Encrypted traffic classification method and device, computer equipment and medium

Abstract

The invention relates to an encrypted traffic classification method and device, computer equipment and a medium, and the method comprises the steps: carrying out the preprocessing of original traffic, and obtaining a session image of a data packet header and a session image of a payload; extracting global features and spatial-temporal features of the header and the load according to the session image of the packet header of the data packet and the session image of the effective load; fusing the global features and the spatial-temporal features of the head and the load through adaptive weighting to obtain initially fused head features and load features; fusing the head feature and the load feature which are initially fused together through adaptive weighting to obtain a final feature vector; and classifying the original traffic according to the final feature vector. In the whole process, the situation that the same byte value has different meanings in the head and the effective load in practical application is fully considered, and accurate encrypted traffic classification can be realized.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an encrypted traffic classification method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] In today's digital age, with the widespread popularity and in-depth application of the Internet, network security has become a major issue that cannot be ignored worldwide. Faced with the increasingly rampant cyber attacks and data leakage risks, encryption technology, as an important line of defense for protecting information security, has become increasingly prominent. By adopting advanced encryption algorithms and protocols, encryption technology can effectively ensure the confidentiality, integrity and authenticity of data during transmission, providing a solid guarantee for the privacy and anonymity of users.

[0003] However, the widespread use of encryption technology also brings a double-edged sword effect. On the one hand, it greatly improves the security of network communications; on the other hand, it brings unprecedented challenges to the analysis and classification of network traffic. Cybercriminals use encryption technology to hide malicious behavior in seemingly normal encrypted traffic, making traditional traffic monitoring and analysis methods difficult to work. This concealment not only increases the complexity of intrusion detection systems (IDS) and malware propagation detection, but also may cause security vulnerabilities to remain dormant for a long time and be difficult to detect. In addition, with the popularity of privacy-enhancing tools such as virtual private networks (VPN) and onion routing (Tor), the anonymity and concealment of network traffic are further enhanced. These tools use multiple layers of encryption and routing technology to make network traffic difficult to track and locate, thereby making traffic classification more difficult.

[0004] Therefore, an accurate encrypted traffic classification scheme is urgently needed. Summary of the invention

[0005] Based on this, it is necessary to provide an accurate encrypted traffic classification method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a method for classifying encrypted traffic. The method comprises:

[0007] Preprocess the original traffic to obtain the session image of the data packet header and the session image of the payload respectively;

[0008] Extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload;

[0009] The global features of the head and the load are fused with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features;

[0010] The initially fused head features and load features are fused together by adaptive weighting to obtain a final feature vector;

[0011] The original traffic is classified according to the final feature vector.

[0012] In one embodiment, the preprocessing of the original traffic to obtain the session image of the data packet header and the session image of the payload respectively includes:

[0013] Divide raw traffic into network sessions;

[0014] Filtering invalid traffic in the network session to obtain a filtered network session;

[0015] Performing data enhancement on the data packets in the filtered network session by using fixed step sampling;

[0016] The header and payload of each enhanced packet are converted into session grayscale images respectively.

[0017] In one embodiment, converting the header and payload of each enhanced data packet into a session grayscale image includes:

[0018] Acquire a session flow formed by the enhanced data packets, extract n preset data packets from the session flow, and obtain a target data packet;

[0019] Extracting respectively the preset t bytes before the payload and the preset h bytes before the packet header from each data packet in the target data packet;

[0020] Read each packet extracted bytes byte by byte, convert each byte to an integer, and convert each integer to a packet image;

[0021] The head features and payload images are merged into head session image and payload image respectively.

[0022] In one embodiment, extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload includes:

[0023] The session image of the data packet header and the session image of the payload are simultaneously input into PVT and STFE to extract the global features and spatiotemporal features of the header and the payload.

