Method and system for identifying refined behaviors of tunnel users

Abstract

The invention discloses a method and a system for identifying refined behaviors of tunnel users, and belongs to the field of network flow detection. The method comprises the following steps: extracting byte features of unlabeled tunnel traffic, learning a context relationship of the unlabeled tunnel traffic through a pre-training network model, and generating vector representation of the byte features; extracting byte features, a data packet length sequence and a data packet arrival time interval sequence of target tunnel user behavior traffic, and obtaining vector representation of the byte features through a pre-training network model; obtaining hidden state features of vector representation of the byte features, a data packet length sequence and a data packet arrival time interval sequence based on a convolutional neural network (CNN), and obtaining a comprehensive hidden state feature through fusion; and inputting the comprehensive hidden state features into a classifier to predict the user behavior of the target tunnel. According to the invention, the problem that tunnel user behaviors are difficult to identify in a real network environment in the prior art can be solved.

Description

Technical Field

[0001] The invention belongs to the field of network traffic detection, and in particular relates to a method and system for identifying refined behaviors of tunnel users. Background Art

[0002] Tunneling technology, also known as virtual private network (VPN), encapsulates data packets generated by various applications through encryption protocols, enabling them to be securely transmitted over public networks. With the rapid development of the Internet and the increasing emphasis on communication security, tunneling technology has become an important part of network communications, meeting a wide range of security needs for individuals and enterprises. However, the widespread use of tunneling technology has increased the complexity of user behavior and posed major challenges to network security and management. While protecting the privacy and anonymity of network users, tunneling technology may also hide some key information, thereby circumventing the monitoring system of the firewall, which brings additional difficulties to network management. For example, on the Twitter platform, different user behaviors, including likes, retweets, and comments, may indicate the presence of different types of malicious users.

[0003] With the widespread application of tunneling technology, effective methods for identifying refined encrypted tunnel traffic are urgently needed in real-world scenarios such as quality of service (QoS) optimization, intrusion detection, and content regulation. It has become an urgent need to not only distinguish between tunnel traffic and non-tunnel traffic, but also to identify refined applications and behaviors. Taking quality of service (QoS) optimization as an example, due to the sharp increase in the number of users and network bandwidth usage, Internet service providers (ISPs) strive to optimize bandwidth allocation for different services. By identifying the specific behaviors of users in the tunnel network, ISPs can allocate appropriate available bandwidth to each user after comprehensively considering user experience and cost, thereby saving bandwidth costs without affecting user experience. This study aims to accurately identify these refined behaviors in tunnels and improve the accuracy and effectiveness of different activity detection.

[0004] In recent years, a lot of research has been done on tunnel traffic classification. Tunnel traffic classification is mainly based on machine learning and deep learning. The machine learning-based method mainly extracts effective features (such as the maximum packet length) from tunnel traffic and then inputs them into a machine learning classifier (such as random forest). However, this method relies heavily on expert experience to select specific features, and even insignificant statistical features may affect the analysis performance. Tunnel traffic is more difficult to construct effective features manually than non-tunnel traffic due to its high complexity and chaos of features. Therefore, traditional machine learning methods show limitations in dealing with tunnel traffic classification and it is difficult to achieve ideal classification accuracy. Compared with traditional models, existing deep learning models have significantly improved the performance of tunnel traffic classification due to their excellent feature extraction capabilities. However, existing deep learning models are heavily dependent on the number and distribution of labeled training data. Due to the failure to fully utilize the rich potential information in the original data packets, the mining of tunnel traffic features is not deep enough, which may lead to model bias and make it difficult to adapt to emerging encryption technologies.

[0005] In the fields of natural language processing (NLP) and computer vision (CV), pre-training models using massive unlabeled data has shown excellent performance. Through self-supervised learning, pre-training methods greatly reduce the need for labeled training data. Some studies have applied pre-training methods to encrypted traffic classification and achieved good results. However, these pre-training methods generally use traffic bytes and focus on a single feature, which may lead to the loss of important information. Some methods use packet length sequences as features, but ignore other important features such as packet time interval sequences. All of these current methods generally ignore the integration of various potential information in the original packet data and cannot solve fine-grained tasks such as identifying tunnel user behavior. In addition, although pre-trained models can learn unbiased data representations from large-scale unlabeled data and can be transplanted to downstream tasks through fine-tuning, current pre-trained models are not specifically optimized for the refined identification of user behavior in tunnel traffic.

