A Multi-Task Encrypted Traffic Classification Method and Device Based on Dual Embedding and Graph Comparison Learning

Abstract

This invention relates to the field of network information security technology, and discloses a multi-task encrypted traffic classification method and device based on dual embedding and graph contrastive learning. The method includes the following steps: A. Dividing traffic into different session flows; B. Embedding packet headers and payloads to generate packet representations; C. Generating packet direction sequences, and constructing a traffic interaction graph based on the packet direction sequences and burst sequences; D. Generating an enhanced traffic interaction graph through a graph enhancement strategy, and extracting flow-level features from the traffic interaction graph using a four-layer graph neural network and a contrastive learning mechanism to obtain flow-level representations; E. Optimizing the loss function to train the four-layer graph neural network model incorporating the contrastive learning mechanism to obtain a multi-task encrypted traffic classification model; F. Using the multi-task encrypted traffic classification model to perform flow-level and packet-level classification on unknown traffic, obtaining the classification results. This invention achieves accurate multi-task classification within the same model while ensuring classification accuracy.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, specifically to a multi-task encrypted traffic classification method and device based on dual embedding and graph contrast learning. Background Technology

[0002] In recent years, with the increasing demand for privacy protection, privacy-enhancing technologies have been widely applied, greatly improving users' anonymity and data security in the internet environment. Second-generation Tor routing and Virtual Private Networks (VPNs), as the most representative technologies, provide users with the ability to access the internet anonymously, effectively avoiding network tracking and preventing personal data from being monitored or misused by third parties. However, while encryption technology plays a crucial role in protecting user privacy and free network access, it also provides cover for malicious actors, allowing them to bypass traditional security detection methods and carry out a series of criminal activities such as network attacks, data theft, and illegal transactions, increasing the difficulty of network security monitoring. How to effectively characterize encrypted traffic and accurately identify potential security threats without violating privacy protection principles has become a critical issue that urgently needs to be addressed in the current cybersecurity field.

[0003] Encrypted traffic classification aims to identify and classify network traffic related to different service types and specific applications by analyzing various characteristics of traffic without decrypting the transmitted content. Traditional methods based on port numbers and deep packet inspection are no longer effective due to the widespread use of dynamic ports, the continuous evolution of encryption protocols, and the increasing computational overhead. Statistical feature-based methods improve classification accuracy by extracting features from encrypted traffic metadata (such as traffic size, latency, and transmission mode) and using machine learning algorithms for classification. However, due to the limitations of manually designed features and the instability of traffic statistics, these methods may affect the effectiveness and accuracy of classification in some cases. Currently, encrypted traffic classification methods typically use deep neural networks to automatically learn features and classify encrypted traffic. This method eliminates the need for manual feature design and automatically extracts low-dimensional feature vectors from the data, significantly improving the accuracy and robustness of encrypted traffic classification. However, this technology has at least the following technical problems:

[0004] Existing encrypted traffic classification methods typically handle packet-level and traffic-level classification tasks separately, leading to redundancy in the training process and failing to fully explore the potential correlation between the two. Furthermore, the utilization of byte sequence information is insufficient, failing to fully extract the rich information contained in the payload. Simultaneously, the learning of sample semantic invariance is also inadequate, failing to fully explore the common features among samples within the same application. Summary of the Invention

[0005] This invention provides a multi-task encrypted traffic classification method and device based on dual embedding and graph contrastive learning, which addresses the shortcomings of existing deep learning-based encrypted traffic classification methods in representing encrypted traffic, and achieves robust flow-level classification and more fine-grained packet-level classification in the same model.

[0006] This invention relates to a multi-task encrypted traffic classification method based on dual embedding and graph contrast learning, comprising the following steps:

[0007] Building a classification model:

[0008] A. Dataset preprocessing: Collect application traffic to form a dataset. Divide the traffic in the dataset into different session streams using a 5-tuple (source IP address, destination IP address, source port number, destination port number, protocol type) and remove irrelevant information from the session streams.

