A method for classifying network traffic and related equipment

Abstract

This application discloses a network traffic classification method and related equipment, relating to the field of network information security technology. The method includes: acquiring the electromagnetic radiation signal and historical communication behavior sequence of a target network device; extracting a first frequency domain feature from the electromagnetic radiation signal; generating an electromagnetic fingerprint identifier for the target network device based on the first frequency domain feature; extracting a second temporal feature from the historical communication behavior sequence; jointly encoding the electromagnetic fingerprint identifier and the second temporal feature to generate a multi-dimensional classification feature vector; and generating the traffic type of the target network device based on the matching degree between the multi-dimensional classification feature vector and a preset traffic category template. This application improves the accuracy and anti-spoofing capability of traffic classification by fusing the hardware physical layer features of the target network device with the temporal features of the historical communication behavior sequence to construct a multi-dimensional classification model.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and in particular to a network traffic classification method and related equipment. Background Technology

[0002] Existing network traffic classification methods largely rely on protocol parsing, IP 5-tuples, or machine learning models to identify traffic characteristics. However, these methods have significant limitations: on the one hand, attackers can bypass detection by forging protocol headers and tampering with packet content, leading to low reliability of classification results; on the other hand, traditional technologies struggle to handle encrypted traffic or new attack patterns (such as adaptive malware), and their reliance on manually labeled data for model training makes them difficult to dynamically adapt to complex and ever-changing network environments. Therefore, a new network traffic classification method is urgently needed to address the aforementioned technical problems. Summary of the Invention

[0003] The summary section introduces a series of simplified concepts, which will be further explained in detail in the detailed description section. This summary section is not intended to limit the key and essential technical features of the claimed technical solutions, nor is it intended to determine the scope of protection of the claimed technical solutions.

[0004] Firstly, this application provides a method for classifying network traffic, the method comprising:

[0005] Acquire electromagnetic radiation signals and historical communication behavior sequences of the target network device;

[0006] Based on the electromagnetic radiation signal, the first frequency domain features are extracted from the electromagnetic radiation signal;

[0007] Generate an electromagnetic fingerprint identifier for the target network device based on the first frequency domain features;

[0008] Based on historical communication behavior sequences, extract the second temporal feature from the historical communication behavior sequences;

[0009] The electromagnetic fingerprint identifier is jointly encoded with the second temporal feature to generate a multi-dimensional classification feature vector.

[0010] Based on the matching degree between the multidimensional classification feature vector and the preset traffic category template, the traffic type of the target network device is generated.

[0011] In some implementations, based on the electromagnetic radiation signal, a first frequency domain feature is extracted from the electromagnetic radiation signal, including:

[0012] Wavelet packet decomposition is performed on the electromagnetic radiation signal to extract the energy distribution ratio within the preset frequency band;

[0013] The energy distribution ratio is nonlinearly reduced by a convolutional autoencoder to generate a first frequency domain feature that includes the inherent noise characteristics of the hardware circuit.

[0014] In some implementations, generating an electromagnetic fingerprint identifier for the target network device based on a first frequency domain feature includes:

[0015] Cluster analysis is performed on the first frequency domain features to generate a cluster center vector that uniquely corresponds to the hardware circuit of the target network device.

[0016] The cluster center vector is mapped to a preset electromagnetic fingerprint identifier library to generate an electromagnetic fingerprint identifier in digital code form, and the cluster center vector and the digital code are associated and stored; wherein, the preset electromagnetic fingerprint identifier library stores the mapping relationship between the digital code and the cluster center vector.

[0017] In some implementations, a second temporal feature is extracted from the historical communication behavior sequence, including:

[0018] Based on a preset time window, the system statistically analyzes the traffic burst intervals, data packet length distributions, and retransmission rates in historical communication behavior sequences to generate a time series of statistical behavior characteristics.

[0019] By extracting periodic patterns from time series data using a long short-term memory network, a second time-series feature representing the dynamic changes in traffic flow is obtained.

[0020] In some implementations, the electromagnetic fingerprint identifier is jointly encoded with a second temporal feature to generate a multi-dimensional classification feature vector, including:

[0021] Based on the electromagnetic fingerprint identifier, obtain the corresponding cluster center vector from the preset electromagnetic fingerprint identifier library;

[0022] The cluster center vectors are normalized to generate the first feature vector;

[0023] The second time-series feature is standardized to generate a second feature vector;

[0024] The first feature vector and the second feature vector are concatenated according to a preset dimension, and then the features are fused through a fully connected layer to generate a multidimensional classification feature vector.

[0025] In some implementations, the traffic type of the target network device is generated based on the matching degree between the multidimensional classification feature vector and the preset traffic category template, including:

[0026] Calculate the cosine similarity between the multidimensional classification feature vector and each of the preset multiple traffic category templates;

[0027] Templates with a cosine similarity higher than a first preset threshold are selected from multiple traffic category templates as candidate categories;

[0028] Based on the stability coefficient of the electromagnetic fingerprint identifier, the cosine similarity of each candidate category is weighted and corrected to obtain the corrected similarity of each candidate category.

[0029] The candidate category with the highest similarity score is determined as the traffic type of the target network device.

[0030] In some implementations, it also includes:

[0031] When the cosine similarity of all traffic category templates is lower than the first preset threshold,

[0032] The multidimensional classification feature vector is labeled as an unknown type, and a new traffic category template is generated based on the multidimensional classification feature vector;

[0033] Match and associate the new traffic category template with historical abnormal behavior patterns in the abnormal behavior database.

[0034] Secondly, this application proposes a network traffic classification device, the device comprising:

[0035] The device data acquisition unit is used to acquire the electromagnetic radiation signals and historical communication behavior sequences of the target network device.

[0036] The frequency domain feature extraction unit extracts the first frequency domain features from the electromagnetic radiation signal based on the electromagnetic radiation signal.

