A method and device for classifying encrypted malicious traffic based on byte frequency domain information

Abstract

The application discloses a kind of encryption malicious traffic classification method and device based on byte frequency domain information, the method includes: obtaining first data;The first data is preprocessed, and second data is obtained;The second data is extracted and handled, and a second data feature information set is obtained;The second data feature information set is handled using traffic data classification model, and traffic data classification information is obtained.The application uses traffic data classification model, realizes the real-time identification and classification of encryption malicious traffic in original traffic data based on important byte frequency domain information screening, improves encryption malicious traffic identification processing efficiency and classification accuracy.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security, and in particular to a method and device for identifying and classifying encrypted malicious traffic of a small sample. Background Art

[0002] Methods based on content-based censorship, such as Deep Packet Inspection (DPI), struggle to identify malicious content and behavior because they can't directly parse information contained in encrypted payloads. Decrypting data packets can be achieved by pre-importing user encryption certificates, but this method consumes significant computing resources and time, a burden prohibitive for high-throughput network nodes. Furthermore, the decryption process can lead to the leakage of private information, defeating the purpose of using encryption protocols in the first place.

[0003] While signature-based identification methods can attempt to generate encrypted malicious traffic signatures using plaintext information from various protocol layers, this approach is significantly more difficult and requires network analysis experts to invest more time and effort in designing targeted signatures to adapt to evolving attack patterns. Furthermore, attackers often employ obfuscation and camouflage techniques to adjust the characteristics of encrypted malicious traffic in order to circumvent signature-based identification mechanisms.

[0004] Anomaly-based identification methods rely on modeling normal traffic. Commonly used models include machine learning and deep learning models. Machine learning-based methods for identifying encrypted malicious traffic rely heavily on feature engineering and lack a systematic feature design approach. Deep learning-based identification methods can automatically extract features from raw traffic data and exhibit strong versatility. However, existing research lacks targeted design for encrypted traffic, which affects the accuracy of encrypted malicious traffic identification. Furthermore, deep learning models typically require high computing resources, making them difficult to meet real-time requirements in high-bandwidth, high-throughput network environments.

[0005] Therefore, traditional methods for identifying encrypted malicious traffic suffer from limitations such as privacy leakage, high computational costs, and low accuracy, making them difficult to meet network protection requirements. This method aims to maintain high accuracy while also leveraging deep feature learning to achieve refined classification of encrypted malicious traffic and rapid, real-time identification of unknown malicious traffic. By designing a lightweight deep learning model, it promotes intelligent identification of encrypted malicious traffic, providing a solution to addressing increasingly complex network threats and maintaining network security. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method and device for classifying encrypted malicious traffic based on byte frequency domain information, which utilizes a traffic data classification model to realize real-time identification and classification of encrypted malicious traffic in original traffic data based on screening of important byte frequency domain information, thereby improving the efficiency of encrypted malicious traffic identification and processing and the classification accuracy.

[0007] In order to solve the above technical problems, the first aspect of the embodiments of the present invention discloses a method for classifying encrypted malicious traffic based on byte frequency domain information, the method comprising:

[0008] S1, obtaining first data;

[0009] S2, preprocessing the first data to obtain second data;

[0010] S3, extracting and processing the second data to obtain a second data feature information set;

[0011] S4. Process the second data feature information set using a traffic data classification model to obtain traffic data classification information.

[0012] As an optional implementation manner, in the first aspect of the embodiment of the present invention, preprocessing the first data to obtain important byte data includes:

[0013] S21, encoding the first data to obtain a data packet byte data set;

[0014] The data packet byte data set includes a plurality of data packet byte data;

[0015] S22, processing the data packet byte data set based on the error assessment model to obtain a first byte parameter information set;

[0016] The first byte parameter information set includes a plurality of first byte parameter information;

[0017] S23, performing a difference process on the first byte parameter information set to obtain a second byte parameter information set;

[0018] The second byte parameter information set includes a plurality of second byte parameter information;

[0019] S24, sorting the byte data of the data packet according to the size order of the second byte parameter information to obtain a data packet byte sorting data set;

[0020] The data packet byte sorting data set includes a plurality of data packet byte sorting data;

[0021] S25: Based on the second byte parameter information, filter all the byte sorting data of the data packet to obtain second data.

[0022] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the expression of the error assessment model is:

[0023]

[0024] Where i represents the index of the data packet byte data; ER i Indicates the classification prediction error rate of the byte data of the i-th packet; FP i Indicates the number of samples misclassified as normal; FN i Indicates the number of samples misclassified as malicious; TP i Indicates the number of samples correctly classified as normal; TN i Indicates the number of samples correctly classified as malicious;

[0025] The difference processing expression is:

[0026] ER i '=ER i -ER;

[0027] Among them, ER i ' represents the importance parameter of the byte data of the i-th data packet; ER represents the classification prediction error rate benchmark value.

[0028] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the extracting and processing the second data to obtain the second data feature information set includes:

[0029] S31, performing splicing processing on the second data to obtain an important byte sequence set;

[0030] The important byte sequence set includes several important byte sequences;

[0031] S32, performing transformation processing on any of the important byte sequences to obtain second data feature information;

[0032] The transformation processing expression is:

[0033]

[0034] Among them, Q[K] represents the characteristic information of the kth important byte data; x n represents the second data; N represents the size of the second data; j is an imaginary unit; k represents the index of the important byte data;

[0035] S33, all the second data feature information are combined in order to obtain a second data feature information set;

[0036] The second data feature information set includes a plurality of second data feature information.

[0037] As an optional implementation, in the first aspect of the embodiment of the present invention, the traffic data classification model includes: a packet-level benchmark characterization module, an inter-packet feature extraction module, and a data classification module;

[0038] The packet-level benchmark characterization module is configured to process the second data feature information set to obtain a first feature information set;

[0039] The inter-packet feature extraction module is configured to perform convolution processing on the first feature information set to obtain a second feature information set;

[0040] The data classification module is used to perform splicing and identification processing on the second feature information set to obtain flow data classification information;

[0041] The packet-level benchmark characterization module, the inter-packet feature extraction module and the data classification module are sequentially data-connected.

