Encrypted traffic classification method and classification model based on network byte traffic diagram

Abstract

The invention aims to provide an encrypted traffic classification method and classification model based on a dual network byte traffic diagram, and belongs to the technical field of information security. According to the method, a position one-hot coding technology is innovatively applied to construction of vertexes of a byte traffic diagram, a position window is introduced to construct edges, position information is successfully integrated into a traffic diagram structure, and potential original features in traffic are mined; the method comprises the following steps: constructing a traffic diagram based on position codes of a head byte and a load byte of a data packet, extracting features of the head byte traffic diagram and the load byte traffic diagram, performing cross feature fusion on the two features, and finally completing classification of encrypted traffic by adopting a bidirectional LSTM (Long Short Term Memory) based on the time sequence of the traffic. A double graph and feature fusion mode is adopted, and the flow is represented more comprehensively in terms of semantics and space structures. Compared with a current encrypted traffic classification method, the method has higher recognition accuracy and can be applied to an actual generation environment.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to an encrypted traffic classification method and a classification model based on a network byte traffic graph. Background Art

[0002] As people's demand for personal privacy and data security continues to increase, encrypted traffic has become the mainstream of the online world. However, attackers are also using encryption technology to evade detection of their malicious activities. In addition, attackers use some privacy-enhancing tools, such as TOR and VPN, to conduct illegal network transactions. Moreover, most ransomware disguises itself through encrypted traffic. Therefore, classifying encrypted network traffic has become a very challenging task.

[0003] The application scope of encrypted network traffic classification technology is very wide. In service quality management (QoS), if the type of traffic can be identified, network equipment and service providers can prioritize high-priority traffic and ensure the performance of critical applications, especially when the network is congested. In malware and intrusion detection, encrypted network traffic classification technology can help identify malicious behaviors in the network, including spreading malware, launching DDos attacks, etc., and improve the efficiency of intrusion detection. In addition, the classification of encrypted network traffic helps to analyze the behavioral characteristics of different types of traffic, such as the spread of malware, the behavior patterns of attackers, etc., to help network security teams better respond to potential threats.

[0004] At present, the mainstream encrypted traffic classification methods are mainly based on machine learning and deep learning. Machine learning methods extract manually designed statistical features from network traffic and then use machine learning algorithms for classification. Shafiq et al. rely on statistical features such as packet length to classify traffic and compare the classification effects of the above statistical features on four machine learning algorithms such as decision trees. Taylor et al. introduced AppScanner, which extracts statistical features from traffic data and provides these features as input to the random forest algorithm to distinguish mobile applications. Compared with Shafiq's method, this method considers the direction of the packet as an effective feature and extracts more statistical features. Although the payload of the data packet is encrypted by the SSL and TLS protocols, Taylor uses bypass data to identify smartphone applications. In addition, inspired by ensemble learning, Gomez et al. proposed a method called customized decision tree chain, in which they arranged many basic binary classifiers in a certain order to construct an encrypted network traffic classifier.

[0005] Deep learning methods rely on their ability to automatically extract features, and input raw byte data or statistical features of traffic into deep learning models to complete classification. Liu et al. introduced FS-Net, a framework designed for encrypted traffic classification through neural networks. FS-Net takes packet length sequences as input, uses bidirectional GR for feature encoding, and combines reconstruction mechanisms in AutoEncoder to ensure the effectiveness of learned features. In addition, inspired by the attention mechanism in the field of natural language processing, Lin et al. proposed a new traffic representation model called ET-BERT. The model pre-trains deep contextual packet-level representations from large-scale unlabeled traffic data, and then fine-tunes and classifies based on a small amount of labeled data. Recently, considering that GNN can well preserve local features when processing unstructured data, Shen et al. proposed GraphDApp, which uses GNN to identify encrypted traffic of decentralized applications (DApps). This method constructs an encrypted traffic interaction graph based on packet length and packet direction, and converts traffic identification into a graph classification problem. However, most of the current GNN-based encrypted network traffic classification methods construct graphs based on the relationship between packets, and do not deeply explore the internal features of packets. Secondly, the data packet is divided into a header and a payload, and the information they carry is different. Current classification methods ignore the difference between the two. The model TFE-GNN proposed by Zhang et al. mines the encrypted traffic data features through GNN inside the network data packet, and then uses LSTM to model the downstream traffic classification model with time series information. This method focuses on the feature engineering of the traffic in the original encrypted traffic itself, rather than just staying on the statistical features or the relationship between data packets. However, its composition method uses the original bytes of the data packet as the node attributes and constructs the edge relationship based on the semantic correlation between bytes. However, this method does not take into account the impact of encrypted traffic on the original byte masking. This masking is interfered by external factors such as the encryption method, which makes the byte value lack specific meaning and continuity, which affects the accuracy of the composition to a certain extent. Summary of the invention

