Accurate classification method and system for encrypted traffic of Internet of Things

Abstract

The invention belongs to the technical field of Internet of Things, and discloses an Internet of Things encrypted traffic accurate classification method. The whole life cycle of encrypted traffic data acquisition, processing, extraction and classification is throughout. The implicit correlation between the original bytes is mined, and the internal feature information of the flow graph is effectively extracted and fused by using the graph neural network. And meanwhile, the problem of class imbalance in the encrypted traffic data set is well solved through the balance loss function. According to the method, a simulation experiment is carried out on two encrypted traffic data sets, the validity of the method is verified when the two encrypted traffic data sets are compared with a plurality of reference models, and a certain guarantee can be provided for the security of the Internet of Things. By using a small amount of marked data and a large amount of unmarked data, better traffic identification performance and relatively high accuracy are realized, and the network security of the traffic of the Internet of Things is ensured by using a small amount of resources.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things, and in particular relates to a method and system for accurately classifying encrypted traffic of Internet of Things. Background Art

[0002] The Internet of Things (IoT) plays a significant role in all aspects of users' daily lives. It covers multiple fields such as healthcare, automobiles, entertainment, industrial appliances, sports, and home. According to statistics, there will be more than 26.66 billion IoT devices active in the world in 2020, and it is expected that there will be 75 billion IoT devices in the world by 2025. The realization of such a large-scale IoT network requires the large-scale deployment of sensor nodes or smart devices with sensing and reporting capabilities, which leads to a large amount of traffic transmitting information through the network. Different types of traffic, such as information in the form of voice, financial transactions, driverless cars, social networks, etc., need to be processed on time, delivered quickly, or filtered for security reasons. These requirements have led to the need for more accurate classification of IoT traffic.

[0003] Traffic classification is an important part of network security and plays a key role in improving network quality of service (QoS) and user experience (QoE). In recent years, network traffic has been encrypted, which not only protects the privacy and anonymity of Internet users, but also brings new challenges to traffic classification. For example, attackers use encryption technology to evade detection in order to hide their own behavior, thereby invading and attacking the system. In addition, the use of some privacy-enhancing tools, such as VPN and Tor, has made the network environment more complex, which has increased the difficulty of traffic classification to a certain extent. In other words, the classification of encrypted traffic has become a problem that needs to be solved urgently, which has attracted great attention from academia and industry.

[0004] Early network traffic classification methods mainly rely on port-based, deep packet inspection (DPI). Port-based methods use the correspondence between ports and protocols for classification, but they become ineffective with the surge in unregistered and random ports. DPI-based methods identify specific protocols and application data by analyzing data packets, but the payload information of network traffic is no longer available after encryption, so this method is no longer reliable. In order to cope with the challenges brought by encryption, the academic community uses machine learning (ML)-based methods to analyze the feature information in encrypted traffic for traffic classification. It does not need to use the payload information of the data packet, and the feature information used has good robustness. However, this method relies on manual feature extraction, which takes a long time, and as network dynamics evolve, the manually extracted features may no longer be effective. In recent years, as a branch of machine learning, deep learning (DL) has triggered a research boom on autonomous feature learning, eliminating the step of manual feature extraction and has been successfully applied in the field of encrypted traffic classification. DL-based methods directly extract features from raw traffic for classification in an end-to-end manner and achieve good results. However, the network traffic environment is becoming more and more complex and changeable. The feature extraction capabilities of models such as CNN and RNN are limited. They cannot capture effective information data from encrypted traffic. At the same time, they ignore the difference between Header and Payload and simply learn the two as a whole. Currently, Graph Neural Networks (GNN) are gradually being widely used due to their powerful ability to process unstructured data. They classify by identifying the topological structure in the traffic graph.

[0005] In addition, due to the different popularity of network services, there is usually a class imbalance problem in encrypted traffic datasets, that is, the number of samples of commonly used applications is much larger than the number of samples of other applications. This class imbalance problem will cause the model to prefer the category with more samples during the classification process, ignoring or directly overwhelming the category with fewer samples. The classifier is based on the assumption that the data set is balanced, so its performance will degrade when processing class imbalanced datasets, which will have an impact on network resource management and network security. However, there is little research on the class imbalance problem in current encrypted traffic classification methods.

[0006] Encrypted traffic classification based on machine learning

[0007] Traditional machine learning methods mainly rely on manually extracted features. In the past few decades, they have played a relatively important role and have been widely used. Various ML methods have emerged and achieved good classification performance.

[0008] Taylor et al. proposed an AppScanner method for encrypted traffic classification, which extracts statistical features such as packet length and interval time from flow data, and then uses random forest to classify the input to identify mobile applications; Shen et al. proposed a web fingerprint recognition method FineWP, which extracts the cumulative sum of packet length, block, sequence features, and statistical features in the two-way interaction between the client and the server as input, and then processes the above features through machine learning algorithms such as random forest, K nearest neighbor and decision tree, and creates network fingerprints to achieve fine-grained identification; Zaki et al. proposed a GRAIN encrypted traffic classification method, which achieves different classification granularities by linking two random forest classifiers together to process 7 statistical features of packet payload length The method maintains good performance compared with four baseline classifiers on the ISCXVPN-nonVPN dataset; Han et al. proposed a lightweight unsupervised classification model for encrypted malicious traffic. First, the statistical information extracted from the data packet is compressed to improve the model operation efficiency, and then the classic K-means clustering algorithm is used to implement classification, which solves the problem of difficulty in obtaining rich high-quality labels in actual scenarios. Finally, an accuracy of more than 90% was achieved on the public encrypted malware traffic dataset DataCon2020; Koumar et al. designed a novel traffic feature expansion method, and proposed 69 common features based on statistics, time, frequency, distribution and behavior, and then used 14 traditional machine learning algorithms including RF, K-Nearest Neighbor (KNN) and SVM on 15 well-known public datasets for verification. Experiments show that the EXtreme Gradient Boosting (XGBoost) algorithm has the best performance, and achieved classification accuracy of 94.35% and 98.49% on the ISCX-VPN and UNSW-NB15 datasets, respectively. However, the above methods are all based on feature engineering, which requires manual feature extraction, and has high requirements on the knowledge reserve of researchers. At the same time, they are time-consuming and lack robustness. Therefore, there is an urgent need to seek new learning algorithms to break out of the limitations of machine learning methods.

[0009] Encrypted traffic classification based on deep learning

[0010] In recent years, deep learning has become a popular solution in the field of encrypted traffic classification due to its ability to automatically extract features from massive encrypted traffic data, improving the accuracy and effectiveness of classification.

[0011] WANG et al. first introduced end-to-end deep learning technology into the field of encrypted traffic classification. This method uses one-dimensional CNN to automatically extract features from raw traffic data and learn its nonlinear relationship to better characterize the one-dimensional sequence characteristics of encrypted traffic. The experimental results on the ISCX VPN-nonVPN dataset show that the proposed method has been greatly improved in performance; Liu et al. proposed an end-to-end model Fs-Net, which uses a bidirectional gated recurrent unit to mine the time information in the packet length sequence, and adds a reconstruction mechanism to the encoding-decoding structure to enhance the effectiveness of the features; Lin et al. proposed an encrypted traffic identification scheme TSCRNN combining CNN and LSTM for massive traffic in the industrial Internet of Things. This scheme first extracts abstract spatial features through CNN, then introduces stacked bidirectional LSTM to learn temporal features, and finally TSCRNN is used in ISCX. Experiments were conducted on Tor-nonTor and a high accuracy rate was achieved, so early identification of traffic can be achieved using only a small number of data packets; Lin et al. designed a bidirectional encoding pre-training model ET-BERT based on Transformer. This method first learns a general traffic representation in a large amount of unlabeled encrypted traffic, and then fine-tunes it on a small amount of labeled data to complete specific tasks; Liu et al. designed a new scheme ATVITSC, which first converts the Session in the original traffic into a grayscale image, retains the sequential characteristics between data packets, and then feeds it in parallel to the packet visual converter and spatiotemporal feature extraction module to capture global and spatiotemporal features, and finally uses a dynamic reinforcement mechanism to fuse parallel features to achieve encrypted traffic classification. Although the above methods have achieved good results, the process of extracting features from raw bytes is time-consuming, and with the update and iteration of encryption protocols, the ability of most models to capture key information is also declining.

