

[0021] (3-4) Parameter update: According to the true label of the batch data and the predicted label set Calculate the loss function value loss scene , and according to the loss function value loss scene Update model parameters;

[0022] (3-5) Single round training: When the e scene Round P scene If all batches of data are input into the classification model, it means that the round of training is over and goes to step (3-6), otherwise it returns to step (3-3);

[0023] (3-6) Training end judgment: When the loss function loss scene In continuous E s ' cene The reduction in the wheel is less than σ scene , where E s ' cene is the minimum number of convergence rounds to determine whether the classification model has converged, σ scene To judge the loss scene If the threshold value no longer decreases, it indicates that the classification model has converged, and step (3-8) is executed; otherwise, step (3-7) is executed;

[0024] (3-7) If e scene <E scene , then e scene =e scene +1, continue iterating and return to step (3-2); if e scene =E scene , indicating that the classifier training is completed and proceed to step (3-8);

[0025] (3-8) Model saving: Save the optimal weight parameters of the classifier model and the optimal bias parameters

[0026] Step (4) Identify the types of malicious traffic data:

[0027] (4-1) Preprocessing malicious traffic data using the same method as step (1);

[0028] (4-2) Input a convolution layer with a convolution kernel size of n×n for preliminary feature extraction;

[0029] (4-3) Use multiple S2M modules for deep local feature extraction;

[0030] (4-4) Intersperse S2MMamba modules between multiple S2M modules to further extract global features:

[0031] The S2MMamba module first passes the feature map output by the previous neural network layer through a convolution layer with a convolution kernel size of n×n to perform local feature modeling, and then adjusts the number of channels through a convolution layer with a convolution kernel size of 1×1 to obtain the output represents the real number domain, H and W represent the height and width of the effective receptive field respectively, and d represents the dimension; then Expand into N non-overlapping one-dimensional vectors Among them, the effective receptive field patch is divided into N small areas according to the fixed area P = wh, and the number of one-dimensional vectors obtained by expansion is The height h and width w of each patch are the height and width of each one-dimensional vector, h≤n, w≤n, and n is the size of the convolution kernel. Then, the Mamba module is used to encode each pixel p∈{1,2,…,P} in each patch to obtain N one-dimensional vectors with global feature information. N one-dimensional vectors with global feature information Collapse back to a high-dimensional vector

[0032] Through a convolution layer with a convolution kernel size of 1×1, the number of channels is adjusted back to the original size and mapped back to the low-dimensional feature space. Then, it is spliced ​​with the original input feature map along the channel direction through a residual connection, and finally, through a convolution layer with a convolution kernel size of n×n, the feature fusion is performed to obtain the output feature;

[0033] (4-5) Use the classifier to obtain the final classification output: The specific steps of the classifier include using a 1×1 convolution layer for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flattening the feature map into a one-dimensional vector, adding a Dropout layer to prevent overfitting, and finally performing classification output through a linear layer.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. In view of the environment where labeled data is scarce, the present invention proposes a malicious traffic classification method based on a small amount of labeled data, which can achieve extremely high classification accuracy with a small amount of labeled data.

[0036] 2. The present invention combines the improved MobileNetV2 model with the Mamba model to process both local features and global features, thereby better realizing the extraction of malicious traffic features.

[0037] 3. The present invention converts the traffic data into grayscale data that is more convenient for classification through operations such as flow data slicing, truncation, zero padding, and pixel value mapping, thereby better analyzing and extracting the potential features of the traffic data.

[0038] 4. The present invention takes into account the characteristics of malicious traffic data with less effective semantic information and more redundant information, uses the Mamba module with a selective state space model, and utilizes the mechanism of meta-learning to learn how to retain as much effective semantic information as possible in the feature extraction process and filter out useless information, thereby improving the effectiveness of the extracted features and further improving the accuracy of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of the overall framework of malicious traffic classification of the present invention;

[0040] Figure 2 It is a schematic diagram of the data preprocessing steps of the present invention;

[0041] Figure 3 is a schematic diagram of a malicious traffic classification model in the method of the present invention;

[0042] Figure 4 is a schematic diagram of the S2M module in the method of the present invention;

[0043] Figure 5 is a schematic diagram of the S2MMamba module in the method of the present invention;

[0044] Figure 6 It is a schematic diagram of the Mamba module in the method of the present invention. DETAILED DESCRIPTION

[0045] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0046] This embodiment is based on a small amount of annotated data in the CIC-AndMal2017 and USTC-TFC2016 datasets to illustrate the malicious traffic classification method based on a small amount of annotated data based on a convolutional neural network and a selective state space model proposed in the present invention. The overall framework is as follows: Figure 1 shown.

