A quic encrypted video traffic identification method based on an attention mechanism CNN deep learning model

Abstract

The application provides a QUIC encrypted video flow recognition method based on an attention mechanism CNN deep learning model, and realizes recognition of specific video content in a QUIC encrypted flow environment. First, the application collects QUIC encrypted video flow data and corresponding decrypted flow data in a normal environment, marks data transmission units by using a client request packet, and fragments the video data. Then, the data transmission unit length sequence of the encrypted video stream is extracted, the original flow data is combined, a linear regression model is trained to correct the length formula, and the length deviation caused by QUIC encryption and stream multiplexing is corrected. Finally, the QUIC encrypted video flow data of specific video is collected and corrected in length, and the corrected data is trained by using a CNN deep learning model based on an attention mechanism, so that high-precision recognition of the QUIC encrypted video stream is realized. Experimental results show that the application can realize high-precision video stream recognition in a complex network environment, has higher recognition accuracy and robustness compared with traditional methods, and is suitable for the fields of video flow monitoring and security analysis.

Description

Technical Field

[0001] This invention proposes a video data segment length correction processing technology, which applies a CNN deep learning model based on the attention mechanism to identify video traffic encrypted based on the QUIC protocol, belonging to the field of network traffic management and security monitoring technology. Background Technology

[0002] In today's internet environment, video traffic has become a crucial component of network data transmission. The QUIC protocol, with its strong encryption, fast connection establishment, and low latency resulting from integrating UDP with TLS 1.3, has been widely adopted in the video streaming field. However, this encryption mechanism presents significant challenges to network security and traffic analysis.

[0003] Traditional video traffic identification technologies face numerous challenges when dealing with QUIC encrypted traffic. On one hand, the encryption of the QUIC protocol makes it difficult for traditional methods based on plaintext protocol header information to obtain effective features. On the other hand, existing encrypted video traffic identification methods, such as those based on video fingerprint databases, machine learning, and reversible encryption / watermarking, cannot accurately identify video traffic due to the dynamic stream multiplexing, variable packet size, and protocol-level obfuscation characteristics of the QUIC protocol.

[0004] (1) Video recognition method based on fingerprint database

[0005] Fingerprint-based video recognition methods extract unique fingerprint features from videos (such as payload length, frame features, audio features, and coding characteristics) and compare them with a database to achieve video content recognition. These methods are widely used in copyright protection, video search, and media surveillance. However, this approach has several limitations. First, building and maintaining the fingerprint database requires a large amount of video data for training and storage, while the matching process demands high computational resources, increasing the complexity and cost of the recognition system. Second, this method is sensitive to changes in video stream format; if the video undergoes transmission optimization, its data packet structure may change, affecting fingerprint consistency and reducing recognition accuracy.

[0006] Under the QUIC protocol, the limitations of this method are particularly evident. First, QUIC employs end-to-end encryption, encrypting transport layer information of data packets (such as stream ID and packet size), making it impossible for traditional methods to directly obtain useful fingerprint features. Second, QUIC supports multiplexing, meaning a single connection can carry multiple data streams simultaneously. This disrupts the packet order and traffic patterns relied upon by traditional traffic identification methods. Furthermore, QUIC's dynamic flow control and adaptive congestion control mechanisms mean that the traffic characteristics of the same video may differ under different network conditions, leading to a decrease in the stability and accuracy of fingerprint identification.

[0007] (2) Machine learning-based methods

[0008] Machine learning-based methods utilize labeled datasets to train classifiers (such as support vector machines and random forests) to identify different types of video traffic. These methods typically rely on extractable features from traffic patterns, such as packet size distribution, traffic peak variations, and protocol header information. However, the end-to-end encryption mechanism of the QUIC protocol hides many traffic features relied upon by traditional machine learning methods, significantly reducing the availability of training data. Furthermore, QUIC employs a flexible flow control mechanism, dynamically adjusting packet transmission patterns based on network conditions, leading to unstable traffic characteristics and impacting the model's generalization ability. In addition, because QUIC is still in a rapid development phase, existing datasets are limited, making model training more challenging, resulting in reduced accuracy of traditional machine learning-based methods in the QUIC environment.

