An encrypted traffic classification method based on multi-view heterogeneous graph model

Abstract

The application provides an encrypted traffic classification method based on a multi-view heterogeneous graph model (MH-Net), which can effectively improve the accuracy and robustness of network traffic classification. In this method, a multi-view traffic graph is constructed, and different numbers of traffic bits are aggregated into multiple types of traffic units to enrich the diversity of information granularity. Further, three types of traffic unit correlations, including header-header, header-payload, and payload-payload, are introduced to form a heterogeneous traffic graph, and a heterogeneous graph neural network is used for feature extraction. In addition, through a multi-task contrastive learning strategy, the robustness of traffic unit representation is enhanced, and synchronous training is realized in traffic-level and packet-level classification tasks to optimize overall performance. Experimental results show that this method achieves excellent performance on multiple datasets, surpassing existing technologies and demonstrating its application potential in the field of network traffic classification.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network information security, and particularly relates to a method for encrypted traffic classification based on a multi-view heterogeneous graph model. BACKGROUND

[0002] With the continuous development of computer network technology and a large number of devices accessing the Internet, user privacy is increasingly vulnerable to malicious attacks. Although encryption technologies such as VPN and Tor can provide protection for users, they can also be used by attackers as a tool to hide their identity. Traditional packet deep packet inspection (DPI) methods have lost their effectiveness in the face of encrypted traffic. It is still a great challenge to design a method from encrypted traffic that can universally and effectively classify attacker network activities (such as website browsing or application usage).

[0003] In the past few years, many methods have been proposed to enhance the ability of encrypted traffic classification technology. Among them, the statistical-based methods usually rely on hand-crafted traffic statistical features, and then use traditional machine learning models for classification. However, these methods require a lot of feature engineering and are vulnerable to unreliable traffic. With the rise of representation learning, some methods also use deep learning models for traffic classification, such as pre-trained language models, etc. Although these methods show competitive performance, they fail to fully reveal the fine-grained associations between traffic bytes, which can be attributed to the following two shortcomings: (1) the rigid information granularity of bytes. Most existing methods default to treating a byte as an indivisible unit, which ignores the diversity of information granularity contained in traffic data. As a practical example, a Chinese character is represented by two bytes, while an English letter is represented by one byte, which shows that traffic data generally contains information of different granularities (note that granularity is not necessarily byte, but bit). (2) Lack of consideration of multiple types of associations between bytes. Current methods mix the correlations of bytes at different positions in the byte sequence together, which ignores the differences between different types of correlations (for example, the correlation type between header bytes and payload bytes is different). Therefore, how to reveal and utilize the potential fine-grained associations between traffic bytes to enhance traffic classification has become a significant problem.

[0004] Flow-level traffic classification methods.

[0005] Flow-level traffic classification methods aim to classify traffic flows, which can be summarized into the following three categories:

[0006] • Statistical feature-based methods. Many methods use statistical features to represent packet properties and leverage traditional machine learning models for classification. App-Scanne extracts features from traffic based on bidirectional flow features, while CUMUL uses cumulative packet length as its feature. ETC-PS enhances packet length sequences by applying path signature theory, and Conti et al. also perform feature extraction through hierarchical clustering.

[0007] • Fingerprint matching-based methods. Fingerprinting represents traffic features and is also used for traffic identification. FlowPrint generates traffic fingerprints by creating association graphs and computing activity values between target IPs. K-FP uses random forests to build fingerprints and identifies unknown samples through k-nearest neighbor matching.

[0008] • Deep learning-based methods. Deep learning demonstrates strong learning capabilities, and many traffic classification methods are based on this. RBRN, DF, and FS-Net all use statistical feature sequences (e.g., packet length sequences) as inputs to convolutional neural networks (CNNs) or recurrent neural networks (RNNs). In addition, there are some methods that use raw bytes as features. EBSNN combines RNNs and attention mechanisms to process header and payload byte segments. ET-BERT performs pre-training tasks on large-scale traffic datasets to learn strong raw byte representations, which is both time-consuming and expensive. Graph neural networks (GNNs) are another model that can be used for traffic classification tasks. GraphDApp constructs traffic interaction graphs through traffic bursts and uses GNNs for representation learning. TFE-GNN constructs byte-level traffic graphs using point-to-point mutual information and designs a traffic graph encoder for feature extraction. YaTC adopts a traffic transformer based on a masked autoencoder to achieve efficient feature extraction and improve performance.

[0009] • Packet-level traffic classification methods. In contrast, packet-level traffic classification methods identify different classes for each network packet. Securitas generates n-grams for raw bytes and forms protocol keywords as features using Latent Dirichlet Allocation (LDA), and then uses SVM, C4.5 decision tree or Bayesian network for packet classification. 2D-CNN and 3D-CNN treat packet bytes as pixel values and convert them into images, and then input the images into 2D-CNN and 3D-CNN for packet classification. DP extracts byte features using CNN and autoencoder. BLJAN explores the correlation between packet bytes and their labels and encodes them into a joint embedding space for packet classification. EBSNN and ET-BERT can also perform packet classification. But they still need two separate training or fine-tuning for flow-level and packet-level tasks, which is very computationally expensive. PacRep uses triplet loss, no data augmentation, and jointly optimizes multiple packet-level tasks to learn better packet representations.

