Encrypted traffic threat detection method and device based on multi-stream enhanced single-stream representation

Abstract

The invention relates to the technical field of malicious traffic detection, in particular to an encrypted traffic threat detection method and device based on multi-stream enhanced single-stream representation. The method comprises the following steps of: performing data enhancement by utilizing similar single flows in flow data in combination with network flow characteristics, and enriching selection of positive samples in contrast learning tasks; in the training process, the combination of uniflow pairs is disrupted, so that the model recognizes disrupted samples. According to the method, the two proxy tasks are set to perform pre-training learning to obtain characteristics which are irrelevant to labels and are relatively high in generalization, and fine adjustment and rapid adaptation are performed on a small amount of labeled malicious traffic detection data. According to the scheme, the proxy task is designed in combination with the network traffic characteristics, the sequence information of the traffic is introduced to serve as supplement, and the representation of the malicious traffic detection task which can be quickly migrated to the single flow is learned.

Description

Technical Field

[0001] The present invention relates to the technical field of malicious traffic detection, and in particular to a method and device for detecting encrypted traffic threats based on multi-stream enhanced single-stream characterization. Background Art

[0002] As a key support for the booming digital economy, the healthy and stable operation of information networks is based on the accurate classification and proper management of network traffic. In today's era, the Internet is becoming more and more popular and the application scenarios are becoming more and more diverse, which has significantly increased the complexity of network traffic. In the field of malicious traffic detection, malicious traffic is currently showing a sharp growth trend, which has posed a serious threat to network security and stability, and has also brought extremely severe challenges to traditional traffic detection and classification methods.

[0003] Currently, most models based on supervised deep learning are highly dependent on the support of a large amount of labeled data. However, the labeling process of network traffic usually relies on the expertise of security experts, which is labor-intensive and time-consuming, and the labeling cost is high. For example, in order to collect malicious traffic data, researchers usually run malware in a sandbox environment to generate corresponding malicious traffic samples. This method requires the construction and maintenance of a highly simulated virtual operating environment, and faces complex traffic capture and cleaning tasks. At the same time, the characteristics of malicious traffic may change dynamically over time, making it difficult for existing labeled data to maintain its effectiveness in the long term.

[0004] In this context, self-supervised learning technology has gradually become a promising alternative. Self-supervised learning refers to learning by using the data's own information, and solving the problem of insufficient labeled data in supervised learning by learning feature representations from unlabeled data. Its core idea is to learn shallow representations from unlabeled data by setting proxy tasks, and finally fine-tune with labeled data to make full use of the data. In the field of computer vision, self-supervised learning methods construct positive samples by performing data enhancement (such as random cropping and color jitter) on samples. Positive samples are different observation angles of the original image samples, and their semantics are similar, while other samples are negative samples. The shallow representation of the image is learned by pulling the distance of the positive samples closer and the distance of the negative samples farther away. In the field of natural language processing, taking BERT as an example, it learns more in-depth contextual semantic information through MLM (random mask, predicting masked words through context information) and NSP (neighboring sentence prediction, by judging whether a pair of sentences are adjacent context sentences). Most of the existing encrypted traffic detection models are supervised, and the labeled data is often manually labeled, which requires a lot of time and manpower costs, while there is a large amount of unlabeled data in the real world. In addition, for some fields, it is difficult to obtain a sufficient amount of labeled data, making it difficult for supervised models to achieve good results in these fields. In addition, supervised models need to collect labeled data again and retrain the model when dealing with new tasks, new fields, and new scenarios, which increases the training cost and time cost, and may face the problem of insufficient model generalization ability. In this context, self-supervised learning technology has gradually become a promising alternative.

[0005] Most existing self-supervised learning-based models extract features by masking traffic data and predicting the masked parts. However, this method fails to fully explore the characteristics of network traffic in multiple dimensions such as time series correlation and behavior patterns, thus limiting the improvement of its detection performance.

[0006] In summary, how to set up proxy tasks in combination with network traffic characteristics to make full use of a large amount of unlabeled encrypted traffic to learn traffic representation and make the model have strong generalization is an important issue.

[0007] The existing methods for classifying encrypted traffic are summarized as follows:

[0008] (1) Machine learning-based methods

[0009] The machine learning-based method mainly extracts some features based on the expert prior knowledge and uses machine learning algorithms to identify malicious traffic. Generally, these features are designed based on the behavior of the session. The behavior-based classification method is mainly based on the following idea: different attacks usually have their own unique characteristics [1]. Take DoS attack as an example. It has two subcategories: bandwidth consumption and resource consumption attacks. Each category has many attack methods. Take the SYNFlood attack of bandwidth consumption attack as an example. It mainly exploits the vulnerability of TCP handshake. The attacker sends a large number of SYN packets to the target server. Usually, the attacker uses a spoofed IP address. Then the server responds to each connection request and leaves the port open for a period of time to receive the corresponding data packets. If the attacker sends too many SYN packets, each new SYN packet will cause the server to open the port for a period of time. Once all ports are used, the server cannot complete normal work. Usually, this type of attack can be detected by duration, flag field, and only SYN but no further communication.