[0006] In view of the problems existing in the background technology, the purpose of the present invention is to provide an encrypted traffic classification method and classification model based on a dual network byte flow graph. The method innovatively constructs a flow graph based on the position encoding of the header bytes and payload bytes of the data packet, extracts features from the header byte flow graph and the payload byte flow graph respectively, and then cross-features are fused on the two features. Finally, based on the temporal nature of the traffic, a bidirectional LSTM is used to complete the classification of the encrypted traffic.

[0007] To achieve the above object, the technical solution of the present invention is as follows:

[0008] A method for classifying encrypted traffic based on a dual network byte traffic graph comprises the following steps:

[0009] Step 1. Collect network traffic;

[0010] Step 2: Perform data preprocessing on the collected network traffic to obtain several flows;

[0011] Step 3. Take each data packet in each flow as a unit and construct a byte flow graph for the header and payload in the data packet respectively:

[0012] Each byte in the data packet represents a vertex, and bytes with the same byte value share the same vertex; the vertex feature is represented by a position vector, which is generated by one-hot encoding the position of the byte in the header or payload. The processing rule of one-hot encoding is: if the byte appears at a certain position, the position corresponding to the vector is set to 1, otherwise it is set to 0;

[0013] Use the position window to build edges between vertices. Define a fixed-size position window for each byte. The current byte has connecting edges with all bytes contained in the position windows on its left and right sides.

[0014] Step 4. Obtain the feature vector of the header byte flow graph and the feature vector of the payload byte flow graph respectively:

[0015] A feature vector is extracted from each vertex in the flow graph, and then the feature vectors of all vertices are connected, and then the connected feature vectors are averaged and aggregated to obtain the feature vector of the flow graph;

[0016] Step 5. Filter the header feature vector and the load feature vector obtained in step 4 respectively, filter out the unimportant information in the feature vector, retain the features important for classification, and then concatenate the filtered header feature vector and the filtered load feature vector to obtain a feature vector of a data packet;

[0017] Step 6. All data packets in a data stream are spliced ​​according to the time sequence of the data packets, and the sequence data composed of the data packets are subjected to feature extraction to obtain the overall traffic feature vector. After classification, the overall traffic feature vector can obtain the predicted traffic category.

[0018] Furthermore, in step 1, the network traffic collection tool is preferably wireshark or tcpdump, and the traffic data can be collected in different environments and platforms to increase the robustness and cross-platform nature of the final identification result; the network traffic is encrypted network traffic and unencrypted network traffic.

[0019] Furthermore, the traffic data preprocessing of step 2 specifically includes: flow segmentation, data packet cleaning, flow cleaning, Ethernet frame header deletion and IP anonymization.

[0020] Furthermore, in step 3, the first 40 bytes of a data packet header and the first 150 bytes of payload data are selected to construct a byte-level traffic graph, and the insufficient number of bytes is filled with 0.

[0021] Furthermore, in step 3, the position window size of the head is 5, the position window size of the load is 10, and the step size is 1. A position window that is too small will prevent nodes that are originally closely connected from being associated, while a position window that is too large will fail to reflect edge differences.

