Method and device for classifying encrypted traffic based on reintegration features, equipment and medium

Abstract

Embodiments of the present application provide a kind of encryption traffic classification method, device and equipment based on reintegration feature and medium, belong to network communication technical field.The method includes: obtaining the encrypted traffic data of target session, according to the encrypted traffic data and the five tuples of the encrypted traffic data, generate original traffic path, the original traffic path is the sequence formed by the data packet length of the target session in each time period;Path transformation processing is carried out to the original traffic path of one dimension, and five-dimensional target traffic path is obtained;According to the target traffic path, determine the reintegration feature data, and determine target feature data according to the reintegration feature data screening;The target feature data is input into traffic classification model, and the category of the encrypted traffic data is determined according to the output result of the traffic classification model.The present application aims at reducing the complexity of the model for classifying encrypted traffic, thereby reducing the use cost of model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, and particularly relates to a method and device for classifying encrypted traffic based on reintegration features, equipment and a medium. BACKGROUND

[0002] In the Internet, with the improvement of user privacy protection awareness, the proportion of network traffic encryption is getting higher and higher. Although the encryption of network traffic increases the security and privacy of communication, on the other hand, it may also facilitate malicious behavior on the network. Therefore, encrypted traffic classification is a basic and important tool for network traffic analysis, and provides important support for network management, security and quality of service.

[0003] At present, the classification method for encrypted traffic is generally carried out by machine learning. However, in this classification method, a too high feature dimension needs to be used when extracting features from traffic data, which will result in that the feature data used for training or prediction is too large, so that the model is too complex, the training is more difficult, and the deployment requirement is higher, which affects the use cost of the model.

[0004] In summary, the technical problems existing in the related art need to be improved. SUMMARY

[0005] The main purpose of the embodiments of the present application is to provide a method and device for classifying encrypted traffic based on reintegration features, equipment and a medium, which aims to reduce the complexity of the model for classifying encrypted traffic, thereby reducing the use cost of the model.

[0006] To achieve the above purpose, one aspect of the embodiments of the present application provides a method for classifying encrypted traffic based on reintegration features, which comprises:

[0007] Obtaining encrypted traffic data of a target session, generating an original traffic path according to the encrypted traffic data and five-tuple of the encrypted traffic data, the original traffic path being a sequence formed by packet lengths of the target session at each time period;

[0008] Performing path transformation processing on the one-dimensional original traffic path to obtain a five-dimensional target traffic path;

[0009] Determining reintegration feature data according to the target traffic path, and determining target feature data according to the reintegration feature data;

[0010] Inputting the target feature data into a traffic classification model, and determining the category of the encrypted traffic data according to the output result of the traffic classification model.

[0011] In some embodiments, the step of determining target feature data according to the reintegration feature data comprises:

[0012] calculating a Shapley value corresponding to each feature item in the re-integrated feature data based on a Tree SHAP algorithm of Boruta Shap;

[0013] filtering out a preset number of target feature items from the re-integrated feature data according to the Shapley value of each feature item, and forming the target feature data according to the target feature items, the Shapley value of the target feature items being the largest among the Shapley values of all the feature items.

[0014] In some embodiments, the step of determining the re-integrated feature data according to the target traffic path comprises:

[0015] obtaining a preset number of layers of a hierarchical dynamic window, and determining a window size and a step length of each layer of the hierarchical dynamic window according to the preset number of layers and a sequence length of the target traffic path;

[0016] based on the target traffic path, extracting a sub-path of each dimension of the target traffic path according to the preset number of layers, the window size and the step length;

[0017] determining the re-integrated feature data according to the sub-path.

[0018] In some embodiments, the step of determining the re-integrated feature data according to the sub-path comprises:

[0019] for the sub-paths extracted from the same hierarchical dynamic window, calculating corresponding sub-re-integrated feature data;

[0020] generating the re-integrated feature data according to all the sub-re-integrated feature data.

[0021] In some embodiments, the step of performing path transformation processing on the one-dimensional original traffic path to obtain a five-dimensional target traffic path comprises:

[0022] performing path decomposition transformation processing on the original traffic path to obtain a first upload path and a first download path;

[0023] performing accumulation and transformation processing on the first upload path and the first download path respectively to obtain a first accumulation and upload path and a first accumulation and download path;

[0024] performing base point transformation processing on the first upload path, the first download path, the first accumulation and upload path and the first accumulation and download path respectively to obtain corresponding second upload path, second download path, second accumulation and upload path and second accumulation and download path;

[0025] determine a time coordinate path according to a sequence length of the original flow path;

[0026] form a five-dimensional target flow path according to the second upload path, the second download path, the second cumulative upload path, the second cumulative download path and the time coordinate path.

[0027] In some embodiments, the step of generating an original flow path according to the encrypted flow data and the five-tuple of the encrypted flow data comprises:

[0028] determine the packet length of the encrypted flow data in each time period;

[0029] determine the data type corresponding to each packet length according to the five-tuple, the data type including upload data or download data;

[0030] generate the original flow path according to the packet length and the data type of each time period.