[0010] In summary, existing methods do not fully consider the information correlation contained in raw bytes when performing traffic classification tasks, thus facing performance bottlenecks.

[0011] It should be noted that the information disclosed in the above background section is only for understanding the background of the present application, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0012] The main purpose of the present application is to overcome the defects existing in the background art, and to provide an encrypted traffic classification method based on a multi-view heterogeneous graph model (MH-Net).

[0013] To achieve the above purpose, the present application adopts the following technical solutions:

[0014] An encrypted traffic classification method based on a multi-view heterogeneous graph model, comprising the following steps:

[0015] S1, multi-view traffic graph construction: aggregating bits in network traffic data into multiple types of traffic units to achieve diversity of information granularity; using point-to-point mutual information PMI to quantify the correlation between different types of traffic unit sequences, and constructing a multi-view traffic graph, and revealing the fine-grained association between traffic units through the graph structure of the constructed multi-view traffic graph;

[0016] S2, Isomerous traffic graph representation learning: based on the constructed multi-view traffic graph, the head-head, head-load and load-load unit correlations are introduced to form an isomerous traffic graph; the isomerous traffic graph is represented by using a heterogeneous graph neural network HGNN, wherein the distinctive features in the traffic graph are extracted by the isomerous traffic graph representation learning, and rich feature representations are provided for the traffic classification task, including traffic level and packet level representations;

[0017] S3, Multi-task training of MH-Net model: based on the constructed multi-view traffic graph and the extracted distinctive features, the multi-task training of the MH-Net model is performed, wherein the traffic classification tasks at the packet level and the flow level are jointly trained, and the contrastive learning task is trained; wherein the traffic classification is performed at the packet level and the flow level, the obtained traffic level and packet level representations are converted into classification results by using a multi-layer perception MLP, and the corresponding traffic classification task loss is calculated; the contrastive learning strategy is adopted, the positive and negative sample pairs from various data augmentations are compared, and the semantic invariant representation is learned; the multi-task training of the MH-Net model is trained in an end-to-end manner, and the accurate classification of encrypted traffic is realized.

[0018] Further, step S1 specifically comprises:

[0019] The aggregated traffic unit sequence is converted into a traffic graph to form an overall correlation, and the potential fine-grained correlation in the traffic unit sequence is mined by using the graph structure;

[0020] The point-to-point mutual information PMI algorithm is applied to quantify the correlation between the traffic units, and the number of common occurrences is counted by sliding a window on the traffic unit sequence;

[0021] The PMI value is calculated to determine the high correlation between the traffic units, and only when the PMI value is greater than zero, the two traffic units are connected to represent the significant correlation between them;

[0022] For the traffic data in each packet, two traffic units of different lengths, (N1)-bit and (N2)-bit traffic units, are selected, and the PMI algorithm is applied to construct multi-view traffic graphs G{ N1} and G{ N2};

[0023] In the constructed multi-view traffic graph, the features of the nodes are determined by the values of the traffic units.

[0024] Further, in step S2, the capture ability of the model for the functional differences of different parts in the traffic data is enhanced by integrating the isomerous traffic unit correlations, specifically comprising:

[0025] Identify the heterogeneity of the header and payload in the byte sequence of the data packet, and the correlation of different types of traffic units based on their positions;

[0026] Construct three traffic unit correlations of header-header (h-h), payload-payload (p-p) and header-payload (h-p) to fully utilize the heterogeneity in the header and payload;

[0027] Apply PMI algorithm to the header, payload and entire traffic unit sequence respectively to obtain three types of traffic edges, and integrate these edges into a heterogeneous traffic graph G H ;

[0028] Construct a view heterogeneous traffic graph And Implement fine-grained heterogeneous fusion of the header and the payload in a single traffic graph for effective representation learning.

[0029] Further, in step S2, a heterogeneous traffic graph encoder is applied for traffic representation learning to extract and learn the heterogeneous features in the traffic graph and generate traffic representation, specifically including:

[0030] The heterogeneous traffic graph encoder uses a heterogeneous graph neural network HGNN to extract discriminative features of the traffic graph;

[0031] The model weights of different edge types of the heterogeneous graph neural network HGNN are not shared to adapt to different types of traffic unit correlations;

[0032] In each layer of the HGNN, the information of the node and its neighbors is processed by a message calculation function and a message aggregation function to obtain the embedding vector of the node;

[0033] Perform element-wise averaging operation on all node embedding vectors of the last layer to obtain packet-level traffic representation p N1 And p N2 , respectively corresponding to And

[0034] Further obtain traffic representation at the flow level through a recurrent neural network RNN And Generate flow-level representation based on the sequence of packet-level representation to complete the representation learning process.

[0035] Further, the heterogeneous graph neural network HGNN is based on the GraphSAGE architecture.

[0036] Further, in step S3, training the traffic classification task includes simultaneously performing classification at the flow level and the packet level, specifically including:

[0037] Different levels of representation are processed using a shared traffic classifier using a multi-layer perceptron (MLP);

[0038] The traffic level and packet level representations are spliced to form a comprehensive feature vector;

[0039] The traffic level and packet level classification losses are calculated respectively, and the performance of the classifier is evaluated using a cross-entropy loss function.

