Malicious traffic classification method based on convolutional neural network

Abstract

The application discloses a malicious traffic classification method based on a convolutional neural network. The prior art has a high misjudgment rate and poor classification effect. The application provides a malicious traffic classification method based on a convolutional neural network, which realizes high-accuracy malicious traffic classification through original traffic data conversion into a grayscale image, traffic data potential feature extraction, classification model training, and malicious traffic data training. The application first prepares training data for the classification model, designs and trains a malicious traffic classification model based on a convolutional neural network, and inputs the preprocessed malicious traffic data into the trained classification model to determine whether the current traffic is malicious traffic. The application combines the improved MobileNetV2 model and the Mamba model, simultaneously processes local features and global features, can cope with changes in the actual network environment, improves the classification accuracy, and enhances the actual usability and robustness.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security and network defense, especially the field of malicious traffic classification, and specifically relates to a malicious traffic classification method based on a convolutional neural network. BACKGROUND

[0002] The rapid development of the Internet has brought many conveniences, such as reshaping our way of obtaining information, promoting wireless communication across distances, and optimizing the pattern of business operations. However, this transformative progress also poses potential risks. Malicious traffic poses a serious threat to the safe and stable operation of the network, which may lead to network system paralysis, sensitive data leakage, and invasion of personal privacy, thus malicious traffic classification is proposed.

[0003] Current research methods for malicious traffic identification mainly fall into three categories: rule-based methods, machine learning methods, and deep learning methods. Traffic identification methods have also undergone development from rule-based methods to machine learning methods, deep learning methods, and parallel development of multiple methods. Early research mainly used rule-based methods to identify malicious traffic, that is, using the basic attributes of traffic data such as communication protocols, port numbers, and packet lengths to manually develop security rules to check for abnormal behavior. With the development of network environments, rule-based methods have exposed defects such as high demand for expert knowledge, long time consumption, and difficulty in responding to new traffic encryption and anonymity technologies, which cannot meet the needs of security personnel for traffic analysis.

[0004] In order to adapt to complex traffic data in the new network environment, researchers introduced algorithms such as random forests, logistic regression, and support vector machines in the field of machine learning to identify high-dimensional features of traffic data. Machine learning methods can effectively analyze complex traffic data, but these methods still rely on expert-designed traffic statistical features, and the performance of features in different actual application scenarios is unstable, requiring manual selection and adjustment.

[0005] Unlike the above methods, deep learning-based methods do not require pre-set artificial features when analyzing traffic, but use deep learning methods for direct end-to-end analysis and classification, which has become the focus of research in the direction of automatically extracting traffic features and improving traffic classification results.

[0006] The above methods usually have good effects on known malicious traffic classification problems with a large amount of labeled data, but in actual application scenarios. The data labeling of new malicious traffic data is usually very complex and requires a lot of time and financial cost. Under the condition of a small amount of labeled data, the existing methods cannot effectively realize the classification of malicious traffic, and often misjudge. The Chinese invention patent application with application number CN201910858882.8 discloses a network intrusion detection method in a small sample scene based on meta-learning. The method uses the F-Net built by the convolutional neural network to extract the final representation of the network flow, then uses the C-Net to evaluate the difference value of the query sample and each class sample in the sampling set in turn, and finally takes the mean value of each class, and selects the class represented by the minimum value as the label of the query sample. Its limitation is that only the local features of malicious traffic data are extracted, and the global features of the data are not considered, thus ignoring part of the effective information of the malicious traffic data. The Chinese invention patent application with application number CN202310253979.2 discloses a small sample abnormal traffic detection method and system. The method converts the data packet into a gray scale image data, then uses a sliding window to combine three adjacent gray scale images into an RGB image in turn, and finally uses a convolutional neural network to build a twin neural network model for subsequent malicious traffic detection tasks. Its limitation is also that only local features are extracted, ignoring the global feature processing of malicious traffic data. The Chinese invention patent application with application number CN202410770288.4 discloses a malicious traffic recognition classification method and system based on attention mechanism. The method uses multi-scale perception fusion attention mechanism to perform feature mapping of multi-scale network traffic features of different scales, and performs attention weighted fusion on network traffic mapping features of different scales to obtain fused scale network traffic features, and then classifies and identifies based on the fused scale network traffic features to determine the malicious classification and identification result of the network traffic. Its limitation is that it does not consider the characteristics of less effective semantic information and more redundant information of malicious traffic data, and uses a large amount of redundant information to learn the features of malicious traffic, which reduces the accuracy of malicious traffic classification.

