Malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning

Abstract

The application discloses a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning, first, the method proposes a malicious encrypted traffic multi-dimensional feature representation method based on traffic behavior and timing characteristics, deeply and fully learns the malicious encrypted traffic behavior and timing characteristics, and realizes automatic extraction of traffic characteristics. Secondly, prompt learning is introduced into the field of malicious encrypted traffic classification, and is combined with the BERT network, appropriate prompt samples are constructed, the BERT network fully learns the feature space of the data samples, the negative influence brought by the unbalanced training data is reduced, and accurate detection of the malicious encrypted traffic is realized, thereby providing technical support for malicious encrypted traffic detection and classification.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of malicious encrypted traffic detection, multi-dimensional traffic feature representation and prompt learning, and particularly relates to a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning. BACKGROUND

[0002] With the continuous development of network communication technology, network traffic classification as an important technology is widely used in network management, network optimization and network security fields. However, the increasing popularity of encryption protocols makes it challenging to classify traffic using traditional packet detection techniques. Although encrypting network traffic using encryption protocols protects the confidentiality of data, it also increases the difficulty of network traffic classification. Traditional security tools, such as intrusion detection systems and firewalls, identify threats by detecting the content of network traffic. However, traffic encryption technology makes the content of traffic undetectable, which can hide malicious activities such as malicious applications or data breaches. Therefore, it is increasingly important to implement encrypted traffic classification without decryption to maintain network security.

[0003] In recent years, researchers have proposed various methods for encrypted traffic classification, including statistical methods, machine learning algorithms, and deep learning algorithms. For ordinary traffic classification, port number-based classification methods rely on checking the port number of a packet to determine its traffic type. Deep packet inspection traffic classifiers use the payload of a packet to identify patterns or keywords in the packet. Using classical machine learning algorithms to build a traffic classification model, the network features are used for statistical classification by machine learning algorithms, which can significantly improve the classification effect. After preprocessing such as normalization, discretization, and nonlinear transformation of the data set, feature extraction is completed for classification, which can effectively identify various attack types. Deep learning does not need to rely on expert knowledge to manually select features, and it has the ability to automatically select features, simplifying the traffic classification process, which makes it more flexible and applicable when dealing with traffic classification problems. Moreover, compared with traditional machine learning methods, deep learning models can learn complex nonlinear patterns and have better performance when dealing with high-dimensional and large-scale data.

[0004] Existing traffic classification technologies suffer from several problems: First, statistical methods face difficulties and inadequacies in feature extraction, making them unable to detect and classify encrypted traffic. Second, while machine learning algorithms improve detection and classification efficiency to some extent, they heavily rely on specialized knowledge and require manual feature extraction, resulting in insufficient feature extraction and a lack of universality. Finally, while deep learning models do not rely on expert knowledge and have the ability to automatically select features, the imbalanced distribution of publicly available encrypted traffic datasets severely impacts model detection performance, leading to low recall, high false positive rates, and decreased model generalization ability. In summary, current encrypted traffic classification primarily faces two problems: 1. Difficulty in designing traffic features and insufficient feature extraction; 2. Imbalanced distribution of publicly available malicious encrypted traffic training datasets, affecting the detection performance of deep learning models. Summary of the Invention

[0005] To overcome the shortcomings and deficiencies of existing technologies, this invention provides a method for detecting malicious encrypted traffic based on multidimensional feature representation and cue learning.

[0006] The technical solution adopted in this invention is a malicious encrypted traffic detection method based on multi-dimensional feature representation and cue learning, which includes:

[0007] Step S1: Perform data preprocessing on the malicious encrypted traffic dataset, including three steps: data segmentation, data cleaning, and standardization;

[0008] Step S2: Using the preprocessed malicious encrypted traffic dataset, the Ip2Vec algorithm is used to characterize behavioral features based on the traffic feature quintuple.

[0009] Step S3: Using the preprocessed malicious encrypted traffic dataset, a two-layer Bi-LSTM neural network is used to perform temporal feature representation of the malicious encrypted traffic based on the traffic packet-level data.

