Encrypted traffic classification method based on multi-view heterogeneous graph model

Abstract

The invention provides an encrypted traffic classification method based on a multi-view heterogeneous graph model (MH-Net). The accuracy and robustness of network traffic classification can be effectively improved. In the method, the multi-view flow graph is constructed, and the diversity of information granularity is enriched by aggregating different numbers of flow bits into various types of flow units. And head-head, head-load and load-load flow unit correlation is further introduced to form a heterogeneous flow graph, and feature extraction is performed by using a heterogeneous graph neural network. Besides, through a multi-task contrast learning strategy, the robustness of traffic unit representation is enhanced, synchronous training is realized in traffic level and data packet level classification tasks, and the overall performance is optimized. Experimental results show that the method has excellent performance on a plurality of data sets, exceeds the prior art and shows the application potential in the field of network traffic classification.

Description

Technical Field

[0001] The present invention relates to computer network information security technology, and in particular to an encrypted traffic classification method based on a multi-view heterogeneous graph model. Background Art

[0002] With the continuous development of computer network technology and the access of a large number of devices to the Internet, user privacy is increasingly vulnerable to malicious attacks. Although encryption technologies such as VPN and Tor can provide protection for users, they can also be used by attackers as a tool to hide their identities. Traditional packet deep inspection (DPI) methods have lost their effectiveness when facing encrypted traffic. Designing a method that can universally and effectively classify attacker network activities (such as website browsing or application usage) from encrypted traffic remains a huge challenge.

[0003] In the past few years, many methods have been proposed to enhance the capabilities of encrypted traffic classification techniques. Among them, statistical-based methods usually rely on hand-crafted traffic statistical features and then use traditional machine learning models for classification. However, these methods require a lot of feature engineering and are easily affected by unreliable traffic. With the rise of representation learning, some methods also adopt deep learning models for traffic classification, such as pre-trained language models. Although these methods have shown competitive performance, they fail to fully reveal the fine-grained associations between traffic bytes, which can be attributed to the following two shortcomings: (1) Rigid information granularity limited by bytes. Most existing methods default to treating a byte as an indivisible unit, which ignores the diversity of information granularity contained in traffic data. For example, a Chinese character is represented by two bytes, while an English letter is represented by one byte, which shows that traffic data generally contains information of different granularities (note that the granularity is not necessarily bytes, but may be bits). (2) Lack of consideration of multiple types of associations between bytes. Current methods mix together byte correlations at different positions in the byte sequence, which ignores the differences between different types of correlations (for example, the types of correlations between header bytes and payload bytes are different). Therefore, how to reveal and exploit the potential fine-grained correlations between traffic bytes to enhance traffic classification becomes a prominent problem.

[0004] Flow-level traffic classification method.

[0005] Flow-level traffic classification methods aim to classify traffic flows, which can be summarized into the following three categories:

[0006] Statistical feature-based methods. Many methods use statistical features to represent packet attributes and utilize traditional machine learning models for classification. App-Scanne extracts features from traffic based on bidirectional flow features, while CUMUL (uses cumulative packet length as its feature. ETC-PS enhances packet length sequences by applying path signature theory, and Conti et al. also extract features through hierarchical clustering.

[0007] Fingerprint matching-based method. Fingerprint identification represents traffic characteristics and is also used for traffic identification. FlowPrint generates traffic fingerprints by creating association graphs and calculating activity values ​​between target IPs. K-FP uses random forests to build fingerprints and identifies unknown samples through k-nearest neighbor matching.

[0008] · Methods based on deep learning. Deep learning demonstrates powerful learning capabilities, and many traffic classification methods are based on this. RBRN, DF, and FS-Net all use statistical feature sequences (e.g., packet length sequences) as inputs to convolutional neural networks (CNNs) or recurrent neural networks (RNNs). In addition, there are some methods that use raw bytes as features. EBSNN combines RNN and attention mechanisms to process header and payload byte segments. ET-BERT performs pre-training tasks on large-scale traffic datasets to learn powerful raw byte representations, which is time-consuming and expensive. Graph neural networks (GNNs) are another model that can be used for traffic classification tasks. GraphDApp builds a traffic interaction graph through traffic bursts and uses GNNs for representation learning. TFE-GNN uses point-to-point mutual information to build byte-level traffic graphs and designs a traffic graph encoder for feature extraction. YaTC adopts a traffic transformer based on masked autoencoders to achieve efficient feature extraction and improve performance.

[0009] Packet-level traffic classification methods. In contrast, packet-level traffic classification methods identify different categories for each network packet. Securitas generates n-grams for raw bytes and uses Latent Dirichlet Allocation (LDA) to form protocol keywords as features, and then uses SVM, C4.5 decision tree, or Bayesian network for packet classification. 2D-CNN and 3D-CNN treat packet bytes as pixel values ​​and convert them into images, which are then input into 2D-CNN and 3D-CNN for packet classification. DP uses CNN and autoencoders to extract byte features. BLJAN explores the correlation between packet bytes and their labels and encodes them into a joint embedding space for packet classification. EBSNN and ET-BERT can also perform packet classification. But they still require two independent training or fine-tuning for flow-level and packet-level tasks, which is computationally expensive. PacRep uses triplet loss, no data augmentation, and jointly optimizes multiple packet-level tasks to learn better packet representations.