[0047] Step (1) obtain a small amount of traffic data marked as specific malicious traffic types (including beanbot, plankton, smssniffer and other malicious traffic types in this example) and normal traffic types from the CIC-AndMal2017 and USTC-TFC2016 datasets for training, and convert the original traffic data into grayscale data that is more convenient for classification through slicing, truncation, zero padding, and pixel value mapping operations. The specific data conversion is as follows: Figure 2 As shown:

[0048] 1. Data slicing: Split the original PCAP file into data streams. Group the data packets in the PCAP file according to the five-tuple information (source IP address, destination IP address, source port, destination port and protocol) and arrange them in chronological order.

[0049] 2. Data uniform length processing: The first 784 bytes of each data stream file in the CIC-AndMal2017 and USTC-TFC2016 datasets are retained, and the information after 785 bytes is discarded. For files with a length of less than 784 bytes, 0x00 bytes are added to achieve a uniform length to facilitate subsequent image conversion and model processing.

[0050] 3. Pixel value mapping: Map each byte data value to a grayscale pixel value, where 0x00 corresponds to black (0) and 0xff corresponds to white (255). The final output image data format is PNG.

[0051] Step (2) Design a malicious traffic classification model:

[0052] like Figure 3 As shown in the figure, the model is constructed based on convolutional neural network, S2M module (improved MobileNetV2 module), Mamba module, global pooling layer and linear layer. In the convolutional neural network, each convolutional layer is connected to a batch normalization layer and a SiLU nonlinear activation layer. The improved MobileNetV2 module and Mamba module are used to extract local features and global features respectively.

[0053] Specifically, the model consists of a convolutional layer with a convolution kernel size of n×n, multiple cross-designed S2M modules and S2MMamba modules, a global pooling layer, and a linear layer. The S2M module separates the token mixer and channel mixer based on the MobileNetV2 module, and simplifies the structure of the module through reparameterization techniques. The resulting S2M module is shown in the figure below. Figure 4As shown in Figure 1, the specific steps include using an n×n (n=3 in this example) depth-wise separable convolutional layer to integrate spatial information along the channel direction, and then using a residual connection and two 1×1 convolutional layers to learn the relationship between different channel features. Figure 5 As shown in FIG. 1 , it is composed of a convolution layer with a convolution kernel size of n×n (n=3 in this example), a convolution layer with a convolution kernel size of 1×1, n Mamba modules (n=1 in this example), a convolution layer with a convolution kernel size of 1×1, and a convolution layer with a convolution kernel size of n×n (n=3 in this example). Among them, the Mamba module is as follows Figure 6 As shown, it specifically includes neural network layers such as root mean square normalization layer, linear layer and selective state space model.

[0054] Step (3) Train the malicious traffic classification model:

[0055] Use the small amount of labeled malicious traffic data obtained in step (1) to train the malicious traffic classification model. The details are as follows:

[0056] (3-1) Parameter initialization: Randomly initialize the weight parameters and bias parameters in the model. Set the initial learning rate to η scene (In this example, n scene =0.001), the training sample batch size is bs scene (In this example, bs scene =64), the maximum number of iterations is E scene (In this example, E scene =200), that is, in each iteration, the model will process 64 samples until 200 iterations are completed.

[0057] (3-2) Data batching: The preprocessed data set is evenly divided into P scene Each batch contains 64 malicious traffic data subsets and their corresponding labels. In this example, 1000 samples are selected, then P scene =16(1000 / 64), each batch contains 64 samples, and the last batch may contain fewer samples.

[0058] (3-3) Data input: In each round of training, a batch of data subsets is randomly selected In this example, the 64 samples are sent to the model one by one. The model extracts the feature representation of each sample through the convolutional layer, the improved MobileNetV2 module and the Mamba module.

[0059] (3-4) Parameter update: According to the true label of the batch data (In this embodiment and the label set predicted by the model (In this embodiment ) Calculate the loss function value Use a gradient descent-based optimizer (in this example, the AdamW optimizer with decoupled weight decay regularization method is used) to update the weight parameters and bias parameters

[0060]

[0061] (3-5) Single round training: When P in a round scene (In this example, P scene =16) batch data are input into the model, it means that the round of training is completed and enters step (3-6), otherwise it returns to step (3-3).