[0022] The present invention also provides a network traffic classification model, comprising a dual byte traffic graph construction module, a dual graph feature extraction module, a cross feature fusion module and a classification module connected in sequence;

[0023] The dual byte flow graph construction module constructs a byte flow graph based on the header and the load of each data packet in the stream obtained by preprocessing;

[0024] The dual graph feature extraction module includes a byte flow graph feature extractor, a jump knowledge network JKN unit and an average aggregation unit; the byte flow graph feature extractor is used to process the head byte flow graph and the load byte flow graph to obtain the head graph feature vector and the load graph feature vector, which includes four layers of GNN encoding layers; each layer of GNN encoding layer is composed of GraphSAG E, an activation function and a batch normalization layer; four layers of GNN encoding layers are selected because the constructed byte graph will have a connectivity with a step size of 4 or more;

[0025] The skip knowledge network JKN unit is used to connect each layer of the four-layer GNN encoding layer in the byte flow graph feature extractor to solve the problem of feature over-smoothing and concatenate the output results of each layer to obtain a single node feature vector;

[0026] The average aggregation unit averages and aggregates the feature vectors of all nodes in the entire graph based on the single node feature vector output by the skip knowledge network JKN unit to obtain the graph feature vector;

[0027] The cross-feature fusion module includes a filter and a splicing unit; the filter is composed of a header filter and a load filter, the header filter and the load filter have the same structure and independent parameters, and filter the header map feature vector and the load map feature vector respectively, and the filtered results are input into the splicing unit for splicing processing to obtain a data packet feature vector;

[0028] The classification module includes a bidirectional LSTM, a linear layer, an activation function and a fully connected layer connected in sequence, and the classification module completes the identification of network traffic based on the feature vector of the data packet.

[0029] Furthermore, the processing process of the jump knowledge network JKN unit is:

[0030]

[0031] in, is the vertex feature vector output by concatenating the i-th layer of GraphSAGE, i = 1, 2, 3, 4; is the vertex feature vector output by the i-th layer GraphS AGE;

[0032] The processing formula for the average aggregation unit is,

[0033]

[0034] in, | V | is the number of vertices in the entire graph.

[0035] Furthermore, the filter is obtained by sequentially connecting a linear layer, a PReLU, a linear layer, and a Sigmod activation function. The head map feature vector is filtered through the filter to filter out unimportant information in the load map feature vector, and the filtered head feature vector is output. The load map feature vector is filtered through the filter to filter out unimportant information in the head map feature vector, and the filtered load feature vector is output.

[0036] Furthermore, the training process of the model is as follows: collect data and assign labels, input the data into the model, calculate the gap between the model output and the true label, optimize the network parameters through back propagation and gradient descent method to minimize the loss function, and finally obtain a trained model.

[0037] Furthermore, the specific formula of the loss function of the training process is:

[0038] L=CE(Classifier(LSTM(z1,z2,...,z n )),y)

[0039] Among them, n represents the sequence length, that is, the number of packets, z i Represents the feature vector of the i-th data packet in a network flow, y represents the true label, Classifier represents the classification head composed of multiple linear layers, and CE represents the cross entropy function.

[0040] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0041] This invention innovatively applies the positional unique-hot encoding technology to construct the vertices of the byte flow graph, and introduces the position window to construct the edge, successfully integrating the position information into the flow graph structure, and mining the potential original features in the flow; at the same time, considering the differences between the packet header and the load, the dual graph and feature fusion method are used to more comprehensively characterize the flow from the semantic and spatial structure. Compared with the current encrypted traffic classification method, it has a higher recognition accuracy and can be applied in the actual generation environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Schematic diagram of the process of the classification method of the present invention.

[0043] Figure 2 This is a schematic diagram of constructing a byte flow graph in step 3 of embodiment 1 of the present invention.

[0044] Figure 3 This is a schematic diagram of extracting feature vectors of a byte flow graph in step 4 of embodiment 1 of the present invention. DETAILED DESCRIPTION

[0045] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the implementation modes and the accompanying drawings.

