A method and system for identifying fine-grained behaviors of tunnel users

Abstract

The application discloses a tunnel user fine behavior identification method and system, and belongs to the network flow detection field. Byte features of unlabeled tunnel flow are extracted, the context relationship of the unlabeled tunnel flow is learned through a pre-trained network model, and a vector representation of the byte features is generated; byte features of target tunnel user behavior flow, a data packet length sequence and a data packet arrival time interval sequence are extracted, and a vector representation of the byte features is obtained through the pre-trained network model; hidden state features of the vector representation of the byte features, the data packet length sequence and the data packet arrival time interval sequence are obtained based on a convolutional neural network (CNN), and then comprehensive hidden state features are obtained through fusion; and the comprehensive hidden state features are input into a classifier to predict the target tunnel user behavior. The application can solve the problem that existing methods are difficult to identify tunnel user behavior in a real network environment.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network traffic detection, and specifically relates to a method and system for identifying fine-grained behaviors of tunnel users. BACKGROUND

[0002] Tunnel technology, also known as virtual private network (VPN), encapsulates data packets generated by various applications through encryption protocols, enabling secure transmission over public networks. With the rapid development of the Internet and increasing emphasis on communication security, tunnel technology has become an important part of network communication, meeting the security needs of individuals and enterprises. However, the widespread use of tunnel technology has increased the complexity of user behavior, posing significant challenges to network security and management. While protecting the privacy and anonymity of network users, tunnel technology may also hide some critical information, thereby evading the monitoring system of firewalls, which adds additional difficulty to network management. For example, on the Twitter platform, different user behaviors, including liking, retweeting, and commenting, may indicate the presence of different types of malicious users.

[0003] In the context of widespread use of tunnel technology, scenarios such as quality of service (QoS) optimization, intrusion detection, and content monitoring in reality all require effective methods to identify fine-grained encrypted tunnel traffic. Not only is it necessary to distinguish between tunnel traffic and non-tunnel traffic, but methods to identify fine-grained applications and behaviors have become an urgent need. Taking quality of service (QoS) optimization as an example, due to the rapid growth of the number of users and network bandwidth usage, Internet service providers (ISPs) strive to optimize bandwidth allocation for different services. By identifying specific behaviors of users in tunnel networks, ISPs can allocate appropriate available bandwidth to each user after considering user experience and cost, thereby achieving cost savings in bandwidth without affecting user experience. This research aims to accurately identify these fine-grained behaviors in tunnels, improving the accuracy and effectiveness of different activity detection.

[0004] In recent years, there have been a large number of studies on tunnel traffic classification. Tunnel traffic classification is mainly based on machine learning and deep learning. The method based on machine learning mainly extracts effective features (such as the maximum packet length) from the tunnel traffic, and then inputs them into a machine learning classifier (such as random forest). However, this method largely depends on expert experience to select specific features, and even trivial statistical features can affect the analysis performance. Tunnel traffic is more difficult to construct effective features manually than non-tunnel traffic due to its complexity and high degree of chaos in features, so the traditional machine learning method has limitations in dealing with tunnel traffic classification and is difficult to achieve ideal classification accuracy. Compared with traditional models, existing deep learning models significantly improve the performance of tunnel traffic classification due to their excellent feature extraction capability. However, the existing deep learning models are heavily dependent on the number and distribution of labeled training data, and fail to fully utilize the rich potential information in the original packet data, which may lead to model bias and make it difficult to adapt to emerging encryption technologies.

[0005] In the field of natural language processing (NLP) and computer vision (CV), the use of massive unlabeled data to pretrain models has shown excellent performance. Through self-supervised learning, pretraining methods greatly reduce the need for labeled training data. Some studies have applied pretraining methods to encrypted traffic classification and achieved good results. However, these pretraining methods generally use traffic bytes and focus on a single feature, which may result in the loss of important information. Some other methods use packet length sequences as features, but ignore other important features such as packet time interval sequences. Currently, all these methods generally ignore the integration of various potential information in the original packet data, and cannot solve fine-grained tasks such as identifying tunnel user behavior. In addition, although pretraining-based models can learn unbiased data representations from large-scale unlabeled data and can be ported to downstream tasks through fine-tuning, current pretraining models are not specifically optimized for fine-grained identification of user behavior in tunnel traffic.