[0009] B. Generate packet-level representation: By performing header embedding and payload embedding on each data packet in the dataset, the features of the header embedding and payload embedding are fused to generate a data packet representation;

[0010] C. Constructing a traffic interaction graph: Based on the interaction between the client and the server, the direction of each data packet in the preprocessed dataset is extracted to generate a data packet direction sequence. A traffic interaction graph is constructed based on the data packet direction sequence and the burst sequence, where the burst sequence is used to represent a sequence of consecutive data packets with the same direction.

[0011] D. Generate flow level representation: Generate an enhanced flow interaction graph through a graph augmentation strategy. Based on the enhanced flow interaction graph, learn the potential common features in the flow using a four-layer graph neural network model and a contrastive learning mechanism, extract robust flow level features, and obtain the flow level representation.

[0012] E. Generate a multi-task encrypted traffic classification model: Train a four-layer graph neural network model that incorporates a contrastive learning mechanism by optimizing the loss function through packet representation and flow level representation to obtain the final multi-task encrypted traffic classification model;

[0013] Multi-task encrypted traffic classification:

[0014] F. Use a multi-task encrypted traffic classification model to classify unknown traffic at the flow level and packet level, and obtain the classification results.

[0015] This application preprocesses, performs packet-level representation, constructs traffic interaction graphs, and performs flow-level representation on application traffic datasets to obtain a multi-task encrypted traffic classification model. The model is trained on the training set using a loss function and a contrastive learning mechanism, and the optimal multi-task encrypted traffic classification model is obtained based on the validation set. Classification is then performed on an unknown test set. Through collaborative optimization between flow-level and packet-level classification tasks, the generalization ability of the classification model is improved while ensuring classification accuracy. This addresses the shortcomings of existing deep learning-based multi-task encrypted traffic classification models in encrypted traffic representation and the technical challenge of simultaneously and effectively achieving robust flow-level classification and more refined packet-level classification. It achieves the technical achievement of accurate multi-task classification within a single model.

[0016] Furthermore, step B includes:

[0017] Header embedding: The header byte features of each data packet in the preprocessed dataset are learned using a CNN-LSTM (Convolutional Neural Network-Long Short-Term Memory) model;

[0018] Payload embedding: The payload byte features of each data packet in the preprocessed dataset are learned using a CNN-LSTM model;

[0019] Key feature extraction: An attention mechanism is used to extract key features (the most useful features for classification) from the header embedding and payload embedding of each data packet respectively;

[0020] Cross-gated fusion: Based on the key features, deep-level correlation features (such as local contextual semantic features of each data packet) are extracted through a cross-gated fusion strategy to generate a data packet representation.

[0021] Furthermore, in the traffic interaction graph described in step C, nodes within the same burst sequence are connected in the order of data packets, and nodes between adjacent burst sequences are connected according to the first and last data packets respectively. The nodes contain data packet representations and directions, and the edges represent the temporal relationships between data packets.

[0022] Furthermore, in step C, based on the interaction between the client and the server, the direction of each data packet in the preprocessed dataset is extracted to generate the data packet direction sequence.

[0023] Furthermore, the graph enhancement strategy described in step D is used to simulate the dynamic changes in network conditions, and randomly deletes nodes and edges in the traffic interaction graph according to a preset ratio, which is a hyperparameter.

[0024] Furthermore, in step E, the flow-level classification loss and packet-level classification loss are calculated using a loss function, and the contrastive loss is calculated based on the contrastive learning mechanism. The flow-level classification loss, packet-level classification loss, and weighted contrastive loss are then added together to obtain the total loss. The four-layer graph neural network model is then optimized based on the total loss.

[0025] Furthermore, when calculating the packet-level classification loss, the packet-level representation is extracted from the flow-level representation, and the packet-level classification loss is calculated based on the extracted packet-level representation.

[0026] Furthermore, in step E, the Adam algorithm is used in conjunction with a cosine annealing learning rate scheduling strategy to optimize the loss function.