[0012] Encrypted traffic classification based on graph neural network

[0013] In real scenarios, encrypted traffic is unstructured data, and graph neural networks have great potential in processing unstructured data. They have been applied by many scholars to the field of encrypted traffic classification.

[0014] Shen et al. proposed a fingerprint recognition method GraphApp, which constructs a traffic interaction graph based on the data packets generated during the interaction between the client and the server, which contains a relatively rich information representation, and then uses a powerful graph neural network for classification. This method has achieved good performance in both closed and open scenarios; Zhang et al. constructed a byte-level traffic graph based on point-by-point mutual information as the input of GNN, capturing the implicit correlation between the original bytes and achieving good results; Han et al. proposed a dual embedding graph neural network model DE-GNN, which first embeds and encodes the Header and Payload respectively, then extracts the packet-level features of the Header and Payload through CNN and constructs a traffic interaction graph based on them, and finally extracts the flow-level features through GNN and fuses them to achieve encrypted traffic classification; Li et al. proposed a new graph structure based on communication behavior, in which the vertices of the graph structure are interaction states and the edges are transfer states, and then captures the subgraphs through GNN for classification; Cui et al. used data packets in the original traffic to construct a flow graph with rich node attributes, and then integrated two types of GNNs to extract features to achieve classification and recognition.

[0015] Through the above analysis, the problems and defects of the prior art are as follows:

[0016] (1) The network traffic environment is becoming increasingly complex and changeable. The feature extraction capabilities of models such as CNN and RNN are limited. They are unable to capture effective information data from encrypted traffic. At the same time, they ignore the difference between Header and Payload and simply learn the two as a whole.

[0017] (2) Due to the different popularity of network services, there is usually a class imbalance problem in the encrypted traffic dataset, that is, the number of samples of commonly used applications is far greater than the number of samples of other applications. Summary of the invention

[0018] In view of the problems existing in the prior art, the present invention provides a method for accurately classifying encrypted traffic of the Internet of Things.

[0019] The present invention is implemented in this way: a method for accurately classifying encrypted traffic of the Internet of Things includes:

[0020] Step 1: In the preprocessing stage, the original traffic data is segmented, sampled, and vectorized;

[0021] Step 2, in the parallel traffic graph construction phase, the method constructs the traffic graph based on byte correlation from two perspectives: the packet header and the payload;

[0022] Step 3, in the double embedding stage, a certain number of bytes are selected from the two traffic graphs and embedded into high-dimensional vectors;

[0023] Step 4: In the graph feature extraction and fusion stage, the improved graph neural network is introduced to extract the abstract features of the traffic graph, and then the two features are fused through the temporal fusion attention module TFAM;

[0024] Step 5: In the classification stage, this method learns the fused features through the fully connected layer and the Softmax layer to achieve encrypted traffic classification, and also uses EQL v2 as the loss function to solve the class imbalance problem.

[0025] Further, the pretreatment method is as follows:

[0026] (1) Pcap file segmentation: Use the tool Splitcap to split the files in the dataset to obtain bidirectional streams;

[0027] (2) Data cleaning: discard bad packets or retransmitted packets in the split files, and remove empty flows with a data packet length of 0 and overlong flows with a length greater than 10,000.

[0028] Further, the parallel flow graph is constructed:

[0029] Set the two co-occurring bytes to i1 and i2 respectively, and then calculate the PMI value between them according to formula (1);

[0030]

[0031] Among them, p(i1,i2) represents the probability of two bytes appearing at the same time, and p(i1) and p(i2) represent the probability of bytes i1 and i2 appearing respectively. It is worth noting that i1 and i2 only establish an edge when the PMI value is positive, and the corresponding value in the adjacency matrix is ​​1. At other times, no edge is established, and the corresponding value in the adjacency matrix is ​​0, because i1 and i2 have almost no correlation at this time.

[0032] The flow graph is constructed through the above steps. Since PMI(i1, i2) = PMI(i2, i1), the flow graph constructed by the present invention is an undirected graph.

[0033] Further, the dual embedding method:

[0034] First, select the number of bytes to be embedded from the two traffic graphs, denoted as N H and N P ; Then the selected bytes are embedded into a high-dimensional vector. At the same time, since the value range of a byte is [-128, 127], the dimension d is set to 256 in the present invention; Finally, the embedding matrices of the traffic Header graph and the traffic Payload graph are and Each row vector represents a byte.

[0035] Further, the graph feature extraction:

[0036] GATv2 is introduced into the field of encrypted traffic classification. The model modifies the internal operation order of GAT to form a dynamic attention mechanism to improve its expression ability, as shown below;

[0037] GAT:e(h i ,h j )=LeakyReLU(a T ·[Wh i ||Wh j ]) (2)

[0038] GATv2:e(h i ,h j )=a T LeakyReLU(W·[h i ||h j ]) (3)

[0039] In the formula, i and j are nodes, h i and h j is its node vector, e() is a scoring function, which is mainly used to evaluate the importance of the characteristics of neighbor nodes to the point of the present invention, W is the weight matrix to be learned, a is the vector to be learned, and a T is the transpose of a, || is the concatenation operation, and LeakyReLU is the activation function. From formula (2), it can be seen that the learnable parameters a and W are operated continuously.

[0040] As can be seen from the above, for a flow graph, the present invention first calculates e(h i ,h j ); Secondly, the nodes are normalized using the softmax function to ensure that the nodes are easy to compare, as shown below;

[0041]

[0042] In the formula, α ij is the normalized attention coefficient, N i is the set of all neighbor nodes of node i, j' is any neighbor node of node i, exp() is the exponential function, and softmax is the activation function; then GATv2 uses the obtained α ij Implement feature updates;

[0043]

[0044] In the formula, h' iis the updated feature vector of node i, σ is the activation function; at the same time, the present invention connects the updated feature vectors of node i in multiple GATv2 layers;

[0045]

[0046] In the formula, is the final feature vector of node i, and k is the number of GATv2 layers stacked by the model of the present invention; finally, all nodes in the flow graph are processed by mean pooling to obtain the final graph feature vector;

[0047]

[0048] Where g is the final graph feature vector, N is the number of nodes in the flow graph, is the addition operation.

[0049] Furthermore, the TFAM:

[0050] TFAM extracts and fuses key information in two dimensions: space and channel. First, average pooling and maximum pooling are performed on the header vector and payload vector respectively.

