Network intrusion traffic detection method and system based on incremental learning

Abstract

The invention discloses a network intrusion traffic detection method based on incremental learning. The method comprises the following steps: constructing a multi-dimensional time sequence feature; arranging the multi-dimensional time sequence features according to a time sequence to form a time sequence feature matrix; inputting the time sequence feature matrix into a pre-trained first malicious traffic detection model, and outputting category probability distribution of traffic samples; performing second malicious traffic detection model training based on an incremental learning task, and aligning the second malicious traffic detection model training with the first malicious traffic detection model by using the category probability distribution of the output traffic sample, and optimizing the performance of the second malicious traffic detection model; and detecting the network traffic by taking the optimized second malicious traffic detection model as a final malicious traffic detection model to obtain a malicious traffic detection result. According to the invention, high-efficiency malicious traffic detection is realized.

Description

Technical Field

[0001] The present invention relates to the field of malicious traffic detection, and specifically, to a method and system for detecting network intrusion traffic based on incremental learning. Background Art

[0002] With the increase in the complexity of network traffic and the diversification of network attack forms, malicious traffic detection has become a research hotspot in the field of network security. When facing new types of malicious traffic, traditional static training models often need to retrain or update the full model, resulting in waste of time and resources, and at the same time, the problem of "catastrophic forgetting" may occur, that is, the model forgets the learned knowledge when learning new tasks. Therefore, proposing a class incremental learning method that can dynamically adapt to new tasks and retain the knowledge of old tasks is an important way to improve the ability of malicious traffic detection.

[0003] The Chinese patent application with the application number 202310540038.7 discloses "A method, device, equipment and computer-readable storage medium for detecting malicious traffic". The method includes: respectively inputting the traffic data to be detected into different malicious traffic detection models to obtain multiple preliminary detection results, where each malicious traffic detection model is respectively trained based on different malicious traffic adversarial sample sets; obtaining the comprehensive detection result of the traffic data to be detected based on each preliminary detection result and the similarity between each preliminary detection result. This method does not solve the problem of "catastrophic forgetting" in the traditional method, and the detection method of multiple models has technical problems of low detection efficiency and high memory occupancy rate. Summary of the Invention

[0004] To solve the technical problems in the existing technology of malicious traffic detection that when facing new types of malicious traffic, it often needs to retrain or update the full model, resulting in waste of time and resources, and at the same time, the problem of "catastrophic forgetting" may occur, the present invention provides a method and system for detecting network intrusion traffic based on incremental learning. The technical solution adopted by the present invention is:

[0005] The first aspect of the present invention provides a method for detecting network intrusion traffic based on incremental learning, and the method includes:

[0006] Construct multi-dimensional time series features;

[0007] Arrange the multi-dimensional time series features in chronological order to form a time series feature matrix;

[0008] Input the time series feature matrix into a pre-trained first malicious traffic detection model, and output the class probability distribution of the traffic sample;

[0009] Train the second malicious traffic detection model based on the incremental learning task, and align the training of the second malicious traffic detection model with the first malicious traffic detection model by using the class probability distribution of the output traffic samples to optimize the performance of the second malicious traffic detection model;

[0010] Use the optimized second malicious traffic detection model as the final malicious traffic detection model to detect network traffic and obtain the malicious traffic detection result.

[0011] As a preferred solution, before constructing the multi-dimensional time series features, it further includes:

[0012] Divide different types of malicious samples according to the public dataset, and set the class incremental learning task T = [T 1 , T 2 , T 3 , T 4 , where T 1 includes benign network traffic and one type of malicious network traffic, and T 2 adds two new types of malicious network traffic in addition to the benign traffic and malicious traffic types in T 1 . Similarly, T 3 adds two new types of malicious network traffic in addition to the benign traffic and malicious traffic types in T 2 , and T 4 adds two new types of malicious network traffic in addition to the benign traffic and malicious traffic types in T 3 .

[0013] As a preferred solution, the method for constructing multi-dimensional time series features includes:

[0014] Extract features from the network traffic data to obtain multi-dimensional time series features, and represent each traffic sample as a matrix X ∈ R k×l , where k represents the feature dimension and l represents the fixed time series length.

