A method for encrypted traffic classification based on a two-stage adaptive architecture

Abstract

The present application relates to a kind of encrypted traffic classification method based on two-stage adaptive architecture, belong to computer network security technical field.The present application first distinguishes data distribution inside (ID) and distribution outside (OOD) traffic by hybrid OOD detection mechanism, and adaptive classification strategy is used for the processing of detection result: for ID traffic, accurate classification is carried out to known category based on transformer-based encoder;For OOD traffic, the classification task is converted into generation task by combining large language model (LLM) and newly proposed semantic enhancement prompt strategy (SPS), so as to realize flexible fine-grained identification to unknown traffic type.SPS strategy of the present application contains three levels of strict mode, complete mode and extension mode, while ensuring classification accuracy, flexible generation space is provided.By this kind of innovative two-stage design, the present application keeps high-precision classification of ID traffic, while effectively solving the problem that existing methods cannot accurately identify emerging network applications.

Description

TECHNICAL FIELD

[0001] The present application relates to a two-stage adaptive architecture-based encrypted traffic classification method, belonging to the technical field of computer network security. Specifically, it relates to a classification method that can simultaneously process intra-distribution (ID) and out-of-distribution (OOD) encrypted traffic. Through an innovative hybrid OOD detection mechanism and semantic enhancement prompting strategy, the method achieves accurate identification of known and unknown encrypted traffic types. BACKGROUND

[0002] In recent years, the Internet technology has experienced explosive growth, and the innovation wave of network applications has been surging, which has led to increasing complexity and diversity of network traffic. On the one hand, existing network applications continue to optimize and update communication protocols and encryption methods; on the other hand, emerging applications are constantly emerging, each adopting unique and significantly differentiated traffic patterns. In such a rapidly changing network ecosystem, traffic classification technology faces unprecedented challenges. Precise traffic classification, as the cornerstone of network security, not only supports the core of intrusion detection and abnormal traffic analysis, but also is a key link to improve the level of service quality management, and has irreplaceable importance in ensuring the security and stability of the network space.

[0003] Currently, in the field of encrypted traffic classification, the mainstream methods can be roughly divided into two categories: traditional methods based on feature engineering and cutting-edge methods based on deep learning. Early research work mainly focused on hand-designed statistical features, and researchers achieved traffic classification by analyzing basic parameters such as packet size and arrival time interval. With the deepening of research, classification methods based on session behavior gradually emerged, which achieved more accurate traffic classification by deeply mining the behavior features in traffic sessions. Although these traditional methods have good interpretability to some extent, they can provide clear classification logic for researchers, but they generally have a cumbersome feature engineering process, and their limitations in generalization ability are increasingly evident when facing complex and changing network environments.

[0004] The rapid development of deep learning technology has brought revolutionary changes and opportunities to encrypted traffic classification. Convolutional neural networks (CNN), as a representative of deep learning models, can automatically extract features by cleverly converting raw traffic data into images or other structured representations, greatly improving classification efficiency and accuracy. Meanwhile, the combination of recurrent neural networks (RNN) and their derivatives, long short-term memory networks (LSTM), with CNNs further enhances classification performance by accurately modeling the temporal characteristics of traffic data. In recent years, the introduction of attention mechanisms has injected new vitality into deep learning models, significantly enhancing their ability to capture long-term dependencies in traffic data and providing a new technical path for achieving higher accuracy classification.

[0005] However, existing encrypted traffic classification methods mostly focus on the classification task of known categories of traffic, and have relatively weak processing capabilities for unknown traffic (i.e., OOD data) that does not appear in the training data. Although some studies attempt to alleviate this problem by introducing an "unknown" category, this simple approach is difficult to achieve fine-grained differentiation and accurate identification of unknown categories. In actual network application scenarios, network traffic exhibits high dynamicity and diversity, with new applications and protocols emerging like a flood, making the network environment increasingly complex. When encountering traffic patterns outside the scope of training data, existing classification methods often experience significant performance degradation. Moreover, grouping all unknown traffic into a single "other" category is far from meeting the stringent requirements of network security monitoring for accurate identification.