[0040] Further, in step S3, the contrastive learning task includes:

[0041] Double-layer contrastive learning: a contrastive learning strategy is adopted to learn semantic invariant representations by comparing the embedding vectors of different data enhancement sample pairs, and a supervised contrastive loss is introduced to utilize data labels, wherein the supervised contrastive loss optimizes the model by comparing the similarity of positive samples and negative samples;

[0042] Packet-level contrastive learning: packet-level traffic representation generated based on the traffic graph is enhanced, including graph structure enhancement and node feature enhancement, to reveal semantic invariant representations in traffic units, wherein the packet-level contrastive learning loss promotes the model's understanding of packet-level traffic features by comparing the traffic graph representations before and after enhancement;

[0043] Flow-level contrastive learning: flow-level contrastive learning is performed by randomly discarding packets to capture common features of traffic flows and generate robust flow-level representations, wherein the flow-level contrastive learning loss improves the model's ability to recognize overall features of traffic flows by comparing the traffic representations before and after discarding packets.

[0044] Further, in step S3, the overall training target of the end-to-end multi-task training is designed to integrate the packet-level classification loss, the flow-level classification loss, the packet-level contrastive learning loss, and the flow-level contrastive learning loss in a weighted combination manner, wherein the coefficients of the packet-level contrastive learning loss and the flow-level contrastive learning loss are adjusted to determine the contributions of the packet-level and flow-level contrastive tasks.

[0045] A computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the multi-view heterogeneous graph model-based encrypted traffic classification method.

[0046] A computer program product includes a computer program, and the computer program is executed by a processor to implement the multi-view heterogeneous graph model-based encrypted traffic classification method.

[0047] The present application has the following advantages:

[0048] The application provides a multi-view heterogeneous graph model-based encrypted traffic classification method, designs a simple and effective model MH-Net, and exhibits significant technical advantages in the field of network traffic classification, mainly embodied in the multi-view heterogeneous traffic graph construction method and the efficient representation learning strategy. MH-Net aggregates different numbers of traffic bits into multiple types of traffic units, effectively enriching the diversity of information granularity, which not only enhances the expression ability of traffic data, but also provides the possibility for in-depth mining of fine-grained associations in traffic data. The head-head, head-payload and payload-payload unit correlations introduced by MH-Net enable the model to capture the functional differences of different parts in the traffic unit sequence, further enhancing the accuracy of traffic classification. By using point-to-point mutual information (PMI) and multi-task contrastive learning strategy, the representation learning performed by MH-Net on the traffic graph not only enhances the robustness of traffic unit representation, but also improves the ability of the model to identify attack behaviors in the face of encryption technologies such as VPN and Tor. Experimental results show that MH-Net has achieved excellent performance in both packet-level and flow-level traffic classification tasks, surpassing multiple benchmark models, proving its advanced nature in improving traffic classification accuracy and robustness. In addition, the multi-task training framework of MH-Net enables the model to simultaneously train in traffic-level and packet-level classification tasks, optimizing the overall performance of the model and demonstrating its broad application prospects in the field of network traffic classification.

[0049] Other beneficial effects of the embodiments of the application will be further described below. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 A model structure diagram of the multi-view heterogeneous graph model-based encrypted traffic classification method of the embodiments of the application. DETAILED DESCRIPTION

[0051] The embodiments of the application will be described in detail below. It should be emphasized that the following description is merely exemplary and is not intended to limit the scope of the application and its applications.

[0052] With the continuous development of computer network technology and a large number of devices accessing the Internet, user privacy is increasingly vulnerable to malicious attacks. Although encryption technologies such as VPN and Tor can provide protection for users, they can also be used by attackers as a tool to hide their identity. Traditional packet deep packet inspection (DPI) methods have lost their effectiveness in the face of encrypted traffic. It is still a great challenge to design a method that can universally and effectively classify attacker network activities (such as website browsing or application usage) from encrypted traffic.

[0053] To solve the above challenges, the present application proposes an encrypted traffic classification method, and designs a novel multi-view heterogeneous graph model named MH-Net, which classifies network traffic through multi-view heterogeneous traffic graphs. Specifically, MH-Net first aggregates different numbers of traffic bits into multiple types of traffic units (e.g., 4-bit units and 8-bit units), thereby promoting the information granularity diversity of traffic data. Since graphs have excellent capabilities in processing relational data, MH-Net further converts multiple types of traffic unit sequences into multi-view traffic graphs using point-to-point mutual information (PMI). On this basis, considering the functional differences of different parts in traffic unit sequences, MH-Net introduces three types of unit correlations, namely head-head, head-payload, and payload-payload unit correlations, and designs a heterogeneous traffic graph encoder using heterogeneous graph neural network (HGNN) for multi-view heterogeneous graph representation learning. In order to enhance the robustness of traffic unit representation, contrastive learning is also performed on the traffic graph in a multi-task manner.

[0054] The encrypted traffic classification method based on the multi-view heterogeneous graph model provided by the present application has the model structure as shown in Figure 1 The method comprises the following steps:

[0055] Step S1, multi-view traffic graph construction: aggregating bits in network traffic data into multiple types of traffic units to achieve information granularity diversity; quantifying the correlation between different types of traffic unit sequences using point-to-point mutual information (PMI) to construct multi-view traffic graphs; revealing the fine-grained association between traffic units through the graph structure of the constructed multi-view traffic graphs, and providing structured data for subsequent heterogeneous traffic graph representation learning.