[0051]

[0052] In the formula, h a ,p a ,h m ,p m They represent the feature vectors of the Header vector and the Payload vector after average pooling and maximum pooling respectively; then they are concatenated;

[0053] s c ,c c =concat(h a ,h m ,p a ,p m ) (9)

[0054] In the formula, s c and c s They represent the feature vectors after the spatial dimension and channel dimension are concatenated respectively, and concat() is the concatenation operation; then the weights of the two are determined by one-dimensional convolution, and the weights are normalized by the softmax function;

[0055]

[0056] Where W s and W cRespectively represent the weights of the spatial dimension and the channel dimension; finally, the present invention multiplies the above weights with the initial Header vector and Payload vector and then adds them;

[0057] F V =W s *g p +W c *g h (11)

[0058] In the formula, F V It is the fusion feature of the Header vector and the Payload vector; through the above steps, the present invention can retain the key information in the two types of traffic graphs and discard useless information, thereby achieving effective fusion of traffic graph features;

[0059] Furthermore, the EQL v2:

[0060] Generally speaking, the encrypted traffic classification method uses the cross entropy loss function as the loss function; however, due to the class imbalance problem in the data set, the classification model is biased towards the majority class samples; therefore, the present invention uses EQL v2 as the loss function to eliminate this problem;

[0061] First, the calculation process of the model output for the positive and negative gradients of the loss function is as follows:

[0062]

[0063] In the formula, z j is the model output, L is the loss function, represents the probability that the i-th sample belongs to category j, y is the true label, and L is the number of samples included; then the positive and negative gradients are processed by reweighting coefficients:

[0064]

[0065] in, and is the weighting coefficient, is the accumulated ratio after iteration t times, α is the balance coefficient, and f() is the mapping function, which is expressed as follows:

[0066]

[0067] At this time, the positive and negative gradients are updated as follows:

[0068]

[0069] In addition, the ratio of positive and negative gradients for the next iteration needs to be updated:

[0070]

[0071] In summary, the present invention can effectively solve the class imbalance problem in the training stage through EQLv2;

[0072] Further, the traffic classification is:

[0073] After obtaining the effective fusion representation of the Header flow graph and the Payload flow graph through the above parts and alleviating the class imbalance problem through EQLv2, the present invention uses the fully connected layer and the softmax layer for processing to obtain the final prediction result, and finally uses EQLv2 as the loss function to calculate the loss and perform back propagation;

[0074] loss = EQLv2(softmax(FC(F V )))(17)

[0075] In the formula, loss is the loss value and FC is the fully connected layer.

[0076] Another object of the present invention is to provide an Internet of Things encrypted traffic accurate classification system comprising:

[0077] The preprocessing module is used to perform flow segmentation, sampling, and vectorization processing on the original traffic data;

[0078] The classification module is used to extract abstract features through graph neural networks and then introduce them into the fully connected layer for classification.

[0079] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for accurately classifying encrypted traffic of the Internet of Things.

[0080] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the method for accurately classifying encrypted traffic in the Internet of Things.

[0081] Another object of the present invention is to provide an information data processing terminal, which is used to implement the Internet of Things encrypted traffic accurate classification system.

[0082] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0083] First, the present invention proposes a precise classification method for encrypted traffic in the Internet of Things, which runs through the entire life cycle of encrypted traffic data collection, processing, extraction and classification. Not only the implicit correlation between the original bytes is mined, but also the intrinsic feature information of the traffic graph is effectively extracted and fused using the graph neural network. At the same time, the class imbalance problem in the encrypted traffic data set is better solved through the balanced loss function. The proposed method carries out simulation experiments on two encrypted traffic data sets, and verifies the effectiveness of the method of the present invention when compared with multiple benchmark models, which can provide certain guarantees for the security of the Internet of Things network. In the future, the performance effect of the model based on semi-supervised learning will be studied, and better traffic identification performance and relatively high accuracy will be achieved by using a small amount of labeled data and a large amount of unlabeled data, and the network security of the Internet of Things traffic will be ensured by using a small amount of resources.

[0084] This paper proposes a method for accurately classifying encrypted traffic in the Internet of Things. The main contributions are as follows:

[0085] (1) To address the problem that existing encrypted traffic classification methods use a mixture of Header and Payload, the present invention constructs traffic graphs from the perspectives of Header and Payload respectively based on the correlation between bytes to highlight the differences between the two.

[0086] (2) The present invention proposes a TFAM-GNN model, which uses GATv2 to extract the feature information of the Header and Payload respectively and fuses them through TFAM to form an overall graph vector representation, effectively improving the fine-grained classification performance of encrypted traffic.

[0087] (3) To address the class imbalance problem in encrypted traffic datasets, the present invention uses EQL v2 with a gradient-guided reweighting mechanism as the loss function. This function increases the weight of positive gradients and decreases the weight of negative gradients according to the ratio of positive and negative gradients accumulated by each classifier. This reweighting mechanism effectively improves the classification performance of the model and alleviates the class imbalance problem at a relatively low cost.

[0088] (4) The present invention conducts experiments on two challenging public encrypted traffic datasets, ISCX VPN-nonVPN and ISCX Tor-nonTor. The results show that the proposed method performs better and is superior to existing encrypted traffic classification methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0089] Figure 1 It is a flow chart of a method for accurately classifying encrypted traffic of the Internet of Things provided by an embodiment of the present invention.

[0090] Figure 2 This is a structural block diagram of the Internet of Things encrypted traffic accurate classification system provided by an embodiment of the present invention.

[0091] Figure 3 It is a model architecture diagram provided by an embodiment of the present invention.

[0092] Figure 4 It is a schematic diagram of the TFAM structure provided by an embodiment of the present invention.

[0093] Figure 5 It is a diagram of experimental results of the ISCX data set provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0095] like Figure 1 As shown, a method for accurately classifying encrypted traffic of the Internet of Things provided by an embodiment of the present invention includes the following steps:

[0096] S101, in the preprocessing stage, the original traffic data is subjected to flow segmentation, sampling, and vectorization processing;

[0097] S102, in the parallel traffic graph construction stage, the method constructs a traffic graph based on byte correlation from two perspectives of the packet header and the payload;

[0098] S103, in the double embedding stage, a certain number of bytes are selected from the two traffic graphs respectively and embedded into high-dimensional vectors;

[0099] S104, in the graph feature extraction and fusion stage, the abstract features of the traffic graph are extracted by introducing an improved graph neural network, and then the two features are fused through the temporal fusion attention module TFAM;

[0100] S105, in the classification stage, this method learns the fused features through the fully connected layer and the Softmax layer to achieve encrypted traffic classification, and also uses EQL v2 as the loss function to solve the class imbalance problem.

[0101] The preprocessing method provided by the embodiment of the present invention is as follows:

[0102] (1) Pcap file segmentation: Use the tool Splitcap to split the files in the dataset to obtain bidirectional streams;

[0103] (2) Data cleaning: discard bad packets or retransmitted packets in the split files, and remove empty flows with a data packet length of 0 and overlong flows with a length greater than 10,000.

[0104] The flow graph construction provided by the embodiment of the present invention is as follows:

[0105] Set the two co-occurring bytes to i1 and i2 respectively, and then calculate the PMI value between them according to formula (1);

[0106]

[0107] Among them, p(i1,i2) represents the probability of two bytes appearing at the same time, and p(i1) and p(i2) represent the probability of bytes i1 and i2 appearing respectively. It is worth noting that i1 and i2 only establish an edge when the PMI value is positive, and the corresponding value in the adjacency matrix is ​​1. At other times, no edge is established, and the corresponding value in the adjacency matrix is ​​0, because i1 and i2 have almost no correlation at this time.

[0108] The flow graph is constructed through the above steps. Since PMI(i1, i2) = PMI(i2, i1), the flow graph constructed by the present invention is an undirected graph.

