Encrypted network traffic classification method and system based on spatio-temporal information fusion

Abstract

The invention discloses an encrypted network traffic classification method and system based on spatio-temporal information fusion, and mainly relates to the technical field of information security. Comprising the steps of obtaining data from an original Pcap file and performing data preprocessing; respectively converting the processed flow into a session flow multi-level representation sequence and a session-level flow graph; carrying out feature vector integration on the flow sequence through a session flow multi-stage representation sequence; the method comprises the following steps of: embedding a session-level flow graph to obtain a spatial feature vector representation of a network flow file; and aggregating the time feature vector and the space feature vector by using a cross gating feature fusion method to obtain the overall representation of the traffic features, and carrying out encrypted traffic classification by using a trained model. The method has the beneficial effects that the feature representation capability of the model is effectively enhanced while the classification effect of the encrypted traffic is improved.

Description

Technical Field

[0001] The present invention relates to the field of intrusion detection technology based on dynamic potential perception of cyberspace, and in particular to an encrypted network traffic classification method and system based on spatiotemporal information fusion. Background Art

[0002] With the acceleration of the pace of the information age, a variety of new network applications have emerged in an endless stream, resulting in an explosive growth of traffic data on the Internet. Accurately classifying network traffic is essential for optimizing network resource management, ensuring service quality, and supporting service providers to provide customized services. Given that more and more network communications have begun to adopt encryption protocols such as Internet Protocol Security (IPsec) and Transport Layer Security (TLS) to protect user privacy, encrypted traffic now accounts for a large part of the total network traffic. Although these encryption measures have improved the security of communications, they have also brought new challenges because they blur the specific content of the traffic and increase the difficulty of traffic analysis. In the face of the characteristics of the current network environment, in order to ensure the security of cyberspace, network traffic classification technology plays an increasingly important role in the monitoring of network security events and the perception of network conditions. This technology is not only a key means to distinguish normal network activities from potential malicious traffic, but also an important tool to promote the development of network security research and practical applications. Therefore, the development of effective encrypted traffic classification methods is of far-reaching significance for improving the level of network security.

[0003] At present, encrypted traffic classification methods have been widely studied. According to the order in which the methods appear, they can be divided into rule-matching-based methods, statistical feature-based machine learning, deep learning methods based on feature self-extraction, and pre-training-based methods. The rule-matching-based method uses a pre-defined set of rules to identify specific traffic patterns, but the maintenance and update costs of the rule set are high, and it is difficult to cope with newly emerging encrypted traffic patterns, and the flexibility is poor. The machine learning method based on statistical features extracts the statistical features of the traffic (such as packet length, arrival time interval, etc.) for classification. The feature selection and extraction process is complex, and the adaptability to new types of traffic is poor. The deep learning method based on feature self-extraction automatically learns features through neural networks, requires a large amount of labeled data for training, and has high model complexity and high computing resource consumption. The selection and fine-tuning strategy of the pre-training model based on the pre-training method has a greater impact on the final performance, and may be limited by the pre-training data.

[0004] In addition, traditional network security detection methods focus more on the detection of traffic content, but cannot classify encrypted traffic based on the structure and characteristics of the traffic data itself. Therefore, classifying encrypted traffic in an accurate and effective manner remains a challenging task.

[0005] In view of the above problems, how to design an encrypted traffic classification method that takes into account both improving classification accuracy and utilizing the structural information of the traffic itself is an issue that needs to be urgently addressed in this field. Summary of the invention