[0007] The prior art has many deficiencies, one is that the existing method is usually good in classification effect under the condition of a large amount of known labeled data, but the model trained often misjudges under the condition of data scarcity; two is that the existing method usually uses original traffic data for feature extraction, and the method used is mostly designed for image data, which leads to the classification effect usually being poor; three is that the existing method mostly uses the neural network model with good effect in other fields, and does not specially design the model for the characteristics of less semantic information of malicious traffic data. In view of the above problems, the present application aims to provide a malicious traffic classification method under the condition of a small amount of labeled data, to further improve the classification accuracy of malicious traffic data and enhance the usability and robustness in actual scenes from the aspects of data preprocessing, potential feature extraction, classification model design and model training. SUMMARY

[0008] The purpose of the present application is to provide a malicious traffic classification method based on a convolutional neural network under the new malicious traffic classification scene, aiming at the problems of difficult data labeling and high labeling cost, low classification accuracy of the existing classification method and weak actual usability, realizing high-accuracy malicious traffic classification through the steps of converting original traffic data into grayscale images, extracting potential features of traffic data, training a classification model, and training malicious traffic data.

[0009] The method of the present application is specifically:

[0010] Step (1) Prepare training data for the malicious traffic classification model: download known malicious traffic data from the Internet as original traffic data; convert the original traffic data into grayscale image data through slicing, truncation, zero padding and pixel value mapping operations for more convenient classification. The specific steps of data conversion are as follows:

[0011] (1-1) Data slicing: slice the original PCAP file according to the data stream, group the packets in the PCAP file according to the five-tuple information, and arrange them in time sequence; the five-tuple information includes source IP address, destination IP address, source port, destination port and protocol. This step ensures that each data stream is a set of packets with the same five-tuple information, thereby maintaining the association and order between packets.

[0012] (1-2) Data uniform length processing: keep the first 784 bytes of each file, discard all information 785 bytes and later in the file. If the file length is less than 784 bytes, supplement 0x00 bytes at the end of the file. The purpose of this is to standardize the length of all data stream files for subsequent image conversion and model processing.

[0013] (1-3) Pixel value mapping: map the data value of each byte to a grayscale pixel value, where 0x00 corresponds to black and 0xff corresponds to white. The final output picture format is PNG. This step converts the data stream file from binary form to image form, making it able to be processed by deep learning models such as convolutional neural networks.

[0014] The processed data is used as training data for the malicious traffic classification model in step (3).

[0015] Step (2) designs a malicious traffic classification model: the model is constructed based on a convolutional neural network, S2M module, Mamba module, global pooling layer, and linear layer, with a batch normalization layer and non-linear activation layer connected after each convolutional layer.

[0016] Specifically, the model consists of a convolutional layer with a kernel size of n x n, multiple cross-designed S2M modules and S2M Mamba modules, a global pooling layer, and a linear layer. The S2M module separates the token mixer and channel mixer based on the MobileNetV2 module and simplifies the structure of the module through the reparameterization technique, resulting in the final S2M module. The specific steps include using an n x n depth separable convolutional layer to integrate spatial information along the channel direction, then using a residual connection and two 1 x 1 convolutional layers to learn the relationship between different channel features; the S2M Mamba module consists of an n x n convolutional layer, a 1 x 1 convolutional layer, n Mamba modules, a 1 x 1 convolutional layer, and an n x n convolutional layer. The Mamba module consists of a root mean square normalization layer, a linear layer, and a selective state space model.

[0017] Step (3) trains the malicious traffic classification model, as follows:

[0018] (3-1) Parameter initialization: randomly initialize the weight parameters w scene and bias parameters b scene of the learning network, initialize the iteration round e scene = 0, set the initial learning rate η scene , the training sample batch size bs scene , and the maximum iteration round E scene .

[0019] (3-2) Data batching: evenly divide the data set into P scene batches according to the set sample batch size bs scene , and each batch of malicious traffic data subset is represented as , and its corresponding label set is

[0020] (3-3) Data input: Randomly select a subset of training data from a certain batch. The data is fed into the classification model designed in step (2), and feature representations of the data are extracted through convolutional layers, the improved MobileViT module, and the Mamba module. These feature representations are then input into the global pooling layer and the linear layer to obtain the predicted label set for this batch of data.