[0006] Therefore, the increasing size of tunnel traffic in real network environments requires a model that can fully utilize tunnel traffic features and has strong feature mining capability to identify fine-grained behavior of tunnel users, and thus realize monitoring of tunnel users, which is of great significance for improving network security, reducing potential attack threats, and ensuring the security and stability of network environments. SUMMARY

[0007] The application aims to provide a tunnel user fine-grained behavior recognition method and system based on multi-feature fusion technology and large-scale pre-training model, which extracts and combines byte feature information, data packet length sequence information and data packet arrival time interval sequence information in tunnel traffic to predict corresponding fine-grained behavior of tunnel users, and solves the problem that existing methods are difficult to recognize tunnel user behavior in real network environment.

[0008] To achieve the above purpose, the technical solution adopted by the application is as follows:

[0009] A tunnel user fine-grained behavior recognition method, comprising the following steps:

[0010] S1: capturing unlabeled tunnel traffic;

[0011] S2: extracting byte features of the unlabeled tunnel traffic, learning context relationship of the unlabeled tunnel traffic through a pre-training network model, and generating vector representation of the byte features;

[0012] S3: capturing target tunnel user behavior traffic;

[0013] S4: extracting byte features, data packet length sequence and data packet arrival time interval sequence of the target tunnel user behavior traffic, obtaining vector representation of the byte features through the pre-training network model; obtaining hidden state features of the vector representation of the byte features, the data packet length sequence and the data packet arrival time interval sequence based on a convolutional neural network (CNN), and then obtaining comprehensive hidden state features of the tunnel user behavior traffic through fusion;

[0014] S5: inputting the comprehensive hidden state features into a classifier composed of a full connection layer and a softmax layer to predict the target tunnel user behavior;

[0015] Before predicting the target tunnel user behavior, a training stage is performed, the tunnel user behavior traffic captured in step S3 is labeled with a real label of tunnel user behavior, the prediction result is generated through steps S4-S5, the difference between the prediction result and the real label is calculated by using a cross-entropy loss function, and the model parameters are adjusted to minimize the loss.

[0016] Further, the captured unlabeled tunnel traffic is saved as a PCAP file in step S1, and the data streams in the PCAP file are classified according to five-tuple in step S2, and the PCAP file is converted into HEX format by using a Scapy tool.

[0017] Further, the method for extracting byte features in step S2 is: analyzing the TCP protocol layer of the unlabeled tunnel traffic, taking the sequence number of the TCP protocol layer as a flag string, and extracting a payload byte sequence from the data packet as byte features.

[0018] Further, in step S2, when pre-training the network model, the byte sequence of the byte feature is marked using symbols [CLS], [SEP], [PAD], and [MASK], [CLS] marks the start position of the input sequence, [SEP] is used to separate the sequence, [PAD] is used to fill the sequence to meet the minimum length requirement, and [MASK] is used to learn the context relationship of the traffic.

[0019] Further, in step S2, when pre-training the network model, the symbols in each tunnel traffic sequence input are randomly masked by the mask packet model MPM with a probability of 15%, in which 80% of the probability is replaced with [MASK], or a symbol is randomly replaced with a probability of 10%, or no processing is performed with a probability of 10%.

[0020] Further, in step S2, the pre-trained network model is a Transformer encoder, each Transformer encoder includes two sub-layers: a multi-head self-attention mechanism module and a position-coded fully connected feedforward network; each sub-layer adopts residual connection and performs layer normalization.

[0021] Further, in step S3, the target tunnel user behavior traffic is divided into session flows and packets according to the five-tuple, and the traffic is labeled based on the target tunnel user behavior.