[0062] (3-6) Training end judgment: When the loss function loss scene In continuous E s ' cene The reduction in the wheel is less than σ scene , where E s ' cene (In this embodiment, E s ' cene =10) is the minimum number of convergence rounds to determine whether the classification model has converged, σ scene (In this embodiment, σ scene =0.005) is used to judge the loss scene A threshold value that basically no longer decreases indicates that the classification model has converged, and step (3-8) is executed; otherwise, step (3-7) is executed.

[0063] (3-7) If e scene <E scene , then e scene =e scene +1, continue iterating and return to step (3-2); if e scene =E scene =200, the classifier training is completed and the process goes to step (3-8).

[0064] (3-8) Model saving: Save the optimal weight parameters of the classifier model and the optimal bias parameters

[0065] Step (4) Identify the types of malicious traffic data:

[0066] like Figure 3 As shown in the figure, malicious traffic data is preprocessed and then input into the model for feature extraction and classification. The details are as follows:

[0067] (4-1) Preprocess the malicious traffic data through slicing, truncation, zero padding, and pixel value mapping operations to obtain grayscale image data. The specific method is the same as step (1).

[0068] (4-2) Input the grayscale image data into a convolution layer with a convolution kernel size of n×n (n=3 in this example) for preliminary feature extraction.

[0069] (4-3) Use multiple S2M modules for deep local feature extraction.

[0070] (4-4) Multiple S2MMamba modules are interspersed between multiple S2M modules (in this example, the number and types of modules are 5 S2M modules, 2 S2MMamba modules, 1 S2M module, 4 S2MMamba modules, 1 S2M module, and 3 S2MMamba modules, respectively) to perform further global feature extraction: The specific steps of the S2MMamba module include passing the feature map through a convolution layer with a convolution kernel size of n×n (n=3 in this example) for local feature modeling, and then adjusting the number of channels through a convolution layer with a convolution kernel size of 1×1 to obtain the output Then Expand into N non-overlapping one-dimensional vectors Where P = wh (P = 4 in this example) and is the number of one-dimensional vectors, w≤n (in this example w=2,n=3) and h≤n (in this example h=2,n=3) are the width and height of each one-dimensional vector. Then, n Mamba modules (in this example n=1) are used to encode each p∈{1,2,…,P}, and we get Then, Fold back Then, a convolution layer with a convolution kernel size of 1×1 is used to adjust the number of channels back to the original size and map it back to the low-dimensional feature space. Then, a residual connection is used to splice the original input feature map along the channel direction, and finally, a convolution layer with a convolution kernel size of n×n (n=3 in this example) is used to fuse the features to obtain the output features.

[0071] (4-5) Use the classifier to obtain the final classification output: The specific steps of the classifier include using a 1×1 convolution layer for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flattening the feature map into a one-dimensional vector, adding a Dropout layer to prevent overfitting, and finally performing classification output through a linear layer.

[0072] The contents described in the above examples are merely an enumeration of implementation forms of the present invention. The protection scope of the present invention should not be limited to the specific forms described in the embodiments. The protection scope of the present invention should also include similar inventive methods conceived on the basis of the present invention.