[0037] The fingerprint identification generation unit generates an electromagnetic fingerprint identification of the target network device based on the first frequency domain features;

[0038] The temporal feature extraction unit extracts the second temporal feature from the historical communication behavior sequence based on the historical communication behavior sequence;

[0039] The feature vector fusion unit is used to jointly encode the electromagnetic fingerprint identifier and the second temporal feature to generate a multi-dimensional classification feature vector;

[0040] The traffic type confirmation unit generates the traffic type of the target network device based on the matching degree between the multi-dimensional classification feature vector and the preset traffic category template.

[0041] Thirdly, an electronic device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program stored in the memory to implement the network traffic classification method of any of the first aspects.

[0042] Fourthly, this application proposes a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the network traffic classification method of any one of the first aspects.

[0043] In summary, this application constructs a multi-dimensional classification model by integrating the electromagnetic fingerprint (hardware physical layer feature) of the target network device with the temporal features of its historical communication behavior sequences, thereby improving the accuracy of traffic classification and its anti-spoofing capabilities. The electromagnetic fingerprint, generated based on the inherent characteristics of the hardware circuit, is unique and tamper-proof, effectively distinguishing counterfeit devices. The temporal features of the behavior dynamically reflect changes in traffic patterns, compensating for the shortcomings of static protocol analysis. The multi-dimensional feature vector generated after joint encoding of these two features can simultaneously capture device identity and behavioral intent, solving the problem of single feature dimensions in traditional methods. Furthermore, by dynamically matching traffic category templates and adaptively generating unknown type templates, it achieves rapid identification and anomaly correlation of new threats, enhancing the overall network security capabilities. Attached Figure Description

[0044] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit this specification. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0045] Figure 1 This is a schematic flowchart of a network traffic classification method provided in an embodiment of this application;

[0046] Figure 2 This application provides a schematic diagram of a network traffic classification structure.

[0047] Figure 3 This is a structural diagram of a network traffic classification electronic device provided in an embodiment of this application. Detailed Implementation

[0048] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus. The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them.

[0049] Please see Figure 1 This is a schematic flowchart of a network traffic classification method provided in an embodiment of this application, which may specifically include:

[0050] S110. Obtain the electromagnetic radiation signals and historical communication behavior sequences of the target network device;

[0051] For example, by synchronously acquiring the electromagnetic radiation signals and historical communication behavior sequences of the target network device, a multi-dimensional data foundation can be provided for subsequent traffic classification. The electromagnetic radiation signals originate from the physical layer electromagnetic waves generated by the device's hardware circuitry (such as the CPU and network interface card chip) during operation. Their spectral characteristics are closely related to the hardware structure and workload, making them unique to each device. These signals can be captured in real time by electromagnetic sensors (such as software-defined wireless devices), providing a physical layer basis for distinguishing counterfeit devices or identifying hardware tampering.

[0052] Historical communication behavior sequences record the network interaction patterns of devices within a preset time period, including statistical characteristics such as traffic burst intervals, packet length distribution, and retransmission rate. This type of data is obtained by capturing network traffic logs or using real-time monitoring tools, reflecting the dynamic communication intentions and behavioral patterns of the devices. The combination of these two elements constructs a dual verification framework of "hardware identity" and "behavioral patterns," laying a data foundation for subsequent feature fusion and classification decisions.

[0053] S120. Based on the electromagnetic radiation signal, extract the first frequency domain features from the electromagnetic radiation signal;

[0054] For example, frequency domain analysis techniques are used to extract first frequency domain features from electromagnetic radiation signals, aiming to capture the inherent characteristics of the target network device's hardware circuitry. The frequency domain features of electromagnetic radiation signals reflect the differences in energy distribution across different frequency components during device operation. For instance, high-frequency bands may correspond to electromagnetic leakage during high-speed chip computation, while low-frequency bands may be related to power supply ripple. These features are strongly correlated with the hardware circuitry's design parameters, manufacturing process, and operating status, exhibiting significant device uniqueness and providing a physical layer basis for subsequent generation of electromagnetic fingerprint identifiers.

[0055] To achieve feature extraction, this step employs frequency band segmentation and nonlinear dimensionality reduction strategies. First, frequency band segmentation is used to extract the energy distribution ratio within a preset frequency band, separating the core frequency domain components associated with the hardware circuitry. Then, nonlinear dimensionality reduction is used to filter out environmental noise interference, preserving the inherent noise characteristics of the hardware, ultimately generating a low-dimensional and robust first frequency domain feature. This process transforms the original electromagnetic signal into a key feature vector that can characterize the hardware, laying the foundation for subsequent multi-dimensional classification.

[0056] S130. Generate an electromagnetic fingerprint identifier for the target network device based on the first frequency domain features;

[0057] For example, generating an electromagnetic fingerprint identifier for a target network device through first frequency domain features is essentially about transforming the physical layer characteristics of the hardware circuit into a unique and tamper-proof device identity. The electromagnetic fingerprint identifier is based on the frequency domain characteristics of the electromagnetic radiation signals generated during device operation, such as the energy distribution and noise patterns in specific frequency bands. These characteristics are determined by the physical structure of the hardware circuit (such as chip layout and circuit impedance) and differences in manufacturing processes, possessing device-level uniqueness. This effectively distinguishes different models or individual devices, preventing spoofing attacks.

[0058] This step transforms the first frequency domain features into a standardized digital encoding sequence through feature mapping and identifier processing. Specifically, the extracted features are matched or registered using a pre-defined electromagnetic fingerprint identifier library to generate a unique identifier strongly bound to the target device hardware. This process ensures the stability and reusability of the electromagnetic fingerprint identifier, providing a reliable basis for the joint verification of device identity and behavior patterns in subsequent traffic classification.