[0042] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the processing of the second data feature information set using the traffic data classification model to obtain traffic data classification information includes:

[0043] S41, using the packet-level benchmark characterization module, processing the second data feature information set to obtain a first feature information set;

[0044] S42, using the inter-packet feature extraction module to process the first feature information set to obtain a second feature information set;

[0045] S43: Utilize the data classification module to process the second feature information set to obtain flow data classification information.

[0046] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the processing of the second data feature information set by the packet-level benchmark characterization module to obtain the first feature information set includes:

[0047] S4101, performing a first convolution process on the second data feature information set to obtain frequency domain feature information within a first packet;

[0048] Performing a second convolution process on the second data feature information set to obtain second intra-packet frequency domain feature information;

[0049] S4102, performing a first function processing on the frequency domain feature information in the first packet to obtain frequency domain feature information in a third packet;

[0050] Performing a first function processing on the frequency domain feature information in the second packet to obtain frequency domain feature information in a fourth packet;

[0051] S4103, performing a second function processing on the frequency domain feature information in the third packet to obtain frequency domain feature information in a fifth packet;

[0052] Performing a second function processing on the frequency domain feature information in the fourth packet to obtain frequency domain feature information in a sixth packet;

[0053] S4104, performing a first pooling process on the frequency domain feature information in the fifth packet to obtain frequency domain feature information in a seventh packet;

[0054] Performing a second pooling process on the frequency domain feature information in the sixth packet to obtain frequency domain feature information in an eighth packet;

[0055] S4105, performing a third convolution process on the frequency domain feature information in the seventh packet to obtain frequency domain feature information in a ninth packet;

[0056] performing a fourth convolution process on the frequency domain feature information in the eighth packet to obtain frequency domain feature information in a tenth packet;

[0057] S4106, performing a third function processing on the frequency domain feature information in the ninth packet to obtain frequency domain feature information in the eleventh packet;

[0058] Performing a third function processing on the frequency domain feature information in the tenth packet to obtain frequency domain feature information in the twelfth packet;

[0059] S4107, performing a fourth function processing on the frequency domain feature information in the eleven packets to obtain frequency domain feature information in the thirteenth packet;

[0060] Performing a fourth function processing on the frequency domain feature information in the twelfth packet to obtain frequency domain feature information in the fourteenth packet;

[0061] S4108, performing a third pooling process on the frequency domain feature information in the thirteenth packet to obtain frequency domain feature information in the fifteenth packet;

[0062] Performing a fourth pooling process on the frequency domain feature information in the fourteenth packet to obtain frequency domain feature information in the sixteenth packet;

[0063] S4109: Concatenate and flatten the frequency domain feature information in the fifteenth packet and the frequency domain feature information in the sixteenth packet to obtain frequency domain feature information in the seventeenth packet.

[0064] S4110, performing a first linear processing on the frequency domain feature information in the seventeenth packet to obtain frequency domain feature information in the eighteenth packet;

[0065] S4111, performing generalization processing on the frequency domain feature information in the eighteenth packet to obtain frequency domain feature information in the nineteenth packet;

[0066] S4112, performing a second linear processing on the frequency domain feature information in the nineteenth packet to obtain frequency domain feature information in the twentieth packet;

[0067] S4113: Perform a fifth function processing on the frequency domain feature information in the 20th packet to obtain a first feature information set.

[0068] A second aspect of an embodiment of the present invention discloses an encrypted malicious traffic classification device based on byte frequency domain information, the device comprising:

[0069] a data acquisition module, a first processing module, a second processing module, and a third processing module;

[0070] The data acquisition module is used to acquire first data;

[0071] The first processing module is used to preprocess the first data to obtain second data;

[0072] The second processing module is used to extract and process the second data to obtain a second data feature information set;

[0073] The third processing module is used to process the second data feature information set using a traffic data classification model to obtain traffic data classification information.

[0074] A third aspect of an embodiment of the present invention discloses another encrypted malicious traffic classification device based on byte frequency domain information, the device comprising:

[0075] a memory storing executable program code;

[0076] a processor coupled to the memory;

[0077] The processor calls the executable program code stored in the memory to execute some or all of the steps in the encrypted malicious traffic classification method based on byte frequency domain information disclosed in the first aspect of the embodiment of the present invention.

[0078] The fourth aspect of the present invention discloses a computer-readable storage medium, which stores computer instructions. When the computer instructions are called, they execute some or all of the steps in the encrypted malicious traffic classification method based on byte frequency domain information disclosed in the first aspect of the embodiment of the present invention.

[0079] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0080] The present invention utilizes a traffic classification model based on one-dimensional CNN and important byte frequency domain information screening to achieve real-time identification and classification of encrypted malicious traffic in raw traffic data based on important byte frequency domain information screening, thereby improving the efficiency of encrypted malicious traffic identification and processing and the classification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0082] Figure 1 This is a schematic diagram of a scenario of a network security monitoring system provided by an embodiment of the present invention;

[0083] Figure 2 This is a flow chart of a method for classifying encrypted malicious traffic based on byte frequency domain information disclosed in an embodiment of the present invention;

[0084] Figure 3 This is a schematic diagram of the structure of an encrypted malicious traffic classification device based on byte frequency domain information disclosed in an embodiment of the present invention;

[0085] Figure 4 This is a structural diagram of another encrypted malicious traffic classification device based on byte frequency domain information disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0086] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0087] The terms "first," "second," and so on, in the description and claims of the present invention and the accompanying drawings are used to distinguish between different objects, not to describe a specific order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, apparatus, product, or device comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or device.

[0088] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0089] In this application, the word "exemplary" is used to mean "serving as an example, illustration, or illustration." Any embodiment described in this application as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments. The following description is given to enable any person skilled in the art to implement and use the present application. In the following description, details are listed for the purpose of explanation. It should be understood that one of ordinary skill in the art can recognize that the present application can be implemented without using these specific details. In other instances, well-known structures and processes are not elaborated in detail to avoid obscuring the description of the present application with unnecessary details. Therefore, the present application is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in this application.

[0090] It should be noted that since the method of the embodiment of the present application is executed in a computer device, the processing objects of each computer device exist in the form of data or information. For example, time is actually time information. It can be understood that if size, quantity, position, etc. are mentioned in subsequent embodiments, the corresponding data exist for the computer device to process. The details will not be repeated here.

[0091] It should be noted that the artificial intelligence related technologies that may be involved in this application are briefly described. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making.