[0024] In one embodiment, the session image of the data packet header and the session image of the payload are simultaneously input into the PVT, and the global features of the header and the payload are extracted, including:

[0025] Decomposing the session image of the data packet header and the session image of the payload into a series of multiple packet images respectively, projecting each packet image into a d-dimensional space through a convolution operation, and obtaining a packet embedding of each data packet;

[0026] The position of each data packet is embedded through position encoding to obtain position embedding;

[0027] Convert the length of each packet into a one-hot vector and use a linear layer to generate a length embedding;

[0028] Add the packet embedding, position embedding, and length embedding of each packet to get the final embedding for each packet;

[0029] Adding a learnable embedding to the beginning of the final embedding to characterize the global features of the session, to obtain a packet header and a payload after the session input embedding layer;

[0030] The packet header and the effective load after the session input embedding layer are input into the PVT to obtain the global characteristics of the header and the load of each data packet.

[0031] In one embodiment, the packet header and payload after the session input embedding layer are input into the PVT to obtain the global features of the header and payload of each data packet, including:

[0032] Performing the attention score function calculation of the KBS module on the final embedding of each data packet to obtain the sum of the weights at each byte position;

[0033] Filter the N byte positions with the largest sum of weights and determine them as the keybyte_pos template;

[0034] Optimize the input header and the payload after the input embedding layer according to the keybyte_pos template to obtain an optimized input vector;

[0035] The optimized input vector is input into the Fourier transform module of PVT after layer normalization;

[0036] The output of the Fourier transform module is processed through a residual connection and a fully connected layer with a LeakyRELU activation function to obtain the output sequence OL;

[0037] The first vector is extracted from the sequence OL as the global feature of the header and payload of the data packet.

[0038] In one embodiment, the session image of the data packet header and the session image of the payload are simultaneously input into the STFE, and the spatiotemporal features of the header and the payload are extracted, including:

[0039] Inputting the session image of the data packet header and the session image of the payload into a ResAtConv layer including a convolution layer and an attention layer to obtain a spatial feature with a temporal feature;

[0040] The spatial features with temporal features are input into a bidirectional long short-term memory network to capture the spatiotemporal features of the head and the payload.

[0041] In a second aspect, the present application also provides an encrypted traffic classification device. The device comprises:

[0042] A preprocessing module, used for preprocessing the original traffic to obtain a session image of a data packet header and a session image of a payload;

[0043] A feature extraction module, used for extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload;

[0044] A first fusion module, used to fuse the global features of the head and the load with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features;

[0045] A second fusion module is used to fuse the initially fused head features and load features together through adaptive weighting to obtain a final feature vector;

[0046] A classification module is used to classify the original traffic according to the final feature vector.

[0047] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0048] Preprocess the original traffic to obtain the session image of the data packet header and the session image of the payload respectively;

[0049] Extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload;

[0050] The global features of the head and the load are fused with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features;

[0051] The initially fused head features and load features are fused together by adaptive weighting to obtain a final feature vector;

[0052] The original traffic is classified according to the final feature vector.

[0053] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0054] Preprocess the original traffic to obtain the session image of the data packet header and the session image of the payload respectively;

[0055] Extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload;

[0056] The global features of the head and the load are fused with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features;

[0057] The initially fused head features and load features are fused together by adaptive weighting to obtain a final feature vector;

[0058] The original traffic is classified according to the final feature vector.

[0059] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0060] Preprocess the original traffic to obtain the session image of the data packet header and the session image of the payload respectively;

[0061] Extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload;

[0062] The global features of the head and the load are fused with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features;

[0063] The initially fused head features and load features are fused together by adaptive weighting to obtain a final feature vector;

[0064] The original traffic is classified according to the final feature vector.