[0031] In some embodiments, the method further comprises:

[0032] obtain sample data of a sample set, and determine a sample session corresponding to the sample data according to the five-tuple of the sample data;

[0033] for the sample data of the same sample session, generate the original flow path according to the sample data and the five-tuple of the sample data;

[0034] perform path transformation processing on the original flow path to obtain the target flow path;

[0035] determine the reintegration feature data according to the target flow path, and determine the target feature data according to the reintegration feature data;

[0036] determine the target feature data corresponding to different sample sessions as a training data set, and divide the training data set into a training set, a validation set and a test set according to a preset proportion;

[0037] train a preset model according to the training set, the validation set and the test set to obtain the flow classification model.

[0038] To achieve the above object, another aspect of the embodiment of the present application proposes an encrypted flow classification device based on reintegration features, which comprises:

[0039] a traffic processing module, configured to acquire encrypted traffic data of a target session, and generate an original traffic path according to the encrypted traffic data and five-tuple of the encrypted traffic data, the original traffic path being a sequence formed by packet lengths of the target session at each time period;

[0040] a path transformation module, configured to perform path transformation processing on the one-dimensional original traffic path to obtain a five-dimensional target traffic path;

[0041] a feature extraction module, configured to determine reintegration feature data according to the target traffic path, and determine target feature data by screening the reintegration feature data;

[0042] a prediction module, configured to input the target feature data into a traffic classification model, and determine a category of the encrypted traffic data according to an output result of the traffic classification model.

[0043] To achieve the above object, another aspect of the embodiment of the present application provides an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the method described above when executing the computer program.

[0044] To achieve the above object, another aspect of the embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method described above.

[0045] The embodiment of the present application at least has the following beneficial effects: the present application provides an encrypted traffic classification method, device, equipment and medium based on reintegration feature, which acquires encrypted traffic data of a target session, generates an original traffic path according to the encrypted traffic data and five-tuple corresponding to the encrypted traffic data, analyzes the target session through packet lengths at each time period in the original traffic path, then performs path transformation processing on the original traffic path to expand its dimension to extract more effective features, improve accuracy, obtain a five-dimensional target traffic path, calculate reintegration feature data of the target traffic path, and further screen and determine target feature data to avoid that the feature data is too large, so as to predict and analyze based on the target feature data by using a traffic classification model to determine the category of the encrypted traffic data. Compared with the current feature data which is too large, the present application further screens the reintegration feature data after extracting it to optimize the number of feature data and reduce the complexity of the model for classifying encrypted traffic, thereby reducing the use cost of the model. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 is a flowchart of an encrypted traffic classification method based on reintegration feature provided by the embodiment of the present application;

[0047] Figure 2 is Figure 1 part of flow chart of step 103 in the method;

[0048] Figure 3 is a schematic diagram of the sub-path extraction of the layered dynamic window according to an embodiment of the present application;

[0049] Figure 4 is another flow chart of the encryption traffic classification method based on reintegration features according to an embodiment of the present application;

[0050] Figure 5 is a structural schematic diagram of the encryption traffic classification device based on reintegration features according to an embodiment of the present application;

[0051] Figure 6 is a hardware structural schematic diagram of the electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementation described in the following exemplary embodiments does not represent all the implementations consistent with the embodiments of the present application, but is only an example of devices and methods consistent with some aspects of the embodiments of the present application as described in the appended claims.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0054] In the related art, with the improvement of user privacy protection awareness, the proportion of network traffic encryption is getting higher and higher. Encrypting network traffic can improve the security and privacy of communication, so various network traffic encryption methods and tools are emerging, such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN) and Tor network, etc. However, although the encryption of network traffic increases the security and privacy of communication, it also brings challenges to network management and provides convenience for malicious user camouflage attacks and escalation of crimes, so encrypted traffic classification is a basic and important tool for network traffic analysis, providing important support for network management, security and Quality of Service (QoS).

[0055] For encrypted traffic data, the traditional analysis method based on the plaintext payload of the packet becomes almost ineffective, and the simplest port-based method often fails due to the use of application dynamic port negotiation mechanism, so currently it is generally classified by machine learning, but the method based on machine learning relies on manually designed features, and currently when extracting features from traffic data, it is generally necessary to use a too high feature dimension, which will cause the feature data used for training or prediction to be too large, making the model too complex, more difficult to train, and requiring higher deployment requirements, affecting the cost of using the model.

[0056] Therefore, in the embodiments of the present application, a method, device and medium for classifying encrypted traffic based on reintegration features are provided, Figure 1 is an optional flowchart of a method for classifying encrypted traffic based on reintegration features provided by the embodiments of the present application, Figure 1 The method in the above embodiment can include but is not limited to steps S101-S104.

[0057] Step S101, obtaining encrypted traffic data of a target session, generating an original traffic path according to the encrypted traffic data and the five-tuple of the encrypted traffic data, the original traffic path being a sequence formed by the lengths of the data packets of the target session in each time period.

[0058] It should be noted that a one-way network stream can be uniquely determined by its five-tuple, which includes the source IP address, the destination IP address, the source port, the destination port and the transport layer protocol. All data packets in the network stream correspond to the same five-tuple, while in a two-way network stream, it can be understood that all data packets correspond to the same five-tuple or the same transposed five-tuple (the source IP address and the destination IP address are transposed, and the source port and the destination port are transposed).