[0056] In a preferred embodiment, step S1 specifically comprises: converting the aggregated traffic unit sequence into a traffic graph to form an overall interrelated whole, and using the natural advantages of the graph structure to mine the potential fine-grained correlation in the traffic unit sequence; applying the point-to-point mutual information (PMI) algorithm to quantify the correlation between traffic units, and counting the number of common occurrences by sliding a window over the traffic unit sequence; calculating the PMI value to determine the high correlation between traffic units, and connecting two traffic units only when the PMI value is greater than zero, indicating that there is significant correlation between them; for the traffic data in each data packet, selecting two different lengths of traffic units, (N1)-bit and (N2)-bit traffic units, and respectively applying the PMI algorithm to construct multi-view traffic graphs and In the constructed multi-view traffic graph, the features of the nodes are determined by the values of the traffic units.

[0057] Step S2, heterogeneous traffic graph representation learning: based on the multi-view traffic graph constructed in step S1, the head-head, head-payload and payload-payload unit correlations are introduced to form a heterogeneous traffic graph; the heterogeneous graph neural network HGNN is used for representation learning of the heterogeneous traffic graph, wherein the distinctive features in the traffic graph are extracted through the heterogeneous traffic graph representation learning to provide rich feature representation for the traffic classification task, including traffic level and packet level representation.

[0058] In a preferred embodiment, in step S2, the model's ability to capture the functional differences of different parts in the traffic data is enhanced by integrating heterogeneous traffic unit correlations, specifically including: identifying the heterogeneity of the head and payload in the packet byte sequence, and the different types of traffic unit correlations based on their positions; constructing three types of traffic unit correlations: head-head (h-h), payload-payload (p-p) and head-payload (h-p) to fully utilize the heterogeneity in the head and payload; applying the PMI algorithm to the head, payload and entire traffic unit sequence respectively to obtain three types of traffic edges, and integrating these edges into a heterogeneous traffic graph G H ; constructing view heterogeneous traffic graph and Realizing fine-grained heterogeneous fusion of the head and the payload in a single traffic graph for effective representation learning.

[0059] In a preferred embodiment, in step S2, a heterogeneous traffic graph encoder is applied for traffic representation learning to extract and learn the heterogeneous features in the traffic graph and generate rich traffic representation, specifically including: the heterogeneous traffic graph encoder uses the heterogeneous graph neural network HGNN to extract the distinctive features of the traffic graph; the HGNN is preferably based on the GraphSAGE architecture, and the model weights of different edge types are not shared to adapt to different types of traffic unit correlations; in each layer of the HGNN, the information of the node and its neighbors is processed through the message calculation function and the message aggregation function to obtain the embedding vector of the node; an element-wise average operation is performed on all node embedding vectors of the last layer to obtain the packet-level traffic representation p N1 and p N2 , corresponding to and The traffic level traffic representation and is further obtained through the recurrent neural network RNN

[0060] Step S3, multi-task training of the MH-Net model: based on the multi-view traffic graph constructed in step S1 and the discriminative features extracted in step S2, multi-task training of the MH-Net model is performed, wherein the traffic classification tasks at the packet level and the flow level are jointly trained, and the contrast learning task is trained to enhance the robustness of the traffic unit representation; wherein the traffic classification is performed at the packet level and the flow level, the representations at the traffic level and the packet level obtained in step S2 are converted into classification results by using a multi-layer perception MLP, and the corresponding traffic classification task loss is calculated; the contrast learning strategy is adopted, the semantic invariant representation is learned by contrasting the positive and negative sample pairs from various data augmentations, and the model performance is further enhanced; the multi-task training of the MH-Net model is trained through end-to-end training, realizes accurate classification of encrypted traffic, and optimizes the overall performance of the model.

[0061] In a preferred embodiment, in step S3, training the traffic classification task includes simultaneously performing classification at the traffic level and the packet level, specifically including: using a non-shared traffic classifier, using a multi-layer perception (MLP) to process representations at different levels; concatenating the representations at the traffic level and the packet level to form a comprehensive feature vector; respectively calculating the classification loss at the traffic level and the packet level, and using a cross-entropy loss function to evaluate the performance of the classifier.

[0062] In a preferred embodiment, in step S3, the contrast learning task specifically includes:

[0063] Double-layer contrast learning: using a contrast learning strategy, learning a semantic invariant representation by contrasting embedding vectors of different data augmentation sample pairs, introducing a supervised contrast loss to better utilize data labels, and optimizing the model by comparing the similarity of positive samples and negative samples to strengthen the robustness of the model to data augmentation.

[0064] Packet-level contrast learning: packet-level traffic representation generated based on the traffic graph is enhanced, including graph structure enhancement and node feature enhancement, to reveal semantic invariant representations in traffic units, wherein the packet-level contrast learning loss is used to promote the model's understanding of packet-level traffic features and enhance the model's performance by contrasting the traffic graph representations before and after enhancement.

