A method and system for classifying encrypted network traffic based on spatiotemporal information fusion

Abstract

The application discloses a kind of based on spatiotemporal information fusion's encrypted network flow classification method and system, mainly related to information security technical field. Including: data is obtained from original Pcap file and data pre-processing is carried out;The traffic after being processed is respectively converted into session flow multistage representation sequence and session level traffic graph;Through session flow multistage representation sequence, feature vector integration is carried out to flow sequence;After embedding to session level traffic graph, the spatial feature vector representation of network traffic file is obtained;Cross-gated feature fusion method is used to aggregate time feature vector and spatial feature vector, obtain the overall representation of flow feature, and the model trained is used to carry out encrypted flow classification.The beneficial effects of the application are that it improves the encrypted flow classification effect while effectively enhancing the feature representation capability of the model.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology based on dynamic potential perception in cyberspace, specifically a method and system for classifying encrypted network traffic based on spatiotemporal information fusion. Background Technology

[0002] With the rapid pace of the information age, a plethora of new network applications are emerging, leading to an explosive growth in internet traffic. Accurately classifying network traffic is crucial for optimizing network resource management, ensuring service quality, and supporting service providers in offering customized services. Given that more and more network communications are adopting encryption protocols such as Internet Security Protocol (IPsec) and Transport Layer Security (TLS) to protect user privacy, encrypted traffic now accounts for a large portion of total network traffic. While these encryption measures improve communication security, they also bring new challenges because they obscure the specific content of traffic, increasing the difficulty of traffic analysis. Considering the characteristics of the current network environment, network traffic classification technology plays an increasingly important role in monitoring network security incidents and perceiving network conditions to ensure cyberspace security. This technology is not only a key means of distinguishing normal network activity from potentially malicious traffic but also an important tool for promoting the development of network security research and practical applications. Therefore, developing effective encrypted traffic classification methods has profound significance for improving network security levels.

[0003] Currently, encrypted traffic classification methods have been extensively studied. Based on their chronological order of appearance, these methods can be categorized into rule-matching-based methods, machine learning based on statistical features, deep learning methods based on feature extraction, and pre-trained methods. Rule-matching-based methods identify specific traffic patterns using predefined rule sets, but the maintenance and updating of these rule sets are costly, and they struggle to cope with newly emerging encrypted traffic patterns, exhibiting poor flexibility. Machine learning methods based on statistical features classify traffic by extracting statistical characteristics (such as packet length and arrival time intervals), but the feature selection and extraction process is complex, and they are poorly adaptable to new traffic types. Deep learning methods based on feature extraction automatically learn features through neural networks, requiring large amounts of labeled data for training, resulting in high model complexity and computational resource consumption. Pre-trained methods are highly dependent on the selection of the pre-trained model and fine-tuning strategies, which significantly impact the final performance, and may be limited by the amount of pre-trained data available.

[0004] In addition, traditional network security detection methods focus more on detecting the content of traffic, rather than classifying encrypted traffic based on the structure and characteristics of the traffic data itself. Therefore, classifying encrypted traffic accurately and effectively remains a challenging task.

[0005] To address the above issues, designing an encrypted traffic classification method that balances improving classification accuracy with utilizing the structural information of the traffic itself is a problem that urgently needs to be solved in this field. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for classifying encrypted network traffic based on spatiotemporal information fusion, which improves the classification effect of encrypted traffic and effectively enhances the feature representation capability of the model.

[0007] To achieve the above objectives, the present invention employs the following technical solution:

[0008] On the one hand, this invention provides a method for classifying encrypted network traffic based on spatiotemporal information fusion, comprising the following steps:

[0009] S1: Divide the data packets in the original Pcap file into different sessions according to the five-tuple, extract the protocol layer bytes of each packet in the traffic, and perform data preprocessing;

[0010] S2: Convert the traffic processed in step S1 into a session flow multilevel representation sequence and a session-level traffic graph, respectively.

[0011] S3: By using the multi-level representation sequence of the session flow in step S2, the time-dependent information of the network traffic is extracted using a long short-term memory network, the importance of key features is enhanced by a channel attention mechanism, and the feature vectors of the traffic sequence are integrated through a fully connected layer.

