A message feature extraction method and related equipment

Abstract

The present application discloses a message feature extraction method and related equipment, which relate to the field of feature extraction technology. The method includes: obtaining the original message data of the target network traffic and the corresponding physical layer signal waveform; parsing the original message data based on the preset protocol layering rules to determine the multi-layer protocol field set; determining the protocol layer feature vector based on the multi-layer protocol field set; determining the frequency domain feature vector based on the physical layer signal waveform; constructing a cross-attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector; generating target message features based on the cross-attention weight matrix. The present application enhances the feature's ability to parse encrypted traffic and protocol obfuscation attacks through the deep dual-modality fusion of protocol semantics and physical signals, and at the same time improves the feature robustness through dynamic weight allocation and anti-replay mechanisms, providing highly discriminative endogenous security features for complex network threat detection.

Description

Technical Field

[0001] The present application relates to the field of feature extraction technology, and in particular to a message feature extraction method and related equipment. Background Art

[0002] Current network traffic feature extraction techniques primarily rely on static parsing of protocol-layer fields, such as field extraction based on fixed protocol templates or shallow statistical feature analysis. These traditional methods are limited in their ability to represent encrypted traffic, nested proprietary protocols, and protocol obfuscation attacks, making it difficult to effectively identify hidden network anomalies. Therefore, a packet feature extraction method is urgently needed to address these technical challenges. Summary of the Invention

[0003] The Summary of the Invention introduces a series of simplified concepts that will be further described in the Detailed Description of the Invention. The Summary of the Invention of this application is not intended to limit the key features and essential technical features of the claimed technical solution, nor is it intended to determine the scope of protection of the claimed technical solution.

[0004] In a first aspect, the present application provides a message feature extraction method, comprising:

[0005] Obtain the original message data of the target network traffic and the corresponding physical layer signal waveform;

[0006] Parse the original message data based on the preset protocol layering rules to determine the multi-layer protocol field set;

[0007] Determine a protocol layer feature vector based on a multi-layer protocol field set;

[0008] Determine the frequency domain eigenvector based on the physical layer signal waveform;

[0009] Based on the protocol layer feature vector and the frequency domain feature vector, a cross attention weight matrix is constructed;

[0010] Generate target message features based on the cross-attention weight matrix.

[0011] In some implementations, parsing the original message data based on preset protocol layering rules to determine a multi-layer protocol field set includes:

[0012] Determine the protocol identification segment based on the first preset length byte of the header of the original message data;

[0013] Determine the protocol parsing template based on the matching result between the protocol identification segment and the protocol feature library;

[0014] Based on the sliding window mechanism, the unmatched protocol fields in the original message data are parsed again to determine the position markers of the variable-length fields;

[0015] Generate a protocol tree containing a multi-layer protocol structure based on the protocol parsing template and the position mark of the variable-length field;

[0016] Based on the hierarchical structure of the protocol tree, a multi-layer protocol field set is determined.

[0017] In some implementations, determining a protocol layer feature vector based on a multi-layer protocol field set includes:

[0018] Determine a first semantic code based on a mapping relationship between a transport layer port number and an application layer protocol type in the multi-layer protocol field set;

[0019] Determining a second semantic code based on a timing correlation coefficient between a network layer TTL value and a data link layer frame interval in the multi-layer protocol field set;

[0020] A protocol layer feature vector is determined based on a normalized concatenation result of the first semantic code and the second semantic code.

[0021] In some implementations, determining a frequency domain eigenvector based on a physical layer signal waveform includes:

[0022] Based on the wavelet packet decomposition algorithm, the physical layer signal waveform is divided into frequency bands to determine the energy entropy of each frequency band;

[0023] Determine the signal stability coefficient based on the decay rate of the autocorrelation function of the signal amplitude between adjacent messages;

[0024] The frequency domain eigenvector is determined based on the weighted calculation results of the energy entropy and signal stability coefficient of each frequency band.

[0025] In some embodiments, a cross-attention weight matrix is constructed based on the protocol layer feature vector and the frequency domain feature vector, including:

[0026] Determine the protocol timing transition probability based on the mapping relationship between the transport layer port number and the application layer protocol type in the protocol layer feature vector;

[0027] Based on the distribution characteristics of the energy entropy of each frequency band in the frequency domain feature vector, the frequency domain mutation intensity is determined;

[0028] Determine the cross-modal correlation matrix based on the protocol timing transition probability and frequency domain mutation intensity;

[0029] Perform temporal modeling of the cross-modal correlation matrix based on the gated recurrent unit to determine feature dependencies;

[0030] Based on the self-attention mechanism, the feature dependencies are weighted and the cross-attention weight matrix is determined.

[0031] In some embodiments, generating target message features based on the cross-attention weight matrix includes:

[0032] The protocol layer feature vector and the frequency domain feature vector are weightedly fused based on the cross-attention weight matrix to determine the bimodal features;

[0033] Generate a pseudo hash sequence based on the byte sampling results of the encrypted payload in the original message data;

[0034] Determine the anti-replay code based on the XOR confusion operation of the pseudo-hash sequence and the bimodal feature;

[0035] Based on the dynamic S-box replacement algorithm, nonlinear transformation is performed on the anti-replay coding to determine the target message characteristics.

[0036] In some embodiments, further comprising:

[0037] Based on the synchronization relationship between the timestamp of the target message feature and the physical layer signal waveform, a watermark is embedded to generate the target message feature including anti-replay coding and watermark.

[0038] In a second aspect, the present application proposes a message feature extraction device, comprising:

[0039] A message data acquisition unit, used to obtain the original message data of the target network traffic and the corresponding physical layer signal waveform;

[0040] A protocol field determination unit parses the original message data based on preset protocol layering rules to determine a multi-layer protocol field set;

[0041] A protocol feature generation unit, which determines a protocol layer feature vector based on a multi-layer protocol field set;

[0042] A frequency domain feature generation unit, which determines a frequency domain feature vector based on a physical layer signal waveform;

[0043] The weight matrix construction unit constructs a cross-attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector;

[0044] The message feature extraction unit generates target message features based on the cross-attention weight matrix.

[0045] In a third aspect, an electronic device comprises: a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein the processor is configured to implement the steps of the message feature extraction method of any one of the first aspects when executing the computer program stored in the memory.

[0046] In a fourth aspect, the present application proposes a computer-readable storage medium having a computer program stored thereon, which implements the message feature extraction method of any one of the first aspects when the computer program is executed by a processor.