[0010] In summary, existing methods do not fully consider the information relevance contained in the raw bytes when performing traffic classification tasks, and thus face performance bottlenecks.

[0011] It should be noted that the information disclosed in the above background technology section is only used for understanding the background of the present application, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0012] The main purpose of the present invention is to overcome the defects existing in the above-mentioned background technology and provide an encrypted traffic classification method based on a multi-view heterogeneous graph model (MH-Net).

[0013] To achieve the above object, the present invention adopts the following technical solutions:

[0014] A method for classifying encrypted traffic based on a multi-view heterogeneous graph model comprises the following steps:

[0015] S1. Construction of multi-view traffic graph: Aggregate the bits in the network traffic data into multiple types of traffic units to achieve the diversity of information granularity; Use point-to-point mutual information (PMI) to quantify the correlation between sequences of different types of traffic units, construct a multi-view traffic graph, and reveal the fine-grained association between traffic units through the graph structure of the constructed multi-view traffic graph;

[0016] S2. Heterogeneous traffic graph representation learning: Based on the constructed multi-view traffic graph, the head-head, head-load and load-load unit correlations are introduced to form a heterogeneous traffic graph; the heterogeneous graph neural network HGNN is used to perform representation learning on the heterogeneous traffic graph. The distinguishing features in the traffic graph are extracted through heterogeneous traffic graph representation learning, providing rich feature representations for traffic classification tasks, including flow level and packet level representations;

[0017] S3. Multi-task training of MH-Net model: Based on the constructed multi-view traffic graph and the extracted discriminative features, multi-task training of MH-Net model is performed, wherein the traffic classification tasks at packet level and flow level, as well as the contrastive learning tasks, are jointly trained; wherein, traffic classification is performed at the packet level and flow level, and the obtained traffic level and packet level representations are converted into classification results using a multi-layer perceptron MLP, and the corresponding traffic classification task loss is calculated; a contrastive learning strategy is adopted to learn semantically invariant representations by comparing positive and negative sample pairs from various data enhancements; the multi-task training of MH-Net model achieves accurate classification of encrypted traffic through overall end-to-end training.

[0018] Furthermore, step S1 specifically includes:

[0019] Convert the aggregated flow unit sequence into a flow graph to form an interconnected whole, and use the graph structure to mine the potential fine-grained correlation in the flow unit sequence;

[0020] The point-to-point mutual information (PMI) algorithm is applied to quantify the correlation between traffic units, and the number of co-occurrences is counted by sliding a window over the traffic unit sequence;

[0021] PMI values ​​are calculated to identify high correlations between flow units. Only when the PMI value is greater than zero, two flow units are connected to indicate that there is a significant correlation between them.

[0022] For the traffic data in each data packet, two traffic units with different lengths are selected, (N 1 )-bit and (N 2 )-bit flow units, respectively apply the PMI algorithm to construct a multi-view flow graph G{ N1} and G{ N2};

[0023] In the constructed multi-view traffic graph, the characteristics of the nodes are determined by the values ​​of each traffic unit.

[0024] Furthermore, in step S2, the correlation of heterogeneous traffic units is integrated to enhance the model's ability to capture functional differences of different parts of traffic data, including:

[0025] Identify the heterogeneity of headers and payloads in packet byte sequences, and the correlation of different types of traffic units based on their positions;

[0026] Three types of traffic unit correlations, head-head (hh), load-load (pp) and head-load (hp), are constructed to fully exploit the heterogeneity in head and load;

[0027] The PMI algorithm is applied to the header, load, and the entire flow unit sequence to obtain three types of flow edges, and these edges are integrated into a heterogeneous flow graph G H ;

[0028] Build a heterogeneous traffic graph and Enables fine-grained heterogeneous fusion of headers and payloads in a single traffic graph for efficient representation learning.

[0029] Furthermore, in step S2, a heterogeneous traffic graph encoder is applied to perform traffic representation learning to extract and learn heterogeneous features in the traffic graph and generate traffic representation, specifically including:

[0030] The heterogeneous flow graph encoder uses a heterogeneous graph neural network HGNN to extract discriminative features of the flow graph;

[0031] The model weights of different edge types of the heterogeneous graph neural network HGNN are not shared to adapt to the correlation of different types of traffic units;

[0032] In each layer of HGNN, the information of the node and its neighbors is processed through the message calculation function and the message aggregation function to obtain the embedding vector of the node;

[0033] Perform element-wise averaging on all node embedding vectors in the last layer to obtain the packet-level traffic representation p N1 and p N2 , corresponding to and

[0034] The flow level representation is further obtained through the recurrent neural network RNN and Generate stream-level representations based on the packet-level representation sequence to complete the representation learning process.

[0035] Furthermore, the heterogeneous graph neural network HGNN is based on the GraphSAGE architecture.

[0036] Further, in step S3, the training traffic classification task includes simultaneously performing classification at the traffic level and the data packet level, specifically including:

[0037] Using a non-shared traffic classifier, a multi-layer perceptron (MLP) is used to process representations at different levels.