[0012] S4: By embedding the session-level traffic graph in step S2, spatial features are extracted using an N-layer GraphSAGE network with a skip connection mechanism to obtain the spatial feature vector representation of the network traffic file;

[0013] S5: Use the cross-gated feature fusion method to aggregate the temporal feature vector output in step S3 and the spatial feature vector output in step S4. Input the resulting aggregated vector into the downstream classifier to obtain the overall representation of the traffic features, and use the trained model to perform encrypted traffic classification.

[0014] Preferably, step S1 specifically includes:

[0015] S11: Use SplitCap to split the traffic in the original Pcap file into multiple independent session streams, and then execute the SplitCap command to save each session stream as a separate Pcap file based on the 5-tuple information;

[0016] S12: Use the Scapy library to preprocess the raw Pcap file;

[0017] S13: Use the Scapy library to replace MAC address and IP address information, traverse the packets in each session stream, extract and replace MAC address and IP address information;

[0018] S14: Traverse the packets in each session stream, extract the TCP payload information of each packet, and for each packet, extract the first 784 bytes of protocol layer data. If the data length is less than 784 bytes, pad it with 0 to 784 bytes.

[0019] Preferably, step S12 includes:

[0020] S121: Use Scapy to read the raw Pcap file and split the traffic into multiple independent session streams based on the 5-tuple information;

[0021] S122: Traverse the messages in each session stream, use hash values ​​to detect and remove duplicate messages, and check the integrity of each message;

[0022] S123: Delete or replace strong identifying information in the message that reveals the user's identity, including: user agent string, Cooki;

[0023] S124: Filter protocol messages, retaining TCP protocol messages;

[0024] S125: Identify and remove abnormal sessions through statistical analysis and threshold settings, including sessions with extremely long durations, extremely large data volumes, and a large number of messages within a very short period of time.

[0025] Preferably, step S2 specifically includes:

[0026] S21: Extract the first P data packets of the session stream. For each data packet, extract the first m bytes of its header data and the first n bytes of its payload data. If the length of the data packet, header data, or payload data is insufficient, pad it with zeros to P, m, and n respectively. If the length exceeds the specified value, perform a truncation operation. The multi-level representation of the traffic is that each row of the matrix corresponds to a data packet, consisting of the header bytes and payload bytes of the data packet. The one-dimensional representation matrix of P data packets is stacked to form a matrix of size P. Two-dimensional representation sequence;

[0027] S22: Take the session stream consisting of packets with the same 5-tuple as nodes of the graph, and check the source IP address and destination IP address of each node by traversing the IP address information of each node.

[0028] Preferably, step S3 includes:

[0029] S31: Represent the session stream as a multi-level sequence The input is fed into the LSTM layer, where each Indicates the first One data packet, The number of data packets, the input sequence The input is fed into an LSTM layer, where the LSTM uses its internal gating mechanism and cell state to capture long-term dependencies in the time series. After processing, the input flow sequence outputs a hidden state of the time series. each Indicates the first The hidden state at each time step;

[0030] S32: Output of the LSTM layer The input is fed into the channel attention mechanism, which dynamically adjusts the importance of features in each channel by analyzing global information in each feature channel, and compresses the features at each time step into a feature vector through global average pooling. ,

[0031] ,

[0032] in It is the number of time steps. It is the feature dimension of each time step;

[0033] The feature vector The weights for each channel are generated using two fully connected layers and a sigmoid activation function. :

[0034] ,

[0035] ,

[0036] ,

[0037] ,

[0038] Finally, the generated weights will be... With LSTM output Multiplication yields the adjusted features ;

[0039] S33: Adjust the feature map The input is fed into a fully connected layer for feature integration, specifically: the adjusted feature map is integrated using global average pooling. Compress into a fixed-length vector Then compress the vector The input is fed into a fully connected layer for feature integration, generating the final feature vector. The specific formula is as follows:

[0040] ,

[0041] ,

[0042] The resulting vector It is a vector containing the time characteristics of the traffic file.