[0006] Therefore, in response to the ever-increasing scale of tunnel traffic in real network environments, it is necessary to propose a model that fully utilizes tunnel traffic characteristics and has strong traffic feature mining capabilities to identify the refined behaviors of tunnel users, and then realize the monitoring of tunnel users, which is of great significance to improving network security, reducing potential attack threats, and ensuring the security and stability of the network environment. Summary of the invention

[0007] The purpose of the present invention is to provide a method and system for identifying the refined behavior of tunnel users based on multi-feature fusion technology and large-scale pre-training models. By extracting and combining byte feature information, data packet length sequence information and data packet arrival time interval sequence information in tunnel traffic, the corresponding fine-grained behavior of tunnel users is predicted, thereby solving the problem that existing methods are difficult to identify tunnel user behavior in a real network environment.

[0008] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0009] A method for identifying refined behavior of a tunnel user comprises the following steps:

[0010] S1: Capture unlabeled tunnel traffic;

[0011] S2: Extract the byte features of the unlabeled tunnel traffic, learn the contextual relationship of the unlabeled tunnel traffic through the pre-trained network model, and generate a vector representation of the byte features;

[0012] S3: Capture the target tunnel user behavior traffic;

[0013] S4: Extract the byte features, packet length sequence and packet arrival time interval sequence of the target tunnel user behavior traffic, and obtain the vector representation of the byte features through the pre-trained network model; obtain the vector representation of the byte features, the hidden state features of the packet length sequence and the packet arrival time interval sequence based on the convolutional neural network CNN, and then obtain the comprehensive hidden state features of the tunnel user behavior traffic through fusion;

[0014] S5: Input the comprehensive hidden state features into the classifier composed of a fully connected layer and a softmax layer to predict the target tunnel user behavior;

[0015] Before predicting the target tunnel user behavior, a training phase is performed to annotate the tunnel user behavior traffic captured in step S3 with the real label of the tunnel user behavior. After processing in steps S4-S5, a prediction result is generated, and the cross entropy loss function is used to calculate the difference between the prediction result and the real label. The model parameters are adjusted to minimize the loss.

[0016] Furthermore, in step S1, the captured unlabeled tunnel traffic is saved as a PCAP file, in step S2, the data stream in the PCAP file is classified according to five-tuples, and the PCAP file is converted into a HEX format using a Scapy tool.

[0017] Furthermore, the method for extracting byte features in step S2 is: parsing the TCP protocol layer of the unlabeled tunnel traffic, using the sequence number of the TCP protocol layer as a marker string, and extracting the payload byte sequence from the data packet as the byte feature.

[0018] Furthermore, when pre-training the network model in step S2, the byte sequence of the byte features is marked using symbols [CLS], [SEP], [PAD], and [MASK], [CLS] marks the starting position of the input sequence, [SEP] is used to separate the sequence, [PAD] is used to fill the sequence to meet the minimum length requirement, and [MASK] is used to learn the contextual relationship of the traffic.

[0019] Furthermore, when pre-training the network model in step S2, the symbols in each input tunnel traffic sequence are randomly masked with a probability of 15% through the mask packet model MPM, of which 80% are replaced with [MASK], or a symbol is randomly replaced with a probability of 10%, or no processing is performed with a probability of 10%.

[0020] Furthermore, the pre-trained network model in step S2 is a Transformer encoder, and each Transformer encoder includes two sub-layers: a multi-head self-attention mechanism module and a position-encoded fully connected feed-forward network; each sub-layer adopts residual connection and performs layer normalization.

[0021] Furthermore, in step S3, the target tunnel user behavior traffic is segmented into session flows and data packets according to the five-tuple, and the traffic is labeled based on the target tunnel user behavior.