[0059] Optionally, the traffic between the client and the server is observed by a third-party Internet service provider, and the traffic is collected by a traffic collection tool, such as Libpcap, TCPdump, Wireshark and Netflow, to obtain the encrypted traffic data. Based on this, by analyzing the five-tuple of the data packets in the traffic, traffic belonging to the same session can be distinguished to determine the target session. In the embodiments of the present application, only the classification of the encrypted traffic data of a single target session is analyzed and described, and the final classification of the encrypted traffic data is also for the classification of the target session. It can be understood that the method of the embodiments of the present application can also be applied to the scenario of multiple target sessions, and the classification of each target session can be analyzed respectively.

[0060] On the other hand, in the target session, the client and server continuously send data packets to each other to achieve communication. Furthermore, the density of data packets varies at different stages of the communication interaction. Therefore, this embodiment slices the data packets on a time scale and determines the corresponding data packet length within each time period. The data packet length is used to determine the data items in the original traffic path, thus generating the original traffic path representing the target session. Only the data packet length of the target session is used as the information for analysis, avoiding sensitive processing of encrypted data content. This original traffic path is a sequence, where each data item is the data packet length within its corresponding time period, and they are ordered according to the order of their corresponding time periods.

[0061] Step S102: Perform path transformation processing on the one-dimensional original traffic path to obtain the five-dimensional target traffic path.

[0062] Since the reintegral features based on the one-dimensional original traffic path cannot provide satisfactory effectiveness, a path transformation operation is needed to highlight its hidden information, thereby improving the effectiveness of subsequent reintegral feature data. By performing a path transformation on the original traffic path, a five-dimensional target traffic path is obtained. This target traffic path includes five paths generated based on the original traffic path. In this embodiment, the original traffic path is not included among the five paths of the target traffic path.

[0063] Step S103: Determine the re-integral feature data based on the target traffic path, and then filter and determine the target feature data based on the re-integral feature data.

[0064] Furthermore, the five-dimensional path X can be represented as Five of these items represent five paths, with the subscript 't' indicating their time coordinates, i.e., which time interval each path corresponds to. Data within, In this embodiment, all five paths correspond to the same t.

[0065] The multiple integral feature data of the target traffic path are calculated. The k-fold iterative integral can be calculated with reference to equation (1). Specifically:

[0066] (1)

[0067] Where i is the superscript that distinguishes different paths, and k is the truncation order.

[0068] For example, consider a two-dimensional path. , (a=0, b=4) , Calculate its double path multiple integral (k=2), and we get the following equation (2):

[0069] (2)

[0070] The k-fold iterative integral of the five-dimensional path can also be calculated according to the above examples, and the signature dimension in the case of calculating the k-order truncation of the d-dimensional path can be calculated according to formula (3), specifically:

[0071] (3)

[0072] As in the above example of the two-dimensional path, the path reintegration feature dimension of the path is , which is equivalent to the number of feature items of the reintegration feature data of the path.

[0073] After calculating the reintegration feature data of the target traffic path, in order to reduce the complexity of the model, the reintegration feature data is screened, and the target feature data with greater contribution is selected as the data actually used for prediction or training.

[0074] In step S104, the target feature data is input into the traffic classification model, and the category of the encrypted traffic data is determined according to the output result of the traffic classification model.

[0075] The target feature data is input into the traffic classification model, and the output result of the traffic classification model is obtained. The output result includes score values of predicting that the encrypted traffic data belongs to different categories, and based on the score values, it can be judged which category the encrypted traffic data should belong to.

[0076] Optionally, the categories that can be predicted by the traffic classification model include, for example, Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), and Tor network, which are not limited in the embodiment. In addition, the traffic classification model can be one of machine learning models such as random forest, decision tree, Gaussian naive Bayes, and K-nearest neighbor, which are also not limited in the embodiment.

[0077] The steps S101 to S104 shown in the embodiments of the present application are as follows: the encrypted traffic data of a target session is obtained, an original traffic path is generated according to the encrypted traffic data and its corresponding five-tuple, the target session is analyzed through the data packet length of each time period in the original traffic path, path transformation processing is performed on the original traffic path to expand its dimension to extract more effective features and improve accuracy, a five-dimensional target traffic path is obtained, the reintegration feature data of the target traffic path is calculated, and in order to avoid the feature data being too large, the target feature data is further screened and determined, so that the traffic classification model is used for prediction analysis based on the target feature data to determine the category of the encrypted traffic data. Compared with the current feature data being too large, the reintegration feature data is further screened after being extracted in the present application, so as to optimize the number of feature data and reduce the complexity of the model for classifying encrypted traffic, thereby reducing the use cost of the model.

[0078] In step S101 of some embodiments, the step of generating an original traffic path according to encrypted traffic data and five-tuple of the encrypted traffic data comprises:

[0079] The data packet length of the encrypted traffic data in each time period is determined.

[0080] The data type of each data packet length corresponding data is determined according to the five-tuple, and the data type includes upload data or download data.

[0081] The original traffic path is generated according to the data packet length and data type of each time period.