[0043] Preferably, step S5 includes:

[0044] S51: The feature vector passes through a filter consisting of a PRelu activation function and two linear layers, and then is transformed into a corresponding gated vector by a Sigmoid function. The resulting spatial gated vector... To filter time feature vectors Simultaneously using spatiotemporal gating vectors To filter spatial feature vectors The process of cross-gated feature fusion is represented as follows:

[0045] ,

[0046] ,

[0047] ,

[0048] Among the symbols Represents element-wise product. It is the overall representation vector of the flow. , , , These are the weights of the linear layer. , , , It is the deviation of the linear layer;

[0049] S52: Combine the fused feature vectors The input is fed into the downstream module classifier. The format and dimensions of the feature vector are adjusted according to different classifiers. After initializing the classifier parameters, the feature vector is... The input is fed into the classifier for forward propagation to obtain the model's prediction results. The model prediction results are calculated using the cross-entropy loss function. With real labels The difference between them is calculated by backpropagation algorithm to calculate the gradient of the loss function with respect to the model parameters, and the model parameters are updated using Adam optimization algorithm. The training data is divided into 256 batches, and the process of forward propagation, loss calculation, backpropagation and parameter update is repeated.

[0050] S53: Apply the trained classification model to the test set, performing the same preprocessing steps on the test set as on the training set, including traffic segmentation, feature extraction, and feature fusion, to generate the feature vector for the test set. , the feature vector of the test set The data is fed into a trained classification model for forward propagation, and the final classification result and evaluation metric are output.

[0051] On the other hand, a classification system based on the above-mentioned encrypted network traffic classification method based on spatiotemporal information fusion is provided, including:

[0052] The preprocessing module is used to: divide the raw network traffic into sessions according to the five-tuple, extract a fixed number of bytes from the protocol layer of each message, and remove duplicate traffic;

[0053] The temporal feature extraction module includes a Long Short-Term Memory (LSTM) network, a channel attention mechanism, and a fully connected layer, used to extract temporal information and local dependencies from the preprocessed traffic sequence.

[0054] The spatial feature extraction module is used to: construct a session-level traffic graph and encode the graph using GraphSAGE, then aggregate the features of each node into a fixed-length vector through non-linear activation functions PReLU, BatchNorm batch normalization, and global average pooling, followed by a fully connected layer and a Dropout layer, and finally aggregate them into a spatial feature vector of the traffic file through readout, in order to capture key spatial information in the traffic sequence.

[0055] The feature fusion classification module is used to: aggregate the temporal feature vector and spatial feature vector into a total vector representation of the traffic file through a cross-gating fusion method, and obtain the final classification result through multiple downstream classifiers, and generate the confusion matrix of the classification results on two public datasets, ISCX-VPNnonVPN and USTC-TFC.

[0056] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0057] 1. The method in this invention uses LSTM and channel attention mechanism to capture temporal features, and extracts spatial features by constructing session-level traffic graphs and applying GraphSAGE coding technology, thereby enhancing the expressiveness of key features and significantly improving the effect of encrypted traffic classification.

[0058] 2. In this invention, the proposed encrypted network traffic classification method based on spatiotemporal information fusion adopts a cross-gating mechanism to achieve effective fusion of hierarchical spatial features and time series features, forming the final representation vector of traffic, which effectively enhances the feature representation capability of the model, while reducing the additional noise introduced by irrelevant features, and improving the performance and generalization ability of the model.

[0059] 3. Experimental results show that the encrypted network traffic classification method based on spatiotemporal information fusion in this invention achieves multi-class F1 scores of 99.13% and 98.65% on the two public datasets USTC-TFC and ISCX-VPNnonVPN, respectively, demonstrating the method's excellent ability in feature representation and identification of encrypted traffic. Attached Figure Description

[0060] Figure 1 This is a flowchart of the method of the present invention;

[0061] Figure 2 This is a flowchart of the data preprocessing process of the present invention;

[0062] Figure 3 This is a flowchart of the session-level traffic graph construction process of the present invention;

[0063] Figure 4 This is a schematic diagram of the LSTM process for processing time series data of traffic files according to the present invention;

[0064] Figure 5 This is a schematic diagram of the channel attention mechanism of the present invention;

[0065] Figure 6 This is a schematic diagram of GraphSAGE node aggregation according to the present invention;

[0066] Figure 7 This is a schematic diagram of the multi-layered GraphSAGE architecture of the present invention;

[0067] Figure 8 This is a schematic diagram of the cross-gating feature fusion of the present invention;

[0068] Figure 9 This is a schematic diagram of the system structure of the present invention;

[0069] Figures 10(a) and (b) are schematic diagrams of the confusion matrices of the classification results of the present invention on the USTC-TFC and ISCX-VPNnonVPN datasets, respectively. Detailed Implementation

[0070] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined in this application.