[0047] In summary, this application constructs a dynamic cross-attention weight matrix by fusing the semantic association features of the protocol layer fields with the frequency domain analysis results of the physical layer signals, thus achieving dual-modal deep feature fusion of the protocol content and the physical signal. This application improves the feature parsing capability of encrypted traffic, effectively enhancing the robustness of features against protocol confusion and signal interference. At the same time, through anti-replay coding and dynamic nonlinear transformation mechanisms, it gives features inherent security defense capabilities, can accurately identify complex network attack behaviors, and provide reliable technical support for highly concealed threat detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present description. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0049] Figure 1 A flow chart of a message feature extraction method provided in an embodiment of the present application;

[0050] Figure 2 A schematic diagram of the structure of a message feature extraction device provided in an embodiment of the present application;

[0051] Figure 3 A structural diagram of an electronic device for extracting message features provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or that are inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the embodiments described are only part of the embodiments of the present application, not all of the embodiments.

[0053] See also Figure 1 , which is a flow chart of a message feature extraction method provided in an embodiment of the present application, which may specifically include:

[0054] S110, obtaining original message data of target network traffic and corresponding physical layer signal waveform;

[0055] For example, obtaining the original message data of the target network traffic and the corresponding physical layer signal waveform is the basic data collection stage for message feature extraction. Original message data refers to the actual data packet in network transmission, which contains structured information such as protocol header and payload content, and is used to parse the semantic features of the protocol field; while the physical layer signal waveform is the electrical signal or optical signal representation of data when it is transmitted in the physical medium, reflecting the signal's timing fluctuations, frequency distribution and other physical characteristics. The combination of the two can make up for the limitations of a single data dimension. The protocol layer data provides semantic information at the logical level, while the physical layer signal implies underlying features such as channel status and transmission stability, providing complementary data support for subsequent cross-modal feature fusion.

[0056] This step overcomes the limitations of traditional feature extraction, which relies solely on protocol fields, by collaboratively acquiring bimodal data from protocol content and physical signals. The raw message data covers the entire protocol stack from the application layer to the physical layer, while the physical layer signal waveform captures hardware-layer features such as signal strength and frequency offset. This bimodal data acquisition not only enhances the diversity of feature sources but also lays the foundation for subsequent dynamic modeling of the interaction between protocol and physical features, thereby improving the adaptability of feature expression to complex network environments.

[0057] S120, parsing the original message data based on preset protocol layering rules to determine a multi-layer protocol field set;

[0058] For example, raw message data is parsed based on preset protocol layering rules, aiming to extract a multi-layer protocol field set by structurally decomposing the protocol layers of network traffic. The protocol layering rules define the protocol stack parsing logic from the physical layer to the application layer. By identifying message header features and protocol interaction patterns, key field information from different protocol layers is gradually stripped away, forming a hierarchical protocol field set. This process overcomes the lack of adaptability of traditional static parsing methods to protocol nesting and dynamic changes, providing a structured data foundation for subsequent feature vector generation.

[0059] The layered parsing mechanism effectively addresses field ambiguity in proprietary protocols or encrypted traffic. Preset rules, combined with dynamic matching strategies, identify known protocol identifiers and then utilize a sliding window mechanism to perform secondary inference on unknown or variable-length fields, thereby constructing a complete protocol tree structure. This layered parsing approach not only enhances the accuracy of protocol field extraction but also provides hierarchical data support for cross-protocol semantic correlation analysis, ensuring that the feature extraction process adapts to the changing demands of complex network environments.

[0060] S130. Determine a protocol layer feature vector based on the multi-layer protocol field set;

[0061] For example, the construction of protocol layer feature vectors aims to extract highly discriminative feature expressions from the semantic associations and temporal dependencies of multi-layer protocol fields. By analyzing the mapping relationship between the transport layer and the application layer, the semantic logical characteristics of protocol interactions are extracted; at the same time, the temporal dynamic parameters of the network layer and the data link layer are combined to capture the contextual relevance of protocol behavior. This cross-layer feature fusion mechanism breaks through the limitations of traditional single-layer field parsing, can more comprehensively characterize the collaborative operation mode of the protocol stack, and provide a semantically rich vectorized representation for subsequent feature fusion.

[0062] This step enhances the feature's adaptability to encrypted traffic and protocol obfuscation attacks by dynamically modeling the multidimensional relationships between protocol fields. Compared to static field extraction methods, protocol-layer feature vectors not only incorporate the static properties of the protocol content but also embed the temporal dynamics of protocol interactions. This enhances the robustness of the feature representation against encrypted traffic and protocol obfuscation attacks, laying the foundation for the accurate identification of complex network behavior.

[0063] S140. Determine a frequency domain eigenvector based on a physical layer signal waveform;

[0064] For example, the physical layer signal waveform contains the underlying characteristics of network traffic during transmission over physical media, such as the signal's frequency distribution, energy intensity, and time-series fluctuation pattern. Through frequency domain analysis, the time domain signal can be mapped to the frequency dimension, and the energy distribution characteristics and signal stability indicators of different frequency bands can be extracted. The construction of frequency domain feature vectors aims to quantify the signal's energy concentration in the frequency domain space, the interaction relationship between frequency bands, and the frequency domain distortion characteristics caused by channel interference during transmission, thereby providing a complementary physical dimension representation for the protocol layer features and enhancing the features' adaptability to hardware layer noise and changes in the transmission environment.

[0065] This step captures the dynamic behavior of the signal in the transmission medium through frequency-domain statistical features. For example, energy anomalies in high-frequency bands may indicate sudden interference, while the stability of energy entropy in low-frequency bands is closely related to channel quality. Frequency-domain feature vectors not only characterize the instantaneous frequency-domain state of a single message signal but also reveal the overall transmission trend of the signal through cross-message correlation analysis. This provides underlying signal characteristics for the subsequent deep integration of protocols and physical features, enhancing the comprehensive characterization capabilities of features in complex network environments.

[0066] S150, constructing a cross attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector;

[0067] For example, the goal of constructing a cross-attention weight matrix is to dynamically quantify the correlation strength between protocol layer features and physical layer frequency domain features, and to achieve deep interaction of bimodal features. By analyzing the protocol interaction timing rules in the protocol layer feature vector (such as the dynamic mapping relationship between the transport layer port and the application protocol), and the mutation characteristics of the signal frequency band energy in the frequency domain feature vector, the intrinsic coupling relationship between the protocol behavior and the physical signal fluctuation is revealed. The matrix adaptively adjusts the contribution weights of different feature dimensions through cross-modal association modeling, providing dynamic guidance for subsequent feature fusion, and ensuring that the feature expression can accurately reflect the multi-dimensional characteristics of network traffic.

[0068] The cross-attention weight matrix construction mechanism enhances the contextual awareness of feature fusion. The semantic logic carried by protocol-layer features and the dynamic changes in physical signals implied by frequency-domain features are collaboratively analyzed through time series modeling and self-attention mechanisms. This dynamic weight allocation strategy reflects the synergy between protocol-layer and physical-layer features, providing dynamic guidance for the weighted fusion of bimodal features, thereby improving the global consistency and environmental adaptability of feature representation.

[0069] S160: Generate target message features based on the cross-attention weight matrix.