[0059] S140. Based on the historical communication behavior sequence, extract the second temporal feature from the historical communication behavior sequence;

[0060] For example, by analyzing the historical communication behavior sequences of a target network device, a second temporal feature characterizing its dynamic traffic patterns can be extracted. The historical communication behavior sequences record the device's network interaction patterns within a preset time period, including statistical parameters such as traffic burst intervals, packet length distribution, and retransmission rate. These parameters reflect the device's communication intentions and behavioral preferences in different scenarios, providing a data foundation for capturing its dynamic behavior patterns.

[0061] This step employs temporal modeling techniques to extract high-order temporal patterns from the original behavioral sequences. Through time window segmentation and pattern mining, it identifies the periodicity, suddenness, or abnormal fluctuation characteristics of traffic behavior. These temporal features can dynamically characterize changes in the communication state of devices (such as the difference in behavior between normal operation and under attack), compensating for the shortcomings of static protocol analysis and providing key dimensions reflecting behavioral intent for subsequent multi-dimensional feature fusion.

[0062] S150. Jointly encode the electromagnetic fingerprint identifier and the second temporal feature to generate a multi-dimensional classification feature vector;

[0063] For example, electromagnetic fingerprint identifiers and second temporal features are fused through joint encoding to generate a multi-dimensional classification feature vector. The electromagnetic fingerprint identifier obtains the corresponding cluster center vector through a preset database mapping, representing the hardware uniqueness of the device; the second temporal feature reflects the dynamic communication behavior patterns of the device. The combination of the two constructs a dual verification mechanism of "hardware identity authentication" and "behavioral intent recognition," breaking through the single-dimensional limitations of traditional traffic classification and providing multi-dimensional support for encrypted traffic identification and protocol spoofing attack defense.

[0064] A feature standardization and cross-dimensional fusion strategy is adopted. Normalization of cluster center vectors eliminates differences in hardware feature dimensions, while standardization of time-series features ensures the comparability of behavioral data. Furthermore, by concatenating preset dimensions and fusing with a fully connected layer, the correlation between hardware identity and behavioral patterns is mined, generating a highly discriminative fused feature vector. This strategy enhances the complementarity of features; even if a single feature is tampered with, the joint features still guarantee classification reliability, significantly improving the system's anti-spoofing capability and adaptive level.

[0065] S160. Based on the matching degree between the multidimensional classification feature vector and the preset traffic category template, generate the traffic type of the target network device.

[0066] For example, the traffic type of a target network device is determined by matching a multidimensional classification feature vector with a preset traffic category template. The multidimensional classification feature vector integrates the device's electromagnetic fingerprint and second-order temporal features. By calculating its similarity to the preset template, the most matching candidate category is selected. This process combines the immutable features of the physical layer with the dynamic laws of the behavioral layer, effectively improving the accuracy and anti-spoofing capability of traffic classification, especially in scenarios involving encrypted traffic or protocol spoofing.

[0067] This step uses a dynamic matching mechanism to determine the final traffic type. Preset traffic category templates cover known traffic types (such as video streams, IoT data, and malicious attacks). High-confidence candidate categories are selected through multi-dimensional feature similarity comparison. Simultaneously, a stability coefficient is introduced for weighted correction to ensure the long-term reliability of the electromagnetic fingerprint. If the matching degree is insufficient, an unknown type processing mechanism is triggered, dynamically generating a new template and associating it with abnormal behavior to achieve adaptive classification and threat warning capabilities.

[0068] In summary, this application's embodiments construct a classification model with multi-dimensional discriminative capabilities by integrating the electromagnetic fingerprint identifier of the target network device with the temporal characteristics of historical communication behavior sequences, thereby improving the accuracy, anti-spoofing ability, and dynamic adaptability of network traffic classification. First, the electromagnetic fingerprint identifier is generated based on the inherent noise characteristics of the hardware circuit, possessing device-level uniqueness and immutability, effectively distinguishing counterfeit devices or identifying hardware tampering, thus solving the problem of easy forgery using traditional methods relying on protocol parsing or IP 5-tuples. Second, the temporal characteristics extracted through the Long Short-Term Memory network can dynamically capture the periodicity, burstiness, and abnormal fluctuation patterns of traffic behavior, compensating for the shortcomings of static protocol analysis in adapting to dynamic network environments. The multi-dimensional classification feature vector formed by the joint encoding of these two methods simultaneously includes both hardware identity and behavioral intent dimensions, enhancing the discriminative power of the feature space and maintaining high classification accuracy even in encrypted traffic, protocol spoofing, or novel attack scenarios. Furthermore, the classification strategy based on cosine similarity matching and stability coefficient weighted correction, combined with a dynamic generation mechanism for unknown type templates, not only achieves accurate identification of known traffic types but also quickly discovers and associates abnormal behavior patterns, improving the system's adaptability and threat warning efficiency. Finally, this method does not rely on manually labeled data; it achieves automatic dimensionality reduction and label mapping of features through autoencoders and cluster analysis, reducing model training complexity and making it suitable for real-time traffic classification and security protection in large-scale heterogeneous network environments.

[0069] In some instances, based on electromagnetic radiation signals, the first frequency domain features are extracted from the electromagnetic radiation signals, including:

[0070] Wavelet packet decomposition is performed on the electromagnetic radiation signal to extract the energy distribution ratio within the preset frequency band;

[0071] The energy distribution ratio is nonlinearly reduced by a convolutional autoencoder to generate a first frequency domain feature that includes the inherent noise characteristics of the hardware circuit.