[0022] Furthermore, in step S4, the hidden state features of the vector representation of byte features, the data packet length sequence, and the data packet arrival time interval sequence are obtained based on the convolutional neural network CNN, including:

[0023] Use a CNN-based byte feature encoder to obtain hidden state features of the vector representation of byte features;

[0024] Two CNN-based sequence feature encoders are used to obtain the hidden state features of the packet length sequence and the packet arrival time interval sequence respectively; each sequence feature encoder includes three repeated CNN modules and one fully connected layer module; each CNN module includes two convolutional layers, one activation layer and one mean pooling layer, each convolutional layer is normalized by BN, and the activation layer uses the activation function ReLU; the output features are regularized by Dropout; the fully connected layer module includes one fully connected layer and one activation layer, the fully connected layer is normalized by BN, the activation layer uses the tanh activation function, and the output features are regularized by Dropout.

[0025] Furthermore, in step S4, feature fusion is performed based on the attention mechanism to obtain the comprehensive hidden state features of the tunnel user behavior traffic.

[0026] A system for identifying refined behaviors of tunnel users comprises a memory and a processor. The memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0027] The present invention has achieved the following beneficial effects:

[0028] 1. The present invention proposes a self-supervised pre-training method specifically for encrypted tunnel traffic, which uses a large amount of unlabeled data to learn the byte feature representation of tunnel traffic, significantly reduces the dependence on manually labeled data, and effectively improves the model's generalization ability and adaptability to new types of traffic.

[0029] 2. The present invention adopts a multi-feature fusion method, combines the original byte data, the data packet length sequence features and the data packet arrival time interval sequence features, and improves the full utilization and feature mining of encrypted traffic by adding the data packet arrival time interval sequence features. The present invention splices the length feature vector and the time feature vector, and then uses the feature fusion based on the attention mechanism with the byte feature vector. The fusion technology based on the attention mechanism is used to fully mine the potential information in the tunnel traffic, without relying on expert knowledge for manual feature mining, to achieve refined identification of tunnel user behavior, and significantly improve the accuracy and refinement of identification.

[0030] 3. The present invention designs a new loss function to optimize the final classification performance of the model while taking into account the independent classification performance of each part of the features, so that the model can give full play to the advantages of each module when updating parameters, thereby more comprehensively learning the characteristic information in the tunnel flow.

[0031] 4. Compared with traditional methods, the present invention has achieved significant improvement in the effectiveness of identifying tunnel user behavior, especially showing stronger robustness and adaptability in various complex network scenarios, verifying its wide practical application value.

[0032] 5. The present invention supports encrypted traffic analysis of multiple protocols and multiple scenarios, is compatible with the processing methods of session flows and data packet granularity, can flexibly adapt to different target network services and tunnel user behaviors, and demonstrates high application flexibility and practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 The present invention is a flowchart of a method for identifying refined behaviors of tunnel users in an embodiment of the present invention.

[0034] Figure 2 Schematic diagram of the structure of the Transformer encoder in an embodiment of the present invention.

[0035] Figure 3 It is a flowchart of the training phase in an embodiment of the present invention.

[0036] Figure 4 It is a schematic diagram of the structure of a sequence feature encoder in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the various technical features and advantages or technical effects in the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below with reference to the accompanying drawings.

[0038] The embodiment of the present invention specifically discloses a method for identifying the refined behavior of tunnel users, the process of which is as follows: Figure 1 The specific processing steps are as follows:

[0039] Step S1: Capture large-scale unlabeled tunnel traffic.

[0040] Before determining the target network service list, a large amount of unlabeled tunnel traffic is collected from the gateway manually or through an automated script and saved in the form of a PCAP file.

[0041] Step S2: Extract byte features of unlabeled tunnel traffic for pre-training.

[0042] Extract the byte features of the unlabeled tunnel traffic and learn the contextual relationship of the unlabeled tunnel traffic through the pre-trained network model. The specific steps include:

[0043] Step S2-1: For encrypted traffic of multiple protocols and multiple scenarios, it is not necessary to classify the data stream in each captured PCAP file according to the five-tuple. Use the Scapy tool to convert the PCAP file into HEX format, and use the sequence number (Sequence) of the TCP protocol layer as the flag string. Sequence is used to identify the order of data packets, which helps to extract the payload byte sequence from the data packets of the PCAP file as byte features.