[0070] For example, generating target message features based on the cross-attention weight matrix is the core step in optimizing feature expression by dynamically fusing protocol layer and physical layer features. The cross-attention weight matrix quantifies the correlation strength between protocol semantic features and physical signal characteristics, guiding the weighted fusion process of bimodal features, so that the protocol interaction logic and signal transmission dynamics can be collaboratively represented. This step uses matrix operations to context-awarely fuse the protocol layer feature vector and the frequency domain feature vector to generate a comprehensive feature vector that is both semantically rich and physically robust, providing highly discriminative feature input for subsequent network behavior analysis.

[0071] The generation of target message features not only integrates multi-dimensional features but also imbues them with inherent security through mechanisms such as anti-replay coding. Under the dynamic regulation of cross-attention weights, the semantic relevance of protocol layer features and the frequency domain stability of physical layer features are adaptively enhanced, effectively suppressing noise interference and attack confusion. This ensures that the generated features accurately depict the essential behavioral patterns of network traffic, providing reliable feature support for complex threat detection.

[0072] In summary, the embodiment of the present application obtains the original message data of the target network traffic and its physical layer signal waveform, combines the protocol layer semantic features with the physical layer frequency domain characteristics, and constructs a dynamic cross-attention weight matrix to achieve dual-modal deep feature fusion of protocol content and physical signals. The embodiment of the present application breaks through the limitation of traditional feature extraction relying on a single protocol field. By synchronously collecting protocol layer structured information and physical layer signal waveforms, a complementary input space is constructed from the dual dimensions of logical semantics and underlying signal characteristics. Based on hierarchical parsing rules and dynamic matching strategies, a set of multi-layer protocol fields is extracted, and the semantic mapping relationship between the transport layer and the application layer, and the timing correlation between the network layer and the data link layer are combined to generate a protocol layer feature vector with cross-layer semantic association; at the same time, the frequency band energy entropy and the signal stability coefficient are used to quantify the frequency domain dynamic characteristics of the physical layer signal to form a frequency domain feature vector. The correlation between the protocol timing transition probability and the frequency domain mutation intensity is dynamically modeled through the cross-attention weight matrix, and the fusion weight of the dual-modal features is adaptively allocated to enhance the global consistency and environmental adaptability of the feature expression. The generated comprehensive feature vector not only possesses the semantic richness of protocol interaction logic but also incorporates the robustness of physical signal transmission, improving the accuracy of encrypted traffic identification and protocol obfuscation attack detection. Furthermore, through anti-replay coding mechanisms and dynamic nonlinear transformations, the feature is endowed with inherent security defense capabilities, effectively suppressing replay attacks and noise interference, ensuring the feature's accurate representation of complex network threats and providing reliable technical support for highly concealed anomalous behavior detection.

[0073] Obtaining the original message data of the target network traffic and the corresponding physical layer signal waveform is the core step of data collection in the message feature extraction method. The original message data is captured in real time by a capture device deployed at the network node (such as a network card, probe, or mirror port), which fully records the content of the data packets transmitted in the network traffic, including protocol header fields, payload data, and metadata information. The original message data covers the entire protocol stack from the physical layer to the application layer. As the input of the protocol layer parsing, it is used to subsequently extract the semantic association features of the multi-layer protocol fields, such as the mapping relationship between the transport layer port number and the application layer protocol type, the temporal change pattern of the network layer TTL value, etc., providing a structured data foundation for the construction of the protocol layer feature vector.

[0074] Physical layer signal waveforms are synchronously collected through RF sensors or baseband chips, capturing the waveforms of electrical or optical signals as they travel through physical media (such as cables, optical fibers, or wireless channels). This includes signal amplitude, frequency, phase, and timing fluctuations. This synchronization is achieved through hardware clock synchronization, ensuring strict alignment of protocol content with physical signal timestamps, providing a consistent data foundation for cross-modal feature fusion.

[0075] The collaborative collection of bimodal data is achieved through a data association mechanism between the protocol layer and the physical layer. By binding the timestamp of the original message data to the sampling moment of the physical layer signal waveform, a one-to-one correspondence between the cross-layer data is established. This association mechanism ensures that the field information parsed by the protocol layer can be strictly synchronized with the physical layer signal characteristics in terms of timing, providing a data alignment basis for the subsequent construction of the cross-attention weight matrix. For example, a message appears as a communication behavior of a specific port number at the transport layer, and its corresponding physical layer signal waveform may show a sudden increase in energy in the high-frequency band. After the two are associated through timestamps, the dynamic coupling relationship between protocol interaction and signal physical characteristics can be revealed. This bimodal data collection not only breaks through the limitations of traditional methods that rely solely on protocol fields, but also supplements the noise, interference, and channel state information in the hardware transmission environment through physical layer signals. It provides multi-dimensional data input for dynamic modeling of the intrinsic relationship between protocol semantics and physical signals, and enhances the adaptability of feature extraction to complex network environments.

[0076] In some instances, the original message data is parsed based on preset protocol layering rules to determine a multi-layer protocol field set, including:

[0077] Determine the protocol identification segment based on the first preset length byte of the header of the original message data;

[0078] Determine the protocol parsing template based on the matching result between the protocol identification segment and the protocol feature library;

[0079] Based on the sliding window mechanism, the unmatched protocol fields in the original message data are parsed again to determine the position markers of the variable-length fields;

[0080] Generate a protocol tree containing a multi-layer protocol structure based on the protocol parsing template and the position mark of the variable-length field;

[0081] Based on the hierarchical structure of the protocol tree, a multi-layer protocol field set is determined.

[0082] Exemplarily, during the protocol layered parsing process, bytes of a first preset length are first extracted from the header of the original message data as a protocol identification segment. The first preset length is pre-set according to the length range of a typical protocol identification field, such as the first 14 bytes of an Ethernet frame header or the first 20 bytes of an IP message header. By intercepting a byte stream of a fixed length in the header, the basic identification information of the current protocol layer can be quickly identified. This step utilizes the fixed position characteristics of the protocol identification segment to provide initial data input for subsequent protocol type matching, thereby ensuring the efficiency and accuracy of the parsing process. For example, when parsing an Ethernet frame, the first 14 bytes contain the target MAC address, source MAC address, and Ethernet type fields. By extracting this portion of bytes, the protocol family or protocol stack layer to which the message belongs can be preliminarily identified, providing basic identification information for subsequent protocol matching.

[0083] The protocol feature library stores the identification features of known protocol types and the corresponding parsing rules. The protocol identification segment extracted in step one is matched with the identification features in the protocol feature library. If the match is successful, the corresponding protocol parsing template is loaded. The protocol parsing template defines the field structure, field length and parsing order of the current protocol layer, such as the parsing rules of the request line, header field and payload of the HTTP protocol. This step ensures that the fields of known protocols can be accurately extracted through a templated parsing mechanism, and provides structured guidance for subsequent layered parsing. If a known protocol type is not matched, it is marked as an unknown protocol and the subsequent secondary parsing mechanism is triggered. By dynamically loading predefined parsing templates, efficient parsing of standardized protocols is ensured, while providing extended processing capabilities for private protocols or encrypted traffic.