[0010] The implementation based on machine learning is relatively simple. It only requires specifying features, extracting them and processing them with classic algorithms. However, there are also big problems. The first is the selection of features. Obviously, there is no universal feature group that can distinguish the current task. Different features need to be designed for different tasks. In addition, due to the continuous development of malicious traffic types in this field, features may need to be continuously added and modified.

[0011] (2) Methods based on supervised deep learning

[0012] Deep-Packet[2] classifies flows at the packet level and processes each packet into a one-dimensional vector. Considering the differences in traffic collection environments, there may be huge differences between data in a closed environment and data in an open environment, that is, the existing network. The closed data set is collected under limited servers and hosts. Therefore, when processing the data packet, the Ethernet header is first removed and the IP address is zeroed to prevent the model from being affected by irrelevant features. The UDP packet header is aligned according to the TCP packet length, and finally aligned according to the MTU maximum transmission unit of 1500 bytes. If it is not enough, it is padded with 0. The processed one-dimensional vector is used for feature learning by CNN and Stacked Autoencoder respectively. However, for the packet level, the information that a packet can carry is too little. We believe that based on FlowLevel or even multiple flows, we can better utilize the information of the session. In 2016, Wang used a very simple LeNet network to open the door to deep learning in encrypted traffic classification [3]. This is the first paper to use deep neural networks to learn representations on raw traffic data. The traffic is divided into five tuples (source IP address, destination IP address, source port number, destination port number, protocol). The first 784 bytes in the flow are processed into 2D grayscale images. The processed data is similar to handwritten MNIST digit recognition to classify traffic. In the subsequent work, end-to-end encrypted traffic is based on one-dimensional CNN [4]. Wang believes that network traffic is essentially a kind of time series data, which is a one-dimensional byte stream organized in a hierarchical structure. From the bottom to the top, it is used as bytes, frames, sessions, and the entire traffic. It is similar to the previous work that takes the first 784 bytes in the session, except that the network in this work uses a one-dimensional CNN. The supervised learning-based method requires a large number of labeled data sets and is not applicable in scenarios where the number of labeled data samples is small. Summary of the invention

[0013] In order to solve the technical problem in the prior art of how to set proxy tasks in combination with network traffic characteristics to make full use of a large amount of unlabeled encrypted traffic to learn traffic characterization, the embodiment of the present invention provides an encrypted traffic threat detection method and device based on multi-stream enhanced single-stream characterization. The technical solution is as follows:

[0014] On the one hand, a method for detecting encrypted traffic threats based on multi-stream enhanced single-stream characterization is provided, characterized in that the method includes:

[0015] S1. Collect flow data samples and construct the flow data samples into a flow data set;

[0016] S2, preprocessing the traffic data set to obtain training samples;

[0017] S3, the training samples are divided into samples of the pre-training stage and samples of the fine-tuning stage; for the samples of the pre-training stage, multiple streams are organized according to four-tuples to enrich the selection of positive samples in contrastive learning; for the samples of the fine-tuning stage, single streams are organized according to five-tuples, and for each single stream, the byte information of the first n data packets in the stream and the length sequence information of the first m data packets are extracted;

[0018] S4. Pre-training is performed by setting proxy tasks in an unlabeled dataset to obtain a pre-trained model; wherein the proxy tasks include contrastive learning tasks and flow consistency discrimination tasks;

[0019] S5. Based on the pre-trained model, fine-tune it with a small amount of labeled malicious traffic data sets, use the cross-loss entropy function to calculate the loss during the training process, perform gradient updates based on the loss, and obtain the updated model;

[0020] S6. For the updated model, malicious traffic detection and identification are performed to complete encrypted traffic threat detection based on multi-stream enhanced single-stream characterization.

[0021] Optionally, in S2, multiple pairs of traffic data sets are preprocessed, including:

[0022] Remove invalid traffic;

[0023] Remove the fields irrelevant to traffic detection and set them to 0; the irrelevant fields include: checksum, IP address, and port number.

[0024] Optionally, a four-tuple includes: source IP address, destination IP address, destination port number, and protocol number;

[0025] The quintuple includes: source IP address, source port number, destination IP address, destination port number, and protocol number.

[0026] Optionally, in S4, the contrastive learning task includes:

[0027] The unlabeled data set is split into traces or multiple streams according to the four-tuple {source IP, destination IP, destination port, protocol};

[0028] Construct a positive and negative sample sampling method to sample the positive and negative sample pairs required for contrastive learning;

[0029] Through contrastive learning loss function, similar flows in multiple flows are brought closer in feature space, while flows that are not in the same trace are pulled apart in vector space;

[0030] Among them, the positive samples in contrastive learning are selected from a single stream among multiple streams, and data enhancement is performed on the single stream, while the negative samples are samples from different batches maintained through a sliding queue;

[0031] The InfoNCE loss function is used to calculate loss optimization, shortening the distance between positive samples and increasing the distance between negative samples in the vector space.

[0032] Optionally, construct a positive and negative sample sampling method to sample the positive and negative sample pairs required for contrastive learning, including:

[0033] The pre-training data consists of triples Composition, where x and is a flow sample randomly selected from the same trace. are negative samples maintained from the dictionary queue;

[0034] Among them, for a batch of samples, similar streams in multiple streams are taken as positive samples through data enhancement, and negative samples are obtained through dictionary queue maintenance.

