VPN traffic identification method and system based on multi-model fusion

Abstract

The application provides a VPN traffic identification method and system based on multi-model fusion, which splices a Pcap file traffic feature vector and a geographic feature vector, uses a random forest model and an LSTM network model respectively for traffic category prediction, splices the prediction results as the input of a meta model to obtain a final prediction result. The application realizes efficient network traffic monitoring, feature extraction and decision support. The collaborative work between various modules provides strong technical support for network security monitoring, and can effectively deal with complex network security threats; the application improves the effect of Vmess and Shadowsocks by 5% through multi-model fusion, and does not reduce the judgment accuracy by discarding the subsequent traffic by obtaining the first 100 frames of the Pcap packet, and shortens the judgment time to 40% of the original.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, specifically to a VPN traffic identification method and system based on multi-model fusion. Background Technology

[0002] Cross-border communication utilizes technologies such as encrypted tunnels (VPN technology) and covert communication (protocol spoofing) to establish request transmissions and data communications with overseas servers, enabling access to cross-border resources. Users connect to overseas servers via broadband lines from operators such as China Telecom, China Unicom, and China Mobile, using direct connections and relay methods (through domestically deployed servers for traffic aggregation and relay) to access the overseas internet. By analyzing cross-border communication processes and data, various network infrastructure resources are acquired during the communication process. Based on information such as cross-border communication resources, services, and data, a cross-border communication resource intelligence database is established. Monitoring strategies are then developed based on this intelligence database to monitor cross-border communication activities.

[0003] Virtual Private Network (VPN) technology provides users with secure and reliable data transmission services by establishing a private network over a public network. VPNs are widely used in scenarios such as remote work and internal communications within multinational corporations. While improving network transmission security, they also bring challenges to network management and security oversight.

[0004] Currently, VPN traffic identification is mainly based on the following methods:

[0005] Port identification: This method detects VPNs by identifying the fixed ports they use, such as OpenVPN's default port 1194. However, this method is easily circumvented, for example, by using custom ports. Protocol feature identification: This method analyzes the unique handshake process and message format of VPN protocols. However, with the development of VPN protocols and the application of obfuscation techniques, relying solely on protocol features is insufficient for accurate identification.

[0006] Traffic statistics: This method analyzes the statistical characteristics of VPN traffic, such as packet length distribution and flow duration. However, it is susceptible to network conditions and has poor robustness.

[0007] Machine learning methods: These methods utilize machine learning algorithms to classify VPN traffic. However, traditional machine learning methods have limitations in feature selection and model generalization capabilities.

[0008] The existing technology has the following shortcomings:

[0009] A single feature is insufficient to fully characterize VPN traffic, resulting in low identification accuracy. While deep learning has shone brightly in many fields, its performance is often not ideal when dealing with CSV-formatted data. It lacks real-time VPN traffic detection solutions for large-scale network environments and struggles to cope with new VPN protocols and obfuscation techniques.

[0010] Therefore, there is an urgent need for a VPN traffic identification method that can integrate multi-dimensional features and has strong generalization ability to improve detection accuracy and practicality. Summary of the Invention

[0011] This invention addresses the accuracy and practicality of VPN traffic identification by providing a multi-model fusion-based VPN traffic identification method and system. It concatenates the traffic feature vector from a Pcap file with a geographic feature vector, then uses a random forest model and an LSTM network model to predict traffic categories. The prediction results are then concatenated and input into a meta-model to obtain the final prediction result. This invention achieves efficient network traffic monitoring, feature extraction, and decision support. The collaborative work between the various modules provides strong technical support for network security monitoring and can effectively address complex network security threats. This invention improves the performance of Vmess and Shadowsocks analysis by 5% compared to single-model algorithms through multi-model fusion. By acquiring the first 100 frames of the Pcap packet and discarding the subsequent traffic, the accuracy is not reduced, and the analysis time is shortened to 40% of the original.