[0084] For protocol fields or variable-length fields (such as protocols with non-fixed payload lengths) that do not match the protocol identification segment, a sliding window mechanism is used for secondary parsing. The sliding window slides byte by byte in the message data at a preset step size (such as 1 byte), and dynamically infers the field boundaries based on context information. By calculating the statistical characteristics of the data in the window (such as field type identifier, length field value, or checksum matching), the start and end positions of the variable-length field are identified, and a position marker is generated. For example, when parsing the IP option field, the option type and length field are detected through a sliding window to determine the precise range of each option. The above content effectively solves the problem of insufficient adaptability of traditional fixed-length parsing to variable-length protocol fields, and improves the parsing accuracy in complex protocol nesting scenarios.

[0085] Combine the protocol parsing template with the variable-length field position marker to parse the message data layer by layer and build a protocol tree. The nodes of the protocol tree correspond to the field information of each protocol layer, and the hierarchical relationship is determined by the protocol stack structure. For example, when parsing the TCP / IP protocol stack, the root node is the Ethernet frame, and the child nodes are the IP message, TCP message, and application layer data in sequence. Each node contains the field name, field value, and location range information of the protocol layer, and records the dynamic parsing results of the variable-length field. For example, after parsing the IP layer, according to the protocol type field of the IP header (such as TCP protocol number 6), the TCP parsing template is called to continue parsing the transport layer field. By structured modeling of the protocol hierarchy, a complete protocol stack representation is formed, providing hierarchical data support for the extraction of multi-layer protocol fields.

[0086] Traverse the nodes of each layer of the protocol tree, extract the key field information of each layer of the protocol, and form a multi-layer protocol field set. The field set includes the identification field, control field and payload data of each protocol layer, such as the source IP address of the network layer, the destination port number of the transport layer, the HTTP method of the application layer, etc. Through the hierarchical association of the protocol tree, it is ensured that the field set fully reflects the contextual relationship of the protocol interaction. For example, when parsing HTTPS traffic, the field set covers the TLS handshake protocol version, the encryption suite list and the certificate chain information, while retaining its association with the underlying TCP sequence number and IP fragment offset. The final output is a structured and hierarchical protocol field set, which provides precise input for the construction of the protocol layer feature vector and ensures the semantic integrity and cross-layer correlation of the protocol layer features.

[0087] In this application, the present invention implements structured hierarchical parsing of raw message data by pre-setting protocol layering rules, combining protocol feature library matching with a sliding window dynamic parsing mechanism. From header identification segment extraction to variable-length field location, a multi-layer protocol field set is ultimately generated. This ensures that the protocol parsing process balances efficient matching of standard protocols with dynamic adaptability to non-standard protocols, providing an accurate and complete protocol layer data foundation for subsequent feature extraction.

[0088] In some examples, determining a protocol layer feature vector based on a multi-layer protocol field set includes:

[0089] Determine a first semantic code based on a mapping relationship between a transport layer port number and an application layer protocol type in the multi-layer protocol field set;

[0090] Determining a second semantic code based on a timing correlation coefficient between a network layer TTL value and a data link layer frame interval in the multi-layer protocol field set;

[0091] A protocol layer feature vector is determined based on the normalized concatenation result of the first semantic code and the second semantic code.

[0092] Exemplarily, the first semantic coding is determined based on the mapping relationship between the transport layer port number and the application layer protocol type in the multi-layer protocol field set. Specifically, a static or dynamic association is established between the transport layer port number (such as TCP / UDP port number) and the application layer protocol type (such as HTTP, DNS, FTP, etc.) through a preset protocol mapping rule library. For example, port number 80 is mapped to the HTTP protocol type, and port number 53 is mapped to the DNS protocol type. Such mapping relationships are predefined through the protocol feature library. For non-standard ports or encrypted traffic, a sliding window matching algorithm is used to deeply analyze the application layer payload content, infer the actual protocol type, and update the mapping relationship library. The first semantic coding is achieved by mapping the combination of the port number and the protocol type into a fixed-length numerical vector, for example, using one-hot encoding or embedded encoding technology to convert the discrete protocol type identifier into a continuous vector space representation. This code not only represents the explicit correspondence between the port number and the application protocol, but also enhances the adaptability to non-standard protocols through a dynamic inference mechanism, ensuring the integrity and scalability of the semantic coding.

[0093] The second semantic code is determined based on the timing correlation coefficient between the network layer time to live (TTL) value and the data link layer frame interval in the multi-layer protocol field set. First, the timing sequence of the network layer TTL field and the timing sequence of the data link layer frame interval are extracted, and the two are aligned by timestamps. By calculating the Pearson correlation coefficient of the TTL change and the frame interval fluctuation in the sliding time window, the dynamic correlation strength between the two is quantified. For example, the hop-by-hop decreasing pattern of the TTL value and the sudden increase in the data link layer frame interval may reflect network congestion or routing path changes. After normalization, the correlation coefficient is mapped into a numerical vector of fixed dimension to form the second semantic code. The second semantic code captures the coordinated change pattern of the network layer and data link layer behavior by embedding the timing dynamic characteristics of the protocol interaction, providing a context-aware timing representation for the protocol layer feature vector.

[0094] The first semantic code and the second semantic code are standardized separately to eliminate dimensional differences. Specifically, the Z-score normalization method is used to adjust each coding dimension to a distribution with a mean of 0 and a variance of 1. Subsequently, the normalized first semantic code and the second semantic code are spliced in dimensional order to form a high-dimensional composite vector. For example, if the first coding dimension is 128 dimensions and the second coding dimension is 64 dimensions, a 192-dimensional protocol layer feature vector is generated after splicing. This vector realizes multi-dimensional feature representation across protocol layers by integrating the semantic mapping relationship between the transport layer and the application layer, and the timing correlation between the network layer and the data link layer. The final output protocol layer feature vector has both the static semantic logic and dynamic timing characteristics of protocol interaction, providing hierarchical and structured input data for the subsequent construction of the cross-attention weight matrix, ensuring the robustness of feature expression to complex protocol nesting and encrypted traffic.

[0095] In some examples, determining a frequency domain feature vector based on a physical layer signal waveform includes:

[0096] Based on the wavelet packet decomposition algorithm, the physical layer signal waveform is divided into frequency bands to determine the energy entropy of each frequency band;

[0097] Determine the signal stability coefficient based on the decay rate of the autocorrelation function of the signal amplitude between adjacent messages;

[0098] The frequency domain eigenvector is determined based on the weighted calculation results of the energy entropy and signal stability coefficient of each frequency band.