[0109] The double embedding provided by the embodiment of the present invention:

[0110] First, select the number of bytes to be embedded from the two traffic graphs, denoted as N H and N P ; Then the selected bytes are embedded into a high-dimensional vector. At the same time, since the value range of a byte is [-128, 127], the dimension d is set to 256 in the present invention; Finally, the embedding matrices of the traffic Header graph and the traffic Payload graph are and Each row vector represents a byte.

[0111] The graph feature extraction provided by the embodiment of the present invention:

[0112] GATv2 is introduced into the field of encrypted traffic classification. The model modifies the internal operation order of GAT to form a dynamic attention mechanism to improve its expression ability, as shown below;

[0113] GAT:e(h i ,h j )=LeakyReLU(a T ·[Wh i ||Wh j ]) (2)

[0114] GATv2:e(h i ,h j )=a T LeakyReLU(W·[h i ||h j ]) (3)

[0115] In the formula, i and j are nodes, h i and h j is its node vector, e() is a scoring function, which is mainly used to evaluate the importance of the characteristics of neighbor nodes to the point of the present invention, W is the weight matrix to be learned, a is the vector to be learned, and a T is the transpose of a, || is the concatenation operation, and LeakyReLU is the activation function. From formula (2), it can be seen that the learnable parameters a and W are operated continuously.

[0116] As can be seen from the above, for a flow graph, the present invention first calculates e(h i ,h j ); Secondly, the nodes are normalized using the softmax function to ensure that the nodes are easy to compare, as shown below;

[0117]

[0118] In the formula, α ij is the normalized attention coefficient, N i is the set of all neighbor nodes of node i, j' is any neighbor node of node i, exp() is the exponential function, and softmax is the activation function; then GATv2 uses the obtained α ij Implement feature updates;

[0119]

[0120] In the formula, h' i is the updated feature vector of node i, σ is the activation function; at the same time, the present invention connects the updated feature vectors of node i in multiple GATv2 layers;

[0121]

[0122] In the formula, is the final feature vector of node i, and k is the number of GATv2 layers stacked by the model of the present invention; finally, all nodes in the flow graph are processed by mean pooling to obtain the final graph feature vector;

[0123]

[0124] Where g is the final graph feature vector, N is the number of nodes in the flow graph, is the addition operation.

[0125] The TFAM provided in the embodiment of the present invention:

[0126] TFAM extracts and fuses key information in two dimensions: space and channel. First, average pooling and maximum pooling are performed on the header vector and payload vector respectively.

[0127]

[0128] In the formula, h a ,p a ,h m ,p m They represent the feature vectors of the Header vector and the Payload vector after average pooling and maximum pooling respectively; then they are concatenated;

[0129] s c ,c c =concat(h a ,h m ,p a ,p m ) (9)

[0130] In the formula, s c and c s They represent the feature vectors after the spatial dimension and channel dimension are concatenated respectively, and concat() is the concatenation operation; then the weights of the two are determined by one-dimensional convolution, and the weights are normalized by the softmax function;

[0131]

[0132] Where W s and W c Respectively represent the weights of the spatial dimension and the channel dimension; finally, the present invention multiplies the above weights with the initial Header vector and Payload vector and then adds them;

[0133] F V =W s *g p +W c *g h (11)

[0134] In the formula, F V It is the fusion feature of the Header vector and the Payload vector; through the above steps, the present invention can retain the key information in the two types of traffic graphs and discard useless information, thereby achieving effective fusion of traffic graph features;

[0135] EQL v2 provided in the embodiment of the present invention:

[0136] Generally speaking, the encrypted traffic classification method uses the cross entropy loss function as the loss function; however, due to the class imbalance problem in the data set, the classification model is biased towards the majority class samples; therefore, the present invention uses EQL v2 as the loss function to eliminate this problem;

[0137] First, the calculation process of the model output for the positive and negative gradients of the loss function is as follows:

[0138]

[0139] In the formula, z j is the model output, is the loss function, represents the probability that the i-th sample belongs to category j, y is the true label, and L is the number of samples included; then the positive and negative gradients are processed by reweighting coefficients:

[0140]

[0141] in, and is the weighting coefficient, is the accumulated ratio after iteration t times, α is the balance coefficient, and f() is the mapping function, which is expressed as follows:

[0142]

[0143] At this time, the positive and negative gradients are updated as follows:

[0144]

[0145] In addition, the ratio of positive and negative gradients for the next iteration needs to be updated:

[0146]

[0147] In summary, the present invention can effectively solve the class imbalance problem in the training stage through EQLv2;

[0148] Traffic classification provided by the embodiment of the present invention:

[0149] After obtaining the effective fusion representation of the Header flow graph and the Payload flow graph through the above parts and alleviating the class imbalance problem through EQLv2, the present invention uses the fully connected layer and the softmax layer for processing to obtain the final prediction result, and finally uses EQLv2 as the loss function to calculate the loss and perform back propagation;

[0150] loss = EQLv2(softmax(FC(F V )))(17)

[0151] In the formula, loss is the loss value and FC is the fully connected layer.

[0152] like Figure 2 As shown, the IoT encrypted traffic accurate classification system provided by the embodiment of the present invention includes:

[0153] The preprocessing module is used to perform flow segmentation, sampling, and vectorization processing on the original traffic data;

[0154] A parallel traffic graph construction module is used to construct traffic graphs based on byte correlation from two perspectives: packet header and payload.

[0155] The dual embedding module is used to select a certain number of bytes from two traffic graphs and embed them into high-dimensional vectors;

[0156] The graph feature extraction and fusion module is used to extract the abstract features of the traffic graph by introducing an improved graph neural network, and then fuse the two features through the temporal fusion attention module TFAM;

[0157] The classification module is used to learn the fused features through the fully connected layer and the Softmax layer to achieve encrypted traffic classification, and also uses EQLv2 as the loss function to solve the class imbalance problem.

[0158] After the raw traffic data enters the system, it is first processed by the preprocessing module. The module divides the data into streams to ensure that different streams do not interfere with each other; then the data stream is partially extracted through sampling technology to reduce the computational burden; finally, the data is vectorized and converted into a numerical form that the model can recognize, laying the foundation for the subsequent construction of the traffic map.

[0159] The parallel traffic graph construction module constructs the traffic graph from two perspectives, namely, the packet header and the payload, using the correlation between bytes.

[0160] Header perspective: Extract packet header information and build a header traffic graph based on its byte distribution and dependencies.

[0161] Payload perspective: Extract the payload part of the data and analyze its byte correlation to generate a payload flow graph.

[0162] This dual-perspective construction method can comprehensively characterize the characteristics of encrypted traffic and improve the accuracy of classification.

[0163] The dual embedding module is responsible for embedding the two constructed traffic graphs. It selects a certain number of key bytes from each traffic graph and maps these bytes to a high-dimensional vector space using a high-dimensional embedding method. In this way, the features of the traffic graph are abstracted into a numerical vector representation, providing a unified input format for subsequent feature extraction.

[0164] In the graph feature extraction and fusion module, an improved graph neural network (GNN) is introduced to extract deep abstract features of the traffic graph.

[0165] -After feature extraction, the features of the head flow graph and the payload flow graph are fused in the temporal dimension through the Temporal Fusion Attention Module (TFAM).

[0166] -This module can effectively capture the temporal variation relationship of traffic features, making the fused features more representative and discriminative.

[0167] The fused features pass through the fully connected layer and the Softmax layer to complete the classification task of encrypted traffic.