[0015] As a preferred solution, the multi-dimensional time series features include:

[0016] The number of bytes of traffic per second, the time interval between packet arrivals, the distributions of source IP address and destination IP address, TCP / UDP port distribution, and traffic protocol type.

[0017] As a preferred solution, the method for inputting the time series feature matrix into the pre-trained first malicious traffic detection model and outputting the class probability distribution of the traffic samples includes:

[0018] Extract features from the time series feature matrix X ∈ R k×l and transform it into a sequence feature map F(X);

[0019] Convert the sequence feature map F(X) into a feature vector of a fixed dimension;

[0020] Input the feature vector of the fixed dimension into a pre-trained classifier for classification, and output the class probability distribution of the traffic sample.

[0021] As a preferred solution, the method for converting the sequence feature map into a feature vector of a fixed dimension includes:

[0022] Vectorize the sequence feature map F(X) along the time dimension to generate a feature vector of a fixed dimension:

[0023]

[0024] where l' is the sequence length after downsampling.

[0025] As a preferred solution, the method for inputting the feature vector of the fixed dimension into a pre-trained classifier for classification and outputting the class probability distribution of the traffic sample includes:

[0026] Use a fully connected layer as the classifier h to map the feature vector V(X) to the class probability distribution ∈R n+1 , where n + 1 represents n malicious traffic classes and 1 benign traffic class;

[0027] The training method of the classifier includes:

[0028] Use the cross-entropy loss function L CE to optimize the classification performance, and its formula is:

[0029]

[0030] where N is the number of samples, y i is the true class label, is the predicted probability distribution.

[0031] As a preferred solution, the method for training the second malicious traffic detection model based on the incremental learning task and aligning the training of the second malicious traffic detection model with the first malicious traffic detection model by using the class probability distribution of the output traffic sample to optimize the performance of the second malicious traffic detection model includes:

[0032] During the training of the current model, use Soft-DTW to align the sequence feature maps of the current model f t and the old model f o , and calculate the alignment loss function where dtw γ (·, ·) is the Soft-DTW alignment distance, and the formula is: D(A i , B j ) = |A i - B j | 2 is the Euclidean distance, and π is the alignment path;

[0033] Guided by the class probability distribution of the first malicious traffic detection model, optimize through the temporal knowledge distillation cross-entropy loss L LwF as follows: where τ is a temporal parameter used to smooth the probability distribution;

[0034] Calculate the feature prototype μ of each class c , generate pseudo-samples for calibrating the classifier, and further improve the model performance by optimizing the pseudo-sample classification loss ; among them, the feature prototype μ of each class c is represented by calculating from class samples: The pseudo-samples are generated by the feature prototype and standard normal distribution random noise where r is the enhancement radius, z is the standard normal distribution random noise, and the enhancement radius r is dynamically adjusted by the following formula:

[0035] Integrate the above losses into the total loss function L = L CE + λ 1 L DTW + λ 2 L LwF + λ 3 L proto , where λ 1 , λ 2 , λ 3 are weight hyperparameters determined by cross-validation;

[0036] Optimize the total loss function L using stochastic gradient descent or the Adam optimizer, dynamically adjust the learning rate and loss weights during the training process, and finally achieve the optimization of the performance of the second malicious traffic detection model.

[0037] The second aspect of the present invention provides a network intrusion traffic detection system based on incremental learning, and the system includes a multi-dimensional time series feature construction module, a time series feature matrix construction module, a class probability distribution output module, a model alignment optimization module, and a malicious traffic detection module;

[0038] The multi-dimensional time series feature construction module is used to construct multi-dimensional time series features;

[0039] The time series feature matrix construction module is used to arrange the multi-dimensional time series features in chronological order to form a time series feature matrix;

[0040] The class probability distribution output module is configured to input the time series feature matrix into a pre-trained first malicious traffic detection model, and output the class probability distribution of the traffic sample;

[0041] The model alignment and optimization module is configured to train a second malicious traffic detection model based on an incremental learning task, and align the training of the second malicious traffic detection model with the first malicious traffic detection model by using the class probability distribution of the output traffic sample, so as to optimize the performance of the second malicious traffic detection model;

[0042] The malicious traffic detection module is configured to use the optimized second malicious traffic detection model as the final malicious traffic detection model to detect network traffic, and obtain the malicious traffic detection result.