[0009] (3) Reversible encryption / watermarking method

[0010] This method embeds special watermarks or hidden information into encrypted videos for identification during subsequent transmission or decoding. Reversible encryption or watermarking techniques typically rely on traffic retaining certain detectable characteristics during transmission, such as embedding specific bit patterns or modifying the statistical properties of video frames. However, QUIC employs end-to-end encryption, making packet-level content completely invisible during transmission, hindering external observers from detecting or extracting the embedded information. Furthermore, QUIC is based on the HTTP / 3 protocol, which further hides application-layer data, making watermark detection even more difficult. Because video traffic does not reveal its data characteristics in a fixed pattern during QUIC transmission, the applicability of watermark-based encrypted video recognition methods under QUIC is severely limited. Summary of the Invention

[0011] To address the problem of accurately identifying QUIC encrypted video traffic in existing technologies, this invention proposes a QUIC encrypted video traffic identification method based on an attention-based CNN deep learning model. This method achieves high-precision identification of QUIC encrypted video traffic by correcting the data slice length and combining it with an attention-based CNN deep learning model.

[0012] This invention proposes a method for identifying QUIC encrypted video traffic based on an attention-mechanism CNN deep learning model.

[0013] To achieve the objectives of this invention, the specific technical steps of this solution are as follows: A QUIC encrypted video traffic identification method based on an attention mechanism CNN deep learning model, the method comprising the following steps:

[0014] Step (1) As a user, collect QUIC encrypted video traffic data and its corresponding raw unencrypted traffic data under normal conditions;

[0015] Step (2) processes the video traffic data collected in step (1) by identifying client request packets to realize the division of data transmission units;

[0016] Step (3) Use the obtained data transmission unit length sequence of QUIC encrypted video traffic data and the corresponding data transmission unit length sequence of the original unencrypted traffic data to train the linear regression formula for the correction length.

[0017] Step (4) As a third party, collect QUIC encrypted video traffic data under different network environments;

[0018] Step (5) First, the data transmission unit is divided by identifying the client request packet, and the data transmission unit of the encrypted traffic data is divided. Then, the data transmission unit correction length sequence is obtained by processing the linear regression formula of the correction length obtained in step (3).

[0019] Step (6) feeds the data transmission unit correction length sequence into the attention mechanism-based CNN model for training to obtain a model that can accurately identify QUIC encrypted video traffic;

[0020] Step (7) Process the QUIC encrypted video traffic data according to step (5), and use the recognition model obtained in step (6) to identify QUIC encrypted video traffic in different network environments.

[0021] Furthermore, the specific process of data collection in step (1) is as follows:

[0022] (1.1) To set up an acquisition environment for capturing QUIC encrypted video traffic data, one or more PCs and several network cables are required. The required video is played on each PC.

[0023] (1.2) Obtain the URLs of the videos to be identified on the corresponding platforms and compile them into a video URL list file;

[0024] (1.3) Deploy a script program on each PC to capture the transmitted encrypted video messages while automatically playing the video;

[0025] (1.4) Record the protocol handshake key when capturing video on each PC. Use this key to decrypt the captured encrypted video messages and extract the actual data in the encrypted traffic for subsequent analysis and processing.

[0026] Furthermore, in step (2), the method for dividing the QUIC video traffic data transmission unit is as follows:

[0027] (2.1) By analyzing the principles of video streaming protocols, it is found that when QUIC is applied to HTTP / 3, some features of the HTTP protocol are retained for backward compatibility, including the basic request-response unit. Therefore, clear segmentation is visible in the traffic, i.e., after the client sends a request message, it receives a response from the server. Based on this, encrypted video streams can be segmented;

[0028] (2.2) The data packets exchanged between the two adjacent client request messages are grouped into a data transmission unit for subsequent analysis.

[0029] Furthermore, in step (3), the specific process of training the linear regression formula for the correction length is as follows:

[0030] (3.1) Select protocol features related to the video stream as input data, including packet length and the number of transmitted packets;

[0031] (3.2) Using the actual data (including packet length and number of packets) of the acquired encrypted video stream, the parameters (U1, U2) in the formula are trained using linear regression methods such as least squares. The formula for linear regression is as follows:

[0032] cor_len=cip_len-pk_num×U1+U2

[0033] Let the actual video packet length of the i-th sample be cor_len. i The length of the encrypted data packet is cip_len i The number of data packets is pk_num i Calculate the predicted value based on the current parameters U1 and U2.