[0010] Step S4: Concatenate the malicious encrypted traffic behavior obtained in steps S2 and S3 with the temporal features to obtain a joint representation vector of malicious encrypted traffic, and use the joint representation vector to construct a prompt sample based on the prompt learning strategy;

[0011] Step S5: Shuffle the prompt samples processed in step S4 and construct a training set, which is then fed into the embedding layer of the BERT network for processing to assist in constructing the input embedding result;

[0012] Step S6: The BERT classification network is trained using the processed input embedding results of step S5, fully learning the malicious encrypted traffic data samples, making the trained network fully learn the malicious encrypted traffic data sample feature space, alleviating the influence of data set imbalance on the detection model, and improving the classification effect;

[0013] Step S7: The same processing method as training is used to process the malicious encrypted traffic data to be detected, and the processed N malicious encrypted traffic samples are input into the trained BERT network for detection, realizing classification of malicious encrypted traffic.

[0014] Further, the step S1 comprises:

[0015] Step S1.1: In the data splitting stage, the original PACP file is split into single stream data using the SplitCap tool, and the packet-level data of the same traffic feature five-tuple is merged into a stream data;

[0016] Step S1.2: After data splitting in step S1.1, the data is cleaned, and the repeated and invalid data in the extracted stream data is deleted to improve the quality of the data set;

[0017] Step S1.3: After data cleaning in step S1.2, for a set containing M malicious encrypted traffic data, each stream is extracted and processed into a standardized traffic feature five-tuple, obtaining a 5*1*M feature five-tuple input matrix as the input of behavior feature representation learning;

[0018] Step S1.4: For traffic data packets, the bit stream is divided according to the length of 8 bits, and the range of each byte is 0-255;

[0019] Step S1.5: The first N packets of each stream are extracted in time sequence and merged into a data, retaining the time sequence feature of the traffic;

[0020] Step S1.6: The length of each packet is L bytes, and L is 128. If the length of the packet is less than 128, 0 is used to complete it;

[0021] Step S1.7: Since the first 8 packets of traffic usually contain complete handshake information, N is taken as 8. If the number of packets is less than 8, 0X00 packets are used to complete it, obtaining a 128*8*M byte sequence matrix as the input of time sequence feature representation learning.

[0022] Further, the feature five-tuple comprises: source IP address, target IP address, source port, target port, and protocol.

[0023] Further, the step S2 comprises:

[0024] Step S2.1: Ip2Vec extracts the context information of IP addresses from flow-based data and converts it into a real number vector representation;

[0025] Step S2.2: For a given traffic five tuple , target its maximum probability , the expression is:

[0026]

[0027] wherein, denotes the length of the input sequence, represents the probability, represents the position of the word, k represents the serial number of each unit in the sequence;

[0028] Step S2.3: The task of prediction is a multi-classification problem, and the last layer of the classifier uses softmax for multi-classification, the expression is:

[0029]

[0030] wherein, is the traffic five tuple sequence, is the classification probability, is the non-standardized log probability of the word , is the non-standardized log probability of each word , the expression is:

[0031] wherein, , is the softmax parameter, is composed of the concatenation or average of the word vectors extracted from the traffic vector matrix .

[0032] Further, the step S3 comprises:

[0033] Step S3.1: For the malicious encrypted traffic packet byte sequence , N represents the number of packets, , the forward language model composed of two layers of LSTM will calculate the maximum likelihood probability of a certain packet , using the packet sequence set before , for each malicious encrypted traffic packet, each layer of LSTM outputs an intermediate word vector , j = 1, 2, the expression is:

[0034]

[0035] Step S3.2: Using the reverse language model, the same as the forward language model, each LSTM layer will also output an intermediate word vector on each traffic packet , the expression is:

[0036]

[0037] Step S3.3: The time series feature representation learning model integrates the forward language model and the reverse language model, and jointly maximizes the bidirectional model log-likelihood function, and the calculation method is:

[0038]

[0039] wherein, is the syntax unit representation layer parameter, is the SoftMax layer parameter, and the two parameters are shared in the forward and backward language algorithm, and the parameters of the LSTM are unique to the layer LSTM, so the training process of the language model in two directions is separate;