[0043] As a preferred solution, the class probability distribution output module includes a sequence feature map generation module, a feature vector generation module, and a classification module;

[0044] The sequence feature map generation module is configured to perform feature extraction on the time series feature matrix X∈R k×l and convert it into a sequence feature map;

[0045] The feature vector generation module is configured to convert the sequence feature map F(X) into a feature vector with a fixed dimension;

[0046] The classification module is configured to input the feature vector with a fixed dimension into a pre-trained classifier for classification, and output the class probability distribution of the traffic sample;

[0047] Wherein the sequence feature map generation module includes a first convolutional block, a second convolutional block, and a third convolutional block connected in sequence; each convolutional block includes a convolutional layer, a batch normalization layer, and a max pooling layer, and the convolutional kernel sizes of the first convolutional block, the second convolutional block, and the third convolutional block are 1×5, 1×5, and 1×3 in sequence.

[0048] Compared with the prior art, the beneficial effects of the present invention are:

[0049] The present invention provides a class incremental learning method applicable to network malicious traffic detection. Through steps such as time series feature construction, feature extraction and classifier design initialization, sequence feature alignment and knowledge distillation, and feature prototype generation of pseudo samples, dynamic incremental learning of network traffic is realized, which can effectively solve the "catastrophic forgetting" problem in traditional methods, and improve the accuracy and efficiency of malicious traffic detection at the same time. Description of the Drawings

[0050] Figure 1Flowchart of a network intrusion traffic detection method based on incremental learning provided in this embodiment;

[0051] Figure 2 Overall framework diagram of a network intrusion traffic detection method based on incremental learning provided in this embodiment. Detailed implementation manners

[0052] The accompanying drawings are only for illustrative purposes and should not be construed as limiting the present invention;

[0053] It should be clear that the described embodiments are only a part of the embodiments of the present application, rather than all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative efforts belong to the scope protected by the embodiments of the present application.

[0054] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the embodiments of the present application. The singular forms "a", "the", and "said" used in the embodiments of the present application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0055] When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims. In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and do not have to be used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to specific circumstances.

[0056] In addition, in the description of the present application, unless otherwise specified, "a plurality of" means two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally represents an "or" relationship between the associated objects before and after. The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0057] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0058] Embodiment 1

[0059] Please refer to Figure 1 and Figure 2 , this embodiment provides a network intrusion traffic detection method based on incremental learning, and the method includes:

[0060] S1: Construct multi-dimensional time series features;

[0061] In a specific embodiment, before constructing the multi-dimensional time series features, it further includes:

[0062] Divide different categories of malicious samples according to the public dataset, and set the class incremental learning task T = [T 1 , T 2 , T 3 , T 4 , where T 1 includes benign network traffic and one type of malicious category network traffic, T 2 except for the benign traffic and malicious category traffic in T 1 , adds two types of malicious network traffic, and successively, T 3 except for the benign traffic and malicious category traffic in T 2 , adds two types of malicious network traffic, T 4 except for the benign traffic and malicious category traffic in T 3 , adds two types of malicious network traffic.

[0063] In a specific embodiment, the method for constructing multi-dimensional time series features includes:

[0064] Extract features from the network traffic data to obtain multi-dimensional time series features, and represent each traffic sample as a matrix X ∈ R k×l , where k represents the feature dimension and l represents the fixed time series length.

[0065] In a specific embodiment, the multi-dimensional time series features include:

[0066] Bytes of traffic per second, packet arrival time interval, distribution of source IP address and destination IP address, TCP / UDP port distribution, traffic protocol type.