[0038] Concatenate the flow-level and packet-level representations to form a comprehensive feature vector;

[0039] The classification losses at the flow level and packet level are calculated respectively, and the cross entropy loss function is used to evaluate the performance of the classifier.

[0040] Furthermore, in step S3, the comparative learning task includes:

[0041] Two-layer contrastive learning: adopts a contrastive learning strategy to learn semantically invariant representations by comparing the embedding vectors of different data-augmented sample pairs, and introduces supervised contrastive loss to utilize data labels. The supervised contrastive loss optimizes the model by comparing the similarity of positive and negative samples;

[0042] Packet-level contrastive learning: Enhance the packet-level traffic representation generated based on the traffic graph, including graph structure enhancement and node feature enhancement, to reveal the semantically invariant representation in the traffic unit. The packet-level contrastive learning loss promotes the model's in-depth understanding of packet-level traffic features by comparing the traffic graph representation before and after enhancement.

[0043] Flow-level contrastive learning: Flow-level contrastive learning is performed by randomly discarding data packets to capture the common characteristics of traffic flows and generate robust flow-level representations. The flow-level contrastive learning loss improves the model's ability to recognize the overall characteristics of traffic flows by comparing the traffic representations of complete traffic and those after partially discarding data packets.

[0044] Furthermore, in step S3, the overall training goal of end-to-end multi-task training is designed to integrate packet-level classification loss, flow-level classification loss, packet-level contrast learning loss, and flow-level contrast learning loss in a weighted combination manner, wherein the packet-level and flow-level contrast task contributions are controlled by adjusting the coefficients of the packet-level contrast learning loss and the flow-level contrast learning loss.

[0045] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the encrypted traffic classification method based on a multi-view heterogeneous graph model.

[0046] A computer program product includes a computer program, and when the computer program is executed by a processor, the encrypted traffic classification method based on a multi-view heterogeneous graph model is implemented.

[0047] The present invention has the following beneficial effects:

[0048] The present invention provides an encrypted traffic classification method based on a multi-view heterogeneous graph model, designs a simple and effective model MH-Net, and shows significant technical advantages in the field of network traffic classification, which is mainly reflected in the innovative multi-view heterogeneous traffic graph construction method and efficient representation learning strategy of the present invention. MH-Net effectively enriches the diversity of information granularity by aggregating different numbers of traffic bits into multiple types of traffic units, which not only enhances the expressive power of traffic data, but also provides the possibility for in-depth mining of fine-grained associations in traffic data. The head-head, head-load and load-load unit correlations introduced by MH-Net enable the model to capture the functional differences of different parts in the traffic unit sequence, further enhancing the accuracy of traffic classification. Using point-to-point mutual information (PMI) and multi-task comparative learning strategies, the representation learning performed by MH-Net on the traffic graph not only enhances the robustness of the traffic unit representation, but also improves the model's ability to identify attack behaviors when facing encryption technologies such as VPN and Tor. Experimental results show that MH-Net has achieved excellent performance in both packet-level and flow-level traffic classification tasks, surpassing multiple benchmark models, proving its advancedness in improving traffic classification accuracy and robustness. In addition, MH-Net's multi-task training framework enables the model to be trained simultaneously in flow-level and packet-level classification tasks, optimizing the overall performance of the model and demonstrating its broad application prospects in the field of network traffic classification.

[0049] Other beneficial effects of the embodiments of the present invention will be further described below. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is a model structure diagram of an encrypted traffic classification method based on a multi-view heterogeneous graph model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following is a detailed description of the embodiments of the present invention. It should be emphasized that the following description is only exemplary and is not intended to limit the scope and application of the present invention.

[0052] With the continuous development of computer network technology and the access of a large number of devices to the Internet, user privacy is increasingly vulnerable to malicious attacks. Although encryption technologies such as VPN and Tor can provide protection for users, they can also be used by attackers as a tool to hide their identities. Traditional packet deep inspection (DPI) methods have lost their effectiveness when facing encrypted traffic. Designing a method that can universally and effectively classify attacker network activities (such as website browsing or application usage) from encrypted traffic remains a huge challenge.

[0053] In order to address the above challenges, the present invention proposes an encrypted traffic classification method and designs a novel multi-view heterogeneous graph model, named MH-Net, which classifies network traffic through multi-view heterogeneous traffic graphs. Specifically, MH-Net first aggregates different numbers of traffic bits into multiple types of traffic units (e.g., 4-bit units and 8-bit units), thereby promoting the diversity of information granularity of traffic data. Due to the excellent ability of graphs in processing relational data, MH-Net further uses point-to-point mutual information (PMI) to convert multiple types of traffic unit sequences into multi-view traffic graphs. On this basis, considering the functional differences of different parts in the traffic unit sequence, MH-Net introduces three types of unit correlations, namely head-head, head-load and load-load unit correlations, and designs a heterogeneous traffic graph encoder using a heterogeneous graph neural network HGNN for multi-view heterogeneous graph representation learning. In order to enhance the robustness of the traffic unit representation, comparative learning is also performed in a multi-task manner on the traffic graph.