[0092] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0093] Computer vision (CV) is the science of making machines "see." Specifically, it refers to machine vision, where cameras and computers replace the human eye in identifying and measuring objects, performing further image processing to create images more suitable for human observation or transmission to instrumentation. As a scientific discipline, computer vision studies related theories and technologies, aiming to build artificial intelligence systems capable of extracting information from images or multidimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, optical character recognition (OCR), video processing, video semantic understanding, video content / behavior recognition, three-dimensional object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping, and common biometric recognition technologies such as facial recognition and fingerprint recognition.

[0094] Unimodal information is data consisting of only one type, such as text, images, audio, video, or electromagnetic signals. Multimodal information is data that includes at least two types of unimodal information. Furthermore, multimodal information is suitable for complex tasks that require integrating multiple information sources, such as sentiment analysis, robot interaction, and autonomous driving. By integrating information from multiple modalities, higher performance and accuracy can often be achieved on the task.

[0095] A large model refers to an artificial neural network model with a very large number of parameters. In the field of artificial intelligence, a large model generally refers to a model with hundreds of millions to trillions of parameters. Models usually need to be trained on large-scale data sets and require a large amount of computing resources to be optimized and adjusted. Large models are generally used to solve complex tasks such as natural language processing, computer vision, and speech recognition. Generative AI is an AI that can create new content and ideas, including conversations, stories, images, videos, and music. In the embodiment of the present application, the large model can be a large-scale language model such as BERT, XLNet, Zhipu model, Claude, Moonshot AI model, ChatGLM model, Qianyi Tongwen model, MiniMax model, Spark model, Llama model, 360GPT model, Qwen model, Baichuan model, Skylark model, vivoLM model, and Wenxin Yiyan, which is not limited in the embodiment of the present application.

[0096] The embodiments of the present application provide a method, system, apparatus, computer device, and computer-readable storage medium for classifying encrypted malicious traffic based on byte frequency domain information, which are described in detail below.

[0097] See also Figure 1 , Figure 1 This is a schematic diagram of a network security monitoring system provided by an embodiment of the present application. The system may include a computer device 100, in which an encrypted malicious traffic classification device based on byte frequency domain information is integrated. Figure 1 Computer equipment in.

[0098] In the embodiments of the present application, the computer device 100 may be an independent server, or a server network or server cluster composed of servers. For example, the computer device 100 described in the embodiments of the present application includes, but is not limited to, a computer, a network host, a single network server, a set of multiple network servers, or a cloud server composed of multiple servers. A cloud server is composed of a large number of computers or network servers based on cloud computing.

[0099] It is understood that the computer device 100 used in the embodiments of the present application can be a device that includes both receiving and transmitting hardware, that is, a device that has receiving and transmitting hardware capable of performing two-way communication over a two-way communication link. Such a device may include: a cellular or other communication device that has a single-line display, a multi-line display, or a cellular or other communication device without a multi-line display. The specific computer device 100 can be a desktop terminal or a mobile terminal. The computer device 100 can also be a mobile phone, a tablet computer, a laptop computer, etc.

[0100] Those skilled in the art will understand that Figure 1 The application environment shown in the figure is only one application scenario of the present application solution and does not constitute a limitation on the application scenario of the present application solution. Other application environments may also include Figure 1 More or fewer computer devices as shown in Figure 1 Only one computer device is shown in the figure. It can be understood that the system can also include one or more other services, which are not limited here.

[0101] In addition, if Figure 1 As shown, the network security monitoring system may further include a memory 200 for storing recognition result data and sample data, such as simulation result data.

[0102] It should be noted that Figure 1 The scenario diagram of the network security monitoring system shown is only an example. The network security monitoring system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided by the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of the network security monitoring management system and the emergence of new business scenarios, the technical solution provided by the embodiment of the present application is also applicable to similar technical problems.

[0103] This invention discloses a method and device for classifying encrypted malicious traffic based on byte frequency domain information. This method utilizes a traffic classification model based on a one-dimensional CNN and filtering of important byte frequency domain information to achieve real-time identification and classification of encrypted malicious traffic in raw traffic data, thereby improving the efficiency of encrypted malicious traffic identification and classification accuracy. These are described in detail below.

[0104] Example 1

[0105] See also Figure 2 , Figure 2 This is a flow chart of a method for classifying encrypted malicious traffic based on byte frequency domain information disclosed in an embodiment of the present invention. Figure 2 The encrypted malicious traffic classification method based on byte frequency domain information is applied to a network security monitoring system, such as a local server or cloud server of a network security monitoring system, and is not limited in the embodiment of the present invention. Figure 1 As shown, the encrypted malicious traffic classification method based on byte frequency domain information may include the following operations:

[0106] S1, obtaining first data;

[0107] It should be noted that the first data, i.e., the original traffic data, refers to the CIC-IDS2017 dataset or the CSE-CIC-IDS2018 dataset, which is widely used for evaluating encrypted malicious traffic identification methods;

[0108] It should be noted that the CIC-IDS2017 dataset constructs an abstract network behavior model of 25 users, covering a variety of common network protocols such as HTTP, HTTPS, FTP, SSH, and email; it covers seven typical attack types: brute force, denial of service (DoS), distributed denial of service (DDoS), botnet, web attacks, port scans, and infiltration. The CIC-IDS2017 dataset includes raw pcap data and extracted feature csv data, with a total pcap data volume of 48.8GB.

[0109] It should be noted that the CSE-CIC-IDS2018 dataset is used to simulate real network traffic. It consists of two parts, B-Profile and M-Profile, and provides pcap data files and feature csv data files. The pcap data is as high as 444.5GB, and the collection time span is 10 days, which is the working time period of weekdays. B-Profile is responsible for describing the abstract behavior of user interaction and generating normal traffic. M-Profile is used to describe and execute attack scenarios and generate traffic with attack behavior. The attack types involved in CSE-CIC-IDS2018 are the same as those in CIC-IDS2017. The pcap data in the CSE-CIC-IDS2018 data is divided into 10 folders, corresponding to the 10-day collection time, in which the traffic data of each host constitutes a separate pcap file. Based on the specific time and attack path of the attack execution provided by the official website, combined with the characteristics of each type of attack, we extracted malicious traffic and saved them as pcap files respectively.