[0072] For example, firstly, wavelet packet decomposition is performed on the electromagnetic radiation signal generated by the target network device during operation. Compared to traditional wavelet transform, wavelet packet decomposition has the advantage of being able to perform more refined multi-scale frequency band division of the signal. Wavelet packet decomposition recursively decomposes the signal into low-frequency and high-frequency components, and further subdivides it at each level, forming a complete binary tree structure. This multi-resolution characteristic allows wavelet packet decomposition to capture the detailed features of different frequency components in the signal, and is particularly suitable for the analysis of non-stationary signals (such as electromagnetic radiation signals). For example, when analyzing the electromagnetic radiation of a chip, high-frequency components may reflect the rapid switching of clock signals, while low-frequency components may correspond to the periodic fluctuations of the power supply module. By selecting an appropriate number of decomposition levels, the signal can be divided into fine frequency bands, providing high-resolution frequency domain information for subsequent feature extraction.

[0073] Frequency band selection must be closely integrated with the hardware circuit characteristics of the target device. For example, the CPU of a certain network device has a main frequency of 2.4 GHz, and its electromagnetic radiation signal in the 2.4 GHz to 5 GHz frequency band may contain clock leakage energy; while the operating frequency of the power management module is usually in the range of tens to hundreds of kHz, corresponding to the energy distribution in the low-frequency band. By analyzing the hardware parameters of the target device in advance, the frequency band range of concern can be determined. In actual operation, the frequency band division can be optimized by combining experimental measurement data: electromagnetic signal acquisition is carried out on multiple devices, and the energy concentration area is observed by a spectrum analyzer. Finally, 2.4-5 GHz is selected as the core frequency band to ensure coverage of the main radiation sources of the hardware circuit.

[0074] The energy distribution ratio of each frequency band is obtained through integration. Specifically, the energy of each sub-band signal after decomposition is integrated to calculate its percentage of the total signal energy. This calculation process can be implemented using digital signal processing algorithms. By quantifying the energy proportion of each frequency band, a feature vector characterizing the hardware properties is formed. For example, a high energy proportion in the high-frequency band may reflect electromagnetic leakage during high-speed operation of the chip, while concentrated energy in the low-frequency band may correspond to periodic noise in the power supply circuit.

[0075] The frequency band energy distribution ratio extracted in this step provides the raw input data for the subsequent nonlinear dimensionality reduction of the convolutional autoencoder. This data not only contains inherent characteristics of the hardware circuitry but also implicit information about the device's operating status. Fine-grained frequency band division through wavelet packet decomposition effectively separates environmental noise from the target signal, ensuring that the subsequent dimensionality reduction process focuses on key physical characteristics. For example, if the energy proportion of a device's 3.0GHz frequency band remains stable under different workloads, it indicates that it can serve as a core feature for uniquely identifying the hardware, while frequency bands with larger fluctuations may be filtered out by the autoencoder, thereby improving the robustness of the feature.

[0076] The extracted frequency band energy distribution data (e.g., a 256-dimensional vector) contains a mixture of information from the inherent characteristics of the hardware circuitry and environmental noise. To improve feature discrimination, nonlinear dimensionality reduction techniques are needed to compress the data dimensions while retaining core information. Therefore, a convolutional autoencoder (CAE) is used for nonlinear dimensionality reduction. This technique automatically captures local correlations between frequency bands through end-to-end learning, suppressing environmental noise (such as Gaussian white noise and multipath interference) while compressing the data dimensions, generating a low-dimensional vector that includes the inherent noise features of the hardware circuitry.

[0077] The convolutional autoencoder consists of an encoder and a decoder, achieving data dimensionality reduction and reconstruction through hierarchical feature learning. The encoder includes convolutional and pooling layers. The convolutional layers use 3×1 convolutional kernels to slide and scan the frequency band energy sequence, extracting correlation features between local frequency bands (such as energy coupling patterns between adjacent 0.2GHz sub-bands). The pooling layers progressively compress the feature dimension through a 2×1 window, ultimately generating a 32-dimensional low-dimensional feature vector. The decoder reconstructs the original frequency band energy distribution through deconvolution and upsampling operations, ensuring that the low-dimensional features retain key hardware characteristics. This structure can effectively capture inherent hardware noise patterns such as crystal oscillator phase jitter and power supply ripple frequency, while filtering out random interference.

[0078] Model training aims to minimize the mean squared error (MSE) by optimizing network parameters through backpropagation. During training, the encoder learns to separate environmental noise from hardware features: for random noise, the encoder reduces its weights during compression; for stable hardware features, the encoder strengthens their feature representation. The decoder verifies the integrity of low-dimensional features through reconstruction, ensuring that the energy distribution of key frequency bands (such as CPU clock speed-related bands) can be accurately recovered.

[0079] The trained encoder converts the 256-dimensional frequency band energy distribution data into a 32-dimensional low-dimensional feature vector. For example, if the input data contains the energy proportions of 10 preset frequency bands, after convolution and pooling operations, the output contains low-dimensional features that include hardware characteristics such as power supply ripple frequency offset and clock signal phase noise, which is the first frequency domain feature.

[0080] In some instances, the electromagnetic fingerprint identifier of the target network device is generated based on the first frequency domain features, including:

[0081] Cluster analysis is performed on the first frequency domain features to generate a cluster center vector that uniquely corresponds to the hardware circuit of the target network device.

[0082] The cluster center vector is mapped to a preset electromagnetic fingerprint identifier library to generate an electromagnetic fingerprint identifier in digital code form, and the cluster center vector and the digital code are associated and stored; wherein, the preset electromagnetic fingerprint identifier library stores the mapping relationship between the digital code and the cluster center vector.

