Malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning

Abstract

The invention discloses a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning, and the method comprises the steps: firstly, providing a malicious encrypted traffic multi-dimensional feature representation method based on a traffic behavior and a time sequence feature, deeply and fully learning the malicious encrypted traffic behavior and the time sequence feature, and achieving the automatic extraction of the traffic feature; secondly, prompt learning is introduced into the malicious encrypted traffic classification field and is combined with the BERT network, the BERT network fully learns the feature space of a data sample by constructing a proper prompt sample, the negative influence caused by training data imbalance is reduced, accurate detection of malicious encrypted traffic is realized, and the accuracy of malicious encrypted traffic classification is improved. And a technical support is provided for malicious encrypted traffic detection and classification.

Description

Technical Field

[0001] The present invention relates to the fields of malicious encrypted traffic detection, multi-dimensional traffic feature representation and prompt learning, and in particular to a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning. Background Art

[0002] With the continuous development of network communication technology, network traffic classification, as an important technology, has been widely used in fields such as network management, network optimization, and network security. However, the increasing popularity of encryption protocols makes it challenging to classify traffic using traditional packet inspection technology. Although encrypting network traffic using encryption protocols protects the confidentiality of data, it also increases the difficulty of classifying network traffic. Traditional security tools, such as intrusion detection systems and firewalls, identify threats by detecting the content of network traffic. However, traffic encryption technology makes the content of traffic impossible to detect, which may hide malicious activities, such as malicious applications or data leaks. Therefore, it is increasingly important to achieve encrypted traffic classification without decryption to maintain network security.

[0003] In recent years, researchers have proposed a variety of encrypted traffic classification methods, including statistical methods, machine learning algorithms, and deep learning algorithms. For ordinary traffic classification, the port number-based classification method relies on checking the port number of the data packet to determine the type of traffic it belongs to. The deep packet inspection traffic classifier uses the payload of the data packet to identify patterns or keywords in the data packet. The classic machine learning algorithm is used to build a traffic classification model. The machine learning algorithm uses network features for statistics to significantly improve the classification effect. After pre-processing the data set such as normalization, discretization, and nonlinear transformation, feature extraction is completed for classification, which can effectively identify various types of attacks. Deep learning does not need to rely on expert knowledge to manually select features. It has the ability to automatically select features and simplifies the traffic classification process, which makes it more flexible and applicable when dealing with traffic classification problems. Compared with traditional machine learning methods, deep learning models can learn complex nonlinear patterns and have better performance when dealing with high-dimensional and large-scale data.

[0004] The existing traffic classification technology has the following problems: First, the statistical method has the problem of difficulty and insufficiency in feature extraction, and cannot detect and classify encrypted traffic; second, although the machine learning algorithm for encrypted traffic detection has improved the detection and classification efficiency to a certain extent, the process is heavily dependent on professional knowledge and requires manual feature extraction, there is a problem of insufficient feature extraction and the method is not universal; finally, the use of deep learning models to classify encrypted traffic does not require expert knowledge and has the ability to automatically select features, but the imbalanced distribution of public encrypted traffic data sets seriously affects the model detection performance, resulting in low recall rate, high false alarm rate and reduced model generalization ability. In summary, there are currently two main problems with the encrypted traffic classification problem: 1. Difficulty in designing traffic features and insufficient extraction; 2. The public malicious encrypted traffic training data set has an unbalanced data distribution, which affects the detection performance of the deep learning model. Summary of the invention

[0005] In order to overcome the shortcomings and deficiencies of the prior art, the present invention provides a malicious encrypted traffic detection method based on multi-dimensional feature characterization and prompt learning.