[0065] Flow-level contrast learning: flow-level contrast learning is performed by randomly discarding packets to capture common features of traffic flows and generate robust flow-level representations, wherein the flow-level contrast learning loss is used to improve the model's ability to identify overall features of traffic flows by contrasting traffic representations before and after discarding packets.

[0066] In a preferred embodiment, in step S3, the overall training objective of the end-to-end multi-task training is designed to integrate the packet-level classification loss, the flow-level classification loss, the packet-level contrastive learning loss, and the flow-level contrastive learning loss in a weighted combination manner, wherein the contributions of the packet-level and flow-level contrastive tasks are adjusted by adjusting the coefficients of the packet-level and flow-level contrastive learning losses.

[0067] The specific embodiments of the present application and examples of algorithm implementation thereof are further described below.

[0068] An encrypted traffic classification method based on a multi-view heterogeneous graph model MH-Net, which improves encrypted traffic classification by using MH-Net. MH-Net first aggregates different numbers of traffic bits into multiple types of traffic units (e.g., 4-bit units and 8-bit units), thereby promoting the information granularity diversity of traffic data. Since graphs have excellent capabilities in processing relational data, MH-Net further converts multiple types of traffic unit sequences into multi-view traffic graphs using point-to-point mutual information (PMI). On this basis, considering the functional differences of different parts in the traffic unit sequence, MH-Net introduces three types of unit correlations, namely head-head, head-payload, and payload-payload unit correlations, and designs a heterogeneous traffic graph encoder for multi-view heterogeneous graph representation learning. In order to enhance the robustness of traffic unit representation, contrastive learning is also performed on the traffic graph in a multi-task manner.

[0069] Multi-view traffic graph construction

[0070] The following first describes the theoretical basis for using traffic units and details how to construct a multi-view traffic graph through traffic units.

[0071] Traffic units with diverse granularities

[0072] In order to reveal the diverse information granularities contained in the original bytes, the present application aggregates different lengths of original bits into various traffic units beyond the simple bytes themselves. Traffic units with different bit numbers can "interpret" or "express" transmission data from different angles, thereby being able to mine potential high-discriminative features. Taking character encoding as an example, given 16-bit binary data, it can be converted into a Chinese character through a 16-bit traffic unit, or two English characters through an 8-bit traffic unit. Therefore, various traffic units can be used for multi-view feature extraction on the same traffic data, thereby obtaining a better traffic representation.

[0073] Traffic graph construction

[0074] Although the traffic data is aggregated into traffic units, these units are still individual and dispersed, which is not conducive to mining the potential fine-grained correlation in the traffic unit sequence. Inspired by (Zhang et al., 2023; Yao, Mao, and Luo, 2019), since the graph structure has natural advantages in data correlation modeling, the traffic unit sequence is further converted into a traffic graph, making it a whole interrelated body. For a sequence of N-bit traffic units, the point-to-point mutual information (PMI) is used to quantify the correlation between traffic units. PMI applies a sliding window on the traffic unit sequence and counts the number of times two units co-occur in the window. The co-occurrence frequency of two units and the occurrence frequency of each unit are used to calculate PMI, which is as follows:

[0075]

[0076] where #W is the total number of sliding windows, represents the number of times occurs in the sliding window, represents the number of times and co-occur in the sliding window. Only when is met, connect two traffic units and to represent their high correlation. For the traffic data in each packet, two types of traffic units are selected, such as (N1)-bit and (N2)-bit traffic units, and the PMI algorithm is applied to their sequences to construct multi-view traffic graphs and It should be noted that the features of the nodes in the traffic graph are the values of the respective traffic units.

[0077] Heterogeneous traffic graph representation learning

[0078] Next, further integrate the heterogeneous correlation in the traffic graph and design a carefully constructed heterogeneous traffic graph encoder for performing heterogeneous traffic graph representation learning.

[0079] Heterogeneous traffic unit correlation

[0080] In the byte sequence of the packet, due to the difference in function (the former carries the metadata of the packet, and the latter carries the actual transmission content), the header and the payload have information heterogeneity. However, the homogeneous correlation of traffic units in the traffic graph GG limits the full use of the heterogeneity in the header and the payload. Therefore, it is believed that the correlation between traffic units should have multiple types according to their position in the traffic unit sequence. Intuitively, the present application proposes three types of traffic unit correlation: header-header (h-h), payload-payload (p-p), and header-payload (h-p) correlation to alleviate the above problem.

[0081] Subsequently, PMI algorithm is applied to the sequence of flow units of the head, the payload and the head+payload (i.e. the entire sequence of flow units) respectively to obtain three types of flow edges, which are further integrated into a heterogeneous flow graph G H .

[0082] View heterogeneous flow graph and In this way, the correlation between flow units becomes more fine-grained, realizing seamless heterogeneous fusion of the head and the payload in a single flow graph.

[0083] Heterogeneous flow graph encoder

[0084] So far, the flow graph has been obtained for each data packet, which will be further input into the heterogeneous flow graph encoder for flow representation learning.