[0110] S2, preprocessing the first data to obtain second data;

[0111] It should be noted that the second data is the important byte data;

[0112] S3, extracting and processing the second data to obtain a second data feature information set;

[0113] S4. Process the second data feature information set using a traffic data classification model to obtain traffic data classification information.

[0114] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented, and the traffic classification model is used to realize real-time identification and classification of encrypted malicious traffic in the original traffic data, thereby improving the efficiency of encrypted malicious traffic identification and processing and the classification accuracy.

[0115] In an optional embodiment, in step S2 above, preprocessing the first data to obtain important byte data includes:

[0116] S21, encoding the first data to obtain a data packet byte data set;

[0117] The data packet byte data set includes a plurality of data packet byte data;

[0118] It should be noted that the encoding process means obtaining a target byte data set from the first data in units of bytes, and then performing ASC encoding on the target byte data set to obtain a target data packet byte data set;

[0119] It should be noted that the byte data including the MAC address and the IP address in the target data packet byte data set is removed to obtain the data packet byte data set;

[0120] S22, processing the data packet byte data set based on the error assessment model to obtain a first byte parameter information set;

[0121] The first byte parameter information set includes a plurality of first byte parameter information;

[0122] S23, performing a difference process on the first byte parameter information set to obtain a second byte parameter information set;

[0123] The second byte parameter information set includes a plurality of second byte parameter information;

[0124] S24, sorting the byte data of the data packet according to the size order of the second byte parameter information to obtain a data packet byte sorting data set;

[0125] The data packet byte sorting data set includes a plurality of data packet byte sorting data;

[0126] It should be noted that the second byte parameter information size represents the size of the second byte parameter value;

[0127] S25, filtering all the byte sorting data of the data packets based on the second byte parameter information to obtain second data;

[0128] It should be noted that the filtering process means filtering out bytes whose second byte parameter is less than or equal to 0;

[0129] It should be noted that the second data is the important byte data.

[0130] In another optional embodiment, in the above step S22, the expression of the error assessment model is:

[0131]

[0132] Where i represents the index of the data packet byte data; ER i Indicates the classification prediction error rate of the byte data of the i-th packet; FP i Indicates the number of samples misclassified as normal; FN i Indicates the number of samples misclassified as malicious; TP i Indicates the number of samples correctly classified as normal; TN i Indicates the number of samples correctly classified as malicious;

[0133] In another optional embodiment, in the above step S23, the difference processing expression is:

[0134] ER i '=ER i -ER;

[0135] Among them, ER i ' represents the importance parameter of the byte data of the i-th data packet; ER represents the classification prediction error rate benchmark value;

[0136] It should be noted that, in this embodiment, the classification prediction error rate benchmark value is set to: 0.1;

[0137] It should be noted that the second data, namely the important byte data, represents the data ranked in the top 5 by the importance parameter.

[0138] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented to pre-process the original traffic data, providing data support for subsequent data processing, thereby realizing real-time identification and classification of encrypted malicious traffic in the original traffic data, and improving the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0139] In another optional embodiment, in step S3 above, extracting and processing the second data to obtain a second data feature information set includes:

[0140] S31, performing splicing processing on the second data to obtain an important byte sequence set;

[0141] The important byte sequence set includes several important byte sequences;

[0142] It should be noted that the splicing process means splicing the second data in a front-to-back order;

[0143] S32, performing transformation processing on any of the important byte sequences to obtain second data feature information;

[0144] The transformation processing expression is:

[0145]

[0146] Among them, Q[k] represents the characteristic information of the kth important byte data; x n represents the second data; N represents the size of the second data; j is an imaginary unit; k represents the index of the important byte data;

[0147] It should be noted that the imaginary unit is an intermediate calculation variable;

[0148] S33, all the second data feature information are combined in order to obtain a second data feature information set;

[0149] The second data feature information set includes a plurality of second data feature information;

[0150] It should be noted that the sequential combination means combining in chronological order;

[0151] It should be noted that the second data feature information set is the important byte feature information set.

[0152] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented to extract the important byte data set to obtain an important byte feature information set, providing data support for subsequent data processing, thereby realizing real-time identification and classification of encrypted malicious traffic in the original traffic data, and improving the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0153] In another optional embodiment, in the above step S4, the traffic data classification model includes: a packet-level benchmark characterization module, an inter-packet feature extraction module and a data classification module;

[0154] The packet-level benchmark characterization module is configured to process the second data feature information set to obtain a first feature information set;

[0155] The inter-packet feature extraction module is configured to process the first feature information set to obtain a second feature information set;

[0156] The data classification module is used to process the second feature information set to obtain flow data classification information;

[0157] The packet-level benchmark characterization module, the inter-packet feature extraction module and the data classification module are sequentially data-connected.

[0158] It can be seen that by implementing the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention, the traffic classification model realizes real-time identification and classification of encrypted malicious traffic in the original traffic data, thereby improving the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0159] In another optional embodiment, the above-mentioned method of processing the second data feature information set using the traffic data classification model to obtain traffic data classification information includes:

[0160] S41, using the packet-level benchmark characterization module, processing the second data feature information set to obtain a first feature information set;

[0161] S42, using the inter-packet feature extraction module to process the first feature information set to obtain a second feature information set;

[0162] S43: Utilize the data classification module to process the second feature information set to obtain flow data classification information.

[0163] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented, and the traffic classification model is used to realize real-time identification and classification of encrypted malicious traffic of the important byte feature information set, thereby improving the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0164] In another optional embodiment, in the above step S41, the processing of the second data feature information set by the packet-level benchmark characterization module to obtain the first feature information set includes:

[0165] S4101, performing a first convolution process on the second data feature information set to obtain frequency domain feature information within a first packet;

[0166] It should be noted that the first convolution process uses one-dimensional convolution, with the input channel set to 2 and the output channel set to 32; the convolution kernel size is set to 3 and the step size is 1;

[0167] The convolution kernel is a small matrix used to perform convolution operations on the input traffic features. The step size is the amplitude of the convolution kernel movement during the operation.