[0021] (3-4) Parameter update: based on the actual label of this batch of data. and predicted label set Calculate the loss function value. scene And based on the loss function value loss scene Update model parameters;

[0022] (3-5) Single-round training: When the e-th round of training... scene Round P scene If all batches of data are input into the classification model, it means that the training round is over and proceed to step (3-6); otherwise, return to step (3-3).

[0023] (3-6) Training termination judgment: When the loss function... scene In continuous E s ′ cene The reduction within the wheel is less than σ. scene E s ′ cene The minimum number of convergence rounds to determine whether a classification model has converged, σ scene To determine loss scene If the threshold no longer decreases, it indicates that the classification model has converged, and step (3-8) is executed; otherwise, step (3-7) is executed.

[0024] (3-7) If e scene <E scene Then e scene =e scene +1, continue iterating, and return to step (3-2); if e scene =E scene This indicates that the classifier training is complete, and we proceed to step (3-8);

[0025] (3-8) Model saving: Save the optimal weight parameters of the classifier model. and optimal bias parameters

[0026] Step (4) Identify the types of malicious traffic data:

[0027] (4-1) Preprocess the malicious traffic data, using the same method as step (1);

[0028] (4-2) Input a convolutional layer with a kernel size of n x n for preliminary feature extraction;

[0029] (4-3) Use multiple S2M modules for deep local feature extraction;

[0030] (4-4) Use S2MMamba modules between multiple S2M modules to further extract global features:

[0031] The S2MMamba module first models the local features of the feature map output by the previous neural network layer through a convolutional layer with a kernel size of n x n, and then adjusts the channel number through a convolutional layer with a kernel size of 1 x 1 to obtain the output where R denotes the real field, H and W denote the height and width of the effective receptive field, respectively, and d denotes the dimension; then is unfolded into N non-overlapping one-dimensional vectors where the effective receptive field patch is divided into N small regions according to a fixed area P = wh, and the number of one-dimensional vectors obtained by unfolding is The height h and width w of each patch are the height and width of each one-dimensional vector, h ≤ n, w ≤ n, and n is the size of the convolutional kernel. Then, the Mamba module is used to encode each pixel p e {1, 2,..., P} in each patch to obtain N one-dimensional vectors with global feature information The N one-dimensional vectors with global feature information are folded back into a high-dimensional vector

[0032] The channel number is adjusted back to the original size through a convolutional layer with a kernel size of 1 x 1, and mapped back to the low-dimensional feature space. Then, the original input feature map is spliced along the channel direction through residual connection, and finally a convolutional layer with a kernel size of n x n is used for feature fusion to obtain the output feature;

[0033] (4-5) Use a classifier for final classification output: The specific steps of the classifier include using a 1 x 1 convolutional layer for feature compression, adjusting the size of the feature map to a fixed size through global pooling, flattening the feature map into a one-dimensional vector, adding a Dropout layer to prevent overfitting, and finally performing classification output through a linear layer.

[0034] Compared with the prior art, the present application has the following beneficial effects:

[0035] 1. For the environment of scarce labeled data, the present application proposes a malicious traffic classification method based on a small amount of labeled data, which can achieve very high classification accuracy under the condition of a small amount of labeled data.

[0036] 2. The application processes local features and global features by combining the improved MobileNetV2 model and the Mamba model, thereby better realizing extraction of malicious traffic feature.

[0037] 3. The application converts the traffic data into gray scale data more convenient for classification through traffic data slicing, truncation, zero padding, pixel value mapping and other operations, thereby better analyzing and extracting potential features of the traffic data.

[0038] 4. The application considers the characteristics of less effective semantic information and more redundant information of malicious traffic data, uses the Mamba module with a selective state space model, and learns how to retain as much effective semantic information as possible in the feature extraction process by using the mechanism of meta-learning, filters out useless information, thereby improving the effectiveness of the extracted features, and further improving the accuracy of the model. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is a schematic diagram of the overall framework of the malicious traffic classification of the application;

[0040] Figure 2 is a schematic diagram of the data preprocessing step of the application;

[0041] Figure 3 is a schematic diagram of the malicious traffic classification model in the method of the application;

[0042] Figure 4 is a schematic diagram of the S2M module in the method of the application;

[0043] Figure 5 is a schematic diagram of the S2M Mamba module in the method of the application;

[0044] Figure 6 is a schematic diagram of the Mamba module in the method of the application. DETAILED DESCRIPTION

[0045] The application will be further described in detail below in combination with the drawings and examples.