[0034] Define the error function:

[0035]

[0036] Where n is the number of samples.

[0037] (3.3) The gradient descent method is used to optimize the model parameters to minimize the difference between the length of the encrypted data stream and the actual data stream length, and the final parameter values ​​are obtained.

[0038] Initialization parameter U1 (0) U2 (0)和 The learning rate α = 0.01.

[0039] The gradient calculation formula is:

[0040]

[0041] Update the parameters according to the gradient descent update rule:

[0042]

[0043]

[0044] Set a convergence threshold ε After each iteration, calculate the change in the error function ΔJ = J(U1) (k) U2 (k) )-J(U1 (k+1) U2 (k+1) When ΔJ < ε Or when the maximum number of iterations is reached.

[0045] Furthermore, in step (4), as a third party, QUIC encrypted video stream traffic data is collected under different network environments:

[0046] Same as steps (1.1), (1.2), and (1.3).

[0047] Furthermore, in step (5), the specific steps for obtaining the QUIC encrypted video traffic data transmission unit correction length sequence are as follows:

[0048] (5.1) Using the method in step (2), divide the data transmission units of encrypted traffic data;

[0049] (5.2) Extract the packet length and UDP payload length of each data transmission unit;

[0050] (5.3) The data transmission unit correction length sequence is obtained by processing the linear regression formula of the correction length obtained in step (4).

[0051] Furthermore, in step (6), the CNN model based on the attention mechanism for identifying QUIC encrypted video traffic is constructed as follows:

[0052] (6.1) Constructing a CNN model based on attention mechanism. A dual-attention enhanced convolutional neural network model is established, forming a CNN-STA hybrid architecture. The key channel feature representation of video segments is dynamically enhanced through the channel attention module (SEBlock), and important segment dependencies in the temporal dimension are captured by the temporal attention module (TemporalAttention). This constructs a deep learning model that integrates spatial and temporal dual attention mechanisms, forming an enhanced feature extraction architecture suitable for video traffic recognition.

[0053] Design a hierarchical attention model architecture. The model consists of feature convolutional units, dual attention units, and classification units:

[0054] The feature convolutional unit adopts a three-level progressive structure. Each level includes a Conv1D layer, a BN layer, a channel attention module, a temporal attention module (only in the third level), a ReLU activation function, and MaxPool downsampling. Spatiotemporal features are extracted step by step through 3×3 convolutional kernels.

[0055] The dual attention unit is composed of parallel channel attention and temporal attention. SEBlock uses global average pooling and fully connected layers to achieve channel dimension recalibration, while TemporalAttention uses the QKV attention mechanism to achieve temporal dimension feature weight allocation.

[0056] The classification unit adopts a three-level fully connected layer structure, which includes 256-128 neuron hierarchical dimensionality reduction, combined with the ReLU activation function and Dropout regularization layer (dropout rate 0.5), and finally outputs the class probability distribution through a linear projection layer.

[0057] (6.2) Training the model. The attention-based CNN model is trained through supervised learning: the network parameters are optimized through end-to-end supervised learning, the channel attention module learns the importance weights of feature channels, the temporal attention module establishes long-range dependencies across frames, and the dual attention mechanism works together to improve the model's learning of the feature of the data transmission unit correction length sequence of the input video stream, thereby achieving accurate classification of QUIC encrypted video stream traffic.

[0058] Furthermore, in step (7), the identification process of QUIC encrypted video traffic in the network is as follows:

[0059] (7.1) Capture QUIC encrypted video traffic in the network, divide it into data transmission units using the method in step (5), and then process it using the linear regression formula of the correction length to obtain the correction length sequence.

[0060] (7.2) Input the processed corrected length sequence into the attention-based CNN model trained in step (6), and identify the transmitted encrypted video traffic in real time according to the classification results output by the model to determine whether it belongs to the video to be identified.