[0168] Performing a second convolution process on the second data feature information set to obtain second intra-packet frequency domain feature information;

[0169] It should be noted that the second convolution process uses one-dimensional convolution, with the input channel set to 2 and the output channel set to 32; the convolution kernel size is set to 5 and the step size is 1;

[0170] S4102, performing a first function processing on the frequency domain feature information in the first packet to obtain frequency domain feature information in a third packet;

[0171] Performing a first function processing on the frequency domain feature information in the second packet to obtain frequency domain feature information in a fourth packet;

[0172] It should be noted that the first function adopts the BatchNorm function;

[0173] S4103, performing a second function processing on the frequency domain feature information in the third packet to obtain frequency domain feature information in a fifth packet;

[0174] Performing a second function processing on the frequency domain feature information in the fourth packet to obtain frequency domain feature information in a sixth packet;

[0175] It should be noted that the second function is the ReLU activation function;

[0176] The ReLU activation function expression is:

[0177] f(x)=max(0,W T x+B);

[0178] Wherein, W represents the slope; B represents the intercept; x represents the frequency domain feature information in the fourth packet;

[0179] S4104, performing pooling processing on the frequency domain feature information in the fifth packet to obtain frequency domain feature information in a seventh packet;

[0180] It should be noted that the pooling process uses the Maxpool pooling component;

[0181] It should be noted that the Maxpool pooling component divides the frequency domain feature information of the fifth packet input into multiple regions and samples the maximum value in each region, thereby achieving feature dimensionality reduction and extracting important features;

[0182] performing pooling processing on the frequency domain feature information in the sixth packet to obtain frequency domain feature information in an eighth packet;

[0183] It should be noted that the pooling process uses the Maxpool pooling component;

[0184] It should be noted that the pooling process uses the Maxpool pooling component; it should be noted that the Maxpool pooling component divides the frequency domain feature information of the input sixth packet into multiple regions, and samples the maximum value in each region, thereby achieving feature dimensionality reduction and extracting important features;

[0185] S4105, performing a third convolution process on the frequency domain feature information in the seventh packet to obtain frequency domain feature information in a ninth packet;

[0186] It should be noted that the third convolution process adopts one-dimensional convolution, with the input channel set to 2 and the output channel to 64; the convolution kernel size is set to 3 and the step size is 1;

[0187] performing a fourth convolution process on the frequency domain feature information in the eighth packet to obtain frequency domain feature information in a tenth packet;

[0188] It should be noted that the fourth convolution process adopts one-dimensional convolution, the input channel is set to 2, the output channel is 64; the convolution kernel size is set to 5, and the step size is 1;

[0189] S4106, performing a third function processing on the frequency domain feature information in the ninth packet to obtain frequency domain feature information in the eleventh packet;

[0190] Performing a third function processing on the frequency domain feature information in the tenth packet to obtain frequency domain feature information in the twelfth packet;

[0191] It should be noted that the third function adopts the BatchNorm function;

[0192] S4107, performing a fourth function processing on the frequency domain feature information in the eleven packets to obtain frequency domain feature information in the thirteenth packet;

[0193] Performing a fourth function processing on the frequency domain feature information in the twelfth packet to obtain frequency domain feature information in the fourteenth packet;

[0194] It should be noted that the fourth function is the same as the second function, which is a ReLU activation function;

[0195] S4108, performing pooling processing on the frequency domain feature information in the thirteenth packet to obtain frequency domain feature information in the fifteenth packet;

[0196] It should be noted that the pooling process uses the Maxpool pooling component; it should be noted that the Maxpool pooling component divides the input frequency domain feature information of the thirteenth packet into multiple regions, and samples the maximum value in each region, thereby achieving feature dimensionality reduction and extracting important features;

[0197] performing pooling processing on the frequency domain feature information in the fourteenth packet to obtain frequency domain feature information in the sixteenth packet;

[0198] It should be noted that the pooling process uses the Maxpool pooling component;

[0199] It should be noted that the pooling process uses the Maxpool pooling component; it should be noted that the Maxpool pooling component divides the frequency domain feature information of the input fourteenth packet into multiple regions, and samples the maximum value in each region, thereby achieving feature dimensionality reduction and extracting important features;

[0200] S4109: Concatenate and flatten the frequency domain feature information in the fifteenth packet and the frequency domain feature information in the sixteenth packet to obtain frequency domain feature information in the seventeenth packet.

[0201] It should be noted that the splicing refers to splicing according to the order of output data;

[0202] It should be noted that the flattening means flattening the data into one dimension;

[0203] S4110, performing a first linear processing on the frequency domain feature information in the seventeenth packet to obtain frequency domain feature information in the eighteenth packet;

[0204] It should be noted that the first linear processing expression is:

[0205] y=w*x+B

[0206] Wherein, y represents the linear processing output value; w represents the weight value; B represents the bias; x represents the frequency domain feature information in the seventeenth packet;

[0207] It should be noted that the value range of w and B is 0 to 1;

[0208] S4111, performing generalization processing on the frequency domain feature information in the eighteenth packet to obtain frequency domain feature information in the nineteenth packet;

[0209] It should be noted that the generalized processing expression is:

[0210] y=x⊙Bernoulli(p)

[0211] Wherein, y represents the frequency domain feature information in the nineteenth packet; ⊙ represents element-by-element multiplication, Bernoulli() represents Bernoulli distribution; p represents the probability of discarding an element; x represents the frequency domain feature information in the eighteenth packet;

[0212] In this embodiment, p = 0.6;

[0213] S4112, performing a second linear processing on the frequency domain feature information in the nineteenth packet to obtain frequency domain feature information in the twentieth packet;

[0214] It should be noted that the second linear processing is consistent with the first linear processing;

[0215] S4113, performing a fifth function processing on the frequency domain feature information in the 20th packet to obtain a first feature information set;

[0216] It should be noted that the fifth function is a Softmax activation function;

[0217] It should be noted that the Softmax activation function converts an unnormalized vector (usually the output of the model) into a probability distribution so that each value in the output is between 0 and 1 and the sum of all outputs is 1.

[0218] The Softmax activation function expression is:

[0219]

[0220] Among them, x i is the i-th element in the input vector; K represents the total number of categories; e represents the base of the natural logarithm;

[0221] It should be noted that the Softmax activation function converts the output value x of each category into i Convert to a positive value while keeping the relative proportions between categories unchanged, and normalize to ensure that the values ​​of all categories output add up to 1, indicating the probability of each category;

[0222] It should be noted that the first feature information set is an n×256 vector sequence, where n is the number of data packets.