[0085] Specifically, the heterogeneous flow graph encoder adopts a heterogeneous graph neural network (HGNN) to extract discriminative features of the flow graph. HGNN uses GraphSAGE as its basic skeleton, and the model weights are not shared between different edge types. Generally, the forward propagation of HGNN at the l-th layer can be described as:

[0086]

[0087] where, is the embedding vector of node v in the l-th layer, is the neighbor message of node v calculated in the l-th layer, and N(v) is the neighbor set of node v. MSG l (·) is a message calculation function, whose parameter is and AGG l (·) is a message aggregation function, whose parameter is located in the l-th layer. Then, an element-wise average operation is performed on all node embedding vectors of the last layer to obtain the final packet-level flow representation p N1 and p N2 , respectively corresponding to and can be simplified as:

[0088]

[0089] The flow-level flow representation and

[0090]

[0091] where L is the length of the flow

[0092] Multi-task training of MH-Net

[0093] The object of the present application is to jointly train the MH-Net in a multi-task manner to achieve better optimization. The training objectives of the MH-Net mainly include the flow classification and contrastive learning tasks, which will be described in detail below.

[0094] Flow classification task. In the present application, flow-level and packet-level flow classification tasks are performed simultaneously. As shown in Figure 1 , a non-shared flow classifier is used to convert the flow-level and packet-level representations using a multi-layer perceptron (MLP) and calculate the corresponding flow classification task losses respectively:

[0095] f = CONCAT(f N1 ,f N2 ), p = CONCAT(P N1 ,P( N2 ))

[0096] L FCLS = CE(MLP(f), y f ), L PCLS = CE(MLP(P), y p )

[0097] where CONCAT(·) represents the concatenation operation, CE(·) is the cross-entropy loss function, y f is the flow label, and y p is the packet label consistent with its belonging flow label.

[0098] Double-layer contrastive learning

[0099] Inspired by the powerful representation learning ability of contrastive learning, which aims to learn a semantic-invariant representation by contrasting positive and negative sample pairs from various data augmentations, it is proposed to further enhance the multi-view packet-level and flow-level representations in the MH-Net using contrastive learning. Specifically, the MH-Net adopts a supervised contrastive loss to better utilize the data labels during the training process, which can be represented as:

[0100]

[0101] where z refers to a set of embedding vectors from two sets of augmented data samples from the same source. z e I is the index of any augmented sample in z, K(i)≡I{i}, and M(i)≡{m e K(i): y m = y i} is the index of all positive samples under the same data label condition. + represents the temperature parameter.

[0102] Packet-level contrastive learning

[0103] Since the packet-level traffic representation is generated based on the traffic graph, an enhanced graph needs to be generated for further contrastive learning. In the present application, two enhancement methods are mainly used: graph structure enhancement and node feature enhancement.

[0104] For graph structure enhancement, a random walk algorithm is used, which starts from a randomly selected node and iteratively performs random traversal on its neighbors to obtain an enhanced traffic graph. For node feature enhancement, the traffic graph is enhanced by flipping the node features, thereby obtaining another enhanced traffic graph After obtaining the embedding vector and , the packet-level contrastive loss can be represented as:

[0105]

[0106] It is worth noting that the embedding vector P N of the original traffic graph is regarded as an "anchor point" for training stability without enhancement (slightly abusing the symbol). By directly perturbing the structure and features of the traffic graph, the semantic invariant representation in the traffic unit (i.e., node) can be well revealed through contrastive learning, thereby enhancing the performance of the model.

[0107] Flow-level contrastive learning

[0108] Further, the flow-level contrastive learning task is performed by randomly discarding packets in the traffic with a certain probability P PD ∈[0,1], thereby obtaining enhanced traffic. Similarly, the flow-level contrastive loss can be represented as:

[0109]

[0110] where ρ i ∈{0,1} is drawn from the Bernoulli distribution ρ~B(P PD ), indicating whether to discard the packet. This learning paradigm also helps the model capture the common features of traffic flows through data augmentation, thereby generating flow-level representations with robustness.

[0111] Overall training objective.

[0112] Overall, the present application proposes the overall end-to-end multi-task training objective of MH-Net, as follows:

[0113] L=LPCLS +L FCLS +αL PCL +βL FCL

[0114] where, α and β ∈ [0, 1] are coefficients that control the contribution of packet-level and flow-level tasks.

[0115] The present application proposes a simple and effective model MH-Net, which aggregates different numbers of flow bits into flow units, and uses point-wise mutual information to construct multi-view heterogeneous flow graphs. In particular, the heterogeneous byte correlation contained in the flow graph is revealed, and a heterogeneous graph neural network is used for graph representation learning. In addition, multi-task supervised contrastive learning is performed to obtain a more powerful flow representation.

[0116] Experimental results

[0117] In order to comprehensively evaluate MH-Net, packet-level and flow-level traffic classification tasks are performed on ISCX and CIC-IoT datasets. Experimental results show that MH-Net achieves the best overall performance on flow-level and packet-level traffic classification tasks compared to multiple baseline models, ranking first among all state-of-the-art methods. Further analysis of flow units also reveals the potential trade-off between complementarity and interference among flow units with different information granularities. Extensive analysis of flow units reveals the possibility of using complementary information from different flow units to improve traffic classification performance.