[0067] S2: Arrange the multi-dimensional time series features in chronological order to form a time series feature matrix;

[0068] S3: Input the time series feature matrix into a pre-trained first malicious traffic detection model to output the class probability distribution of the traffic sample;

[0069] In a specific embodiment, the method of inputting the time series feature matrix into a pre-trained first malicious traffic detection model to output the class probability distribution of traffic samples includes:

[0070] Performing feature extraction on the time series feature matrix \(X\in R\) k×l to convert it into a sequence feature map \(F(X)\);

[0071] Converting the sequence feature map \(F(X)\) into a feature vector of a fixed dimension;

[0072] Inputting the feature vector of the fixed dimension into a pre-trained classifier for classification to output the class probability distribution of the traffic samples.

[0073] In a specific embodiment, the method of converting the sequence feature map into a feature vector of a fixed dimension includes:

[0074] Vectorizing the sequence feature map \(F(X)\) along the time dimension to generate a feature vector of a fixed dimension:

[0075]

[0076] where \(l'\) is the sequence length after downsampling.

[0077] In a specific embodiment, the method of inputting the feature vector of the fixed dimension into a pre-trained classifier for classification to output the class probability distribution of the traffic samples includes:

[0078] Using a fully connected layer as the classifier \(h\) to map the feature vector \(V(X)\) to the class probability distribution \(\in R\) n+1 , where \(n + 1\) represents \(n\) malicious traffic classes and 1 benign traffic class;

[0079] The training method of the classifier includes:

[0080] Using the cross-entropy loss function \(L\) CE to optimize the classification performance, and its formula is:

[0081]

[0082] where \(N\) is the number of samples, \(y\) i is the true class label, is the predicted probability distribution.

[0083] S4: Training a second malicious traffic detection model based on an incremental learning task, and aligning the training of the second malicious traffic detection model with the first malicious traffic detection model by using the class probability distribution of the output traffic samples to optimize the performance of the second malicious traffic detection model;

[0084] In a specific embodiment, a method for training a second malicious traffic detection model based on an incremental learning task and aligning the training of the second malicious traffic detection model with the first malicious traffic detection model by using the class probability distribution of the output traffic samples to optimize the performance of the second malicious traffic detection model includes:

[0085] During the training of the current model, use Soft-DTW to align the sequence feature maps of the current model f t and the old model f o to calculate the alignment loss function where dtw γ (·, ·) is the Soft-DTW alignment distance, and the formula is: D(A i , B j ) = |A i -B j | 2 is the Euclidean distance, and π is the alignment path;

[0086] Use the class probability distribution of the first malicious traffic detection model as a guide and optimize through the temporal knowledge distillation cross-entropy loss L LwF : where τ is the temporal parameter used to smooth the probability distribution;

[0087] Calculate the feature prototype μ c for each class, generate pseudo-samples for calibrating the classifier, and further improve the model performance by optimizing the pseudo-sample classification loss ; among them, the feature prototype μ c for each class is calculated through class samples: The pseudo-samples are generated by the feature prototype and standard normal distribution random noise where r is the augmentation radius, z is the standard normal distribution random noise, and the augmentation radius r is dynamically adjusted by the following formula:

[0088] Integrate the above losses into the total loss function L = L CE +λ 1 L DTW +λ 2 L LwF +λ 3 L proto , where λ 1 , λ 2 , λ 3 are weight hyperparameters determined by cross-validation;

[0089] Optimize the total loss function L using Stochastic Gradient Descent or the Adam optimizer, dynamically adjust the learning rate and loss weights during the training process, and finally optimize the performance of the second malicious traffic detection model.

[0090] S5: Use the optimized second malicious traffic detection model as the final malicious traffic detection model to detect network traffic and obtain the malicious traffic detection result.

[0091] Embodiment 2

[0092] This embodiment provides a network intrusion traffic detection system based on incremental learning. The system includes a multi-dimensional time series feature construction module, a time series feature matrix construction module, a class probability distribution output module, a model alignment optimization module, and a malicious traffic detection module.

[0093] The multi-dimensional time series feature construction module is used to construct multi-dimensional time series features.

[0094] The time series feature matrix construction module is used to arrange the multi-dimensional time series features in chronological order to form a time series feature matrix.

[0095] The class probability distribution output module is used to input the time series feature matrix into a pre-trained first malicious traffic detection model and output the class probability distribution of traffic samples.