[0083] For example, cluster analysis is performed on the first frequency domain features to identify the inherent patterns of the target network device's hardware circuitry using an unsupervised learning algorithm. Specifically, the K-means clustering algorithm is used to group multiple sets of first frequency domain features, generating cluster center vectors that uniquely correspond to the target device's hardware circuitry. During the clustering process, the algorithm iteratively optimizes the centroid positions, ensuring that similar features (such as multiple measurement data from the same device) are tightly clustered in the feature space, while dissimilar features (such as measurement data from different devices) are significantly separated. For instance, after cluster analysis of the feature datasets of 10 devices of the same model, the feature vectors of each device are distributed around independent centroids, and the inter-cluster distance is greater than three times the intra-cluster distance, verifying the ability of the cluster center vectors to represent the uniqueness of the hardware.

[0084] After cluster analysis, the distance between the target device's first frequency domain feature and the centroid of its cluster is used as the criterion to generate a cluster center vector. This vector is obtained by calculating the average or weighted average of features of the same type, ensuring that it can represent the stable physical characteristics of the device's hardware circuitry. For example, the cluster center vector of a device may include parameters such as the mean power supply ripple frequency and the variance of clock signal phase noise. To improve the compatibility of subsequent mappings, the cluster center vector is standardized to eliminate dimensional differences and conform to the input format of the preset electromagnetic fingerprint identification library.

[0085] The cluster center vectors are mapped to a pre-defined electromagnetic fingerprint identifier library to generate a digitally encoded electromagnetic fingerprint identifier, and an association is established between the digital code and the cluster center vector. The pre-defined electromagnetic fingerprint identifier library stores the digital codes of all known devices and their corresponding cluster center vectors. During the mapping process, the Euclidean distance between the cluster center vector of the target device and the existing vectors in the library is calculated. If the minimum distance is lower than a pre-defined threshold, the matching code is used as the electromagnetic fingerprint identifier; if no match is found, a new unique digital code is generated for the device, and the code is stored in association with the vector.

[0086] Electromagnetic fingerprint identifiers are presented as digital encoded sequences, with encoding rules using binary or hexadecimal formats to ensure storability and transmission efficiency. For example, the code "0x3A7F" maps to the cluster center vector of a device, representing the joint characteristics of its power supply ripple frequency and clock noise. The digital code is protected by a hash function or encryption algorithm to prevent tampering or forgery. During traffic classification, the corresponding cluster center vector is retrieved from the database using the digital code and used for joint encoding with a second temporal feature to achieve dual verification of device identity and behavioral intent. For example, when abnormal traffic is detected from a device corresponding to the code "0x3A7F," potential threats can be quickly determined based on the fusion result of its cluster center vector and behavioral features.

[0087] In some instances, based on historical communication behavior sequences, second temporal features are extracted from the historical communication behavior sequences, including:

[0088] Based on a preset time window, the system statistically analyzes the traffic burst intervals, data packet length distributions, and retransmission rates in historical communication behavior sequences to generate a time series of statistical behavior characteristics.

[0089] By extracting periodic patterns from time series data using a long short-term memory network, a second time-series feature representing the dynamic changes in traffic flow is obtained.

[0090] For example, historical communication behavior sequences are statistically analyzed according to preset time windows to generate a time series of statistical behavioral characteristics. This step employs a sliding window mechanism to extract multi-dimensional features from the traffic data. Specifically, a fixed duration (e.g., 5 minutes) is used as the window, sliding across the historical communication behavior sequence to statistically analyze the traffic burst interval, packet length distribution, and retransmission rate within each window. The traffic burst interval reflects the drastic changes in network traffic within a short period, obtained by calculating the time difference between adjacent burst traffic events; the packet length distribution describes the frequency of packet occurrences of different lengths in the network, determined by statistically analyzing the probability distribution of packet lengths; the retransmission rate reflects the reliability of network communication, obtained by calculating the ratio of retransmitted packets to the total number of sent packets. The statistical results within each window are arranged chronologically to form a time series containing multiple feature dimensions, which records the behavioral characteristics of network traffic at different points in time.

[0091] The time series generation process for statistical behavioral features needs to consider the stationarity and representativeness of the data. To ensure data stationarity, outliers are handled during the statistical process, for example, by using a method based on quartile intervals to identify and remove outliers. Specifically, traffic burst intervals, packet length distributions, and retransmission rates are integrated into vector form and arranged in chronological order. The statistical vectors of continuous time windows constitute the time series of statistical behavioral features, providing structured input for subsequent time series modeling.

[0092] Long Short-Term Memory (LSTM) networks are used to extract periodic patterns from generated time series data to obtain a second temporal feature representing the dynamic changes in traffic. LSTM is a special type of recurrent neural network that can effectively handle long-term dependencies in sequence data. Using time series data with statistical behavioral characteristics as input, the LSTM network automatically learns the periodic change patterns of network traffic through its internal memory units and gating mechanisms. Specifically, during training, the LSTM network adjusts its parameters based on the input time series, enabling it to accurately predict future traffic behavior. By analyzing the trained LSTM network, the final hidden state or sequence output is extracted and mapped through a fully connected layer to generate the second temporal feature representing the dynamic changes in traffic. This feature is a low-dimensional vector (e.g., 64-dimensional) containing abstract pattern information about device communication behavior. For example, the characteristics of video streaming devices may exhibit "high burstiness and low retransmission rate," while malicious traffic presents a pattern of "irregular burst intervals and high retransmission rate." When these features are jointly encoded with electromagnetic fingerprint identifiers, they can simultaneously represent hardware identity and behavioral intent, providing multi-dimensional discrimination criteria for traffic classification.

[0093] In some instances, the electromagnetic fingerprint identifier is jointly encoded with a second temporal feature to generate a multidimensional classification feature vector, including:

[0094] Based on the electromagnetic fingerprint identifier, obtain the corresponding cluster center vector from the preset electromagnetic fingerprint identifier library;

[0095] The cluster center vectors are normalized to generate the first feature vector;

[0096] The second time-series feature is standardized to generate a second feature vector;

[0097] The first feature vector and the second feature vector are concatenated according to a preset dimension, and then the features are fused through a fully connected layer to generate a multidimensional classification feature vector.