[0054] The embodiment of the present invention provides an encrypted traffic classification method based on a multi-view heterogeneous graph model, and its model structure is as follows: Figure 1 As shown, the method comprises the following steps:

[0055] Step S1, multi-perspective traffic graph construction: Aggregate the bits in the network traffic data into multiple types of traffic units to achieve diversity in information granularity; Use point-to-point mutual information PMI to quantify the correlation between sequences of different types of traffic units and construct a multi-perspective traffic graph; Reveal the fine-grained associations between traffic units through the graph structure of the constructed multi-perspective traffic graph, and provide structured data for subsequent heterogeneous traffic graph representation learning.

[0056] In a preferred embodiment, step S1 specifically includes: converting the aggregated flow unit sequence into a flow graph to form an interconnected whole, using the natural advantages of the graph structure to mine the potential fine-grained correlation in the flow unit sequence; applying the point-to-point mutual information PMI algorithm to quantify the correlation between flow units, and counting the number of co-occurrences by sliding a window on the flow unit sequence; calculating the PMI value to determine the high correlation between flow units, and only when the PMI value is greater than zero, connecting two flow units to indicate that there is a significant correlation between them; for the flow data in each data packet, selecting two flow units of different lengths, (N 1 )-bit and (N 2 )-bit flow unit, respectively apply the PMI algorithm to construct a multi-view flow graph and In the constructed multi-view traffic graph, the characteristics of the nodes are determined by the values ​​of each traffic unit.

[0057] Step S2, heterogeneous traffic graph representation learning: Based on the multi-view traffic graph constructed in step S1, the head-head, head-load and load-load unit correlations are introduced to form a heterogeneous traffic graph; the heterogeneous graph neural network HGNN is used to perform representation learning on the heterogeneous traffic graph, wherein the discriminative features in the traffic graph are extracted through heterogeneous traffic graph representation learning, providing rich feature representations for the traffic classification task, including traffic level and packet level representations.

[0058] In a preferred embodiment, in step S2, the model's ability to capture functional differences of different parts of traffic data is enhanced by integrating heterogeneous traffic unit correlations, specifically including: identifying the heterogeneity of headers and payloads in a data packet byte sequence, and different types of traffic unit correlations based on their positions; constructing three types of traffic unit correlations, namely, header-header (hh), payload-load (pp), and header-load (hp), to fully utilize the heterogeneity in headers and payloads; applying the PMI algorithm to the header, payload, and the entire traffic unit sequence, respectively, to obtain three types of traffic edges, and integrating these edges into a heterogeneous traffic graph G H ; Build a heterogeneous traffic graph and Enables fine-grained heterogeneous fusion of headers and payloads in a single traffic graph for efficient representation learning.

[0059] In a preferred embodiment, in step S2, a heterogeneous traffic graph encoder is applied to perform traffic representation learning to extract and learn heterogeneous features in the traffic graph and generate rich traffic representations, specifically including: the heterogeneous traffic graph encoder uses a heterogeneous graph neural network HGNN to extract the distinguishing features of the traffic graph; the HGNN is preferably based on the GraphSAGE architecture, and the model weights of different edge types are not shared to adapt to the correlation of different types of traffic units; in each layer of the HGNN, the information of the node and its neighbors is processed through the message calculation function and the message aggregation function to obtain the embedding vector of the node; the element-by-element average operation is performed on all the node embedding vectors of the last layer to obtain the packet-level traffic representation p N1 and p N2 , corresponding to and The flow level representation is further obtained through the recurrent neural network RNN and Generate stream-level representations based on the packet-level representation sequence to complete the representation learning process.

[0060] Step S3, multi-task training of MH-Net model: Based on the multi-view traffic graph constructed in step S1 and the discriminative features extracted in step S2, multi-task training of MH-Net model is performed, wherein the traffic classification tasks at the packet level and the flow level, as well as the contrastive learning tasks, are jointly trained to enhance the robustness of the traffic unit representation; wherein, traffic classification is performed at the packet level and the flow level, and the traffic level and packet level representations obtained in step S2 are converted into classification results using a multi-layer perceptron MLP, and the corresponding traffic classification task loss is calculated; a contrastive learning strategy is adopted to learn semantically invariant representations by comparing positive and negative sample pairs from various data enhancements, thereby further enhancing the model performance; the multi-task training of the MH-Net model achieves accurate classification of encrypted traffic and optimizes the overall performance of the model through overall end-to-end training.

[0061] In a preferred embodiment, in step S3, the training traffic classification task includes simultaneously performing classification at the traffic level and the packet level, specifically including: using a non-shared traffic classifier and a multi-layer perceptron (MLP) to process representations of different levels; concatenating the representations of the traffic level and the packet level to form a comprehensive feature vector; respectively calculating the classification losses at the traffic level and the packet level, and using the cross entropy loss function to evaluate the performance of the classifier.