[0006] The technical solution adopted by the present invention is a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning, the method comprising: Step S1: preprocess the malicious encrypted traffic data set, including data segmentation, data cleaning and standardization; Step S2: Using the preprocessed malicious encrypted traffic data set, the Ip2Vec algorithm is used to characterize the behavior characteristics based on the traffic feature quintuple; Step S3: Using the preprocessed malicious encrypted traffic data set, a two-layer Bi-LSTM neural network is used to characterize the time series characteristics of the malicious encrypted traffic based on the traffic packet level data; Step S4: The malicious encrypted traffic behavior obtained in steps S2 and S3 is concatenated with the time series features to obtain a joint representation vector of the malicious encrypted traffic, and the joint representation vector is used to construct a prompt sample based on the prompt learning strategy; Step S5: Shuffle the prompt samples processed in step S4 to construct a training set and send it to the embedding layer in the BERT network for processing to assist in constructing the input embedding result; Step S6: Use the input embedding sequence processed in step S5 to train the BERT classification network, fully learn the malicious encrypted traffic data samples, so that the training network can fully learn the feature space of the malicious encrypted traffic data samples, alleviate the impact of the imbalanced data set on the detection model, and improve the classification effect; Step S7: Process the malicious encrypted traffic data to be detected in the same way as training, input the processed N malicious encrypted traffic samples into the trained BERT network for detection, and realize classification of malicious encrypted traffic.

[0007] Furthermore, the step S1 comprises: Step S1.1: In the data segmentation stage, the original PACP file is segmented into individual flow data using the SplitCap tool, and the packet-level data of the same traffic feature quintuple is merged into one flow data; Step S1.2: After data segmentation in step S1.1, the data is cleaned to delete duplicate and invalid data in the extracted stream data to improve the quality of the data set; Step S1.3: After data cleaning in step S1.2, for a set of M malicious encrypted traffic data, extract each flow and process it into a standardized traffic feature quintuple to obtain a 5*1*M feature quintuple input matrix as the input for the characterization learning of the behavior features; Step S1.4: For the traffic data packet, the bit stream is divided according to the length of 8 bits, and the range of each byte is 0-255; Step S1.5: extract the first N packets of each flow in time order and merge them into one piece of data, retaining the time series characteristics of the traffic; Step S1.6: The length of each packet is L bytes, where L is 128. If the length of the packet is less than 128, it is padded with 0. Step S1.7: Since the first 8 data packets of the traffic usually contain complete handshake information, N is taken as 8. If the number of packets is less than 8, they are completed with data packets filled with 0X00 to obtain a 128*8*M byte sequence matrix as the input for the representation learning of timing features.

[0008] Furthermore, the characteristic quintuple includes: source IP address, destination IP address, source port, destination port, and protocol.

[0009] Furthermore, the step S2 comprises: Step S2.1: Ip2Vec extracts the contextual information of the IP address from the flow-based data and converts it into a real vector representation; Step S2.2: For a given traffic quintuple , targeting its maximum probability , the expression is:

[0010] in, represents the length of the input sequence, represents the probability, Represents the position of the word, k Represents the serial number of each unit in the sequence; Step S2.3: The prediction task is a multi-classification problem. The last layer of the classifier uses softmax for multiple classifications. The expression is:

[0011] in, is a five-tuple sequence of traffic, is the classification probability, For words The unnormalized log probability of For each word The unnormalized log probability of The expression is:

[0012] in, , is the softmax parameter, From the flow vector matrix The word vectors are either concatenated or averaged from the previous word vectors.

[0013] Furthermore, the step S3 comprises: Step S3.1: For the malicious encrypted traffic packet byte sequence ( ), N represents the number of packets, , the forward language model consisting of two layers of LSTM will calculate a data packet The maximum likelihood probability, using The previous set of packet sequences ( ) is calculated. For each malicious encrypted traffic data packet, each layer of LSTM outputs an intermediate word vector (j=1,2), the expression is:

[0014] Step S3.2: Using the reverse language model, as with the forward language model, each LSTM layer also outputs an intermediate word vector for each traffic packet. , the expression is:

[0015] Step S3.3: The temporal feature representation learning model integrates the forward language model and the reverse language model model, and jointly maximizes the log-likelihood function of the bidirectional model. The calculation method is:

[0016] in, is the syntax unit representation layer parameter, is the SoftMax layer parameter. Both parameters are shared by the previous and next language algorithms. The parameters of LSTM ( ) is unique to the layer LSTM, so the training process of the language model in the two directions is equivalent to being separate; Step S3.4: For each incoming malicious encrypted traffic Each layer of the Bi-LSTM network in the model will output two vectors with opposite directions. Indicates that the expression is:

[0017] in, is the static word embedding layer, = [ ]; Step S3.5: Normalize each LSTM layer application layer. Since different network layers of the model learn different information, calculate the weighted combination of the forward and reverse language model output vector representations. For downstream classification targets, all Layers are collapsed into a vector and used Representing this vector, the task-specific weight expression of the bidirectional language model layer is:

[0018] Among them, the global scaling factor is a scalar parameter that allows the task algorithm to scale the entire vector, Indicates the number of layers of the bidirectional language algorithm, represents the softmax normalized weight, indicating how much attention should be devoted to each layer, is a static word embedding layer; Furthermore, the step S4 comprises: Step S4.1: Concatenate the behavior and time series representation vectors into a joint representation vector. The concatenation expression is as follows:

[0019] in, Joint characterization vector for malicious encrypted traffic, Characterize the malicious encrypted traffic behavior vector. Characterize the timing characteristics of malicious encrypted traffic.

[0020] Step S4.2: In a dataset with N class labels and a size of M, for the single malicious encrypted traffic representation vector spliced ​​in step S4.1 and its corresponding category label , based on the prompt strategy, they are constructed into the form of "< >, [MASK]< >". The [MASK] flag is a binary value, with values ​​of "yes" and "no". Predicting the value of [MASK] is the training process.

[0021] Step S4.3: For the same characterization vector And other Category labels , using the same prompt strategy to construct other A sample of different prompts.

[0022] Step S4.4: Repeat steps S4.1 to S4.3 until all M representation vectors are constructed as prompt samples, converting the multi-label classification problem into multiple binary classification problems.

[0023] Furthermore, the step S5 comprises: Step S5.1: Shuffle the processed prompt samples to construct a training set and send it to the embedding layer of the BERT network. The embedding expression is as follows:

[0024] in is the combination of the results after three embeddings, which is used as the input embedding for BERT network training. For each word in the prompt sample, , and They represent token embedding, position embedding, and paragraph embedding respectively.

[0025] Step S5.2: The processed input sequence is represented as: "[CLS]<Malicious Encrypted Traffic Characterization Vector>[SEP][MASK]<Malicious Encrypted Traffic Category Label>[SEP]". Where [CLS] is a special classification token that corresponds to the last hidden state of BERT. The [SEP] token must be inserted at the end of a single input to help the BERT network understand the end of one input and the beginning of another in the same sequence of inputs.

[0026] Furthermore, the step S6 comprises: Step S6.1: embed the processed sequence Input into the BERT network for training.

[0027] Step S6.2: For the input embedding "[CLS]<Malicious Encrypted Traffic Characterization Vector>[SEP] [MASK]<Malicious Encrypted Traffic Category Label>[SEP]", since the multi-label classification problem has been converted into multiple binary classification problems through the construction of the prompt sample, a binary classifier is used to predict the value of [MASK] to determine whether the malicious encrypted traffic matches the category label.

[0028] Step S6.3: Since the constructed hint sample plays the role of negative sample in the classification process, the cross entropy function is used as the training target of the model, and the expression is:

[0029] in To predict the label result, Represents the amount of malicious encrypted traffic in the dataset, Represents the number of categories. represents the symbol function, if the sample The true category is equal to Takes 1, otherwise takes 0. It means the observed sample Belongs to category The predicted probability of .

[0030] Step S6.4: The model distinguishes the correct sample from N similar samples. By introducing prompt learning, the BERT network achieves an effect similar to contrastive learning during training. The larger N is, the more negative samples are involved in the training, and the more comprehensive the feature space learned by the model is. This reduces the probability of judging small sample class data as similar large sample class labels, and enhances the classification effect of the model.

[0031] Further, the step S7 comprises: Step S7.1: Use the trained model to detect and classify malicious encrypted traffic samples. Similar to the training process, N different prompt samples are constructed using the prompt strategy and sent to the embedding layer to generate the input embedding "[CLS]<Malicious encrypted traffic representation vector>[SEP] [MASK]<Malicious encrypted traffic category label>[SEP]".