[0071] In this invention, terms such as "upper," "lower," "left," "right," "front," "back," "vertical," "horizontal," "side," and "bottom" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used only to facilitate the description of the structural relationships of the various components or elements of this invention and do not specifically refer to any component or element in this invention. They should not be construed as limiting the invention.

[0072] Example:

[0073] like Figure 1 As shown, this embodiment provides a method for classifying encrypted network traffic based on spatiotemporal information fusion, including:

[0074] S1: Divide the data packets in the original Pcap file into different sessions according to the five-tuples, extract the first 784 bytes of the protocol layer of each packet in the traffic, remove duplicate traffic, and store it. The preprocessing process is as follows: Figure 2 As shown, the specific implementation is as follows:

[0075] S11: Use the traffic splitting tool SplitCap. This tool can split the traffic in the original Pcap file into multiple independent session streams based on the five-tuple information (source IP address, destination IP address, source port, destination port, transport layer protocol). Run the SplitCap command, specify the input Pcap file path and output directory, and SplitCap will save each session stream as a separate Pcap file based on the five-tuple information for easy subsequent processing.

[0076] S12: In order to preprocess the original Pcap file, this embodiment uses the Scapy library to complete the following steps:

[0077] First, Scapy is used to read the raw Pcap file and the traffic is split into multiple independent session streams based on the 5-tuple information;

[0078] Next, by examining the messages in each session stream, duplicate messages are detected and removed using hash values. At the same time, the integrity of each message is checked, and messages containing incorrect checksums, invalid lengths, or other corrupted flags are excluded.

[0079] In addition, delete or replace strong identifying information in the message that may reveal the user's identity, including user agent strings and cookies;

[0080] Then, filter out protocol messages that are irrelevant to the research objective and keep only TCP protocol messages;

[0081] Finally, through statistical analysis and threshold setting, sessions that are obviously abnormal are identified and removed, including sessions with extremely long durations, extremely large data volumes, and a large number of messages in a very short period of time.

[0082] S13: In this embodiment, the Scapy library is used to replace MAC address and IP address information. It iterates through the packets in each session flow, extracts and replaces MAC address and IP address information. For each packet, the source MAC address and destination MAC address are replaced with "00:00:00:00:00:00", and the source IP address and destination IP address are replaced with "0.0.0.0" (IPv4) and "::" (IPv6).

[0083] S14: Traverse the packets in each session stream, extract the TCP payload information of each packet, and for each packet, extract the first 784 bytes of protocol layer data. If the data length is less than 784 bytes, pad it with 0 to 784 bytes.

[0084] S2: Convert the traffic processed in step S1 into a session flow multi-level representation sequence and a session-level traffic graph, respectively. The specific implementation is as follows:

[0085] S21: Extract the first P data packets of the session stream. For each data packet, extract the first m bytes of its header data and the first n bytes of its payload data. If the length of the data packet, header data, or payload data is insufficient, pad it with zeros to P, m, and n respectively. If the length exceeds the specified value, perform a truncation operation. The multi-level representation of the traffic is that each row of the matrix corresponds to a data packet, consisting of the header bytes and payload bytes of the data packet. The one-dimensional representation matrix of P data packets is stacked to form a matrix of size P. Two-dimensional representation sequence;

[0086] S22: Treat the session flow consisting of packets with the same 5-tuple as nodes in the graph, such as... Figure 3 As shown, by traversing the IP address information of each node, the source IP address and destination IP address of each node are checked. Specifically, for each pair of nodes, if the source IP address or destination IP address of one node is the same as the source IP address or destination IP address of the other node, then an edge is established between the two nodes.

