Encrypted data packet classification method and device
By constructing packet feature sequences and multivariate time feature sequences, combining convolution kernels and pooling operations, the existing encryption traffic classification methods are solved, and efficient and universal encrypted packet classification is achieved.
Patent Information
- Application Number
- CN202410460017.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-17
- Publication Date
- 2025-03-18
AI Technical Summary
The existing encryption traffic classification methods are poor in popularity, have too many feature dependencies or too dependent protocols, and cannot be applied to various encryption technologies. The classification models need to be retrained frequently during environment and task transfer, and the application complexity is high and the efficiency is low.
By constructing a packet feature sequence based on the packet length of multiple consecutive encrypted data packets, a multivariate time feature sequence is generated using accumulation and function, combining convolution kernel and pooling operations, a pooled feature sequence is generated, and a pre-acquisitioned classification model is input to obtain the classification tag of the encrypted data packet.
It effectively reduces the complexity of encrypted packet classification, improves the universality and efficiency of encrypted packet classification, and reduces the retraining requirements of the model during environment and task transfer.
Smart Images
Figure CN119646560A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data classification, and in particular to a method and device for classifying encrypted data packets. Background Art
[0002] Encrypted traffic classification is a network traffic analysis technology used to identify and classify encrypted (such as TLS / SSL encrypted) network packets. Encryption technology has become increasingly popular in recent years because it can effectively protect data privacy and security. However, this also brings challenges to network management and security analysis, because the traditional traffic classification method based on content analysis is no longer applicable in this case. Encrypted traffic classification attempts to infer the application type or behavior behind it by analyzing some observable characteristics of encrypted data packets (such as packet size, transmission direction, time interval, etc.). Encrypted traffic classification technology is of great significance in many aspects such as network security, network management, and traffic optimization.
[0003] Existing research on encrypted traffic classification involves different methods and models to identify and classify encrypted network traffic. Traffic feature classification relies on information such as traffic statistics, timing patterns, and frequency distribution for classification. It includes identifying traffic patterns and building models through machine learning and data mining to distinguish different types of encrypted traffic; protocol fingerprinting classification is performed by identifying protocol fingerprints in encrypted traffic. It focuses on specific identifiers or patterns in traffic to determine the type of traffic; deep learning methods are also widely used in encrypted traffic classification. They use neural networks and deep learning models to achieve efficient encrypted traffic classification by analyzing packet-level features and flow-level features.
[0004] Although these studies have made some progress in the encrypted traffic classification task, the existing studies usually have the following defects: either too many features are used or too dependent on the protocol, which cannot be applied to various encryption technologies (such as VPN, Tor and SSL / TLS), that is, the universality of the existing technology is poor. In addition, the capabilities of existing classification models are limited to specific data sets or tasks, and in practical applications, when faced with environment and task transfer, frequent and time-consuming retraining is required, that is, the model application is complex and inefficient. Summary of the invention
[0005] In view of this, the embodiments of the present application provide a method and device for classifying encrypted data packets to eliminate or improve one or more defects existing in the prior art.
[0006] A first aspect of the present application provides a method for classifying encrypted data packets, the method comprising:
[0007] Based on the data packet lengths corresponding to the plurality of consecutive encrypted data packets, the data packet features corresponding to the respective encrypted data packets are obtained; based on the features of the respective data packets, a target data packet feature sequence is constructed;
[0008] Based on the cumulative sum function and the target data packet feature sequence, an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence and a cumulative and downlink data packet feature sequence are obtained, and a multivariate time feature sequence is formed with the target data packet feature sequence;
[0009] Obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of pre-generated convolution kernels;
[0010] Performing a pooling operation on the target convolution sequence to obtain a pooling feature sequence;
[0011] The pooled feature sequence is input into a pre-acquired classification model to obtain a classification label corresponding to each of the encrypted data packets.
[0012] In some embodiments of the present application, obtaining the data packet features corresponding to each of the encrypted data packets based on the data packet lengths corresponding to each of the plurality of consecutive encrypted data packets includes:
[0013] If the encrypted data packet is an uplink data packet, taking a positive value of the data packet length of the encrypted data packet as a data packet feature of the encrypted data packet;
[0014] If the encrypted data packet is a downlink data packet, the data packet length of the encrypted data packet takes a negative value as the data packet feature of the encrypted data packet.