[0032] Step S7.2: Input N repeated prompt samples into the trained BERT network. Since the multi-label classification problem is converted into multiple binary classification problems, the Sigmoid classifier is used for classification during the detection process. The predicted label of the sample is output according to the confidence. The confidence calculation expression is:

[0033] in represents the sigmoid function, is the sample input passed to the sigmoid function, which performs a weighted sum of the input features and the weights, and maps the result to a probability value between [0,1] through the Sigmoid function, where 0 represents the negative class and 1 represents the positive class, and interprets it as a probability distribution, which helps to effectively perform backward gradient propagation of parameter updates, and the output can be regarded as the probability associated with each label, thereby determining the final predicted label. The opposite confidence of the hint sample predicted as an error is equal to .

[0034] Step S7.3: Determine the classification of malicious encrypted traffic based on the prediction result (0, 1) interval value, and detect and classify malicious encrypted traffic.

[0035] Beneficial effects: The present invention proposes a malicious encrypted traffic detection method based on multi-dimensional feature characterization and prompt learning, introduces a malicious encrypted traffic data feature characterization method based on behavior and timing features, fully learns the behavior features and timing features of traffic data and realizes the automatic extraction of traffic features. Secondly, prompt learning is introduced into the field of malicious encrypted traffic classification, and by constructing appropriate prompt samples, the feature space of data samples is fully learned, the negative impact caused by the imbalance of training data is reduced, the classification accuracy of BERT network for malicious encrypted traffic is improved, and technical support is provided for the detection and classification of malicious encrypted traffic. The present invention uses the flow-level data and packet-level data of malicious encrypted traffic as data objects for characterization learning, fully extracts the behavior and timing features of malicious encrypted traffic, and introduces the idea of ​​prompt learning at the same time, proposes a malicious encrypted traffic classification method based on multi-dimensional traffic feature extraction and prompt learning, constructs prompt samples and performs BERT training, reduces the negative impact caused by the imbalance of training data, and improves the classification accuracy of the model for malicious encrypted traffic. The present invention has excellent performance in the accuracy, precision and recall rate of traffic feature extraction and classification, realizes effective response to the impact of data imbalance and can better realize malicious encrypted traffic identification and detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a general step flow chart of the present invention; Figure 2 This is a flow chart of step S1 of the present invention; Figure 3 This is a flow chart of step S2 of the present invention; Figure 4 This is a flow chart of step S4 of the present invention; Figure 5 This is a flow chart of steps S4 to S7 of the present invention. DETAILED DESCRIPTION

[0037] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application may be combined with each other. The present application is further described in detail below in conjunction with the drawings and specific embodiments.

[0038] This embodiment provides a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning, as shown in the attached Figure 1 As shown in the figure, this method realizes malicious encrypted traffic detection and classification through data processing, multi-dimensional traffic feature representation, prompt samples and model construction. The specific process is as follows: Step S1: preprocess the malicious encrypted traffic data set, including data segmentation, data cleaning and standardization; Step S2: Using the preprocessed malicious encrypted traffic data set, the Ip2Vec algorithm is used to characterize the behavior characteristics based on the traffic feature quintuple; Step S3: Using the preprocessed malicious encrypted traffic data set, a two-layer Bi-LSTM neural network is used to characterize the time series characteristics of the malicious encrypted traffic based on the traffic packet level data; Step S4: The malicious encrypted traffic behavior obtained in steps S2 and S3 is concatenated with the time series features to obtain a joint representation vector of the malicious encrypted traffic, and the joint representation vector is used to construct a prompt sample based on the prompt learning strategy; Step S5: Shuffle the prompt samples processed in step S4 to construct a training set and send it to the embedding layer in the BERT network for processing to assist in constructing the input embedding result; Step S6: Use the input embedding sequence processed in step S5 to train the BERT classification network, fully learn the malicious encrypted traffic data samples, so that the training network can fully learn the feature space of the malicious encrypted traffic data samples, alleviate the impact of the imbalanced data set on the detection model, and improve the classification effect; Step S7: Process the malicious encrypted traffic data to be detected in the same way as training, input the processed N malicious encrypted traffic samples into the trained BERT network for detection, and realize classification of malicious encrypted traffic.