[0012] This invention provides a VPN traffic identification method based on multi-model fusion, comprising the following steps:

[0013] S1. The data acquisition module collects network traffic data in real time and generates a Pcap file;

[0014] S2. The multi-dimensional feature extraction module segments and parses the Pcap file, classifies it into TCP and UDP according to protocol type, and then extracts the five-tuple features and calculates additional features to obtain the traffic feature vector.

[0015] The multi-model fusion module extracts the geographic location information from the Pcap file to obtain the geographic feature vector. The traffic feature vector is concatenated with the geographic feature vector to obtain the cross-border feature concatenation vector, which is then output to the trained random forest model and LSTM network model.

[0016] S3. The random forest model predicts VPN traffic categories based on the concatenated cross-border feature vectors, resulting in a random forest classification prediction result f. _rf (x) Output to the meta-model. The LSTM network model uses time series prediction to predict VPN traffic categories and obtains the LSTM prediction result f. _lstm(x) Output to the meta-model, which concatenates the random forest classification prediction results and the LSTM prediction results to form a new feature set X. meta Then the new feature set X meta Inputting the data into the meta-model for VPN traffic category prediction and performing logistic regression analysis yields the meta-model prediction probability P(y=1|x):

[0017] P(y=1|x=σ(ω0+ω1·f) _rf (x)+ω2·f _lstm (x));

[0018] Where σ is the sigmoid function, σ(z) = 1 / (1+e ^(-z) ), ω0, ω1, ω2 are the weights of the logistic regression, and x is the input cross-border feature concatenation vector;

[0019] A VPN traffic identification method based on multi-model fusion is completed by determining the data protocol category of network traffic based on thresholds and meta-model prediction probabilities and generating a detection report.

[0020] In the VPN traffic identification method based on multi-model fusion described in this invention, as a preferred embodiment, in step S2, the five-tuple features include source IP, source port, destination IP, destination port, and protocol type.

[0021] Additional features include: mean uplink packet size, standard deviation of uplink packet size, mean uplink interval time, standard deviation of uplink interval time, uplink packet size, downlink packet size, packet quantity ratio, packet size ratio, mean downlink packet size, standard deviation of downlink packet size, entropy, response, response ratio, transmission, transmission ratio, and timestamp;

[0022] The size of the uplink packet is the size of the first 10 uplink packets in the Pcap file, the size of the downlink packet is the size of the first 10 downlink packets in the Pcap file, and the entropy value is the first 4 entropy values ​​in the Pcap file.

[0023] Geographic location information includes the country / region of the source IP and the country / region of the destination IP.

[0024] The VPN traffic identification method based on multi-model fusion described in this invention, as a preferred embodiment, includes step S3,

[0025] X meta =[f _rf (x),f _lstm (x)];

[0026] The data protocol category for network traffic is either Vmess or Shadowsocks.

[0027] The VPN traffic identification method based on multi-model fusion described in this invention, as a preferred embodiment, includes the following steps in the training method of the random forest model, LSTM network model, and meta-model:

[0028] The machine learning analysis system extracts stored log data from the machine learning log management system through the data acquisition module, splits the Pcap packet into single streams through the multi-dimensional feature extraction module, extracts features and calculates additional features to obtain the traffic feature vector, and extracts geographical location information through the multi-model fusion module and merges it with the traffic feature vector to form a cross-border feature concatenation vector, which is then divided into training set, validation set and test set.

[0029] The random forest model and LSTM network model are trained on the training set to predict VPN traffic categories. Then, the random forest model and LSTM network model are used to predict on the validation set, and the prediction results are used to train the meta-model. The model hyperparameters are then adjusted based on the confusion matrix and ROC curve, and the accuracy of the model is evaluated using cross-validation. Based on the evaluation results, the hyperparameters or structure are further adjusted to fine-tune the model until the accuracy of VPN traffic category prediction reaches the target value. Finally, the random forest model and LSTM network model are used to make predictions on the test set, and the prediction results are concatenated and input into the meta-model to obtain the final prediction result.