[0065] The above-mentioned encrypted traffic classification method, device, computer equipment, storage medium and computer program product pre-process the original traffic to obtain the session image of the data packet header and the session image of the payload respectively; extract the global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload; fuse the global features and spatiotemporal features of the header and the payload together through adaptive weighting to obtain the initial fused header features and load features; fuse the initial fused header features and load features together through adaptive weighting to obtain the final feature vector; classify the original traffic according to the final feature vector. In the whole process, the data packet header and the payload are characterized independently, and then the extracted features are weighted and fused, fully considering the situation in actual applications that the same byte value has different meanings in the header and the payload, so as to achieve accurate encrypted traffic classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 An application environment diagram of an encrypted traffic classification method in an embodiment;

[0067] Figure 2 A schematic diagram of a flow chart of an encrypted traffic classification method in an embodiment;

[0068] Figure 3 A schematic diagram of a flow chart of an encrypted traffic classification method in another embodiment;

[0069] Figure 4 It is a schematic diagram of the PVT structure;

[0070] Figure 5 A flowchart diagram of a flowchart diagram method in a specific application example;

[0071] Figure 6 It is a structural block diagram of a flow diagram device in one embodiment;

[0072] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0074] The encrypted traffic classification method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 sends an encrypted traffic classification request to the server 104, and the server 104 pre-processes the original traffic carried in the encrypted traffic classification request to obtain the session image of the data packet header and the session image of the payload respectively; according to the session image of the data packet header and the session image of the payload, the global features and spatiotemporal features of the header and the load are extracted; the global features and spatiotemporal features of the header and the load are fused together through adaptive weighting to obtain the initial fused header features and load features; the initial fused header features and load features are fused together through adaptive weighting to obtain the final feature vector; the original traffic is classified according to the final feature vector. Further, the server 104 can feed back the encrypted traffic classification results to the terminal 102. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0075] In one embodiment, Figure 2 As shown, a method for classifying encrypted traffic is provided, and the method is applied to Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0076] S100: Preprocessing the original traffic to obtain a session image of a data packet header and a session image of a payload.

[0077] Preprocessing is the initial stage of data processing, which aims to prepare the data for subsequent analysis. This step converts the raw traffic data into a visual session image format to facilitate feature extraction. The packet header contains important information about the packet, such as source address, destination address, port number, protocol type, etc. This information is usually used to generate session images, reflecting the basic properties of the traffic. The payload is the actual data content of the packet, which is encrypted for encrypted traffic. Nevertheless, certain statistical characteristics of the payload (such as length, frequency distribution, etc.) can still be used to generate session images. Here, image processing techniques such as grayscale and normalization can be used to convert the raw packet data into image form.

[0078] S200: extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload.

[0079] Extract features that can describe the characteristics of the packet header and payload from the session image. These features include global features and spatiotemporal features. Extracting global features specifically refers to extracting statistical characteristics that describe the entire session or packet, such as packet size, session duration, protocol type, etc. Extracting spatiotemporal features specifically refers to extracting characteristics that describe the time-varying changes in packet arrival time, size, etc. These features can reflect the dynamic behavior of traffic. Specifically, the two session images can be simultaneously input into the PVT (packet converter) and the STFE (spatiotemporal feature extraction module) to extract global features and spatiotemporal features.

[0080] S300: The global features of the head and the load are fused with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features.

[0081] The extracted global features of the head and load are fused with the spatiotemporal features through adaptive weighting to form the initial fused head features and load features. Here, the weights of the features are automatically adjusted according to their importance, which can be achieved through machine learning algorithms (such as weighted summation, linear regression, etc.). The weighted head features and load features are merged to form the initial fused features.

[0082] S400: The initially fused head features and load features are fused together through adaptive weighting to obtain a final feature vector.

[0083] The initially fused head features and load features are fused together again through adaptive weighting to obtain the final feature vector, and the weights of the initially fused head features and load features are further adjusted to optimize the representation capability of the feature vector, and the weighted features are merged into a final feature vector for subsequent traffic classification. In simple terms, the global features and spatiotemporal features of the head and load are fused together through adaptive weighting, and then the fused head features and load features are fused together through adaptive weighting to obtain the final feature vector.

[0084] S500: Classify the original traffic according to the final feature vector.

