Encrypted Traffic Detection Method and System Based on NiN Hybrid Dense Residual Network

Abstract

This invention relates to an encrypted traffic detection method based on a NiN hybrid dense residual network. The method designs and creates a NiN hybrid dense residual network, and based on a sample dataset, analyzes the target traffic feature values ​​corresponding to encrypted traffic data packets. The NiN hybrid dense residual network is trained to obtain an encrypted traffic data packet recognition model, which is then used to identify and detect the encrypted traffic data packets to be analyzed. The invention also designs a corresponding system, incorporating modules for feature extraction, network training, and prediction / classification to efficiently achieve encrypted traffic data packet recognition and detection. The NiN hybrid dense residual network designed in this invention employs a multi-module network with progressive learning, resulting in higher model robustness and a lower false negative rate. It can uncover deeper features in encrypted traffic data, achieving efficient and stable data analysis and classification, and improving the efficiency of encrypted traffic recognition and detection.

Description

Technical Field

[0001] This invention relates to an encrypted traffic detection method and system based on NiN hybrid dense residual networks, belonging to the field of traffic detection and identification technology. Background Technology

[0002] As internet communication security gains importance for users and businesses, encrypting traffic generated during communication has become a mainstream security measure to protect the security of user and business communication information. Among numerous encryption protocols, HTTPS (Hypertext Transfer Protocol Secure) is the most widely used. HTTPS uses SSL (Secure Sockets Layer) and TLS (Transport Layer Security) on top of Hypertext Transfer Protocol (HTTP) to ensure secure transmission. While encrypting ordinary internet traffic protects the privacy and integrity of information to a certain extent, it also provides shelter for malicious activities on the network, allowing them to carry out destructive acts more covertly. These malicious traffic behaviors based on SSL / TLS protocols can steal user information, implant malicious advertisements, and conduct communication between botnets, causing enormous harm and incalculable losses to ordinary users, businesses, and critical national infrastructure. Therefore, against this backdrop, encrypted traffic detection methods based on various modern computer technologies have always been one of the main research directions.

[0003] Traditional malicious traffic detection primarily focuses on screening and analyzing plaintext information, commonly employing depth-of-pipe (DPI) detection techniques for deep packet inspection. However, DPI-based methods are largely ineffective against encrypted traffic, failing to directly extract plaintext information. Currently, more advanced methods for encrypted traffic identification are based on machine learning and deep learning. Machine learning-based encrypted traffic identification addresses two main issues: features and algorithms. Regarding features, most research extracts protocol-independent or protocol-related features from data packets or sessions, sometimes combined with manually selected features. For algorithms, traditional machine learning identification methods can be categorized into supervised learning-based and unsupervised learning-based malicious encrypted traffic identification algorithms. While traditional machine learning-based methods for malicious encrypted traffic identification have achieved significant results, they are limited by feature selection. Current research focuses more on deep learning algorithms with powerful representation and feature mining capabilities. The shortcomings of existing malicious encrypted traffic identification methods are summarized below:

[0004] (1) Due to the limitations of manually selected features, many hidden features in encrypted traffic cannot be well mined, resulting in unstable model accuracy and a high false negative rate.

[0005] (2) For networks containing a large amount of unknown and new malicious encrypted traffic, the existing models have poor robustness and adaptability and cannot adapt well to different datasets. Summary of the Invention

[0006] The technical problem to be solved by this invention is to provide an encrypted traffic detection method based on NiN hybrid dense residual network, which improves the detection and identification efficiency of encrypted traffic data packets based on the creation of an innovative classification network.

[0007] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs an encrypted traffic detection method based on NiN hybrid dense residual network, and performs the following steps A to B to obtain an encrypted traffic data packet identification model; then performs step i, applying the encrypted traffic data packet identification model to identify and detect the encrypted traffic data packets to be analyzed;

[0008] Step A. Construct a preset number of encrypted traffic data packets corresponding to each preset traffic category, and extract the preset target traffic feature values ​​corresponding to each encrypted traffic data packet. Construct samples by combining the target traffic feature values ​​corresponding to each encrypted traffic data packet with the traffic category corresponding to the encrypted traffic data packet, thereby obtaining a sample dataset, and then proceed to Step B.

[0009] Step B. Construct a NiN hybrid dense residual network, and based on the sample dataset, use the target traffic feature values ​​corresponding to the sample encrypted traffic data packets in the sample as input and the traffic classification category corresponding to the sample encrypted traffic data packets as output to train the NiN hybrid dense residual network to obtain an encrypted traffic data packet recognition model.