[0006] In summary, how to achieve fine-grained identification of unknown traffic while ensuring high-precision classification of known traffic has become a key technical problem that needs to be solved in the field of encrypted traffic classification. In order to effectively deal with the emerging new encrypted traffic in the network environment and meet the growing high-standard demands of modern network security, it is urgent to design a new technical solution to adapt to the complex and changing network ecological environment. SUMMARY

[0007] The technical problem to be solved by the present application is to provide an encrypted traffic classification method based on a two-stage adaptive architecture to solve the following problems existing in the prior art:

[0008] (1) Existing encrypted traffic classification methods mainly focus on in-distribution (ID) data, and have limited processing capabilities for out-of-distribution (OOD) data, resulting in the inability to identify new encrypted protocols or variant attack traffic in a timely manner;

[0009] (2) Most existing methods simply classify all unknown traffic into the "other" category, and cannot achieve fine-grained identification of multiple unknown types in encrypted traffic.

[0010] (3)With the continuous emergence of new applications and protocols, network traffic patterns are diverse and evolving, and there is an urgent need for a classification method that combines high generalization ability and adaptability, and can handle unknown traffic types in a timely manner.

[0011] To solve the above problems, the application proposes a two-stage encrypted traffic classification architecture combining "hybrid detection + adaptive classification". Compared with the traditional model trained only for known data, the application adds a hybrid OOD detection mechanism in the first stage, and in the second stage, it uses a precise classification strategy based on Transformer and a semantic enhancement prompt strategy (SPS) for unknown traffic fine-grained classification according to different judgment results. This method fully utilizes the advantages of deep learning models in sequence feature extraction, distribution difference measurement, and cross-layer feature smoothness analysis, not only achieving high-precision identification of known traffic types, but also dynamically adapting to unknown traffic introduced by new protocols and new applications, greatly improving the robustness and applicability of the overall system.

[0012] The technical solution adopted by the application is as follows: an encrypted traffic classification method based on a two-stage adaptive architecture, the specific steps are:

[0013] Step 1: For the input encrypted traffic data sequence, the final feature vector is calculated through the LSTM network gate unit and state update;

[0014] Step 2: Based on the principal component analysis method, the feature space is decomposed using the obtained final feature vector, the feature covariance matrix is calculated, the eigenvalues and eigenvectors are obtained by eigenvalue decomposition, and the principal component space and residual space are constructed;

[0015] Step 3: Project the final feature vector using the residual space to calculate the residual space projection score;

[0016] Step 4: Calculate the smoothness score of the inter-layer transformation of the deep network, and calculate the sum of the L2 norm difference of the feature representation of adjacent layers in the network as the smoothness score;

[0017] Step 5: Set the balance factor, combine the residual space projection score and the smoothness score by weighting, and obtain the final hybrid OOD score;

[0018] Step 6: Based on the preset threshold, the hybrid OOD score is judged, when the hybrid OOD score is greater than the preset threshold, it is judged as OOD traffic, otherwise it is judged as ID traffic;

[0019] Step 7: According to the determined encrypted traffic data type, an adaptive classification strategy is used to classify ID and OOD traffic.

[0020] The specific updates of the gating units and states of the LSTM network are as follows:

[0021] For the input encrypted traffic data sequence {x1, x2, ..., x n}, using LSTM network for feature extraction, we get:

[0022] i t =σ(W i [h t-1 , x t ]+b i )

[0023] f t =σ(W f [h t-1 , x t ]+b f )

[0024] o t =σ(W o [h t-1 , x t ]+b o )

[0025]

[0026] h t =o t ⊙tanh(c t )

[0027]

[0028] Among them, i t is the input gate, f t For the forget gate, o t is the output gate, is the candidate cell state, c t is the cell state, h t is the hidden state, x t is the encrypted traffic data sequence, W i , W f , W o , Wc is the weight matrix, b i , b f , b o , b c is the bias term, σ is the sigmoid activation function, tanh is the hyperbolic tangent activation function, ⊙ represents element-by-element multiplication, and h n represents the last hidden state of the sequence, n represents the sequence length, h t-1 is the hidden state at time t-1, c t-1 is the cell state at time t-1, represents the final feature vector, by introducing LSTM, long-distance dependencies can be captured in encrypted traffic sequence modeling, and robust and rich time sequence information representation is provided for subsequent determination.