[0085] The feature vector can be input to a linear layer for classification. The linear layer (also called a fully connected layer or dense layer) is one of the most basic components of a neural network. It accepts an input vector and produces an output through a linear transformation (i.e. multiplying it by a weight matrix and adding a bias vector). In this encrypted traffic classification task, a linear layer will be used to map the final feature vector to the classification label. The final feature vector is used as the input of the linear layer. This input vector will be multiplied by the weight matrix of the linear layer and the bias vector will be added to produce the output.

[0086] The above encrypted traffic classification method preprocesses the original traffic to obtain the session image of the data packet header and the session image of the payload respectively; extracts the global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload; fuses the global features and spatiotemporal features of the header and the payload together through adaptive weighting to obtain the initial fused header features and load features; fuses the initial fused header features and load features together through adaptive weighting to obtain the final feature vector; and classifies the original traffic according to the final feature vector. In the whole process, the data packet header and the payload are characterized independently, and then the extracted features are weighted and fused, fully considering the situation in actual applications that the same byte value has different meanings in the header and the payload, so that accurate encrypted traffic classification can be achieved.

[0087] In one embodiment, if Figure 3 As shown, S100 includes:

[0088] S120: Divide the original traffic into network sessions.

[0089] The continuous raw traffic data is divided into independent network sessions, each of which contains a series of related data packets. Specifically, the raw traffic data can be divided into different network sessions according to specific rules (such as source address, destination address, port number, protocol type, etc.), and each session contains a set of data packets from a certain starting point to a certain end point, and these data packets are logically related.

[0090] S140: Filter invalid traffic in the network session to obtain a filtered network session.

[0091] The filtering itself carries less effective information, which is not conducive to the model's extraction and learning of specific business features of this type of traffic. Specifically, here we remove useless or redundant data packets in the network session to improve the efficiency and accuracy of subsequent processing. Specifically, we can filter out invalid data packets that do not meet the requirements according to certain standards (such as data packet size, protocol type, timestamp, etc.), retain those data packets that are useful for network session analysis, and form a filtered network session.

[0092] S160: Perform data enhancement on the data packets in the filtered network session using fixed step sampling.

[0093] Fixed step sampling is used to perform data enhancement on the packets in the session. Here, by sampling and data enhancement of the packets, the robustness of subsequent feature extraction and classification is improved. Specifically, a fixed step sampling method can be used to select packets from the filtered network session for sampling. The sampled packets are subjected to data enhancement processing, such as adding noise, rotating, scaling, etc., to increase the diversity and richness of the data.

[0094] S180: Convert the header and payload of each enhanced data packet into session grayscale images respectively.

[0095] After data packet enhancement, the payload and header of each data packet are converted into session grayscale images. Specifically, the header and payload of each enhanced data packet are converted into grayscale images so as to perform feature extraction using image processing technology.

[0096] In one embodiment, converting the header and the payload of each enhanced data packet into a session grayscale image includes:

[0097] Step 1: Obtain a session flow formed by enhanced data packets, extract n preset data packets in the session flow, and obtain a target data packet.

[0098] Step 2: For each data packet in the target data packet, extract the preset t bytes before the payload and the preset h bytes before the packet header.

[0099] For a given session stream SSession, extract the first t bytes of the payload for each of the n packets, and extract the first h bytes of the header. If the length exceeds t and h bytes, it will be truncated. Otherwise, it will be padded with 0x00. Similarly, if the number of packets is less than n, the number of packets will be padded to n.

[0100] Step 3: Read each packet extracted bytes byte by byte, convert each byte to an integer, and convert each integer to packet image.

[0101] Read each packet byte by byte, convert each byte to an integer, and convert each integer to a packet image, denoted as P i .

[0102] Step 4: Merge the head feature and payload image into the head session image and payload image respectively.

[0103] The header image and the payload image are merged into the header session image and the payload session image respectively. The subsequent processing of the header and the payload is the same and independent.