[0040] Step S3.4: For each input malicious encrypted traffic , the model will output two opposite vectors representing each layer of Bi-LSTM network, and the expression is:

[0041]

[0042] wherein, is the static word embedding layer, = [ ];

[0043] Step S3.5: Apply layer normalization to each LSTM layer, since the model learns different information at different network levels, calculate the weighted combination of the forward and reverse language model output vectors, and fold all layers into a vector, and use to represent the vector, and the task-specific weight expression of the bidirectional language model layer is:

[0044]

[0045] wherein, the global scaling factor is a scalar parameter that allows the task algorithm to scale the entire vector, represents the number of layers of the bidirectional language algorithm, denotes softmax normalized weights, denoting how much attention should be put on each layer, is a static word embedding layer;

[0046] Further, the step S4 comprises:

[0047] Step S4.1: Concatenate the behavior and timing two kinds of representation vectors into a joint representation vector, the concatenation expression is as follows:

[0048]

[0049] wherein, is a malicious encrypted traffic joint representation vector, is a malicious encrypted traffic behavior feature representation vector, is a malicious encrypted traffic timing feature representation vector.

[0050] Step S4.2: In a data set containing N kinds of class labels and having a size of M, for the single malicious encrypted traffic representation vector concatenated in step S4.1 and the class label corresponding thereto , based on the prompt strategy, they are constructed into a prompt sample in the form of “ >”, [MASK] >”. Wherein [MASK] mark is a binary value, taking values of “yes” and “no”, and the value of [MASK] is predicted in the training process.

[0051] Step S4.3: For the same representation vector and other class labels in the data set, use the same prompt strategy to construct other different prompt samples.

[0052] Step S4.4: Repeat steps S4.1-S4.3 until M representation vectors are all constructed into prompt samples, and the multi-label classification problem is converted into multiple binary classification problems.

[0053] Further, the step S5 comprises:

[0054] Step S5.1: After shuffling the processed prompt samples, construct a training set and send it to the embedding layer of the BERT network, the embedding expression is as follows:

[0055]

[0056] wherein is the result combination after three times of embedding, as the input embedding of BERT network training, is each word in the prompt sample, 、 and denote token embedding, position embedding, paragraph embedding, respectively.

[0057] Step S5.2: The processed input sequence is represented as: “[CLS]<malicious encrypted traffic feature vector>[SEP][MASK]<malicious encrypted traffic category label>[SEP]”. Where [CLS] is a special classification token, the token corresponds to the last hidden state of BERT. [SEP] token must be inserted at the end of a single input, help BERT network understand the end of one input and the beginning of another input in the same sequence input.

[0058] Further, the step S6 comprises:

[0059] Step S6.1: The processed embedding result is input into the BERT network for training.

[0060] Step S6.2: For the input embedding “[CLS]<malicious encrypted traffic feature vector>[SEP][MASK]<malicious encrypted traffic category label>[SEP]”, since the multi-label classification problem has been converted into multiple binary classification problems through the construction of the prompt sample, a binary classifier is used to predict the value of [MASK], so as to judge whether the malicious encrypted traffic matches the category label.

[0061] Step S6.3: Since the constructed prompt sample plays the role of negative sample in the classification process, the cross-entropy function is used as the training target of the model, and the expression is:

[0062]

[0063] where is the predicted label result, represents the number of malicious encrypted traffic in the data set, represents the number of categories. represents the symbol function, if the real category of the sample is equal to , it takes 1, otherwise it takes 0. then represents the predicted probability that the observed sample belongs to the category .

[0064] Step S6.4: The model distinguishes the correct sample from N similar samples, and by introducing prompt learning, the BERT network achieves a similar effect to contrast learning during training. The larger N is, the more negative samples participate in training, and the more comprehensive the feature space learned by the model. In turn, it reduces the probability of judging small sample class data as similar to large sample class labels, enhancing the classification effect of the model.

[0065] Further, the step S7 comprises:

[0066] Step S7.1: Detect and classify malicious encrypted traffic samples using the trained model. Similar to the training process, use the prompt strategy to construct N different prompt samples and send them to the embedding layer, and generate the input embedding "[CLS]<malicious encrypted traffic feature vector>[SEP] [MASK]<malicious encrypted traffic class label>[SEP]".