[0015] In some embodiments of the present application, the uplink data packet feature sequence, the downlink data packet feature sequence, the cumulative and target data packet feature sequence, the cumulative and uplink data packet feature sequence, and the cumulative and downlink data packet feature sequence are obtained based on the cumulative and target data packet feature sequence, including:
[0016] Constructing the uplink data packet characteristic sequence and the downlink data packet characteristic sequence based on the target data packet characteristic sequence;
[0017] The cumulative sum target data packet feature sequence, cumulative sum uplink data packet feature sequence and cumulative sum downlink data packet feature sequence corresponding to the target data packet feature sequence, uplink data packet feature sequence and downlink data packet feature sequence are calculated based on the cumulative sum function.
[0018] In some embodiments of the present application, obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of pre-generated convolution kernels includes:
[0019] Based on each of the convolution kernels, a convolution operation is performed on the multivariate time feature sequence at the target position of the convolution channel corresponding to each of the convolution kernels to obtain a convolution value at the target position corresponding to each of the convolution kernels;
[0020] A target convolution sequence is obtained based on the convolution values of multiple target positions corresponding to each of the convolution kernels.
[0021] In some embodiments of the present application, the performing a pooling operation on the target convolution sequence to obtain a pooled feature sequence includes one of the following four methods:
[0022] Performing a positive ratio pooling operation on the target convolution sequence to obtain a first pooling feature sequence;
[0023] Performing a positive mean pooling operation on the target convolution sequence to obtain a second pooling feature sequence;
[0024] Performing a positive index mean pooling operation on the target convolution sequence to obtain a third pooling feature sequence;
[0025] Performing the longest positive segment pooling operation on the target convolution sequence obtains a fourth pooling feature sequence.
[0026] In some embodiments of the present application, performing convolution operation on the multivariate time feature sequence based on each of the convolution kernels at the target position of the convolution channel corresponding to each of the convolution kernels to obtain the convolution value at the target position corresponding to each of the convolution kernels includes:
[0027] Based on the multivariate time feature sequence, the weights corresponding to each of the convolution kernels, the dilation value, the bias constant, the convolution channel and the target position on the convolution channel, the convolution value at the target position corresponding to each of the convolution kernels is calculated.
[0028] In some embodiments of the present application, obtaining a target convolution sequence based on the convolution values of the multiple target positions corresponding to each of the convolution kernels includes:
[0029] Summing the convolution values of all convolution channels corresponding to the target position to obtain a target position convolution sequence;
[0030] The target convolution sequence is constructed according to the target position convolution sequence corresponding to each target position on all convolution channels.
[0031] A second aspect of the present application provides an encrypted data packet classification device, the device comprising:
[0032] A feature extraction module, used to obtain the data packet features corresponding to each of the encrypted data packets based on the data packet lengths corresponding to each of the multiple consecutive encrypted data packets; and to construct a target data packet feature sequence based on the features of each of the data packets;
[0033] A multivariate time feature sequence construction module is used to obtain an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence, and a cumulative and downlink data packet feature sequence based on a cumulative and function and the target data packet feature sequence, and form a multivariate time feature sequence with the target data packet feature sequence;
[0034] A feature convolution module, used for obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of pre-generated convolution kernels;
[0035] A feature pooling module, used for performing a pooling operation on the target convolution sequence to obtain a pooled feature sequence;
[0036] The data packet classification module is used to input the pooled feature sequence into a pre-acquired classification model to obtain a classification label corresponding to each of the encrypted data packets.
[0037] The third aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the encrypted data packet classification method described in the first aspect when executing the computer program.
[0038] The fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the encrypted data packet classification method described in the first aspect.
[0039] The present application provides an encrypted data packet classification method and device, the method comprising: constructing a target data packet feature sequence based on the data packet lengths corresponding to each of a plurality of continuous encrypted data packets; obtaining an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence, and a cumulative and downlink data packet feature sequence based on a cumulative and sum function and the target data packet feature sequence, and forming a multivariate time feature sequence with the target data packet feature sequence; obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of convolution kernels; performing a pooling operation on the target convolution sequence to obtain a pooling feature sequence; and inputting the pooling feature sequence into a pre-acquired classification model to obtain a classification label corresponding to each encrypted data packet. The present application can effectively reduce the complexity of encrypted data packet classification, thereby effectively improving the universality of encrypted data packet classification.
[0040] Additional advantages, purposes, and features of the present application will be partially described in the following description, and will become partially apparent to those skilled in the art after studying the following, or may be learned from the practice of the present application. The purposes and other advantages of the present application can be achieved and obtained by the structures specifically pointed out in the specification and the drawings.