[0062] In a preferred embodiment, in step S3, the contrastive learning task specifically includes:

[0063] Two-layer contrastive learning: A contrastive learning strategy is adopted to learn semantically invariant representations by comparing the embedding vectors of different data augmented sample pairs. A supervised contrastive loss is introduced to better utilize data labels. The supervised contrastive loss optimizes the model by comparing the similarity between positive and negative samples, thereby enhancing the model's robustness to data augmentation.

[0064] Packet-level contrastive learning: The packet-level traffic representation generated based on the traffic graph is enhanced, including graph structure enhancement and node feature enhancement, to reveal the semantically invariant representation in the traffic unit. The packet-level contrastive learning loss promotes the model's in-depth understanding of packet-level traffic features and enhances model performance by comparing the traffic graph representation before and after enhancement.

[0065] Flow-level contrastive learning: Flow-level contrastive learning is performed by randomly discarding data packets to capture the common characteristics of traffic flows and generate robust flow-level representations. The flow-level contrastive learning loss improves the model's ability to recognize the overall characteristics of traffic flows by comparing the traffic representations of complete traffic and those after partially discarding data packets.

[0066] In a preferred embodiment, in step S3, the overall training goal of end-to-end multi-task training is designed to integrate packet-level classification loss, flow-level classification loss, packet-level contrast learning loss, and flow-level contrast learning loss in a weighted combination manner, wherein the packet-level and flow-level contrast task contributions are controlled by adjusting the coefficients of the packet-level contrast learning loss and the flow-level contrast learning loss.

[0067] The following further describes specific embodiments of the present invention and examples of algorithm implementation thereof.

[0068] An encrypted traffic classification method based on a multi-view heterogeneous graph model MH-Net is proposed. MH-Net is used to improve encrypted traffic classification. MH-Net first aggregates different numbers of traffic bits into multiple types of traffic units (e.g., 4-bit units and 8-bit units), thereby promoting the information granularity diversity of traffic data. Due to the excellent ability of graphs in processing relational data, MH-Net further uses point-to-point mutual information (PMI) to convert multiple types of traffic unit sequences into multi-view traffic graphs. On this basis, considering the functional differences of different parts in the traffic unit sequence, MH-Net introduces three types of unit correlations, namely head-head, head-load, and load-load unit correlations, and designs a heterogeneous traffic graph encoder for multi-view heterogeneous graph representation learning. In order to enhance the robustness of the traffic unit representation, contrastive learning is also performed on the traffic graph in a multi-task manner.

[0069] Multi-view traffic graph construction

[0070] The following first describes the theoretical basis for using the flow unit and explains in detail how to construct a multi-view flow graph through the flow unit.

[0071] Flow units with various granularities

[0072] In order to reveal the diverse information granularity contained in the raw bytes, the present invention goes beyond the simple bytes themselves and aggregates raw bits of different lengths into various traffic units. Traffic units with different numbers of bits can "interpret" or "express" the transmitted data from different angles, thereby being able to mine potential highly distinctive features. Taking character encoding as an example, given 16-bit binary data, it can be converted into a Chinese character through a 16-bit traffic unit, or into two English characters through an 8-bit traffic unit. Therefore, various traffic units can be used to perform multi-view feature extraction on the same traffic data, thereby obtaining a better traffic representation.

[0073] Traffic graph construction

[0074] Although traffic data is aggregated into traffic units, these units are still scattered individuals, which is not conducive to mining the potential fine-grained correlations in the traffic unit sequence. Inspired by (Zhang et al., 2023; Yao, Mao, and Luo, 2019), due to the natural advantages of graph structure in data correlation modeling, the traffic unit sequence is further converted into a traffic graph to make it an interconnected whole. For a sequence of N-bit traffic units, point-to-point mutual information (PMI) is used to quantify the correlation between traffic units. PMI applies a sliding window on the traffic unit sequence and counts the number of times two units co-occur within the window. The co-occurrence frequency of two units and the occurrence frequency of each unit are used to calculate PMI, and its formula is as follows:

[0075]

[0076] Among them, #W is the total number of sliding windows, Indicates the unit The number of occurrences in the sliding window, Indicates the unit and The number of times it appears in the sliding window. Connect two flow units under the condition of and To indicate the high correlation between them. For the traffic data in each data packet, two types of traffic units are selected, such as (N 1 )-bit and (N 2 )-bit flow units, and apply the PMI algorithm to their sequences to construct multi-view flow graphs and It should be noted that the characteristics of the nodes in the flow graph are the values ​​of each flow unit.

[0077] Heterogeneous Traffic Graph Representation Learning

[0078] Next, we further integrate the heterogeneous correlations in flow graphs and design a carefully constructed heterogeneous flow graph encoder to perform heterogeneous flow graph representation learning.

[0079] Heterogeneous traffic unit correlation

[0080] In the byte sequence of a data packet, the header and the payload have information heterogeneity due to their different functions (the former carries the metadata of the data packet, and the latter carries the actual transmission content). However, the homogeneous correlation of traffic units in the traffic graph GG limits the full utilization of the heterogeneity in the header and the payload. Therefore, it is believed that the correlation between traffic units should have multiple types according to their positions in the traffic unit sequence. Intuitively, the present invention proposes three types of traffic unit correlations: header-header (hh), payload-payload (pp), and header-payload (hp) correlations to alleviate the above problems.