[0030] The VPN traffic identification method based on multi-model fusion described in this invention, as a preferred approach, uses the SFTP protocol for data transmission during the identification and training process; sensitive data is encrypted, or differential privacy methods are used to process core data, replace the user's personal identity information, and replace it with a unique ID.

[0031] This invention provides a VPN traffic identification system based on multi-model fusion, including a machine learning log management system, a machine learning analysis system, and a data collection and analysis system that interact with data via the SFTP protocol;

[0032] The machine learning log management system stores logs, manages and backs up data. The machine learning analysis system trains and evaluates machine learning models based on the log data stored in the machine learning log management system and outputs analysis results. The data acquisition and analysis system loads the trained machine learning model to parse real-time acquired network traffic data, integrates country / region codes for feature analysis, generates detection reports, and sends the detection reports to the machine learning analysis system.

[0033] Machine learning models include random forest models, LSTM network models, and meta-models connected to the outputs of random forest models and LSTM network models. The inputs of random forest models and LSTM network models are connected to cross-border feature models.

[0034] The cross-border feature model includes a feature embedding layer, which extracts the traffic feature vector and geographic feature vector of the Pcap data packet, and concatenates the geographic feature vector with the traffic feature vector to obtain the cross-border feature concatenation vector. Then, the cross-border feature concatenation vector is output to the random forest model and the LSTM network model respectively.

[0035] The random forest model classifies traffic by processing cross-border feature concatenation vectors and capturing nonlinear relationships, and outputs random forest classification prediction results.

[0036] The LSTM network model captures the temporal patterns of traffic, analyzes the time dependencies in the sequence data to classify traffic, and outputs LSTM prediction results.

[0037] The meta-model is a logistic regression model. It concatenates the random forest classification prediction results with the LSTM prediction results to form a new feature set. Then, it performs probability prediction based on the new feature set and determines the data protocol category based on the threshold.

[0038] The VPN traffic identification system based on multi-model fusion described in this invention, as a preferred embodiment, uses a machine learning log management system to receive log data from different sources through an API interface and store it in a database. The system also formats the received log data, provides a query interface, supports rapid retrieval and analysis of the log data, regularly cleans up expired logs, and regularly backs up log data. The log data includes network traffic logs and system event logs.

[0039] The VPN traffic identification system based on multi-model fusion described in this invention, as a preferred embodiment, includes a data acquisition module, a multi-dimensional feature extraction module, a multi-model fusion module, a decision engine, and an adaptive optimization module in both the machine learning analysis system and the data acquisition analysis system.

[0040] The VPN traffic identification system based on multi-model fusion described in this invention, as a preferred method, involves a multi-dimensional feature extraction module that segments and parses the first 100 frames of a Pcap file.

[0041] The VPN traffic identification system based on multi-model fusion described in this invention, as a preferred approach, uses a meta-model to predict the threat level based on a new set of features.

[0042] The present invention solves the following problems: (1) how to accurately identify and distinguish between VPN traffic and ordinary encrypted traffic; (2) how to reduce false alarm rate and false negative rate, especially the cross-border characteristics when facing new VPN technologies; (3) how to effectively capture and utilize the unique characteristics of cross-border traffic; and (4) how to quickly extract features for analysis when facing large PAP traffic packets.

[0043] The present invention has the following advantages:

[0044] (1) Through the detailed implementation of the machine learning log management system, machine learning analysis system, and data acquisition analysis system, this system achieves efficient network traffic monitoring, feature extraction, and decision support. The collaborative work between the various modules provides strong technical support for network security monitoring and can effectively address complex network security threats.

[0045] (2) The present invention improves the effect of Vmess and Shadowsocks by 5% by multi-model fusion and evaluation compared with single algorithm; by obtaining the first 100 frames of Pcap packet and discarding the traffic afterward, the evaluation accuracy is not reduced and the evaluation time is shortened to 40% of the original. Attached Figure Description

[0046] Figure 1 A flowchart of a VPN traffic identification method based on multi-model fusion;

[0047] Figure 2 This is a schematic diagram of a VPN traffic identification system based on multi-model fusion. Detailed Implementation

[0048] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0049] Example 1

[0050] like Figures 1-2 As shown, a VPN traffic identification method and system based on multi-model fusion is presented. This system consists of three main modules: a machine learning log management system, a machine learning analysis system, and a data acquisition and analysis system. Each module interacts with data via the secure SFTP protocol to ensure the security and integrity of data transmission.