[0168] To solve the problem of class imbalance in encrypted traffic classification, the classification module is optimized using the improved loss function EQL v2. This method can improve the model's ability to identify minority classes, thereby achieving higher classification accuracy on unbalanced datasets.

[0169] The invention also provides a computer device, a computer-readable storage medium and an information data processing terminal based on the system.

[0170] Computer equipment: Stores and executes programs that implement the encrypted traffic classification method.

[0171] Storage medium: Contains the program for loading and running the classification algorithm.

[0172] Data processing terminal: Provides an integrated solution that enables users to efficiently deploy and apply the system.

[0173] The integrated design of software and hardware ensures the versatility and efficiency of the system.

[0174] This paper realizes efficient and accurate processing of encrypted traffic classification through modular design and advanced deep learning technology, providing strong support for data security analysis in the Internet of Things environment. This paper proposes a method for accurate classification of encrypted traffic in the Internet of Things. The main contributions are as follows:

[0175] (1) To address the problem that existing encrypted traffic classification methods use a mixture of Header and Payload, the present invention constructs traffic graphs from the perspectives of Header and Payload respectively based on the correlation between bytes to highlight the differences between the two.

[0176] (2) The present invention proposes a TFAM-GNN model, which uses GATv2 to extract the feature information of the Header and Payload respectively and fuses them through TFAM to form an overall graph vector representation, effectively improving the fine-grained classification performance of encrypted traffic.

[0177] (3) To address the class imbalance problem in encrypted traffic datasets, the present invention uses EQL v2 with a gradient-guided reweighting mechanism as the loss function. This function increases the weight of positive gradients and decreases the weight of negative gradients according to the ratio of positive and negative gradients accumulated by each classifier. This reweighting mechanism effectively improves the classification performance of the model and alleviates the class imbalance problem at a relatively low cost.

[0178] (4) The present invention conducts experiments on two challenging public encrypted traffic datasets, ISCX VPN-nonVPN and ISCX Tor-nonTor. The results show that the proposed method performs better and is superior to existing encrypted traffic classification methods.

[0179] This paper mainly describes the proposed model in detail. The specific framework is as follows Figure 3 As shown in the figure, it mainly includes four parts: traffic graph construction, dual embedding, graph feature extraction and fusion, and traffic classification.

[0180] Studies have shown that the statistical features in traffic flows are particularly unstable in some cases, resulting in a decrease in the performance of encrypted traffic classification. To this end, the present invention turns its research focus to raw bytes, mainly because raw bytes, as basic data units, contain more comprehensive and specific information about network traffic and are usually used to represent data packets. At the same time, the meaning of bytes is not only related to the byte value, but also depends on its location, that is, two bytes with the same byte value are interpreted completely differently in the Header or Payload. The reason is that the Header mainly contains five-tuple information (source IP, source port, destination IP, destination port and transport layer protocol), while the Payload is mainly used to carry the transmission content. If the two are mixed to construct a traffic graph, this will make the meaning of the bytes vague, making it difficult for the model to converge. In summary, the present invention will construct a traffic graph from the two perspectives of Header and Payload respectively.

[0181] Generally speaking, Figure 1 It is generally defined as G = {V, E, X}, where V represents the set of nodes, E is the set of edges that describe the connection relationship between nodes, and X is the set of initial features of nodes. Therefore, the specific construction process of the flow graph is as follows.

[0182] Vertices: The present invention regards each byte in the byte sequence as a vertex in the set V, thereby mining the implicit relationship between bytes. At the same time, in order to make the proposed method simpler and more efficient, all bytes with the same byte value share the same node, that is, the number of nodes in the traffic graph is no more than 256, which improves the classification speed of encrypted traffic.

[0183] Edges: The present invention measures the correlation between two bytes in a byte sequence based on pointwise mutual information (PMI)

[27] , and creates an edge based on this. Specifically, the present invention sets the two co-occurring bytes as i1 and i2, and then calculates the PMI value between them according to formula (1).

[0184]

[0185] Among them, p(i1,i2) represents the probability of two bytes appearing at the same time, and p(i1) and p(i2) represent the probability of bytes i1 and i2 appearing respectively. It is worth noting that i1 and i2 only establish an edge when the PMI value is positive, and the corresponding value in the adjacency matrix is ​​1. At other times, no edge is established, and the corresponding value in the adjacency matrix is ​​0, because i1 and i2 have almost no correlation at this time.

[0186] The flow graph is constructed through the above steps. Since PMI(i1, i2) = PMI(i2, i1), the flow graph constructed by the present invention is an undirected graph.

[0187] The present invention distinguishes between Header and Payload and constructs two traffic graphs, namely, traffic Header graph and traffic Payload graph, so there will be two different embedding vectors. Therefore, the present invention constructs two embedding layers to process the traffic Header graph and the traffic Payload graph respectively, converting the byte value features into high-dimensional vectors, thereby obtaining effective embedding of Header and Payload.

[0188] Specifically, the present invention first selects the number of bytes to be embedded from the two traffic graphs, which are respectively denoted as N and H and N P ; Then the selected bytes are embedded into a high-dimensional vector. At the same time, since the value range of a byte is [-128, 127], the dimension d is set to 256 in the present invention; Finally, the embedding matrices of the traffic Header graph and the traffic Payload graph are and Each row vector represents a byte.

[0189] GNN has great potential in the field of encrypted traffic classification. Therefore, the present invention will use GNN to extract features from the obtained embedding matrix to better capture traffic information. Among them, Graph Attention Network (GAT)

[28] as a spatial domain GNN has become one of the most popular architectures. However, the literature

[29] believes that the attention mechanism in GAT is a static attention mechanism, which has problems such as limited expression ability and inability to fit training data. Therefore, in order to overcome the limitations of GAT, the present invention introduces GATv2 into the field of encrypted traffic classification. The model forms a dynamic attention mechanism by modifying the internal operation order of GAT to improve its expression ability, as shown below.

[0190] GAT:e(h i ,h j )=LeakyReLU(a T ·[Wh i ||Wh j ])(2)

[0191] GATv2:e(h i ,h j )=a T LeakyReLU(W·[h i ||h j ])(3)

[0192] In the formula, i and j are nodes, h i and h j is its node vector, e() is a scoring function, which is mainly used to evaluate the importance of the characteristics of neighbor nodes to the point of the present invention, W is the weight matrix to be learned, a is the vector to be learned, and a T is the transpose of a, || is the concatenation operation, and LeakyReLU is the activation function. From formula (2), it can be seen that the learnable parameters a and W are operated continuously.

[0193] As can be seen from the above, for a flow graph, the present invention first calculates e(h i ,h j ); Secondly, the nodes are normalized using the softmax function to ensure that the nodes are easy to compare, as shown below;

[0194]

[0195] In the formula, α ij is the normalized attention coefficient, N iis the set of all neighbor nodes of node i, j' is any neighbor node of node i, exp() is the exponential function, and softmax is the activation function; then GATv2 uses the obtained α ij Implement feature updates;

[0196]

[0197] In the formula, h' i is the updated feature vector of node i, σ is the activation function; at the same time, the present invention connects the updated feature vectors of node i in multiple GATv2 layers;

[0198]

[0199] In the formula, is the final feature vector of node i, and k is the number of GATv2 layers stacked by the model of the present invention; finally, all nodes in the flow graph are processed by mean pooling to obtain the final graph feature vector;

[0200]

[0201] Where g is the final graph feature vector, N is the number of nodes in the flow graph, is the addition operation.