[0022] Further, in step S4, the hidden state features of the vector representation of the byte feature, the packet length sequence, and the packet arrival time interval sequence based on the convolutional neural network CNN include:

[0023] The hidden state features of the vector representation of the byte feature are obtained using a CNN-based byte feature encoder;

[0024] The hidden state features of the packet length sequence and the packet arrival time interval sequence are obtained using two CNN-based sequence feature encoders respectively; each sequence feature encoder includes 3 repeated CNN modules and 1 fully connected layer module; each CNN module includes 2 convolution layers, 1 activation layer, and 1 mean pooling layer, and BN is used for normalization processing after each convolution layer, the activation layer uses the activation function ReLU; the output features are regularized using Dropout; the fully connected layer module includes 1 fully connected layer and 1 activation layer, the fully connected layer uses BN for normalization processing, the activation layer uses the tanh activation function, and the output features are regularized using Dropout.

[0025] Further, in step S4, feature fusion is performed based on the attention mechanism to obtain comprehensive hidden state features of the tunnel user behavior traffic.

[0026] A tunnel user fine behavior identification system comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0027] The present application has the following beneficial effects:

[0028] 1. The present application proposes a self-supervised pre-training method specifically for encrypted tunnel traffic, which learns byte feature representations of tunnel traffic using a large amount of unlabeled data, significantly reduces the dependence on manually labeled data, and effectively improves the generalization ability and adaptability to new traffic of the model.

[0029] 2. The present application adopts a multi-feature fusion method, combines original byte data, data packet length sequence features and data packet arrival time interval sequence features, and improves the utilization and feature mining of encrypted traffic by adding data packet arrival time interval sequence features. The present application splices the length feature vector and the time feature vector, and then uses feature fusion based on the attention mechanism with the byte feature vector, fully mines the potential information in the tunnel traffic using the attention mechanism-based fusion technology, without relying on expert knowledge for manual feature mining, realizes fine identification of tunnel user behavior, and significantly improves the accuracy and fine degree of identification.

[0030] 3. The present application designs a new loss function, which optimizes the final classification performance of the model while considering the independent classification performance of each feature, so that the model can fully utilize the advantages of each module during parameter updating, thereby more comprehensively learning the feature information in the tunnel traffic.

[0031] 4. Compared with traditional methods, the present application has significantly improved effectiveness in identifying tunnel user behavior, especially in complex network scenarios, showing stronger robustness and adaptability, verifying its wide practical application value.

[0032] 5. The present application supports multi-protocol and multi-scenario encrypted traffic analysis, is compatible with session flow and data packet granularity processing methods, can flexibly adapt to different target network services and tunnel user behavior, and shows high application flexibility and practicality. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 is a flowchart of a tunnel user fine behavior identification method in an embodiment of the present application.

[0034] Figure 2 is a structural schematic diagram of a Transformer encoder in an embodiment of the present application.

[0035] Figure 3 is a flowchart of a training stage in an embodiment of the present application.

[0036] Figure 4 Figure 1 is a structural schematic diagram of a sequence feature encoder in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the technical features and advantages or technical effects of the above technical solutions of the present application more obvious and easy to understand, the following will be described in detail with reference to the drawings.

[0038] An embodiment of the present application specifically discloses a tunnel user fine behavior recognition method, the flow of which is as shown in Figure 2, and the specific processing steps are as follows: Figure 1

[0039] Step S1: Capture large-scale unlabeled tunnel traffic.

[0040] Before determining the target network service list, a large amount of unlabeled tunnel traffic is collected from the gateway by manual or automatic script, and is saved in the form of PCAP file.

[0041] Step S2: Extract byte features of unlabeled tunnel traffic for pre-training.

[0042] The byte features of the unlabeled tunnel traffic are extracted, and the context relationship of the unlabeled tunnel traffic is learned through the pre-training network model, which specifically includes the following steps:

[0043] Step S2-1: For encrypted traffic of multiple protocols and multiple scenes, it is not necessary to classify the data stream in each captured PCAP file according to the five-tuple. The Scapy tool is used to convert the PCAP file into HEX format, and the sequence number (Sequence) of the TCP protocol layer is used as the mark string. Sequence is used to identify the order of the data packet, helping to extract the payload byte sequence from the data packet of the PCAP file as the byte feature.

[0044] Step S2-2: The purpose of pre-training is to train a model with byte encoding capability, and to encode each traffic packet into a vector in the payload byte encoder. Although the payload of encrypted traffic usually does not have semantics, research shows that the data generated by different applications has different randomness, and encrypted traffic still contains certain implicit patterns, especially the first few data packets of the traffic. The value range of the payload byte is from 0 to 65535, which has similar potential characteristics to the language structure in the real world. This method treats the payload byte of the data packet as a language-like string in natural language processing (NLP) for processing.