[0223] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented, and the packet-level benchmark characterization module of the traffic classification model is used to perform convolution and mapping processing on the important byte feature information set to obtain the first feature information set, which lays the foundation for the subsequent real-time identification and classification of encrypted malicious traffic of the second data feature information set, and improves the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0224] In another optional embodiment, in the above step S42, the using the inter-packet feature extraction module to process the first feature information set to obtain the second feature information set includes:

[0225] S421, performing a fifth convolution process on the first feature information set to obtain first inter-packet feature information;

[0226] It should be noted that the fifth convolution process adopts one-dimensional convolution, the input channel is set to 2, the output channel is 32; the convolution kernel size is set to 3, and the step size is 1;

[0227] Performing a sixth convolution process on the second data feature information set to obtain second inter-packet feature information;

[0228] It should be noted that the sixth convolution process adopts one-dimensional convolution, the input channel is set to 2, the output channel is 32; the convolution kernel size is set to 5, and the step size is 1;

[0229] S422, performing a sixth function processing on the second private room characteristic information to obtain third private room characteristic information;

[0230] Performing a sixth function on the second private room characteristic information to obtain fourth private room characteristic information;

[0231] It should be noted that the sixth function adopts the BatchNorm function;

[0232] S423, performing a seventh function processing on the fourth private room characteristic information to obtain fifth private room characteristic information;

[0233] Performing a seventh function on the fourth private room characteristic information to obtain sixth private room characteristic information;

[0234] It should be noted that the seventh function is the same as the second function, which is a ReLU activation function;

[0235] S424, performing pooling processing on the fifth private room characteristic information to obtain seventh private room characteristic information;

[0236] It should be noted that the pooling process uses the Maxpool pooling component;

[0237] It should be noted that the Maxpool pooling component divides the input fifth packet feature information into multiple regions and samples the maximum value in each region, thereby achieving feature dimensionality reduction and extracting important features;

[0238] Performing pooling processing on the sixth private room characteristic information to obtain eighth private room characteristic information;

[0239] It should be noted that the pooling process uses the Maxpool pooling component;

[0240] It should be noted that the Maxpool pooling component divides the input sixth packet feature information into multiple regions and samples the maximum value in each region, thereby achieving feature dimensionality reduction and extracting important features;

[0241] S425, concatenating the seventh private room characteristic information and the eighth private room characteristic information to obtain a second characteristic information set;

[0242] It should be noted that the splicing refers to splicing according to the order of output data;

[0243] It should be noted that the second feature information set is the inter-packet timing feature;

[0244] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented, and the first feature information set is processed using the inter-packet feature extraction module of the traffic classification model to obtain the second feature information set, which lays the foundation for the subsequent real-time identification and classification of encrypted malicious traffic of the second data feature information set, and improves the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0245] In another optional embodiment, in the above step S43, the processing of the second feature information set by the data classification module to obtain traffic data classification information includes:

[0246] S431, performing pooling processing on the second feature information set to obtain first global feature information;

[0247] It should be noted that the seventh pooling process uses the Maxpool pooling component;

[0248] It should be noted that the Maxpool pooling component divides the input second feature information set into multiple regions and samples the maximum value in each region, thereby achieving feature dimensionality reduction and extracting important features;

[0249] S432, performing a seventh convolution process on the first global feature information to obtain second global feature information and weight vector information;

[0250] It should be noted that the weight vector information is used to represent the weight vector with the same number of input feature channels;

[0251] S433: Fusing the second feature information set, the second global feature information, and the weight vector information to obtain third global feature information;

[0252] It should be noted that the fusion processing means bit-wise multiplication of the second feature information set, the second global feature information and the weight vector information;

[0253] S434, normalizing the third global feature information to obtain traffic data classification information;

[0254] It should be noted that the normalization process uses the softmax function;

[0255] It should be noted that the softmax function expression is:

[0256] The Softmax activation function expression is:

[0257]

[0258] Among them, m i is the i-th element in the third global feature information; K represents the total number of categories; e represents the base of the natural logarithm;

[0259] It should be noted that the softmax function converts an unnormalized vector (usually the output of the model) into a probability distribution so that each value in the output is between 0 and 1 and the sum of all outputs is 1;

[0260] It should be noted that after normalization, the weight value of each channel is between 0 and 1;

[0261] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented, and the data classification module of the traffic classification model is used to process the second feature information set to obtain traffic data classification information, thereby improving the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0262] In another optional embodiment, the loss function expression of the traffic classification model is:

[0263]

[0264] Z=[z1,z2,…,z C ]T

[0265] Where Z represents the prediction results of all categories; y represents the yth sample data of the first data; β represents the hyperparameter; C represents the total number of categories of the first data; n y represents the number of samples of the first data; y Indicates the prediction result of the y-th sample data; z j Represents the prediction result of the jth category;

[0266] It should be noted that the value range of β is [0, 1);

[0267] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention is implemented, and the data classification module of the traffic classification model is used to process the second feature information set on the basis of obtaining the second feature information set to obtain traffic data classification information, thereby improving the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0268] It should be noted that this embodiment uses a packet-level classification model based on one-dimensional CNN and a classification model based on random forest as benchmark models, respectively, to test the byte importance on the CIC-IDS2017 and CSE-CIC-IDS2018 data sets. The maximum number of bytes extracted from each data packet is set to 200; for the common TCP / IP protocol suite, the Ethernet protocol header usually occupies 14 bytes, the TCP protocol header occupies 20 bytes, and the IPv4 protocol header occupies 20 bytes. Therefore, the total number of protocol header bytes is generally within 54 bytes. After removing the MAC address and IP address, 34 bytes remain; after byte importance calculation, we obtained the important bytes of 2 data sets. Among these bytes, the more important ones include: packet length, IP flag and fragment offset, lifetime, transport layer protocol, checksum, source port, destination port, TCP header length, TCP flag (including SYN, ACK, RST, FIN, PSH, URG and other flags), window size, TCP checksum. For the UDP protocol, the list of attacks involved is relatively small. We analyzed the traffic categories most significantly impacted by these important bytes, finding that they primarily pertain to DoSHulk, DoS GoldenEye, and DoS Slowloris attacks. Analyzing the raw pcap using Wireshark traffic analysis software revealed that these bytes correspond to optional fields in the TCP header, used to store TCP timestamps. Because these two datasets simulate attack traffic using attack tools in a controlled network environment, relying on timestamps for accurate classification may introduce artifacts.