[0041] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present application are not limited to the above specific description, and the above and other purposes that can be achieved by the present application will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] The drawings described herein are used to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. The components in the drawings are not drawn to scale, but are only for the purpose of illustrating the principles of the present application. In order to facilitate the illustration and description of some parts of the present application, the corresponding parts in the drawings may be enlarged, that is, they may become larger relative to other components in the exemplary device actually manufactured according to the present application. In the drawings:
[0043] Figure 1 Schematic diagram of a flow chart of a method for classifying encrypted data packets in an embodiment of the present application.
[0044] Figure 2 It is a structural diagram of an encrypted data packet classification device in another embodiment of the present application.
[0045] Figure 3 2 is a schematic diagram of a process for extracting a target convolution sequence in another embodiment of the present application. DETAILED DESCRIPTION
[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the implementation modes and the accompanying drawings. Here, the illustrative implementation modes and descriptions of the present application are used to explain the present application, but are not intended to limit the present application.
[0047] It should also be noted here that in order to avoid obscuring the present application due to unnecessary details, only the structures and / or processing steps closely related to the scheme according to the present application are shown in the accompanying drawings, while other details that are not very relevant to the present application are omitted.
[0048] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.
[0049] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.
[0050] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.
[0051] The details are described in detail through the following examples.
[0052] The present application embodiment provides an encrypted data packet classification method that can be performed by an encrypted data packet classification device or a client device, see Figure 1 The encrypted data packet classification method specifically includes the following contents:
[0053] Step 110: based on the data packet lengths corresponding to a plurality of consecutive encrypted data packets, obtain the data packet features corresponding to each of the encrypted data packets; and construct a target data packet feature sequence based on the features of each of the data packets.
[0054] Step 120: Based on the cumulative sum function and the target data packet feature sequence, an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence and a cumulative and downlink data packet feature sequence are obtained, and a multivariate time feature sequence is formed with the target data packet feature sequence.
[0055] Step 130: Obtain a target convolution sequence corresponding to the multivariate time feature sequence based on multiple pre-generated convolution kernels.
[0056] Step 140: Perform a pooling operation on the target convolution sequence to obtain a pooled feature sequence.
[0057] Step 150: Input the pooled feature sequence into a pre-acquired classification model to obtain a classification label corresponding to each of the encrypted data packets.
[0058] Specifically, the client device first extracts the packet lengths corresponding to multiple consecutive encrypted packets (aggregated into a session) as the packet features corresponding to each encrypted packet; and constructs a target packet feature sequence such as X = {x1, x2, ..., x N}, where x1,x2,…,x N They respectively represent the data packet characteristics of the 1st, 2nd, ...Nth encrypted data packets.
[0059] Then, the target data packet feature sequence pairs are classified to obtain the uplink data packet feature sequence and the downlink data packet feature sequence. The cumulative sum function is used to obtain the cumulative sum of the three feature sequences: the target data packet feature sequence, the cumulative sum uplink data packet feature sequence, and the cumulative sum downlink data packet feature sequence, and they are combined with the target data packet feature sequence to form a multivariate time feature sequence.
[0060] Then, a target convolution sequence corresponding to the multivariate time feature sequence is obtained based on multiple pre-generated convolution kernels. Then, a pooling operation is performed on the target convolution sequence to obtain a pooled feature sequence. Finally, the pooled feature sequence is input into a pre-acquired classification model to obtain a classification label corresponding to each of the encrypted data packets, thereby effectively reducing the complexity of encrypted data packet classification, thereby effectively improving the universality of encrypted data packet classification.
[0061] It should be noted that the pre-trained model is a meta-learning model, such as MAML (Model-Agnostic Meta-Learning), MeTAL (MetaLearning with Task-Adaptive LossFunction for Few-Shot Learning), and other meta-learning models. The meta-learning model itself is adaptive, which can further improve the accuracy of encrypted data packet classification. Among them, adaptability means that the meta-learning model can solve some new learning tasks with only a small number of samples, that is, it performs well in few-shot learning.
[0062] In order to further reduce the complexity of the encrypted data packet classification and thereby effectively improve the universality of the encrypted data packet classification, step 110 includes:
[0063] If the encrypted data packet is an uplink data packet, taking a positive value of the data packet length of the encrypted data packet as a data packet feature of the encrypted data packet;
[0064] If the encrypted data packet is a downlink data packet, the data packet length of the encrypted data packet takes a negative value as the data packet feature of the encrypted data packet.