[0039] like Figure 2 As shown in the figure, the preprocessing of malicious encrypted traffic data set mainly includes three steps: data segmentation, data cleaning and standardization. The specific steps are as follows: Step S1.1: In the data segmentation stage, the original PACP file is segmented into individual stream data using the SplitCap tool, and the packet-level data of the same traffic feature quintuple is merged into one stream data.

[0040] Step S1.2: After data segmentation in step S1.1, the data is cleaned and duplicate and invalid data in the extracted stream data is deleted to improve the quality of the data set.

[0041] Step S1.3: After data cleaning in step S1.2, for a set containing M malicious encrypted traffic data, each flow is extracted and processed into a standardized traffic feature quintuple (source IP address, destination IP address, source port, destination port, protocol), and a 5*1*M feature quintuple input matrix is ​​obtained as the input for the characterization learning of behavioral features.

[0042] Step S1.4: For the traffic data packet, the bit stream is divided according to the length of 8 bits, and the range of each byte is 0-255.

[0043] Step S1.5: Extract the first N packets of each flow in chronological order and merge them into one piece of data, preserving the timing characteristics of the traffic.

[0044] Step S1.6: The length of each packet is L bytes, where L is 128. If the length of the packet is less than 128, it is padded with 0.

[0045] Step S1.7: Since the first 8 data packets of the traffic usually contain complete handshake information, N is taken as 8. If the number of packets is less than 8, they are completed with data packets filled with 0X00 to obtain a 128*8*M byte sequence matrix as the input for the representation learning of timing features.

[0046] like Figure 3 As shown in the figure, the Ip2Vec algorithm is used to extract the real-valued vector representation of the IP address based on the context information of the traffic feature quintuple, and the malicious encrypted traffic behavior characteristics are characterized and learned. The specific steps are as follows: Step S2.1: Ip2Vec extracts the contextual information of IP addresses from flow-based data (traffic feature quintuples) and converts it into a real vector representation.

[0047] Step S2.2: For a given traffic quintuple , targeting its maximum probability , the expression is:

[0048] in, represents the length of the input sequence, represents the probability, Represents the position of the word and the ordinal number of each unit in the sequence.

[0049] Step S2.3: The prediction task is a multi-classification problem, so the last layer of the classifier uses softmax for multiple classification, expressed as:

[0050] in, is a five-tuple sequence of traffic, is the classification probability, For words The unnormalized log probability of For each word The unnormalized log probability of The expression is:

[0051] in, , is the softmax parameter, From the flow vector matrix The word vectors are either concatenated or averaged from the previous word vectors.

[0052] like Figure 4 As shown in the figure, the packet-level data of the traffic contains the time information between data packets and has strong timing characteristics. Therefore, the first 8 packets of each traffic are intercepted as the input object of representation learning, and are input into the two-layer Bi-LSTM model for representation learning. The specific steps are as follows: Step S3.1: For the malicious encrypted traffic packet byte sequence ( ), N represents the number of data packets, because the preprocessing stage takes the first 8 packets of traffic data, so The forward language model consisting of two layers of LSTM will calculate a data packet The maximum likelihood probability, which requires the use of The previous set of packet sequences ( ) is calculated. For each malicious encrypted traffic data packet, each layer of LSTM outputs an intermediate word vector (j=1,2), the expression is:

[0053] Step S3.2: Use the reverse language model. As with the forward language model, each LSTM layer also outputs an intermediate word vector for each traffic packet. , the expression is:

[0054] Step S3.3: The temporal feature representation learning model integrates the forward language model and the reverse language model, and jointly maximizes the log-likelihood function of the bidirectional model. The calculation method is:

[0055] in, is the syntax unit representation layer parameter, is the SoftMax layer parameter. Both parameters are shared by the previous and next language algorithms. The parameters of LSTM ( ) is unique to the layer LSTM, so the training process of the language model in the two directions is equivalent to being separate.