[0082] Specifically, each data item in the original traffic path, i.e. the time period length corresponding to each data packet length, is the same, therefore, the sequence length of the original traffic path is determined according to the overall time interval length of the encrypted traffic data, and in the present embodiment, the time period length corresponding to each data packet length is not limited. Based on this, the data packet length of the encrypted traffic data in each time period is determined, thereby determining the ordering and numerical value of each data item in the original traffic path, and determining the sequence length of the original traffic path.

[0083] Since the target session may also be a bidirectional network flow, in order to further improve the representativeness of the original traffic path to the encrypted traffic data, in the present embodiment, the data type is represented by positive and negative, where positive represents download data and negative represents upload data. Based on this, the data type corresponding to each data packet length is determined according to the five-tuple, and the positive and negative values of each data packet length corresponding data item are determined according to the data type, and thus the original traffic path is generated. An exemplary original traffic path is wherein the superscript o represents the original traffic path, .

[0084] By constructing the original traffic path of the encrypted traffic data according to the data packet length and the data type, the sensitive processing of the encrypted data content is avoided, the security of analyzing the encrypted traffic data is improved, the representativeness of the original traffic path for the encrypted traffic data is ensured, and the accuracy of subsequent classification and prediction of the encrypted traffic data based on the original traffic path is improved.

[0085] In step S102 of some embodiments, the step of performing path transformation processing on the one-dimensional original traffic path to obtain a five-dimensional target traffic path includes:

[0086] Performing path decomposition transformation processing on the original traffic path to obtain a first upload path and a first download path.

[0087] Performing accumulation and transformation processing on the first upload path and the first download path respectively to obtain a first accumulation and upload path and a first accumulation and download path.

[0088] Performing base point transformation processing on the first upload path, the first download path, the first accumulation and upload path, and the first accumulation and download path respectively to obtain corresponding second upload path, second download path, second accumulation and upload path, and second accumulation and download path.

[0089] Determining a time coordinate path according to the sequence length of the original traffic path.

[0090] Forming a five-dimensional target traffic path according to the second upload path, the second download path, the second accumulation and upload path, the second accumulation and download path, and the time coordinate path.

[0091] Specifically, the path transformation processing includes path decomposition transformation, accumulation and transformation, base point transformation, and additional incremental dimension transformation.

[0092] The path decomposition transformation is to decompose the original traffic path into a first upload path and a first download path according to upload data or download data, generate the first download path according to the data items belonging to the download data in the original traffic path, and generate the first upload path according to the data items belonging to the upload data in the original traffic path. It should be noted that the data items in the opposite direction are replaced with zero, not discarded directly, so the sequence length of the first upload path and the first download path is the same as that of the original traffic path, and the position of the non-zero data items is the same as that in the original traffic path. Converting a path into a sub-path set with the same dimension can improve the efficiency of path reintegration.

[0093] The accumulation and transformation is an accumulation processing of the data items in the path, for example, the second item in the sequence is updated as the accumulation sum of the first item and the original second item, the third item is updated as the accumulation sum of the updated second item and the original third item, and so on. Based on this, the first accumulation upload path and the first accumulation download path are obtained by performing accumulation and transformation on the first upload path and the first download path, respectively. Since the effective payload to be transmitted by the same website or service is often fixed, it will lead to very similar accumulation and transformation features, and therefore the accumulation and transformation is added to improve the effectiveness of the reintegration feature data.

[0094] The base point transformation adds a constant 0 at the beginning of the first upload path, the first download path, the first accumulation upload path and the first accumulation download path, which is equivalent to shifting the data items in each path backward, which also leads to an increase of 1 in the sequence length of each path. The original sequence length is defined as n, and the value of t is [1, n] before the base point transformation, and the value of t is [0, n] after the base point transformation. The base point transformation can make the reintegration feature sensitive to the translation of the path and eliminate the translation invariance.

[0095] The additional incremental dimension transformation is to determine the time coordinate path according to the sequence length of the original traffic path. The time coordinate path is determined based on the value range of t, and therefore it is equivalent to being determined according to the sequence length. However, it should be noted that, because the aforementioned steps are processed by the base point transformation, the value of t at this time is [0, n], for example, the time coordinate path is (0, 1, 2, 3, …, n).

[0096] Based on the above four path transformation processes, the second upload path, the second download path, the second accumulation upload path, the second accumulation download path and the time coordinate path are obtained, and the five paths form the target traffic path.

[0097] By performing path transformation processing on the original traffic path, the original traffic path is converted into a target traffic path with five dimensions, which can better mine the encrypted traffic data features and improve the effectiveness of the subsequent reintegration feature data and the accuracy of the prediction classification result.

[0098] In step S103 of some embodiments, with reference to Figure 2 , the step of determining the reintegration feature data according to the target traffic path comprises:

[0099] In step S201, a preset number of layers of a layered dynamic window is obtained, and the window size and the step size of the layered dynamic window at each level are determined according to the preset number of layers and the sequence length of the target traffic path.

[0100] In step S202, based on the target traffic path, a sub-path of each dimension of the target traffic path is extracted according to the preset number of layers, the window size and the step size.

[0101] In step S203, the re-integrated feature data is determined according to the sub-path.

[0102] In order to further improve the effectiveness of the feature of the target traffic path, the target traffic path is sliced by a hierarchical dynamic window, and a plurality of sub-paths are extracted.