[0099] For example, the physical layer signal waveform is divided into frequency bands based on the wavelet packet decomposition algorithm to determine the energy entropy of each frequency band. Specifically, the physical layer signal waveform is decomposed into multiple levels using a preset wavelet basis function (such as Daubechies wavelet) and the number of decomposition layers, and the signal is divided layer by layer into Sub-bands ( is the number of decomposition levels. For example, after performing a three-level wavelet packet decomposition, the original signal is divided into eight frequency bands, each of which corresponds to a signal component within a specific frequency range. The wavelet packet coefficients of each sub-band are normalized to obtain the energy probability distribution of each frequency band. The energy entropy of each frequency band is quantified using the Shannon entropy formula and expressed as: in, For the The energy entropy of a frequency band represents the complexity of the distribution of signal energy in the frequency band; For the Frequency band The energy proportion of the wavelet packet coefficients; is the total number of coefficients. Energy entropy characterizes the complexity of the signal's energy distribution in each frequency band. A sudden increase in entropy in high-frequency bands may reflect signal interference or distortion, while a stable entropy in low-frequency bands indicates channel transmission stability.

[0100] The signal stability coefficient is determined based on the decay rate of the autocorrelation function of the signal amplitude between adjacent messages. Specifically, the physical layer signal amplitude sequence corresponding to the adjacent messages is extracted and its autocorrelation function is calculated. ,in, is the time delay parameter. By fitting the decay curve of the autocorrelation function with time delay (such as using the exponential decay model ), calculate the decay rate parameter Specifically, linear regression is performed after taking the logarithm of the autocorrelation function. The absolute value of the slope is the decay rate, and the signal stability coefficient is defined as ,in, A small constant (such as 1e-6) to prevent division by zero. The larger the value, the more severe the signal amplitude fluctuation is. The smaller the value, the smoother the signal transmission. This coefficient quantifies the temporal consistency of the signal amplitude between adjacent messages and provides a dynamic stability indicator for the frequency domain feature.

[0101] The energy entropy of each frequency band and signal stability coefficient Perform linear fusion according to preset weights to generate frequency domain feature vectors , let the total number of frequency bands be , The weight distribution strategy is expressed as: Frequency domain eigenvector It is composed of the weighted energy entropy and stability coefficient of each frequency band, expressed as: Each frequency band's energy entropy is assigned a preset weight, while the signal stability coefficient is independently assigned a fixed weight. The energy entropy and stability coefficients of each frequency band are fused using a linear weighting formula to generate a comprehensive frequency domain feature vector. The energy entropy of the eight frequency bands and the stability coefficient are weighted and concatenated into a nine-dimensional feature vector. Through adaptive weight assignment, frequency bands with complex energy distributions and signal stability indicators collaboratively characterize the physical layer signal characteristics. The final output frequency domain feature vector incorporates both the static statistical characteristics of the frequency domain energy distribution and the dynamic stability information of signal transmission, providing a robust physical layer representation for subsequent cross-modal feature fusion.

[0102] In some instances, a cross-attention weight matrix is constructed based on the protocol layer feature vector and the frequency domain feature vector, including:

[0103] Determine the protocol timing transition probability based on the mapping relationship between the transport layer port number and the application layer protocol type in the protocol layer feature vector;

[0104] Based on the distribution characteristics of the energy entropy of each frequency band in the frequency domain feature vector, the frequency domain mutation intensity is determined;

[0105] Determine the cross-modal correlation matrix based on the protocol timing transition probability and frequency domain mutation intensity;

[0106] Perform temporal modeling of the cross-modal correlation matrix based on the gated recurrent unit to determine feature dependencies;

[0107] Based on the attention mechanism, the feature dependencies are weighted and the cross-attention weight matrix is determined.

[0108] Exemplarily, the protocol timing transition probability is used to quantify the dynamic association strength between the transport layer port number and the application layer protocol type. The mapping relationship between the transport layer port number and the application layer protocol type is extracted from the protocol layer feature vector, and the relationship is established through a predefined protocol mapping rule base or a real-time parsing mechanism. For example, port number 80 usually corresponds to the HTTP protocol, and port number 443 corresponds to the HTTPS protocol. For non-standard ports or encrypted traffic, the actual protocol type is dynamically inferred by analyzing the application layer payload content, and the mapping relationship is updated. The calculation of the protocol timing transition probability is based on the co-occurrence frequency of the port number and the application protocol type within the sliding time window, specifically by counting the proportion of the number of co-occurrences of the port number and the application protocol type in the total number of occurrences within a specific time period. This probability value reflects the dynamic distribution characteristics of the application protocol type under a specific port number, and characterizes the timing regularity of protocol interaction.

[0109] Frequency domain mutation intensity is used to characterize the degree of abnormal fluctuation of the physical layer signal in the frequency domain. By calculating the standard deviation or range of the energy entropy within a sliding time window from the energy entropy distribution of each frequency band generated by wavelet packet decomposition, sudden energy distribution fluctuations can be identified. For example, when the standard deviation of the energy entropy in a frequency band exceeds a preset threshold, significant fluctuations are determined in that frequency band. The calculation of frequency domain mutation intensity combines the ratio of the change in energy entropy in each frequency band to its maximum value to quantify the stability of the signal in the frequency domain. A larger mutation intensity value indicates more severe energy fluctuations in the physical signal in that frequency band, which may be caused by channel interference or signal distortion.

[0110] The cross-modal correlation matrix constructs a dynamic correlation model between protocol and physical layer features by integrating protocol timing transition probabilities with frequency-domain mutation strength. Specifically, the protocol transition probability matrix is expanded into a one-dimensional vector and then outer-producted with the frequency-domain mutation strength vector to generate an initial correlation matrix. The matrix elements are then weighted, with linear weights used to emphasize regions of significant correlation and nonlinear weights used to capture complex interaction patterns. For example, regions where protocol interaction patterns are strongly correlated with high-frequency mutations are assigned higher weights.

[0111] The final output correlation matrix comprehensively characterizes the coordinated change relationship between protocol behavior and physical signal fluctuations, providing input for subsequent timing modeling.

[0112] The Gated Recurrent Unit (GRU) is used to capture the temporal dependencies of the cross-modal correlation matrix. The cross-modal correlation matrix is input into the GRU network in time series, and the update gate and reset gate dynamically control the ratio of historical information to the current input. The update gate determines how much of the historical hidden state is retained, while the reset gate controls the extent to which the current input modifies the historical state. The GRU's hidden state gradually encodes the dynamic evolution of the cross-modal correlation relationship, forming a feature vector that reflects the temporal dependencies. Through this process, the coordinated changes in protocol layer and physical layer features are effectively modeled, providing temporal context for weight allocation.

[0113] The self-attention mechanism dynamically assigns weights to feature dependencies to generate a cross-attention weight matrix. The feature dependency vector output by the GRU is used as input to calculate the query matrix, key matrix, and value matrix. Relevance scores at different time steps are calculated using scaled dot-product attention and normalized to form an attention weight matrix. This matrix dynamically adjusts the fusion weights of protocol-layer and physical-layer features, enhancing the contribution of key feature dimensions and suppressing noise interference. The resulting cross-attention weight matrix accurately quantifies the correlation strength of bimodal features, guiding the deep fusion of protocol content and physical signal features, ensuring that the generated target message features possess both semantic and logical integrity and physical transmission robustness.