[0027] The present invention also provides a classification apparatus for the above-described classification method, comprising:

[0028] Preprocessing module: Divides the traffic in the dataset using quintuples;

[0029] Dual embedding module: includes a CNN-LSTM module for both head embedding and payload embedding;

[0030] Attention learning module: Extracts key features from the head embedding and payload embedding output by the dual embedding module through an attention mechanism;

[0031] Cross-gating fusion module: Based on the key features, it extracts the deep-level correlation features of each data packet through a cross-gating fusion strategy to generate a data packet representation;

[0032] Traffic interaction graph construction module: includes packet direction encoder and burst sequence divider;

[0033] Graph Neural Network Module: Contains a four-layer graph neural network and a flow interaction graph enhancement strategy module to generate robust flow-level representations;

[0034] Multi-task loss calculation module: The total loss is obtained by calculating the stream-level classification loss, packet-level classification loss, and contrast loss;

[0035] Optimization module: Includes Adam optimizer and cosine annealing scheduler, which generate multi-task encrypted traffic classification model based on total loss.

[0036] The beneficial effects of this invention include:

[0037] 1. By co-optimizing between stream-level and packet-level classification tasks, the generalization representation ability of the classification model is improved while ensuring the accuracy of classification.

[0038] 2. It addresses the shortcomings of existing deep learning-based classification models in representing encrypted traffic.

[0039] 3. It can simultaneously achieve robust flow-level classification and fine-grained packet-level classification.

[0040] 4. It achieves accurate classification of multiple tasks within the same model. Attached Figure Description

[0041] Figure 1 This is a flowchart of the multi-task encrypted traffic classification method based on dual embedding and graph contrast learning of the present invention.

[0042] Figure 2 This diagram illustrates a comparison of the classification performance of the classification method of this invention with other existing classification methods on anonymous Tor network traffic data.

[0043] Figure 3 This diagram illustrates a comparison of the classification method of the present invention with other existing classification methods on VPN traffic data.

[0044] Figure 4 This diagram illustrates a comparison of the classification method of the present invention with other existing classification methods on malware traffic data.

[0045] Figure 5 This diagram illustrates a comparison of the classification method of the present invention with other existing classification methods on the anonymous Tor network data, after the method adopts a multi-task learning strategy.

[0046] Figure 6 This diagram illustrates a comparison of the computational overhead of the classification method of this invention with other existing classification methods.

[0047] Figure 7 This diagram illustrates a comparison of the parameter quantities of the model used in the classification method of this invention with those of other existing classification methods. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0049] Example 1:

[0050] like Figure 1As shown, the present invention provides a multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning, comprising the following steps:

[0051] Building a classification model:

[0052] A. Dataset Preprocessing: Application traffic is collected to form a dataset. The traffic in this dataset is then divided into different session flows using a 5-tuple (consisting of five key parameters used to uniquely identify a network connection or data flow). Empty flows without data packets are removed. Simultaneously, information irrelevant to the classification, such as Ethernet header fields, IP addresses, and ports, is removed. The 5-tuple includes the source IP address, destination IP address, source port, destination port, and protocol type, used to uniquely identify a network connection or data flow.

[0053] B. Generate packet-level representations:

[0054] Header embedding: The header byte features of each packet in the preprocessed dataset are learned using a CNN-LSTM (Convolutional Neural Network-Long Short-Term Memory) model.

[0055] Payload embedding: Learn the payload byte features of each packet in the preprocessed dataset using a CNN-LSTM model.

[0056] The CNN-LSTM models in both the head embedding and the payload embedding include two CNN convolutional layers with 16 and 32 kernels respectively, and the hidden layers of the LSTM neural network have 32 nodes.

[0057] Key feature extraction: Key features in the header embedding and payload embedding of each data packet are extracted using an attention mechanism; the attention mechanism includes 4 headers.