[0103] Specifically, the preset number of layers of the hierarchical dynamic window is q, and since the window size and the step size are the same at the same level, only the window size is taken as an example for description. The window size is related to the level, and the window size of the dynamic window at different levels is different. Specifically, wherein p is the actual level used for counting during extraction, p is less than or equal to q, and m is the sequence length of any path in the target traffic path. Based on the formula, it can be understood that as the level increases, the window size and the step size gradually decrease relative to the sequence length, and more sub-paths are extracted, which is equivalent to a finer extraction scale.

[0104] For any path in the target traffic path, the hierarchical dynamic window determined by the preset number of layers, the window size and the step size is used to slice the path, and a plurality of sub-paths are extracted. The five paths in the target traffic path are processed by the hierarchical dynamic window, and a plurality of corresponding sub-paths are extracted. Regarding the extraction process, first set the level to 1, and then calculate the window size and the step size at level 1 according to the above formula. According to the formula, the window size at level 1 is equal to the sequence length, so the first sub-path extracted is the same as the original path. At this time, level 2 is calculated, and the window size and the step size at level 2 are calculated according to the above formula. The window size and the step size at level 2 are half of the sequence length, so two sub-paths are extracted. The two sub-paths are equivalent to slicing the original path from the middle position. Then, the above process is repeated until the level of the preset number of layers is extracted. Figure 3 , Figure 3 The figure shows slicing with a dashed box. From top to bottom, they are the original path, the slicing at level 1, the slicing at level 2, and the slicing at level 3. Each slicing forms a sub-path.

[0105] For example, let q be 2, and a sequence be [0, 1, 2, 3, 4, 5, 6, 7, 8, 9], i.e. m is 10. When the level is 1, the window size is = 10, so the first sub-path is [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]. Since the window has reached the end of the sequence, level 2 is calculated. At this time, the window size is = 5, so the second sub-path is [0, 1, 2, 3, 4], and the step is also 5, so the third sub-path is [5, 6, 7, 8, 9], in this way, the level reaches the preset number of layers, and the window has also reached the end of the sequence, and the sub-path extraction is completed.

[0106] The step of calculating the reintegration feature data is based on the extracted sub-paths, and the sub-paths of the target traffic path are further extracted through the hierarchical dynamic window, highlighting the effectiveness of the input information in the calculation of the reintegration feature data, thereby improving the effectiveness of the subsequent reintegration feature data and the accuracy of the prediction classification result.

[0107] In step S203 of some embodiments, it includes:

[0108] For the sub-paths extracted from the same hierarchical dynamic window, the corresponding sub-reintegration feature data is calculated.

[0109] The reintegration feature data is generated according to all the sub-reintegration feature data.

[0110] When calculating the reintegration feature data based on the sub-paths, the sub-paths extracted from the same hierarchical dynamic window are calculated as a group, and each group calculates the corresponding sub-reintegration feature data. Among them, the same hierarchical dynamic window includes the same level and the same window position, for example, there are two sequences, which are [0, 1, 2, 3, 4, 5, 6, 7, 8, 9] and [10, 11, 12, 13, 14, 15, 16, 17, 18, 19] respectively, and a plurality of corresponding sub-paths are also extracted through the hierarchical dynamic window, wherein [0, 1, 2, 3, 4] and [10, 11, 12, 13, 14] belong to a group of sub-paths extracted from the same hierarchical dynamic window with the same window position, it can be understood that another group includes [5, 6, 7, 8, 9] and [15, 16, 17, 18, 19].

[0111] The calculation formula of the reintegration can refer to the above formula (1), and the plurality of sub-reintegration feature data calculated is spliced to generate the required reintegration feature data.

[0112] In addition, it needs to be explained that referring to the above formula (1) and the corresponding examples, it can be understood that the first term of the calculated sub-reintegration feature data is 1, and this data item is not helpful for the data analysis of the subsequent steps, therefore, for each sub-reintegration feature data, the first data item can be removed before splicing to generate the reintegration feature data.

[0113] By calculating the sub-reintegration feature data based on the sub-paths and then splicing it into the reintegration feature data, the calculation process of the reintegration can also fully utilize the information of different scales extracted from the path by the hierarchical dynamic window, improve the effectiveness of the reintegration feature data, and thereby improve the accuracy of the prediction classification result.

[0114] In step S103 of some embodiments, the step of determining the target feature data according to the re-integrated feature data comprises:

[0115] Based on the Tree SHAP algorithm of BorutaShap, the Shapley value corresponding to each feature item in the re-integrated feature data is calculated.

[0116] According to the Shapley value of each feature item, a preset number of target feature items are selected from the re-integrated feature data, and the target feature data is formed according to the target feature items, and the Shapley value of the target feature item is the largest among the Shapley values of all feature items.

[0117] The data items in the re-integrated feature data are defined as feature items, and the number of feature items can be determined by the signature dimension of formula (3). Compared with the above-mentioned example of calculating double path integral for two-dimensional path, it can be understood that the increase of dimension and the setting of more fine-grained hierarchical dynamic window will lead to an exponential increase in the number of feature items in the re-integrated feature data, and therefore the feature data used for training or prediction will be too large, resulting in the problem of too complex model.