[0202] The present invention obtains the graph feature vectors extracted by GATv2 on the header and payload respectively through Section 2.3.1. However, since the feature information contained in the two is different, the present invention considers feature fusion to improve the classification accuracy. However, the traditional fusion method is susceptible to noise interference and has low robustness. Therefore, inspired by the literature

[30] , the present invention uses TFAM to effectively fuse the final graph feature vectors of the header and payload. Specifically, Figure 4 shown.

[0203] Depend on Figure 4 It can be seen that TFAM extracts and fuses key information through two dimensions: space and channel. First, average pooling and maximum pooling are performed on the header vector and payload vector respectively.

[0204]

[0205] In the formula, h a ,p a ,h m ,p m They represent the feature vectors of the Header vector and the Payload vector after average pooling and maximum pooling respectively; then they are concatenated;

[0206] sc ,c c =concat(h a ,h m ,p a ,p m ) (9)

[0207] In the formula, s c and c s They represent the feature vectors after the spatial dimension and channel dimension are concatenated respectively, and concat() is the concatenation operation; then the weights of the two are determined by one-dimensional convolution, and the weights are normalized by the softmax function;

[0208]

[0209] Where W s and W c Respectively represent the weights of the spatial dimension and the channel dimension; finally, the present invention multiplies the above weights with the initial Header vector and Payload vector and then adds them;

[0210] F V =W s *g p +W c *g h (11)

[0211] In the formula, F V It is the fusion feature of the Header vector and the Payload vector; through the above steps, the present invention can retain the key information in the two types of traffic graphs and discard useless information, thereby achieving effective fusion of traffic graph features;

[0212] Generally speaking, the encrypted traffic classification method uses the cross entropy loss function as the loss function. However, due to the class imbalance problem in the data set, the classification model is biased towards the majority class samples. Therefore, the present invention uses EQL v2 as the loss function to eliminate this problem.

[0213] First, the calculation process of the model output for the positive and negative gradients of the loss function is as follows:

[0214]

[0215] In the formula, z j is the model output, is the loss function, represents the probability that the i-th sample belongs to category j, y is the true label, and L is the number of samples included; then the positive and negative gradients are processed by reweighting coefficients:

[0216]

[0217] in, and is the weighting coefficient, is the accumulated ratio after iteration t times, α is the balance coefficient, and f() is the mapping function, which is expressed as follows:

[0218]

[0219] At this time, the positive and negative gradients are updated as follows:

[0220]

[0221] In addition, the ratio of positive and negative gradients for the next iteration needs to be updated:

[0222]

[0223] In summary, the present invention can effectively solve the class imbalance problem in the training stage through EQLv2;

[0224] After obtaining the effective fusion representation of the Header flow graph and the Payload flow graph through the above parts and alleviating the class imbalance problem through EQLv2, the present invention uses the fully connected layer and the softmax layer for processing to obtain the final prediction result, and finally uses EQLv2 as the loss function to calculate the loss and perform back propagation.

[0225] loss = EQLv2(softmax(FC(F V ))) (17)

[0226] In the formula, loss is the loss value and FC is the fully connected layer.

[0227] In the present invention, the adopted encrypted traffic data set and its preprocessing process will be described in detail.

[0228] In order to verify the effectiveness of the proposed method, experiments are conducted on two datasets: ISCX VPN-nonVPN

[31] and ISCX Tor-nonTor

[32] . The specific label types are shown in Table 1.

[0229] Table 1 Label types of ISCX VPN-nonVPN and ISCX Tor-nonTor datasets

[0230]

[0231] The ISCX VPN-nonVPN dataset contains two datasets: ISCX-VPN and ISCX-nonVPN. This dataset mainly contains 7 types of benign samples such as Email, Chat, P2P, and 7 types of protocol encapsulation samples such as VPN-Email, VPN-Chat, and VPN-P2P. However, due to label confusion, this paper only uses 6 types of benign samples and 6 types of protocol encapsulation samples for experiments.

[0232] The ISCX Tor-nonTor dataset is similar to the ISCX VPN-nonVPN dataset, and also includes two datasets: ISCX-Tor and ISCX-nonTor. It mainly contains 8 types of regular traffic including Browsing, FTP, and VoIP, as well as 8 types of Tor traffic including Tor-Browsing, Tor-FTP, and Tor-VoIP.

[0233] The encrypted traffic data sets used in the present invention are all original traffic files in Pcap format, so it is necessary to preprocess them to meet the format required by the model. The specific steps are as follows: (1) Pcap file segmentation. The present invention uses the tool Splitcap to split the files in the data set to obtain a bidirectional stream. (2) Data cleaning. The present invention discards bad packets or retransmission packets in the split files, and also removes empty flows with a data packet length of 0 and extra-long flows with a length greater than 10,000. This is mainly because there is no valid information in the empty flow that constitutes the traffic graph, and there is a large amount of interference from bad packets or retransmission packets in the extra-long flow. In addition, for the filtered data packets, the present invention removes the irrelevant information (such as Ethernet header) and noise information (such as source IP address, destination IP address) contained therein.

[0234] The present invention is experimented on a computer with a 64-bit Ubuntu operating system, a Core i9-9900K CPU@3.60GHz 16 processor and an NVIDIA GeForce RTX 3090GPU. In addition, the present invention conducts a series of comparative experiments through ten-fold cross validation to determine some key parameters in the model. First, the present invention sets the maximum length of Header and Payload to 40 and 150 respectively, and the PMI window size is 5. Then, the Adam optimizer is used in the training phase, with a learning rate of 1e-3, epochs of 50, batchsize of 32, dropout of 0.5, GATv2 layers of 4, the number of multi-heads in the attention mechanism of 2, the balance coefficient α in the EQLv2 function is set to 4, and γ and μ in the mapping function f() are set to 12 and 0.8 respectively.

[0235] In order to evaluate the performance of the proposed method, the present invention selects four indicators, namely, accuracy (Acc), precision (Pre), recall (Rec) and F1 score (F1), for experiments, and the calculation method is as follows.

[0236]

[0237] Where TP, TN, FP, and FN represent true positives, true negatives, false positives, and false negatives, respectively, that is, the number of correct positive sample predictions, the number of correct negative sample predictions, the number of incorrect positive sample predictions, and the number of incorrect negative sample predictions.

[0238] In order to verify the feasibility of the proposed method, the present invention conducts experiments on four ISCX datasets. The specific results are as follows: Figure 5 shown.

[0239] Depend on Figure 5 It can be seen that the proposed method has achieved good performance on the four ISCX data sets, and can basically achieve results above 90%. Among them, the proposed method has the best performance on the ISCX-Tor data set, and the four index values ​​are close to 100%. As for the ISCX-nonTor data set, it achieved an accuracy rate of 98.13%, but there are certain differences in the three indicators of precision, recall and F1 score. This is also the reason why multiple indicators are used for evaluation. The accuracy rate treats all categories equally, which is not suitable for class imbalanced data sets and seems meaningless at this time. In addition, the class imbalance problem in the ISCX VPN-nonVPN data set is more serious, while the results of the present invention on this data set are relatively stable, and the four index values ​​are not much different. This shows that the proposed method has a strong ability to identify obfuscated traffic even in the case of class imbalance, which effectively verifies the feasibility of the method of the present invention.

[0240] In order to verify the effectiveness of the proposed method, this paper selects 3 traditional machine learning methods, 6 deep learning methods and 4 graph neural network methods as benchmark models for comparison with the method of the present invention.

[0241] (1) AppScanner

[14] : AppScanner first extracts statistical features from streaming data and then processes them using random forest.