[0058] Cross-gated fusion: Based on the key features, a cross-gated fusion strategy is used to extract deep-level correlated features from each data packet, such as header and payload representations in the form of local contextual semantic features, to generate a data packet representation. The cross-gated fusion strategy is an effective technique for extracting correlated features from header and payload representations, strengthening feature representation by fusing information from both.

[0059] C. Constructing a Traffic Interaction Graph: Based on the interaction between the client and server, the direction of each data packet in the preprocessed dataset is extracted to generate a data packet direction sequence. The direction determination is based on the interaction between the client and server. In this embodiment, the direction of the request packet sent by the client to the server is negative, and the direction of the response packet sent by the server to the client is positive.

[0060] A traffic interaction graph is then constructed based on the packet direction sequence and burst sequence. The burst sequence is used to represent a continuous sequence of packets with the same direction. In the traffic interaction graph, nodes within the same burst sequence are connected in the order of the packets, and nodes between adjacent burst sequences are connected in the order of the first and last packets. The nodes contain packets that represent the direction, and the edges represent the temporal relationship between the packets.

[0061] The traffic interaction graph visually presents the data packet interaction behavior between the client and the server, and intuitively reflects the communication pattern of traffic characteristics.

[0062] D. Generating Flow-Level Representation: An enhanced flow interaction graph is generated by randomly deleting nodes and edges from the flow interaction graph according to a preset ratio. This enhancement strategy simulates dynamic changes in network conditions by randomly deleting nodes and edges from the flow interaction graph at a preset ratio, which is a hyperparameter. In this embodiment, the ratio of nodes deleted from the flow interaction graph is 0.1, and the ratio of edges deleted is 0.2.

[0063] Based on the enhanced traffic interaction graph, a four-layer graph neural network model and a contrastive learning mechanism are used to learn potential common features in the traffic, extract robust flow-level features, and obtain flow-level representations. The graph neural network comprises four layers of GraphSAGE, with each layer using mean aggregation as its aggregation function, and the output layer dimension is 64. The main implementation formula is as follows:

[0064]

[0065] in, This represents the (k-1) hop neighbor set of node v. b is the feature learned by node v at the k-th layer of the network. (k) This represents the bias term of the k-th layer, which is the result after adjusting the feature transformation. σ represents the feature of node v at layer k, carrying the features of that node and its neighboring nodes. σ represents the sigmoid nonlinear activation function, used to increase the nonlinear expressive power of the model. W (k) This represents the trainable weight matrix of the k-th layer, used for feature transformation. This indicates that the k-th layer is used to calculate its own features. Contribution weight matrix, This indicates that the k-th layer is used to compute neighbor features. The contribution weight matrix, h v It is the final representation of node v after processing by a four-layer graph neural network model, N S(V) represents the set of all nodes in graph V, and u represents a node in graph V, indicating an entity in the flow interaction graph. u|(u,v) means that node u is a neighbor of node v, that is, (u,v) is an edge in graph V, indicating that there is a connection between u and v. E represents the set of edges in graph V, containing all node pairs (u,v). h G It is for N S The result of average pooling of the features of all nodes in (V) represents the feature vector of the overall graph.

[0066] Flow-level characterization is used to reflect the common characteristics and interaction patterns between traffic in the same application.

[0067] E. Generate a multi-task encrypted traffic classification model:

[0068] E1. Calculate the flow class classification loss using the cross-entropy loss function based on the flow class representation. The formula is:

[0069]

[0070] in, It is the dataset N after preprocessing the collected traffic. f The predicted label for the i-th traffic item, y f,i It is the true label of the i-th traffic.

[0071] E2. Extract packet-level representations from the flow-level representations. Based on the extracted packet-level representations, calculate the packet-level classification loss using the cross-entropy loss function. The formula is:

[0072]

[0073] in, It is the set of data packets N corresponding to the preprocessed traffic data. p The predicted label of the i-th data packet, y p,i It is the actual label of the i-th data packet.