[0010] Step i. Extract the target traffic feature values ​​corresponding to the encrypted traffic data packets to be analyzed, input them into the encrypted traffic data packet recognition model for processing, obtain the traffic classification category corresponding to the encrypted traffic data packets to be analyzed, and realize the recognition and detection of the encrypted traffic data packets to be analyzed.

[0011] As a preferred embodiment of the present invention: In step B, the NiN hybrid dense residual network includes a feature input module, a first NiN module, a first residual cascade structure, a first max pooling layer, a second NiN module, a dense cascade structure, a transition module, a second max pooling layer, a third NiN module, a second residual module, a global average pooling layer, a fully connected layer, and a classification output module, which are connected in series from the input end to the output end. The input end of the feature input module constitutes the input end of the NiN hybrid dense residual network, and the output end of the classification output module constitutes the output end of the NiN hybrid dense residual network. The first residual cascade structure includes at least one first residual module connected in series from the input end to the output end. The input end of the first first residual module constitutes the input end of the first residual cascade structure, and the output end of the last first residual module constitutes the output end of the first residual cascade structure. The dense cascade structure includes at least two dense modules connected in series from the input end to the output end. The input end of the first dense module constitutes the input end of the dense cascade structure, and the output end of the last dense module constitutes the output end of the dense cascade structure.

[0012] As a preferred technical solution of the present invention: the first NiN module, the second NiN module, and the third NiN module have the same structure. Each NiN module includes a 1×1 convolutional layer, a ReLU activation function layer, a 1×1 convolutional layer, and a ReLU activation function layer connected in series from the input end to the output end. The input end of the first 1×1 convolutional layer constitutes the input end of the NiN module, and the output end of the last ReLU activation function layer constitutes the output end of the NiN module.

[0013] As a preferred technical solution of the present invention: the structure of the second residual module and the structure of each of the first residual modules are the same. Each residual module includes a 3×3 convolutional layer, a batch normalization layer, a ReLU activation function layer, a 3×3 convolutional layer, a batch normalization layer, a fusion layer, and a ReLU activation function layer connected in series from the input end to the output end. The input end of the first 3×3 convolutional layer in sequence constitutes the input end of the residual module, the input end of the fusion layer is simultaneously connected to the input end of the residual module, and the output end of the last ReLU activation function layer in sequence constitutes the output end of the residual module.

[0014] As a preferred embodiment of the present invention: the structures of each dense module are identical, and each dense module includes four convolutional normalization activation modules connected in series from the input end to the output end. The input end of the first convolutional normalization activation module constitutes the input end of the dense module, and the output end of the fourth convolutional normalization activation module constitutes the output end of the dense module. The structures of each convolutional normalization activation module are identical, and each convolutional normalization activation module includes a 3×3 convolutional layer, a batch normalization layer, a ReLU activation function layer, and a splicing layer connected in series from the input end to the output end. The input end of the 3×3 convolutional layer constitutes the input end of the convolutional normalization activation module, and the output end of the splicing layer constitutes the output end of the convolutional normalization activation module. The input end of the splicing layer in each convolutional normalization activation module is also connected to the input end of the dense module and the output end of the preceding convolutional normalization activation module.

[0015] As a preferred embodiment of the present invention, the transition module includes a 1×1 convolutional layer, a batch normalization layer, a ReLU activation function layer, and an average pooling layer connected in series from the input end to the output end, wherein the input end of the 1×1 convolutional layer constitutes the input end of the transition module, and the output end of the average pooling layer constitutes the output end of the transition module.

[0016] As a preferred technical solution of the present invention: the preset target traffic feature values ​​include traffic data packet duration, number of forward / backward data packets, statistical features of data packet length, number of traffic bytes per second and number of data packets, traffic arrival time interval statistics, and TCP flag bits.

[0017] As a preferred technical solution of the present invention: the sample encrypted traffic data packet and the encrypted traffic data packet to be analyzed are obtained from the original traffic data packet according to the following steps a to c;

[0018] Step a. Traffic data segmentation: Based on the traffic 5-tuple information corresponding to the source IP, destination IP, source port, destination port, and protocol type, the encrypted traffic in the original traffic data packet is segmented to obtain each primary encrypted traffic.

[0019] Step b. Deduplication and filtering of traffic data: Filter each primary encrypted traffic stream to obtain each primary encrypted traffic stream corresponding to the preset target type encryption protocol, which constitutes each intermediate encrypted traffic stream;

[0020] Step c. Traffic data reassembly: Based on the traffic quintuple information and timestamp, reassemble the intermediate encrypted traffic belonging to the same traffic session to form an encrypted traffic data packet.