[0061] Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0062] (1) Traditional video traffic identification techniques cannot effectively overcome the length distortion problem caused by encryption and stream multiplexing when processing QUIC encrypted video streams. Compared with existing methods, this invention proposes a method based on data fragment length correction, which combines the structural characteristics of the QUIC protocol, considers the influence of the encryption header, trains a linear regression formula, and then corrects the length of video data fragments. This can accurately restore the original characteristics of encrypted video traffic, thereby improving the accuracy and reliability of traffic segmentation.

[0063] (2) Compared with traditional CNN models, this invention introduces time attention mechanism and channel attention mechanism, which enables the deep learning model to be more adaptable and stable when dealing with complex environments such as network fluctuations, packet loss and transmission distortion, and further enhances the robustness of the model in recognizing QUIC encrypted video streams. Attached Figure Description

[0064] Figure 1 This is a system framework diagram of a QUIC encrypted video traffic identification method based on data fragment length correction processing;

[0065] Figure 2 Line graph showing the sequence of QUIC encrypted traffic data transmission unit lengths for the same video under different environments;

[0066] Figure 3 This is a network topology diagram of a CNN model based on an attention mechanism.

[0067] Figure 4 This module is for channel attention (SEBlock) and temporal attention mechanisms. Detailed Implementation

[0068] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0069] Example: The present invention provides a method for identifying QUIC encrypted video traffic, the overall system structure of which is as follows: Figure 1 As shown, it includes the following steps:

[0070] Step (1) As a user, collect QUIC encrypted video traffic data and its corresponding raw unencrypted traffic data under normal conditions;

[0071] Step (2) processes the video traffic data collected in step (1) by identifying client request packets to realize the division of data transmission units.

[0072] Step (3) Use the obtained data transmission unit length sequence of QUIC encrypted video traffic data and the corresponding data transmission unit length sequence of the original unencrypted traffic data to train the linear regression formula for the correction length.

[0073] Step (4) As a third party, collect QUIC encrypted video traffic data under different network environments;

[0074] Step (5) first divides the data transmission units by identifying client request packets, then divides the encrypted traffic data into data transmission units, and then processes the data transmission unit correction length sequence by using the linear regression formula of the correction length obtained in step (3).

[0075] Step (6) feeds the data transmission unit correction length sequence into the attention-based CNN model for training to obtain a model that can accurately identify QUIC encrypted video traffic.

[0076] Step (7) After dividing the QUIC encrypted video traffic data according to step (5), perform correction processing and use the recognition model obtained in step (6) to identify QUIC encrypted video traffic under different network environments.

[0077] In one embodiment of the present invention, in step (1), the user, by collecting QUIC encrypted video traffic data under normal conditions and its corresponding original unencrypted traffic data, can ultimately obtain a dataset of the QUIC encrypted YouTube video platform. The data collection steps are as follows:

[0078] (1.1) Play the required video on a PC in Australia using the Firefox browser and capture QUIC encrypted video traffic data;

[0079] (1.2) Select videos from YouTube, a popular international video provider that uses the QUIC encryption protocol, as the experimental subjects. Write a web crawler script based on the characteristics of the YouTube video platform to obtain the URLs of the platform videos and compile them into a video URL list file.

[0080] (1.3) Deploy Uibot software on the PC and write an automation script program to use Uibot Creator to complete the automated acquisition of video packets. The main tasks of the automation script program are: reading the URL file obtained in (1.2), controlling the PC's browser to play the video according to the read URL, controlling the PC to open Wireshark to capture packets before playing the video, and storing the captured packets;

[0081] (1.4) Configure a browser on the PC to play videos. After each TLS session ends, record the key for decrypting the session data in the corresponding log file. Wireshark can decrypt the captured QUIC session data stream by accessing the key log file and using the key in it.

[0082] In one embodiment of the present invention, step (2), the step of dividing the QUIC encrypted video traffic data transmission unit is as follows:

[0083] (2.1) By analyzing the principles of video streaming protocols, it is found that when QUIC is applied to HTTP / 3, some features of the HTTP protocol are retained for backward compatibility, including the basic request-response unit. Therefore, clear segmentation is visible in the traffic, i.e., after the client sends a request message, it receives a response from the server. Based on this, encrypted video streams can be segmented.