[0096] The model alignment optimization module is used to train a second malicious traffic detection model based on an incremental learning task, and align the training of the second malicious traffic detection model with the first malicious traffic detection model using the output class probability distribution of traffic samples to optimize the performance of the second malicious traffic detection model.

[0097] The malicious traffic detection module is used to use the optimized second malicious traffic detection model as the final malicious traffic detection model to detect network traffic and obtain the malicious traffic detection result.

[0098] In a specific embodiment, the class probability distribution output module includes a sequence feature map generation module, a feature vector generation module, and a classification module.

[0099] The sequence feature map generation module is used to perform feature extraction on the time series feature matrix X ∈ R k×l and convert it into a sequence feature map.

[0100] The feature vector generation module is used to convert the sequence feature map F(X) into a feature vector with a fixed dimension.

[0101] The classification module is used to input the feature vectors of a fixed dimension into a pre-trained classifier for classification, and output the class probability distribution of the traffic samples;

[0102] The sequence feature map generation module includes a first convolutional block, a second convolutional block, and a third convolutional block connected in sequence; each convolutional block includes a convolutional layer, a batch normalization layer, and a max pooling layer, and the convolutional kernel sizes of the first convolutional block, the second convolutional block, and the third convolutional block are 1×5, 1×5, and 1×3 in sequence.

[0103] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, rather than limiting the implementation manners of the present invention. For those of ordinary skill in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to enumerate all the implementation manners here. Any modifications, equivalent replacements, and improvements made within the spirit and principle of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A network intrusion traffic detection method based on incremental learning, characterized in that: The method comprises: Construct multi-dimensional time series features; Arranging the multidimensional time series features in chronological order to form a time series feature matrix; Inputting the time series feature matrix into a pre-trained first malicious traffic detection model, and outputting a category probability distribution of the traffic samples; Performing training of a second malicious traffic detection model based on an incremental learning task, and aligning the training of the second malicious traffic detection model with the first malicious traffic detection model using the category probability distribution of the output traffic sample, thereby optimizing the performance of the second malicious traffic detection model; The optimized second malicious traffic detection model is used as the final malicious traffic detection model to detect network traffic and obtain malicious traffic detection results.

2. According to claim 1, a network intrusion traffic detection method based on incremental learning is characterized in that: Before constructing multidimensional time series features, it also includes: According to the public data set, different categories of malicious samples are divided, and the class incremental learning task T = [T 1 , T 2 , T 3 , T 4 ], where T 1 Including benign network traffic and a malicious category of network traffic, T 2 Except T 1 In addition to the benign traffic and malicious traffic in the above, two new types of malicious network traffic are added. 3 Except T 2 In addition to the benign traffic and malicious traffic in the above, two new types of malicious network traffic are added: 4 Except T 3 In addition to the benign traffic and malicious traffic categories in the , two new categories of malicious network traffic are added.

3. According to the incremental learning-based network intrusion traffic detection method of claim 1, it is characterized in that: Methods for constructing multidimensional time series features include: Extract features from network traffic data to obtain multidimensional time series features, and represent each traffic sample as a matrix X∈R k×l , where k represents the feature dimension and l represents the fixed time series length.

4. A network intrusion traffic detection method based on incremental learning according to claim 3, characterized in that: The multidimensional time series features include: Number of traffic bytes per second, packet arrival time interval, distribution of source and destination IP addresses, TCP / UDP port distribution, and traffic protocol type.

5. According to the incremental learning-based network intrusion traffic detection method of claim 1, it is characterized in that: The method of inputting the time series feature matrix into a pre-trained first malicious traffic detection model and outputting the category probability distribution of the traffic sample includes: For the time series feature matrix X∈R k×l Perform feature extraction and convert it into a sequence feature graph F(X); Convert the sequence feature graph F(X) into a feature vector of fixed dimension; The fixed-dimensional feature vector is input into the pre-trained classifier for classification, and the category probability distribution of the traffic sample is output.

6. A network intrusion traffic detection method based on incremental learning according to claim 5, characterized in that: The method of converting the sequence feature graph into a feature vector of fixed dimension comprises: Vectorize the sequence feature graph F(X) along the time dimension to generate a feature vector of fixed dimension: Among them, l' is the length of the sequence after downsampling.