[0029] The Step2 is specifically:

[0030] After obtaining the sequence features of the LSTM output, in order to further distinguish normal (known distribution) traffic from potential unknown (abnormal) traffic, the application combines principal component analysis (PCA) to orthogonally decompose the feature space, specifically including:

[0031] First, the covariance matrix C is calculated:

[0032]

[0033] Wherein, N is the number of ID training samples, is the feature vector extracted by the LSTM, μ is the mean vector, and T represents the transpose matrix operation;

[0034] Eigenvalue decomposition is performed on the matrix C:

[0035] C=VΛV T

[0036] Wherein, Λ=diag(λ1,…,λ m ) is the eigenvalue, V=[v1,…,v m ] is the eigenvector, and m is the dimension of the eigenvector;

[0037] The number of principal components k is determined according to the cumulative variance ratio γ:

[0038]

[0039] Wherein, m' represents the number of selected principal components, and γ is a preset variance ratio threshold;

[0040] The principal component space P and the residual space R are constructed:

[0041] P=span{v1,…,v k}

[0042] R=span{v k+1 ,…,v m}

[0043] Wherein, span{v1,…,v k} represents a linear space spanned by vectors v1 to v k , that is, a set of vectors in the form of α1v1+α2v2+…+α k v k , wherein α1 to αk are arbitrary real coefficients. In principal component analysis (PCA), P represents the principal component space spanned by the first k principal component vectors, capturing the main direction of variation in the data; R represents the residual space spanned by the remaining principal component vectors, corresponding to the secondary direction of variation and noise in the data.

[0044] The residual space projection score is specifically:

[0045]

[0046] Among them, P R is the projection operator of the residual space R, and s1 is the residual space projection score.

[0047] The Step 4 is specifically as follows:

[0048] To address the dramatic fluctuations in inter-layer feature maps that may occur when deep networks process encrypted traffic, this paper further calculates feature differences between adjacent layers of the transformer and accumulates them to obtain an overall smoothness score. The specific formula is as follows:

[0049] First, obtain the feature representation of each layer:

[0050] F l (X i )=TransformerLayer l (X i )

[0051] Among them, l represents the network layer index, TransformerLayer l represents the l-th layer transformer encoder;

[0052] Calculate the difference in features between adjacent layers:

[0053] d l =||F l (X i )-F l-1 (X i )||2

[0054] Among them, d l represents the difference between the feature representation of layer l and the feature representation of layer l-1, F l (X i ) represents the input X of the deep network layer l i The feature representation, F l-1 (X i ) represents the input X of the deep network layer l-1 i The feature representation of , ||·||2 represents the L2 norm;

[0055] The smoothness scores of all layers are accumulated:

[0056]

[0057] Wherein, L is the total number of network layers, s2 is the smoothness score;

[0058] If the input traffic is OOD, it will often cause a large difference in multiple adjacent network layers, so that s2 rises significantly. This inter-layer smoothness analysis combined with principal component decomposition can cross-verify the input from the spatial distribution and network representation dynamics.

[0059] The Step5 is specifically:

[0060] In order to comprehensively utilize the different emphases provided by residual space projection and smoothness analysis, the present application fuses them into a hybrid OOD score S(X i ), so as to realize more robust judgment, and the calculation formula of the hybrid OOD score S(X i ) is:

[0061] S(X i ) = a * s1 + (1-a) * s2

[0062] Specifically:

[0063]

[0064] Wherein, S(X i ) is the hybrid OOD score of the input X i , a is a balance factor, the value range is [0, 1], and Σ represents the sum of the differences of all network layers.

[0065] The adaptive classification strategy is specifically:

[0066] If the traffic data is judged as ID, a multi-layer transformer encoder is used to process the input feature sequence to obtain the hidden layer representation H i , the feature weight is calculated based on the attention mechanism to obtain the weighted feature representation, the probability distribution P(y|X) of the known categories is calculated through the full connection layer and the softmax function, and the category with the highest probability is selected as the final classification result; the core idea is to deeply mine the context dependency relationship in the traffic sequence by using the attention mechanism, and combine the multi-head attention structure to model the segmented features in parallel. The specific process includes:

[0067] Feature encoding:

[0068]

[0069] Wherein, H i is the inter-layer hidden state, and v iTo classify token representation, denotes a transformer encoder with classification head, and denotes model parameters.

