An efficient open set encrypted traffic identification method for super large scale traffic

Abstract

The application discloses a high-efficiency open-set encrypted traffic identification method for super-large-scale traffic, relates to the technical field of data security, and solves the technical problems of the deficiencies of the prior art in resource efficiency, feature expression and open-set identification, and comprises the following steps: S1. inputting a network traffic data set, and generating reduced dimension data of an optimal dimension through a PCA dimension reduction algorithm; S2. inputting the reduced dimension data of the optimal dimension into an improved MobileNetV3 model, combining a composite structure of an improved SE attention mechanism, a Dense connection and a residual connection, extracting features and outputting a classification result; S3. using a confidence-based open-set identification algorithm to determine whether the classification result belongs to a known category, a drift sample or an unknown category; and S4. if the classification result is a drift sample or an unknown category, starting knowledge distillation-based incremental learning, updating parameters of the improved MobileNetV3 model and retaining old knowledge. The application can effectively improve the network security protection capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to an efficient open-set encrypted traffic identification method for super-large-scale traffic. BACKGROUND

[0002] With the popularization of network encryption technology, encrypted traffic has become the mainstream of network communication. According to the Google Transparency Report, as of 2023, encrypted HTTPS traffic accounts for more than 95% of total network traffic. Encrypted traffic classification technology analyzes the statistical characteristics of traffic (such as packet length distribution, flow duration, arrival time interval, etc.) to identify traffic behavior types, which is the key to ensuring network security. However, traditional encrypted traffic classification methods face two major challenges:

[0003] High computational resource requirement: Complex deep learning models (such as ResNet, VGG) perform well in feature extraction and classification, but their high computational resource requirement (for example, ResNet-50 requires 2.35 billion floating-point operations) limits their application in resource-constrained scenarios (such as edge computing, Internet of Things).

[0004] Insufficient adaptability to dynamic network environment: Traffic features often change dynamically (class drift) in actual network environments, and new types of attack traffic constantly appear, which poses a major challenge to static classification models.

[0005] To address the high computational cost of deep learning models, lightweight models (such as MobileNet, ShuffleNet) have become a research hotspot. These models achieve a reduction in computational complexity through the following techniques: Deep separable convolution decomposes standard convolution into depthwise convolution and pointwise convolution, significantly reducing parameter quantity and computational overhead. Network architecture search (NAS) searches for the best model structure to achieve similar performance to complex models with less resource requirement. Attention mechanism SE module (Squeeze-and-Excitation) improves the model's focus on key information by redistributing the weights of feature channels.

[0006] To address the class drift and new class problems in dynamic network environments, incremental learning and open-set identification techniques have been gradually applied to encrypted traffic classification tasks. Incremental learning aims to learn new classes without forgetting old classes, and open-set identification identifies unknown classes through confidence analysis. These two techniques provide a new direction for dynamic encrypted traffic classification, but existing methods still have limitations in efficiency and classification performance. SUMMARY

[0007] To solve the technical problems of resource efficiency, feature expression and open set identification in the prior art, the present application provides an efficient open set encrypted traffic identification method for super large-scale traffic, comprising:

[0008] S1. Input the network traffic dataset, and generate the optimal dimension of the reduced dimension data by the PCA dimension reduction algorithm;

[0009] S2. Input the optimal dimension of the reduced dimension data into the improved MobileNetV3 model, extract the features and output the classification result;

[0010] S3. Use the confidence-based open set identification algorithm to determine whether the classification result belongs to the known class, the drift sample or the unknown class;

[0011] S4. If the classification result is a drift sample or an unknown class, start the knowledge distillation-based incremental learning, update the parameters of the improved MobileNetV3 model and retain the old knowledge.

[0012] Further, S1 specifically comprises the following steps:

[0013] S11. Initialize the network traffic dataset;

[0014] S12. Check whether the initial dimension is greater than 10, if the initial dimension is greater than 10, set the score to 0 and set the current reduced dimension target dimension i to 10, then execute the next step, otherwise, end the process and perform performance verification on the optimal dimension of the reduced dimension data;

[0015] S13. Select i as the dimension reduction target for analysis;

[0016] S14. Detect whether the selected i dimension is sufficient to retain the information of the original data by calculating the variance explained rate, if the variance explained rate is less than 0.99 and does not meet the requirements, the dimension is not suitable for dimension reduction, and S18 is directly executed; if the condition is met, the next step is continued;

[0017] S15. Ensure that the original data is not modified by the deep copy method, and then apply the dimension reduction operation to obtain the dimension reduction dataset;

[0018] S16. Divide the dimension reduction dataset into a training set and a test set;

[0019] S17. Use the LMCA network to extract features and classify the dimension reduction dataset;

[0020] S18. Calculate and record the accuracy, F1 score, model size and inference time of the LMCA network under this dimension reduction configuration, and then return to step S13 to select a new i value;

[0021] S19. Among all the different i-value configurations tried, compare the score in each case and select the optimal configuration scheme from them;

[0022] S110. Perform final performance verification on the data of the optimal configuration scheme.