[0045] ​To enhance the pre-training effect, this method introduces special marks [CLS], [SEP], [PAD], and [MASK], where [CLS] is a special symbol added in front of each input example, representing the start of the input example; [SEP] is a special separator used to separate sequences; [PAD] is a filler symbol used to fill the sequence to meet the minimum length requirement; and [MASK] is used to learn the context relationship of traffic.

[0046] This method draws on the Masked Language Model (MLM) of BERT and proposes a Masked Packet Model (MPM) that randomly masks symbols in each encrypted tunnel traffic sequence with a 15% probability, where 80% of the probability is replaced with [MASK], or a 10% probability of randomly replacing a symbol, or a 10% probability of no processing.

[0047] In pre-training, a model based on the Transformer architecture is selected to learn the representation of payload bytes. The structure of each Transformer encoder is as shown in Figure 2 The residual connection is used outside each sub-layer, and then layer normalization is performed to improve the training effect and stability of the model.

[0048] Step S3: Capture target tunnel user behavior traffic.

[0049] Determine the target tunnel user behavior, collect the traffic generated by the target application service through manual or automatic script, and save it in the form of a PCAP file. For various scenarios of encrypted traffic identification, this method uses two common specifications of session flow and packet. Each PCAP file contains network communication traffic within a period of time, and the packet processing tool Tshark is used to cut the traffic into session flow and packet according to the five-tuple. In the training phase, the traffic is labeled based on the accessed target tunnel user behavior.

[0050] Step S4: Extract multi-dimensional features of tunnel traffic and perform fusion.

[0051] As shown in Figure 3In the training stage, the byte features, the packet length sequence (length features) and the packet inter-arrival time interval sequence (time features) of the tunnel user behavior traffic are extracted, and the vector representation of the byte features is obtained through a pre-trained network model. According to the principle of capturing local prominent features, a byte feature encoder based on a convolutional neural network (CNN) is used to learn the sequential hidden state features of the packets (for reference Kim, Yoon. Convolutional Neural Networks for Sentence Classification [C] / / 2014. DOI: 10.3115 / v1 / D14-1181.), and two CNN-based sequence feature encoders are used to generate different hidden state features from the packet length sequence with direction and the packet inter-arrival time interval sequence, respectively.

[0052] The two sequence feature encoders have the same structure but different model parameters and do not share the structure as Figure 4 As shown, the structure is composed of three repeated CNN modules and a fully connected layer module. Each CNN module includes two consecutive convolution layers (Conv Layer), an activation layer (ReLU) and a mean pooling layer (Mean Pooling). The convolution layer is responsible for local feature extraction, and by increasing the number of convolution layers, the network depth can be enhanced and the feature encoding capability can be improved. Batch Normalization (BN) is used after each convolution layer for normalization processing to improve training stability and accelerate convergence; the activation layer uses the ReLU activation function, which can enhance the non-linear expression capability; the mean pooling layer is used for down-sampling to reduce the dimension of the features. The features extracted by the CNN module are regularized by Dropout (regularization method) to prevent overfitting. The fully connected layer module includes a fully connected layer (Dense Layer) and an activation layer (tanh), and Batch Normalization (BN) is used after the fully connected layer for normalization processing. The activation layer uses the tanh activation function to perform non-linear transformation on the output features, and finally uses Dropout for regularization processing. The overall structure uses multiple CNN modules and fully connected modules to efficiently encode the input sequence features, and uses Dropout and Batch Normalization at each stage to improve the robustness and generalization ability of the model.

[0053] The hidden states of the packet length sequence and the hidden states of the packet inter-arrival time interval sequence are spliced, and then the feature fusion based on the attention mechanism is performed with the hidden states of the byte features to finally generate the comprehensive hidden state features of the tunnel traffic.

[0054] Step S5: Identify the tunnel user behavior.