[0067] Step S7.2: Input N repeated prompt samples into the trained BERT network. Since the multi-label classification problem is converted into multiple binary classification problems, use the Sigmoid classifier for classification during detection, and output the predicted label for the sample according to the confidence, the confidence calculation expression is:

[0068]

[0069] where represents the sigmoid function, is the sample input passed to the sigmoid function, which weights the input features and weights, and maps the result to a probability value between [0, 1] through the Sigmoid function, where 0 represents the negative class and 1 represents the positive class, and it is interpreted as a probability distribution, which helps to effectively perform backward gradient propagation of parameter updates, and the output can be considered as the probability related to each label, and then determine the final predicted label. The opposite confidence of the prompt sample predicted as an error is equal to .

[0070] Step S7.3: Determine the malicious encrypted traffic classification according to the interval value of the prediction result (0, 1), and realize the detection and classification of malicious encrypted traffic.

[0071] Beneficial effects:

[0072] The application proposes a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning, introduces a malicious encrypted traffic data feature representation method based on behavior and timing characteristics, fully learns the behavior characteristics and timing characteristics of traffic data and realizes the automatic extraction of traffic characteristics. Secondly, prompt learning is introduced into the field of malicious encrypted traffic classification, the feature space of the data sample is fully learned by constructing appropriate prompt samples, the negative effects caused by the imbalance of training data are reduced, and the classification accuracy of the BERT network for malicious encrypted traffic is improved, which provides technical support for malicious encrypted traffic detection and classification. The application uses flow-level data and packet-level data of malicious encrypted traffic as data objects for representation learning, fully extracts the behavior and timing characteristics of malicious encrypted traffic, introduces the prompt learning idea, proposes a malicious encrypted traffic classification method based on multi-dimensional traffic feature extraction and prompt learning, constructs prompt samples and performs BERT training, reduces the negative effects caused by the imbalance of training data, and improves the classification accuracy of the model for malicious encrypted traffic. The application has excellent performance in traffic feature extraction classification accuracy, precision and recall rate, effectively copes with the effects caused by data imbalance, and can better realize malicious encrypted traffic identification and detection. BRIEF DESCRIPTION OF DRAWINGS

[0073] Figure 1 is a general step flowchart of the application;

[0074] Figure 2 is a step S1 step flowchart of the application;

[0075] Figure 3 is a step S2 step flowchart of the application;

[0076] Figure 4 is a step S4 step flowchart of the application;

[0077] Figure 5 is a step S4-S7 flowchart of the application. DETAILED DESCRIPTION

[0078] It should be noted that the embodiments and features in the embodiments in the present application can be combined with each other without conflict, and the present application will be further described in detail below in combination with the drawings and specific embodiments.

[0079] The present embodiment provides a malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning, as shown in the accompanying Figure 1 The method realizes malicious encrypted traffic detection and classification through data processing, multi-dimensional traffic feature representation, prompt sample and model construction, and the specific process is as follows:

[0080] Step S1: data preprocessing of malicious encrypted traffic dataset, including data segmentation, data cleaning and standardization three steps;

[0081] Step S2: using the preprocessed malicious encrypted traffic dataset, using Ip2Vec algorithm, based on the five-tuple of traffic characteristics to represent the behavior characteristics;

[0082] Step S3: using the preprocessed malicious encrypted traffic dataset, using double Bi-LSTM neural network, based on the traffic packet level data to represent the timing characteristics of the malicious encrypted traffic;

[0083] Step S4: splice the behavior and timing characteristics of the malicious encrypted traffic obtained in steps S2 and S3 to obtain the joint representation vector of the malicious encrypted traffic, and use the joint representation vector to construct prompt samples based on the prompt learning strategy;

[0084] Step S5: shuffle the prompt samples processed in step S4 and construct a training set to send to the embedding layer of the BERT network for processing, and assist in constructing the input embedding result;

[0085] Step S6: use the input embedding result processed in step S5 to train the BERT classification network, fully learn the malicious encrypted traffic data samples, make the trained network fully learn the feature space of the malicious encrypted traffic data samples, alleviate the influence of data set imbalance on the detection model, and improve the classification effect;

[0086] Step S7: use the same processing method as training to process the malicious encrypted traffic data to be detected, input the processed N malicious encrypted traffic samples into the trained BERT network for detection, and realize the classification of malicious encrypted traffic.