[0074] E3. Calculate the contrastive loss based on the contrastive learning mechanism. The contrast loss is used to bring similar flows closer together and separate dissimilar flows, and the formula is:

[0075]

[0076] Where I represents the mini-batch set of all graphs, N(i) is the set of augmented views belonging to the same category as graph i (positive samples), and M(i) is the set of graphs or their views from different graphs (negative samples). n represents the positive sample corresponding to sample i, g i G represents the graphical feature vector of sample i.n g represents the graphical feature vector of the positive sample corresponding to sample i. m The graph feature vector represents the negative sample corresponding to sample i. The temperature parameter τ is a hyperparameter used to control the similarity between positive and negative samples and balance their influence in contrastive learning. In this embodiment, τ is 0.07.

[0077] E4. Calculate the total loss based on the flow-level classification loss, packet-level classification loss, and comparison loss. The weight λ of the contrastive loss is set to 0.5 during calculation to balance the contrastive loss with the flow-level and packet-level classification losses, thus preventing overfitting caused by the contrastive learning mechanism dominating. The formula is:

[0078]

[0079] E5. Based on the total loss, the Adam algorithm combined with a cosine annealing learning rate scheduling strategy is used to optimize each loss function to train the four-layer GraphSAGE graph neural network model that incorporates a contrastive learning mechanism, thereby obtaining the final multi-task encrypted traffic classification model that performs flow-level and packet-level classification of traffic in the application.

[0080] The multi-task encrypted traffic classification model integrates flow-level classification tasks and packet-level classification tasks. Through information sharing and task collaborative optimization, it can achieve accurate classification of both tasks simultaneously in the same model.

[0081] When training the multi-task encrypted traffic classification model of this invention, the datasets used can be the publicly available ISCX-Tor, ISCX-VPN, and / or USTC-TFC2016 datasets for encrypted traffic classification. The ISCX-Tor dataset was collected from the anonymous Tor network; the traffic is encrypted through multiple layers, increasing the difficulty of traffic analysis. Following official recommendations, the dataset is divided into 8 categories. The ISCX-VPN dataset was collected from VPNs, and following official recommendations, it is divided into 6 categories. The USTC-TFC2016 dataset was collected for malware and contains 10 categories of malware.

[0082] The dataset was randomly divided into training, validation, and test sets in an 8:1:1 ratio. Then, based on the training and validation sets, a multi-task collaborative optimization of classification loss at the flow and packet levels was used for model training. The packet-level and flow-level classification losses were added together and then combined with a weighted contrastive loss to obtain the total loss, thus yielding the multi-task encrypted traffic classification model. The total loss measures the model's ability to capture potential correlations between data points during training. Using the total loss for model training effectively improves the model's performance and generalization ability while optimizing feature representations. A contrastive learning mechanism was introduced to more tightly aggregate traffic from the same application within the embedded feature space, while simultaneously widening the distance between traffic representations from different applications, thereby enhancing the discriminative power and robustness of the multi-task encrypted traffic classification model.

[0083] During model testing, based on the test set, the trained multi-task encrypted traffic classification model is used to perform flow-level and packet-level classification on unknown traffic to obtain classification results.

[0084] Multi-task encrypted traffic classification:

[0085] F. Use the trained multi-task encrypted traffic classification model to classify unknown traffic at the flow level and packet level, and obtain the classification results.

[0086] The following is passed Figures 2 to 7 The measured data further illustrate the beneficial effects of the present invention.

[0087] like Figures 2 to 7 As shown, this embodiment uses accuracy (ACC) as the evaluation metric for classification assessment, while precision (PR), recall (RC), and macro F1 score (F1) are used as evaluation metrics. Simultaneously, floating-point operations per second (FLOPs) and the number of model parameters are used to evaluate the complexity of different models.

[0088] Figure 2 The results show the comparison of the classification performance of the present invention with other existing comparison methods on the ISCX-Tor dataset. Figure 3 The comparison results of the classification performance of this invention with other existing methods on the ISCX-VPN dataset are shown. Figure 4 The results show the comparison of the classification performance of the present invention with other existing comparison methods on the USTC-TFC2016 dataset.