[0023] Further, in S2, the improved MobileNetV3 model includes:

[0024] The initial feature extraction layer uses a 3x3 convolution kernel to expand the input channel from 1 to 16, combined with BatchNorm2d and HSwish activation function, to maintain the spatial resolution of the original features;

[0025] The feature learning backbone is composed of 8 MobileBottleneck modules in series, gradually adjusting the channel number to 16, 24, 40 and 80, and selectively using SE attention mechanism to enhance feature extraction capability;

[0026] The feature enhancement layer expands the channel number from 80 to 160 through 1x1 convolution, further fuses and enhances the features;

[0027] The global feature modeling layer uses adaptive average pooling to compress the 3x3 feature map to 1x1, extracting global context information;

[0028] The classification head uses a three-layer fully connected network structure, with a dimension decreasing design of 160→128→64→11, outputting the probability distribution of 11 classes.

[0029] Further, in S3, the confidence-based open-set recognition algorithm includes:

[0030] S31. Define confidence analysis to calculate the confidence level of the model in classifying samples;

[0031] S32. Define a confidence threshold to determine the boundary value between known classes, drift samples or unknown classes;

[0032] S33. Define confidence drift detection to identify drift samples and unknown classes through dynamic threshold selection;

[0033] S34. Define a composite detection index combining drift ratio and original sample loss rate to evaluate the recognition performance of the model.

[0034] Further, in S4, the knowledge distillation-based incremental learning includes:

[0035] S41. Define an incremental learning total loss function combining knowledge distillation loss and weighted cross-entropy loss to balance old knowledge and new class learning;

[0036] S42. Defining a feature attention mechanism to enhance the focus on key features by weighting the input features;

[0037] S43. Using a class drift incremental learning algorithm to solve the problem of classification performance decline caused by class feature drift through knowledge distillation and feature attention mechanism;

[0038] S44. Using a new class incremental learning algorithm to improve the classification performance of new classes by modeling new class features independently and fusing them with old model features.

[0039] The beneficial effects of the present application are as follows:

[0040] The present application proposes an efficient open set encrypted traffic identification method for super large scale traffic. First, a differentiated feature drift generation strategy is designed, and a feature scaling method is used for DoS type attacks, and Gaussian noise disturbance is used for noise sensitive classes, effectively simulating the feature changes of different types of traffic. Second, an open set identification mechanism is established based on confidence analysis, and the drift samples and unknown classes are accurately identified through fine-grained threshold selection. Finally, combined with the incremental learning mechanism of knowledge distillation and feature fusion, through the design of the feature extraction module and the weighted knowledge distillation strategy, efficient learning of the drift class and the new class is realized. While maintaining low resource consumption, the adaptability of the model in the open set environment is significantly improved, providing an effective solution for encrypted traffic classification in a lightweight network environment. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 It is an efficient open set encrypted traffic identification method flowchart for super large scale traffic;

[0042] Figure 2 It is a dimensionality reduction algorithm flowchart based on PCA;

[0043] Figure 3 It is an encrypted traffic identification flowchart;

[0044] Figure 4 It is an extended MobileNet architecture channel diagram. DETAILED DESCRIPTION

[0045] In order to make the technical solutions and advantages in the embodiments of the present application clearer, the following will further describe the exemplary embodiments of the present application in conjunction with the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0046] Embodiment 1: Refer to Figures 1-4The embodiment illustrates a high-efficiency open-set encrypted traffic identification method for super-large-scale traffic, comprising the following steps:

[0047] S1. Input a network traffic dataset, and generate dimension-reduced data of an optimal dimension by a PCA dimension-reduction algorithm;

[0048] S2. Input the dimension-reduced data of the optimal dimension into an improved MobileNetV3 model, combine an improved SE attention mechanism, a Dense connection and a residual connection composite structure, extract features and output a classification result;

[0049] S3. Use a confidence-based open-set identification algorithm to determine whether the classification result belongs to a known class, a drift sample or an unknown class;

[0050] S4. If the classification result is a drift sample or an unknown class, start knowledge distillation-based incremental learning, update parameters of the improved MobileNetV3 model and retain old knowledge.