[0046] A network traffic classification model comprises a dual byte traffic graph construction module, a dual graph feature extraction module, a cross feature fusion module and a classification module connected in sequence;

[0047] The dual byte flow graph construction module constructs a byte flow graph based on the header and the load of each data packet in the stream obtained by preprocessing;

[0048] The dual graph feature extraction module includes a byte flow graph feature extractor, a jump knowledge network JKN unit and an average aggregation unit; the byte flow graph feature extractor is used to process the head byte flow graph and the load byte flow graph to obtain the head graph feature vector and the load graph feature vector, which includes four layers of GNN encoding layers; each layer of GNN encoding layer is composed of GraphSAG E, an activation function and a batch normalization layer; four layers of GNN encoding layers are selected because the constructed byte graph will have a connectivity with a step size of 4 or more;

[0049] The skip knowledge network JKN unit is used to connect each layer of the four-layer GNN encoding layer in the byte flow graph feature extractor to solve the problem of feature over-smoothing and concatenate the output results of each layer to obtain a single node feature vector; the processing process of the skip knowledge network JKN unit is:

[0050]

[0051] in, is the vertex feature vector output by concatenating the i-th layer of GraphSAGE, i = 1, 2, 3, 4; is the vertex feature vector output by the i-th layer GraphS AGE;

[0052] The average aggregation unit averages the feature vectors of all nodes in the entire graph based on the single node feature vector output by the jump knowledge network JKN unit to obtain the graph feature vector; the processing formula of the average aggregation unit is:

[0053]

[0054] in, | V | is the number of vertices in the entire graph;

[0055] The cross-feature fusion module includes a filter and a splicing unit; the filter is composed of a head filter and a load filter, the head filter and the load filter have the same structure and independent parameters, and filter the head map feature vector and the load map feature vector respectively; the filter is obtained by sequentially connecting a linear layer, a PReLU, a linear layer, and a Sigmod activation function, the head map feature vector is filtered by the filter to filter the unimportant information in the load map feature vector, and the filtered head feature vector is output; the load map feature vector is filtered by the filter to filter the unimportant information in the head map feature vector, and the filtered load feature vector is output; the filtered result is input into the splicing unit for splicing processing to obtain a data packet feature vector;

[0056] The classification module includes a bidirectional LSTM and a classification head connected in sequence; the bidirectional LSTM consists of two complementary LSTM units, which work together to extract comprehensive features of sequence data; the forward LSTM processes information in the natural order of the time series, thereby capturing the context from the beginning to the end of the sequence, and the reverse LSTM operates in reverse, analyzing from the end of the sequence forward to reveal the context from the end point to the starting point; the classification head consists of a linear layer, an activation function and a fully connected layer connected in sequence, and the classification module completes the identification of network traffic based on the feature vector of the data packet.

[0057] The training process of the model is: collect data and assign labels, input the data into the model, calculate the gap between the model output and the real label, optimize the network parameters through back propagation and gradient descent method, minimize the loss function, and finally get a trained model; the loss function is designed as follows:

[0058] L=CE(Classifier(LSTM(z1,z2,...,z i ...,z n )),y)

[0059] Among them, n represents the sequence length, that is, the number of packets, z i represents the feature vector of the i-th data packet in a network flow, y represents the true label, Classifier represents the classification head composed of multiple linear layers, and CE represents the cross entropy function;

[0060] Example 1

[0061] A method for classifying encrypted traffic based on network byte traffic graph, the flow chart of which is as follows Figure 1 As shown, the specific steps include:

[0062] Step 1. Collect encrypted traffic and non-encrypted traffic respectively and generate corresponding pcap files: Use public datasets ISCX-NonVPN and ISCX-VPN, where ISCX-VPN consists of traffic collected through a virtual private network (VPN), while ISCX-NonVPN contains regular encrypted traffic that is not collected through VPN. Compared with ISCX-NonVPN, it is more challenging to identify the encrypted traffic of ISCX-VPN.