[0055] The classifier composed of a fully connected layer and a softmax layer is used to classify based on the comprehensive hidden state features, predict the tunnel user behavior and assign corresponding labels. Usually, the cross-entropy loss function is used to calculate the difference between the predicted results and the true labels, and the model calculates the gradient of the loss function to the parameters of each model through the back propagation algorithm, and adjusts the model parameters (such as weights and biases) according to the gradient information to minimize the loss. After training, it is formally used to identify tunnel user behavior.

[0056] The method fully utilizes the advantages of original byte features, data packet length sequences and data packet arrival time interval sequences, and improves the recognition ability of the model to tunnel traffic user behavior.

[0057] Experimental test:

[0058] The following 11 representative encrypted traffic recognition models are selected for comparison with the present application (Ours):

[0059] Machine learning methods: AppScanner [1], CUMUL [2], GRAIN [3];

[0060] Deep learning methods: FS-Net [4], DF [5], App-Net [6];

[0061] Graph neural network methods: GraphDApp [7], TFE-GNN [8];

[0062] Pre-training methods: PERT [9], ET-BERT

[10] , PEAN

[11] .

[0063] The experimental results on the self-collected data set are shown in Table 1:

[0064] Table 1

[0065]

[0066] The experimental results on the air opening data sets ISCX-VPN, ISCX-nonVPN and LFETT2021-SSR, LFETT2021-Vmess data sets are shown in Table 2:

[0067] Table 2

[0068]

[0069] References:

[0070] 1.V.F.Taylor,R.Spolaor,M.Conti,and I.Martinovic,“Appscanner:Automaticfingerprinting of smartphoneapps from encrypted network traffic,”in 2016IEEEEuropean Symposium on Security and Privacy

[0071] (EuroS&P).IEEE,2016,pp.439–454.

[0072] 2.A.Panchenko,F.Lanze,J.Pennekamp,T.Engel,A.Zinnen,M.Henze,andK.Wehrle,“Websitefingerprinting at internet scale.”in NDSS,2016.

[0073] 3.F.Zaki,F.Afifi,S.Abd Razak,A.Gani,and N.B.Anuar,“Grain:Granularmulti-label encrypted trafficclassification using classifier chain,”ComputerNetworks,vol.213,p.109084,2022.

[0074] 4.C.Liu,L.He,G.Xiong,Z.Cao,and Z.Li,“Fs-net:A flow sequence networkfor encrypted trafficclassification,”in IEEE INFOCOM 2019-IEEE Conference OnComputer Communications.IEEE,2019,pp.

[0075] 1171–1179.

[0076] 5. P. Sirinam, M. Imani, M. Juarez, and M. Wright, “Deep fingerprinting: undermining website fingerprinting defenses with deep learning,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1928-1943.

[0077] 6. X. Wang, S. Chen, and J. Su, “App-net: A hybrid neural network for encrypted mobile traffic classification,” in IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops (INFOCOMWKSHPS). IEEE, 2020, pp. 424-429.

[0078]

[0079] 7. M. Shen, J. Zhang, L. Zhu, K. Xu, and X. Du, “Accurate decentralized application identification via encrypted traffic analysis using graph neural networks,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 2367-2380, 2021.

[0080] 8. H. Zhang, L. Yu, X. Xiao, Q. Li, F. Mercaldo, X. Luo, and Q. Liu, “Tfe-gnn: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2066-2075.​

[0081] 9. H. Y. He, Z. G. Yang, and X. N. Chen,“Pert: Payload encoding representation from transformer for encrypted traffic classification,” in 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K). IEEE,

[0082] 2020, pp. 1-8.

[0083] 10. X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu,“Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” in Proceedings of the ACM Web Conference

[0084] 2022, 2022, pp. 633-642.

[0085] 11. P. Lin, K. Ye, Y. Hu, Y. Lin, and C.-Z. Xu,“A novel multimodal deep learning framework for encrypted traffic classification,” IEEE / ACM Transactions on Networking, 2022.

[0086] Although the present application has been disclosed with examples as above, it is not intended to limit the present application, and any appropriate modification or equivalent replacement made by those skilled in the art to the technical solutions of the present application shall be covered within the protection scope of the present application, and the protection scope of the present application shall be subject to the limitations of the claims.