[0035] Optionally, in S4, the flow consistency determination task includes:

[0036] In a given dataset, for a single stream of data, the context is constructed by randomly combining the streams in pairs;

[0037] Shuffle the data according to the preset probability p;

[0038] When the context information in the combined stream does not match, it is marked as "1", indicating that the data has been obfuscated; conversely, when the context information remains consistent, it is marked as "0", indicating that the data is a complete stream;

[0039] Use the cross-loss entropy function for optimization:

[0040]

[0041] Where H represents the cross entropy loss function; represents the value predicted by the model;

[0042] The overall loss function is the sum of the two losses, and the joint optimization model The learning process is as follows:

[0043]

[0044] in, represents the loss function for the contrastive learning task.

[0045] Optionally, the data is shuffled according to a preset probability p, including:

[0046] The default probability p=0.5; that is, half of the data is shuffled and half of the data remains the same;

[0047] For a given data, randomly generate a probability p_, if p_>p then shuffle it, otherwise keep the data unchanged.

[0048] Optionally, in S5, based on the pre-trained model, fine-tuning is performed using a small amount of labeled malicious traffic data sets, and during the training process, a cross-loss entropy function is used to calculate the loss, and a gradient update is performed according to the loss to obtain an updated model, including:

[0049] When the quality of features obtained by pre-training is high and there is an obvious distribution shift, linear detection is selected to fine-tune the model. When the data set is sufficient and the graphics card resources are sufficient, all parameters are used to fine-tune the model.

[0050] Among them, fine-tuning includes fine-tuning the model using the cross entropy loss function to optimize the classification performance of downstream tasks:

[0051]

[0052] Where y represents the true label, represents the prediction distribution.

[0053] On the other hand, a device for detecting encrypted traffic threats based on multi-stream enhanced single-stream characterization is provided, and the device is applied to a method for detecting encrypted traffic threats based on multi-stream enhanced single-stream characterization, and the device includes:

[0054] A data collection module is used to collect flow data samples and construct the flow data samples into a flow data set;

[0055] A data preprocessing module is used to preprocess the traffic data set to obtain training samples;

[0056] Traffic embedding module, used to divide training samples into samples of pre-training stage and samples of fine-tuning stage; for samples of pre-training stage, multiple streams are organized as four-tuples to enrich the selection of positive samples in contrastive learning; for samples of fine-tuning stage, single streams are organized as five-tuples, and for each single stream, the byte information of the first n packets in the stream and the length sequence information of the first m packets are extracted;

[0057] A pre-training module is used to perform pre-training in an unlabeled dataset by setting proxy tasks to obtain a pre-training model; wherein the proxy tasks include contrastive learning tasks and flow consistency discrimination tasks;

[0058] The fine-tuning module is used to fine-tune the pre-trained model through a small amount of labeled malicious traffic data sets. During the training process, the cross-loss entropy function is used to calculate the loss, and the gradient is updated according to the loss to obtain the updated model;

[0059] The threat detection module is used to detect and identify malicious traffic through the updated model, and complete the encrypted traffic threat detection based on multi-stream enhanced single-stream characterization.

[0060] On the other hand, an encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization is provided, and the encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization comprises: a processor; a memory, on which computer-readable instructions are stored, and when the computer-readable instructions are executed by the processor, any one of the encrypted traffic threat detection methods based on multi-stream enhanced single-stream characterization is implemented.

[0061] On the other hand, a computer-readable storage medium is provided, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement any one of the above-mentioned encrypted traffic threat detection methods based on multi-stream enhanced single-stream characterization.

[0062] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0063] In an embodiment of the present invention, similar flows in multiple flows are used to enhance the characterization of a single flow. In addition, the present invention allows the model to distinguish whether the data packets in the flow are from the same flow by making the model aware of the consistency of the flow and the contextual relevance of the data packets in the flow. The present invention splits a small amount of labeled traffic for specific tasks into flows as input, and uses a fine-tuning strategy to adjust the pre-trained model to fully utilize the capabilities of the pre-trained model. Compared with supervised models, the pre-trained model provided by the present invention only requires a small amount of labeled samples during fine-tuning to quickly adapt to downstream malicious detection tasks; the pre-trained model learns label-independent representations and can be migrated to different tasks, such as traffic application identification, malicious traffic detection, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 A flowchart of an encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization provided by an embodiment of the present invention;

[0066] Figure 2 A diagram showing the form of traffic in a network provided by an embodiment of the present invention;

[0067] Figure 3 A diagram showing a multi-stream situation in an application provided by an embodiment of the present invention;

[0068] Figure 4 A pre-training framework diagram provided for an embodiment of the present invention;

[0069] Figure 5 A framework diagram of the fine-tuning phase provided by an embodiment of the present invention;

[0070] Figure 6 A diagram of a model encoding structure provided by an embodiment of the present invention;

[0071] Figure 7 A block diagram of an encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization provided by an embodiment of the present invention;

[0072] Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0073] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0074] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0075] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0076] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0077] The embodiment of the present invention provides an encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization, which can be implemented by an encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization, and the encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization can be a terminal or a server. Figure 1 The flowchart of the encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization is shown in FIG. Figure 1 As shown, the encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization proposed by the present invention may include the following steps:

[0078] S1. Collect flow data samples and construct the flow data samples into a flow data set;

[0079] S2, preprocessing the traffic data set to obtain training samples;

[0080] In a feasible implementation, in S2, multiple pairs of traffic data sets are preprocessed, including:

[0081] Remove invalid traffic;

[0082] Remove the fields irrelevant to traffic detection and set them to 0; the irrelevant fields include: checksum, IP address, and port number.