[0118] In summary, the present application proposes an innovative MH-Net model, which aggregates different numbers of flow bits into multiple types of flow units to construct multi-view flow graphs, which not only enriches the diversity of information granularity, but also improves the model performance. MH-Net further introduces three types of flow unit correlations: header-header, header-payload, and payload-payload, to model the heterogeneity of flow graphs, and uses a heterogeneous graph neural network for feature extraction, thereby more accurately capturing the complex relationships in traffic data. In addition, MH-Net performs contrastive learning in a multi-task manner, enhancing the robustness of flow unit representation, and achieving simultaneous training in flow-level and packet-level classification tasks, resulting in the best overall performance. Furthermore, the method of the present application can be extended to use large models and large amounts of unlabeled data to enhance the robustness and generalization ability of the model, making it have a wider application prospect in the field of network traffic classification.

[0119] The MH-Net model and the encrypted traffic classification method thereof have high application value in the field of network traffic classification: (1) by constructing a multi-view heterogeneous traffic graph, the fine-grained association between traffic bytes can be fully revealed and utilized, thereby improving the accuracy of traffic classification; (2) by using point-to-point mutual information (PMI) and multi-task contrast learning strategy, the robustness of traffic unit representation is enhanced, which is helpful to accurately identify attack behaviors in encrypted traffic, especially in the case where VPN and Tor and other encryption technologies are used as identity hiding tools. In addition, compared with the prior art, the method of the present application has the following significant advantages: (1) by aggregating different numbers of traffic bits into multiple types of traffic units, more rich information granularity is provided, thereby enhancing the expression ability of traffic data; (2) a heterogeneous traffic graph encoder is designed to capture different association types between header bytes and payload bytes, so that the traffic classification model can fully utilize the multiple association types between bytes, further improving the performance and accuracy of the model.

[0120] The embodiment of the present application also provides a storage medium for storing a computer program, which is executed to perform at least the method described above.

[0121] The embodiment of the present application also provides a control device, which comprises a processor and a storage medium for storing a computer program; wherein the processor is used to execute the computer program to perform at least the method described above.

[0122] The embodiment of the present application also provides a processor, which executes a computer program to perform at least the method described above.

[0123] The storage medium can be implemented by any type of nonvolatile storage device, or a combination thereof. The nonvolatile memory can be a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Programmable Read-Only Memory (EPROM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Ferromagnetic Random Access Memory (FRAM), a Flash memory, a magnetic surface storage, an optical disc, or a Compact Disc Read-Only Memory (CD-ROM). The magnetic surface storage can be a magnetic disc memory or a magnetic tape memory. The storage medium described in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable type of memory.

[0124] In several embodiments provided by the present application, it should be understood that the disclosed system and method can be implemented in other manners. The described device embodiments are merely schematic, and the division of the units is merely a logical function division. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling, or direct coupling or communication connection between the components can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or in other forms.

[0125] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place or distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0126] In addition, each functional unit in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in the form of hardware, or in the form of hardware plus software functional units.

[0127] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware, and the foregoing program can be stored in a computer readable storage medium, and the program performs the steps of the above-mentioned method embodiments when executed; and the foregoing storage medium includes a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disc or an optical disc and various storage medium capable of storing program codes.

[0128] Alternatively, the integrated unit of the present application can be stored in a computer readable storage medium if it is realized in the form of a software function module and sold or used as an independent product. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the methods described in the embodiments of the present application. The foregoing storage medium includes a mobile storage device, a ROM, a RAM, a magnetic disc or an optical disc and various storage medium capable of storing program codes.

[0129] The methods disclosed in the several method embodiments provided by the present application can be combined arbitrarily without conflict to obtain new method embodiments.

[0130] The features disclosed in the several product embodiments provided by the present application can be combined arbitrarily without conflict to obtain new product embodiments.

[0131] The features disclosed in the several method or device embodiments provided by the present application can be combined arbitrarily without conflict to obtain new method embodiments or device embodiments.

[0132] The above is a further detailed description of the present application in combination with specific preferred embodiments, and the specific implementation of the present application cannot be limited to these descriptions. For those skilled in the art of the present application, without departing from the concept of the present application, a number of equivalent substitutions or obvious modifications can be made, and the performance or use is the same, which should be regarded as belonging to the protection scope of the present application.

Claims

1. An encrypted traffic classification method based on a multi-view heterogeneous graph model, characterized in that: The following steps are involved: S1. Multi-perspective traffic graph construction: Bits in network traffic data are aggregated into multiple types of traffic units to achieve diverse information granularity. For each type of traffic unit sequence, the correlation between traffic units is quantified using point-to-point mutual information (PMI) to construct a multi-perspective traffic graph. The graph structure of the constructed multi-perspective traffic graph reveals the fine-grained correlation between traffic units. S2. Heterogeneous traffic graph representation learning: Based on the constructed multi-view traffic graph, the head-head, head-load and load-load unit correlations are introduced to form a heterogeneous traffic graph; Heterogeneous graph neural networks (HGNNs) are used to learn representations of heterogeneous traffic graphs. This learning extracts discriminative features from traffic graphs, providing rich feature representations for traffic classification tasks, including flow-level and packet-level representations. S3. Multi-task training of MH-Net model: Based on the constructed multi-view traffic graph and the extracted discriminative features, multi-task training of the multi-view heterogeneous graph model, namely the MH-Net model, is performed, wherein the packet-level and flow-level traffic classification tasks, as well as the comparative learning tasks, are jointly trained; wherein, traffic classification is performed at the packet level and flow level, and the obtained traffic-level and packet-level representations are converted into classification results using the multi-layer perceptron (MLP), and the corresponding traffic classification task loss is calculated; a comparative learning strategy is adopted to learn semantically invariant representations by comparing positive and negative sample pairs from various data enhancements; the multi-task training of the MH-Net model achieves accurate classification of encrypted traffic through overall end-to-end training.

2. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to claim 1 is characterized in that: Step S1 specifically includes: Convert the aggregated flow unit sequence into a flow graph to form an interconnected whole, and use the graph structure to mine the potential fine-grained correlations in the flow unit sequence; The point-to-point mutual information (PMI) algorithm is applied to quantify the correlation between traffic units, and the number of co-occurrences is counted by sliding a window over the traffic unit sequence; Calculate the PMI value to identify high correlations between flow units. Only when the PMI value is greater than zero, connect the two flow units to indicate that there is a significant correlation between them. For the traffic data in each data packet, two traffic units with different lengths are selected. bit and The PMI algorithm is applied to each traffic unit to construct a multi-view traffic graph. and ; In the constructed multi-view traffic graph, the characteristics of the nodes are determined by the values ​​of each traffic unit.

3. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to claim 1 or 2, characterized in that: In step S2, the correlation of heterogeneous traffic units is integrated to enhance the model's ability to capture the functional differences of different parts of the traffic data. Specifically, the following steps are involved: Identify the heterogeneity of headers and payloads in packet byte sequences, and the correlation of different types of traffic units based on their position; Three types of flow unit correlations, namely head-head (hh), load-load (pp) and head-load (hp), are constructed to fully exploit the heterogeneity in heads and loads; Apply the PMI algorithm to the header, load, and entire flow unit sequence respectively to obtain three types of flow edges, and integrate these edges into a heterogeneous flow graph ; Build a heterogeneous traffic graph and , achieving fine-grained heterogeneous fusion of headers and payloads in a single traffic graph for effective representation learning.

4. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to claim 3 is characterized in that: In step S2, a heterogeneous traffic graph encoder is applied to perform traffic representation learning to extract and learn heterogeneous features in the traffic graph and generate traffic representation, specifically including: The heterogeneous flow graph encoder uses a heterogeneous graph neural network (HGNN) to extract discriminative features of the flow graph; The model weights of different edge types of the heterogeneous graph neural network HGNN are not shared to adapt to the correlation of different types of traffic units; In each layer of HGNN, the information of the node and its neighbors is processed through the message calculation function and the message aggregation function to obtain the embedding vector of the node; Perform element-wise averaging on all node embedding vectors in the last layer to obtain packet-level traffic representation and , corresponding to and ; The flow level representation is further obtained through the recurrent neural network RNN and , based on the packet-level representation sequence, the stream-level representation is generated to complete the representation learning process.

5. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to claim 4 is characterized in that: The heterogeneous graph neural network HGNN is based on the GraphSAGE architecture.

6. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to any one of claims 1 to 2, characterized in that: In step S3, the training traffic classification task includes simultaneously performing classification at the traffic level and the packet level, specifically including: A non-shared traffic classifier is used, and a multi-layer perceptron (MLP) is used to process representations at different levels. Concatenate the flow-level and packet-level representations to form a comprehensive feature vector; The classification losses are calculated at the flow level and packet level respectively, and the cross entropy loss function is used to evaluate the performance of the classifier.

7. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to any one of claims 1 to 2, characterized in that: In step S3, the contrastive learning task includes: Two-layer contrastive learning: Adopting a contrastive learning strategy, this method learns semantically invariant representations by comparing the embedding vectors of pairs of data-augmented samples. It also introduces a supervised contrastive loss to leverage data labels. The supervised contrastive loss optimizes the model by comparing the similarity between positive and negative samples. Packet-level contrastive learning: Enhances the packet-level traffic representation generated based on the traffic graph, including graph structure enhancement and node feature enhancement, to reveal the semantically invariant representation of traffic units. The packet-level contrastive learning loss compares the traffic graph representation before and after enhancement to promote the model's in-depth understanding of packet-level traffic characteristics. Flow-level contrastive learning: Flow-level contrastive learning is performed by randomly dropping packets to capture the common characteristics of traffic flows and generate robust flow-level representations. The flow-level contrastive learning loss improves the model's ability to identify the overall characteristics of traffic flows by comparing the traffic representations of complete traffic and those after partially dropping packets.

8. The encrypted traffic classification method based on a multi-view heterogeneous graph model according to any one of claims 1 to 2, characterized in that: In step S3, the overall training goal of end-to-end multi-task training is designed to integrate packet-level classification loss, flow-level classification loss, packet-level contrastive learning loss, and flow-level contrastive learning loss in a weighted combination manner, wherein the packet-level and flow-level contrastive task contributions are controlled by adjusting the coefficients of the packet-level contrastive learning loss and the flow-level contrastive learning loss.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the encrypted traffic classification method based on the multi-view heterogeneous graph model as described in any one of claims 1 to 8.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the encrypted traffic classification method based on the multi-view heterogeneous graph model as described in any one of claims 1 to 8.

Images