[0084] (2.2) The data packets exchanged between the two adjacent client request messages are grouped into a data transmission unit for subsequent analysis.

[0085] In one embodiment of the present invention, the specific process of training the linear regression formula for the correction length in step (3) is as follows:

[0086] First, protocol features related to the video stream are selected as input data. The main features include:

[0087] • Packet length (cip_len): Represents the total length of the data packet after encryption by the QUIC protocol.

[0088] • Number of data packets transmitted (pk_num): The number of data packets in each data transmission unit.

[0089] The goal of a linear regression model is to predict the actual video stream length (output value) based on the characteristics (input features) of the encrypted stream. In this invention, the formula for linear regression is as follows:

[0090] cor_len=cip_len-pk_num×U1+U2

[0091] Where cor_len is the corrected actual video stream length; cip_len is the length of the encrypted data packet (Ciphertext Length); pk_num is the number of data packets in the data transmission unit (DTU); U1 and U2 are the parameters of the regression model, which need to be determined through training.

[0092] Using the actual data of the collected encrypted video stream (including packet length and number of packets) as input features, the target value is the actual video data length. Through linear regression methods such as least squares, the model minimizes the difference between the length of the encrypted data stream and the length of the actual data stream by optimizing U1 and U2.

[0093] The final results are: U1 = -28.0301, U2 = 10.9564

[0094] In one embodiment of the present invention, the specific process of collecting QUIC encrypted video stream traffic data under different network environments as a third party in step (4) is as follows:

[0095] (4.1) Play the required video on a PC in Australia and a PC in Japan using Firefox browsers and capture QUIC encrypted video traffic data;

[0096] (4.2) Select videos from YouTube, a popular international video provider that uses the QUIC encryption protocol, as the experimental subjects. Write a web crawler script based on the characteristics of the YouTube video platform to obtain the URLs of the platform videos and compile them into a URL file.

[0097] (4.3) Set up different network environments, deploy Uibot software on the PC, and write an automated script program to use Uibot Creator to complete the automated acquisition of video packets. The main tasks of the automated script program are: reading the URL file obtained in (1.2), controlling the PC's browser to play the video according to the read URL, controlling the PC to open Wireshark to capture packets before playing the video, and storing the captured packets;

[0098] Table 1 shows the dataset captured in step (4).

[0099]

[0100]

[0101] In one embodiment of the present invention, in step (5), the QUIC encrypted video traffic captured in step (4) is processed to obtain its corresponding data transmission unit correction length sequence. The specific process is as follows:

[0102] (5.1) Divide the data transmission units of encrypted traffic data using the same method as in step (2);

[0103] (5.2) Extract the data packet length, number of transmitted data packets, and number of data packets for each data transmission unit;

[0104] (5.3) The data transmission unit correction length sequence is obtained by processing the linear regression formula of the correction length obtained in step (4) (see...). Figure 2 ).

[0105] In one embodiment of the present invention, the specific process of training the attention-based CNN model in step (6) is as follows:

[0106] (6.1) Constructing an attention-based CNN model (e.g.) Figure 3 This introduces channel attention and temporal attention mechanisms into the traditional CNN model. Channel attention (SEBlock) mechanism (e.g.) Figure 4 Global average pooling is used to learn the weights of each channel, enhancing the response of important features and suppressing noisy channels (packet loss, duplicate data). Temporal attention mechanisms (such as...) Figure 4 The weights are dynamically allocated in the time dimension, focusing on key frames and ignoring irrelevant frames (mistransmitted packets).

[0107] (6.2) Training the model. A CNN model based on the attention mechanism is trained through supervised learning to learn the feature of the data transmission unit correction length sequence of the input video traffic, thereby achieving accurate classification of QUIC encrypted video stream traffic.

[0108] Table 2 Hyperparameters of Convolutional Layers

[0109] Number of input channels 1 kernel size 3 filling 1 stride 1 Pooling layer Max pooling, with a kernel size of 2 and a stride of 2 (the feature map size is halved after each pooling operation).