[0056] Step S3.4: For each incoming malicious encrypted traffic Each layer of the Bi-LSTM network in the model will output two vectors with opposite directions. Indicates that the expression is:

[0057] in, is the static word embedding layer, = [ ].

[0058] Step S3.5: Normalize each LSTM layer application layer. Since different network layers of the model learn different information, calculate the weighted combination of the forward and reverse language model output vector representations. For downstream classification targets, all Layers are collapsed into a vector and used Representing this vector, the task-specific weight expression of the bidirectional language model layer is:

[0059] Among them, the global scaling factor is a scalar parameter that allows the task algorithm to scale the entire vector, Indicates the number of layers of the bidirectional language algorithm, represents the softmax normalized weight, indicating how much attention should be devoted to each layer, It is a static word embedding layer.

[0060] like Figure 5 As shown in the figure, a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning includes four stages: prompt sample construction, embedding construction, model training, and malicious encrypted traffic detection. The specific steps are as follows: Step S4.1: Concatenate the behavior and time series representation vectors into a joint representation vector. The concatenation expression is as follows:

[0061] in, Joint characterization vector for malicious encrypted traffic, Characterize the malicious encrypted traffic behavior vector. Characterize the timing characteristics of malicious encrypted traffic.

[0062] Step S4.2: In a dataset with N class labels and a size of M, for the single malicious encrypted traffic representation vector spliced ​​in step S4.1 and its corresponding category label , based on the prompt strategy, they are constructed into the form of "< >, [MASK]< >". The [MASK] flag is a binary value, with values ​​of "yes" and "no". Predicting the value of [MASK] is the training process.

[0063] Step S4.3: For the same characterization vector And other Category labels , using the same prompt strategy to construct other Different prompt samples. The construction results are shown in the following table:

[0064] For example, for the representation vector "A530 B920...0X00" and its category label "Vawtrak", N different prompt samples are constructed. Among these N prompt samples, there is one positive sample and N-1 negative samples.

[0065] Step S4.4: Repeat steps S4.1 to S4.3 until all M representation vectors are constructed as prompt samples, converting the multi-label classification problem into multiple binary classification problems.

[0066] Step S5.1: Shuffle the processed prompt samples to construct a training set and send it to the embedding layer of the BERT network. The embedding expression is as follows:

[0067] in is the combination of the results after three embeddings, which is used as the input embedding for BERT network training. For each word in the prompt sample, , and They represent token embedding, position embedding, and paragraph embedding respectively.

[0068] Step S5.2: The processed input sequence is represented as: "[CLS]<Malicious Encrypted Traffic Characterization Vector>[SEP][MASK]<Malicious Encrypted Traffic Category Label>[SEP]". Where [CLS] is a special classification token that corresponds to the last hidden state of BERT. The [SEP] token must be inserted at the end of a single input to help the BERT network understand the end of one input and the beginning of another in the same sequence of inputs.

[0069] Step S6.1: embed the processed sequence Input into the BERT network for training.

[0070] Step S6.2: For the input embedding "[CLS]<Malicious Encrypted Traffic Characterization Vector>[SEP] [MASK]<Malicious Encrypted Traffic Category Label>[SEP]", since the multi-label classification problem has been converted into multiple binary classification problems through the construction of the prompt sample, a binary classifier is used to predict the value of [MASK] to determine whether the malicious encrypted traffic matches the category label.

[0071] Step S6.3: Since the constructed hint sample plays the role of negative sample in the classification process, the cross entropy function is used as the training target of the model, and the expression is:

[0072] in To predict the label result, Represents the amount of malicious encrypted traffic in the dataset, Represents the number of categories. represents the symbol function, if the sample The true category is equal to Takes 1, otherwise takes 0. It means the observed sample Belongs to category The predicted probability of .