[0044] Step S2-2: The goal of pre-training is to train a model with byte encoding capabilities to encode each traffic packet into a vector in the payload byte encoder. Although the payload of encrypted traffic usually does not have semantics, research shows that the data generated by different applications has random differences, and encrypted traffic still contains certain implicit patterns, especially the first few packets of the traffic. The value range of the payload byte is from 0 to 65535, and it has potential characteristics similar to the language structure in the real world. This method treats the payload bytes of the data packet as language-like strings in natural language processing (NLP) for processing.

[0045] To enhance the pre-training effect, this method introduces special tags [CLS], [SEP], [PAD], and [MASK], where [CLS] is a special symbol added in front of each input example, indicating the start of the input example; [SEP] is a special separator used to separate sequences; [PAD] is a padding symbol used to pad the sequence to meet the minimum length requirement; and [MASK] is used to learn the contextual relationship of the traffic.

[0046] This method draws on BERT's Masked Language Model (MLM) and proposes a Masked Packet Model (MPM). The symbols in each encrypted tunnel traffic sequence input are randomly masked with a probability of 15%, of which 80% are replaced with [MASK], or a symbol is randomly replaced with a probability of 10%, or no processing is performed with a probability of 10%.

[0047] In pre-training, a model based on the Transformer architecture is selected to learn the representation of payload bytes. The structure of each Transformer encoder is as follows Figure 2 As shown in the figure, it includes two sub-layers: a multi-head self-attention mechanism module and a position-encoded fully connected feed-forward network (Position-wise FFN). Residual connections are used outside each sub-layer, and then layer normalization is performed to improve the training effect and stability of the model.

[0048] Step S3: Capture target tunnel user behavior traffic.

[0049] Determine the target tunnel user behavior, collect the traffic generated by the target application service manually or through an automatic script, and save it in the form of a PCAP file. For various scenarios of encrypted traffic identification, this method uses two common specifications: session flow and data packet. Each PCAP file contains network communication traffic over a period of time. The packet processing tool Tshark is used to segment the traffic into session flows and data packets according to five-tuples. During the training phase, the traffic is labeled based on the user behavior of the target tunnel being accessed.

[0050] Step S4: extract and fuse the multi-dimensional features of the tunnel traffic.

[0051] like Figure 3In the training phase shown, the byte features, packet length sequence (length feature) and packet arrival time interval sequence (time feature) of the tunnel user behavior traffic are extracted, and the vector representation of the byte features is obtained through the pre-trained network model. Based on the principle of capturing local prominent features, a byte feature encoder based on a convolutional neural network (CNN) (see Kim, Yoon. Convolutional Neural Networks for Sentence Classification [C] / / 2014. DOI: 10.3115 / v1 / D14-1181.) is used to learn the sequential hidden state features of the data packets, and two CNN-based sequence feature encoders are used to generate different hidden state features from the directional packet length sequence and the packet arrival time interval sequence.

[0052] The structures of these two sequence feature encoders are the same, but the model parameters are different and not shared. Figure 4 As shown in the figure, it consists of three repeated CNN modules and a fully connected layer module. Each CNN module includes two consecutive convolutional layers (Conv Layer), an activation layer (ReLU) and a mean pooling layer (Mean Pooling). The convolution layer is responsible for local feature extraction. By increasing the number of convolutional layers, the network depth can be enhanced and the feature encoding ability can be improved. Batch Normalization (BN) is used after each convolution layer for normalization to improve training stability and accelerate convergence; the activation layer uses the activation function ReLU to enhance nonlinear expression capabilities; the mean pooling layer is used for downsampling to reduce the dimension of features. The features extracted by the CNN module are regularized using Dropout (regularization method) to prevent overfitting. The fully connected layer module includes a fully connected layer (Dense Layer) and an activation layer (tanh). Batch Normalization (BN) is used after the fully connected layer for normalization. The activation layer uses the tanh activation function to perform nonlinear transformation on the output features, and finally Dropout is used for regularization. The overall structure uses multi-layer CNN modules and fully connected modules to efficiently encode the input sequence features, while improving the robustness and generalization ability of the model through Dropout and Batch Normalization at each stage.

[0053] The hidden state of the packet length sequence is concatenated with the hidden state of the packet arrival time interval sequence, and then the hidden state of the byte feature is fused based on the attention mechanism to finally generate the comprehensive hidden state features of the tunnel traffic.

[0054] Step S5: Identify tunnel user behavior.