[0065] Specifically, if the encrypted data packet is an uplink data packet, the packet length of the encrypted data packet takes a positive value as the packet feature of the encrypted data packet; if the packet length is 1, then +1 is taken; if the encrypted data packet is a downlink data packet, the packet length of the encrypted data packet takes a negative value as the packet feature of the encrypted data packet; if the packet length is 1, then -1 is taken, thereby further reducing the complexity of encrypted data packet classification and effectively improving the universality of encrypted data packet classification.
[0066] In order to effectively improve the accuracy of classification of encrypted data packets, step 120 includes:
[0067] Constructing the uplink data packet characteristic sequence and the downlink data packet characteristic sequence based on the target data packet characteristic sequence;
[0068] The cumulative sum target data packet feature sequence, cumulative sum uplink data packet feature sequence and cumulative sum downlink data packet feature sequence corresponding to the target data packet feature sequence, uplink data packet feature sequence and downlink data packet feature sequence are calculated based on the cumulative sum function.
[0069] Specifically, the client device constructs the uplink data packet feature sequence and the downlink data packet feature sequence based on the target data packet feature sequence, as shown in Formulas 1 and 2; and then calculates the cumulative and target data packet feature sequence, the cumulative and uplink data packet feature sequence and the cumulative and downlink data packet feature sequence corresponding to the target data packet feature sequence, the uplink data packet feature sequence and the downlink data packet feature sequence respectively based on the cumulative and function, as shown in Formulas 3, 4 and 5, thereby effectively improving the accuracy of encrypted data packet classification.
[0070]
[0071] Among them, u i represents the i-th uplink data packet feature in the uplink data packet feature sequence U, x i Represents the i-th packet feature in the target packet feature sequence X.
[0072]
[0073] Among them, d i represents the i-th downlink data packet feature in the downlink data packet feature sequence D, x i Represents the i-th packet feature in the target packet feature sequence X.
[0074]
[0075] Where CS represents the cumulative sum function, x′ i represents the i-th cumulative and target packet feature in the cumulative and target packet feature sequence, x j Represents the jth packet feature in the target packet feature sequence X.
[0076]
[0077] Where CS represents the cumulative sum function, u′ irepresents the i-th cumulative and uplink packet feature in the cumulative and uplink packet feature sequence, x j Represents the jth packet feature in the target packet feature sequence X.
[0078]
[0079] Where CS represents the cumulative sum function, d′ i represents the ith cumulative and downlink packet feature in the cumulative and downlink packet feature sequence, x j Represents the jth packet feature in the target packet feature sequence X.
[0080] To extract effective features from multivariate time feature series, see Figure 3 , step 130 comprises:
[0081] Step 131: Based on each of the convolution kernels, a convolution operation is performed on the multivariate time feature sequence at the target position of each corresponding convolution channel to obtain the convolution value at the target position corresponding to each of the convolution kernels.
[0082] Among them, step 131 includes: based on the multivariate time feature sequence, the weights corresponding to each of the convolution kernels, the dilation value, the bias constant, the convolution channel and the target position on the convolution channel, the convolution value at the target position corresponding to each of the convolution kernels is calculated, and the corresponding formula is shown in Formula 6:
[0083]
[0084] Among them, Y represents the multivariate time feature sequence, W represents the weight of the convolution kernel, d represents the expansion value of the convolution kernel, b represents the bias constant of the convolution kernel, c represents the convolution channel corresponding to the convolution kernel, and i represents the target position on the convolution channel.
[0085] Step 132: Obtain a target convolution sequence based on the convolution values of multiple target positions corresponding to each of the convolution kernels.
[0086] Wherein, step 132 includes: summing the convolution values of all convolution channels corresponding to the target position to obtain a target position convolution sequence; constructing a target convolution sequence according to the target position convolution sequences corresponding to each target position on all convolution channels, as shown in Formula 7:
[0087] Z={z1,z2,…},z i =∑ c∈C z c,i (7)
[0089] Among them, z irepresents the sum of the convolution values of all convolution channels corresponding to the target position i, C represents the total number of convolution channels, c represents the convolution channel corresponding to the convolution kernel, and i represents the target position on the convolution channel.
[0090] In order to further extract effective features from the multivariate time feature sequence to improve the accuracy of classification, step 140 includes one of the following four methods:
[0091] Performing a positive ratio pooling operation on the target convolution sequence to obtain a first pooling feature sequence;
[0092] Performing a positive mean pooling operation on the target convolution sequence to obtain a second pooling feature sequence;
[0093] Performing a positive index mean pooling operation on the target convolution sequence to obtain a third pooling feature sequence;
[0094] Performing the longest positive segment pooling operation on the target convolution sequence obtains a fourth pooling feature sequence.