[0083] S3, the training samples are divided into samples of the pre-training stage and samples of the fine-tuning stage; for the samples of the pre-training stage, multiple streams are organized according to four-tuples to enrich the selection of positive samples in comparative learning; for the samples of the fine-tuning stage, single streams are organized according to five-tuples. For each single stream, the byte information of the first n data packets and the length sequence information of the first m data packets in the stream are extracted, and the byte information and length sequence information of the traffic are embedded and represented;

[0084] In a feasible implementation manner, the four-tuple includes: source IP address, destination IP address, destination port number, and protocol number;

[0085] The quintuple includes: source IP address, source port number, destination IP address, destination port number, and protocol number.

[0086] In a feasible implementation, Figure 2 As shown in the figure, the traffic in the network mainly comes from the communication between clients or between clients and servers. During the entire communication process, data packets need to be transmitted between two nodes and may pass through multiple intermediate network devices, such as routers and switches. A single flow is a basic unit in network traffic classification, which is used to represent a set of data packets identified by a five-tuple (source IP address, source port number, destination IP address, destination port number, protocol number) with the same specific characteristics within a certain time interval. It means that an application (identified by the source port) in the source host (identified by the source IP address) communicates with another application (identified by the destination port number) in another host (identified by the destination IP address). The five-tuple here can be regarded as a unique identifier for network communication, ensuring that each single flow represents a group of related communication data packets.

[0087] For multiple streams, it is a collection of single streams, such as Figure 3As shown in the figure, when a user accesses an application, multiple streams that are related in time and space may be generated. For example, when accessing a page, there may be multiple parallel streams to speed up the access speed of page images, or to quickly establish a connection with the application of the destination server after a certain connection is disconnected. This form of multiple streams can be defined by a four-tuple {source IP address, destination IP address, destination port number, protocol number}. Each time the application re-establishes a connection, its destination port number is often determined, while the source port is randomly assigned by the system. Therefore, we use the four-tuple within a certain period of time as described above to identify similar single streams.

[0088] In a feasible implementation, the present invention uses similar flows in multiple flows to enhance the representation of a single flow. In addition, it can also make the model aware of the consistency of traffic and the contextual relevance of data packets in the flow. For this purpose, we have designed a separate task to let the model distinguish whether the data packets in the flow come from the same flow. This solution includes two stages: pre-training and fine-tuning. Figure 4 As shown, there are two tasks in the pre-training stage. The first task is a comparative learning task, which allows the model to learn the similarities between flows. Specifically, the unlabeled data set is split into Traces, i.e., multiple flows, according to the four-tuple {source IP, destination IP, destination port, protocol}, and the similar flows in the multiple flows are brought closer in the feature space through the comparative learning loss function, while the flows that are not in the same trace are pulled apart in the vector space. The second task is a binary classification task to allow the model to learn the consistency of the traffic. Specifically, the context of the randomly obfuscated flow is used to allow the model to determine whether the flow is obfuscated. In the fine-tuning stage, this chapter splits a small amount of labeled traffic for specific tasks into flows as input, and uses three fine-tuning strategies to adjust the pre-trained model to fully utilize the capabilities of the pre-trained model. There are three modules in total, the traffic embedding module, the pre-training module, and the fine-tuning module, as follows:

[0089] Traffic embedding module:

[0090] For a specific TLS stream, the first n packets in the stream may contain some plaintext information of the TLS handshake process. After the TLS handshake negotiates the key, the payload part of the data packet has been encrypted. However, sequence features such as packet sequence length can provide additional information. In order to optimize the computational cost, one strategy is to combine the payload information of the first n packets of the stream with the sequence information of the accompanying stream instead of processing the entire original stream traffic. This approach can more efficiently utilize the original traffic information and reduce the computational overhead associated with processing large amounts of data. The overall structure of this process is as follows Figure 6 shown.

[0091] Traffic data processing: For the original traffic data information, a multi-level traffic representation method is used, which consists of the first 5 packets in the flow The header data of each data packet is represented by 2 rows of header data, totaling 80 bytes, and 6 rows are allocated for the payload part to store its payload content. Subsequently, the Traffic Transformer model is used to encode the original traffic data.

[0092] Packet length sequence feature extraction: Extract the packet length sequence of the flow, for example, {64, 128, 1040,512...}. Then, through the parameter matrix The sequence is word-embedded to convert the discrete input sequence into a high-dimensional vector representation. In addition, this method incorporates position encoding into each token in the sequence to represent its position information in the sequence. Afterwards, multiple Transformer modules are used to encode the sequence.