[0055] A classifier consisting of a fully connected layer and a softmax layer is used to classify based on the comprehensive hidden state features, predict tunnel user behavior and assign corresponding labels. The cross-entropy loss function is usually used to calculate the difference between the predicted result and the true label. The model calculates the gradient of the loss function to the parameters of each model mentioned above through the back propagation algorithm, and adjusts the model parameters (such as weights and biases) according to the gradient information to minimize the loss. After training is completed, it is officially used to identify tunnel user behavior.

[0056] This method makes full use of the advantages of original byte features, packet length sequences and packet arrival time interval sequences to enhance the model's ability to identify tunnel traffic user behavior.

[0057] Experimental test:

[0058] This experiment selected the following 11 representative encrypted traffic identification models for comparison with ours:

[0059] Machine learning methods: AppScanner[1], CUMUL[2], GRAIN[3];

[0060] Deep learning methods: FS-Net[4], DF[5], App-Net[6];

[0061] Graph neural network methods: GraphDApp[7], TFE-GNN[8];

[0062] Pre-training methods: PERT[9], ET-BERT

[10] , PEAN

[11] .

[0063] The experimental results on the self-collected dataset are shown in Table 1:

[0064] Table 1

[0065]

[0066] The experimental results on the open datasets ISCX-VPN, ISCX-nonVPN and the LFETT2021-SSR, LFETT2021-Vmess datasets are shown in Table 2:

[0067] Table 2

[0068]

[0069] References:

[0070] 1.V.F.Taylor,R.Spolaor,M.Conti,and I.Martinovic,“Appscanner:Automaticfingerprinting of smartphoneapps from encrypted network traffic,”in 2016IEEEEuropean Symposium on Security and Privacy

[0071] (EuroS&P).IEEE,2016,pp.439–454.

[0072] 2.A.Panchenko,F.Lanze,J.Pennekamp,T.Engel,A.Zinnen,M.Henze,andK.Wehrle,“Websitefingerprinting at internet scale.”in NDSS,2016.

[0073] 3.F.Zaki,F.Afifi,S.Abd Razak,A.Gani,and N.B.Anuar,“Grain:Granularmulti-label encrypted trafficclassification using classifier chain,”ComputerNetworks,vol.213,p.109084,2022.

[0074] 4.C.Liu,L.He,G.Xiong,Z.Cao,and Z.Li,“Fs-net:A flow sequence networkfor encrypted trafficclassification,”in IEEE INFOCOM 2019-IEEE Conference OnComputer Communications.IEEE,2019,pp.

[0075] 1171–1179.

[0076] 5.P.Sirinam,M.Imani,M.Juarez,and M.Wright,“Deep fingerprinting:Undermining website fingerprintingdefenses with deep learning,”in Proceedingsof the 2018ACM SIGSAC Conference on Computer andCommunications Security,2018,pp.1928–1943.

[0077] 6.X.Wang,S.Chen,and J.Su,“App-net:A hybrid neural network forencrypted mobile traffic classification,”

[0078] in IEEE INFOCOM 2020-IEEE Conference on Computer CommunicationsWorkshops(INFOCOMWKSHPS).IEEE,2020,pp.424–429.

[0079] 7.M.Shen,J.Zhang,L.Zhu,K.Xu,and X.Du,“Accurate decentralizedapplication identification viaencrypted traffic analysis using graph neuralnetworks,”IEEE Transactions on Information Forensics andSecurity,vol.16,pp.2367–2380,2021.

[0080] 8.H.Zhang,L.Yu,X.Xiao,Q.Li,F.Mercaldo,X.Luo,and Q.Liu,“Tfe-gnn:Atemporal fusion encoderusing graph neural networks for fine-grained encryptedtraffic classification,”in Proceedings of the ACM WebConference 2023,2023,pp.2066–2075.

[0081] 9.HYHe, ZGYang, and XNChen, "Pert: Payload encoding representation from transformer for encryptedtraffic classification," in 2020ITUKaleidoscope: Industry-Driven Digital Transformation (ITU K). IEEE,

[0082] 2020,pp.1–8.

[0083] 10.

[0084] 2022,2022,pp.633–642.