[0063] Step 2. Perform data preprocessing on the traffic collected in step 1: First, divide the original pcap package file according to the five-tuple (source IP, source port, destination IP, destination port, transport layer protocol) in units of flow, and filter out the pcap file of TCP session; to prevent a large amount of noise from being introduced during the training process, delete the session pcap files that are too short or too long; considering that the Ethernet frame header does not contain valid information for classification, the Ethernet frame header is deleted in the PCAP file; then, in order to eliminate the interference of IP address and port number on the classification model, delete the source IP address, source port number, destination IP address and destination port number in the data packet header; finally, label each flow sample;

[0064] Step 3. Extract the first 40 bytes of each packet header and the first 150 bytes of payload data to construct byte-level traffic header and payload graphs:

[0065] The graph is constructed based on minimizing the size of the graph, that is, each byte represents a vertex, and bytes with the same byte value share the same vertex. The vertex feature is represented by a position vector. The initial value of the position vector is generated by one-hot encoding. If the byte appears at a certain position, the position corresponding to the vector is set to 1, otherwise it is set to 0. The edges between vertices are constructed using position windows. For each byte of the header and the payload, a fixed-size position window is defined for it. A position window is extended on the left and right sides of the current byte. The current byte is connected to all bytes contained in the windows on its left and right sides.

[0066] Taking the packet header byte sequence [0,1,1,1,1,1,2,2,2,2,2,5,5,3,3,3,4,...] as an example, with 0,1,2,3,4,5,... as nodes, the vertex position of byte 1 is encoded as [0,1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,...], and the vertex position of byte 2 is encoded as [0,0,0,0,0,0,1,1,1,1,1,0,0,0,0,0,0 ,...]; for byte 2, use the head position window size of 5, then associate bytes [1,5,3], then vertex 2 will be connected to vertices 1, 5, and 3 by an edge; taking byte 5 as an example, associate bytes [2,3,4], then vertex 5 will be connected to vertices 2, 3, and 4 by an edge; create two graphs for the head and load in the form of position windows, then a flow containing 50 data packets will construct 100 byte-level traffic graphs; the specific process of constructing byte traffic graphs is as follows Figure 2 As shown;

[0067] Step 4. Use two byte flow graph feature extractors to extract feature vectors of the header byte flow graph and the payload byte flow graph respectively. The process of extracting the feature vector of the byte flow graph is as follows: Figure 3 As shown:

[0068] The byte-level traffic graph obtained in step 3 is input into the feature extractor. Each layer of GraphSAGE samples all neighbor vertices of each vertex in the graph to obtain a partial set of neighbor vertices, updates the aggregated vertex feature vector, selects the PReLU activation function with stronger expression ability, and obtains the standardized vertex feature vector after batch normalization after the updated vertex feature vector. Considering that the deep GNN aggregates almost all neighbor vertex information, resulting in over-smoothing of all vertex features, the jump knowledge connection JKN is used to connect the vertex feature vectors output by the four layers of GraphSAGE to solve the over-smoothing problem, as shown in the formula:

[0069]

[0070] in, It is the vertex feature vector output by splicing four layers of GraphSAGE. is the vertex feature vector output by the i-th layer of GraphSAGE, i = 1, 2, 3, 4; then the average aggregation unit is used to obtain the feature vector of the entire graph, as shown in the formula:

[0071]

[0072] in, | V | is the number of vertices in the entire graph;

[0073] Step 5: The head image feature vector z obtained in step 4 h and the load diagram eigenvector z p , cross feature fusion is used to transform z h and z p The fusion is represented as the overall feature vector z of the data packet pac ; Cross-feature fusion uses two independent parameters consisting of a linear layer, PReLU, a linear layer, and a Sigmod activation function to filter z h and z p , respectively obtain the head gating vector f h and load gating vector f p . Using f h Cross Filter p The unimportant information in the p Cross Filter h Finally, concatenate the filtered header feature vector and the filtered payload feature vector to obtain the overall feature vector z of the data packet. pac ; The specific implementation formula of the cross-fusion method is as follows:

[0074] f h =Sigmoid(w h2 PReLU(w h1 g h +b h1 )+b h2 )

[0075] f p =Sigmoid(w p2 PReLU(w p1 g p +b p1 )+b p2 )

[0076] z pac =CONCAT[f h ·g p ,f p ·g h ]

[0077] Among them, g h and g p Represent the head feature vector and load feature vector respectively; w h1 and w h2 They are used for the head feature vector g h The weight matrix of the linear transformation, w p1 and w p2 They are used for the load characteristic vector g p The weight matrix of the linear transformation; b h1 and bh2 They are used for the bias term of the linear transformation of head features and the weight matrix w h1 and w h2 Together, they are used to adjust the output of the head feature vector after linear transformation, b p1 and b p2 They are bias terms used for linear transformation of load characteristics; f h The gating vector representing the head feature controls the contribution of the head feature vector in the final fusion, f p The gating vector representing the load feature controls the contribution of the load feature vector in the final fusion.