[0081] Then, the PMI algorithm is applied to the traffic unit sequences of the head, the load, and the head + load (i.e., the entire traffic unit sequence) to obtain three types of traffic edges, which are further integrated into a heterogeneous traffic graph G H .

[0082] View heterogeneous traffic graph and In this way, the correlation between traffic units becomes more fine-grained, thus achieving seamless heterogeneous fusion of headers and payloads in a single traffic graph.

[0083] Heterogeneous Traffic Graph Encoder

[0084] So far, flow graphs have been obtained for each packet, which will be further fed into the heterogeneous flow graph encoder for flow representation learning.

[0085] Specifically, the heterogeneous flow graph encoder adopts a heterogeneous graph neural network (HGNN) to extract the discriminative features of the flow graph. HGNN uses GraphSAGE as its basic skeleton, and the model weights are not shared between different edge types. In general, the forward propagation of HGNN at layer l can be described as:

[0086]

[0087] in, is the embedding vector of node v in layer l, is the neighbor message of node v calculated in the lth layer, and N(v) is the neighbor set of node v. MSG l (·) is a message calculation function whose parameters are And AGG l (·) is a message aggregation function whose parameters are is located at the lth layer. Then, an element-wise average operation is performed on all node embedding vectors in the last layer to obtain the final packet-level traffic representation p N1 and p N2 , corresponding to and can be simplified to:

[0088]

[0089] The flow level representation can also be further obtained through recurrent neural network (RNN) and

[0090]

[0091] Where L is the length of the flow

[0092] Multi-task training of MH-Net

[0093] The goal of the present invention is to jointly train MH-Net in a multi-task manner to achieve better optimization. The training objectives of MH-Net mainly include traffic classification and contrastive learning tasks, which will be introduced in detail below.

[0094] Traffic classification task. In the present invention, traffic classification tasks at both the traffic level and the packet level are performed simultaneously. Figure 1 As shown, a non-shared traffic classifier is used, and a multi-layer perceptron (MLP) is used to convert the representation of the traffic level and the packet level, and the corresponding traffic classification task losses are calculated respectively:

[0095] f=CONCAT(f N1 ,f N2 ),p=CONCAT(P N1 ,P( N2 ))

[0096] L FCLS =CE(MLP(f),y f ),L PCLS =CE(MLP(P),y p )

[0097] Among them, CONCAT(·) represents the concatenation operation, CE(·) is the cross entropy loss function, and y f is the traffic label, y p Is the packet label that is consistent with the flow label to which it belongs.

[0098] Two-layer contrastive learning

[0099] Inspired by the powerful representation learning ability of contrastive learning, which aims to learn semantically invariant representations by comparing positive and negative sample pairs from various data enhancements, it is proposed to use contrastive learning in MH-Net to further enhance the multi-view packet-level and flow-level representations. Specifically, MH-Net adopts a supervised contrastive loss to better utilize the data labels during training. The loss can be expressed as:

[0100]

[0101] Where z refers to the set of embedding vectors of two sets of augmented data samples from the same source. z∈I is the index of any augmented sample in z, K(i)≡I{i}, and M(i)≡{m∈K(i):y m =y i} is the index of all positive samples under the same data label condition. The symbol (·) represents the inner product operation, τ∈R + Represents the temperature parameter.

[0102] Packet-level contrastive learning

[0103] Since the packet-level traffic representation is generated based on the traffic graph, an enhanced graph needs to be generated for further comparative learning. In the present invention, two enhancement methods are mainly used: graph structure enhancement and node feature enhancement.

[0104] For graph structure enhancement, a random walk algorithm is used, which starts from randomly selecting a node and iteratively performs random traversal on its neighbors to obtain an enhanced flow graph. For node feature enhancement, the flow graph is enhanced by flipping the node features to obtain another enhanced flow graph. The embedding vector obtained and After that, the packet-level contrast loss can be expressed as:

[0105]

[0106] It is worth noting that the original flow graph The embedding vector P N are regarded as “anchors” and used for training stability without augmentation (a slight abuse of notation). By directly perturbing the structure and features of the flow graph, the semantically invariant representations in the flow units (i.e., nodes) can be well revealed through contrastive learning, thereby enhancing the performance of the model.

[0107] Stream-level contrastive learning

[0108] Further, by using a certain probability P PD ∈[0,1] randomly discards packets in the traffic to perform flow-level contrastive learning tasks, thereby obtaining enhanced traffic. Similarly, the flow-level contrast loss can be expressed as:

[0109]

[0110] Among them, ρ i ∈{0,1} from Bernoulli distribution ρ~B(P PD), indicating whether to discard the packet. This learning paradigm also helps the model capture the common features of traffic flows through data augmentation, thereby generating a robust flow-level representation.

[0111] Overall training goal.

[0112] In general, the present invention proposes an overall end-to-end multi-task training objective for MH-Net as follows:

[0113] L=L PCLS +L FCLS +αL PCL +βL FCL

[0114] where α and β∈[0,1] are coefficients that control the contrast of task contributions at packet level and flow level.