[0242] (2) FlowPrint

[33] : FlowPrint is a semi-supervised method that generates application fingerprints through correlation and uses clustering for identification and matching.

[0243] (3) GRAIN

[10] : GRAIN uses linked random forests to classify payload length features.

[0244] (4)DF

[34] : DF is a deep fingerprint recognition method based on CNN, which can achieve good classification results with only a simple input format.

[0245] (5) FS-Net

[19] : FS-Net uses bidirectional GRU to mine the temporal information in the packet length sequence.

[0246] (6) App-Net

[35] : App-Net uses LSTM and CNN to learn packet length and payload sequence features respectively.

[0247] (7) TSCRNN

[20] : TSCRNN combines CNN and bidirectional LSTM to achieve encrypted traffic classification in industrial IoT.

[0248] (8) FFB

[36] : FFB uses CNN and RNN to learn the raw byte and packet length sequences respectively.

[0249] (9) ET-BERT

[21] : ET-BERT pre-trains datagram-level representations from a large amount of unlabeled data and then fine-tunes them for specific tasks.

[0250] (10) GraphDApp

[22] : GraphDApp uses packet length to construct a traffic interaction graph and then uses graph neural network for learning.

[0251] (11) FB-GNN

[37] : FB-GNN constructs a graph based on the temporal order of data packets and learns graph features through a geometric learning model.

[0252] (12) TFE-GNN

[23] : TFE-GNN constructs a byte-level traffic graph and then performs traffic classification through a graph convolutional neural network.

[0253] (13) DE-GNN

[24] : DE-GNN constructs a traffic interaction graph based on the relationship between burst packets and extracts features through a graph attention network.

[0254] Table 2 Comparison with existing methods (%)

[0255]

[0256] Table 2 shows the comparison results between the present invention and the existing methods on the ISCX dataset. The following conclusions can be drawn from Table 2: (1) The present invention method has achieved good performance on the four encrypted traffic datasets. First, on the ISCX-VPN and ISCX-nonVPN datasets, even though the present invention method did not achieve the best results, the four indicators were not much different from the optimal indicator values, basically around 1%-3%. At the same time, compared with other benchmark models on the ISCX-Tor and ISCX-nonTor datasets, the present invention method achieved the best results in the four indicators of TFAM-GNN, and all of them were greatly improved, verifying the effectiveness of the proposed method; (2) AppScanner, FlowPrint and GRAIN did not achieve satisfactory results. On the four ISCX datasets, the three traditional machine learning methods are generally about 15% less than TFAM-GNN in the four indicator values. This is mainly because traditional machine learning methods rely on manual feature extraction, which inevitably results in information loss. Moreover, as the encrypted traffic environment becomes more complex, the extracted features are no longer reliable and effective, resulting in unsatisfactory performance. (3) Compared with the six deep learning methods, TFAM-GNN outperforms the three models of DF, FS-Net and FFB in all four data sets, with the lowest improvement of more than 10%. At the same time, only on the ISCX VPN-nonVPN data set are some indicators lower than App-Net, TSCRNN and ET-BERT, and the largest gap is only on the ISCX-nonVPN data set, where the accuracy is 2.44% lower than that of the ET-BERT model. However, the ET-BERT model is relatively large and complex, consuming a lot of computing resources, and its performance on the other three data sets is also lower than that of TFAM-GNN. (4) Compared with the four graph neural network methods, the experimental results of the method of the present invention are also satisfactory. Even if some indicators on a certain data set are still not as good as other methods, the gap is not large, and the performance of the present invention on other data sets is much higher than these methods. The main reason for the poor performance of GraphDApp is that technologies such as VPN and Tor have a large impact on the length of data packets, resulting in a lot of noise in the constructed graph. The graph of FB-GNN is constructed based on time series, which means that graphs with the same number of nodes have the same graph structure. Therefore, the method is not robust enough and the performance is not very stable. TFE-GNN cannot process the implicit noise in the raw bytes of the data packet, so the model results are slightly worse. DE-GNN has limitations in transmitting information within the graph, so its performance is lower than the method of the present invention.(5) TFE-GNN and DE-GNN also construct graphs based on the two perspectives of Header and Payload, and the experimental results obtained by the two methods in Table 3 are better than those of other methods, so it is feasible and effective to classify encrypted traffic from the two aspects of Header and Payload. In addition, the performance of most benchmark models on different datasets shows large differences, especially on the ISCX Tor-nonTor dataset, because the samples of some categories in the Tor dataset are limited. The method of the present invention effectively solves this problem through the EQL v2 loss function, so it has achieved relatively excellent and stable experimental results in all four datasets, and has strong generalization.

[0257] In order to verify the reliability of the GATv2 model, this paper selected three classic graph neural network architectures (GCN, GAT, GraphSAGE) to conduct experiments on the ISCX dataset and conduct analysis and comparison, as shown in Table 3.

[0258] Table 3 Experimental results of different graph neural networks

[0259]

[0260] As can be seen from Table 3, the GATv2 used in the present invention has achieved the best results on all four data sets. When compared with the GraphSAGE model, GATv2 has improved by more than 4% in most indicators, especially in the accuracy indicator of the ISCX-nonVPN data set, GATv2 has achieved a performance improvement of 10.79%. This is mainly because the neighbor nodes considered by GraphSAGE are fixed, so there is a loss of graph information when performing aggregation operations, and the embedded features of the same node are not stable enough. When compared with GCN and GAT, GATv2 has also achieved a certain degree of performance improvement, with the maximum improvement of 4.13% and 2.42% respectively in the comprehensive indicator F1 score that takes into account both precision and recall. This is because GCN assumes that the topological structure of the graph is unchanged, while in the actual encrypted traffic environment, its topological structure is usually dynamically changing. Although GAT can evaluate the importance of neighboring nodes and can use this information in the process of feature propagation, the static attention mechanism it uses has the disadvantages of weak expression ability and poor training data fitting. GATv2 not only overcomes these shortcomings through the dynamic attention mechanism, but also has stronger robustness.

[0261] Network encrypted traffic classification is one of the important tasks of the network, communication, security, information processing and other systems in the Internet of Things system. The present invention proposes an accurate classification method for encrypted traffic in the Internet of Things, which runs through the entire life cycle of encrypted traffic data collection, processing, extraction and classification. Not only the implicit correlation between the original bytes is mined, but also the intrinsic feature information of the traffic graph is effectively extracted and fused using the graph neural network. At the same time, the class imbalance problem in the encrypted traffic data set is better solved by the balanced loss function. The proposed method carries out simulation experiments on two encrypted traffic data sets, and verifies the effectiveness of the method of the present invention when compared with multiple benchmark models, which can provide certain guarantees for the security of the Internet of Things network. In the future, the performance effect of the model based on semi-supervised learning will be studied, and better traffic identification performance and relatively high accuracy will be achieved by using a small amount of labeled data and a large amount of unlabeled data, and the network security of the Internet of Things traffic will be ensured by using a small amount of resources.

[0262] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0263] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for accurately classifying encrypted traffic in the Internet of Things, characterized in that: The following steps are involved: Step 1: In the preprocessing stage, the original traffic data is segmented, sampled, and vectorized; Step 2, in the parallel traffic graph construction phase, the method constructs the traffic graph based on byte correlation from two perspectives: the packet header and the payload; Step 3, in the double embedding stage, a certain number of bytes are selected from the two traffic graphs and embedded into high-dimensional vectors; Step 4: In the graph feature extraction and fusion stage, the improved graph neural network is introduced to extract the abstract features of the traffic graph, and then the two features are fused through the temporal fusion attention module TFAM; Step 5: In the classification stage, this method learns the fused features through the fully connected layer and the Softmax layer to achieve encrypted traffic classification, and also uses EQL v2 as the loss function to solve the class imbalance problem.