[0089] from Figure 2 , 3As can be clearly seen from Figures 4 and 5, among all classification methods, the present invention has the highest classification performance in both flow-level and packet-level classification tasks, and has achieved the best value in all evaluation metrics, especially in packet-level classification where the difference is significant compared with other existing methods.

[0090] Figure 5 The comparison results of the classification performance of this invention with other existing methods on the ISCX-Tor dataset after introducing a multi-task learning mechanism are shown. Figure 5 As shown, the performance of packet-level classification is significantly improved when a multi-task learning mechanism is added to other comparative methods, while the performance of stream-level classification is also improved.

[0091] Figure 6 and Figure 7 The complexity of the model used in this invention is shown in comparison with other existing methods. For example... Figure 6 and Figure 7 As shown, the number of floating-point operations (FLOPs) and the number of parameters in the model of this invention are second only to the minimum value, indicating that the computational cost of the model of this invention is small while achieving the best classification performance.

[0092] Therefore, it can be concluded that the present invention has at least the following technical effects or advantages:

[0093] By defining packet-level representations, traffic interaction graphs, flow-level representations, and multi-task classification, this invention enables the simultaneous completion of both flow-level and packet-level classification tasks within a single model. This invention fully leverages the synergistic optimization and complementary advantages between flow-level and packet-level classification tasks, further optimizing the model's generalization capabilities. In multiple encrypted traffic datasets, this invention significantly improves the performance of both classification tasks, achieving robust classification of traffic from different applications. It overcomes the limitations of existing technologies and possesses strong practical value and potential for widespread adoption.

[0094] Example 2:

[0095] The present invention also provides a classification apparatus for the classification method described in Embodiment 1, comprising:

[0096] Preprocessing module: Divides the traffic in the dataset using a 5-tuple (source IP address, destination IP address, source port number, destination port number, protocol type);

[0097] Dual embedding module: includes a CNN-LSTM module for both head embedding and payload embedding;

[0098] Attention learning module: Extracts key features from the head embedding and payload embedding output by the dual embedding module through an attention mechanism;

[0099] Cross-gating fusion module: Based on the key features, it extracts the deep-level correlation features of each data packet through a cross-gating fusion strategy to generate a data packet representation;

[0100] Traffic interaction graph construction module: includes packet direction encoder and burst sequence divider;

[0101] Graph Neural Network Module: Contains a four-layer graph neural network and a flow interaction graph enhancement strategy module to generate robust flow-level representations;

[0102] Multi-task loss calculation module: The total loss is obtained by calculating the stream-level classification loss, packet-level classification loss, and contrast loss;

[0103] Optimization module: Includes Adam optimizer and cosine annealing scheduler, which generate multi-task encrypted traffic classification model based on total loss.

[0104] This invention obtains a multi-task encrypted traffic classification model by preprocessing, packet-level representation, traffic interaction graph construction, and flow-level representation of application traffic datasets. The model is trained using the total loss on the training set, and the optimal classification model is obtained based on the validation set. The model is then used to classify encrypted traffic on an unknown test set. Through collaborative optimization between flow-level and packet-level classification tasks, the generalization ability of the classification model is improved while ensuring classification accuracy. This invention solves the shortcomings of existing deep learning-based multi-task encrypted traffic classification models in encrypted traffic representation and the technical challenge of simultaneously and effectively achieving robust flow-level classification and fine-grained packet-level classification. It achieves the technical achievement of completing accurate multi-task classification within the same model.

[0105] The embodiments described above merely illustrate specific implementation methods of this application, and while the descriptions are detailed and specific, they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make relevant modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.