[0006] The purpose of the present invention is to provide an encrypted network traffic classification method and system based on spatiotemporal information fusion, which improves the encrypted traffic classification effect while effectively enhancing the feature representation capability of the model.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions: On the one hand, the present invention provides an encrypted network traffic classification method based on spatiotemporal information fusion, comprising the following steps: S1: Divide the data packets in the original Pcap file into different sessions according to the five-tuple, intercept the bytes of the protocol layer of each message in the traffic, and perform data preprocessing; S2: converting the processed traffic in step S1 into a session flow multi-level representation sequence and a session-level traffic graph; S3: Through the multi-level representation sequence of the conversation flow in step S2, the long short-term memory network is used to extract the time-dependent information of the network traffic, the channel attention mechanism is used to enhance the importance of key features, and the feature vector of the traffic sequence is integrated through the fully connected layer; S4: After embedding the session-level traffic graph in step S2, an N-layer GraphSAGE network with a skip connection mechanism is used to extract spatial features, thereby obtaining a spatial feature vector representation of the network traffic file; S5: Use the cross-gated feature fusion method to aggregate the temporal feature vector output in step S3 and the spatial feature vector output in step S4, input the obtained aggregated vector into the downstream classifier to obtain the overall representation of the traffic features, and use the trained model to classify the encrypted traffic.

[0008] Preferably, the step S1 is specifically: S11: Use SplitCap to split the traffic in the original Pcap file into multiple independent session flows, and then execute the SplitCap command to save each session flow as a separate Pcap file according to the five-tuple information; S12: Use the Scapy library to preprocess the original Pcap file; S13: Use the Scapy library to replace the MAC address and IP address information, traverse the messages in each session flow, extract and replace the MAC address and IP address information; S14: traverse the messages in each session flow, extract the TCP payload information of each message, and for each message, intercept the first 784 bytes of the protocol layer data. If the data length is less than 784 bytes, fill it with 0 to 784 bytes.

[0009] Preferably, the step S12 includes: S121: Use Scapy to read the original Pcap file and split the traffic into multiple independent session flows based on the five-tuple information; S122: traverse the messages in each session flow, use the hash value to detect and remove duplicate messages, and detect the integrity of each message; S123: Delete or replace the strong identification information that leaks the user's identity in the message, including: user agent string, Cookie; S124: filter protocol messages and retain TCP protocol messages; S125: Identify and remove abnormal sessions through statistical analysis and threshold setting, including sessions with extremely long duration, extremely large data volume, and a large number of messages in an extremely short period of time.

[0010] Preferably, the step S2 is specifically: S21: intercept the first P packets of the session flow. For each packet, extract the first m bytes of its header data and the first n bytes of its payload data. If the length of the packet, header data or payload data is insufficient, fill it with the number 0 to P, m and n respectively; if the length exceeds the specified value, perform a truncation operation. The multi-level traffic representation is that each row of the matrix corresponds to a packet, which consists of the header bytes and payload bytes of the packet. The one-dimensional representation matrix of P packets is stacked to form a size of A two-dimensional representation sequence of ; S22: The session flow composed of data packets with the same five-tuple is used as a node of the graph, and the source IP address and the destination IP address of each node are checked by traversing the IP address information of each node.

[0011] Preferably, the step S3 comprises: S31: Multi-level representation of conversation flow sequence Input to the LSTM layer, where each Indicates Data packets, is the number of packets, the input sequence Input to the LSTM layer, LSTM captures the long-term dependencies in the time series through its internal gating mechanism and cell state. After the flow sequence is input, it is processed and outputs a hidden state of the time series. , each Indicates The hidden state of time steps; S32: The output of the LSTM layer The input is sent to the channel attention mechanism, which dynamically adjusts the importance of features on each channel by analyzing the global information on each feature channel, and compresses the features of each time step into a feature vector through global average pooling. , , in is the number of time steps, is the feature dimension at each time step; The feature vector The weight of each channel is generated through two fully connected layers and Sigmoid activation function : , , , , Finally, the generated weight With the output of LSTM Multiply to get the adjusted features ; S33: The adjusted feature map Input to the fully connected layer for feature integration, specifically: the adjusted feature map is pooled by global average pooling Compress into a fixed-length vector , and then the compressed vector Input into the fully connected layer for feature integration to generate the final feature vector , the specific formula is as follows: , , The resulting vector is a vector containing the time characteristic information of the traffic file.