[0046] This embodiment is based on a small amount of labeled data in the CIC-AndMal2017 and USTC-TFC2016 data sets, and explains the malicious traffic classification method based on convolutional neural network and selective state space model under the condition of a small amount of labeled data proposed by the application, and the overall framework is as shown in Figure 1 .

[0047] Step (1) obtains a small amount of traffic data labeled as specific malicious traffic categories (including data of malicious traffic categories such as beanbot, plankton, smssniffer, etc. in this example) and normal traffic categories from the CIC-AndMal2017 and USTC-TFC2016 datasets for training, and converts the original traffic data into grayscale image data more convenient for classification through slicing, truncation, zero padding, and pixel value mapping operations. The specific data conversion is as shown in Figure 2

[0048] 1. Data slicing: The original PCAP file is sliced according to the data stream form. The packets in the PCAP file are grouped according to the five-tuple information (source IP address, destination IP address, source port, destination port, and protocol), and arranged in chronological order.

[0049] 2. Data uniform length processing: The first 784 bytes of each data stream file in the CIC-AndMal2017 and USTC-TFC2016 datasets are retained, and the information from the 785th byte onwards is discarded. For files with a length less than 784 bytes, 0x00 bytes are appended to achieve uniform length, facilitating subsequent image conversion and model processing.

[0050] 3. Pixel value mapping: The data value of each byte is mapped to a grayscale pixel value, where 0x00 corresponds to black (0) and 0xff corresponds to white (255). The final output image data format is PNG.

[0051] Step (2) designs a malicious traffic classification model:

[0052] As shown in Figure 3 , the model is based on a convolutional neural network, S2M module (improved MobileNetV2 module), Mamba module, global pooling layer, and linear layer for model construction. A batch normalization layer and SiLU nonlinear activation layer are connected after each convolutional layer in the convolutional neural network. The improved MobileNetV2 module and Mamba module are used to extract local features and global features, respectively.

[0053] Specifically, the model consists of a convolutional layer with a convolution kernel size of n x n, multiple cross-designed S2M modules and S2M Mamba modules, a global pooling layer, and a linear layer. Among them, the S2M module separates the token mixer and channel mixer based on the MobileNetV2 module, and simplifies the structure of the module through the reparameterization technique, and the final S2M module is as shown in Figure 4 ​As shown, the specific steps include using an n x n (in this example, n = 3) depth separable convolution layer to integrate spatial information along the channel direction, and then using a residual connection and two 1 x 1 convolution layers to learn the relationship between different channel features. The S2MMamba module is as shown in Figure 5 As shown, it is composed of an n x n (in this example, n = 3) convolution layer, a 1 x 1 convolution layer, n Mamba modules (in this example, n = 1), a 1 x 1 convolution layer, and an n x n (in this example, n = 3) convolution layer. Among them, the Mamba module is as shown in Figure 6 As shown, it specifically includes neural network layers such as root mean square normalization layer, linear layer, and selective state space model.

[0054] Step (3) training of malicious traffic classification model:

[0055] The malicious traffic classification model is trained using a small amount of labeled malicious traffic data obtained in step (1). Specifically as follows:

[0056] (3-1) Parameter initialization: randomly initialize the weight parameters and bias parameters in the model. Set the initial learning rate to η scene (in this example, η scene = 0.001), the training sample batch size is bs scene (in this example, bs scene = 64), the maximum iteration round is E scene (in this example, E scene = 200), that is, in each iteration, the model will process 64 samples until 200 iterations are completed.

[0057] (3-2) Data batching: evenly divide the preprocessed data set into P scene batches, each batch containing 64 malicious traffic data subsets and their corresponding labels. In this example, 1000 samples are selected, so P scene = 16 (1000 / 64), each batch contains 64 samples, and the last batch may contain fewer samples.

[0058] (3-3) Data input: in each round of training, a batch of data subsets is randomly selected and sent into the model. In this example, the 64 samples are sent into the model one by one, and the model extracts the feature representation of each sample through the convolution layer, the improved MobileNetV2 module, and the Mamba module.

[0059] (3-4) Parameter update: according to the true label (in this example and the label set predicted by the model (In this embodiment) Calculate the loss function value The weight parameters are updated using a gradient descent-based optimizer (in this embodiment, the AdamW optimizer with a decoupled weight decay regularization method). and bias parameters

[0060]

[0061] (3-5) Single-round training: When P in a round scene (In this example, P) scene =16) If all batches of data are input into the model, it means that the training round is over and proceed to step (3-6); otherwise, return to step (3-3).