[0118] In order to solve this problem, the present embodiment filters the feature items by using the Tree SHAP algorithm of BorutaShap, wherein the BorutaSHAP algorithm combines the Boruta and SHAP value (Shapley value) two feature selection methods. The Boruta algorithm is a feature selection algorithm based on random forest, which determines the influence of each feature on the model by constructing a random forest model and comparing the importance of the original features and the randomly generated shadow features, while the SHAP (SHapley Additive exPlanations) value is an explanatory machine learning technique, and the Tree SHAP algorithm is a module of SHAP analysis. The Shapley value is used to measure the contribution of each feature to the model output and provides a global and local understanding of the model prediction explanation.

[0119] Specifically, for each feature item in the re-integrated feature data, its corresponding Shapley value is calculated, and a preset number of target feature items with the largest Shapley value are selected from them, for example, 10 items. The target feature items are all the features with the largest contribution to the model output. Based on this, the target feature data is formed according to the target feature items.

[0120] The Boruta SHAP algorithm combines the two methods by using the Boruta algorithm for preliminary feature selection and combining the Shapley value to more accurately evaluate the importance of the features. This combination can help identify the most important features in the dataset and optimize the performance of the machine learning model. On the other hand, the number of feature items in the filtered target feature data depends on the preset number set, so it can also control and adjust the number of feature items, filter out the appropriate number of feature items, and reduce the complexity of the model for classifying encrypted traffic, reducing the cost of using the model.

[0121] In some embodiments, with reference to Figure 4 , the method can further include but is not limited to steps S301 to S306.

[0122] Step S301, obtaining sample data of a sample set, and determining a sample session corresponding to the sample data according to a five-tuple of the sample data.

[0123] Step S302, for sample data of the same sample session, generating an original traffic path according to the sample data and the five-tuple of the sample data.

[0124] Step S303, performing path transformation processing on the original traffic path to obtain a target traffic path.

[0125] Step S304, determining reintegration feature data according to the target traffic path, and determining target feature data according to the reintegration feature data.

[0126] Step S305, determining the target feature data corresponding to different sample sessions as a training data set, and dividing the training data set into a training set, a validation set and a test set according to a preset proportion.

[0127] Step S306, training a preset model according to the training set, the validation set and the test set to obtain a traffic classification model.

[0128] Before implementing the method of the above embodiment, the traffic classification model needs to be obtained, and therefore the embodiment is proposed to train and obtain the traffic classification model. Specifically, sample data of a sample set is obtained, the sample set being a data set of network traffic, and traffic data in the sample set being the sample data. An original traffic path is generated according to the sample data and five-tuple of the sample data. Four path transformation processes are performed on the original traffic path to obtain target traffic paths of the same specifications as described above, and a plurality of sub-paths are extracted by a hierarchical sliding window. The heavy integral feature data is calculated and determined based on the sub-paths, and the target feature data is screened and determined. The above steps can refer to the above embodiment and perform the same processing, and have the same effect on the heavy integral feature data generated based on the sample data. Details are not repeated here. Different from the analysis of the target session described above, a large number of sessions are included in the sample set, and correspondingly, a large number of target feature data corresponding to different sessions are obtained based on the sample set, which are determined as training data set. The training data set is divided into training set, verification set and test set according to a preset proportion, which can be set to 70%, 20% and 10% respectively. In other embodiments, other proportions can also be set. Then, the preset model is trained according to the training set, the verification set and the test set, and the traffic classification model is obtained after the training is completed.

[0129] In the training step of the model, the selection of the heavy integral feature data can further reduce the complexity and use cost of the model, so as to obtain the traffic classification model with the complexity within the expectation of the staff, and keep the use cost low in the subsequent prediction and classification process, thereby reducing the overall use cost of the model.

[0130] Next, the scheme of the embodiment of the present application is described and explained in detail in combination with specific application examples:

[0131] In the embodiments of the present application, a method for classifying encrypted traffic based on reintegration features is provided. The method first acquires sample data of a sample set, determines sample sessions corresponding to each sample data according to the five-tuple of the sample data, determines the packet length of the sample data in each time period of the corresponding sample session for the sample data belonging to the same sample session, determines the data type of each packet length as upload data or download data according to the five-tuple thereof, and generates an original traffic path according to the packet length of each time period and the data type thereof. The original traffic path is subjected to path decomposition transformation processing to obtain a first upload path and a first download path, and the first upload path and the first download path are subjected to accumulation and transformation processing, respectively, to obtain a first accumulated upload path and a first accumulated download path. Then, the first upload path, the first download path, the first accumulated upload path, and the first accumulated download path are subjected to base point transformation processing, respectively, to obtain corresponding second upload path, second download path, second accumulated upload path, and second accumulated download path. A time coordinate path is determined according to the sequence length of the original traffic path, and a five-dimensional target traffic path is formed according to the second upload path, the second download path, the second accumulated upload path, the second accumulated download path, and the time coordinate path.