[0087] As shown in Figure 2 , the preprocessing of the malicious encrypted traffic dataset mainly includes three steps of data segmentation, data cleaning and standardization, and the specific steps are as follows:

[0088] Step S1.1: in the data segmentation stage, use SplitCap tool to cut the original PACP file into single stream data, and merge the packet level data with the same five-tuple of traffic characteristics into a stream data.

[0089] Step S1.2: after data segmentation in step S1.1, clean the data, delete the repeated and invalid data in the extracted stream data, and improve the quality of the data set.

[0090] Step S1.3: After data cleaning in step S1.2, for a set containing M pieces of malicious encrypted traffic data, each flow is extracted and processed into a standardized traffic feature five-tuple (source IP address, destination IP address, source port, destination port, protocol), obtaining a 5*1*M feature five-tuple input matrix as the input of the behavior feature representation learning.

[0091] Step S1.4: For the traffic data packet, the bit stream is divided according to the length of 8 bits, and the range of each byte is 0-255.

[0092] Step S1.5: The first N packets of each flow are extracted in time sequence and combined into one piece of data, retaining the timing characteristics of the traffic.

[0093] Step S1.6: The length of each packet is L bytes, and L is 128. If the length of the packet is less than 128, 0 is used to complete it.

[0094] Step S1.7: Since the first 8 packets of traffic usually contain complete handshake information, N is taken as 8. If the number of packets is less than 8, the packet is completed by using 0X00 padding data, obtaining a 128*8*M byte sequence matrix as the input of the timing feature representation learning.

[0095] As shown in Figure 3 , the real-valued vector representation of the IP address is extracted based on the context information of the traffic feature five-tuple using the Ip2Vec algorithm to represent the behavior features of the malicious encrypted traffic, and the specific steps are as follows:

[0096] Step S2.1: Ip2Vec extracts the context information of the IP address from the flow-based data (traffic feature five-tuple) and converts it into a real number vector representation.

[0097] Step S2.2: For a given traffic five-tuple , the maximum probability is targeted, and the expression is:

[0098]

[0099] wherein, represents the length of the input sequence, represents the probability, represents the position of the word, and represents the serial number of each unit in the sequence.

[0100] Step S2.3: The prediction task is a multi-classification problem, so the last layer of the classifier uses softmax for multi-classification, and the expression is:

[0101]

[0102] where, is the flow five-tuple sequence, is the classification probability, is the non-normalized log probability of a word , is the non-normalized log probability of each word , The expression is:

[0103] where, , is the softmax parameter, is composed of the concatenation or average of word vectors extracted from the flow vector matrix .

[0104] As shown in Figure 4 , the packet-level data of the flow contains time information between packets, and has strong time sequence characteristics, so the first 8 packets of each flow are intercepted as the input object of representation learning, and are input into the double-layer Bi-LSTM model for representation learning, and the specific steps are as follows:

[0105] Step S3.1: For the malicious encrypted flow packet byte sequence (N represents the number of packets, because the first 8 packets of the flow data are taken in the preprocessing stage, so . The forward language model composed of two layers of LSTM will calculate the maximum likelihood probability of a certain packet , which needs to use the packet sequence set (N) before . For each malicious encrypted flow packet, each LSTM layer outputs an intermediate word vector , j = 1, 2, and the expression is:

[0106]

[0107] Step S3.2: Use the reverse language model. Like the forward language model, on each flow packet, each LSTM layer also outputs an intermediate word vector , and the expression is:

[0108]

[0109] Step S3.3: The time sequence feature representation learning model integrates the forward language model and the reverse language model, and jointly maximizes the log likelihood function of the bidirectional model, and the calculation method is:

[0110] ​​

[0111] where, is the syntax unit representation layer parameter, is the SoftMax layer parameter, the two parameters are shared in the front and back language algorithm, the parameter of LSTM is unique to the layer LSTM, so the training process of the language model in two directions is separate.