[0062] (3-6) Training termination judgment: When the loss function... scene In continuous E s ′ cene The reduction within the wheel is less than σ. scene E s ′ cene (E in this embodiment) s ′ cene =10) is the minimum number of convergence rounds to determine whether the classification model has converged, σ scene (σ in this embodiment) scene =0.005) is used to determine the loss. scene If the threshold no longer decreases, it indicates that the classification model has converged, and step (3-8) is executed; otherwise, step (3-7) is executed.

[0063] (3-7) If e scene <E scene Then e scene =e scene +1, continue iterating, and return to step (3-2); if e scene =E scene =200, classifier training is complete, proceed to step (3-8).

[0064] (3-8) Model saving: Save the optimal weight parameters of the classifier model. and optimal bias parameters

[0065] Step (4) Identify the types of malicious traffic data:

[0066] like Figure 3 As shown, malicious traffic data is preprocessed and then input into the model for feature extraction and classification. Specifically:

[0067] (4-1) Preprocess the malicious traffic data by slicing, truncating, zero padding, and pixel value mapping operation to obtain grayscale image data, and the specific method and steps are the same as step (1).

[0068] (4-2) Input the grayscale image data into a convolution layer with a kernel size of n x n (n = 3 in this example) to perform preliminary feature extraction.

[0069] (4-3) Use multiple S2M modules for deep local feature extraction.

[0070] (4-4) Interleave multiple S2M modules with multiple S2MMamba modules (in this example, the number and type of modules are 5 S2M modules, 2 S2MMamba modules, 1 S2M module, 4 S2MMamba modules, 1 S2M module, and 3 S2MMamba modules in order) for further global feature extraction: the specific steps of the S2MMamba module include modeling the feature map locally through a convolution layer with a kernel size of n x n (n = 3 in this example), and then adjusting the channel number through a convolution layer with a kernel size of 1 x 1 to obtain the output Then is unfolded into N non-overlapping one-dimensional vectors where P = wh (P = 4 in this example) and is the number of one-dimensional vectors, w ≤ n (w = 2 in this example, n = 3) and h ≤ n (h = 2 in this example, n = 3) are the width and height of each one-dimensional vector, respectively. Then use n Mamba modules (n = 1 in this example) to encode each p ∈ {1, 2, …, P} to obtain Then is folded back to Then adjust the channel number back to the original size through a convolution layer with a kernel size of 1 x 1, and map back to the low-dimensional feature space. Then concatenate the original input feature map along the channel direction through residual connection, and finally perform feature fusion through a convolution layer with a kernel size of n x n (n = 3 in this example) to obtain the output feature.

[0071] (4-5) Use a classifier for final classification output: the specific steps of the classifier include using a 1 x 1 convolution layer for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flattening the feature map into a one-dimensional vector, adding a Dropout layer to prevent overfitting, and finally performing classification output through a linear layer.

[0072] The content described in the above examples is only an enumeration of the implementation forms of the present application, and the protection scope of the present application should not be limited to the specific forms stated in the examples, and the protection scope of the present application should also include similar methods of invention conceived on the basis of the present application.