[0051] In combination with Figure 1 It can be known that the present application proposes an efficient and adaptable innovative method for network traffic classification and incremental learning scenarios. Based on the improved MobileNetV3 network, the propagation efficiency of deep features is enhanced by combining the Dense connection and the residual connection structure, and the improved SE attention mechanism is combined to improve the perception ability of the model to key features, so that the lightweight design is realized while ensuring high precision, and the method is suitable for large-scale encrypted traffic detection. For the class drift and new class problems in incremental learning, the present application introduces the knowledge distillation and class weight mechanism to balance the old class knowledge memory and the new class learning, and designs the feature attention mechanism and the feature fusion strategy to further improve the adaptability and classification performance of the model to complex feature distribution. In addition, the open-set identification method based on confidence analysis is used to realize efficient detection of class drift and new class samples, and the robustness of the model in unknown scenarios is enhanced.

[0052] S1 specifically comprises the following steps:

[0053] S11. Initialize the network traffic dataset;

[0054] S12. Check whether the initial dimension is greater than 10, if the initial dimension is greater than 10, set the score to 0 and set the current dimension reduction target dimension i to 10, then execute the next step, otherwise, end the process and perform performance verification on the dimension-reduced data of the optimal dimension;

[0055] S13. Select i as the dimension reduction target for analysis;

[0056] S14. Detect whether the selected i-dimension is sufficient to retain the information of the original data by calculating the variance explanation rate. If the variance explanation rate is less than 0.99 and does not meet the requirement, the dimension is not suitable for dimension reduction, and S18 is directly executed; if the condition is met, the next step is continued;

[0057] S15. Ensure that the original data is not modified by deep copy method, and then apply dimension reduction operation to obtain the dimension-reduced data set;

[0058] S16. Divide the dimension-reduced data set into training set and test set;

[0059] S17. Perform feature extraction and classification on the dimension-reduced data set using the LMCA network;

[0060] S18. Calculate and record the accuracy, F1 score, model size and inference time of the LMCA network under this dimension reduction configuration, and then return to step S13 to select a new i value;

[0061] S19. Among all the different i value configurations tried, compare the score in each case to select the optimal configuration scheme;

[0062] S110. Perform final performance verification on the data of the optimal configuration scheme.

[0063] Specifically, in combination with Figure 1 It can be seen that S1 processes the network traffic data set by PCA dimension reduction algorithm to generate dimension-reduced data of optimal dimension, providing more efficient and more informative input for subsequent classification model, and reducing computational overhead.

[0064] In S2, the improved MobileNetV3 model includes:

[0065] The initial feature extraction layer uses a 3x3 convolution kernel to expand the input channel from 1 to 16, and cooperates with BatchNorm2d and HSwish activation function to maintain the spatial resolution of the original features;

[0066] The feature learning backbone is composed of 8 MobileBottleneck modules in series, which gradually adjust the channel number to 16, 24, 40 and 80, and selectively use SE attention mechanism to enhance feature extraction capability;

[0067] The feature enhancement layer expands the channel number from 80 to 160 through 1x1 convolution to further fuse and enhance the features;

[0068] The global feature modeling layer uses adaptive average pooling to compress the 3x3 feature map to 1x1 to extract global context information;

[0069] The classification head adopts a three-layer fully connected network structure, and the dimension decreases by 160→128→64→11, outputting a probability distribution of 11 categories.

[0070] Specifically, the improved MobileNetV3 model identifies the flow of encrypted traffic as Figure 2 shown, the model first proposes an improved SE attention mechanism to enhance the model's perception of key features; secondly, it designs a composite structure of Dense connection and residual connection to effectively solve the feature propagation problem in deep networks; finally, through network architecture modification and replacement strategies, the model is lightweight. The architecture channel of the improved MobileNetV3 model is as Figure 3 shown, the model's feature extraction layer has a convolution kernel size selection, channel number adjustment, and attention mechanism enhancement, the feature learning backbone composition, and the feature representation layer fusion enhancement, the global feature modeling layer feature compression, and the classification head gradual mapping design, which realizes efficient abstraction and reasoning of the original data.

[0071] In S3, the confidence-based open-set recognition algorithm includes:

[0072] S31. Define confidence analysis to calculate the confidence of the model in classifying samples;

[0073] S32. Define a confidence threshold to determine the boundary value of known classes, drift samples, or unknown classes;

[0074] S33. Define confidence drift detection to identify drift samples and unknown classes through dynamic threshold selection;

[0075] S34. Define a composite detection index to evaluate the recognition performance of the model by combining the drift ratio and the original sample loss rate.