7. A network intrusion traffic detection method based on incremental learning according to claim 5, characterized in that: The method of inputting a fixed-dimensional feature vector into a pre-trained classifier for classification and outputting the class probability distribution of the traffic sample includes: Use a fully connected layer as the classifier h to map the feature vector V(X) to the category probability distribution Where n+1 represents n malicious traffic categories and 1 benign traffic category; The training method of the classifier comprises: Use the cross entropy loss function L CE Optimize classification performance, the formula is: Where N is the number of samples, y i is the true category label, is the predicted probability distribution.

8. The network intrusion traffic detection method based on incremental learning according to claim 1 is characterized in that: The method of training a second malicious traffic detection model based on an incremental learning task, and aligning the training of the second malicious traffic detection model with the first malicious traffic detection model using the category probability distribution of the output traffic sample, and optimizing the performance of the second malicious traffic detection model includes: When the current model is trained, Soft-DTW is used to align the current model f t And the old model f o Sequence feature graph of , calculate the alignment loss function Among them, dtw γ (·,·) is the Soft-DTW alignment distance, and the formula is: D(A i ,B j )=|A i -B j | 2 is the Euclidean distance, π is the alignment path; Using the category probability distribution of the first malicious traffic detection model as a guide, the cross entropy loss L is used through time knowledge distillation. LwF To optimize: Where τ is the time parameter, which is used to smooth the probability distribution; Calculate the feature prototype μ for each category c , generate pseudo samples for calibrating the classifier, and optimize the pseudo sample classification loss Further improve the model performance; among them, the feature prototype μ of each category c Calculate the representation by category samples: The pseudo samples are generated by using the feature prototype and standard normal distribution random noise f c =μ c +r·z, Among them, r is the enhancement radius, z is the standard normal distribution random noise, and the enhancement radius r is dynamically adjusted by the following formula: The above losses are integrated into the total loss function L = L CE +λ1L DTW +λ2L LwF +λ3L proto , where λ1, λ2, λ3 are weight hyperparameters, determined by cross-validation; Use stochastic gradient descent or Adam optimizer to optimize the total loss function L, dynamically adjust the learning rate and loss weight during training, and ultimately optimize the performance of the second malicious traffic detection model.

9. A network intrusion traffic detection system based on incremental learning, characterized in that: The system includes a multi-dimensional time series feature construction module, a time series feature matrix construction module, a category probability distribution output module, a model alignment optimization module and a malicious traffic detection module; The multidimensional time series feature construction module is used to construct multidimensional time series features; The time series feature matrix construction module is used to arrange the multi-dimensional time series features in chronological order to form a time series feature matrix; The category probability distribution output module is used to input the time series feature matrix into the pre-trained first malicious traffic detection model and output the category probability distribution of the traffic sample; The model alignment optimization module is used to train the second malicious traffic detection model based on the incremental learning task, and align the second malicious traffic detection model training with the first malicious traffic detection model using the category probability distribution of the output traffic sample to optimize the performance of the second malicious traffic detection model; The malicious traffic detection module is used to detect network traffic using the optimized second malicious traffic detection model as the final malicious traffic detection model to obtain a malicious traffic detection result.

10. A network intrusion traffic detection system based on incremental learning according to claim 9, characterized in that: The category probability distribution output module includes a sequence feature graph generation module, a feature vector generation module and a classification module; The sequence feature graph generation module is used to generate the time series feature matrix X∈R k×l Perform feature extraction and convert it into a sequence feature graph; The feature vector generation module is used to convert the sequence feature graph F(X) into a feature vector of fixed dimension; The classification module is used to input the feature vector of fixed dimension into the pre-trained classifier for classification, and output the category probability distribution of the traffic sample; The sequence feature map generation module includes a first convolution block, a second convolution block and a third convolution block connected in sequence; each convolution block includes a convolution layer, a batch normalization layer and a maximum pooling layer, and the convolution kernel sizes of the first convolution block, the second convolution block and the third convolution block are 1×5, 1×5 and 1×3 respectively.

Images