Claims

1. A malicious traffic classification method based on convolutional neural network, characterized in that: The details are as follows: Step (1) preparing training data for the malicious traffic classification model: downloading known malicious traffic data from the Internet as raw traffic data; converting the raw traffic data into grayscale image data, and using the processed data as training data for implementing the malicious traffic classification model in step (3); Step (2) Design a malicious traffic classification model: The model is constructed based on a convolutional neural network, an S2M module, a Mamba module, a global pooling layer, and a linear layer. Each convolutional layer is connected to a batch normalization layer and a nonlinear activation layer. Step (3) trains the malicious traffic classification model as follows: (3-1) Parameter initialization: Randomly initialize the weight parameter w of the learning network scene and the bias parameter b scene , initialize the iteration round e scene =0, set the initial learning rate η scene , training sample batch size bs scene , maximum iteration round E scene ; (3-2) Data batching: according to the set sample batch size bs scene The dataset Divide evenly into P scene batches, and the malicious traffic data subset of each batch is represented as The corresponding label set is (3-3) Data input: Randomly select a subset of data from a batch of training data The data is sent to the classification model designed in step (2), and the feature representation of the data is extracted through the convolution layer, the improved MobileViT module and the Mamba module. The global pooling layer and the linear layer are input to obtain the predicted label set of the batch data. (3-4) Parameter update: According to the true label of the batch data and the predicted label set Calculate the loss function value loss scene , and according to the loss function value loss scene Update model parameters; (3-5) Single round training: When the e scene Round P scene If all batches of data are input into the classification model, it means that the round of training is over and goes to step (3-6), otherwise it returns to step (3-3); (3-6) Training end judgment: When the loss function loss scene In continuous E s ' cene The reduction in the wheel is less than σ scene , where E s ' cene The minimum number of convergence rounds to determine whether the classification model has converged, σ scene To judge the loss scene If the threshold value no longer decreases, it indicates that the classification model has converged, and step (3-8) is executed; otherwise, step (3-7) is executed; (3-7) If e scene <E scene , then e scene =e scene +1, continue iterating and return to step (3-2); if e scene =E scene , indicating that the classifier training is completed and proceed to step (3-8); (3-8) Model saving: Save the optimal weight parameters of the classifier model and the optimal bias parameters Step (4) Identify the types of malicious traffic data: (4-1) Preprocessing malicious traffic data; (4-2) Input a convolution layer with a convolution kernel size of n×n for preliminary feature extraction; (4-3) Use multiple S2M modules for deep local feature extraction; (4-4) Intersperse S2MMamba modules between multiple S2M modules to further extract global features: The S2MMamba module first passes the feature map output by the previous neural network layer through a convolution layer with a convolution kernel size of n×n to perform local feature modeling, and then adjusts the number of channels through a convolution layer with a convolution kernel size of 1×1 to obtain the output represents the real number domain, H and W represent the height and width of the effective receptive field respectively, and d represents the dimension; then Expand into N non-overlapping one-dimensional vectors The effective receptive field patch is divided into N small areas according to the fixed area P = wh, and the number of one-dimensional vectors obtained by expansion is The height h and width w of each effective receptive field patch are the height and width of each one-dimensional vector, h≤n, w≤n, and n is the size of the convolution kernel. The Mamba module is used to encode each pixel p∈{1,2,…,P} in each effective receptive field patch to obtain N one-dimensional vectors with global feature information. N one-dimensional vectors with global feature information Collapse back to a high-dimensional vector The number of channels is adjusted back to the original size through a convolution layer with a convolution kernel size of 1×1, mapped back to the low-dimensional feature space, and then spliced ​​with the original input feature map along the channel direction through a residual connection. Finally, a convolution layer with a convolution kernel size of n×n is used to fuse the features to obtain the output features. (4-5) Use the classifier to obtain the final classification output: The specific steps of the classifier include using a 1×1 convolution layer for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flattening the feature map into a one-dimensional vector, adding a Dropout layer to prevent overfitting, and finally performing classification output through a linear layer.

2. The malicious traffic classification method based on convolutional neural network as claimed in claim 1, characterized in that: The same method is used to convert the original traffic data into grayscale data in step (1) and pre-process the malicious traffic data in step (4-1), specifically including: (1-1) Data slicing: The original PCAP file is split into data streams. The data packets in the PCAP file are grouped according to five-tuple information and arranged in chronological order. The five-tuple information is source IP address, destination IP address, source port, destination port and protocol. (1-2) Unified data length: retain the first 784 bytes of each file and discard all information from byte 785 onwards; if the file length is less than 784 bytes, add 0x00 bytes to the end of the file; (1-3) Pixel value mapping: Map the data value of each byte to a grayscale pixel value, 0x00 corresponds to black, 0xff corresponds to white, and the final output image format is PNG.

3. The malicious traffic classification method based on convolutional neural network as claimed in claim 1, characterized in that: The malicious traffic classification model in step (2) is composed of a convolution layer with a convolution kernel size of n×n, a plurality of cross-designed S2M modules and S2MMamba modules, a global pooling layer and a linear layer; The S2M module separates the token mixer and the channel mixer based on the MobileNetV2 module, and simplifies the structure of the module by re-parameterization; the specific steps include using an n×n depth-separable convolutional layer to integrate spatial information along the channel direction, and then using a residual connection and two 1×1 convolutional layers to learn the relationship between different channel features; The S2MMamba module consists of a convolutional layer with a convolution kernel size of n×n, a convolutional layer with a convolution kernel size of 1×1, n Mamba modules, a convolutional layer with a convolution kernel size of 1×1 and a convolutional layer with a convolution kernel size of n×n; the Mamba module includes a root mean square normalization layer, a linear layer and a selective state space model neural network layer.

Images