[0076] Specifically, confidence analysis is a calculation method based on the confidence distribution characteristics in the event coordinate space, used to determine the confidence of the model in classifying samples, denoted as C(x). For a given sample x, the confidence is defined as the maximum value in the Softmax output, and the confidence analysis is calculated by:

[0077] C(x) = max(Softmax(f(x)))

[0078] where f(x) is the Logits output of the model for sample x.

[0079] The confidence threshold is an important parameter in confidence analysis, used to determine the boundary value of samples belonging to known classes, class drift, or new classes, denoted as θ. The percentile threshold is calculated by

[0080] θ p= Percentile(C(T c ), p)

[0081] Compute, where T c represents the set of correctly classified samples, and p is the percentile value.

[0082] For an input sample x, if its confidence score C(x) satisfies:

[0083] C(x) < θ

[0084] then the sample is determined to be a drift sample. Based on this detection method, the class drift rate DriftRatec and the overall drift rate DriftRate can be calculated.

[0085] The composite detection indicator M is a comprehensive evaluation indicator that combines the drift rate and the original sample loss rate, defined as:

[0086] M = ω1·UnknownRate + ω2·(1 - LossRate)

[0087] where ω1, ω2 are weight parameters, UnknownRate represents the detected new class unknown rate, and LossRate represents the loss rate of the original sample.

[0088] The confidence threshold selection process is as follows: first, initialize an empty set to store candidate thresholds, and calculate the correctly classified samples in the training sample set T. Then, for each sample, calculate the confidence score, and traverse within the given percentile range with a step size s. In the traversal process, calculate the percentile threshold and add it to the candidate threshold set Θ. Then, evaluate each candidate threshold, calculate the composite detection indicator M and the drift rate. Finally, select the threshold with the optimal performance as the final confidence threshold θ, and return it as the output. The overall process aims to find the most suitable confidence threshold for the current dataset and task requirements through multiple evaluations and comparisons, to improve the performance and robustness of the model.

[0089] In S4, the knowledge distillation-based incremental learning includes:

[0090] S41. Define the incremental learning total loss function, combining the knowledge distillation loss and the weighted cross-entropy loss, to balance the old knowledge and the new class learning;

[0091] S42. Define the feature attention mechanism, enhance the attention to key features by weighting the input features;

[0092] S43. Use the class drift incremental learning algorithm, solve the classification performance degradation problem caused by class feature drift through knowledge distillation and feature attention mechanism;

[0093] S44. Use the new class incremental learning algorithm to improve the classification performance of the new class by independently modeling the new class features and fusing them with the old model features.

[0094] Specifically, to improve the adaptability of the model to the drifting class and the new class, while maintaining the recognition ability of the original class, the total loss function is constructed:

[0095] L_total = a * Ldistil + (1-a) * LCE

[0096] Where Ldistil represents the knowledge distillation loss, LCE is the weighted cross-entropy loss with class weight, and a is the weight parameter.

[0097] The feature attention mechanism enhances the attention to key features by weighting the input features, while suppressing irrelevant features. It is implemented by:

[0098] x enhanced = σ(W2 * ReLU(W1 * x))

[0099] where W1 and W2 are dimension reduction and dimension increase weight matrices; x is the input feature; and σ is the Sigmoid function.

[0100] The class drift incremental learning algorithm aims to solve the problem of classification performance degradation caused by class feature drift in the incremental learning scenario. The feature attention mechanism is introduced to automatically adjust the importance of input features, further enhancing the model's attention to key features, thereby reducing the interference of feature drift on model performance.

[0101] The class drift incremental learning process is shown in Table 1:

[0102] Table 1: Class drift incremental learning process table

[0103]

[0104] The new class incremental learning algorithm focuses on solving the problem of forgetting old class knowledge and insufficient new class features in the incremental learning process. Therefore, by independently modeling the new class features and fusing them with the old model features, the unique features of the new class are fully captured, while the memory of the old class is preserved. This method uses a two-layer convolutional network to extract new class features, and through the channel splicing and fusion strategy, it avoids interfering with the old class knowledge while improving the classification performance of the new class. The new class incremental learning algorithm process is shown in Table 2:

[0105] Table 2: New class incremental learning algorithm process table

[0106]

[0107] While the application has been described in accordance with the various embodiments shown and described, it is to be understood that the application is not limited to those precise embodiments, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the present application. Furthermore, the language used in this specification has been principally selected for readability and instructional purposes and can not have been selected to delineate or circumscribe the patent rights to which it refers. Accordingly, the present application is intended to be illustrative, but not limiting, of the scope of the application, which is set forth with particularity in the claims that follow.