[0269] It should be noted that the same number of important bytes are selected for data packets of different flows, and the important bytes of the same data packet are concatenated into an important byte row vector. Then, the important byte row vectors of all flows are constructed into a matrix, and each row of the matrix represents the important byte of a data packet of a flow. Fourier transform is performed on each row of the important byte matrix to obtain the corresponding frequency domain feature information.

[0270] It should be noted that the performance of the recognition and classification model was tested and analyzed without filtering important bytes. The first two hundred bytes of each data packet, excluding the MAC address and IP address, were extracted.

[0271] It should be noted that the flow-level malicious traffic classification results obtained in the CIC-IDS2017 dataset include precision, recall, and F1 score, and the overall accuracy, macro-average, and weighted average are calculated. The proposed method achieves excellent detection results for the 13 attacks included in the dataset, with precision and recall close to 1 for most attacks. Only the recall for the infiltration attack is slightly lower, reaching 92.31%. Analysis of the pcap files corresponding to the infiltration attack revealed that some flows do not represent successful attack traffic, but only contain TCP connection establishment SYN packets and RST reset packets. These flows are also assigned the Infiltration label, affecting the model's classification accuracy. Most datasets collect traffic by simulating the attack process using attack tools. However, configuration issues can easily lead to some attacks not being executed correctly, resulting in the collected attack traffic being mixed with traffic that does not conform to the attack behavior.

[0272] In the normalized confusion matrices constructed for CIC-IDS2017 flow-level and IP-pair-level malicious traffic classification, each attack category was correctly classified with a high probability, with the probability values ​​distributed along the diagonal with high values. Infiltration attacks, which were poorly identified, some samples were classified as benign traffic. At the IP-pair granularity, this attack was correctly classified. Infiltration attacks involve only a small number of flows, only 65. However, successful flows contain a large number of packets, so they are divided into more samples at the IP-pair granularity. Failed flows contain very few packets, so their impact at the IP-pair granularity is minimal. Detection accuracy for all categories remained high (over 99%), demonstrating the advantages of detecting malicious traffic at the IP-pair level, which can offset the shortcomings of flow-level detection.

[0273] The flow-level malicious traffic classification results obtained on the CSE-CIC-IDS2018 dataset show that the F1 scores for most attacks are above 99%, and nine attack types achieve an F1 score of 100%, demonstrating that the proposed method has excellent classification capabilities for the CSE-CIC-IDS2018 dataset. At the IP pair granularity, the proposed method achieves even better detection results, improving the classification accuracy for Brute Force-Web attacks from 98% to 100%.

[0274] It can be seen that the encrypted malicious traffic classification method based on byte frequency domain information described in the embodiment of the present invention utilizes a traffic classification model based on one-dimensional CNN and important byte frequency domain information screening, and realizes real-time identification and classification of encrypted malicious traffic in original traffic data based on important byte frequency domain information screening. Experiments have shown that the encrypted malicious traffic classification method based on byte frequency domain information can improve the processing efficiency by 3-4 times, and the encrypted malicious traffic classification accuracy can reach 99.9%, thereby improving the encrypted malicious traffic identification and processing efficiency and classification accuracy.

[0275] Example 2

[0276] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of an encrypted malicious traffic classification device based on byte frequency domain information disclosed in an embodiment of the present invention. Figure 3 The described device can be used in a network security monitoring system, such as a local server or a cloud server in a network security monitoring system, and the embodiments of the present invention do not limit this. Figure 3 As shown, the device may include:

[0277] Data acquisition module 101, first processing module 102, second processing module 103 and third processing module 104;

[0278] The data acquisition module 101 is used to acquire first data;

[0279] The first processing module 102 is configured to pre-process the first data to obtain second data;

[0280] The second processing module 103 is configured to extract and process the second data to obtain a second data feature information set;

[0281] The third processing module 104 is configured to process the second data feature information set using a traffic data classification model to obtain traffic data classification information.

[0282] Example 3

[0283] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of a method and device for classifying encrypted malicious traffic based on byte frequency domain information disclosed in an embodiment of the present invention. Figure 4 The described device can be applied to a network security monitoring system, such as a local server or a cloud server in a network security monitoring system, and the embodiments of the present invention do not limit this. Figure 4 As shown, the device may include:

[0284] A memory 202 storing executable program code;

[0285] a processor 201 coupled to a memory 202;

[0286] The processor 201 calls the executable program code stored in the memory 202 to execute the steps of the encrypted malicious traffic classification method based on byte frequency domain information described in the first embodiment.

[0287] Example 4

[0288] An embodiment of the present invention discloses a computer-readable storage medium that stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute the steps of the encrypted malicious traffic classification method based on byte frequency domain information described in Example 1.

[0289] Example 5

[0290] An embodiment of the present invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute the steps in the encrypted malicious traffic classification method based on byte frequency domain information described in Example 1.