[0073] Step S6.4: The model distinguishes the correct sample from N similar samples. By introducing prompt learning, the BERT network achieves an effect similar to contrastive learning during training. The larger N is, the more negative samples are involved in the training, and the more comprehensive the feature space learned by the model is. This reduces the probability of judging small sample class data as similar large sample class labels, and enhances the classification effect of the model.

[0074] Step S7.1: Use the trained model to detect and classify malicious encrypted traffic samples. Similar to the training process, N different prompt samples are constructed using the prompt strategy and sent to the embedding layer to generate the input embedding "[CLS]<Malicious encrypted traffic representation vector>[SEP] [MASK]<Malicious encrypted traffic category label>[SEP]".

[0075] Step S7.2: Input N repeated prompt samples into the trained BERT network. Since the multi-label classification problem is converted into multiple binary classification problems, the Sigmoid classifier is used for classification during the detection process. The predicted label of the sample is output according to the confidence. The confidence calculation expression is:

[0076] in represents the sigmoid function, is the sample input passed to the sigmoid function, which performs a weighted sum of the input features and the weights, and maps the result to a probability value between [0,1] through the Sigmoid function, where 0 represents the negative class and 1 represents the positive class, and interprets it as a probability distribution, which helps to effectively perform backward gradient propagation of parameter updates, and the output can be regarded as the probability associated with each label, thereby determining the final predicted label. The opposite confidence of the hint sample predicted as an error is equal to .

[0077] Step S7.3: Determine the classification of malicious encrypted traffic based on the prediction result (0, 1) interval value, and detect and classify malicious encrypted traffic.

[0078] Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various equivalent changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning, characterized by , the method comprises: Step S1: preprocess the malicious encrypted traffic data set, including data segmentation, data cleaning and standardization; Step S2: Using the preprocessed malicious encrypted traffic data set, the Ip2Vec algorithm is used to characterize the behavior characteristics based on the traffic feature quintuple; Step S3: Using the preprocessed malicious encrypted traffic data set, a two-layer Bi-LSTM neural network is used to characterize the time series characteristics of malicious encrypted traffic using traffic packet-level data; Step S4: The malicious encrypted traffic behavior obtained in steps S2 and S3 is concatenated with the time series features to obtain a joint representation vector of the malicious encrypted traffic, and the joint representation vector is used to construct a prompt sample based on the prompt learning strategy; Step S5: Shuffle the prompt samples processed in step S4 to construct a training set and send it to the embedding layer in the BERT network for processing to assist in constructing the input embedding result; Step S6: Use the input embedding sequence processed in step S5 to train the BERT classification network to learn malicious encrypted traffic data samples, so that the training network can fully learn the feature space of malicious encrypted traffic data samples to alleviate the impact of data set imbalance on the detection model and improve the classification effect; Step S7: Use the same processing method as training to process the traffic data to be detected, input the processed N malicious encrypted traffic samples into the trained BERT network for detection, and complete the classification of malicious encrypted traffic.

2. The method for detecting malicious encrypted traffic based on multi-dimensional feature representation and prompt learning as claimed in claim 1, characterized in that: The step S1 comprises: Step S1.1: In the data segmentation step, the original PACP file is segmented into individual flow data using the SplitCap tool, and the packet-level data of the same traffic feature quintuple is merged into one flow data; Step S1.2: After data segmentation in step S1.1, the data is cleaned to delete duplicate and invalid data in the extracted stream data to improve the quality of the data set; Step S1.3: After data cleaning in step S1.2, for a set of M malicious encrypted traffic data, extract each flow and process it into a standardized traffic feature quintuple to obtain a 5*1*M feature quintuple input matrix as the input for the characterization learning of the behavior features; Step S1.4: For the traffic data packet, the bit stream is divided according to the length of 8 bits, and the range of each byte is 0-255; Step S1.5: extract the first N packets of each flow in time order and merge them into one piece of data, retaining the time series characteristics of the traffic; Step S1.6: The length of each packet is L bytes, where L is 128. If the length of the packet is less than 128, it is padded with 0. Step S1.7: The first 8 data packets of the traffic contain complete handshake information. Take N as 8. If the number of packets is less than 8, use data packets filled with 0X00 to complete them, and obtain a 128*8*M byte sequence matrix as the input for the representation learning of timing features.