[0087] S3: By using a Long Short-Term Memory network to extract the time-dependent information of network traffic from the multi-level representation sequence of the session flow in step S2, and a channel attention mechanism to enhance the importance of key features, the feature vectors of the traffic sequence are finally integrated through a fully connected layer. The specific implementation is as follows:

[0088] S31: Represent the session stream as a multi-level sequence The input is fed into the LSTM layer, where each Let X represent the i-th data packet, and P be the number of data packets. The input sequence X is fed into the LSTM layer. LSTM uses its internal gating mechanisms (forget gate, input gate, output gate) and cell states to capture long-term dependencies in the time series. The working principle of LSTM is as follows: Figure 4 As shown, after the flow sequence is input and processed, a time series hidden state is output. each This represents the hidden state at time step t, which contains the time dependency information of the input data;

[0089] S32: The output H of the LSTM layer is input into the channel attention mechanism. The channel attention mechanism dynamically adjusts the importance of features in each channel by analyzing global information in each feature channel, thereby enhancing the focus on key features of the task. (See diagram below.) Figure 5 As shown, this invention compresses the features at each time step into a feature vector through global average pooling. ,

[0090] ,

[0091] Where P is the number of time steps, and d is the feature dimension of each time step;

[0092] Then, the feature vector F is passed through two fully connected layers and a sigmoid activation function to generate the weight S for each channel.

[0093] ,

[0094] ,

[0095] ,

[0096] ,

[0097] Finally, the generated weight S is multiplied by the LSTM output H to obtain the adjusted features. ;

[0098] S33: Adjust the feature map The input is fed into a fully connected layer for feature integration. Specifically, the adjusted feature map is first integrated using global average pooling. The vector is compressed into a fixed-length vector V, and then the compressed vector V is input into a fully connected layer for feature integration to generate the final feature vector Z. The specific formula is as follows:

[0099] ,

[0100] ,

[0101] The final vector obtained It is a vector containing the time characteristics of the traffic file.

[0102] This embodiment proposes an encrypted traffic classification method based on spatiotemporal information fusion, which aims to capture the behavioral patterns and structural information of network traffic and complete the feature extraction task with the help of graph neural networks. Compared with convolutional neural networks and recurrent neural networks that only focus on spatial, temporal or statistical features, GraphSAGE can more effectively incorporate spatial topology into the node feature learning process through its unique node message passing mechanism, thereby directly and efficiently utilizing the rich structural information contained in network flow data.

[0103] The multimodal encrypted traffic classification method based on graph structure and matrix representation described in this invention utilizes stacked graph sampling and aggregation networks as a graph encoder to deeply mine the implicit interaction information between traffic flows. GraphSAGE, a deep graph neural network algorithm designed to address the limitations of transduction learning in graph convolutional networks, performs a K-hop depth search of neighboring nodes for each node v in the traffic interaction graph when processing the graph. The process involves iterative sampling. Subsequently, the feature sets of these neighboring nodes are integrated through an aggregation function, thereby strengthening the embedded information representation of node v and effectively improving the ability to capture node characteristics.

[0104] S4: After embedding the session-level traffic graph in step S2, spatial features are extracted using an N-layer GraphSAGE network with a skip connection mechanism to obtain the spatial feature vector representation of the network traffic file. The specific implementation is as follows:

[0105] K is the number of hops for aggregating node information in each iteration, in the 1st... In the layer, node v is based on the aggregation features of its sampling neighborhood N(v). It can be represented as:

[0106] ,

[0107] Where u represents a neighboring node. This represents the embedding vector of node u in the previous layer. This represents a differentiable aggregator function, where node aggregation is as follows: Figure 6 As shown, the AGG aggregation function iteratively aggregates node features from the sampling neighborhood with its own node features, thus aggregating the features of the sampling neighborhood. Embedded features with the previous layer nodes The features from each node are connected and then integrated into a fixed-length vector through steps such as the non-linear activation function PReLU, batch normalization using BatchNorm, and global average pooling. This vector is then processed by fully connected layers and Dropout layers to obtain the final spatial embedding feature vector.