[0051] (1) The functions of the machine learning log management system are:

[0052] Log storage: Responsible for receiving and storing log data from different sources, including network traffic logs, system event logs, etc.

[0053] Data management: Regularly clean up expired logs to ensure efficient database operation.

[0054] Data backup: Regularly back up log data to prevent data loss.

[0055] The implementation steps include:

[0056] Data reception: Receive log data through the API interface and store it in the database.

[0057] Data formatting: The received log data is formatted to ensure data consistency and readability.

[0058] Data Query: Provides a query interface to support fast retrieval and analysis of log data.

[0059] (2) The functions of the machine learning analysis system are:

[0060] Feature extraction: Extracting features from Pcap packets

[0061] Model training: Training machine learning models using stored log data.

[0062] Model evaluation: Evaluate the trained model to ensure its accuracy and reliability.

[0063] Output results: Output the model's analysis results for subsequent decision-making.

[0064] The implementation steps include:

[0065] Feature extraction: Extracting the required log data from the log management system and performing preprocessing, including Pcap packet splitting into single streams and feature extraction. Calculating additional features, including but not limited to:

[0066] Entropy calculation

[0067] Package size and standard deviation

[0068] Packet downlink size and its average value

[0069] Communication frequency, duration, etc.

[0070] Extract geographic location information, such as the country / region of the source IP and destination IP.

[0071] Model selection: Random Forest and LSTM models were chosen.

[0072] Model training: The model is trained using the preprocessed data, which can generate predictions for multiple base models (such as random forest and LSTM). These predictions are concatenated according to the following formula (1) as new features (meta-features) as shown in Formula 1. These new features are input into the meta-model (logistic regression is selected in this patent) for training. The hyperparameters are adjusted according to the confusion matrix, ROC curve, etc. to optimize the model performance.

[0073] Feature splicing:

[0074] X meta =[f _rf (x),f _lstm (x)] (1)

[0075] X meta By combining the prediction results from the random forest and LSTM models (f _rf (x) and f _lstm (x) is combined to form a new set of features;

[0076] Where: X meta f is a meta-feature matrix or meta-dataset. _rf (x) represents the prediction result generated by the random forest model on the input feature x, f _lstm (x) represents the prediction result generated by the LSTM model on the input feature x;

[0077] The mathematical expression for the meta-model prediction:

[0078] For input x, the predicted probability of the meta-model is shown in formula (2):

[0079] P(y=1|x=σ(ω0+ω1·f) _rf (x)+ω2·f _lstm (x)) (2)

[0080] in:

[0081] σ is the sigmoid function: σ(z) = 1 / (1+e ^(-z) w0, w1, w2 are the weights of the logistic regression, f _rf (x) is the prediction of x by the random forest model, f _lstm (x) is the prediction of x by the LSTM model;

[0082] Model evaluation: Use methods such as cross-validation to evaluate the accuracy of the model and ensure its effectiveness in practical applications.

[0083] Final decision:

[0084] Based on the output probability, select a threshold (e.g., 0.5) to determine which category the sample belongs to. The category can be Vmess protocol or Shadowsocks protocol.

[0085] For binary classification, if P(y=1|x)>=0.5, then the sample is predicted to belong to class 1; otherwise, it is predicted to belong to class 0.

[0086] (3) The functions of the data acquisition and analysis system are:

[0087] Data Acquisition: Collect network traffic data in real time and generate pcap packets.

[0088] Data analysis: Analyze the collected pcap packets, extract features, and make judgments.

[0089] Results Feedback: The analysis results are fed back to the machine learning judgment system to form a closed loop.