[0112] Step S3.4: for each input malicious encrypted traffic , the model outputs two opposite direction vectors for each layer of Bi-LSTM network , the expression is:

[0113]

[0114] where, is the static word embedding layer, = [ ].

[0115] Step S3.5: apply layer normalization to each LSTM layer, since the model learns different information at different network levels, calculate the weighted combination of the forward and backward language model output vectors, and fold all layers into a vector, and use to represent the vector, the task-specific weight expression of the bidirectional language model layer is:

[0116]

[0117] where the global scaling factor is a scalar parameter that allows the task algorithm to scale the entire vector, represents the number of layers of the bidirectional language algorithm, represents the softmax normalization weight, indicating how much attention should be paid on each layer, is the static word embedding layer.

[0118] As shown in Figure 5 , the malicious encrypted traffic detection method based on multi-dimensional feature representation and prompt learning includes four stages of prompt sample construction, embedding construction, model training and malicious encrypted traffic detection. The specific steps are as follows:

[0119] Step S4.1: concatenate the behavior and timing two kinds of representation vectors into a joint representation vector, the concatenation expression is as follows:

[0120]

[0121] where, a malicious encrypted traffic joint representation vector, a malicious encrypted traffic behavior feature representation vector, a malicious encrypted traffic time sequence feature representation vector.

[0122] Step S4.2: In the data set containing N category labels and M scales, for the single malicious encrypted traffic representation vector spliced in step S4.1 and its corresponding category label , based on the prompt strategy, they are constructed into prompt samples in the form of "< > [MASK] < > ". Where [MASK] is a binary value, taking the values "yes" and "no", and predicting the value of [MASK] is the training process.

[0123] Step S4.3: For the same representation vector and other category labels in the data set, use the same prompt strategy to construct other different prompt samples. The construction results are shown in the following table:

[0124]

[0125] For the representation vector "A530 B920...0X00" and its category label "Vawtrak", N different prompt samples are constructed. Among the N prompt samples, there is one positive sample and N-1 negative samples.

[0126] Step S4.4: Repeat steps S4.1-S4.3 until M representation vectors are all constructed into prompt samples, and the multi-label classification problem is converted into multiple binary classification problems.

[0127] Step S5.1: After shuffling the processed prompt samples, construct a training set and send it to the embedding layer of the BERT network. The embedding expression is as follows:

[0128]

[0129] Where is the result combination after three embeddings, which is the input embedding of the BERT network training, is each word in the prompt sample, , and represent token embedding, position embedding, and paragraph embedding, respectively.

[0130] Step S5.2: The processed input sequence is represented as: “[CLS]<Malicious encrypted traffic feature vector>[SEP][MASK]<Malicious encrypted traffic category label>[SEP]”. Where [CLS] is a special classification token, which corresponds to the last hidden state of BERT. [SEP] token must be inserted at the end of a single input, helping BERT network to understand the end of one input and the beginning of another input in the same sequence input.

[0131] Step S6.1: The processed embedding result is input into the BERT network for training.

[0132] Step S6.2: For the input embedding “[CLS]<Malicious encrypted traffic feature vector>[SEP][MASK]<Malicious encrypted traffic category label>[SEP]”, since the multi-label classification problem has been converted into multiple binary classification problems through the construction of the prompt sample, a binary classifier is used to predict the value of [MASK], so as to determine whether the malicious encrypted traffic matches the category label.

[0133] Step S6.3: Since the constructed prompt sample plays the role of negative sample in the classification process, the cross-entropy function is used as the training target of the model, and the expression is:

[0134]

[0135] Where is the predicted label result, represents the number of malicious encrypted traffic in the data set, represents the number of categories. represents the symbol function, if the real category of the sample is equal to , it takes 1, otherwise it takes 0. represents the predicted probability that the observed sample belongs to the category .