[0110] Table 2 Hyperparameters of Fully Connected Layers

[0111] Fully connected layer input dimensions 128*(input_size / / 8)=128*5=640 Number of hidden layer neurons First fully connected layer: 256; Second fully connected layer: 128 Activation function ReLU Dropout ratio 0.5

[0112] Table 4 Hyperparameters of the Channel Attention Module (SEBlock)

[0113] Compression ratio 16 (In SEBlock, the number of channels is compressed to 1 / 16 of the original). Activation function ReLU (used in SEBlock's fully connected layers) Output activation function Sigmoid (used to generate channel attention weights)

[0114] Table 5 Hyperparameters of the Temporal Attention Module

[0115] Number of channels for query in_channels / / 8 (i.e., 128 / / 8 = 16) Number of channels for the key in_channels / / 8 (i.e., 128 / / 8 = 16) Number of channels for the value in_channels / / 8 (i.e., 128 / / 8 = 16) Attention scaling factor (gamma) Learnable parameters, initialized to 0

[0116] Table 6 Training Hyperparameters

[0117]

[0118]

[0119] In one embodiment of the present invention, the identification process of QUIC encrypted video traffic in the network in step (7) is as follows:

[0120] (7.1) Capture QUIC encrypted video traffic in the network and process it in the same way as in step (5) to obtain the corrected length sequence.

[0121] (7.2) Input the processed corrected length sequence into the attention-based CNN model trained in step (6), and perform real-time recognition of video titles based on the classification results output by the model, and record the accuracy of the results.

[0122] Table 7 Recognition Results

[0123] enclosed environment Closed World 99.25％ Open environment Closed world + Open world 98.29％ Complex Environment 1 Closed world +0.01% packet loss rate 96％ Complex Environment 2 Closed world +0.05% packet loss rate 96％ Complex Environment 3 Closed world +0.1% packet loss rate 96％ Complex Environment 4 Closed world + mixed packet loss rate 96％

[0124] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention. Equivalent transformations or substitutions made based on the above technical solutions all fall within the scope of protection of the claims of the present invention.

Claims

1. A method for identifying QUIC encrypted video traffic based on an attention-mechanism CNN deep learning model, characterized in that, The method includes the following steps: Step (1) As a user, collect QUIC encrypted video traffic data and its corresponding raw unencrypted traffic data under normal conditions; Step (2) processes the video traffic data collected in step (1) by identifying client request packets to realize the division of data transmission units; Step (3) Use the obtained data transmission unit length sequence of QUIC encrypted video traffic data and the corresponding data transmission unit length sequence of the original unencrypted traffic data to train the linear regression formula for the correction length; Step (4) As a third party, collect QUIC encrypted video traffic data under different network environments; Step (5) First, the data transmission unit is divided by identifying the client request packet, and the data transmission unit of the encrypted traffic data is divided. Then, the data transmission unit correction length sequence is obtained by processing the linear regression formula of the correction length obtained in step (3). Step (6) feeds the data transmission unit correction length sequence into the attention mechanism-based CNN model for training to obtain a model that accurately identifies QUIC encrypted video traffic; Step (7) Process the QUIC encrypted video traffic data according to step (5), and use the recognition model obtained in step (6) to identify QUIC encrypted video traffic under different network environments.

2. The QUIC encrypted video traffic identification method based on an attention mechanism CNN deep learning model according to claim 1, characterized in that, Step (1) specifically includes the following sub-steps: (1.1) To set up an acquisition environment for capturing QUIC encrypted video traffic data, one or more PCs and several network cables are required. The required video is played on each PC. (1.2) Obtain the URLs of the videos to be identified on the corresponding platforms and compile them into a video URL list file; (1.3) Deploy a script program on each PC to capture the transmitted encrypted video packets while automatically playing the video; (1.4) Record the protocol handshake key when capturing video on each PC. Use this key to decrypt the captured encrypted video messages and extract the actual data in the encrypted traffic for subsequent analysis and processing.

3. The QUIC encrypted video traffic identification method based on an attention mechanism CNN deep learning model according to claim 1, characterized in that, Step (2) specifically includes the following sub-steps: (2.1) By analyzing the principle of video streaming protocols, when QUIC is applied to HTTP / 3, obvious segmentation can be seen in the traffic. That is, after the client sends a request message, it receives a response from the server. Based on this, the encrypted video stream is segmented. (2.2) The data packets exchanged between two adjacent client request messages are grouped into a data transmission unit for subsequent analysis.