[0012] Preferably, the step S5 comprises: S51: After the feature vector passes through a filter consisting of a PRelu activation function and two linear layers, it is converted into the corresponding gating vector through the Sigmoid function. To filter the time feature vector , while using the spatiotemporal gating vector To filter the spatial feature vector , the process of cross-gated feature fusion is expressed as: , , , The symbol represents element-wise product, is the overall representation vector of the flow, , , , are the weights of the linear layer, , , , is the bias of the linear layer; S52: The fused feature vector Input into the downstream module classifier, adjust the format and dimension of the feature vector according to different classifiers, initialize the parameters of the classifier, and then convert the feature vector Input into the classifier for forward propagation to obtain the model's prediction results , using the cross entropy loss function to calculate the model prediction results With the true label The gap between them is calculated by back-propagation algorithm, and the gradient of loss function with respect to model parameters is calculated. The model parameters are updated using Adam optimization algorithm. The training data is divided into 256 batches, and the process of forward propagation, loss calculation, back-propagation and parameter update is repeated. S53: Apply the trained classification model to the test set, and perform the same preprocessing steps on the test set as the training set, including traffic segmentation, feature extraction, and feature fusion, to generate the feature vector of the test set. , the feature vector of the test set Input into the trained classification model for forward propagation, and output the final classification results and evaluation indicators.

[0013] On the other hand, a classification system based on the above-mentioned encrypted network traffic classification method based on spatiotemporal information fusion is provided, comprising: The pre-processing module is used to: divide the original network traffic into sessions according to the five-tuple, intercept a fixed number of bytes of each message protocol layer, and remove duplicate traffic; The temporal feature extraction module includes a long short-term memory network (LSTM), a channel attention mechanism, and a fully connected layer, which is used to extract temporal information and local dependencies from the preprocessed traffic sequence; The spatial feature extraction module is used to: construct a session-level traffic graph and encode it with GraphSAGE, then aggregate the features of each node into a fixed-length vector through the nonlinear activation function PReLU, BatchNorm batch normalization, global average pooling, fully connected layer and Dropout layer, and finally aggregate them into a traffic file spatial feature vector through readout to capture the key information of the spatial level in the traffic sequence; The feature fusion classification module is used to aggregate the temporal feature vector and the spatial feature vector into the overall vector representation of the traffic file through the cross-gated fusion method, and obtain the final classification result through a variety of selected downstream classifiers. The confusion matrix of the classification results on the two public datasets ISCX-VPNnonVPN and USTC-TFC is shown.

[0014] Compared with the prior art, the beneficial effects of the present invention are: 1. The method of the present invention uses LSTM and channel attention mechanism to capture temporal features, and extracts spatial features by constructing session-level traffic graphs and applying GraphSAGE encoding technology, thereby enhancing the expressiveness of key features and significantly improving the effect of encrypted traffic classification; 2. In the present invention, the proposed encrypted network traffic classification method based on spatiotemporal information fusion adopts a cross-gating mechanism to achieve the effective fusion of hierarchical spatial features and time series features to form the final representation vector of the traffic, effectively enhancing the feature representation ability of the model, while reducing the additional noise introduced by irrelevant features, and improving the performance and generalization ability of the model.

[0015] 3. Experimental results show that the encrypted network traffic classification method based on spatiotemporal information fusion in the present invention achieved multi-classification F1 scores of 99.13% and 98.65% on the two public datasets of USTC-TFC and ISCX-VPNnonVPN, proving that the method has excellent ability in feature expression and identification of encrypted traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a flow chart of the method of the present invention; Figure 2 It is a flowchart of data preprocessing of the present invention; Figure 3 It is a flow chart of constructing a session-level traffic graph of the present invention; Figure 4 It is a schematic diagram of the LSTM process for processing the time series of traffic files of the present invention; Figure 5 Schematic diagram of the channel attention mechanism of the present invention; Figure 6It is a schematic diagram of GraphSAGE node aggregation of the present invention; Figure 7 is a schematic diagram of the multi-stack GraphSAGE architecture of the present invention; Figure 8 is a schematic diagram of cross-gated feature fusion of the present invention; Fig. 9 It is a schematic diagram of the system structure of the present invention; FIG. 10 (a) and (b) are schematic diagrams of confusion matrices of classification results on the USTC-TFC and ISCX-VPNnonVPN datasets of the present invention, respectively. DETAILED DESCRIPTION

[0017] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the application equally.