[0078] Step 6. Obtain the overall feature z of each data packet after step 5 pac , then the characteristic sequence of the flow is A flow consists of multiple data packets, each of which has an independent timestamp. Therefore, the feature sequence of a flow can be regarded as a time feature sequence, in which each data packet represents a time step. The bidirectional LSTM is input, and the hidden layer states of the forward LSTM and the reverse LSTM are concatenated to obtain the overall feature vector of the flow. Finally, the flow feature vector passes through the linear layer, activation function, and fully connected layer to obtain the traffic category.

[0079] Table 1 shows the classification indicators of encrypted traffic and non-encrypted traffic of the method of the present invention in an experimental environment. It can be seen from the table that in terms of the four evaluation indicators of AC, PR, RC, and F1, the classification performance of the model of the present invention on both data sets is better than that of the two non-graph input baseline models AppScanner and FS-Net. The main reason is that the model of the present invention deeply mines the internal byte context information of the data packet, rather than just using the statistical features of the session. Compared with the GNN-based model GraphDApp, the classification performance of the model of the present invention is better than that of GraphDApp. The main reason is that GraphDApp uses the interaction traffic graph as input, while the interaction traffic graph does not deeply mine the internal features of the data packet, and the information it captures remains at the session level. The model of the present invention constructs a byte traffic graph based on position encoding for the packet header and payload respectively, and extracts features from it, so that it can capture the internal information of the data packet more carefully, significantly improving the performance on the encrypted network traffic classification task.

[0080] Table 1

[0081]

[0082] The above description is only a specific implementation mode of the present invention. Any feature disclosed in this specification, unless otherwise stated, can be replaced by other alternative features that are equivalent or have similar purposes; all the disclosed features, or all the steps in the methods or processes, except for mutually exclusive features and / or steps, can be combined in any way.

Claims

1. A method for classifying encrypted traffic based on dual network byte traffic graph, characterized in that: The following steps are involved: Step 1. Collect network traffic; Step 2: Perform data preprocessing on the collected network traffic to obtain several flows; Step 3. Take each data packet in each flow as a unit and construct a byte flow graph for the header and payload in the data packet respectively: Each byte in the data packet represents a vertex, and bytes with the same byte value share the same vertex; the vertex feature is represented by a position vector, which is generated by one-hot encoding the position of the byte in the header or payload. The processing rule of one-hot encoding is: if the byte appears at a certain position, the position corresponding to the vector is set to 1, otherwise it is set to 0; Use the position window to build edges between vertices. Define a fixed-size position window for each byte. The current byte has connecting edges with all bytes contained in the position windows on its left and right sides. Step 4. Obtain the feature vector of the header byte flow graph and the feature vector of the payload byte flow graph respectively: A feature vector is extracted from each vertex in the flow graph, and then the feature vectors of all vertices are connected, and then the connected feature vectors are averaged and aggregated to obtain the feature vector of the flow graph; Step 5. Filter the header feature vector and the load feature vector obtained in step 4 respectively, filter out the unimportant information in the feature vector, retain the features important for classification, and then concatenate the filtered header feature vector and the filtered load feature vector to obtain a feature vector of a data packet; Step 6. All data packets in a data stream are spliced ​​according to the time sequence of the data packets, and the sequence data composed of the data packets are subjected to feature extraction to obtain the overall traffic feature vector. After classification, the overall traffic feature vector can obtain the predicted traffic category.