[0132] Based on the target traffic path, a preset number of layers of a hierarchical dynamic window is acquired, and the window size and step length of each layer of the hierarchical dynamic window are determined according to the preset number of layers and the sequence length of the target traffic path. The sub-paths of each dimension of the target traffic path are extracted according to the preset number of layers, the window size, and the step length. For the sub-paths extracted from the same hierarchical dynamic window, the corresponding sub-reintegration feature data is calculated, the reintegration feature data is generated by splicing all the sub-reintegration feature data, the Shapley value corresponding to each feature item in the reintegration feature data is calculated based on the Tree SHAP algorithm of BorutaShap, the target feature items with the largest Shapley value are selected from the reintegration feature data, and the target feature data is formed. The target feature data corresponding to each sample session forms a training data set, and the training data set is divided into a training set, a validation set, and a test set according to a preset proportion. The training set, the validation set, and the test set are used to train a preset model to obtain a traffic classification model.

[0133] Based on the traffic classification model, the encrypted traffic data of a target session is collected, and the same processing as described above is performed on the encrypted traffic data. The original traffic path is generated according to the encrypted traffic data and its five-tuple, the same path transformation processing is performed on the original traffic path to obtain the target traffic path, the reintegration feature data is calculated after extracting the sub-paths based on the target traffic path, and the target feature data is determined according to the reintegration feature data. The target feature data is input into the traffic classification model, and the category of the encrypted traffic data can be determined according to the output result of the traffic classification model.

[0134] The method for classifying encrypted traffic based on reintegration features provided in the embodiments of the present application relates to the technical field of network communication. The method for classifying encrypted traffic based on reintegration features provided in the embodiments of the present application can be applied to a terminal, can also be applied to a server, and can further be software running in the terminal or the server. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle-mounted terminal, and the like, but is not limited thereto; the server end can be configured as a stand-alone physical server, can also be configured as a server cluster or a distributed system formed by multiple physical servers, can further be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence platforms, and the server can also be a node server in a blockchain network; and the software can be an application for implementing the method for classifying encrypted traffic based on reintegration features, and the like, but is not limited to the above forms.

[0135] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0136] Please refer to Figure 5 The embodiments of the present application also provide a device for classifying encrypted traffic based on reintegration features, which can implement the method for classifying encrypted traffic based on reintegration features described above, and the device comprises:

[0137] A traffic processing module is configured to acquire encrypted traffic data of a target session, and generate an original traffic path according to the encrypted traffic data and five-tuple of the encrypted traffic data, the original traffic path being a sequence formed by data packet lengths of the target session at each time period.

[0138] A path transformation module is configured to perform path transformation processing on the one-dimensional original traffic path to obtain a five-dimensional target traffic path.

[0139] The feature extraction module is configured to determine the reintegration feature data according to the target traffic path, and to filter the target feature data according to the reintegration feature data.

[0140] The prediction module is configured to input the target feature data into a traffic classification model, and to determine the category of the encrypted traffic data according to an output result of the traffic classification model.

[0141] It can be understood that the content in the above method embodiments is applicable to the device embodiments, the device embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0142] Please refer to Figure 6 , Figure 6 The electronic device of another embodiment is illustrated, and the electronic device includes:

[0143] The processor 901 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is configured to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0144] The memory 902 can be implemented in the form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory). The memory 902 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 902 and are called and executed by the processor 901 to implement the encrypted traffic classification method based on reintegration features according to the embodiments of the present application.

[0145] The input / output interface 903 is configured to realize information input and output.

[0146] The communication interface 904 is configured to realize the communication interaction between the device and other devices. The communication can be realized by a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0147] The bus 905 is configured to transmit information between various components (for example, the processor 901, the memory 902, the input / output interface 903, and the communication interface 904) of the device.

[0148] The processor 901, the memory 902, the input / output interface 903, and the communication interface 904 are communicatively connected with each other through a bus 905.

[0149] The computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the above-mentioned encryption traffic classification method based on reintegration features.

[0150] It can be understood that the contents in the above method embodiments are all applicable to the present storage medium embodiment, the present storage medium embodiment specifically implements the same functions as the above method embodiments, and achieves the same beneficial effects as the above method embodiments.

[0151] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0152] The embodiments described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0153] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than the figures shown, or combine certain steps, or different steps.

[0154] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, that is, can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment scheme.

[0155] Those skilled in the art can understand that all or some steps in the above disclosed method, the functions of the modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0156] The terms "first", "second", "third", "fourth", and the like in the description and in the claims of this application, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so termed is interchangeable under appropriate circumstances such that the embodiments of the application described herein are, for example, capable of orderly or chronological mundane operation, reverse order operation, based on circuitry availability, based on stated preference or the like, and that "default" or other orderings are thus permissible. Further, the terms "comprise", "comprising", "include", "including", and the like, are specifically intended to be open-ended. That is, references to individual steps and the like do not suhstantially exclude the presence of two or more of a given step or its integral presence in the process, method, system, article, or apparatus having been made with a wider scope. The use of notation such as "first", "second", "third", etc. does not generally limit the areas, but can be used for clarity, and merely establishes the order of the steps or placement of components. Moreover, singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise.

[0157] It should be understood that, in the application, "at least one" means one or more, and "multiple" means two or more. "And / or", used to describe the relationship between associated objects, means that there can be three relationships, for example, "A and / or B" can mean that there are only A, only B, and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects. "At least one of the following" or the like means any combination of these items, including single or multiple combinations. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0158] In several embodiments provided in the application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the above-mentioned units is only a logical functional division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed objects can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0159] The units described above as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e. they can be located in one place or distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0160] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0161] When the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in part, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions used to cause a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various other media that can store programs.