Claims

1. A method for identifying refined behaviors of tunnel users, characterized in that, The method comprises the following steps: S1: capturing unlabeled tunnel traffic; S2: extracting byte features of the unlabeled tunnel traffic, learning the context relationship of the unlabeled tunnel traffic through a pre-trained network model, and generating a vector representation of the byte features; S3: capturing target tunnel user behavior traffic; S4: extracting byte features, packet length sequences and packet arrival time interval sequences of the target tunnel user behavior traffic, obtaining a vector representation of the byte features through a pre-trained network model; obtaining hidden state features of the vector representation of the byte features, the packet length sequences and the packet arrival time interval sequences based on a convolutional neural network CNN, and then obtaining comprehensive hidden state features of the tunnel user behavior traffic through fusion; S5: inputting the comprehensive hidden state features into a classifier composed of a fully connected layer and a softmax layer to predict the target tunnel user behavior. Before predicting the target tunnel user behavior, a training stage is performed, the tunnel user behavior traffic captured in step S3 is labeled with a tunnel user behavior real label, a prediction result is generated through steps S4-S5, a difference between the prediction result and the real label is calculated by using a cross-entropy loss function, and model parameters are adjusted to minimize the loss.

2. The identification method of claim 1, wherein, In step S1, the captured unlabeled tunnel traffic is saved as a PCAP file, and in step S2, data streams in the PCAP file are classified according to five-tuples, and the PCAP file is converted into a HEX format by using a Scapy tool.

3. The identification method of claim 1, wherein, In step S2, the method for extracting byte features is as follows: the TCP protocol layer of the unlabeled tunnel traffic is parsed, the sequence number of the TCP protocol layer is taken as a mark string, and a payload byte sequence is extracted from the data packet as byte features.

4. The identification method of claim 1, wherein, In step S2, when the pre-trained network model is trained, the byte sequence of the byte features is marked by using symbols [CLS], [SEP], [PAD] and [MASK], [CLS] marks the start position of the input sequence, [SEP] is used to separate the sequence, [PAD] is used to fill the sequence to meet the minimum length requirement, and [MASK] is used to learn the context relationship of the traffic.

5. The identification method of claim 4, wherein, In step S2, when the pre-trained network model is trained, the mask packet model MPM is used to randomly mask the symbols in each tunnel traffic sequence input at a probability of 15%, in which 80% of the probability is replaced by [MASK], or 10% of the probability is randomly replaced by a symbol, or 10% of the probability is not processed.

6. The identification method of claim 1, wherein, In step S2, the pre-trained network model is a Transformer encoder, each Transformer encoder includes two sub-layers: a multi-head self-attention mechanism module and a position-coded fully connected feedforward network; each sub-layer adopts a residual connection and performs layer normalization.

7. The identification method of claim 1, wherein, In step S3, the target tunnel user behavior traffic is divided into session streams and data packets according to five-tuples, and the traffic is labeled based on the target tunnel user behavior.

8. The identification method of claim 1, wherein, In step S4, the hidden state features of the vector representation of the byte features, the packet length sequences and the packet arrival time interval sequences based on the convolutional neural network CNN comprise: a hidden state feature of a vector representation of the byte feature is obtained using a CNN-based byte feature encoder; hidden state features of a packet length sequence and a packet inter-arrival time sequence are respectively obtained using two CNN-based sequence feature encoders; each sequence feature encoder comprises 3 repeated CNN modules and 1 fully connected layer module; each CNN module comprises 2 convolution layers, 1 activation layer and 1 mean pooling layer, and BN is used for normalization processing after each convolution layer, the activation layer adopts an activation function ReLU; the output feature is regularized using Dropout; the fully connected layer module comprises 1 fully connected layer and 1 activation layer, the fully connected layer is normalized using BN, the activation layer adopts a tanh activation function, and the output feature is regularized using Dropout.

9. The identification method of claim 1, wherein, In step S4, feature fusion is performed based on an attention mechanism to obtain comprehensive hidden state features of the tunnel user behavior traffic.

10. A system for recognizing refined behaviors of tunnel users, characterized in that, The computer program product comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of the method in any one of claims 1-9 when executing the computer program.

Images