Claims

1. A highly efficient open-set encrypted traffic identification method for ultra-large-scale traffic, characterized in that, include: S1. Input the network traffic dataset and generate dimensionality-reduced data with optimal dimensions using the PCA dimensionality reduction algorithm; S2. Input the dimensionality-reduced data with the optimal dimension into the improved MobileNetV3 model, and combine the improved SE attention mechanism, Dense connection and residual connection composite structure to extract features and output classification results; S3. Use a confidence-based open set recognition algorithm to determine whether the classification result belongs to a known category, a drift sample, or an unknown category; S4. If the classification result is a drift sample or an unknown category, start incremental learning based on knowledge distillation, update the parameters of the improved MobileNetV3 model and retain the old knowledge; In S2, the improved MobileNetV3 model includes: The initial feature extraction layer uses a 3×3 convolution kernel to expand the input channels from 1 to 16, and combines BatchNorm2d and HSwish activation functions to maintain the spatial resolution of the original features; The feature learning backbone consists of 8 MobileBottleneck modules connected in series, with the number of channels gradually adjusted to 16, 24, 40 and 80, and the SE attention mechanism is selectively used to enhance feature extraction capabilities. The feature enhancement layer expands the number of channels from 80 to 160 through 1×1 convolution, further fusing and enhancing features; The global feature modeling layer uses adaptive average pooling to compress the 3×3 feature map into 1×1 and extract global context information. The classification head uses a three-layer fully connected network structure, with a dimension decreasing from 160 to 128 to 64 to 11, to output the probability distribution of 11 categories.

2. The efficient open-set encrypted traffic identification method for ultra-large-scale traffic as described in claim 1, characterized in that, S1 specifically includes the following steps: S11. Initialize the network traffic dataset; S12. Check if the initial dimension is greater than 10. If the initial dimension is greater than 10, set the score to 0 and set the current dimensionality reduction target dimension i to 10, then proceed to the next step. Otherwise, end the process and perform performance verification on the dimensionality reduction data with the optimal dimension. S13. Select i as the dimensionality reduction target for analysis; S14. Calculate the variance explained ratio to check whether the selected dimension i is sufficient to retain the information of the original data. If the variance explained ratio is less than 0.99 and does not meet the requirements, then this dimension is not suitable for dimensionality reduction, and proceed directly to S18; if the conditions are met, continue to the next step. S15. Ensure that the original data is not modified by using a deep copy method, and then apply dimensionality reduction operation to obtain a dimensionality-reduced dataset; S16. Divide the dimensionality reduction dataset into a training set and a test set; S17. Use the LMCA network to extract features and classify the dimensionality-reduced dataset; S18. Calculate and record the accuracy, F1 score, model size, and inference time of the LMCA network under this dimensionality reduction configuration, and then return to step S13 to select a new i value; S19. Among all the different i-value configurations tried, compare the score for each case and select the optimal configuration. S110. Perform final performance verification on the data of the optimal configuration scheme.

3. The efficient open-set encrypted traffic identification method for ultra-large-scale traffic as described in claim 1, characterized in that, In S3, confidence-based open set recognition algorithms include: S31. Define confidence analysis, which calculates the reliability of the model in classifying samples; S32. Define a confidence threshold to distinguish the boundary value of a known class, a drifting sample, or an unknown class; S33. Define confidence drift detection, and use dynamic thresholds to select and identify drifting samples and unknown categories; S34. Define a composite detection index that combines the drift ratio and the original sample loss rate to evaluate the model's recognition performance.

4. The efficient open-set encrypted traffic identification method for ultra-large-scale traffic as described in claim 1, characterized in that, In S4, incremental learning based on knowledge distillation includes: S41. Define the total loss function for incremental learning, combining knowledge distillation loss and weighted cross-entropy loss to balance the learning of old knowledge and new categories; S42. Define a feature attention mechanism that enhances attention to key features by weighting the input features; S43. Use the category drift incremental learning algorithm to solve the problem of classification performance degradation caused by category feature drift through knowledge distillation and feature attention mechanism; S44. Use a new category incremental learning algorithm to improve the classification performance of the new category by independently modeling the features of the new category and fusing them with the features of the old model.

Images