[0093] Feature vector fusion module: After obtaining the embeddings of the original traffic data and the packet length sequence, this chapter combines these two embedding vectors by concatenation. The combined vector is then input into a linear layer to generate the final traffic embedding representation.

[0094] S4. Pre-training is performed by setting proxy tasks in the unlabeled dataset to obtain a pre-trained model; wherein the proxy tasks include contrastive learning tasks and flow consistency discrimination tasks. Figure 4 shown.

[0095] In one possible implementation, a detailed analysis is conducted on how to use contrastive learning to enhance stream embeddings through traces. Contrastive learning is inspired by the human ability to recognize the commonalities between similar things and the differences between different entities. Its goal can be described as training an encoder to bring enhanced versions of the same sample closer in the embedding space, while moving embeddings of different samples away from each other. To achieve this goal, this scheme designs a sampling strategy for positive and negative sample pairs, and uses contrastive learning to mitigate label bias introduced by data distribution and label information.

[0096] In a feasible implementation, in S4, the contrastive learning task includes:

[0097] The unlabeled data set is split into traces or multiple streams according to the four-tuple {source IP, destination IP, destination port, protocol};

[0098] Construct a positive and negative sample sampling method to sample the positive and negative sample pairs required for contrastive learning;

[0099] Through contrastive learning loss function, similar flows in multiple flows are brought closer in feature space, while flows that are not in the same trace are pulled apart in vector space;

[0100] Among them, the positive samples in contrastive learning are selected from a single stream among multiple streams, and data enhancement is performed on the single stream, while the negative samples are samples from different batches maintained through a sliding queue;

[0101] The InfoNCE loss function is used to calculate loss optimization, shortening the distance between positive samples and increasing the distance between negative samples in the vector space.

[0102] In a feasible implementation, constructing a positive and negative sample sampling method to sample the positive and negative sample pairs required in contrastive learning includes:

[0103] The pre-training data consists of triples Composition, where x and is a flow sample randomly selected from the same trace. are negative samples maintained from the dictionary queue;

[0104] Among them, for a batch of samples, similar streams in multiple streams are used as positive samples through data enhancement, and negative samples are obtained through dictionary queue maintenance. Each time the batch of data is trained, it enters the queue, and the earliest batch of data that enters the queue, that is, the data with lower freshness, is ejected from the queue.

[0105] In a feasible implementation, this solution uses the momentum contrast learning method (MoCo) to extract robust flow features from traces. MoCo optimizes the model on a dynamically updated set of negative samples by modeling contrast learning as a dictionary query task. Its core mechanism is to store negative samples through a dynamic dictionary maintained by a queue, thereby ensuring the comprehensiveness and diversity of negative samples while ensuring efficient calculation. During the training process, the dynamic dictionary queue updates the current batch of data and removes the earliest batch of negative samples to form a dynamic, finite-size negative sample pool. In addition, MoCo uses a momentum encoder to maintain the consistency of training. The advantage of this momentum update mechanism is that there is no need to train a separate encoder for negative samples, but it is gradually updated through the main encoder, thereby reducing the computational burden and improving the stability of negative sample representation. The momentum encoder mechanism in MoCo has been proven in practice to significantly improve the generalization ability of the model and can be adapted to complex downstream task scenarios.

[0106] In a feasible implementation, the present application combines the MOCO method and momentum encoder with specific application scenarios and makes adaptive modifications to them. For example, in contrastive learning, it is necessary to construct positive and negative samples, especially the construction of positive samples. In computer vision, images can be augmented through data enhancement (such as image flipping, Gaussian noise), but they cannot be adapted and used directly in the field of traffic. For this reason, the present invention mines similar traffic in the data set as positive samples through multiple streams.

[0107] In one feasible implementation, the projection layer and the contrast loss function: The projection layer implements nonlinear projection through a multi-layer perceptron with a hidden layer. During the pre-training process, it is usually more important to retain the features in the representation before the projection layer that are closely related to the pre-training task objectives, thereby establishing a connection between representation and contrast loss. For the contrast loss used to measure the similarity of sample pairs in the representation space, this chapter uses the Information Noise Contrastive Estimation (InfoNCE) loss function, which is shown below:

[0108] ;

[0109] in, is a temperature hyperparameter that controls the shape of the logits distribution and is a given triple The contrast loss of The size of is equal to the size of the dictionary queue.

[0110] In a feasible implementation, in S4, the flow consistency determination task includes:

[0111] In a given dataset, for a single stream of data, the context is constructed by randomly combining the streams in pairs;

[0112] Shuffle the data according to the preset probability p;

[0113] When the context information in the combined stream does not match, it is marked as "1", indicating that the data has been obfuscated; conversely, when the context information remains consistent, it is marked as "0", indicating that the data is a complete stream;

[0114] This method essentially constructs a binary classification task, aiming to improve the model's ability to learn flow consistency. The cross-loss entropy function is used to optimize the pre-trained model:

[0115]

[0116] Among them, H represents the cross entropy loss function, represents the value predicted by the model;

[0117] The overall loss function is the sum of the two losses, and the joint optimization model The learning process is as follows:

[0118]

[0119] in, represents the loss function for the contrastive learning task.