Claims

1. A multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning. Its features include the following steps: Building a classification model: A. Dataset preprocessing: Collect application traffic to form a dataset, divide the traffic in the dataset into different session streams using 5-tuples, and remove irrelevant information from the session streams; B. Generate packet-level representation: By performing header embedding and payload embedding on each data packet in the dataset, and fusing the features of the header embedding and payload embedding, a data packet representation is generated. C. Constructing a traffic interaction graph: Based on the interaction between the client and the server, the direction of each data packet in the preprocessed dataset is extracted to generate a data packet direction sequence. A traffic interaction graph is constructed based on the data packet direction sequence and the burst sequence, where the burst sequence is used to represent a sequence of consecutive data packets with the same direction. D. Generate flow level representation: Generate an enhanced flow interaction graph through a graph augmentation strategy. Based on the enhanced flow interaction graph, learn the potential common features in the flow using a four-layer graph neural network model and a contrastive learning mechanism, extract robust flow level features, and obtain the flow level representation. E. Generate a multi-task encrypted traffic classification model: Train a four-layer graph neural network model that incorporates a contrastive learning mechanism by optimizing the loss function through packet representation and flow level representation to obtain the final multi-task encrypted traffic classification model; Multi-task encrypted traffic classification: F. Use a multi-task encrypted traffic classification model to classify unknown traffic at the flow level and packet level, and obtain the classification results.

2. The multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning as described in claim 1, characterized in that: Step B includes: Header embedding: Learn the header byte features of each data packet in the preprocessed dataset using a CNN-LSTM model; Payload embedding: The payload byte features of each data packet in the preprocessed dataset are learned using a CNN-LSTM model; Key feature extraction: An attention mechanism is used to extract key features from the header embedding and payload embedding of each data packet respectively; Cross-gated fusion: Based on the key features, a cross-gated fusion strategy is used to extract the deep-level correlation features of each data packet and generate a data packet representation.

3. The multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning as described in claim 1, characterized in that: In the traffic interaction graph described in step C, nodes within the same burst sequence are connected in the order of data packets, and nodes between adjacent burst sequences are connected in the order of the first and last data packets. Each node contains a data packet representation and direction, and the edges represent the temporal relationship between data packets.

4. The multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning as described in claim 3, characterized in that: The graph enhancement strategy described in step D is used to simulate the dynamic changes in network conditions. It randomly deletes nodes and edges in the traffic interaction graph according to a preset ratio, which is a hyperparameter.

5. The multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning as described in claim 1, characterized in that: In step E, the flow-level classification loss and packet-level classification loss are calculated using a loss function, and the contrastive loss is calculated based on the contrastive learning mechanism. The flow-level classification loss, packet-level classification loss, and weighted contrastive loss are then added together to obtain the total loss. The four-layer graph neural network model is then optimized based on the total loss.

6. The multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning as described in claim 5, characterized in that: When calculating the packet-level classification loss, the packet-level representation is extracted from the flow-level representation, and the packet-level classification loss is calculated based on the extracted packet-level representation.

7. The multi-task encrypted traffic classification method based on dual embedding and graph contrastive learning as described in claim 1, characterized in that: In step E, the Adam algorithm is used in conjunction with a cosine annealing learning rate scheduling strategy to optimize the loss function.

8. A classification apparatus for the multi-task encrypted traffic classification method based on dual embedding and graph contrast learning as described in any one of claims 1 to 7, characterized in that, include: Preprocessing module: Divides the traffic in the dataset using quintuples; Dual embedding module: includes a CNN-LSTM module for both head embedding and payload embedding; Attention learning module: Extracts key features from the head embedding and payload embedding output by the dual embedding module through an attention mechanism; Cross-gating fusion module: Based on the key features, it extracts the deep-level correlation features of each data packet through a cross-gating fusion strategy to generate a data packet representation; Traffic interaction graph construction module: includes packet direction encoder and burst sequence divider; Graph Neural Network Module: Contains a four-layer graph neural network and a flow interaction graph enhancement strategy module to generate robust flow-level representations; Multi-task loss calculation module: The total loss is obtained by calculating the stream-level classification loss, packet-level classification loss, and contrast loss; Optimization module: Includes Adam optimizer and cosine annealing scheduler, which generate multi-task encrypted traffic classification model based on total loss.

Images