[0104] In one embodiment, extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload includes:

[0105] The session image of the packet header and the session image of the payload are simultaneously input into PVT and STFE to extract the global features and spatiotemporal features of the header and payload.

[0106] The PVT model is used to extract global features from the input image. Its specific structure is as follows: Figure 4 As shown. Global features refer to those that can describe the overall characteristics of the entire image or packet session, such as average packet size, session duration, protocol type distribution, etc. The PVT model receives the packet header session image and payload session image at the same time as the input, and the PVT model outputs the global feature vector of the header and the payload. The STFE model focuses on extracting spatiotemporal features from the input image. Spatiotemporal features refer to those that can describe the characteristics of data in a packet or image that change over time, such as the arrival time interval of packets, the burstiness of data traffic, etc.

[0107] In one embodiment, the session image of the packet header and the session image of the payload are simultaneously input into the PVT, and the global features of the header and the payload are extracted, including:

[0108] Step 1: Decompose the session image of the data packet header and the session image of the payload into a series of multiple packet images, project each packet image into the d-dimensional space through a convolution operation, and obtain the packet embedding of each data packet.

[0109] Decompose the session image of the packet header and the session image of the payload into a series of multiple packet images, project each packet image into a d-dimensional space through a convolution operation, and obtain the packet embedding of each data packet

[0110] Step 2: Embed the position of each data packet through position encoding to obtain position embedding.

[0111] The position of each data packet is embedded through position encoding to obtain position embedding The position encoding formula is as follows:

[0112]

[0113] Where j represents the jth dimension of the position embedding, pos i Indicates the position of the i-th data packet in the session flow.

[0114] Step 3: Convert the length of each packet into a one-hot vector and generate the length embedding using a linear layer.

[0115] Convert the length of each packet to a one-hot vector and then use a linear layer to generate the length embedding

[0116] Step 4: Add the packet embedding, position embedding, and length embedding of each packet to get the final embedding of each packet.

[0117] Embed each package's package into e i , position embedding p i and length embedding l i Add together to get the final embedding for each bag

[0118] h i =e i +p i +l i , i=1,2,...,n.

[0119] Step 5: Add a learnable embedding at the beginning of the final embedding to characterize the global features of the session, and get the packet header and payload after the session input embedding layer.

[0120] Add a learnable embedding to the beginning of these embeddings To represent the global characteristics of the session. The packet header and payload output after the session input embedding layer are as follows:

[0121] E s =[V s ;h1;h2;...;h n ].

[0122] Step 6: Input the packet header and payload after the session input embedding layer into PVT to obtain the global features of the header and payload of each data packet.

[0123] Embed the added header into E s_h and payload embedded in E s_t At the same time, they are input into PVT (Packet Translator) to obtain their respective global features.

[0124] In one embodiment, the packet header and payload after the session input embedding layer are input into the PVT, and the global features of the header and payload of each data packet are obtained, including:

[0125] Step 1: The attention score function of the KBS module is calculated for the final embedding of each data packet to obtain the sum of the weights at each byte position.

[0126] For each packet embedding, the attention score function of the KBS module calculates the sum of the weights at each byte position.

[0127] Step 2: Select the N byte positions with the largest sum of weights and determine them as the keybyte_pos template. The byte position is determined as keybyte_pos as the optimization template:

[0128] The attention score function is as follows:

[0129]

[0130] Where b represents the number of packet bytes intercepted in the header and payload, Q and K are learnable matrices in the attention mechanism, and a i，j are the elements in the matrix A.

[0131] Step 3: Optimize the input header and payload after the input embedding layer according to the keybyte_pos template to obtain the optimized input vector.

[0132] The input vector obtained in the previous step is optimized through the keybyte_pos template.

[0133] Step 4: The optimized input vector is normalized by the layer and then input into the Fourier transform module of PVT. The optimized input is normalized by the layer and then input into the Fourier transform module of PVT to obtain the output.