4. The QUIC encrypted video traffic identification method based on an attention mechanism CNN deep learning model according to claim 1, characterized in that, Step (3) specifically includes the following sub-steps: (3.1) Select protocol features related to the video stream as input data, including packet length and the number of transmitted packets; (3.2) Using the actual data of the collected encrypted video stream, including the data packet length and the number of data packets, the parameters U1 and U2 in the formula are trained by the least squares linear regression method. The linear regression formula is as follows: Let the actual video packet length of the i-th sample be... i The length of the encrypted data packet is cip_len i The number of data packets is pk_num i Calculate the predicted value based on the current parameters U1 and U2. , Define the error function: Where n is the number of samples; (3.3) Gradient descent is used to minimize the difference between the length of the encrypted data stream and the actual data stream length to obtain the final parameter values. Initialization parameter U1 （0） U2 （0） With a learning rate α = 0.01, The gradient calculation formula is: Update the parameters according to the gradient descent update rule: Set a convergence threshold ε, and calculate the change in the error function after each iteration. ， when The iteration terminates when the number of iterations is less than ε or when the maximum number of iterations is reached.

5. The QUIC encrypted video traffic identification method based on an attention mechanism CNN deep learning model according to claim 1, characterized in that, Step (5) specifically includes the following sub-steps: (5.1) Divide the data transmission units by identifying client request packets, and divide the data transmission units of encrypted traffic data; (5.2) Extract the data packet length and number of data packets for each data transmission unit; (5.3) The data transmission unit correction length sequence is obtained by processing the linear regression formula of the correction length obtained in step (3).

6. The QUIC encrypted video traffic identification method based on an attention mechanism CNN deep learning model according to claim 1, characterized in that, Step (6) specifically includes the following sub-steps: (6.1) Construct a CNN model based on attention mechanism, establish a convolutional neural network model with dual attention enhancement, form a CNN-STA hybrid architecture, dynamically enhance the key channel feature expression of video segments through the channel attention module SEBlock, capture important segment dependencies in the temporal dimension by combining the temporal attention module TemporalAttention, construct a deep learning model that integrates spatial-temporal dual attention mechanism, and form an enhanced feature extraction architecture suitable for video traffic recognition. Design a hierarchical attention model architecture, which consists of feature convolutional units, dual attention units, and classification units: The feature convolutional unit adopts a three-level progressive structure, with each level containing a Conv1D layer, a BN layer, a channel attention module, a temporal attention module, a ReLU activation function, and MaxPool downsampling. Spatiotemporal features are extracted step by step through 3×3 convolutional kernels. The dual attention unit is composed of parallel channel attention and temporal attention. SEBlock uses global average pooling and fully connected layers to achieve channel dimension recalibration, while TemporalAttention uses the QKV attention mechanism to achieve temporal dimension feature weight allocation. The classification unit adopts a three-order fully connected layer structure, containing 256-128 neurons for dimensionality reduction, combined with ReLU activation function and Dropout regularization layer, with a dropout rate of 0.5, and finally outputs the class probability distribution through a linear projection layer; (6.2) Training the model: The CNN model based on the attention mechanism is trained through supervised learning: the network parameters are optimized through end-to-end supervised learning, the channel attention module learns the feature channel importance weights, the temporal attention module establishes long-range dependencies across frames, and the dual attention mechanism works together to improve the model's learning of the feature of the data transmission unit correction length sequence of the input video traffic, so as to achieve accurate classification of QUIC encrypted video stream traffic.

7. The QUIC encrypted video traffic identification method based on an attention mechanism CNN deep learning model according to claim 1, characterized in that, Step (7) specifically includes the following sub-steps: (7.1) Capture QUIC encrypted video traffic in the network, divide it into data transmission units, and then process it using the linear regression formula of the correction length to obtain the correction length sequence; (7.2) Input the processed corrected length sequence into the CNN model based on the attention mechanism trained in step (6), and identify the transmitted encrypted video traffic in real time according to the classification results output by the model, and determine whether it belongs to the video to be identified.

Images