[0108] ,

[0109] Where Concat represents a chain operation. As weight, This represents the PReLU activation function. The node aggregation process can be visualized as follows: Figure 6 Taking node A as an example, a 2-hop depth neighborhood aggregation operation is performed on it. The direct neighbors of A include B, C, and D. Furthermore, the neighbors of B, C, and D are (A, D), (A, D, E), and (B, A, C), respectively. First, the features of the neighbors of B, C, and D are integrated using the AGG aggregation function, and these aggregation results are concatenated with the features of the corresponding central nodes, namely B, C, and D themselves. Then, the AGG aggregation function is applied again to comprehensively aggregate these three concatenated feature vectors, and finally the neighborhood aggregation features of node A are obtained.

[0110] To address the potential oversmoothing issue in stacked graph neural network models, this embodiment employs skip connections, concatenating the output vectors of each node in each layer of the GraphSAGE network to form the final representation vector of that node. This process is as follows: Figure 7 As shown, then, by applying mean pooling to all nodes, a single feature vector g representing the entire graph is generated, whose mathematical expression is:

[0111] ,

[0112] in Represents matrix addition. This refers to the final representation vector of each graph node; that is, the final embedded feature of node v in the k-th layer; v is the number of graph nodes, and k represents the layer number.

[0113] S5: The cross-gated feature fusion method is used to aggregate the temporal feature vector output in step S3 and the spatial feature vector output in step S4. The resulting aggregated vector is input into the downstream classifier to obtain the overall representation of the traffic features. The trained model is finally used for encrypted traffic classification.

[0114] Temporal feature vectors and spatial structure feature vectors come from different modalities and represent different meanings. Therefore, it is necessary to create a reasonable feature fusion relationship between the two to obtain a holistic representation of the traffic. To this end, a cross-gated feature fusion mechanism is used to fuse the interaction features of the two into the final traffic representation vector.

[0115] S51: The feature vector passes through a filter consisting of a PRelu activation function and two linear layers, and then is transformed into a corresponding gated vector by a Sigmoid function. This filter can learn and adjust the importance of each feature during feature fusion. Subsequently, the Sigmoid function ensures that each element of the vector is compressed to the range of 0 to 1. The resulting spatially gated vector is then used. To filter interaction feature vectors Simultaneously using interactive gating vectors To filter spatial feature vectors This mechanism helps capture the interactions between input features and retains key feature information. The cross-gated feature fusion process can be achieved through... Figure 8 To illustrate this intuitively, the mathematical expression is shown below:

[0116] ,

[0117] ,

[0118] ,

[0119] Among the symbols Let z represent element-wise product, and z be the global representation vector of the flow. , , , These are the weights of the linear layer. , , , It is the deviation of the linear layer;

[0120] S52: The fused feature vector Z is input into the downstream module classifier. The format and dimensions of the feature vector are adjusted according to different classifiers (including Transformer, BERT, GRU, etc.) to adapt to the requirements of different models. After initializing the classifier parameters, the feature vector Z is input into the classifier for forward propagation to obtain the model's prediction result. The model prediction results are calculated using the cross-entropy loss function. With real labels The difference between them is calculated by backpropagation algorithm to calculate the gradient of the loss function with respect to the model parameters, and the Adam optimization algorithm is used to update the model parameters to minimize the loss function. The training data is divided into 256 batches, and the process of forward propagation, loss calculation, backpropagation and parameter update is repeated to finally train a high-performance traffic classification model.

[0121] S53: Apply the trained classification model to the test set. First, perform the same preprocessing steps on the test set as on the training set, including traffic segmentation, feature extraction, and feature fusion, to generate the feature vector of the test set. , the feature vector of the test set The data is fed into a trained classification model for forward propagation, and the final classification result and evaluation metrics are output to verify the model's performance and reliability.

[0122] The scheme described in this embodiment uses an encrypted traffic classification model based on the original network traffic and its spatiotemporal characteristics to identify and classify encrypted traffic. Unlike traditional methods based on network traffic content analysis, this invention analyzes the temporal and spatial structural information features of network traffic. It employs an LSTM model (for processing time series data) and a channel attention mechanism (focusing on key features) to extract temporal features, and uses an improved graph convolutional network (GraphSAGE) to encode the spatial structural features of the traffic file. Vectors that effectively represent both temporal and spatial features are constructed, and finally, the two types of vectors are fused to achieve an efficient and robust encrypted network traffic classification method.