[0098] For example, based on the electromagnetic fingerprint identifier, the corresponding cluster center vector is obtained from a preset electromagnetic fingerprint identifier library. The electromagnetic fingerprint identifier is in digital encoding form. By querying the mapping relationship between the encoding and cluster center vectors stored in the identifier library, the cluster center vector corresponding to the target device is extracted. For example, the encoding maps to vectors 0.85, 0.12, ..., 0.43, which represent the physical characteristics of the device's hardware circuitry. This step, through an encoding retrieval mechanism, ensures the traceability and uniqueness of hardware features, providing a physical layer data foundation for subsequent feature fusion.

[0099] The cluster center vectors are normalized to generate the first feature vector. Normalization uses a minimum-maximum scaling method, linearly mapping the values ​​of each dimension of the vector to the [0,1] interval, eliminating dimensional differences in hardware feature parameters. For example, noise is normalized to a dimensionless value. This process ensures the consistency of scale across different hardware features, avoiding bias in fusion weights due to differences in parameter dimensions.

[0100] The second temporal feature is standardized to generate a second feature vector. Standardization uses the Z-score method, adjusting the mean of the temporal feature to 0 and the variance to 1. For example, the original mean of the traffic burst interval is 1.2 seconds and the standard deviation is 0.3 seconds; after standardization, the numerical distribution is centered around zero, and the fluctuation range is controllable. This operation eliminates the distributional bias of behavioral features, improves model training efficiency and generalization ability, and ensures compatibility between temporal dynamics and hardware features.

[0101] The normalized first feature vector and the standardized second feature vector are concatenated according to a preset dimension to form an initial fusion vector, which is then fused nonlinearly through a fully connected layer. The preset dimension is set according to the dimensions of hardware and behavioral features. For example, the first feature vector is 32-dimensional to represent hardware characteristics, and the second feature vector is 64-dimensional to represent behavioral patterns. After concatenation, a 96-dimensional fusion vector is generated. The fully connected layer gradually compresses the dimension and extracts cross-modal correlation features through nonlinear transformations of the weight matrix and activation function (such as ReLU), ultimately generating a 32-dimensional multi-dimensional classification feature vector with high discriminative power. This process strengthens the complementarity between hardware identity and behavioral intent. Even if a single feature is tampered with, the fusion feature can still ensure classification reliability, providing high-precision input for traffic type determination.

[0102] In some instances, the traffic type of the target network device is generated based on the matching degree between the multidimensional classification feature vector and the preset traffic category template, including:

[0103] Calculate the cosine similarity between the multidimensional classification feature vector and each of the preset multiple traffic category templates;

[0104] Templates with a cosine similarity higher than a first preset threshold are selected from multiple traffic category templates as candidate categories;

[0105] Based on the stability coefficient of the electromagnetic fingerprint identifier, the cosine similarity of each candidate category is weighted and corrected to obtain the corrected similarity of each candidate category.

[0106] The candidate category with the highest similarity score is determined as the traffic type of the target network device.

[0107] For example, to generate traffic types based on the matching degree between multidimensional classification feature vectors and preset traffic category templates, the cosine similarity between the feature vectors and each template must first be calculated. The preset traffic category templates are a pre-established database containing feature vectors of known traffic types (such as video streams, IoT data, and malicious attacks). The cosine similarity is calculated by the ratio of the vector dot product to the magnitude; the formula for cosine similarity is:

[0108]

[0109] in, For multidimensional classification feature vectors, This is a feature vector for a specific traffic category template. By iterating through all templates, a corresponding similarity list is generated. For example, the similarity for the video stream template is 0.92, for the IoT data template it's 0.75, and for the malicious attack template it's 0.35.

[0110] Templates with a cosine similarity higher than a first preset threshold are selected from all traffic category templates as candidate categories. The preset threshold is determined based on experimental data and practical application requirements to balance classification accuracy and false positive rate. If the similarity of a template exceeds this threshold, it is considered a potential match. For example, the video stream template (0.92) and the IoT data template (0.75) meet the threshold condition, while the malicious attack template (0.35) is excluded. The selected candidate categories constitute a high-confidence candidate set, providing input for subsequent corrections. This step quickly eliminates traffic type templates that differ significantly from the target device's traffic characteristics, narrowing the scope of subsequent judgments and improving classification efficiency. It also ensures that the candidate categories have a certain degree of similarity to the target device's traffic characteristics, providing initial assurance for accurate classification.

[0111] Based on the stability coefficient of the electromagnetic fingerprint identifier, the cosine similarity of each candidate category is weighted and corrected to obtain the corrected similarity of each candidate category. The stability coefficient of the electromagnetic fingerprint identifier is an indicator that measures the stability of the electromagnetic fingerprint under different times and environments, reflecting the reliability of the hardware characteristics of the device represented by the electromagnetic fingerprint. The higher the stability coefficient, the more stable the electromagnetic fingerprint, and the greater its weight in traffic classification. When weighting and correcting the cosine similarity of the candidate categories, the cosine similarity of each candidate category is multiplied by the stability coefficient of its corresponding electromagnetic fingerprint identifier to obtain the corrected similarity. The stability coefficient ranges from 0 to 1. For example, if the stability coefficient of a device is 0.9, the original similarity of the video stream template is 0.92, and the corrected similarity is 0.828; if the original similarity of the IoT data template is 0.75, the corrected similarity is 0.675. This step reduces the risk of misjudgment caused by short-term fluctuations in electromagnetic fingerprints and improves long-term classification reliability by introducing hardware feature stability.