2. The method for accurately classifying encrypted traffic of the Internet of Things as claimed in claim 1, characterized in that: The pretreatment method is as follows: (1) Pcap file segmentation: Use the tool Splitcap to split the files in the dataset to obtain bidirectional streams; (2) Data cleaning: discard bad packets or retransmitted packets in the split files, and remove empty flows with a data packet length of 0 and overlong flows with a length greater than 10,000.

3. The method for accurately classifying encrypted traffic of the Internet of Things as claimed in claim 1 is characterized in that: The abstract feature extraction is: (1) Construction of traffic graph; (2) Graph feature extraction; (3)TFAM; (4)EQL v2; (4) Traffic classification.

4. The method for accurately classifying encrypted traffic of the Internet of Things as claimed in claim 3 is characterized in that: The flow graph is constructed by: Set the two co-occurring bytes to i1 and i2 respectively, and then calculate the PMI value between them according to formula (1); Among them, p(i1,i2) represents the probability of two bytes appearing at the same time, and p(i1) and p(i2) represent the probability of bytes i1 and i2 appearing respectively. It is worth noting that i1 and i2 only establish an edge when the PMI value is positive, and the corresponding value in the adjacency matrix is ​​1. At other times, no edge is established, and the corresponding value in the adjacency matrix is ​​0, because i1 and i2 have almost no correlation at this time. The flow graph is constructed through the above steps. Since PMI(i1, i2) = PMI(i2, i1), the flow graph constructed by the present invention is an undirected graph. Double embedding: First, select the number of bytes to be embedded from the two traffic graphs, denoted as N H and N P ; Then the selected bytes are embedded into a high-dimensional vector. At the same time, since the value range of a byte is [-128, 127], the dimension d is set to 256 in the present invention; Finally, the embedding matrices of the traffic Header graph and the traffic Payload graph are and Each row vector represents a byte.

5. The method for accurately classifying encrypted traffic of the Internet of Things as claimed in claim 3 is characterized in that: The graph feature extraction: GATv2 is introduced into the field of encrypted traffic classification. The model modifies the internal operation order of GAT to form a dynamic attention mechanism to improve its expression ability, as shown below; GAT:e(h i ,h j )=LeakyReLU(a T ·[Wh i ||Wh j ]) (2) GATv2:e(h i ,h j )=a T LeakyReLU(W·[h i ||h j ]) (3) In the formula, i and j are nodes, h i and h j is its node vector, e() is a scoring function, which is mainly used to evaluate the importance of the characteristics of neighbor nodes to the point of the present invention, W is the weight matrix to be learned, a is the vector to be learned, and a T is the transpose of a, || is the concatenation operation, and LeakyReLU is the activation function; It can be seen from formula (2) that the learnable parameters a and W are operated continuously; As can be seen from the above, for a flow graph, the present invention first calculates e(h i ,h j ); Secondly, the nodes are normalized using the softmax function to ensure that the nodes are easy to compare, as shown below; In the formula, α ij is the normalized attention coefficient, N i is the set of all neighbor nodes of node i, j' is any neighbor node of node i, exp() is the exponential function, and softmax is the activation function; then GATv2 uses the obtained α ij Implement feature updates; In the formula, h' i is the updated feature vector of node i, σ is the activation function; at the same time, the present invention connects the updated feature vectors of node i in multiple GATv2 layers; In the formula, is the final feature vector of node i, and k is the number of GATv2 layers stacked by the model of the present invention; finally, all nodes in the flow graph are processed by mean pooling to obtain the final graph feature vector; Where g is the final graph feature vector, N is the number of nodes in the flow graph, is the addition operation.

6. The method for accurately classifying encrypted traffic of the Internet of Things as claimed in claim 3 is characterized in that: The TFAM: TFAM extracts and fuses key information in two dimensions: space and channel. First, average pooling and maximum pooling are performed on the header vector and payload vector respectively. In the formula, h a ,p a ,h m ,p m They represent the feature vectors of the Header vector and the Payload vector after average pooling and maximum pooling respectively; then they are concatenated; s c ,c c =concat(h a ,h m ,p a ,p m ) (9) In the formula, s c and c s They represent the feature vectors after the spatial dimension and channel dimension are concatenated respectively, and concat() is the concatenation operation; then the weights of the two are determined by one-dimensional convolution, and the weights are normalized by the softmax function; Where W s and W c Respectively represent the weights of the spatial dimension and the channel dimension; finally, the present invention multiplies the above weights with the initial Header vector and Payload vector and then adds them; F V =W s *g p +W c *g h (11) In the formula, F V It is the fusion feature of the Header vector and the Payload vector; through the above steps, the present invention can retain the key information in the two types of traffic graphs and discard useless information, thereby realizing the effective fusion of traffic graph features.

7. The method for accurately classifying encrypted traffic of the Internet of Things as claimed in claim 3 is characterized in that: The EQL v2: Generally speaking, the encrypted traffic classification method uses the cross entropy loss function as the loss function; however, due to the class imbalance problem in the data set, the classification model is biased towards the majority class samples; therefore, the present invention uses EQL v2 as the loss function to eliminate this problem; First, the calculation process of the model output for the positive and negative gradients of the loss function is as follows: In the formula, z j is the model output, is the loss function, represents the probability that the i-th sample belongs to category j, y is the true label, and L is the number of samples included; then the positive and negative gradients are processed by reweighting coefficients: in, and is the weighting coefficient, is the accumulated ratio after iteration t times, α is the balance coefficient, and f() is the mapping function, which is expressed as follows: At this time, the positive and negative gradients are updated as follows: In addition, the ratio of positive and negative gradients for the next iteration needs to be updated: In summary, the present invention can effectively solve the class imbalance problem in the training stage through EQLv2.

8. The method for accurately classifying encrypted traffic of the Internet of Things as claimed in claim 3 is characterized in that: The traffic classification is: After obtaining the effective fusion representation of the Header flow graph and the Payload flow graph through the above parts and alleviating the class imbalance problem through EQLv2, the present invention uses the fully connected layer and the softmax layer for processing to obtain the final prediction result, and finally uses EQLv2 as the loss function to calculate the loss and perform back propagation; loss=EQLv2(softmax(FC(F V )))(17) In the formula, loss is the loss value and FC is the fully connected layer.

9. An Internet of Things encrypted traffic accurate classification system implementing the Internet of Things encrypted traffic accurate classification method according to any one of claims 1 to 8, characterized in that: The IoT encrypted traffic accurate classification system comprises: The preprocessing module is used to perform flow segmentation, sampling, and vectorization processing on the original traffic data; A parallel traffic graph construction module is used to construct traffic graphs based on byte correlation from two perspectives: packet header and payload. The dual embedding module is used to select a certain number of bytes from two traffic graphs and embed them into high-dimensional vectors; The graph feature extraction and fusion module is used to extract the abstract features of the traffic graph by introducing an improved graph neural network, and then fuse the two features through the temporal fusion attention module TFAM; The classification module is used to learn the fused features through the fully connected layer and the Softmax layer to achieve encrypted traffic classification, and also uses EQLv2 as the loss function to solve the class imbalance problem.

10. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for accurately classifying encrypted traffic of the Internet of Things as described in any one of claims 1-8.

Images