[0291] The device embodiments described above are merely illustrative. Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0292] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus the necessary general hardware platform, or of course, by means of hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, the storage medium including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0293] Finally, it should be noted that the encrypted malicious traffic classification method, system and device based on byte frequency domain information disclosed in the embodiments of the present invention are only preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for classifying encrypted malicious traffic, characterized in that: The method comprises: S1, obtaining first data; S2, preprocessing the first data to obtain second data; S3, extracting and processing the second data to obtain a second data feature information set; S4, using a traffic data classification model, processing the second data feature information set to obtain traffic data classification information; The method of processing the second data feature information set using a traffic data classification model to obtain traffic data classification information includes: S41, using a packet-level benchmark characterization module of a traffic data classification model, performing convolution and mapping processing on the second data feature information set to obtain a first feature information set; S42, using an inter-packet feature extraction module of a traffic data classification model to process the first feature information set to obtain a second feature information set; S43, using a data classification module of a traffic data classification model to process the second feature information set to obtain traffic data classification information; The packet-level benchmark characterization module using the traffic data classification model performs convolution and mapping processing on the second data feature information set to obtain a first feature information set, including: S4101, performing a first convolution process on the second data feature information set to obtain frequency domain feature information within a first packet; The first convolution process uses one-dimensional convolution, with the input channel set to 2 and the output channel set to 32; the convolution kernel size is set to 3 and the step size is 1; Performing a second convolution process on the second data feature information set to obtain second intra-packet frequency domain feature information; The second convolution process uses one-dimensional convolution, with the input channel set to 2 and the output channel set to 32; the convolution kernel size is set to 5 and the step size is 1; S4102, performing a first function processing on the frequency domain feature information in the first packet to obtain frequency domain feature information in a third packet; Performing a first function processing on the frequency domain feature information in the second packet to obtain frequency domain feature information in a fourth packet; The first function adopts the BatchNorm function; S4103, performing a second function processing on the frequency domain feature information in the third packet to obtain frequency domain feature information in a fifth packet; Performing a second function processing on the frequency domain feature information in the fourth packet to obtain frequency domain feature information in a sixth packet; The second function is a ReLU activation function; The ReLU activation function expression is: f(x)=max(0,W T x+B); Wherein, W represents the slope; B represents the intercept; x represents the frequency domain feature information in the fourth packet; S4104, performing pooling processing on the frequency domain feature information in the fifth packet to obtain frequency domain feature information in a seventh packet; The pooling process uses the Maxpool pooling component; performing pooling processing on the frequency domain feature information in the sixth packet to obtain frequency domain feature information in an eighth packet; S4105, performing a third convolution process on the frequency domain feature information in the seventh packet to obtain frequency domain feature information in a ninth packet; The third convolution process uses one-dimensional convolution, with the input channel set to 2 and the output channel set to 64; the convolution kernel size is set to 3 and the step size is 1; performing a fourth convolution process on the frequency domain feature information in the eighth packet to obtain frequency domain feature information in a tenth packet; The fourth convolution process uses one-dimensional convolution, with the input channel set to 2 and the output channel set to 64; the convolution kernel size is set to 5 and the step size is 1; S4106, performing a third function processing on the frequency domain feature information in the ninth packet to obtain frequency domain feature information in the eleventh packet; Performing a third function processing on the frequency domain feature information in the tenth packet to obtain frequency domain feature information in the twelfth packet; The third function adopts the BatchNorm function; S4107, performing a fourth function processing on the frequency domain feature information in the eleven packets to obtain frequency domain feature information in the thirteenth packet; Performing a fourth function processing on the frequency domain feature information in the twelfth packet to obtain frequency domain feature information in the fourteenth packet; The fourth function is the same as the second function, which is a ReLU activation function; S4108, performing pooling processing on the frequency domain feature information in the thirteenth packet to obtain frequency domain feature information in the fifteenth packet; performing pooling processing on the frequency domain feature information in the fourteenth packet to obtain frequency domain feature information in the sixteenth packet; S4109: Concatenate and flatten the frequency domain feature information in the fifteenth packet and the frequency domain feature information in the sixteenth packet to obtain frequency domain feature information in the seventeenth packet. The splicing means splicing the data in the order of output; The flattening means flattening the data into one dimension; S4110, performing a first linear processing on the frequency domain feature information in the seventeenth packet to obtain frequency domain feature information in the eighteenth packet; The first linear processing expression is: y=w*x+b Wherein, y represents the linear processing output value; w represents the weight value; b represents the bias; x represents the frequency domain feature information in the seventeenth packet; S4111, performing generalization processing on the frequency domain feature information in the eighteenth packet to obtain frequency domain feature information in the nineteenth packet; The generalized processing expression is: y=x⊙Bernoulli(p) Wherein, y represents the frequency domain feature information in the nineteenth packet; ⊙ represents element-by-element multiplication, Bernoulli() represents Bernoulli distribution; p represents the probability of discarding an element; x represents the frequency domain feature information in the eighteenth packet; S4112, performing a second linear processing on the frequency domain feature information in the nineteenth packet to obtain frequency domain feature information in the twentieth packet; The second linear processing is consistent with the first linear processing; S4113, performing a fifth function processing on the frequency domain feature information in the 20th packet to obtain a first feature information set; The fifth function is a Softmax activation function; The Softmax activation function expression is: Among them, x i is the i-th element in the input vector; K represents the total number of categories; and e represents the base of the natural logarithm.

2. The encrypted malicious traffic classification method according to claim 1, characterized in that: The preprocessing of the first data to obtain important byte data includes: S21, encoding the first data to obtain a data packet byte data set; The data packet byte data set includes a plurality of data packet byte data; S22, processing the data packet byte data set based on the error assessment model to obtain a first byte parameter information set; The first byte parameter information set includes a plurality of first byte parameter information; S23, performing a difference process on the first byte parameter information set to obtain a second byte parameter information set; The second byte parameter information set includes a plurality of second byte parameter information; S24, sorting the byte data of the data packet according to the size order of the second byte parameter information to obtain a data packet byte sorting data set; The data packet byte sorting data set includes a plurality of data packet byte sorting data; S25: Based on the second byte parameter information, filter all the byte sorting data of the data packet to obtain second data.

3. The encrypted malicious traffic classification method according to claim 2, characterized in that: The expression of the error evaluation model is: Where i represents the index of the data packet byte data; ER i Indicates the classification prediction error rate of the byte data of the i-th packet; FP i Indicates the number of samples misclassified as normal; FN i Indicates the number of samples misclassified as malicious; TP i Indicates the number of samples correctly classified as normal; TN i Indicates the number of samples correctly classified as malicious; The difference processing expression is: IS i’ =IS i -IS; Among them, ER i’ It represents the importance parameter of the byte data of the i-th data packet; ER represents the classification prediction error rate benchmark value.

4. The encrypted malicious traffic classification method according to claim 1, characterized in that: The extracting and processing the second data to obtain a second data feature information set includes: S31, performing splicing processing on the second data to obtain an important byte sequence set; The important byte sequence set includes several important byte sequences; S32, performing transformation processing on any of the important byte sequences to obtain second data feature information; The transformation processing expression is: Among them, Q[k] represents the characteristic information of the kth important byte data; x n represents the second data; N represents the size of the second data; j is an imaginary unit; k represents the index of the important byte data; S33, all the second data feature information are combined in order to obtain a second data feature information set; The second data feature information set includes a plurality of second data feature information.

5. An encrypted malicious traffic classification device, characterized in that: The device comprises: a memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the encrypted malicious traffic classification method as described in any one of claims 1-4.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which, when called, are used to execute the encrypted malicious traffic classification method according to any one of claims 1 to 4.

Images