[0120] In a feasible implementation, the data is shuffled according to a preset probability p, including:

[0121] The default probability p=0.5; that is, half of the data is shuffled and half of the data remains the same;

[0122] For a given data, randomly generate a probability p_, if p_>p then shuffle it, otherwise keep the data unchanged.

[0123] In a feasible implementation, for example, for a given stream, it is composed of some ordered data packets, [data packet 1_1, data packet 2_1, data packet 3_1, ..., data packet n_1], where n in data packet n_1 represents the order of the data packets in the original stream, and 1 represents the data packet in source stream 1. If it is disrupted, it will be mixed with data packets of other streams, such as [data packet 1_1, data packet 2_5, data packet 3_5, ... data packet n_5]. At this time, the data packets of the stream are mixed with stream 1 and stream 5, and are disrupted. Otherwise, the data packets in the stream have the same source and are not disrupted.

[0124] S5. Based on the pre-trained model, fine-tune it through a small amount of labeled malicious traffic data sets. During the training process, the cross-loss entropy function is used to calculate the loss, and the gradient is updated according to the loss to obtain the updated model.

[0125] In a feasible implementation, in S5, based on the pre-trained model, fine-tuning is performed using a small amount of labeled malicious traffic data sets, and during the training process, the cross-loss entropy function is used to calculate the loss, and the gradient is updated according to the loss to obtain the updated model, including:

[0126] When the quality of features obtained by pre-training is high and there is an obvious distribution shift, linear detection is selected to fine-tune the model. When the data set is sufficient and the graphics card resources are sufficient, all parameters are used to fine-tune the model.

[0127] Among them, fine-tuning includes fine-tuning the model using the cross entropy loss function to optimize the classification performance of downstream tasks:

[0128]

[0129] Where y represents the true label, represents the predicted distribution. Figure 5 Shown is the fine-tuning phase framework.

[0130] S6. Through the updated model, malicious traffic detection and identification are performed to complete encrypted traffic threat detection based on multi-stream enhanced single-stream characterization.

[0131] The present invention proposes to use similar flows in multiple flows to enhance the representation of a single flow. In addition, the present invention makes the model aware of the consistency of the flow and the contextual relevance of the data packets in the flow, so that the model can distinguish whether the data packets in the flow come from the same flow. The present invention splits a small amount of labeled flow of a specific task into flows as input, and uses a fine-tuning strategy to adjust the pre-trained model to fully utilize the capabilities of the pre-trained model.

[0132] Figure 7 1 is a block diagram of an encrypted traffic threat detection device 300 based on multi-stream enhanced single-stream characterization according to an exemplary embodiment. The device 300 is used for an encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization. Figure 7 The device includes a data acquisition module 310, a data preprocessing module 320, a sample organization module 330, a pre-training module 340, a fine-tuning module 350 and a threat detection module 360. Among them:

[0133] The data collection module 310 is used to collect flow data samples and construct the flow data samples into a flow data set;

[0134] The data preprocessing module 320 is used to perform data preprocessing on the traffic data set to obtain training samples;

[0135] The traffic embedding module 330 is used to divide the training samples into samples in the pre-training stage and samples in the fine-tuning stage; for the samples in the pre-training stage, multiple streams are organized according to four-tuples to enrich the selection of positive samples in the comparative learning; for the samples in the fine-tuning stage, single streams are organized according to five-tuples, and for each single stream, the byte information of the first n data packets in the stream and the length sequence information of the first m data packets are extracted;

[0136] A pre-training module 340 is used to perform pre-training in an unlabeled dataset by setting a proxy task to obtain a pre-training model; wherein the proxy task includes a contrastive learning task and a flow consistency discrimination task;

[0137] A fine-tuning module 350 is used to perform fine-tuning based on a pre-trained model using a small amount of labeled malicious traffic data sets, calculate the loss using a cross-loss entropy function during the training process, and perform gradient updates based on the loss to obtain an updated model;

[0138] The threat detection module 360 ​​is used to detect and identify malicious traffic through the updated model, and complete the encrypted traffic threat detection based on multi-stream enhanced single-stream characterization.

[0139] This paper proposes an Adaptive Interaction Feature Fusion (AIFF) module, which dynamically adjusts feature weights through an attention allocation mechanism, achieves efficient balance and fusion of short-term and long-term temporal dependencies, and thus significantly improves the overall performance of temporal action localization tasks.

[0140] Optionally, multiple pairs of traffic data sets are subjected to data preprocessing, including:

[0141] Remove invalid traffic;

[0142] Remove the fields irrelevant to traffic detection and set them to 0; the irrelevant fields include: checksum, IP address, and port number.

[0143] Optionally, a four-tuple includes: source IP address, destination IP address, destination port number, and protocol number;

[0144] The quintuple includes: source IP address, source port number, destination IP address, destination port number, and protocol number.

[0145] Optionally, contrastive learning tasks, including:

[0146] The unlabeled data set is split into traces or multiple streams according to the four-tuple {source IP, destination IP, destination port, protocol};

[0147] Construct a positive and negative sample sampling method to sample the positive and negative sample pairs required for contrastive learning;

[0148] Through contrastive learning loss function, similar flows in multiple flows are brought closer in feature space, while flows that are not in the same trace are pulled apart in vector space;

[0149] Among them, the positive samples in contrastive learning are selected from a single stream among multiple streams, and data enhancement is performed on the single stream, while the negative samples are samples from different batches maintained through a sliding queue;

[0150] The InfoNCE loss function is used to calculate loss optimization, shortening the distance between positive samples and increasing the distance between negative samples in the vector space.