[0070] Attention computation:

[0071]

[0072] where Q, K, V are query, key and value matrices, d k is the dimension of key vectors, T denotes the transpose operation, and softmax denotes the normalization function.

[0073] Classification probability computation:

[0074] P(y|X i )=softmax(W·A+b)

[0075] where W and b are learnable parameters, and P(y|X i ) denotes the conditional probability distribution of class y given input X i . Through this step, the prediction distribution of each known traffic type can be obtained. Since a large amount of labeled data is used in the training stage, the present application can maintain high accuracy and stability when processing regular encrypted traffic.

[0076] If the traffic data is determined to be OOD, the traffic features are converted into a standardized format for processing by a large language model, a three-layer prompt template is constructed according to a semantic enhancement prompt strategy, the processed features and the prompt template are input into the large language model, and specific application labels are obtained through a generation task, which can further mine the differences within unknown traffic and realize multi-class subdivision. This process includes:

[0077] Feature standardization:

[0078] Q std =StandardizeFeatures(X i )

[0079] where Q std denotes the standardized feature representation, and StandardizeFeatures denotes the feature standardization function.

[0080] Selecting a prompt mode according to the actual scenario:

[0081] T k ∈{T1,T2,T3}

[0082] The first layer is a strict mode, and the expression is T1={(X i , y i )|y i ∈Y OOD}, wherein y i represents the corresponding category label, Y OOD represents a predefined OOD category set;

[0083] The second layer is a complete mode, and the expression is T2={(X i , y i )|y i ∈(Y ID ∪Y OOD )}, wherein Y ID represents a known ID category set;

[0084] The third layer is an extended mode, and the expression is wherein j represents an index of different data sets, represents an ID category set in the jth data set, represents an OOD category set in the jth data set.

[0085] Construction hints:

[0086] p={T k ,Q std}

[0087] wherein p represents a complete hint constructed.

[0088] Generate category labels:

[0089]

[0090] wherein y is a predicted label sequence, L seq represents a sequence length of generated labels, y t is a tth token of the generated label, y 1:t-1 represents a subsequence from the 1st to the t-1th token, and Π represents a continuous multiplication operation.

[0091] Through the semantic enhanced hint mechanism, the application can make more accurate category determination on the detected OOD traffic on the basis of sufficient mining of implicit information, thereby overcoming the limitation of traditional methods that can only mark “other” in general. In addition, the reasoning and generation characteristics of the large language model can further improve the explainability and expansion capability for unknown categories when processing new protocols or variant traffic emerging.

[0092] The application achieves the following beneficial effects through the above technical solutions:

[0093] (1) The mixed OOD detection mechanism has excellent performance

[0094] The detection accuracy of 96.81% is achieved on the CHNAPP data set. Since the residual space projection and the inter-layer transformation smoothness analysis are fused, the application can maintain stable unknown detection performance under multiple types of encryption protocols, and significantly reduce the misjudgment rate.

[0095] (2) High-precision classification of ID traffic

[0096] The macro-averaged precision of 96.90% is achieved in the ISCXVPN data set, which shows that the application can balance high precision and real-time performance when processing common VPN type traffic; and the adaptive modeling of network layer features greatly reduces the false identification of traffic.

[0097] (3) Innovative realization of OOD traffic fine-grained classification

[0098] The classification accuracy of 97.70% is achieved on the ISCXTor data set, which not only avoids the rough method of simply classifying as "other", but also can further distinguish different unknown traffic types, providing fine-grained basis for network security monitoring and threat warning.

[0099] (4) Strong generalization ability

[0100] Through testing in different encryption scenarios, it is found that whether it is traditional TLS (Transport Layer Security) traffic, emerging QUIC (Quick UDP Internet Connection), SSH (Secure Shell Protocol) or custom encryption protocol, the application can maintain good detection and classification performance, showing robustness across protocols and distributions.

[0101] (5) Significant improvement in computing efficiency

[0102] Compared with the existing method, the average processing time is reduced by 35%, which has a significant advantage for online analysis of real-time massive traffic. In addition, the phased processing architecture can be flexibly deployed on the server side or the edge side, meeting the needs of various application scenarios.