[0095] Specifically, the client device performs positive value proportion pooling (PPV, Proportion of Positive Values), positive value mean pooling (MPV, Mean of Positive Values), positive index mean pooling (MIPV, Mean of Indices of Positive Values) or longest positive segment pooling (LSPV, Longest Stretch of Positive Values) on the target convolution sequence to obtain the corresponding pooled feature sequence, so as to further extract effective features in the multivariate time feature sequence, thereby effectively improving the classification accuracy.
[0096] From the software level, the present application also provides an encrypted data packet classification device for executing all or part of the encrypted data packet classification method, see Figure 2 The encrypted data packet classification device specifically includes the following contents:
[0097] The feature extraction module 10 is used to obtain the data packet features corresponding to each of the encrypted data packets based on the data packet lengths corresponding to each of the multiple consecutive encrypted data packets; and to construct a target data packet feature sequence based on the features of each of the data packets.
[0098] The multivariate time feature sequence construction module 20 is used to obtain an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence and a cumulative and downlink data packet feature sequence based on the cumulative and target data packet feature sequence, and to form a multivariate time feature sequence with the target data packet feature sequence.
[0099] The feature convolution module 30 is used to obtain a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of pre-generated convolution kernels.
[0100] The feature pooling module 40 is used to perform a pooling operation on the target convolution sequence to obtain a pooled feature sequence.
[0101] The data packet classification module 50 is used to input the pooled feature sequence into a pre-acquired classification model to obtain a classification label corresponding to each of the encrypted data packets.
[0102] The embodiment of the encrypted data packet classification device provided in the present application can be specifically used to execute the processing flow of the embodiment of the encrypted data packet classification method in the above-mentioned embodiment. Its functions will not be repeated here, and reference can be made to the detailed description of the above-mentioned encrypted data packet classification method embodiment.
[0103] The present application provides an encrypted data packet classification device, the method performed by the device includes: constructing a target data packet feature sequence based on the data packet lengths corresponding to each of a plurality of continuous encrypted data packets; obtaining an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence, and a cumulative and downlink data packet feature sequence based on a cumulative and sum function and the target data packet feature sequence, and forming a multivariate time feature sequence with the target data packet feature sequence; obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of convolution kernels; performing a pooling operation on the target convolution sequence to obtain a pooling feature sequence; inputting the pooling feature sequence into a pre-acquired classification model to obtain a classification label corresponding to each encrypted data packet. The present application can effectively reduce the complexity of encrypted data packet classification, thereby effectively improving the universality of encrypted data packet classification.
[0104] The embodiment of the present application also provides an electronic device, such as a central server, which may include a processor, a memory, a receiver and a transmitter, wherein the processor is used to execute the encrypted data packet classification method mentioned in the above embodiment, wherein the processor and the memory may be connected via a bus or other means, such as by bus connection. The receiver may be connected to the processor and the memory via wired or wireless means.
[0105] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.
[0106] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the encrypted data packet classification method in the embodiment of the present application. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, the encrypted data packet classification method in the above method embodiment is implemented.
[0107] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0108] The one or more modules are stored in the memory, and when executed by the processor, perform the encrypted data packet classification method in the embodiment.
[0109] In some embodiments of the present application, the user equipment may include a processor, a memory, and a transceiver unit, which may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected through a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.
[0110] As an implementation method, the functions of the receiver and the transmitter in the present application can be considered to be implemented through a transceiver circuit or a dedicated chip for transceiver, and the processor can be considered to be implemented through a dedicated processing chip, a processing circuit or a general chip.
[0111] As another implementation method, it is possible to use a general-purpose computer to implement the server provided in the embodiment of the present application, that is, to store the program code for implementing the functions of the processor, receiver, and transmitter in a memory, and the general-purpose processor implements the functions of the processor, receiver, and transmitter by executing the code in the memory.
[0112] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned encrypted data packet classification method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.
[0113] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.
[0114] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.
[0115] In the present application, features described and / or illustrated for one embodiment may be used in the same manner or in a similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.
[0116] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the embodiments of the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method for classifying encrypted data packets, characterized in that: include: Based on the data packet lengths corresponding to the plurality of consecutive encrypted data packets, the data packet features corresponding to the respective encrypted data packets are obtained; based on the features of the respective data packets, a target data packet feature sequence is constructed; Based on the cumulative sum function and the target data packet feature sequence, an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence and a cumulative and downlink data packet feature sequence are obtained, and a multivariate time feature sequence is formed with the target data packet feature sequence; Obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of pre-generated convolution kernels; Performing a pooling operation on the target convolution sequence to obtain a pooling feature sequence; The pooled feature sequence is input into a pre-acquired classification model to obtain a classification label corresponding to each of the encrypted data packets.