[0123] like Figure 9 As shown, this embodiment also provides a classification system based on the above-mentioned encrypted network traffic classification method based on spatiotemporal information fusion, including:

[0124] The preprocessing module is used to: divide the raw network traffic into sessions according to the five-tuple, extract a fixed number of bytes from the protocol layer of each message, and remove duplicate traffic;

[0125] The temporal feature extraction module includes a Long Short-Term Memory (LSTM) network, a channel attention mechanism, and a fully connected layer, used to extract temporal information and local dependencies from the preprocessed traffic sequence.

[0126] The spatial feature extraction module is used to: construct a session-level traffic graph and encode the graph using GraphSAGE, then aggregate the features of each node into a fixed-length vector through non-linear activation functions PReLU, BatchNorm batch normalization, and global average pooling, followed by a fully connected layer and a Dropout layer, and finally aggregate them into a spatial feature vector of the traffic file through readout, in order to capture key spatial information in the traffic sequence.

[0127] The feature fusion classification module is used to aggregate the temporal feature vector and spatial feature vector into a total vector representation of the traffic file through a cross-gating fusion method, and obtain the final classification result through multiple downstream classifiers. The confusion matrix of the classification results on the two public datasets ISCX-VPNnonVPN and USTC-TFC is shown in Figure 10(a) and (b).

[0128] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A method for encrypted network traffic classification based on spatio-temporal information fusion, characterized in that, The method comprises the following steps: S1: dividing packets in the original Pcap file into different sessions according to the five-tuple, intercepting the bytes of the protocol layer of each message in the traffic, and performing data preprocessing; S2: converting the traffic processed in step S1 into a session flow multi-level representation sequence and a session-level traffic graph, respectively; S3: extracting the time-dependent information of the network traffic using a long short-term memory network, enhancing the importance of key features using a channel attention mechanism, and integrating the feature vectors of the traffic sequence through a fully connected layer, based on the session flow multi-level representation sequence in step S2; S4: extracting spatial features using an N-layer GraphSAGE network with a skip connection mechanism based on the session-level traffic graph embedded in step S2, to obtain a spatial feature vector representation of the network traffic file; S5: using a cross-gated feature fusion method to aggregate the time feature vector output in step S3 and the spatial feature vector output in step S4, inputting the aggregated vector into a downstream classifier to obtain the overall representation of the traffic features, and using the trained model to classify encrypted traffic.

2. The method of claim 1, wherein, The step S1 specifically comprises: S11: using SplitCap to split the traffic in the original Pcap file into multiple independent session flows, and then executing the SplitCap command to save each session flow as a separate Pcap file according to the five-tuple information; S12: preprocessing the original Pcap file using the Scapy library; S13: replacing MAC address and IP address information using the Scapy library, traversing each message in each session flow, and extracting and replacing MAC address and IP address information; S14: traversing each message in each session flow, extracting TCP payload information of each message, and for each message, intercepting the first 784 bytes of protocol layer data, and if the data length is less than 784 bytes, filling with 0 to 784 bytes.

3. The method of claim 2, wherein, The step S12 comprises: S121: reading the original Pcap file using Scapy, and splitting the traffic into multiple independent session flows according to the five-tuple information; S122: traversing each message in each session flow, detecting and removing duplicate messages using a hash value, and detecting the integrity of each message; S123: deleting or replacing strong identification information that reveals the identity of the user in the message, including: user agent string, Cookie; S124: filtering protocol messages, and retaining TCP protocol messages; S125: identifying and removing abnormal sessions through statistical analysis and threshold setting, including: sessions with super-long time, super-large data volume, and a large number of messages in a very short time.