[0115] This paper proposes a simple yet effective model, MH-Net, which constructs a multi-view heterogeneous traffic graph by aggregating different numbers of traffic bits into traffic units and using point-by-point mutual information. In particular, the heterogeneous byte correlations contained in the traffic graph are revealed, and a heterogeneous graph neural network is used for graph representation learning. In addition, supervised contrastive learning is performed in a multi-task manner to obtain a more powerful traffic representation.

[0116] Experimental Results

[0117] To comprehensively evaluate MH-Net, packet-level and flow-level traffic classification tasks were conducted on the ISCX and CIC-IoT datasets. Experimental results show that MH-Net achieves the best overall performance on flow-level and packet-level traffic classification tasks compared with multiple baseline models, ranking first among all state-of-the-art methods. Further traffic unit analysis also reveals the potential trade-off between complementarity and interference between traffic units with different information granularity. Extensive analysis of traffic units reveals the possibility of using complementary information of different traffic units to improve traffic classification performance.

[0118] In summary, the present invention proposes an innovative MH-Net model, which constructs a multi-perspective traffic graph by aggregating different numbers of traffic bits into multiple types of traffic units, which not only enriches the diversity of information granularity, but also improves the model performance. MH-Net further introduces three types of traffic unit correlations: head-head, head-load, and load-load, to model the heterogeneity of traffic graphs, and uses heterogeneous graph neural networks for feature extraction, so as to more accurately capture the complex relationships in traffic data. In addition, MH-Net enhances the robustness of traffic unit representation through comparative learning in a multi-task manner, and realizes synchronous training in traffic-level and packet-level classification tasks, achieving the best overall performance. Furthermore, the method of the present invention can also be extended to the use of large models and a large amount of unlabeled data to enhance the robustness and generalization ability of the model, so that it has a wider application prospect in the field of network traffic classification.

[0119] The MH-Net model and its encrypted traffic classification method proposed in the present invention have high application value in the field of network traffic classification: (1) Through the construction of multi-perspective heterogeneous traffic graphs, the fine-grained associations between traffic bytes can be fully revealed and utilized, thereby improving the accuracy of traffic classification; (2) By using point-to-point mutual information (PMI) and multi-task comparative learning strategies, the robustness of traffic unit representation is enhanced, which helps to accurately identify attack behaviors in encrypted traffic, especially when encryption technologies such as VPN and Tor are used to hide identities. In addition, compared with the prior art, the method of the present invention also has the following significant advantages: (1) By aggregating different numbers of traffic bits into multiple types of traffic units, richer information granularity is provided, thereby enhancing the expression ability of traffic data; (2) A heterogeneous traffic graph encoder is designed to capture different types of associations between header bytes and payload bytes, so that the traffic classification model can make full use of multiple types of associations between bytes, further improving the performance and accuracy of the model.

[0120] An embodiment of the present invention further provides a storage medium for storing a computer program, which at least performs the above method when executed.

[0121] An embodiment of the present invention further provides a control device, comprising a processor and a storage medium for storing a computer program; wherein the processor is configured to execute at least the method described above when executing the computer program.

[0122] An embodiment of the present invention further provides a processor, wherein the processor executes a computer program and at least executes the method described above.

[0123] The storage medium can be implemented by any type of non-volatile storage device, or a combination thereof. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The storage medium described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0124] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0125] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0126] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0127] Those skilled in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), disks or optical disks, etc. Various media that can store program codes.

[0128] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0129] The methods disclosed in the several method embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments.

[0130] The features disclosed in several product embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new product embodiments.

[0131] The features disclosed in several method or device embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0132] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art of the present invention, several equivalent substitutions or obvious variations can be made without departing from the concept of the present invention, and the performance or use is the same, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. An encrypted traffic classification method based on a multi-view heterogeneous graph model, characterized in that: The following steps are involved: S1. Construction of multi-view traffic graph: Aggregate the bits in the network traffic data into multiple types of traffic units to achieve the diversity of information granularity; Use point-to-point mutual information (PMI) to quantify the correlation between sequences of different types of traffic units, construct a multi-view traffic graph, and reveal the fine-grained association between traffic units through the graph structure of the constructed multi-view traffic graph; S2. Heterogeneous traffic graph representation learning: Based on the constructed multi-view traffic graph, the head-head, head-load and load-load unit correlations are introduced to form a heterogeneous traffic graph; The heterogeneous graph neural network HGNN is used to learn the representation of heterogeneous traffic graphs. The distinguishing features in the traffic graphs are extracted through heterogeneous traffic graph representation learning, providing rich feature representations for traffic classification tasks, including flow level and packet level representations. S3. Multi-task training of MH-Net model: Based on the constructed multi-view traffic graph and the extracted discriminative features, multi-task training of MH-Net model is performed, wherein the traffic classification tasks at packet level and flow level, as well as the contrastive learning tasks, are jointly trained; wherein, traffic classification is performed at the packet level and flow level, and the obtained traffic level and packet level representations are converted into classification results using a multi-layer perceptron MLP, and the corresponding traffic classification task loss is calculated; a contrastive learning strategy is adopted to learn semantically invariant representations by comparing positive and negative sample pairs from various data enhancements; the multi-task training of MH-Net model achieves accurate classification of encrypted traffic through overall end-to-end training.