[0090] The implementation steps are as follows:

[0091] Real-time data collection: Network traffic is collected in real time using network monitoring tools, and a Pcap file is generated.

[0092] Data parsing: Parse the Pcap file and extract the five-tuple features (source IP, source port, destination IP, destination port, protocol type).

[0093] Feature analysis: Calculate additional features, such as packet size and traffic frequency, to form a feature set.

[0094] Data analysis:

[0095] (1) Design a feature embedding layer to encode the country / region as a vector, concatenate the geographic vector with the traffic feature, and input it into the random forest model to obtain preliminary prediction results. At the same time, input this feature data into the LSTM model for time series prediction to obtain another set of prediction results.

[0096] (2) The prediction results of the random forest and LSTM models are fused and input into the meta-model to obtain the final prediction result. This step can improve the accuracy and robustness of the prediction.

[0097] (3) Output the fused results and generate a corresponding report. This includes the analysis and visualization of the prediction results.

[0098] Output results: The analysis results are sent to the machine learning evaluation system for further evaluation by the model.

[0099] The VPN traffic identification method based on multi-model fusion follows the process as follows: Figure 2 As shown, the specific steps include:

[0100] Step 1: Load the trained machine learning models, including random forests, LSTM networks, and cross-border feature models.

[0101] Step 2: Input the extracted features into each model to make predictions.

[0102] Step 3:

[0103] 1. Feed the test set into the base models (random forest, LSTM) to obtain the prediction results for each random forest and LSTM.

[0104] 2. Prediction

[0105] The result obtained using step 1 is input into the meta-model, and this prediction result is the final prediction result.

[0106] Step 4: Generate a preliminary detection report based on the fusion results, including possible threat levels and related characteristics.

[0107] In this embodiment, data interaction and security are ensured through the following methods:

[0108] SFTP interface: The modules transmit data via the SFTP protocol to ensure data security during transmission.

[0109] Data encryption: Sensitive data is encrypted during transmission to prevent data leakage.

[0110] Privacy Protection Mechanism: Throughout the implementation process, differential privacy technology is employed to ensure that the processing of user data complies with privacy protection standards. Core data, after processing, replaces the user's personally identifiable information, such as name and address, with a unique ID that no longer contains specific user identity or sensitive information.

[0111] Through the detailed implementation of the above modules, this system achieves efficient network traffic monitoring, feature extraction, and decision support. The collaborative work between these modules provides strong technical support for network security monitoring and effectively addresses complex network security threats.

[0112] Both the machine learning analysis system and the data acquisition analysis system in this system consist of five main parts: a data acquisition module, a multi-dimensional feature extraction module, a multi-model fusion module, a decision engine, and an adaptive optimization module. They are designed to perform network traffic analysis and detection efficiently and accurately.

[0113] 1. Data Acquisition Module

[0114] This module retrieves Pcap data packets from remote servers via the SFTP protocol, ensuring efficient and secure data transmission. It also supports the integration and management of large-scale data.

[0115] 2. Multidimensional Feature Extraction Module

[0116] After obtaining Pcap data, the system segments and parses the packets, classifying them into TCP and UDP protocols, and then extracts the five-tuple features (source IP, source port, destination IP, destination port, and protocol type) for each data stream. This module calculates up to 30 features, including but not limited to:

[0117] Entropy

[0118] Package size and standard deviation

[0119] Packet downlink size and its average value

[0120] Extracting this series of features helps in the in-depth analysis of network traffic behavior patterns.

[0121] 3. Multi-model fusion detection

[0122] 3.1 The system integrates multiple machine learning models to enhance the comprehensiveness and accuracy of detection, mainly including:

[0123] 3.3.1 Random Forest: It excels at handling high-dimensional features and capturing non-linear relationships, making it suitable for classifying complex datasets.

[0124] 3.3.2 LSTM (Long Short-Term Memory) network: It can capture the temporal characteristics of traffic and is especially suitable for analyzing the time dependence in sequence data.