[0018] In the present invention, terms such as "upper", "lower", "left", "right", "front", "back", "vertical", "horizontal", "side", "bottom", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings. They are relational words determined only for the convenience of describing the structural relationships of the various parts or elements of the present invention, and do not specifically refer to any part or element in the present invention and should not be understood as limitations on the present invention.

[0019] Example: like Figure 1 As shown, this embodiment provides an encrypted network traffic classification method based on spatiotemporal information fusion, including: S1: Divide the data packets in the original Pcap file into different sessions according to the five-tuple, intercept the first 784 bytes of the protocol layer of each message in the traffic, remove duplicate traffic, and store it. The preprocessing process is as follows: Figure 2 As shown, the specific implementation is as follows: S11: Use the traffic segmentation tool SplitCap, which can split the traffic in the original Pcap file into multiple independent session flows according to the five-tuple information (source IP address, destination IP address, source port, destination port, and transport layer protocol). Run the SplitCap command, specify the input Pcap file path and output directory, and SplitCap will save each session flow as a separate Pcap file according to the five-tuple information for subsequent processing. S12: In order to implement preprocessing of the original Pcap file, this embodiment uses the Scapy library to complete the following steps: First, use Scapy to read the original Pcap file and split the traffic into multiple independent session flows based on the five-tuple information; Next, by checking the messages in each session flow, the hash value is used to detect and remove duplicate messages. At the same time, the integrity of each message is checked to exclude messages containing wrong checksums, invalid lengths, or other damaged flags. In addition, delete or replace strong identification information in the message that may reveal the user's identity, including user agent strings and cookies; Then, filter out protocol messages that are irrelevant to the research target and only keep TCP protocol messages; Finally, through statistical analysis and threshold setting, we identify and remove obviously abnormal sessions, including those with extremely long duration, extremely large data volume, and a large number of messages in a very short time. S13: This embodiment uses the Scapy library to replace MAC address and IP address information, traverses the messages in each session flow, extracts and replaces the MAC address and IP address information, and for each message, replaces the source MAC address and the destination MAC address with "00:00:00:00:00:00", and replaces the source IP address and the destination IP address with "0.0.0.0" (IPv4) and "::" (IPv6); S14: traverse the messages in each session flow, extract the TCP payload information of each message, and for each message, intercept the first 784 bytes of the protocol layer data. If the data length is less than 784 bytes, fill it with 0 to 784 bytes.

[0020] S2: Convert the traffic processed in step S1 into a multi-level representation sequence of session flows and a session-level traffic graph, which is specifically implemented as follows: S21: intercept the first P packets of the session flow. For each packet, extract the first m bytes of its header data and the first n bytes of its payload data. If the length of the packet, header data or payload data is insufficient, fill it with the number 0 to P, m and n respectively; if the length exceeds the specified value, perform a truncation operation. The multi-level traffic representation is that each row of the matrix corresponds to a packet, which consists of the header bytes and payload bytes of the packet. The one-dimensional representation matrix of P packets is stacked to form a size of A two-dimensional representation sequence of ; S22: The session flows consisting of packets with the same five-tuple are taken as nodes of the graph, such as Figure 3 As shown, by traversing the IP address information of each node, the source IP address and the destination IP address of each node are checked. Specifically, for each pair of nodes, if the source IP address or the destination IP address of one of the nodes is the same as the source IP address or the destination IP address of the other node, an edge is established between the two nodes.