[0103] As can be seen, the application further proposes a two-stage adaptive architecture with high accuracy and strong generalization ability on the basis of the paper, which successfully solves the common problems of "unknown traffic cannot be subdivided" and "weak detection outside the distribution" in existing encrypted traffic classification by using key technical means such as LSTM sequence feature extraction, PCA principal component decomposition, inter-layer transformation smoothness measurement, and semantic enhancement prompt strategy (SPS) guided large language model, and has wide application value and promotion prospect. The technology can be applied to network intrusion detection, real-time traffic regulation, transmission layer protocol optimization, and higher layer network security audit, and has good adaptability and scalability for the network ecology with the continuous emergence of new applications. BRIEF DESCRIPTION OF DRAWINGS

[0104] Figure 1 is a flow chart of the steps of the present invention;

[0105] Figure 2 This is a two-stage adaptive architecture framework diagram of the present invention;

[0106] Figure 3 Schematic diagram of the hybrid OOD detection mechanism of the present invention;

[0107] Figure 4 This is a performance comparison chart of the present invention on different data sets;

[0108] Figure 5 This is the confusion matrix analysis diagram of the present invention. DETAILED DESCRIPTION

[0109] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0110] Example 1: Figure 1 , Figure 2 As shown, the present invention provides an encrypted traffic classification method based on a two-stage adaptive architecture, which includes two stages: OOD detection and adaptive classification. The first stage detects the traffic type through a hybrid mechanism, and the second stage adopts a corresponding classification strategy based on the detection results to achieve accurate classification of ID and OOD traffic. Specifically, the first stage adopts a hybrid OOD detection mechanism to distinguish between ID and OOD traffic by combining the smoothness of transformer inter-layer transformation and feature analysis. The second stage adopts different processing strategies based on the detection results: for ID traffic, a transformer encoder is used for classification, and for OOD traffic, a large language model combined with a semantic enhancement prompt strategy is used for processing.

[0111] Figure 3 The hybrid OOD detection mechanism of the present invention is presented in detail, specifically showing the complete process of LSTM-based feature extraction, feature space decomposition, inter-layer smoothness analysis and score fusion. The calculation formula of the hybrid OOD score S(X i )=α·s1+(1-α)·s2, where s1 is the residual space projection score and s2 is the inter-layer smoothness score.

[0112] Specifically, the mechanism first extracts the traffic feature vector through LSTM. For the input encrypted traffic sequence {x1,x2,…,x n}, LSTM extracts features through gating mechanism and state update. Input gate i t 、Forget Gate t and output gate o t The update of follows the following calculation process:

[0113] i t = σ(W i [h t-1 , x t ] + b i )

[0114] f t = σ(W f [h t-1 , x t ] + b f )

[0115] o t = σ(W o [h t-1 , x t ] + b o )

[0116] where W i , W f , W o are the corresponding weight matrices, h t-1 is the hidden state at time t-1, x t is the current input, b i , b f , b o are bias terms. The update formula of cell state c t and hidden state h t is:

[0117] c t = f t ⊙c t-1 + i t ⊙tanh(Wc[h t-1 , x t ] + b c )

[0118] h t = o t ⊙tanh(c t )

[0119] where ⊙ denotes element-wise multiplication, c t-1 is the cell state at time t-1, denotes the final feature vector, which is given by the hidden state h n at the last time of the sequence, i.e.

[0120] After obtaining the feature vector, as shown in Figure 3 , the present application adopts principal component analysis to decompose the feature space. First, the covariance matrix is calculated:

[0121]

[0122] Among them, N is the number of ID training samples, is the feature vector extracted by LSTM, μ is the mean vector, and T represents the transposed matrix operation;

[0123] The eigenvalues ​​{λ i} and the eigenvector {v i The number of principal components k is determined based on the cumulative variance ratio γ, and the principal component space P and residual space R are constructed:

[0124] P=span{v1,…,v k}

[0125] R=span{v k+1 ,…,v m}

[0126] Among them, span{v1,…,v k} represents the vector from v1 to v k The linear space of Zhang Cheng can be expressed as α1v1+α2v2+…+α k v k A set of vectors of the form α1 to α k are arbitrary real coefficients. In principal component analysis (PCA), P represents the principal component space spanned by the first k principal component vectors, capturing the main direction of variation in the data; R represents the residual space spanned by the remaining principal component vectors, corresponding to the secondary direction of variation and noise in the data.