4. The method of claim 1, wherein, The step S2 specifically comprises: S21: intercepting the first P packets of the session flow, for each packet, extracting the first m bytes of the header data and the first n bytes of the payload data, and if the length of the packet, the header data, or the payload data is insufficient, filling with 0 to P, m, and n, respectively; If the length exceeds the specified value, a truncation operation is performed, and the multi-stage flow is represented as a matrix, each row of which corresponds to a data packet, which is composed of the header bytes and the payload bytes of the data packet. The one-dimensional representation of P data packets is stacked to form a two-dimensional representation sequence with a size of . S22: forming a session flow with packets having the same five-tuple as a node of a graph, and checking the source IP address and the destination IP address of each node by traversing the IP address information of each node.

5. The method of claim 1, wherein, The step S3 comprises: S31: Represent the session stream in a multi-level sequence The input is fed into the LSTM layer, where each Indicates the first One data packet, The number of data packets, the input sequence The input is fed into an LSTM layer, where the LSTM uses its internal gating mechanism and cell state to capture long-term dependencies in the time series. After processing, the input flow sequence outputs a hidden state of the time series. each Indicates the first The hidden state at each time step; S32: output of the LSTM layer is input into a channel attention mechanism, which dynamically adjusts the importance of features on each channel by analyzing global information on each feature channel, and compresses the features at each time step into a feature vector through global average pooling ,​ ， wherein is the number of time steps, is the feature dimension of each time step; The feature vector The weights for each channel are generated by two fully connected layers and a sigmoid activation function : ， ， ， ， Finally the generated weights are multiplied with the output of the LSTM to get the adjusted features ; S33: input the adjusted feature map into a fully connected layer for feature integration, specifically, the adjusted feature map is compressed into a fixed-length vector through global average pooling Then, the compressed vector is input into a fully connected layer for feature integration to generate the final feature vector The specific formula is as follows:​​​ ， ， The resulting vector is a vector containing the time characteristic information of the flow file.

6. The method of claim 1, wherein, The step S5 comprises: S51: the feature vector is converted into a corresponding gate vector through a filter composed of a PReLu activation function and two linear layers, and the spatial gate vector obtained is used to screen the time feature vector the spatial gate vector is used to filter the spatial feature vector The process of cross-gate feature fusion is represented as:​​ ， ， ， where the notation represents element-wise multiplication, is an overall representation vector of the flow, , , , is a weight of a linear layer, , , , is a bias of a linear layer; S52: the fused feature vector is input into a downstream module classifier, the format and dimension of the feature vector are adjusted according to different classifiers, and after the parameters of the classifier are initialized, the feature vector is input into the classifier for forward propagation to obtain a prediction result of the model , a cross-entropy loss function is used to calculate the gap between the prediction result of the model and the real label , the gradient of the loss function with respect to the model parameters is calculated by a back propagation algorithm, the model parameters are updated using an Adam optimization algorithm, the training data is divided into 256 batches, and the processes of forward propagation, loss calculation, back propagation and parameter updating are repeated; S53: Apply the trained classification model to the test set, and perform the same preprocessing steps as the training set, including traffic segmentation, feature extraction, and feature fusion, to generate the feature vectors of the test set , input the feature vectors of the test set into the trained classification model for forward propagation, and output the final classification results and evaluation indicators.

7. A classification system based on the encryption network traffic classification method based on spatio-temporal information fusion according to claim 1, characterized in that, Comprise: The preprocessing module is used for: dividing the original network traffic into sessions according to five tuples, intercepting a fixed number of bytes of each message protocol layer, and clearing repeated traffic; The time feature extraction module comprises: a long short-term memory network (LSTM), a channel attention mechanism and a full connection layer, and is used for: extracting time information and local dependence from the preprocessed traffic sequence; The spatial feature extraction module is used for: constructing a session-level traffic graph and GraphSAGE graph coding, then passing through a nonlinear activation function PReLU, a BatchNorm batch normalization, a global average pooling to summarize the features of each node into a fixed-length vector, a full connection layer and a Dropout layer, and finally aggregating into a traffic file spatial feature vector through readout to capture key information in the spatial level of the traffic sequence; The feature fusion classification module is used for: aggregating the time feature vector and the spatial feature vector into the overall vector representation of the traffic file through a cross-gate fusion method, and obtaining the final classification result through a plurality of selected downstream classifiers, and the confusion matrix of the classification result on the two public data sets of ISCX-VPNnonVPN and USTC-TFC.

Images