2. The method for classifying encrypted data packets according to claim 1, characterized in that: The obtaining of data packet features corresponding to each of the encrypted data packets based on the data packet lengths corresponding to each of the plurality of consecutive encrypted data packets comprises: If the encrypted data packet is an uplink data packet, taking a positive value of the data packet length of the encrypted data packet as a data packet feature of the encrypted data packet; If the encrypted data packet is a downlink data packet, the data packet length of the encrypted data packet takes a negative value as the data packet feature of the encrypted data packet.
3. The method for classifying encrypted data packets according to claim 1, characterized in that: The method of obtaining an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence, and a cumulative and downlink data packet feature sequence based on the cumulative and sum function and the target data packet feature sequence comprises: Constructing the uplink data packet characteristic sequence and the downlink data packet characteristic sequence based on the target data packet characteristic sequence; The cumulative sum target data packet feature sequence, cumulative sum uplink data packet feature sequence and cumulative sum downlink data packet feature sequence corresponding to the target data packet feature sequence, uplink data packet feature sequence and downlink data packet feature sequence are calculated based on the cumulative sum function.
4. The method for classifying encrypted data packets according to claim 1, characterized in that: The step of obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of pre-generated convolution kernels includes: Based on each of the convolution kernels, a convolution operation is performed on the multivariate time feature sequence at the target position of the convolution channel corresponding to each of the convolution kernels to obtain a convolution value at the target position corresponding to each of the convolution kernels; A target convolution sequence is obtained based on the convolution values of multiple target positions corresponding to each of the convolution kernels.
5. The method for classifying encrypted data packets according to claim 1, characterized in that: The pooling operation is performed on the target convolution sequence to obtain a pooling feature sequence, including one of the following four methods: Performing a positive ratio pooling operation on the target convolution sequence to obtain a first pooling feature sequence; Performing a positive mean pooling operation on the target convolution sequence to obtain a second pooling feature sequence; Performing a positive index mean pooling operation on the target convolution sequence to obtain a third pooling feature sequence; Performing the longest positive segment pooling operation on the target convolution sequence obtains a fourth pooling feature sequence.
6. The method for classifying encrypted data packets according to claim 4, characterized in that: The step of performing convolution operations on the multivariate time feature sequence based on each of the convolution kernels at the target positions of the convolution channels respectively corresponding to each of the convolution kernels to obtain the convolution values at the target positions respectively corresponding to each of the convolution kernels includes: Based on the multivariate time feature sequence, the weights corresponding to each of the convolution kernels, the dilation value, the bias constant, the convolution channel and the target position on the convolution channel, the convolution value at the target position corresponding to each of the convolution kernels is calculated.
7. The method for classifying encrypted data packets according to claim 4, characterized in that: The target convolution sequence is obtained based on the convolution values of the multiple target positions corresponding to each of the convolution kernels, including: Summing the convolution values of all convolution channels corresponding to the target position to obtain a target position convolution sequence; The target convolution sequence is constructed according to the target position convolution sequence corresponding to each target position on all convolution channels.
8. An encrypted data packet classification device, characterized in that: include: A feature extraction module, used to obtain the data packet features corresponding to each of the encrypted data packets based on the data packet lengths corresponding to each of the multiple consecutive encrypted data packets; and to construct a target data packet feature sequence based on the features of each of the data packets; A multivariate time feature sequence construction module is used to obtain an uplink data packet feature sequence, a downlink data packet feature sequence, a cumulative and target data packet feature sequence, a cumulative and uplink data packet feature sequence, and a cumulative and downlink data packet feature sequence based on a cumulative and function and the target data packet feature sequence, and form a multivariate time feature sequence with the target data packet feature sequence; A feature convolution module, used for obtaining a target convolution sequence corresponding to the multivariate time feature sequence based on a plurality of pre-generated convolution kernels; A feature pooling module, used for performing a pooling operation on the target convolution sequence to obtain a pooled feature sequence; The data packet classification module is used to input the pooled feature sequence into a pre-acquired classification model to obtain a classification label corresponding to each of the encrypted data packets.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the encrypted data packet classification method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the encrypted data packet classification method according to any one of claims 1 to 7 is implemented.