3. The method for detecting malicious encrypted traffic based on multi-dimensional feature representation and prompt learning as claimed in claim 1, characterized in that: The characteristic five-tuple includes: source IP address, target IP address, source port, target port, and protocol.

4. The method for detecting malicious encrypted traffic based on multi-dimensional feature representation and prompt learning as claimed in claim 1, characterized in that: The step S2 comprises: Step S2.1: Ip2Vec extracts the contextual information of the IP address from the flow-based data and converts it into a real vector representation; Step S2.2: For a given traffic quintuple , targeting its maximum probability , the expression is: in, represents the length of the input sequence, represents the probability, Represents the position of the word, k Represents the serial number of each unit in the sequence; Step S2.3: The prediction task is a multi-classification problem. The last layer of the classifier uses softmax for multiple classifications. The expression is: in, is a five-tuple sequence of traffic, is the classification probability, For words The unnormalized log probability of For each word The unnormalized log probability of , e represents a natural constant, The expression is: in, , is the softmax parameter, From the flow vector matrix The word vectors are the concatenation or average of the extracted word vectors.

5. The method for detecting malicious encrypted traffic based on multi-dimensional feature representation and prompt learning as claimed in claim 1, characterized in that: The step S3 comprises: Step S3.1: For the malicious encrypted traffic packet byte sequence ( ), N represents the number of packets, , the forward language model consisting of two layers of LSTM will calculate a data packet The maximum likelihood probability, using The previous set of packet sequences ( ) is calculated. For each malicious encrypted traffic data packet, each layer of LSTM outputs an intermediate word vector (j=1,2), the expression is: Step S3.2: Use the reverse language model. Similar to the forward language model, each LSTM layer will also output an intermediate word vector for each traffic packet. , the expression is: Step S3.3: The temporal feature representation learning model integrates the forward language model and the reverse language model, and jointly maximizes the log-likelihood function of the bidirectional model. The calculation method is: in, is the syntax unit representation layer parameter, is the SoftMax layer parameter. Both parameters are shared by the previous and next language algorithms. The parameters of LSTM ( ) is unique to layer LSTM, and the training process of the language model in the two directions is separate; Step S3.4: For each incoming malicious encrypted traffic Each layer of the Bi-LSTM network in the model will output two vectors with opposite directions. Indicates that the expression is: in, is the static word embedding layer, = [ ]; Step S3.5: Normalize each LSTM layer application layer. Since different network layers of the model learn different information, calculate the weighted combination of the forward and reverse language model output vector representations. For downstream classification targets, all Layers are collapsed into a vector and used Representing this vector, the task-specific weight expression of the bidirectional language model layer is: Among them, the global scaling factor is a scalar parameter that allows the task algorithm to scale the entire vector, Indicates the number of layers of the bidirectional language algorithm, represents the softmax normalized weight, indicating how much attention should be devoted to each layer, It is a static word embedding layer.

6. The method for detecting malicious encrypted traffic based on multi-dimensional feature representation and prompt learning as claimed in claim 1, characterized in that: The step S4 comprises: Step S4.1: Concatenate the behavior and time series representation vectors into a joint representation vector. The concatenation expression is as follows: in, Joint characterization vector for malicious encrypted traffic, Characterize the malicious encrypted traffic behavior characteristics vector, Characterize the time series characteristics of malicious encrypted traffic vectors; Step S4.2: In a dataset with N class labels and a size of M, for the single malicious encrypted traffic representation vector spliced ​​in step S4.1 and its corresponding category label , based on the prompt strategy, they are constructed as "< >, [MASK] < >” prompt sample, where the [MASK] flag is a binary value, with values ​​of "yes" and "no", and predicting the value of [MASK] is the training process; Step S4.3: For the same characterization vector And other Category labels , using the same prompt strategy to construct other different sample prompts; Step S4.4: Repeat steps S4.1 to S4.3 until all M representation vectors are constructed as prompt samples, converting the multi-label classification problem into multiple binary classification problems.

Images