[0127] At the same time, the present invention analyzes the transformation smoothness of feature representations of adjacent layers in a deep network. Figure 3 As shown on the right, for the L-layer feature representation in the network {F1,…,F L}, calculate the L2 norm difference between adjacent layers, and finally get the smoothness score s2 of all layers:

[0128]

[0129] Among them, F l (X i ) represents the input X of the deep network layer l i The feature representation, F l-1 (X i ) represents the input X of the deep network layer l-1 i The feature representation of ,||·||2 represents the L2 norm;

[0130] The final hybrid OOD score is calculated as Figure 3 As shown, the residual space projection score s1 and the smoothness score s2 are weighted fused:

[0131] S(X i )=α·s1+(1-α)·s2

[0132] where s1 is the residual space projection score: P R is the projection operator of residual space R, and α is a balance factor with a value range of [0, 1]. When S(X i ) exceeds a preset threshold δ, it is determined as an OOD flow, otherwise it is determined as an ID flow. Experiments show that when α = 0.6, δ = 0.75, the detection effect is optimal.

[0133] The application designs a three-layer semantic enhancement prompt strategy (SPS). The strategy guides the large language model to generate accurate classification labels through different levels of prompt templates. Specifically, it includes:

[0134] The strict mode (T1) only contains specific application categories. Its prompt template form is:

[0135] “Classify this encrypted network traffic packet into one of these known application categories: QQMail, QQMusic, Youku, TaoBao. Consider the traffic packet characteristics including: 1. Protocol behavior (TCP flags, window size) 2. Packet structure (length, fragmentation) 3. Encrypted payload patterns.”

[0136] The complete mode (T2) is extended to all application categories in the dataset. Its prompt template is:

[0137] “Given this encrypted network traffic packet, classify it into one of these possible applications: QQMail, QQMusic, Youku, TaoBao, WeChat, Weibo. Analyze the characteristics including TCP protocol behaviors, packet structure patterns, and encrypted payload features.”

[0138] Extended mode (T3) integrates cross-dataset knowledge. The prompt template is:

[0139] “Analyze this encrypted network traffic packet and classify it based on its characteristics. Consider the following applications across different platforms: QQMail, QQMusic, Youku, TaoBao, WeChat, Weibo, Gmail, Facebook, Skype, YouTube.”

[0140] The generation space corresponding to each mode gradually expands, achieving a trade-off between classification accuracy and generalization ability.

[0141] It is worth noting that the use of English prompt templates in the present application can more accurately describe and match protocol characteristics, because hexadecimal data is represented in ASCII: network packets are usually displayed in hexadecimal form in packet capture tools such as Wireshark, and the ASCII characters that can be displayed are mostly English. Although the payload of encrypted traffic is encrypted, the protocol handshake process, header structure, and other characteristics still retain this representation. The prompt template uses English, which is more consistent with these original data representations. The RFC documents and technical specifications of encryption protocols such as TLS, QUIC, and SSH are written in English, and the keywords, status codes, and error messages in the protocols are also in English.

[0142] As shown in Figure 4 , the horizontal axis of the graph represents different evaluation indicators (macro-averaged precision, macro-averaged F1 value, etc.), and the vertical axis represents performance scores. By comparing with existing methods (PacRep, BART-Large, GPT-4o, etc.), the performance advantages of the present application are intuitively demonstrated. Specifically, the present application was comprehensively evaluated on three datasets: CHNAPP, ISCXVPN, and ISCTXTor. Evaluation indicators include macro-averaged precision (M-Prec), macro-averaged F1 value (MacroF1), micro-averaged F1 value (MicroF1), and recall (Recall). The experimental results show that the present application method is significantly better than the prior art. On the CHNAPP dataset, it achieved a macro-averaged precision of 96.81%, which is 38.68 percentage points higher than the 58.13% of PacRep. On the ISCXVPN dataset, it reached a macro-averaged precision of 96.90%, which is 14.97 percentage points higher than the 81.93% of GPT-4o.