[0114] In the embodiment of the present application, the timing transfer rules are extracted from the protocol layer features, the frequency domain mutation intensity is quantified from the physical layer signal, a cross-modal association matrix is constructed through tensor product operations, and the GRU and self-attention mechanisms are used to realize timing modeling and dynamic weight allocation. The mapping relationship between the port number and protocol type in the protocol layer features and the energy entropy fluctuation characteristics of the physical layer signal are analyzed through the correlation between the timing transfer probability and the mutation intensity to form a dynamic representation of the cross-modal feature interaction. The GRU network captures the temporal coordinated changes of the protocol and physical features, and the self-attention mechanism further optimizes the feature fusion weights. The cross-attention weight matrix finally generated provides dynamic guidance for the efficient fusion of multi-dimensional features, ensuring the strong adaptability of feature expression to complex network environments.

[0115] In some instances, target message features are generated based on the cross-attention weight matrix, including:

[0116] The protocol layer feature vector and the frequency domain feature vector are weightedly fused based on the cross-attention weight matrix to determine the bimodal features;

[0117] Generate a pseudo hash sequence based on the byte sampling results of the encrypted payload in the original message data;

[0118] Determine the anti-replay code based on the XOR confusion operation of the pseudo-hash sequence and the bimodal feature;

[0119] Based on the dynamic S-box replacement algorithm, nonlinear transformation is performed on the anti-replay coding to determine the target message characteristics.

[0120] Exemplarily, the cross-attention weight matrix dynamically characterizes the correlation strength between protocol-layer features and physical-layer frequency-domain features, providing weighting guidance for bimodal feature fusion. Specifically, a matrix multiplication operation is performed on the protocol-layer feature vector and the cross-attention weight matrix to obtain a weighted vector for the protocol-layer features. Simultaneously, a similar operation is performed on the frequency-domain feature vector and the transpose of the cross-attention weight matrix to obtain a weighted vector for the frequency-domain features. The weighted protocol-layer features are fused with the frequency-domain features through element-by-element addition or concatenation to generate bimodal features. For example, if the protocol-layer feature vector has 192 dimensions and the frequency-domain feature vector has 9 dimensions, a 201-dimensional bimodal feature vector is generated after weighted fusion. The elements in the cross-attention weight matrix characterize the correlation strength between the protocol-layer features and the frequency-domain features at different dimensions, with high-weight dimensions indicating areas of synergy between key features. For example, if the mapping between the transport-layer port number and the application protocol type in the protocol-layer features shows a strong correlation with the high-frequency energy entropy mutation in the frequency-domain features, the corresponding weight value is significantly increased, ensuring that the fused features possess both logical and semantic integrity and physical transmission stability.

[0121] The byte sampling of the encrypted payload is intended to extract its key structural features while avoiding direct exposure of the encrypted content. Specifically, first, according to the preset position rules, sampling is performed at equal intervals from the Xth byte to the Yth byte after the starting offset of the encrypted payload. Among them, the values of X and Y are pre-defined according to the characteristics of the encryption protocol or actual needs, such as X=16 and Y=80, covering the payload header and key parameter areas. The sampling interval is dynamically adjusted according to the total length of the payload to ensure complete coverage of the key structural areas. For example, if the payload length is 200 bytes, the sampling interval can be set to 5% of the total length (that is, sampling once every 10 bytes), thereby capturing the distribution characteristics of the payload within a limited sampling point.

[0122] After sampling is completed, the acquired byte sequence is input into a preset hash function (such as SHA-256) to generate a pseudo-hash sequence. SHA-256 is chosen because it has strong collision resistance, a fixed output length (32 bytes), and is widely applicable in security scenarios. The sampled byte sequence needs to be preprocessed according to the requirements of the hash function, such as padding sequences of insufficient length (PKCS#7 standard) to ensure that the input meets the data block size of the hash operation. Through the hash operation, the original byte sequence is compressed into a fixed-length pseudo-hash sequence. This sequence not only represents the local structural characteristics of the payload, but also cannot be reversed due to the one-way nature of the hash function to deduce the original content, thereby preventing the leakage of sensitive information.

[0123] The pseudo-hash sequence generation process includes real-time calculation of the sampling interval based on the payload length to ensure that key areas (such as encryption algorithm parameters and initialization vectors) are covered; standardization of the sampled bytes (such as byte alignment and padding) to meet the input requirements of the hash function; inputting the processed data into the SHA-256 algorithm to generate a 32-byte pseudo-hash sequence; and secondary encoding of the hash result (such as Base64) to facilitate efficient processing of subsequent obfuscation operations. Through the above mechanism, the pseudo-hash sequence not only retains the key structural information of the encrypted payload, but also achieves anti-tampering protection through the irreversible characteristics of the hash function. This sequence provides a stable summary input for subsequent XOR obfuscation operations, ensuring that the generated anti-replay code is unique and dynamic, thereby effectively resisting replay attacks and feature forgery.

[0124] The core of the XOR obfuscation operation is to generate dynamic anti-replay codes by fusing the differential information of bimodal features and pseudo-hash sequences. Specifically, the bimodal feature vector (e.g., a 201-dimensional floating-point vector) is first aligned with the pseudo-hash sequence (e.g., a 32-byte binary sequence). Since bimodal features are usually represented in floating-point form, they need to be converted into a binary bit sequence to match the format of the pseudo-hash sequence. For example, each floating-point number is converted into a 32-bit binary representation according to the IEEE 754 standard, and the 201-dimensional feature vector will be expanded to a 201×32=6432-bit binary sequence. If the length of the pseudo-hash sequence (e.g., 256 bits) is less than the length of the feature vector binary sequence, the pseudo-hash sequence is cyclically extended, that is, the pseudo-hash sequence is repeatedly concatenated until its length is consistent with the feature vector binary sequence. For example, the 256-bit pseudo-hash sequence is cyclically extended to 6432 bits to ensure that the two dimensions are strictly matched.

[0125] After the data alignment is completed, a bit-by-bit exclusive OR (XOR) operation is performed on the two. The XOR operation rule is that if the corresponding bit values are the same, 0 is output, and if they are different, 1 is output. For example, if a bit in the feature binary sequence is 1 and the corresponding bit in the pseudo-hash sequence is 0, the XOR result is 1. Through bit-by-bit operations, the semantic information of the bimodal features and the local structural features of the pseudo-hash sequence are deeply integrated to generate a binary sequence with anti-replay coding. This process breaks the predictability of the features through the obfuscation mechanism, so that the codes generated by the same message at different transmission times or under different channel conditions have significant differences, thereby resisting attacks launched by attackers by replaying the same features.