[0151] Optionally, construct a positive and negative sample sampling method to sample the positive and negative sample pairs required for contrastive learning, including:

[0152] The pre-training data consists of triples Composition, where x and is a flow sample randomly selected from the same trace. are negative samples maintained from the dictionary queue;

[0153] Among them, for a batch of samples, similar streams in multiple streams are taken as positive samples through data enhancement, and negative samples are obtained through dictionary queue maintenance.

[0154] Optionally, the flow consistency determination task includes:

[0155] In a given dataset, for a single stream of data, the context is constructed by randomly combining the streams in pairs;

[0156] Shuffle the data according to the preset probability p;

[0157] When the context information in the combined stream does not match, it is marked as "1", indicating that the data has been obfuscated; conversely, when the context information remains consistent, it is marked as "0", indicating that the data is a complete stream;

[0158] Use the cross-loss entropy function for optimization:

[0159]

[0160] Where H represents the cross entropy loss function; represents the value predicted by the model;

[0161] The overall loss function is the sum of the two losses, and the joint optimization model The learning process is as follows:

[0162]

[0163] in, represents the loss function for the contrastive learning task.

[0164] Optionally, the data is shuffled according to a preset probability p, including:

[0165] The default probability p=0.5; that is, half of the data is shuffled and half of the data remains the same;

[0166] For a given data, randomly generate a probability p_, if p_>p then shuffle it, otherwise keep the data unchanged.

[0167] Optionally, the fine-tuning module 340 is used to select linear detection to fine-tune the model when the quality of the features obtained by pre-training is high and there is an obvious distribution shift; when the data set is sufficient and the graphics card resources are sufficient, the model is fine-tuned using all parameters;

[0168] Among them, fine-tuning includes fine-tuning the model using the cross entropy loss function to optimize the classification performance of downstream tasks:

[0169]

[0170] Where y represents the true label, represents the prediction distribution.

[0171] The present invention uses similar flows in multiple flows to enhance the representation of a single flow. In addition, the present invention makes the model aware of the consistency of the flow and the contextual relevance of the data packets in the flow, so that the model can distinguish whether the data packets in the flow come from the same flow. The present invention splits a small amount of labeled flow of a specific task into flows as input, and uses a fine-tuning strategy to adjust the pre-trained model to fully utilize the capabilities of the pre-trained model.

[0172] Figure 8 is a structural diagram of an encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization provided by an embodiment of the present invention, such as Figure 8 As shown, the encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization may include the above Figure 7 The encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization is shown. Optionally, the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization may include a first processor 2001 .

[0173] Optionally, the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization may further include a memory 2002 and a transceiver 2003 .

[0174] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0175] Combine the following Figure 8 The components of the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization are specifically introduced:

[0176] The first processor 2001 is the control center of the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization, which can be a processor or a general term for multiple processing elements. For example, the first processor 2001 is one or more central processing units (CPUs), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (field programmable gate arrays, FPGAs).

[0177] Optionally, the first processor 2001 can perform various functions of the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002.

[0178] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 8 CPU0 and CPU1 are shown in FIG.

[0179] In a specific implementation, as an embodiment, the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization may also include multiple processors, such as Figure 8 The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0180] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled to be executed by the first processor 2001. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0181] Optionally, the memory 2002 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2002 may be integrated with the first processor 2001, or may exist independently, and may be accessed through the interface circuit ( Figure 8 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0182] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0183] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 8 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0184] Optionally, the transceiver 2003 may be integrated with the first processor 2001, or may exist independently, and may be connected to the first processor 2001 through the interface circuit ( Figure 8 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0185] It should be noted that Figure 8 The structure of the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization shown in the figure does not constitute a limitation on the router. The actual knowledge structure identification device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0186] In addition, the technical effects of the encrypted traffic threat detection device 410 based on multi-stream enhanced single-stream characterization can refer to the technical effects of the encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization described in the above method embodiment, which will not be repeated here.

[0187] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0188] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0189] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable sensors. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0190] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0191] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0192] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0193] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0194] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0195] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.

[0196] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for detecting encrypted traffic threats based on multi-stream enhanced single-stream characterization, characterized in that: The method comprises: S1. Collect flow data samples and construct the flow data samples into a flow data set; S2. performing data preprocessing on the traffic data set to obtain training samples; S3, dividing the training samples into samples of the pre-training stage and samples of the fine-tuning stage; for the samples of the pre-training stage, organizing multiple streams according to four-tuples to enrich the selection of positive samples in comparative learning; for the samples of the fine-tuning stage, organizing single streams according to five-tuples, for each single stream, extracting the byte information of the first n data packets in the stream and the length sequence information of the first m data packets; S4. Pre-training is performed by setting a proxy task in an unlabeled dataset to obtain a pre-trained model; wherein the proxy task includes a contrastive learning task and a flow consistency discrimination task; S5. Based on the pre-trained model, fine-tune it through a small amount of labeled malicious traffic data set, calculate the loss using the cross-loss entropy function during the training process, perform gradient update according to the loss, and obtain an updated model; S6. Through the updated model, malicious traffic detection and identification are performed to complete encrypted traffic threat detection based on multi-stream enhanced single-stream characterization.