[0134] The Fourier transform module formula is as follows:

[0135]

[0136] in is the input optimized by KBS, E byte is a trainable weight vector, Is the new package embedded The elements in is the new package representation extracted from the Fourier transform module, F emb is a one-dimensional discrete Fourier transform (DFT) for embedding dimension d, F inp is used for model input dimension DFT, is the rotation factor, Represents a real number.

[0137] Step 5: The output of the Fourier transform module is processed through a residual connection and a fully connected layer with a LeakyRELU activation function to obtain the output sequence OL.

[0138] The output of the previous step is processed through a residual connection and a fully connected layer with a LeakyRELU activation function to obtain the output sequence OL.

[0139] Step 6: Extract the first vector from the sequence OL as the global feature of the packet header and payload.

[0140] The first vector is extracted from the output sequence OL of the last layer of the PVT encoder through multiple sub-modules including parameter-free Fourier transform modules and fully connected layers to obtain the global features of the header and payload.

[0141] In one embodiment, the session image of the data packet header and the session image of the payload are simultaneously input into the STFE, and the spatiotemporal features of the header and the payload are extracted, including:

[0142] The session image of the packet header and the session image of the payload are input into the ResAtConv layer containing the convolution layer and the attention layer to obtain the spatial features with temporal features; the spatial features with temporal features are input into the bidirectional long short-term memory network to capture the spatiotemporal features of the header and payload.

[0143] First, the packet header and payload are converted into session images respectively. This conversion may involve mapping the binary representation or other forms of information of the packet into the image space so as to extract features using convolutional neural networks. Specifically, the ResAtConv layer includes a convolutional layer and an attention layer. The convolutional layer extracts the spatial features of the image by applying multiple convolution kernels. These features may include edges, textures, and shapes, which are crucial for understanding the structure and content of the packet. After the convolutional layer, the introduction of the attention mechanism can help the model focus on more important areas in the image. This is achieved by calculating the weight of each position. Positions with higher weights represent features that are more important for the final decision. Combining the convolutional layer and the attention layer, the ResAtConv layer is able to output spatial features with temporal features. The "temporal features" here may refer to the position or order information of the packet in the session. Although this information may not be so direct in the image representation, the attention mechanism may help capture this implicit temporal information.

[0144] The spatial features with temporal features output by the ResAtConv layer are fed into a Bi-LSTM network (Bidirectional Long Short-Term Memory). Bi-LSTM is a variant of a Recurrent Neural Network (RNN) that is able to capture long-term dependencies in sequence data. In this context, Bi-LSTM is able to capture the spatiotemporal features of both the packet header and payload by taking into account the contextual information of both. This means that the model not only focuses on individual packets, but also on the position of packets in a session and their relationship with other packets. By combining the ResAtConv layer and Bi-LSTM, the model is able to extract complex spatiotemporal features of the packet header and payload. These features can then be used for various tasks such as packet classification, anomaly detection, or communication pattern analysis.

[0145] In short, the session images of the packet header and payload are input into the ResAtConv layer containing convolutional layers and attention layers to extract high-level spatial features of each data packet and solve the problem of temporal information confusion when convolving the entire session image. These spatial features with temporal features are input into the Bi-LSTM to further capture the spatiotemporal features of the session.

[0146] In one specific application example, Figure 5 As shown, the encrypted traffic classification method of the present application includes the following steps:

[0147] 1) Preprocess the traffic to obtain two session images of the data packet header and payload respectively.

[0148] 2) Both session images are simultaneously input into the PVT (Packet Translator) and STFE modules to extract global features and spatiotemporal features.

[0149] 3) The global features and spatiotemporal features of the head and the load are fused together through adaptive weighting, and then the melted head features and load features are fused together through adaptive weighting to obtain the final feature vector.

[0150] 4) Input the final feature vector into the linear layer for classification.

[0151] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0152] Based on the same inventive concept, the embodiment of the present application also provides an encrypted traffic classification device for implementing the encrypted traffic classification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the encrypted traffic classification device provided below can refer to the limitations of the encrypted traffic classification method above, and will not be repeated here.