2. The encrypted traffic classification method according to claim 1, characterized in that: In step 1, the network traffic collection tool is wireshark or tcpdump, and the traffic data is collected in different environments and platforms; the network traffic is encrypted network traffic and non-encrypted network traffic.

3. The encrypted traffic classification method according to claim 1, characterized in that: The traffic data preprocessing in step 2 specifically includes: flow segmentation, packet cleaning, flow cleaning, Ethernet frame header removal and IP anonymization.

4. The encrypted traffic classification method according to claim 1, characterized in that: In step 3, the first 40 bytes of a data packet header and the first 150 bytes of payload data are selected to construct a byte-level traffic graph, and the insufficient bytes are filled with 0.

5. The encrypted traffic classification method according to claim 1, characterized in that: In step 3, the position window size of the head is 5, the position window size of the load is 10, and the step size is 1. A position window that is too small will prevent nodes that are originally closely connected from being associated, while a position window that is too large will fail to reflect edge differences.

6. An encrypted traffic classification model based on dual network byte traffic graph, characterized in that: It includes a dual byte flow graph construction module, a dual graph feature extraction module, a cross feature fusion module and a classification module connected in sequence; The dual byte flow graph construction module constructs a byte flow graph based on the header and the load of each data packet in the stream obtained by preprocessing; The dual graph feature extraction module includes a byte flow graph feature extractor, a jump knowledge network JKN unit and an average aggregation unit; the byte flow graph feature extractor is used to process the head byte flow graph and the load byte flow graph to obtain the head graph feature vector and the load graph feature vector, which includes four layers of GNN encoding layers; each layer of GNN encoding layer is composed of GraphSAGE, an activation function and a batch normalization layer; four layers of GNN encoding layers are selected because the constructed byte graph will have a connectivity with a step size of 4 or more; The skip knowledge network JKN unit is used to connect each layer of the four-layer GNN encoding layer in the byte flow graph feature extractor to solve the problem of feature over-smoothing and concatenate the output results of each layer to obtain a single node feature vector; The average aggregation unit averages and aggregates the feature vectors of all nodes in the entire graph based on the single node feature vector output by the skip knowledge network JKN unit to obtain the graph feature vector; The cross-feature fusion module includes a filter and a splicing unit; the filter is composed of a header filter and a load filter, the header filter and the load filter have the same structure and independent parameters, and filter the header map feature vector and the load map feature vector respectively, and the filtered results are input into the splicing unit for splicing processing to obtain a data packet feature vector; The classification module includes a bidirectional LSTM, a linear layer, an activation function and a fully connected layer connected in sequence, and the classification module completes the identification of network traffic based on the feature vector of the data packet.

7. The encrypted traffic classification model as claimed in claim 6, characterized in that: The processing process of the jumping knowledge network JKN unit is: in, is the vertex feature vector output by concatenating the i-th layer of GraphSAGE, i = 1, 2, 3, 4; is the vertex feature vector output by the i-th layer of GraphSAGE; The processing formula for the average aggregation unit is, Among them, |V| is the number of vertices in the entire graph.

8. The encrypted traffic classification model as claimed in claim 6, characterized in that: The filter is obtained by connecting the linear layer, PReLU, linear layer, and Sigmod activation function in sequence. The head image feature vector is filtered through the filter to filter the unimportant information in the load image feature vector, and the filtered head feature vector is output. The load image feature vector is filtered through the filter to filter the unimportant information in the head image feature vector, and the filtered load feature vector is output.

9. The encrypted traffic classification model as claimed in claim 6, characterized in that: The training process of the model is as follows: collect data and assign labels, input the data into the model, calculate the gap between the model output and the true label, optimize the network parameters through back propagation and gradient descent method to minimize the loss function, and finally obtain a trained model.

10. The encrypted traffic classification model according to claim 9, characterized in that: The specific formula of the loss function of the training process is: L=CE(Classifier(LSTM(z1,z2,...,z n )),y) Among them, n represents the sequence length, that is, the number of packets, z i Represents the feature vector of the i-th data packet in a network flow, y represents the true label, Classifier represents the classification head composed of multiple linear layers, and CE represents the cross entropy function.

Images