[0112] The candidate category with the highest corrected similarity is determined as the traffic type of the target network device. For example, if the corrected similarity of a video stream template is 0.828 and that of an IoT data template is 0.675, the traffic type is determined to be a video stream. If multiple candidate categories have the same corrected similarity, the category with the higher preset priority is selected (e.g., malicious attack categories have higher priority than normal traffic). The final classification result is output through the device interface or network protocol, triggering corresponding security policies or routing optimization operations to achieve accurate traffic management and threat interception.

[0113] In some instances, it also includes:

[0114] When the cosine similarity of all traffic category templates is lower than the first preset threshold,

[0115] The multidimensional classification feature vector is labeled as an unknown type, and a new traffic category template is generated based on the multidimensional classification feature vector;

[0116] Match and associate the new traffic category template with historical abnormal behavior patterns in the abnormal behavior database.

[0117] For example, when the cosine similarity of all traffic category templates is detected to be lower than a first preset threshold, the multidimensional classification feature vector is marked as an unknown type. The first preset threshold is used to measure the similarity between the multidimensional classification feature vector and known traffic category templates. If it is lower than this threshold, it indicates that the traffic characteristics represented by the current multidimensional classification feature vector differ significantly from the known traffic categories and cannot be matched with any existing traffic category template. At this time, it is marked as an unknown type. This is a preliminary identification of abnormal traffic, providing an identifier for further analysis and processing, and facilitating the system to concentrate resources on in-depth research on this type of special traffic to determine its potential threats or characteristics.

[0118] Based on multidimensional classification feature vectors labeled as unknown types, the system initiates a dynamic generation process for new traffic category templates. First, the unsupervised clustering algorithm DBSCAN is used to group the unknown feature vectors in the temporary feature library to identify potential new traffic patterns. The center vector of each cluster is calculated and used as the feature representation of the new template, and a unique category identifier is assigned. Subsequently, the new template is added to a preset traffic category template library, and its generation time, associated device, and initial matching rules are recorded. For example, a new template reflecting traffic behavior with an unknown encryption protocol is identified as "Encrypted Traffic_New". This process, through an automated template expansion mechanism, overcomes the limitations of traditional classification methods that rely on fixed templates, improving the system's adaptability to new traffic patterns.

[0119] The generated new traffic category templates need to be matched and associated with historical abnormal patterns in the abnormal behavior database to assess their potential threat. During the matching process, the cosine similarity between the feature vector of the new template and all abnormal features in the abnormal database is calculated, and entries with similarity higher than a second preset threshold are selected. If a match is successful, the new template is associated with the threat level and feature description of the corresponding abnormal behavior. For example, if a new template has a similarity of 0.85 with the "DDoS attack pattern" in the database, it is marked as a "potential DDoS variant" and a predefined security response strategy (such as traffic limiting or session blocking) is triggered. This step, through a real-time association mechanism, quickly maps unknown traffic to the historical attack knowledge base, shortens threat response time, and enhances the system's ability to defend against unknown attacks.

[0120] After generating new templates and associating them with anomalies, an adaptive learning process is initiated to continuously optimize the classification model. First, the new templates and their associated anomaly features are input into the classification model, and incremental learning updates the model parameters, improving the accuracy of identifying new traffic patterns. Second, the effectiveness of templates in the template library is periodically evaluated, removing entries that have not matched for a long time or have a high false positive rate, ensuring the timeliness and accuracy of the template library. Simultaneously, verified new threat patterns are added to the anomaly database, expanding the coverage of the attack signature database. For example, after the feature description and defense strategy of a new DDoS variant are included in the database, the system can automatically block subsequent attacks of the same type. This closed-loop optimization mechanism enables the system to dynamically adapt to changes in the network environment and the evolution of attack methods, achieving continuous evolution of security protection capabilities.

[0121] Please see Figure 2 The diagram below illustrates the structure of a network traffic classification device according to an embodiment of this application, comprising:

[0122] Device data acquisition unit 21 is used to acquire electromagnetic radiation signals and historical communication behavior sequences of the target network device;

[0123] Frequency domain feature extraction unit 22 extracts the first frequency domain features from the electromagnetic radiation signal based on the electromagnetic radiation signal;

[0124] The fingerprint identification generation unit 23 generates an electromagnetic fingerprint identification of the target network device based on the first frequency domain features;

[0125] Temporal feature extraction unit 24 extracts the second temporal feature from the historical communication behavior sequence based on the historical communication behavior sequence;

[0126] The feature vector fusion unit 25 is used to jointly encode the electromagnetic fingerprint identifier and the second temporal feature to generate a multi-dimensional classification feature vector;

[0127] Traffic type confirmation unit 26 generates the traffic type of the target network device based on the matching degree between the multi-dimensional classification feature vector and the preset traffic category template.

[0128] Please see Figure 3 This application also provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor. When the processor 320 executes the computer program 311, it implements the steps of any method for network traffic classification.

[0129] Since the electronic device described in this embodiment is the device used to implement a network traffic classification device in the embodiments of this application, those skilled in the art can understand the specific implementation method and various variations of the electronic device in this embodiment based on the method described in the embodiments of this application. Therefore, how the electronic device implements the method in the embodiments of this application will not be described in detail here. Any device used by those skilled in the art to implement the method in the embodiments of this application is within the scope of protection of this application.

[0130] In practice, when the computer program 311 is executed by the processor, it can implement any of the embodiments corresponding to the first aspect.

[0131] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0132] Those skilled in the art will understand that embodiments of this application can provide methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media containing computer-readable program code.

[0133] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0134] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0135] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0136] This application also provides a computer program product, which includes computer software instructions that, when executed on a processing device, cause the processing device to perform... Figure 1 The flowchart of a network traffic classification method in the corresponding embodiment.

[0137] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, computer instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any usable medium that a computer can store or a data storage device such as a server or data center that integrates one or more usable media. The usable medium may be a magnetic medium, an optical medium, or a semiconductor medium, etc.