[0136] Step S6.4: The model distinguishes the correct sample from N similar samples, by introducing prompt learning, the BERT network achieves a similar effect to contrastive learning during training. The larger N is, the more negative samples participate in training, and the more comprehensive the feature space learned by the model is. In turn, it reduces the probability of judging small sample class data as similar to large sample class labels, and enhances the classification effect of the model.

[0137] Step S7.1: Detect and classify malicious encrypted traffic samples using the trained model. Similar to the training process, N different prompt samples are constructed using the prompt strategy and input into the embedding layer, and the input embedding "[CLS]<malicious encrypted traffic feature vector>[SEP] [MASK]<malicious encrypted traffic class label>[SEP]" is generated.

[0138] Step S7.2: Input the N repeated prompt samples into the trained BERT network. Since the multi-label classification problem is converted into multiple binary classification problems, a Sigmoid classifier is used for classification during the detection process, and the predicted label for the sample is output according to the confidence, and the confidence calculation expression is:

[0139]

[0140] where represents the sigmoid function, is the sample input passed to the sigmoid function, which weights and sums the input features with the weights, maps the result to a probability value between [0, 1] through the Sigmoid function, where 0 represents the negative class and 1 represents the positive class, and it is interpreted as a probability distribution, which helps to effectively perform backward gradient propagation of parameter updates, and the output can be considered as the probability related to each label, and then determine the final predicted label. The opposite confidence of the prompt sample predicted as an error is equal to .

[0141] Step S7.3: Determine the classification of malicious encrypted traffic according to the interval value of the prediction result (0, 1), and realize the detection and classification of malicious encrypted traffic.

[0142] Although the embodiments of the present application have been shown and described, it can be understood by those of ordinary skill in the art that various equivalent changes, modifications, replacements and variations of these embodiments can be made without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalent scope.

Claims

1. A method for malicious encrypted traffic detection based on multi-dimensional feature representation and hint learning, characterized in that The method comprises: Step S1: data preprocessing of malicious encrypted traffic data set, including data segmentation, data cleaning and standardization three steps; Step S2: using the preprocessed malicious encrypted traffic data set, using Ip2Vec algorithm, based on the traffic feature five tuple to represent the behavior characteristics; Step S3: using the preprocessed malicious encrypted traffic data set, using double Bi-LSTM neural network, using traffic packet level data to represent the time sequence characteristics of malicious encrypted traffic; Step S4: the malicious encrypted traffic behavior and time sequence characteristics obtained in steps S2 and S3 are spliced to obtain a malicious encrypted traffic joint representation vector, and a prompt sample is constructed based on the prompt learning strategy using the joint representation vector; Step S5: the prompt sample processed in step S4 is shuffled and constructed as a training set to be input into the embedding layer of the BERT network for processing, and the input embedding result is constructed; Step S6: using the input embedding result processed in step S5, the BERT classification network is trained, and the malicious encrypted traffic data sample is learned, so that the training network fully learns the feature space of the malicious encrypted traffic data sample, which is used to alleviate the influence of data set imbalance on the detection model and improve the classification effect; Step S7: using the same processing method as training, process the to-be-detected traffic data, input the processed N malicious encrypted traffic samples into the trained BERT network for detection, and complete the classification of malicious encrypted traffic.

2. The method for malicious encrypted traffic detection based on multi-dimensional feature representation and prompt learning of claim 1, wherein, The step S1 comprises: Step S1.1: in the data segmentation step, use SplitCap tool to cut the original PACP file into single stream data, and merge the packet level data with the same traffic feature five tuple into a stream data; Step S1.2: after data segmentation in step S1.1, clean the data, delete the repeated and invalid data in the extracted stream data, and use it to improve the quality of the data set; Step S1.3: after data cleaning in step S1.2, for a set of M malicious encrypted traffic data, extract each stream and process it into a standardized traffic feature five tuple to obtain a 5*1*M feature five tuple input matrix as the input of behavior feature representation learning; Step S1.4: divide the bit stream according to the length of 8 bits for the traffic data packet, and the range of each byte is 0-255; Step S1.5: extract the first N packets of each stream in time sequence, merge them into a data, and retain the time sequence characteristics of the traffic; Step S1.6: the length of each packet is L bytes, and L is 128, if the length of the packet is less than 128, 0 is used to complete; Step S1.7: the first 8 packets of the traffic contain complete handshake information, and N is taken as 8, if the number of packets is less than 8, 0X00 padding packet is used to complete, and a 128*8*M byte sequence matrix is obtained as the input of time sequence feature representation learning.