[0162] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, and the scope of the embodiments of the present application is not limited thereto. Any modification, equivalent replacement and improvement made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the embodiments of the present application.

Claims

1. A method for classifying encrypted traffic based on multiple integral features, characterized in that, The method includes: Obtain encrypted traffic data of the target session, and generate an original traffic path based on the encrypted traffic data and the 5-tuple of the encrypted traffic data. The original traffic path is a sequence formed by the length of the data packets of the target session in each time period. The original one-dimensional traffic path is transformed to obtain the five-dimensional target traffic path. The re-integral feature data is determined based on the target traffic path, and the target feature data is determined by filtering based on the re-integral feature data; The target feature data is input into the traffic classification model, and the category of the encrypted traffic data is determined based on the output of the traffic classification model. The step of performing path transformation processing on the one-dimensional original traffic path to obtain the five-dimensional target traffic path includes: The original traffic path is decomposed and transformed to obtain the first upload path and the first download path; The first upload path and the first download path are respectively accumulated and transformed to obtain the first accumulated upload path and the first accumulated download path; The first upload path, the first download path, the first summation upload path, and the first summation download path are respectively subjected to base point transformation processing to obtain the corresponding second upload path, second download path, second summation upload path, and second summation download path; The time coordinate path is determined based on the sequence length of the original traffic path; The target traffic path is formed in five dimensions based on the second upload path, the second download path, the second cumulative upload path, the second cumulative download path, and the time coordinate path.

2. The method according to claim 1, characterized in that, The step of filtering and determining the target feature data based on the multiple integral feature data includes: The Shapley value corresponding to each feature item in the multiple integral feature data is calculated based on the Tree SHAP algorithm of BorutaShap. Based on the Shapley value of each feature item, a predetermined number of target feature items are selected from the multiple integral feature data, and the target feature data is formed based on the target feature items, wherein the Shapley value of the target feature item is the largest among the Shapley values ​​of all the feature items.

3. The method according to claim 1, characterized in that, The step of determining the reintegration feature data based on the target traffic path includes: Obtain the preset number of layers for the hierarchical dynamic window, and determine the window size and step size of the hierarchical dynamic window at each layer based on the preset number of layers and the sequence length of the target traffic path; Based on the target traffic path, sub-paths for each dimension of the target traffic path are extracted according to the preset number of layers, the window size, and the step size; The multiple integral feature data is determined based on the sub-path.

4. The method according to claim 3, characterized in that, The step of determining the multiple integral feature data based on the sub-path includes: For the sub-paths extracted from the same hierarchical dynamic window, calculate the corresponding sub-multiintegral feature data; The multiple integral feature data is generated based on all the sub-multiple integral feature data.

5. The method according to claim 1, characterized in that, The step of generating the original traffic path based on the encrypted traffic data and the 5-tuple of the encrypted traffic data includes: Determine the length of the data packet for the encrypted traffic data in each of the aforementioned time periods; The data type corresponding to the length of each data packet is determined based on the quintuple, and the data type includes uploaded data or downloaded data. The original traffic path is generated based on the data packet length and data type for each time period.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Obtain sample data from the sample set, and determine the sample session corresponding to the sample data based on the quintuple of the sample data; For the sample data of the same sample session, the original traffic path is generated based on the sample data and the 5-tuple of the sample data; Perform path transformation processing on the original traffic path to obtain the target traffic path; The re-integral feature data is determined based on the target traffic path, and the target feature data is determined by filtering based on the re-integral feature data; The target feature data corresponding to different sample sessions are determined as the training dataset, and the training dataset is divided into a training set, a validation set, and a test set according to a preset ratio. The traffic classification model is obtained by training a preset model based on the training set, the validation set, and the test set.

7. A cryptographic traffic classification device based on multiple integral features, characterized in that, The device includes: The traffic processing module is used to acquire encrypted traffic data of the target session and generate an original traffic path based on the encrypted traffic data and the five-tuple of the encrypted traffic data. The original traffic path is a sequence formed by the length of the data packets of the target session in various time periods. The path transformation module is used to perform path transformation processing on the one-dimensional original traffic path to obtain the five-dimensional target traffic path. The feature extraction module is used to determine the re-integral feature data based on the target traffic path, and to filter and determine the target feature data based on the re-integral feature data. The prediction module is used to input the target feature data into the traffic classification model and determine the category of the encrypted traffic data based on the output of the traffic classification model. The step of performing path transformation processing on the one-dimensional original traffic path to obtain the five-dimensional target traffic path includes: The original traffic path is decomposed and transformed to obtain the first upload path and the first download path; The first upload path and the first download path are respectively accumulated and transformed to obtain the first accumulated upload path and the first accumulated download path; The first upload path, the first download path, the first summation upload path, and the first summation download path are respectively subjected to base point transformation processing to obtain the corresponding second upload path, second download path, second summation upload path, and second summation download path; The time coordinate path is determined based on the sequence length of the original traffic path; The target traffic path is formed in five dimensions based on the second upload path, the second download path, the second cumulative upload path, the second cumulative download path, and the time coordinate path.

8. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method of any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images