[0126] To ensure the irreversibility and anti-analysis capability of the obfuscated results, the generated binary sequence needs to be post-processed. Specifically, the XOR result is converted into a byte sequence according to a preset group length (e.g., 8 bits per group). If there are padding bits, the padding bits are removed. For example, a 6432-bit XOR result is converted into an 804-byte anti-replay code. This code not only contains the fusion information of the protocol layer and the physical layer features, but also embeds the summary characteristics of the pseudo-hash sequence, making it difficult for attackers to restore the original features or forge valid codes through reverse analysis.

[0127] The resulting anti-replay code implements a security protection mechanism that dynamically changes the sampling position and hash calculation results of the pseudo-hash sequence with the message content to ensure the timeliness of the code. Loop expansion and type conversion are used to address the dimensional differences between the bimodal features and the pseudo-hash sequence, ensuring computational integrity. XOR operations disrupt the statistical regularity of the feature sequence, preventing attackers from inferring future codes from historical data. This step, through multi-level data transformation and obfuscation, imbues the target message features with inherent security attributes, providing a tamper-resistant input foundation for subsequent dynamic S-box replacement and comprehensively enhancing the feature's defense against replay attacks.

[0128] The dynamic S-box replacement algorithm introduces a key-driven nonlinear permutation rule to perform irreversible obfuscation against replay coding, ultimately generating target message features with inherent security properties. Specifically, the generation of dynamic S-boxes is based on preset dynamic parameters (such as timestamps or random seeds) to ensure that the replacement rules are unique each time the feature is generated. For example, using the hash value of the current timestamp as a seed, a 16×16 S-box matrix is dynamically generated through a pseudo-random number generation algorithm (such as AES-CTR mode). Each element of the matrix (0x00 to 0xFF) is randomly permuted, and each generated S-box is only applicable to the current message, thereby avoiding the risk of static S-boxes being reverse-engineered.

[0129] Each byte of the anti-replay code (for example, 0xAB) is split into the upper 4 bits (0xA) and the lower 4 bits (0xB), which serve as the row index and column index of the S-box respectively. For example, in the dynamically generated S-box matrix, the row index 0xA (decimal 10) corresponds to the 10th row, and the column index 0xB (decimal 11) corresponds to the 11th column. The table is looked up to obtain the replaced byte value (such as 0xCD). Through this operation, each byte of the anti-replay code is nonlinearly mapped to a new value, and the mapping rules change dynamically with the S-box. For example, if the same anti-replay code is generated at different times, the replacement results will be significantly different due to different S-boxes, thereby destroying the attacker's ability to predict the characteristic patterns.

[0130] To improve the irreversibility of the feature, multiple rounds of operations are required on the replaced byte sequence, each round including S-box replacement and bit shifting. First round of replacement: byte replacement is completed based on dynamic S-box; Circular left shift: the 8 bits of each byte are circularly shifted left by 3 bits to disrupt the bit order; Second round of replacement: replacement is performed again using a new dynamic S-box (derived from the result of the previous round); Final shift: intra-block circular right shift operation is performed on the entire byte sequence. Multiple rounds of operations completely mask the correlation between the feature and the original anti-replay code through cascaded nonlinear transformations and bit perturbations. For example, after three rounds of replacement and shifting, even if the attacker obtains the final feature, it is impossible to restore the original code content through reverse deduction.

[0131] In the final feature generation stage, the current timestamp (such as the Unix timestamp) is embedded into the target message features according to preset rules. Specifically, the timestamp is converted to a 4-byte binary format and XORed with the replaced byte sequence to ensure that the timestamp is embedded in the features in a dispersed manner. At the same time, the synchronization of the timestamp is guaranteed by the hardware clock to avoid watermark conflicts caused by clock offset. The features embedded with the watermark not only have temporal uniqueness, but can also be used to detect replay attacks. The target message features finally generated through the above process have protocol semantics, physical signal characteristics, and dynamic security properties, providing robust and unforgeable feature input for highly concealed threat detection.

[0132] In some instances, this also includes:

[0133] Based on the synchronization relationship between the timestamp of the target message feature and the physical layer signal waveform, a watermark is embedded to generate the target message feature including anti-replay coding and watermark.

[0134] Exemplarily, during the generation of target message signatures, the target message signature's timestamp is first strictly aligned with the sampling instant of the physical layer signal waveform through a hardware clock synchronization mechanism, ensuring that the two are completely consistent in timing. The timestamp is generated using a high-precision clock source (such as a GPS-synchronized clock or Network Time Protocol (NTP)) with microsecond accuracy to avoid synchronization errors caused by clock drift. The synchronization data of the physical layer signal waveform is obtained through the hardware timestamp function of the baseband chip or RF sensor, ensuring that its correspondence with the protocol layer timestamp is accurate to a single sampling point. Subsequently, the timestamp is converted to a fixed-length binary sequence (such as a 4-byte Unix timestamp) and a watermark identifier is generated using a preset hash function (such as SHA-256). This identifier contains unique information about the timestamp and a synchronization check code for the physical layer signal waveform. The watermark identifier is embedded using an exclusive-or operation: a bit-by-bit exclusive-or operation is performed on the watermark identifier with the designated locations of the anti-replay code (such as 4 bytes each reserved at the beginning, middle, and end) to generate the target message signature containing the watermark. For example, if the anti-replay code is 804 bytes and the watermark identifier is 12 bytes (3 groups of 4-byte timestamps), then the XOR operation is performed on the 0th to 3rd bytes, 400-403 bytes and 800-803 bytes of the code respectively to ensure that the watermark is embedded in a dispersed manner and does not affect the overall structure of the feature. The generated target message feature realizes the uniqueness verification of the transmission time through the strong binding relationship between the timestamp and the physical layer signal. If the attacker attempts to replay the historical features, the timestamp verification of the watermark identifier will fail due to the lack of synchronization with the current physical layer signal waveform, thereby effectively resisting replay attacks. This mechanism ensures that the watermark cannot be tampered with and has dynamic uniqueness through hardware-level synchronization, hash summary generation and distributed embedding strategy, providing end-to-end security for message features.

[0135] See also Figure 2 , is a schematic diagram of the structure of a message feature extraction device provided in an embodiment of the present application, comprising:

[0136] The message data acquisition unit 21 is used to obtain the original message data of the target network traffic and the corresponding physical layer signal waveform;

[0137] The protocol field determination unit 22 parses the original message data based on the preset protocol layering rules to determine a multi-layer protocol field set;

[0138] The protocol feature generating unit 23 determines a protocol layer feature vector based on a multi-layer protocol field set;

[0139] The frequency domain feature generating unit 24 determines a frequency domain feature vector based on the physical layer signal waveform;

[0140] A weight matrix construction unit 25 constructs a cross-attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector;

[0141] The message feature extraction unit 26 generates target message features based on the cross attention weight matrix.

[0142] See also Figure 3 An embodiment of the present application also provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored on the memory 310 and executable on the processor. When the processor 320 executes the computer program 311, the steps of any method for extracting message features are implemented.