[0143] Figure 5 The confusion matrix analysis results of the application are shown in the figure, which shows the classification results on the CHNAPP, ISCXVPN and ISCTXTor three data sets, and reflects the classification effect of the application on different types of traffic through the distribution of diagonal and non-diagonal elements. Specifically, from the confusion matrix, it can be clearly seen that the method of the application shows strong classification ability when processing ID traffic. Taking the CHNAPP data set as an example, the number of accurate recognition of QQMusic reaches 1085, and that of Youku reaches 1207. When processing OOD traffic, it also maintains high accuracy, and the number of accurate recognition of WeChat and Weibo reaches 970 and 1014 respectively. This excellent performance benefits from the design of the two-stage adaptive architecture.

[0144] Further analysis shows that the advantage of the application is particularly prominent when processing VPN encrypted traffic. As shown in the confusion matrix of the ISCXVPN data set in the middle, even in the face of complex traffic patterns encrypted by VPN, the application can still maintain clear classification boundaries. This high-precision classification effect is mainly due to the effectiveness of the hybrid OOD detection mechanism and the accurate guidance of the semantic enhancement prompt strategy. Figure 5

[0145] In actual application, the specific deployment process of the application is as follows:

[0146] First, data preprocessing and division are performed. Taking the CHNAPP data set as an example, from a total of 614575 traffic data, 485782 ID category data (QQMail, QQMusic, Youku, TaoBao) are selected for training, and the remaining 128793 data contain WeChat and Weibo as OOD category data. Among the 128793 non-training data, a validation set and a test set are constructed, each set maintaining a 7:3 ratio of ID and OOD data. Specifically, the validation set contains 64391 data (of which 45074 are ID data and 19317 are OOD data), and the test set contains 64402 data (of which 45081 are ID data and 19321 are OOD data). This division ensures that the model can fully contact different proportions of known and unknown types of traffic in the validation and test stages.

[0147] In the model training stage, the OOD detection part uses the Adam optimizer, and the learning rate is set to 2e-5, and is trained for 20 rounds. The calculation of the hybrid OOD score uses the optimal parameter configuration verified by experiments: the balance factor α = 0.6, and the detection threshold δ = 0.75. These parameter settings also show good adaptability on the ISCXVPN and ISCTXTor data sets.

[0148] ​The ID classification branch adopts a 12-layer transformer encoder, with 8 attention heads in each layer. The AdamW optimizer is used for training, with a learning rate of 2e-5, and a total of 30 rounds of training. It is found in experiments that this configuration can well balance the expression ability and computational overhead of the model.

[0149] The OOD classification branch uses GPT-4o as the base language model, with a temperature parameter of 0.7 and a top-p sampling parameter of 0.95. In the generation process, the prompt strategy of strict mode shows the best classification effect. Experiments show that this parameter configuration can ensure the accuracy of generated labels while maintaining moderate output diversity.

[0150] In processing Tor network traffic, as shown in the results of the ISCXTor dataset, Figure 5 The invention shows strong robustness. Even in the face of multiple layers of encryption and anonymization processing of the Tor network, the classification accuracy remains at a high level. This proves the practical value of the two-stage adaptive architecture proposed in the invention in complex network environments.

[0151] Experiments have also found that as the prompt mode changes from strict to extended, although the classification accuracy decreases slightly, the model shows stronger generalization ability. This provides an important reference for how to balance accuracy and generalization in practical applications.

[0152] In terms of computational efficiency, thanks to the reasonable architecture design, the invention shows significant performance advantages under standard hardware configuration (NVIDIA RTX4090 GPU). Compared with existing methods, the average processing time is reduced by 35%. This is of great significance for practical scenarios that require real-time processing of large amounts of network traffic.

[0153] It should be noted that the above embodiments are only preferred embodiments of the invention. They are not a limitation on the scope of protection of the invention. Those skilled in the art can make various modifications and improvements without departing from the essence of the technical solutions of the invention. These modifications and improvements also belong to the scope of protection of the invention.