2. The encrypted traffic classification method based on a multi-view heterogeneous graph model as claimed in claim 1, characterized in that: Step S1 specifically includes: Convert the aggregated flow unit sequence into a flow graph to form an interconnected whole, and use the graph structure to mine the potential fine-grained correlation in the flow unit sequence; The point-to-point mutual information (PMI) algorithm is applied to quantify the correlation between traffic units, and the number of co-occurrences is counted by sliding a window over the traffic unit sequence; PMI values ​​are calculated to identify high correlations between flow units. Only when the PMI value is greater than zero, two flow units are connected to indicate that there is a significant correlation between them. For the traffic data in each data packet, two traffic units of different lengths are selected, (N1)-bit and (N2)-bit traffic units, and the PMI algorithm is applied to construct multi-view traffic graphs. and In the constructed multi-view traffic graph, the characteristics of the nodes are determined by the values ​​of each traffic unit.

3. The encrypted traffic classification method based on a multi-view heterogeneous graph model as described in claim 1 or 2, characterized in that: In step S2, the correlation of heterogeneous traffic units is integrated to enhance the model's ability to capture the functional differences of different parts of the traffic data, including: Identify the heterogeneity of headers and payloads in packet byte sequences, and the correlation of different types of traffic units based on their positions; Three types of traffic unit correlations, head-head (hh), load-load (pp) and head-load (hp), are constructed to fully exploit the heterogeneity in head and load; The PMI algorithm is applied to the header, load, and the entire flow unit sequence to obtain three types of flow edges, and these edges are integrated into a heterogeneous flow graph G H ; Build a heterogeneous traffic graph and Enables fine-grained heterogeneous fusion of headers and payloads in a single traffic graph for efficient representation learning.

4. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to any one of claims 1 to 3, characterized in that: In step S2, a heterogeneous traffic graph encoder is applied to perform traffic representation learning to extract and learn heterogeneous features in the traffic graph and generate traffic representation, specifically including: The heterogeneous flow graph encoder uses a heterogeneous graph neural network HGNN to extract discriminative features of the flow graph; The model weights of different edge types of the heterogeneous graph neural network HGNN are not shared to adapt to the correlation of different types of traffic units; In each layer of HGNN, the information of the node and its neighbors is processed through the message calculation function and the message aggregation function to obtain the embedding vector of the node; Perform element-wise averaging on all node embedding vectors in the last layer to obtain the packet-level traffic representation p N1 and p N2 , corresponding to and The flow level representation is further obtained through the recurrent neural network RNN and Generate stream-level representations based on the packet-level representation sequence to complete the representation learning process.

5. The encrypted traffic classification method based on a multi-view heterogeneous graph model as claimed in claim 4 is characterized in that: The heterogeneous graph neural network HGNN is based on the GraphSAGE architecture.

6. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to any one of claims 1 to 5, characterized in that: In step S3, the training traffic classification task includes simultaneously performing classification at the traffic level and the packet level, specifically including: Using a non-shared traffic classifier, a multi-layer perceptron (MLP) is used to process representations at different levels. Concatenate the flow-level and packet-level representations to form a comprehensive feature vector; The classification losses at the flow level and packet level are calculated respectively, and the cross entropy loss function is used to evaluate the performance of the classifier.

7. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to any one of claims 1 to 6, characterized in that: In step S3, the contrastive learning task includes: Two-layer contrastive learning: adopts a contrastive learning strategy to learn semantically invariant representations by comparing the embedding vectors of different data-augmented sample pairs, and introduces supervised contrastive loss to utilize data labels. The supervised contrastive loss optimizes the model by comparing the similarity of positive and negative samples; Packet-level contrastive learning: Enhance the packet-level traffic representation generated based on the traffic graph, including graph structure enhancement and node feature enhancement, to reveal the semantically invariant representation in the traffic unit. The packet-level contrastive learning loss promotes the model's in-depth understanding of packet-level traffic features by comparing the traffic graph representation before and after enhancement. Flow-level contrastive learning: Flow-level contrastive learning is performed by randomly discarding data packets to capture the common characteristics of traffic flows and generate robust flow-level representations. The flow-level contrastive learning loss improves the model's ability to recognize the overall characteristics of traffic flows by comparing the traffic representations of complete traffic and those after partially discarding data packets.

8. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to any one of claims 1 to 7, characterized in that: In step S3, the overall training goal of end-to-end multi-task training is designed to integrate packet-level classification loss, flow-level classification loss, packet-level contrast learning loss, and flow-level contrast learning loss in a weighted combination manner, wherein the packet-level and flow-level contrast task contributions are controlled by adjusting the coefficients of the packet-level contrast learning loss and the flow-level contrast learning loss.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the encrypted traffic classification method based on a multi-view heterogeneous graph model as described in any one of claims 1 to 8 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the encrypted traffic classification method based on a multi-view heterogeneous graph model as described in any one of claims 1 to 8 is implemented.

Images