[0021] S3: The long short-term memory network is used to extract the time-dependent information of network traffic from the multi-level representation sequence of the conversation flow in step S2, and the channel attention mechanism is used to enhance the importance of key features. Finally, the feature vector of the traffic sequence is integrated through the fully connected layer. The specific implementation is as follows: S31: Multi-level representation of conversation flow sequence Input to the LSTM layer, where each represents the i-th data packet, P is the number of data packets, and the input sequence X is input into the LSTM layer. LSTM captures the long-term dependencies in the time series through its internal gating mechanism (forget gate, input gate, output gate) and cell state. The working principle of LSTM is as follows: Figure 4 As shown, the traffic sequence is processed after input and outputs a hidden state of a time series , each Represents the hidden state at the tth time step, which contains the time-dependent information of the input data; S32: The output H of the LSTM layer is input into the channel attention mechanism. The channel attention mechanism dynamically adjusts the importance of features on each channel by analyzing the global information on each feature channel, thereby enhancing the focus on task-critical features. The schematic diagram is shown in Figure 5 As shown, the present invention compresses the features of each time step into a feature vector by global average pooling. , , Where P is the number of time steps and d is the feature dimension of each time step; Then, the feature vector F is passed through two fully connected layers and the Sigmoid activation function to generate the weight S of each channel. , , , , Finally, the generated weight S is multiplied by the output H of LSTM to obtain the adjusted features ; S33: The adjusted feature map The input is sent to the fully connected layer for feature integration. Specifically, the adjusted feature map is first pooled by global average pooling. Compress it into a vector V of fixed length, and then input the compressed vector V into the fully connected layer for feature integration to generate the final feature vector Z. The specific formula is as follows: , , The final vector is a vector containing the time characteristic information of the traffic file.

[0022] This embodiment proposes an encrypted traffic classification method based on spatiotemporal information fusion, which aims to capture the behavior pattern and structural information of network traffic and complete the feature extraction task with the help of graph neural network. Compared with convolutional neural networks and recurrent neural networks that only focus on spatial, temporal or statistical features, GraphSAGE can more effectively incorporate spatial topological structures into the learning process of node features through its unique node message passing mechanism, thereby directly and efficiently utilizing the rich structural information contained in network flow data.

[0023] The multimodal encrypted traffic classification method based on graph structure and matrix representation described in the present invention is based on graph structure and matrix representation, and uses stacked graph sampling and aggregation networks as graph encoders to deeply mine the implicit interaction information between traffic. GraphSAGE is a deep graph neural network algorithm designed for the limitations of graph convolutional network transductive learning. When processing traffic interaction graphs, for each node v in the graph, it performs a K-hop depth neighbor node Iterative sampling process. Subsequently, the feature sets of these neighbor nodes are integrated through the aggregation function to strengthen the embedded information representation of node v, effectively improving the ability to capture node characteristics.

[0024] S4: After embedding the session-level traffic graph in step S2, an N-layer GraphSAGE network with a skip connection mechanism is used to extract spatial features to obtain a spatial feature vector representation of the network traffic file. The specific implementation is as follows: K is the number of hops for aggregating node information in each iteration. In the layer, node v is based on the aggregated features of the sampled neighborhood N(v) It can be expressed as: , Where u represents the neighboring node, represents the embedding vector of node u in the previous layer, represents a differentiable aggregator function, where nodes are aggregated as Figure 6 As shown in the figure, the AGG aggregation function is used to iteratively aggregate the node features from the sampling neighborhood with its own node features, and the aggregated features of the sampling neighborhood are Embedding features with the previous layer nodes Finally, through the steps of nonlinear activation function PReLU, BatchNorm batch normalization, global average pooling, etc., the features of each node are integrated into a vector of fixed length. Then, after the processing of the fully connected layer and the Dropout layer, the final spatial embedding feature vector is obtained: , Concat represents a concatenation operation. is the weight, represents the PRelu activation function. The node aggregation process can be visually represented as Figure 6 , Taking node A as an example, a 2-hop deep neighborhood aggregation operation is performed on it. A's direct neighboring nodes include B, C, and D. Furthermore, the neighboring nodes of B, C, and D are (A, D), (A, D, E), and (B, A, C), respectively. First, the AGG aggregation function is used to integrate the features of the neighboring nodes of B, C, and D, and these aggregation results are spliced ​​with the features of the corresponding central nodes, namely B, C, and D. Then, the AGG aggregation function is applied again to comprehensively aggregate the three spliced ​​feature vectors, and finally the neighborhood aggregation features of node A are obtained; In view of the possible over-smoothing problem in the stacked graph neural network model, this embodiment adopts the idea of ​​skip connection to concatenate the output vectors of each node in each layer of the GraphSAGE network to form the final representation vector of the node. This process is as follows Figure 7 As shown, after that, by applying the mean pooling operation to all nodes, a single feature vector g representing the entire graph is generated, and its mathematical expression is: , in represents matrix addition, It refers to the final representation vector of each graph node; that is, the final embedding feature of the v-th node in the k-th layer; v is the number of graph nodes, and k represents the number of layers.