[0138] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0140] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0141] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in the form of hardware and / or software functional units.

[0142] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device to execute all or part of the steps of the methods of the various embodiments of this application.

[0143] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

[0144] Although preferred embodiments have been described in this specification, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this specification.

[0145] Obviously, those skilled in the art can make various modifications and variations to this specification without departing from its spirit and scope. Therefore, if such modifications and variations fall within the scope of the claims and their equivalents, this specification is also intended to include such modifications and variations.

Claims

1. A method for classifying network traffic, characterized in that, The method includes: Acquire electromagnetic radiation signals and historical communication behavior sequences of the target network device; Based on the electromagnetic radiation signal, extract the first frequency domain features from the electromagnetic radiation signal, including: The electromagnetic radiation signal is decomposed using wavelet packets to extract the energy distribution ratio within a preset frequency band; The energy distribution ratio is nonlinearly reduced in dimensionality by a convolutional autoencoder to generate a first frequency domain feature that includes the inherent noise characteristics of the hardware circuit. Generating the electromagnetic fingerprint identifier of the target network device based on the first frequency domain features includes: Cluster analysis is performed on the first frequency domain features to generate a cluster center vector that uniquely corresponds to the hardware circuit of the target network device. The cluster center vector is mapped to a preset electromagnetic fingerprint identifier library to generate an electromagnetic fingerprint identifier in digital code form, and the cluster center vector and the digital code are associated and stored; wherein, the preset electromagnetic fingerprint identifier library stores the mapping relationship between the digital code and the cluster center vector; Based on the historical communication behavior sequence, extract the second temporal feature from the historical communication behavior sequence; The electromagnetic fingerprint identifier is jointly encoded with the second temporal feature to generate a multi-dimensional classification feature vector, including: Based on the electromagnetic fingerprint identifier, obtain the corresponding cluster center vector from the preset electromagnetic fingerprint identifier library; The cluster center vector is normalized to generate the first feature vector; The second time-series feature is standardized to generate a second feature vector; The first feature vector and the second feature vector are concatenated according to a preset dimension, and feature fusion is performed through a fully connected layer to generate the multidimensional classification feature vector. Based on the matching degree between the multidimensional classification feature vector and the preset traffic category template, the traffic type of the target network device is generated.

2. The method according to claim 1, characterized in that, The step of extracting the second temporal feature from the historical communication behavior sequence based on the historical communication behavior sequence includes: The traffic burst interval, data packet length distribution and retransmission rate in the historical communication behavior sequence are statistically analyzed according to a preset time window to generate a time series of statistical behavior characteristics. The time series is subjected to periodic pattern extraction using a long short-term memory network to obtain a second time series feature characterizing the dynamic changes in traffic flow.

3. The method according to claim 1, characterized in that, The step of generating the traffic type of the target network device based on the matching degree between the multidimensional classification feature vector and the preset traffic category template includes: Calculate the cosine similarity between the multidimensional classification feature vector and each of the preset multiple traffic category templates; From the multiple traffic category templates, the template with a cosine similarity higher than a first preset threshold is selected as the candidate category; Based on the stability coefficient of the electromagnetic fingerprint identifier, the cosine similarity of each candidate category is weighted and corrected to obtain the corrected similarity of each candidate category. The candidate category with the highest value in the corrected similarity is determined as the traffic type of the target network device.

4. The method according to claim 3, characterized in that, Also includes: When the cosine similarity of all traffic category templates is lower than the first preset threshold, The multidimensional classification feature vector is labeled as an unknown type, and a new traffic category template is generated based on the multidimensional classification feature vector; The new traffic category template is matched and associated with historical abnormal behavior patterns in the abnormal behavior database.

5. A network traffic classification device, characterized in that, The device includes: The device data acquisition unit is used to acquire the electromagnetic radiation signals and historical communication behavior sequences of the target network device. The frequency domain feature extraction unit extracts a first frequency domain feature from the electromagnetic radiation signal based on the electromagnetic radiation signal, including: The electromagnetic radiation signal is decomposed using wavelet packets to extract the energy distribution ratio within a preset frequency band; The energy distribution ratio is nonlinearly reduced in dimensionality by a convolutional autoencoder to generate a first frequency domain feature that includes the inherent noise characteristics of the hardware circuit. The fingerprint identification generation unit generates an electromagnetic fingerprint identification of the target network device based on the first frequency domain feature, including: Cluster analysis is performed on the first frequency domain features to generate a cluster center vector that uniquely corresponds to the hardware circuit of the target network device. The cluster center vector is mapped to a preset electromagnetic fingerprint identifier library to generate an electromagnetic fingerprint identifier in digital code form, and the cluster center vector and the digital code are associated and stored; wherein, the preset electromagnetic fingerprint identifier library stores the mapping relationship between the digital code and the cluster center vector; The temporal feature extraction unit extracts a second temporal feature from the historical communication behavior sequence based on the historical communication behavior sequence. The feature vector fusion unit is used to jointly encode the electromagnetic fingerprint identifier and the second temporal feature to generate a multi-dimensional classification feature vector, including: Based on the electromagnetic fingerprint identifier, obtain the corresponding cluster center vector from the preset electromagnetic fingerprint identifier library; The cluster center vector is normalized to generate the first feature vector; The second time-series feature is standardized to generate a second feature vector; The first feature vector and the second feature vector are concatenated according to a preset dimension, and feature fusion is performed through a fully connected layer to generate the multidimensional classification feature vector. The traffic type confirmation unit generates the traffic type of the target network device based on the matching degree between the multidimensional classification feature vector and the preset traffic category template.

6. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the computer program stored in the memory, implements the steps of the network traffic classification method as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the network traffic classification method as described in any one of claims 1 to 4.

Images