[0153] In one embodiment, Figure 6 As shown, an encrypted traffic classification device is provided, comprising:

[0154] The preprocessing module 100 is used to preprocess the original traffic to obtain a session image of the data packet header and a session image of the payload;

[0155] The feature extraction module 200 is used to extract the global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload;

[0156] The first fusion module 300 is used to fuse the global features of the head and the load with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features;

[0157] The second fusion module 400 is used to fuse the initially fused head features and load features together through adaptive weighting to obtain a final feature vector;

[0158] The classification module 500 is used to classify the original traffic according to the final feature vector.

[0159] In one of the embodiments, the preprocessing module 100 is also used to divide the original traffic into network sessions; filter invalid traffic in the network sessions to obtain filtered network sessions; use fixed step sampling to perform data enhancement on the data packets in the filtered network sessions; and convert the header and payload of each enhanced data packet into session grayscale images respectively.

[0160] In one of the embodiments, the preprocessing module 100 is also used to obtain a session flow formed by enhanced data packets, extract n preset data packets in the session flow, and obtain a target data packet; extract t bytes preset before the payload and h bytes preset before the header for each data packet in the target data packet; read the bytes extracted from each data packet byte by byte, convert each byte into an integer, and convert each integer into a data packet image; merge the header features and the payload image into a header session image and a payload image, respectively.

[0161] In one of the embodiments, the feature extraction module 200 is further used to input the session image of the data packet header and the session image of the payload into the PVT and STFE simultaneously, and extract the global features and spatiotemporal features of the header and the payload.

[0162] In one embodiment, the feature extraction module 200 is further used to decompose the session image of the data packet header and the session image of the payload into a series of multiple packet images, respectively, and project each packet image into a d-dimensional space through a convolution operation to obtain a packet embedding of each data packet; embed the position of each data packet through position encoding to obtain a position embedding; convert the length of each data packet into a single hot vector, and use a linear layer to generate a length embedding; add the packet embedding, position embedding and length embedding of each data packet to obtain a final embedding of each data packet; add a learnable embedding at the beginning of the final embedding to characterize the global features of the session, and obtain the header and payload after the session input embedding layer; input the header and payload after the session input embedding layer into the PVT to obtain the global features of the header and load of each data packet.

[0163] In one of the embodiments, the feature extraction module 200 is also used to perform the attention score function calculation of the KBS module on the final embedding of each data packet to obtain the sum of the weights at each byte position; screen the N byte positions with the largest sum of weights and determine them as the keybyte_pos template; optimize the input of the packet header and the payload after the input embedding layer according to the keybyte_pos template to obtain an optimized input vector; input the optimized input vector into the Fourier transform module of PVT after layer normalization; process the output of the Fourier transform module through a residual connection and a fully connected layer with a LeakyRELU activation function to obtain an output sequence OL; extract the first vector from the sequence OL as the global feature of the header and payload of the data packet.

[0164] In one of the embodiments, the feature extraction module 200 is further used to input the session image of the data packet header and the session image of the payload into a ResAtConv layer including a convolutional layer and an attention layer to obtain spatial features with temporal features; and input the spatial features with temporal features into a bidirectional long short-term memory network to capture the spatiotemporal features of the header and the payload.

[0165] Each module in the above encrypted traffic classification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0166] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store preset data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an encrypted traffic classification method is implemented.

[0167] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0168] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above-mentioned encrypted traffic classification method when executing the computer program.

[0169] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned encrypted traffic classification method is implemented.

[0170] In one embodiment, a computer program product is provided, comprising a computer program, which implements the above-mentioned encrypted traffic classification method when executed by a processor.

[0171] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0172] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited thereto.