[0025] S5: Use the cross-gated feature fusion method to aggregate the temporal feature vector output in step S3 and the spatial feature vector output in step S4, and input the obtained aggregated vector into the downstream classifier to obtain the overall representation of the traffic features. The trained model is finally used for encrypted traffic classification: The time feature vector and the spatial structure feature vector come from different modal data and represent different meanings, so it is necessary to create a reasonable feature fusion relationship between the two to obtain the overall representation of the traffic. To this end, a cross-gated feature fusion mechanism is used to fuse the interactive features of the two into the final representation vector of the traffic: S51: After the feature vector passes through a filter consisting of a PRelu activation function and two linear layers, it is converted into the corresponding gating vector through the Sigmoid function. This filter can learn and adjust the importance of each feature in the feature fusion process. Subsequently, the Sigmoid function ensures that each element of the vector is compressed to the range of 0 to 1. The spatial gating vector obtained in this way is To filter the interactive feature vector , while using the interactive gating vector To filter the spatial feature vector ,This mechanism helps to capture the interaction between input features and retain key feature information. The process of cross-gated feature fusion can be achieved by Figure 8 The mathematical expression is as follows: , , , The symbol represents the element-by-element product, z is the overall representation vector of the flow, , , , are the weights of the linear layer, , , , is the bias of the linear layer; S52: Input the fused feature vector Z into the downstream module classifier. Adjust the format and dimension of the feature vector according to different classifiers (including Transformer, Bert, GRU, etc.) to adapt to the requirements of different models. After initializing the parameters of the classifier, input the feature vector Z into the classifier for forward propagation to obtain the prediction result of the model. , using the cross entropy loss function to calculate the model prediction results With the true label The gap between the two is calculated by back-propagation algorithm, and the gradient of the loss function with respect to the model parameters is calculated. The model parameters are updated using the Adam optimization algorithm to minimize the loss function. The training data is divided into 256 batches, and the process of forward propagation, loss calculation, back-propagation and parameter update is repeated to finally train a high-performance traffic classification model. S53: Apply the trained classification model to the test set. First, perform the same preprocessing steps on the test set as the training set, including traffic segmentation, feature extraction, feature fusion, etc., to generate the feature vector of the test set. , the feature vector of the test set The data is input into the trained classification model for forward propagation, and the final classification results and evaluation indicators are output to verify the performance and reliability of the model.

[0026] The scheme described in this embodiment uses an encrypted traffic classification model based on the original network traffic and its spatiotemporal characteristics to identify classified encrypted traffic. Different from the traditional method based on network traffic content analysis, the present invention analyzes the temporal information characteristics and spatial structural information characteristics of network traffic, adopts the model LSTM for processing time series and the strategic channel attention mechanism for focusing on key features to extract temporal features, adopts the improved graph convolutional network GraphSAGE to encode the spatial structural features of traffic files, respectively constructs vectors that can effectively represent temporal and spatial features, and finally fuses the two types of vectors to achieve an efficient and robust encrypted network traffic classification method.