3. The method for malicious encrypted traffic detection based on multi-dimensional feature representation and prompt learning of claim 1, wherein, The feature five tuple comprises: source IP address, target IP address, source port, target port and protocol.

4. The method for malicious encrypted traffic detection based on multi-dimensional feature representation and prompt learning of claim 1, wherein, The step S2 comprises: Step S2.1: Ip2Vec extracts the context information of IP addresses from flow-based data and converts it into a real number vector representation; Step S2.2: For a given flow five tuple , target its maximum probability , the expression is: wherein, denotes the length of the input sequence, represents a probability, represents the position of a word, k represents the sequence number of each unit in the sequence; Step S2.3: The task of prediction is a multi-classification problem, and the last layer of the classifier uses softmax for multi-classification, with the expression being: wherein, is a flow five tuple sequence, is a classification probability, is a word is a non-normalized log probability, is a non-normalized log probability for each word is a non-normalized log probability for each word the expression is: wherein, , is a softmax parameter, is composed of concatenation or average of word vectors extracted from the traffic vector matrix .

5. The method for malicious encrypted traffic detection based on multi-dimensional feature representation and prompt learning of claim 1, wherein, The step S3 comprises: Step S3.1: For the byte sequence of malicious encrypted traffic packets ( N represents the number of data packets. A forward language model consisting of two LSTM layers will calculate a certain data packet. Maximum likelihood probability, using Previous packet sequence set ( The calculation is performed such that for each malicious encrypted traffic packet, each LSTM layer outputs an intermediate word vector. If j=1,2, the expression is: Step S3.2: Using the reverse language model, same as the forward language model, at each traffic packet, each LSTM layer will output an intermediate word vector as well , the expression is: Step S3.3: The time sequence feature representation learning model integrates a forward language model and a reverse language model, and jointly maximizes the bidirectional model log-likelihood function, with the calculation method being: wherein, is a syntax unit representation layer parameter, is a SoftMax layer parameter, the two parameters are shared in the front and back language algorithm, the parameters of the LSTM is unique to the layer LSTM, and the training processes of the language models in the two directions are separated; Step S3.4: For each input malicious encrypted traffic , the model outputs two opposite direction vectors for each layer of Bi-LSTM network , the expression is: wherein, is a static word embedding layer, = [ ]; Step S3.5: Apply normalization to each LSTM layer application layer, since the model learns different information from different network levels, calculate the weighted combination of the forward and backward language model output vector representation, and fold all layers into a vector, and use to represent this vector, and the task-specific weight expression of the bidirectional language model layer is: where the global scaling factor is a scalar parameter that allows the task algorithm to scale the entire vector, denotes the number of layers of the bidirectional language algorithm, denotes the softmax normalization weights, indicating how much attention should be put on each layer, is a static word embedding layer.

6. The method for malicious encrypted traffic detection based on multi-dimensional feature representation and prompt learning of claim 1, wherein, The step S4 comprises: Step S4.1: The behavior and time sequence two kinds of representation vectors are spliced into a joint representation vector, with the splicing expression being: wherein, is a malicious encrypted traffic joint representation vector, is a malicious encrypted traffic behavior feature representation vector, is a malicious encrypted traffic temporal feature representation vector; Step S4.2: In the data set containing N categories of labels and the size of M, for the single malicious encrypted traffic feature vector spliced in step S4.1 and the corresponding category label , based on the prompt strategy, they are constructed into prompt samples in the form of "< > [MASK] < >”, wherein [MASK] is a binary value, taking the values of "yes" and "no", and the value of [MASK] is predicted, that is, the training process; Step S4.3: For the same representation vector and other class labels in the data set , other different prompt samples are constructed using the same prompting strategy; Step S4.4: Steps S4.1-S4.3 are repeated until M representation vectors are all constructed as prompt samples, and the multi-label classification problem is converted into multiple binary classification problems.

Images