[0173] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0174] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for classifying encrypted traffic, characterized in that: The method comprises: Preprocess the original traffic to obtain the session image of the data packet header and the session image of the payload respectively; Extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload; The global features of the head and the load are fused with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features; The initially fused head features and load features are fused together by adaptive weighting to obtain a final feature vector; The original traffic is classified according to the final feature vector.

2. The method according to claim 1, characterized in that: The preprocessing of the original traffic to obtain the session image of the data packet header and the session image of the payload respectively includes: Divide raw traffic into network sessions; Filtering invalid traffic in the network session to obtain a filtered network session; Performing data enhancement on the data packets in the filtered network session by using fixed step sampling; The header and payload of each enhanced packet are converted into session grayscale images respectively.

3. The method according to claim 2, characterized in that The step of converting the header and the payload of each enhanced data packet into a session grayscale image comprises: Acquire a session flow formed by the enhanced data packets, extract n preset data packets from the session flow, and obtain a target data packet; Extracting respectively the preset t bytes before the payload and the preset h bytes before the packet header from each data packet in the target data packet; Read each packet extracted bytes byte by byte, convert each byte to an integer, and convert each integer to a packet image; The head features and payload images are merged into head session image and payload image respectively.

4. The method according to claim 1, characterized in that Extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload includes: The session image of the data packet header and the session image of the payload are simultaneously input into PVT and STFE to extract the global features and spatiotemporal features of the header and the payload.

5. The method according to claim 4, characterized in that The session image of the packet header and the session image of the payload are simultaneously input into PVT, and the global features of the header and the payload are extracted, including: Decomposing the session image of the data packet header and the session image of the payload into a series of multiple packet images respectively, projecting each packet image into a d-dimensional space through a convolution operation, and obtaining a packet embedding of each data packet; The position of each data packet is embedded through position encoding to obtain position embedding; Convert the length of each packet into a one-hot vector and use a linear layer to generate a length embedding; Add the packet embedding, position embedding, and length embedding of each packet to get the final embedding for each packet; Adding a learnable embedding to characterize the global features of the session at the beginning of the final embedding to obtain a packet header and a payload after the session input embedding layer; The packet header and the effective load after the session input embedding layer are input into the PVT to obtain the global characteristics of the header and the load of each data packet.

6. The method according to claim 5, characterized in that The packet header and the payload after the session input embedding layer are input into the PVT to obtain the global features of the header and the payload of each data packet, including: Performing the attention score function calculation of the KBS module on the final embedding of each data packet to obtain the sum of the weights at each byte position; Filter the N byte positions with the largest sum of weights and determine them as the keybyte_pos template; Optimize the input header and the payload after the input embedding layer according to the keybyte_pos template to obtain an optimized input vector; The optimized input vector is input into the Fourier transform module of PVT after layer normalization; The output of the Fourier transform module is processed through a residual connection and a fully connected layer with a LeakyRELU activation function to obtain the output sequence OL; The first vector is extracted from the sequence OL as the global feature of the header and payload of the data packet.

7. The method according to claim 4, characterized in that Inputting the session image of the data packet header and the session image of the payload into STFE at the same time, extracting the spatiotemporal features of the header and the payload includes: Inputting the session image of the data packet header and the session image of the payload into a ResAtConv layer including a convolution layer and an attention layer to obtain a spatial feature with a temporal feature; The spatial features with temporal features are input into a bidirectional long short-term memory network to capture the spatiotemporal features of the head and the payload.

8. An encrypted traffic classification device, characterized in that: The device comprises: A preprocessing module, used for preprocessing the original traffic to obtain a session image of a data packet header and a session image of a payload; A feature extraction module, used for extracting global features and spatiotemporal features of the header and the payload according to the session image of the data packet header and the session image of the payload; A first fusion module, used to fuse the global features of the head and the load with the spatiotemporal features through adaptive weighting to obtain initial fused head features and load features; A second fusion module is used to fuse the initially fused head features and load features together through adaptive weighting to obtain a final feature vector; A classification module is used to classify the original traffic according to the final feature vector.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images