[0027] like Fig. 9 As shown, this embodiment also provides a classification system based on the above-mentioned encrypted network traffic classification method based on spatiotemporal information fusion, including: The pre-processing module is used to: divide the original network traffic into sessions according to the five-tuple, intercept a fixed number of bytes of each message protocol layer, and remove duplicate traffic; The temporal feature extraction module includes a long short-term memory network (LSTM), a channel attention mechanism, and a fully connected layer, which is used to extract temporal information and local dependencies from the preprocessed traffic sequence; The spatial feature extraction module is used to: construct a session-level traffic graph and encode it with GraphSAGE, then aggregate the features of each node into a fixed-length vector through the nonlinear activation function PReLU, BatchNorm batch normalization, global average pooling, fully connected layer and Dropout layer, and finally aggregate them into a traffic file spatial feature vector through readout to capture the key information of the spatial level in the traffic sequence; The feature fusion classification module is used to aggregate the temporal feature vector and the spatial feature vector into the overall vector representation of the traffic file through the cross-gated fusion method, and obtain the final classification result through a variety of selected downstream classifiers. The confusion matrix of the classification results on the two public datasets ISCX-VPNnonVPN and USTC-TFC is shown in Figure 10 (a) and (b).

[0028] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for classifying encrypted network traffic based on spatiotemporal information fusion, characterized in that: The following steps are involved: S1: Divide the data packets in the original Pcap file into different sessions according to the five-tuple, intercept the bytes of the protocol layer of each message in the traffic, and perform data preprocessing; S2: converting the processed traffic in step S1 into a session flow multi-level representation sequence and a session-level traffic graph; S3: Through the multi-level representation sequence of the conversation flow in step S2, the long short-term memory network is used to extract the time-dependent information of the network traffic, the channel attention mechanism is used to enhance the importance of key features, and the feature vector of the traffic sequence is integrated through the fully connected layer; S4: After embedding the session-level traffic graph in step S2, an N-layer GraphSAGE network with a skip connection mechanism is used to extract spatial features, thereby obtaining a spatial feature vector representation of the network traffic file; S5: Use the cross-gated feature fusion method to aggregate the temporal feature vector output in step S3 and the spatial feature vector output in step S4, input the obtained aggregated vector into the downstream classifier to obtain the overall representation of the traffic features, and use the trained model to classify the encrypted traffic.

2. According to claim 1, a method for classifying encrypted network traffic based on spatiotemporal information fusion is characterized in that: The step S1 is specifically: S11: Use SplitCap to split the traffic in the original Pcap file into multiple independent session flows, and then execute the SplitCap command to save each session flow as a separate Pcap file according to the five-tuple information; S12: Use the Scapy library to preprocess the original Pcap file; S13: Use the Scapy library to replace the MAC address and IP address information, traverse the messages in each session flow, extract and replace the MAC address and IP address information; S14: traverse the messages in each session flow, extract the TCP payload information of each message, and for each message, intercept the first 784 bytes of the protocol layer data. If the data length is less than 784 bytes, fill it with 0 to 784 bytes.

3. According to claim 2, a method for classifying encrypted network traffic based on spatiotemporal information fusion is characterized in that: The step S12 comprises: S121: Use Scapy to read the original Pcap file and split the traffic into multiple independent session flows based on the five-tuple information; S122: traverse the messages in each session flow, use the hash value to detect and remove duplicate messages, and detect the integrity of each message; S123: Delete or replace the strong identification information that leaks the user's identity in the message, including: user agent string, Cookie; S124: filter protocol messages and retain TCP protocol messages; S125: Identify and remove abnormal sessions through statistical analysis and threshold setting, including sessions with extremely long duration, extremely large data volume, and a large number of messages in an extremely short period of time.

4. According to claim 1, the encrypted network traffic classification method based on spatiotemporal information fusion is characterized in that: The step S2 is specifically: S21: intercept the first P data packets of the session flow, and for each data packet, extract the first m bytes of its header data and the first n bytes of its payload data. If the length of the data packet, header data or payload data is insufficient, fill P, m and n with the number 0 respectively; If the length exceeds the specified value, the truncation operation is performed. The multi-level traffic representation is that each row of the matrix corresponds to a data packet, which consists of the header byte and the payload byte of the data packet. The one-dimensional representation matrix of P data packets is stacked to form a size of A two-dimensional representation sequence of ; S22: The session flow composed of data packets with the same five-tuple is used as a node of the graph, and the source IP address and the destination IP address of each node are checked by traversing the IP address information of each node.