[0125] 3.2 Enhanced Cross-Border Features

[0126] 3.2.1 Introduce a geolocation awareness mechanism to extract cross-border traffic features, focusing on key features such as international gateways and cross-border links to improve detection accuracy.

[0127] 3.3 Fusion of ensemble model results

[0128] The Stacking method is used to integrate the outputs of Random Forest and LSTM.

[0129] 4. Privacy Protection Mechanism

[0130] A differential privacy mechanism is designed to ensure efficient detection while minimizing the risk of personal information leakage and protecting user privacy.

[0131] 5. Cross-platform compatibility

[0132] The system adopts a modular architecture, making it highly adaptable and allowing deployment on different network devices and operating systems, ensuring a wide range of application scenarios.

[0133] 6. Reporting of analysis results

[0134] Finally, the system can promptly report the detection and analysis results to the designated location, supporting subsequent decision-making and response mechanisms.

[0135] This technical solution achieves efficient network traffic monitoring and analysis through the synergistic effect of its various modules, providing a solid technical foundation for addressing complex network security challenges.

[0136] This embodiment improves the performance of Vmess and Shadowsocks by 5% through multi-model fusion compared to a single algorithm; by acquiring the first 100 frames of the Pcap packet and discarding the subsequent traffic, the accuracy of the analysis is not reduced, and the analysis time is shortened to 40% of the original.

[0137] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A VPN traffic identification method based on multi-model fusion, characterized in that: Includes the following steps: S1. The data acquisition module collects network traffic data in real time and generates a Pcap file; S2. The multi-dimensional feature extraction module segments and parses the Pcap file, classifies it into TCP and UDP according to protocol type, and then extracts the five-tuple features and calculates additional features to obtain the traffic feature vector. The multi-model fusion module extracts the geographic location information of the Pcap file to obtain a geographic feature vector, and concatenates the traffic feature vector with the geographic feature vector to obtain a cross-border feature concatenation vector, which is then output to the trained random forest model and LSTM network model. S3. The random forest model performs VPN traffic category prediction based on the cross-border feature concatenation vector to obtain the random forest classification prediction result f. _rf (x) Output to the meta-model, where the LSTM network model performs VPN traffic category prediction through time series forecasting to obtain the LSTM prediction result f. _lstm (x) is output to the meta-model, which concatenates the random forest classification prediction results and the LSTM prediction results to form a new feature set X. meta Then, the new feature set X meta Inputting the data into the meta-model for VPN traffic category prediction yields the meta-model prediction probability P(y=1|x): P(y=1|x)=σ(ω0+ω1·f _rf (x)+ω2·f _lstm (x)); Where σ is the sigmoid function, σ(z) = 1 / (1+e ^(-z) ), ω0, ω1, ω2 are the weights of the logistic regression, and x is the input cross-border feature concatenation vector; Based on the threshold and the predicted probability of the meta-model, the data protocol category of the network traffic is determined and a detection report is generated, thus completing a VPN traffic identification method based on multi-model fusion.

2. The VPN traffic identification method based on multi-model fusion according to claim 1, characterized in that: In step S2, the five-tuple features include source IP, source port, destination IP, destination port, and protocol type; The additional features include: mean uplink packet size, standard deviation of uplink packet size, mean uplink interval time, standard deviation of uplink interval time, uplink packet size, downlink packet size, packet quantity ratio, packet size ratio, mean downlink packet size, standard deviation of downlink packet size, entropy value, response, response ratio, transmission, transmission ratio, and timestamp; The uplink packet size is the size of the first 10 uplink packets in the Pcap file, the downlink packet size is the size of the first 10 downlink packets in the Pcap file, and the entropy value is the first 4 entropy values ​​in the Pcap file; The geographic location information includes the country / region of the source IP and the country / region of the destination IP.

3. The VPN traffic identification method based on multi-model fusion according to claim 1, characterized in that: In step S3, X meta =[f _rf (x),f _lstm (x)]; The data protocol category for network traffic is either Vmess or Shadowsocks.