2. The encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization according to claim 1 is characterized in that: In S2, the traffic data set is preprocessed, including: Remove invalid traffic; Remove the fields irrelevant to traffic detection and set them to 0; the irrelevant fields include: check code, IP address, port number.

3. The encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization according to claim 2 is characterized in that: The four-tuple includes: source IP address, destination IP address, destination port number, and protocol number; The quintuple includes: source IP address, source port number, destination IP address, destination port number, and protocol number.

4. The encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization according to claim 3 is characterized in that: In S4, the contrastive learning task includes: The unlabeled data set is split into traces or multiple streams according to the four-tuple {source IP, destination IP, destination port, protocol}; Construct a positive and negative sample sampling method to sample the positive and negative sample pairs required for contrastive learning; By contrasting the learning loss function, similar flows in multiple flows are brought closer in the feature space, while flows that are not in the same trace are pulled apart in the vector space. Among them, the positive samples in contrastive learning are selected from a single stream among multiple streams, and data enhancement is performed on the single stream, while the negative samples are samples from different batches maintained through a sliding queue; The InfoNCE loss function is used to calculate loss optimization, shortening the distance between positive samples and increasing the distance between negative samples in the vector space.

5. The encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization according to claim 4 is characterized in that: The method for constructing positive and negative sample sampling to sample the positive and negative sample pairs required in contrastive learning includes: The pre-training data consists of triples Composition, where x and is a flow sample randomly selected from the same trace. are negative samples maintained from the dictionary queue; Among them, for a batch of samples, similar streams in multiple streams are taken as positive samples through data enhancement, and negative samples are obtained through dictionary queue maintenance.

6. The encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization according to claim 5 is characterized in that: In S4, the flow consistency determination task includes: In a given dataset, for a single stream of data, the context is constructed by randomly combining the streams in pairs; Shuffle the data according to the preset probability p; When the context information in the combined stream does not match, it is marked as "1", indicating that the data has been obfuscated; conversely, when the context information remains consistent, it is marked as "0", indicating that the data is a complete stream; Use the cross-loss entropy function for optimization: ； Where H represents the cross entropy loss function; represents the value predicted by the model; The overall loss function is the sum of the two losses, and the joint optimization model The learning process is as follows: ； in, represents the loss function for the contrastive learning task.

7. The encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization according to claim 6 is characterized in that: The shuffling of the data according to the preset probability p includes: The default probability p=0.5; that is, half of the data is shuffled and half of the data remains the same; For a given data, randomly generate a probability p_, if p_>p then shuffle it, otherwise keep the data unchanged.

8. The encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization according to claim 7 is characterized in that: In S5, based on the pre-trained model, fine-tuning is performed using a small amount of labeled malicious traffic data sets, and during the training process, a cross-loss entropy function is used to calculate the loss, and a gradient update is performed according to the loss to obtain an updated model, including: When the quality of features obtained by pre-training is high and there is an obvious distribution shift, linear detection is selected to fine-tune the model. When the data set is sufficient and the graphics card resources are sufficient, all parameters are used to fine-tune the model. The fine-tuning includes fine-tuning the model using the cross entropy loss function to optimize the classification performance of downstream tasks: ； Where y represents the true label, represents the prediction distribution.

9. An encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization, the encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization is used to implement the encrypted traffic threat detection method based on multi-stream enhanced single-stream characterization as claimed in any one of claims 1-8, characterized in that: The device comprises: A data collection module, used for collecting flow data samples and constructing the flow data samples into a flow data set; A data preprocessing module, used to perform data preprocessing on the traffic data set to obtain training samples; A traffic embedding module is used to divide the training samples into samples of the pre-training stage and samples of the fine-tuning stage; for the samples of the pre-training stage, multiple streams are organized according to four-tuples to enrich the selection of positive samples in comparative learning; for the samples of the fine-tuning stage, single streams are organized according to five-tuples, and for each single stream, the byte information of the first n data packets in the stream and the length sequence information of the first m data packets are extracted; A pre-training module, used to perform pre-training in an unlabeled dataset by setting proxy tasks to obtain a pre-training model; wherein the proxy tasks include contrastive learning tasks and flow consistency discrimination tasks; A fine-tuning module, which is used to perform fine-tuning based on the pre-trained model through a small amount of labeled malicious traffic data sets, calculate the loss using a cross-loss entropy function during the training process, perform gradient update according to the loss, and obtain an updated model; The threat detection module is used to detect and identify malicious traffic based on the updated model, and complete encrypted traffic threat detection based on multi-stream enhanced single-stream characterization.

10. An encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization, characterized in that: The encrypted traffic threat detection device based on multi-stream enhanced single-stream characterization includes: A processor; a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the encrypted traffic threat detection methods based on multi-stream enhanced single-stream characterization as described in any one of claims 1-8 is implemented.

Images