[0085] 11.P.Lin, K.Ye, Y.Hu, Y.Lin, and C.-Z.Xu, “A novel multimodal deeplearning framework for encryptedtraffic classification,” IEEE / ACM Transactionson Networking, 2022.

[0086] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A method for identifying refined behavior of tunnel users, characterized in that: The following steps are involved: S1: Capture unlabeled tunnel traffic; S2: Extract the byte features of the unlabeled tunnel traffic, learn the contextual relationship of the unlabeled tunnel traffic through the pre-trained network model, and generate a vector representation of the byte features; S3: Capture the target tunnel user behavior traffic; S4: Extract the byte features, packet length sequence and packet arrival time interval sequence of the target tunnel user behavior traffic, and obtain the vector representation of the byte features through the pre-trained network model; obtain the vector representation of the byte features, the hidden state features of the packet length sequence and the packet arrival time interval sequence based on the convolutional neural network CNN, and then obtain the comprehensive hidden state features of the tunnel user behavior traffic through fusion; S5: Input the comprehensive hidden state features into the classifier composed of a fully connected layer and a softmax layer to predict the target tunnel user behavior; Before predicting the target tunnel user behavior, a training phase is performed to annotate the tunnel user behavior traffic captured in step S3 with the real label of the tunnel user behavior. After processing in steps S4-S5, a prediction result is generated, and the cross entropy loss function is used to calculate the difference between the prediction result and the real label. The model parameters are adjusted to minimize the loss.

2. The identification method according to claim 1, characterized in that: In step S1, the captured unlabeled tunnel traffic is saved as a PCAP file. In step S2, the data streams in the PCAP file are classified according to five-tuples, and the PCAP file is converted into a HEX format using the Scapy tool.

3. The identification method according to claim 1, characterized in that: The method for extracting byte features in step S2 is: parsing the TCP protocol layer of the unlabeled tunnel traffic, using the sequence number of the TCP protocol layer as a marker string, and extracting the payload byte sequence from the data packet as the byte feature.

4. The identification method according to claim 1, characterized in that: When pre-training the network model in step S2, the byte sequence of the byte feature is marked using symbols [CLS], [SEP], [PAD], and [MASK]. [CLS] marks the starting position of the input sequence, [SEP] is used to separate the sequence, [PAD] is used to fill the sequence to meet the minimum length requirement, and [MASK] is used to learn the contextual relationship of the traffic.

5. The identification method according to claim 4, characterized in that: When pre-training the network model in step S2, the symbols in each input tunnel traffic sequence are randomly masked with a probability of 15% through the mask packet model MPM, of which 80% are replaced with [MASK], or a symbol is randomly replaced with a probability of 10%, or no processing is performed with a probability of 10%.

6. The identification method according to claim 1, characterized in that: The pre-trained network model in step S2 is a Transformer encoder, each of which consists of two sublayers: a multi-head self-attention mechanism module and a fully connected feed-forward network with position encoding; each sublayer uses residual connection and performs layer normalization.

7. The identification method according to claim 1, characterized in that: In step S3, the target tunnel user behavior traffic is segmented into session flows and data packets according to the five-tuple, and the traffic is labeled based on the target tunnel user behavior.

8. The identification method according to claim 1, characterized in that: In step S4, the hidden state features of the vector representation of byte features, the data packet length sequence, and the data packet arrival time interval sequence obtained based on the convolutional neural network CNN include: Use a CNN-based byte feature encoder to obtain hidden state features of the vector representation of byte features; Two CNN-based sequence feature encoders are used to obtain the hidden state features of the packet length sequence and the packet arrival time interval sequence respectively; each sequence feature encoder includes three repeated CNN modules and one fully connected layer module; each CNN module includes two convolutional layers, one activation layer and one mean pooling layer, each convolutional layer is normalized by BN, and the activation layer uses the activation function ReLU; the output features are regularized by Dropout; the fully connected layer module includes one fully connected layer and one activation layer, the fully connected layer is normalized by BN, the activation layer uses the tanh activation function, and the output features are regularized by Dropout.

9. The identification method according to claim 1, characterized in that: In step S4, feature fusion is performed based on the attention mechanism to obtain the comprehensive hidden state features of the tunnel user behavior traffic.

10. A system for identifying refined behaviors of tunnel users, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method according to any one of claims 1 to 9 when executing the computer program.

Images