Claims

1. A method of malicious traffic classification based on convolutional neural networks, characterized in that, Specifically as follows: Step (1) preparing training data of malicious traffic classification model: downloading known malicious traffic data from the Internet as original traffic data; converting the original traffic data into grayscale image data, and processing the data as training data for implementing step (3) of the malicious traffic classification model; Step (2) designing a malicious traffic classification model: the model is constructed based on a convolutional neural network, S2M modules, Mamba modules, a global pooling layer and a linear layer, and a batch normalization layer and a nonlinear activation layer are connected after each convolutional layer; Step (3) training the malicious traffic classification model, specifically as follows: (3-1) Parameter initialization: randomly initialize the weight parameters w of the learning network scene and the bias parameters b scene , initialize the iteration round e scene = 0, set the initial learning rate η scene , set the training sample batch size bs scene , and set the maximum iteration round E scene ; (3-2) Data batching: according to the set sample batch size bs scene The data set is evenly divided into P scene batches, and each batch of malicious traffic data subset is represented as The corresponding label set is (3-3) Data input: randomly select a subset of data of a batch of training data The designed classification model in step (2) is input, and the feature representation of the data is extracted through the convolution layer, the improved MobileViT module and the Mamba module, and the prediction label set of the batch of data is obtained by inputting the global pooling layer and the linear layer (3-4) Parameter update: according to the true label of this batch of data and the predicted label set Calculate the loss function value loss scene , and update the model parameters according to the loss function value loss scene ; (3-5) Single round training: when the P scene batch data of the e scene th round are all input into the classification model, it indicates that the training of this round is completed, and step (3-6) is entered, otherwise, return to step (3-3); (3-6) Training end judgment: when the loss function loss scene In the continuous E s ' cene The reduction range in the wheel is less than σ scene , where E s ' cene is the minimum convergence wheel number for judging whether the classification model converges, σ scene is the threshold value for judging whether the loss scene is no longer reduced, indicating that the classification model has converged, and step (3-8) is executed; otherwise, step (3-7) is executed; (3-7) If e scene < E scene , then e scene = e scene + 1, continue iteration, return to step (3-2); if e scene = E scene , it indicates that the classifier training is completed, enter step (3-8); (3-8) Model saving: saving the best weight parameters of the classifier model and the best bias parameters Step (4) identifying the type of malicious traffic data: (4-1) preprocessing the malicious traffic data; (4-2) inputting a convolutional layer with a convolution kernel size of n x n for preliminary feature extraction; (4-3) using multiple S2M modules for deep local feature extraction; (4-4) interspersing S2MMamba modules between multiple S2M modules to further extract global features: The S2MMamba module firstly performs local feature modeling on the feature map output by the previous layer of neural network through a convolution layer with a convolution kernel size of n x n, and then adjusts the number of channels through a convolution layer with a convolution kernel size of 1 x 1 to obtain the output denotes a real number field, H and W respectively denote the height and width of the effective receptive field, and d denotes the dimension; then is unfolded into N non-overlapping one-dimensional vectors The effective receptive field patch is divided into N small areas according to a fixed area P = wh, and the number of one-dimensional vectors obtained by unfolding is The height h and the width w of each effective receptive field patch are the height and the width of each one-dimensional vector, h ≤ n, w ≤ n, and n is the size of the convolution kernel; each pixel p ∈ {1, 2,..., P} in each effective receptive field patch is encoded using the Mamba module to obtain N one-dimensional vectors with global feature information The N one-dimensional vectors with global feature information are folded back into a high-dimensional vector Adjust the channel number back to the original size through a convolutional layer with a convolution kernel size of 1 x 1, map back to a low-dimensional feature space, then splice along the channel direction through residual connection with the original input feature map, and finally perform feature fusion through a convolutional layer with a convolution kernel size of n x n to obtain output features; (4-5) using a classifier for final classification output: the specific steps of the classifier include using a 1 x 1 convolutional layer for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flattening the feature map into a one-dimensional vector, adding a Dropout layer to prevent overfitting, and finally performing classification output through a linear layer. 2.The method of claim 1, wherein, The same method is used in step (1) to convert the original traffic data into grayscale image data and step (4-1) to preprocess the malicious traffic data, specifically including: (1-1) data slicing: the original PCAP file is cut according to the data stream, and the packets in the PCAP file are grouped according to the five-tuple information and arranged in chronological order; the five-tuple information includes source IP address, destination IP address, source port, destination port and protocol; (1-2) data uniform length: the first 784 bytes of each file are retained, and all information from the 785th byte onwards is discarded; if the file length is less than 784 bytes, 0x00 bytes are added at the end of the file; (1-3) pixel value mapping: map the data value of each byte to a grayscale pixel value, 0x00 corresponds to black, 0xff corresponds to white, and the final output image format is PNG. 3.The convolutional neural network-based malicious traffic classification method of claim 1, wherein, The malicious traffic classification model in step (2) is composed of a convolutional layer with a convolution kernel size of n x n, multiple cross-designed S2M modules and S2MMamba modules, a global pooling layer and a linear layer; The S2M module separates the token mixer and the channel mixer on the basis of the MobileNetV2 module, and simplifies the structure of the module through reparameterization; the specific steps comprise: using an n*n depth separable convolution layer to integrate spatial information in the channel direction, and then using a residual connection and two 1*1 convolution layers to learn the relationship between different channel features; The S2MMamba module is composed of an n*n convolution kernel size convolution layer, a 1*1 convolution kernel size convolution layer, n Mamba modules, a 1*1 convolution kernel size convolution layer and an n*n convolution kernel size convolution layer; the Mamba module comprises a root mean square normalization layer, a linear layer and a selective state space model neural network layer.

Images