5. According to claim 1, the encrypted network traffic classification method based on spatiotemporal information fusion is characterized in that: The step S3 comprises: S31: Multi-level representation of conversation flow sequence Input to the LSTM layer, where each Indicates Data packets, is the number of packets, the input sequence Input to the LSTM layer, LSTM captures the long-term dependencies in the time series through its internal gating mechanism and cell state. After the flow sequence is input, it is processed and outputs a hidden state of the time series. , each Indicates The hidden state of time steps; S32: The output of the LSTM layer The input is sent to the channel attention mechanism, which dynamically adjusts the importance of features on each channel by analyzing the global information on each feature channel, and compresses the features of each time step into a feature vector through global average pooling. , ， in is the number of time steps, is the feature dimension at each time step; The feature vector The weight of each channel is generated through two fully connected layers and Sigmoid activation function : ， ， ， ， Finally, the generated weight With the output of LSTM Multiply to get the adjusted features ; S33: The adjusted feature map Input to the fully connected layer for feature integration, specifically: the adjusted feature map is pooled by global average pooling Compress into a fixed-length vector , and then the compressed vector Input into the fully connected layer for feature integration to generate the final feature vector , the specific formula is as follows: ， ， The resulting vector is a vector containing the time characteristic information of the traffic file.

6. The encrypted network traffic classification method based on spatiotemporal information fusion according to claim 1 is characterized in that: The step S5 comprises: S51: After the feature vector passes through a filter consisting of a PRelu activation function and two linear layers, it is converted into the corresponding gating vector through the Sigmoid function. To filter the time feature vector , while using the spatiotemporal gating vector To filter the spatial feature vector , the process of cross-gated feature fusion is expressed as: ， ， ， The symbol represents element-wise product, is the overall representation vector of the flow, , , , are the weights of the linear layer, , , , is the bias of the linear layer; S52: The fused feature vector Input into the downstream module classifier, adjust the format and dimension of the feature vector according to different classifiers, initialize the parameters of the classifier, and then convert the feature vector Input into the classifier for forward propagation to obtain the model's prediction results , using the cross entropy loss function to calculate the model prediction results With the true label The gap between them is calculated by back-propagation algorithm, and the gradient of loss function with respect to model parameters is calculated. The model parameters are updated using Adam optimization algorithm. The training data is divided into 256 batches, and the process of forward propagation, loss calculation, back-propagation and parameter update is repeated. S53: Apply the trained classification model to the test set, and perform the same preprocessing steps on the test set as the training set, including traffic segmentation, feature extraction, and feature fusion, to generate the feature vector of the test set. , the feature vector of the test set Input into the trained classification model for forward propagation, and output the final classification results and evaluation indicators.

7. A classification system based on the encrypted network traffic classification method based on spatiotemporal information fusion as claimed in claim 1, characterized in that: include: The pre-processing module is used to: divide the original network traffic into sessions according to the five-tuple, intercept a fixed number of bytes of each message protocol layer, and remove duplicate traffic; The temporal feature extraction module includes a long short-term memory network (LSTM), a channel attention mechanism, and a fully connected layer, which is used to extract temporal information and local dependencies from the preprocessed traffic sequence; The spatial feature extraction module is used to: construct a session-level traffic graph and encode it with GraphSAGE, then aggregate the features of each node into a fixed-length vector through the nonlinear activation function PReLU, BatchNorm batch normalization, global average pooling, fully connected layer and Dropout layer, and finally aggregate them into a traffic file spatial feature vector through readout to capture the key information of the spatial level in the traffic sequence; The feature fusion classification module is used to aggregate the temporal feature vector and the spatial feature vector into the overall vector representation of the traffic file through the cross-gated fusion method, and obtain the final classification result through a variety of selected downstream classifiers. The confusion matrix of the classification results on the two public datasets ISCX-VPNnonVPN and USTC-TFC is shown.

Images