Claims

1. A method for encrypted traffic classification based on a two-stage adaptive architecture, characterized in that, The method comprises the following steps: Step 1: for the input encrypted traffic data sequence, the final feature vector is calculated through the gating unit and state update of the LSTM network; Step 2: using the obtained final feature vector, the feature space is decomposed based on the principal component analysis method, the feature covariance matrix is calculated, the eigenvalue and eigenvector are obtained by eigenvalue decomposition, and the principal component space and residual space are constructed; Step 3: projecting the final feature vector into the residual space to calculate the residual space projection score; Step4: Calculate the smoothness score of the inter-layer transformation of the deep network. For the feature representations of adjacent layers in the network, calculate the sum of the norm difference as the smoothness score. norm difference as the smoothness score. Step 5: setting a balance factor, weighting and combining the residual space projection score and the smoothness score to obtain the final hybrid OOD score; Step 6: based on the preset threshold, the hybrid OOD score is judged, and when the hybrid OOD score is greater than the preset threshold, it is judged as OOD traffic, otherwise it is judged as ID traffic; Step 7: according to the determined type of encrypted traffic data, an adaptive classification strategy is adopted to realize the classification of ID and OOD traffic.

2. The method of claim 1, wherein, The state update through the gating unit of the LSTM network is specifically: ； ； ； ； ； ； ； wherein, is an input gate, is a forget gate, is an output gate, is a candidate cell state, is a cell state, is a hidden state, is an encrypted traffic data sequence, , , , is a weight matrix, , , , is a bias term, is a sigmoid activation function, is a hyperbolic tangent activation function, denotes an element-wise multiplication, denotes the last hidden state of a sequence, denotes the sequence length, is a hidden state at time t, is a cell state at time t, denotes a final feature vector.

3. The method of claim 1, wherein, The Step 2 is specifically: Computing a covariance matrix : ； wherein, is the number of training samples, is the feature vector extracted by LSTM, is the mean vector, denotes the transpose matrix operation; On the matrix Eigenvalue decomposition: ； wherein, is an eigenvalue, is an eigenvector, is a dimension of the eigenvector; According to the accumulated variance ratio Determining the number of principal components : ； wherein, represents the number of selected principal components, is a preset variance ratio threshold value; Constructing principal component space and residual space : ； ； wherein, denotes the linear space spanned by the vectors to , in principal component analysis, denotes the principal component space spanned by the first previous principal component vectors; denotes the residual space spanned by the remaining principal component vectors.

4. The method of claim 3, wherein, The residual space projection score is specifically: ； wherein, is a projection operator of the residual space is a projection operator of the residual space is a residual space projection score.

5. The method of claim 1, wherein, The Step 4 is specifically: Obtain the feature representation of each layer: ； wherein represents a network layer index, represents the first layer encoder; Calculate the feature difference between adjacent layers: ； wherein, represents the feature representation of the input by the deep network at the layer, represents the feature representation of the input by the deep network at the layer, represents the feature representation of the input by the deep network at the layer, represents norm; Accumulate the smoothness scores of all layers: ； wherein, is the total number of networks, is the smoothness score.

6. The method of claim 5, wherein, The hybrid OOD score is specifically: ； wherein, is the input mixed OOD score, is a balancing factor, taking values in the range , denotes the sum over all network layers of the difference.

7. The method of claim 6, wherein, The adaptive classification strategy is specifically: If the flow data is determined as ID, a multi-layer transformer encoder is used to process the input feature sequence to obtain a hidden layer representation , a feature weight is calculated based on an attention mechanism to obtain a weighted feature representation, and a probability distribution of known categories is calculated through a fully connected layer and a softmax function , the category with the highest probability is selected as the final classification result; If the traffic data is determined as OOD, the traffic features are converted into the standardized format for processing by the large language model, a three-layer prompt template is constructed according to the semantic enhancement prompt strategy, the processed features and the prompt template are input into the large language model, and specific application labels are obtained through the generation task.

8. The method of claim 7, wherein, The three-layer prompt template constructed according to the semantic enhancement prompt strategy is specifically: The first layer is strict mode, the expression is wherein, denotes the corresponding class label, denotes a predefined set of OOD classes; The second layer is the full mode, the expression is wherein, represents a known set of ID categories; The third layer is the expanded mode, the expression is wherein, denotes the index of different data sets, denotes the ID category set in the th data set, denotes the OOD category set in the th data set.

Images