4. The VPN traffic identification method based on multi-model fusion according to claim 1, characterized in that: The training methods for the random forest model, the LSTM network model, and the meta-model include the following steps: The machine learning analysis system extracts stored log data from the machine learning log management system through the data acquisition module, segments the Pcap packet into single streams through the multi-dimensional feature extraction module, extracts features and calculates additional features to obtain the traffic feature vector, and extracts the geographical location information through the multi-model fusion module and fuses it with the traffic feature vector to form the cross-border feature concatenation vector, which is then divided into training set, validation set and test set. The Random Forest model and the LSTM network model are trained using the training set to predict VPN traffic categories. Then, the Random Forest model and the LSTM network model are used to predict the validation set, and the prediction results are used to train the meta-model. Next, the model hyperparameters are adjusted based on the confusion matrix and ROC curve, and cross-validation is used to evaluate the model's accuracy. Based on the evaluation results, hyperparameter adjustments or structural adjustments are made to fine-tune the model until the accuracy of VPN traffic category prediction reaches the target value. Finally, the Random Forest model and the LSTM network model are used to make predictions using the test set, and the prediction results are concatenated and input into the meta-model to obtain the final prediction result.

5. The VPN traffic identification method based on multi-model fusion according to claim 1, characterized in that: During the identification and training process, data is transmitted via the SFTP protocol; sensitive data is encrypted, or differential privacy methods are used to process core data, replace the user's personal identity information, and replace it with a unique ID.

6. A VPN traffic identification system based on multi-model fusion according to any one of claims 1 to 5, characterized in that: This includes machine learning log management systems, machine learning analysis systems, and data acquisition and analysis systems that interact with data via the SFTP protocol; The machine learning log management system performs log storage, data management, and data backup. The machine learning judgment system trains and evaluates the machine learning model based on the log data stored in the machine learning log management system and outputs judgment results. The data acquisition and judgment system loads the trained machine learning model, parses the real-time acquired network traffic data, integrates country / region codes for feature analysis, generates a detection report, and sends the detection report to the machine learning judgment system. The machine learning model includes the random forest model, the LSTM network model, and the meta-model connected to the outputs of the random forest model and the LSTM network model. The inputs of the random forest model and the LSTM network model are connected to the cross-border feature model. The cross-border feature model includes a feature embedding layer, which extracts the traffic feature vector and geographical feature vector of the Pcap data packet, and concatenates the geographical feature vector with the traffic feature vector to obtain the cross-border feature concatenation vector. Then, the cross-border feature concatenation vector is output to the random forest model and the LSTM network model respectively. The random forest model performs traffic classification and outputs random forest classification prediction results by processing the cross-border feature splicing vector and capturing nonlinear relationships. The LSTM network model captures the temporal patterns of traffic, analyzes the time dependencies in the sequence data to classify traffic, and outputs LSTM prediction results. The meta-model is a logistic regression model. The random forest classification prediction results and the LSTM prediction results are concatenated to form a new feature set. Probability prediction is then performed based on the new feature set, and the data protocol category is determined based on a threshold.

7. A VPN traffic identification system based on multi-model fusion according to claim 6, characterized in that: The machine learning log management system receives log data from different sources through an API interface and stores it in a database. It also formats the received log data, provides a query interface, supports rapid retrieval and analysis of log data, regularly cleans up expired logs, and regularly backs up log data. The log data includes network traffic logs and system event logs.

8. A VPN traffic identification system based on multi-model fusion according to claim 6, characterized in that: Both the machine learning analysis system and the data acquisition analysis system include the data acquisition module, the multi-dimensional feature extraction module, the multi-model fusion module, the decision engine, and the adaptive optimization module.

9. A VPN traffic identification system based on multi-model fusion according to claim 8, characterized in that: The multidimensional feature extraction module segments and parses the first 100 frames of the Pcap file.

10. A VPN traffic identification system based on multi-model fusion according to claim 6, characterized in that: The meta-model predicts the threat level based on the new feature set.

Images