[0143] Since the electronic device introduced in this embodiment is a device used to implement a message feature extraction device in the embodiment of the present application, based on the method introduced in the embodiment of the present application, technical personnel in this field can understand the specific implementation of the electronic device of this embodiment and its various variations. Therefore, how the electronic device implements the method in the embodiment of the present application will not be introduced in detail here. As long as the equipment used by technical personnel in this field to implement the method in the embodiment of the present application falls within the scope of protection to be protected by this application.

[0144] During the specific implementation process, when the computer program 311 is executed by the processor, any implementation method of the embodiments corresponding to the first aspect can be implemented.

[0145] It should be noted that, in the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0146] Those skilled in the art will appreciate that embodiments of the present application may provide methods, systems, or computer program products. Thus, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-readable storage media containing computer-readable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0150] The present application also provides a computer program product, which includes computer software instructions. When the computer software instructions are executed on a processing device, the processing device executes Figure 1 The process of a message feature extraction method in the corresponding embodiment.

[0151] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium can be a magnetic medium, an optical medium or a semiconductor medium, etc.

[0152] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0153] In the several embodiments provided in this application, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0154] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0155] In addition, the functional units in the various embodiments of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The above-mentioned integrated units may be implemented in the form of hardware and / or software functional units.

[0156] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device to execute all or part of the steps of the various embodiments of the method of the present application.

[0157] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

[0158] Although the preferred embodiments of this specification have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of this specification.

[0159] Obviously, those skilled in the art may make various changes and modifications to this specification without departing from the spirit and scope of this specification. Thus, if such changes and modifications fall within the scope of the claims of this specification and their equivalents, this specification is intended to include such changes and modifications.

Claims

1. A message feature extraction method, characterized in that: include: Obtain the original message data of the target network traffic and the corresponding physical layer signal waveform; Parsing the original message data based on preset protocol layering rules to determine a multi-layer protocol field set; Determining a protocol layer feature vector based on the multi-layer protocol field set; Determining a frequency domain eigenvector based on the physical layer signal waveform; Constructing a cross-attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector; The constructing of a cross attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector includes: Determining a protocol timing transition probability based on a mapping relationship between a transport layer port number and an application layer protocol type in the protocol layer feature vector; Determining the frequency domain mutation intensity based on the distribution characteristics of the energy entropy of each frequency band in the frequency domain feature vector; Determining a cross-modal correlation matrix based on the protocol timing transition probability and the frequency domain mutation intensity; Performing temporal modeling on the cross-modal association matrix based on a gated recurrent unit to determine feature dependencies; Based on the self-attention mechanism, weights are assigned to the feature dependencies to determine a cross-attention weight matrix; Generating target message features based on the cross-attention weight matrix; Generating target message features based on the cross attention weight matrix includes: Performing weighted fusion on the protocol layer feature vector and the frequency domain feature vector based on the cross attention weight matrix to determine a bimodal feature; Generate a pseudo hash sequence based on a byte sampling result of the encrypted payload in the original message data; Determining an anti-replay code based on an XOR obfuscation operation of the pseudo-hash sequence and the bimodal feature; The anti-replay code is nonlinearly transformed based on a dynamic S-box replacement algorithm to determine target message characteristics.

2. The method according to claim 1, characterized in that The parsing of the original message data based on the preset protocol layering rule to determine the multi-layer protocol field set includes: Determine a protocol identification segment based on a first preset length byte of the header of the original message data; Determining a protocol parsing template based on a matching result between the protocol identification segment and the protocol signature library; Performing secondary parsing on the unmatched protocol fields in the original message data based on a sliding window mechanism to determine the position markers of the variable-length fields; Generating a protocol tree including a multi-layer protocol structure based on the protocol parsing template and the position mark of the variable-length field; Based on the hierarchical structure of the protocol tree, a multi-layer protocol field set is determined.

3. The method according to claim 1, characterized in that The determining of the protocol layer feature vector based on the multi-layer protocol field set includes: Determining a first semantic code based on a mapping relationship between a transport layer port number and an application layer protocol type in the multi-layer protocol field set; Determining a second semantic code based on a timing correlation coefficient between a network layer TTL value and a data link layer frame interval in the multi-layer protocol field set; A protocol layer feature vector is determined based on a normalized concatenation result of the first semantic code and the second semantic code.

4. The method according to claim 1, wherein The determining of the frequency domain eigenvector based on the physical layer signal waveform includes: Dividing the physical layer signal waveform into frequency bands based on a wavelet packet decomposition algorithm to determine the energy entropy of each frequency band; Determine the signal stability coefficient based on the decay rate of the autocorrelation function of the signal amplitude between adjacent messages; A frequency domain eigenvector is determined based on a weighted calculation result of the energy entropy of each frequency band and the signal stability coefficient.

5. The method according to claim 1, wherein Also includes: Based on the synchronization relationship between the timestamp of the target message feature and the physical layer signal waveform, a watermark identifier is embedded to generate the target message feature including the anti-replay code and the watermark identifier.

6. A message feature extraction device, characterized in that: include: A message data acquisition unit, used to obtain the original message data of the target network traffic and the corresponding physical layer signal waveform; A protocol field determination unit, which parses the original message data based on a preset protocol layering rule to determine a multi-layer protocol field set; A protocol feature generating unit, configured to determine a protocol layer feature vector based on the multi-layer protocol field set; A frequency domain feature generating unit, which determines a frequency domain feature vector based on the physical layer signal waveform; A weight matrix construction unit, which constructs a cross-attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector; The constructing of a cross attention weight matrix based on the protocol layer feature vector and the frequency domain feature vector includes: Determining a protocol timing transition probability based on a mapping relationship between a transport layer port number and an application layer protocol type in the protocol layer feature vector; Determining the frequency domain mutation intensity based on the distribution characteristics of the energy entropy of each frequency band in the frequency domain feature vector; Determining a cross-modal correlation matrix based on the protocol timing transition probability and the frequency domain mutation intensity; Performing temporal modeling on the cross-modal association matrix based on a gated recurrent unit to determine feature dependencies; Based on the self-attention mechanism, weights are assigned to the feature dependencies to determine a cross-attention weight matrix; A message feature extraction unit, which generates target message features based on the cross-attention weight matrix; Generating target message features based on the cross attention weight matrix includes: Performing weighted fusion on the protocol layer feature vector and the frequency domain feature vector based on the cross attention weight matrix to determine a bimodal feature; Generate a pseudo hash sequence based on a byte sampling result of the encrypted payload in the original message data; Determining an anti-replay code based on an XOR obfuscation operation of the pseudo-hash sequence and the bimodal feature; The anti-replay code is nonlinearly transformed based on a dynamic S-box replacement algorithm to determine target message characteristics.

7. An electronic device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor is configured to implement the steps of the message feature extraction method as described in any one of claims 1 to 5 when executing the computer program stored in the memory.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the message feature extraction method according to any one of claims 1 to 5 is implemented.

Images