[0021] Corresponding to the above, the technical problem to be solved by the present invention is to provide a system for encrypted traffic detection based on NiN hybrid dense residual network, which is based on the creation of innovative classification network, the design of each module, and the efficient completion of model training and recognition detection.

[0022] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a system for encrypted traffic detection based on NiN hybrid dense residual network, including an encrypted traffic feature extraction module, a model training module, and a model prediction and classification module. The encrypted traffic feature extraction module is used to read, parse, and extract features from sample encrypted traffic data packets and encrypted traffic data packets to be analyzed, respectively, to obtain preset target traffic feature values ​​corresponding to the encrypted traffic data packets and preset target traffic feature values ​​corresponding to the encrypted traffic data packets to be analyzed.

[0023] The model training module is based on the sample dataset. It takes the target traffic feature value corresponding to the sample encrypted traffic data packet as input and the traffic classification category corresponding to the sample encrypted traffic data packet as output. It combines the cross-entropy loss function to train the NiN hybrid dense residual network to obtain the encrypted traffic data packet recognition model.

[0024] The model prediction and classification module is used to process the preset target traffic feature values ​​corresponding to the encrypted traffic data packets to be analyzed using the encrypted traffic data packet recognition model, thereby obtaining the traffic classification category corresponding to the encrypted traffic data packets to be analyzed and realizing the recognition and detection of the encrypted traffic data packets to be analyzed.

[0025] The encrypted traffic detection method and system based on NiN hybrid dense residual network described in this invention has the following technical advantages compared with the prior art:

[0026] (1) The encrypted traffic detection method based on NiN hybrid dense residual network designed in this invention innovatively integrates NiN modules, residual modules, and dense modules into a NiN hybrid dense residual network. Based on the sample dataset, the analysis object is the characteristic value of each target traffic corresponding to the encrypted traffic data packet. The NiN hybrid dense residual network is trained to obtain an encrypted traffic data packet recognition model, and then the encrypted traffic data packet to be analyzed is identified and detected. This invention also designs a corresponding system, designing corresponding modules for feature extraction, network training, and prediction classification to efficiently realize the identification and detection of encrypted traffic data packets. The NiN hybrid dense residual network designed in this invention adopts the step-by-step learning of multi-module networks, which has higher model robustness and lower model false negative rate. It can mine deeper features in encrypted traffic data, realize efficient and stable data analysis and classification, and improve the working efficiency of encrypted traffic identification and detection. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the structure of the NiN hybrid dense residual network in the design of this invention;

[0028] Figure 2 This is a schematic diagram of the encrypted traffic detection method based on NiN hybrid dense residual network designed in this invention;

[0029] Figure 3 This is a flowchart of the preprocessing of raw traffic data packets in the design of this invention;

[0030] Figure 4 This is a flowchart of the data processing before network training in the design and application of this invention;

[0031] Figure 5 This is a flowchart illustrating the classification of encrypted traffic data packets to be analyzed during the design, application, and implementation of this invention. Detailed Implementation

[0032] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0033] The encrypted traffic detection method based on NiN hybrid dense residual network designed in this invention, in practical applications, performs the following steps A to B to obtain an encrypted traffic data packet identification model.

[0034] Step A. Construct a preset number of encrypted traffic data packets corresponding to each preset traffic category, and extract the preset target traffic feature values ​​corresponding to each encrypted traffic data packet. Construct samples by combining the target traffic feature values ​​corresponding to each encrypted traffic data packet with the traffic category corresponding to the encrypted traffic data packet, and then obtain the sample dataset. Then proceed to Step B.

[0035] In practical applications, since the data is encrypted traffic, there is basically no obvious plaintext information in the encrypted traffic. Therefore, this invention designs and uses some statistical features of the traffic. These statistical features are not related to the core information of the data, but are only a kind of time or space feature statistics. That is, here, various target traffic feature values ​​are preset, such as the duration of traffic packets (Flow Duration), the number of forward / backward packets (Total Fwd / Backward Packets), statistical features of packet length (Max, Min, Mean, Std of Packet Length), the number of bytes and packets per second (Flow Bytes / s, Flow Packets / s), the statistics of traffic arrival time interval (Flow IAT Mean, Std, Max, Min), and TCP flags (such as FIN, SYN, ACK, etc.). Through these features, the model can capture different feature patterns of encrypted traffic, thereby providing richer information for subsequent classification models.

[0036] Step B. Construct a NiN hybrid dense residual network, and based on the sample dataset, use the target traffic feature values ​​corresponding to the sample encrypted traffic data packets in the sample as input and the traffic classification category corresponding to the sample encrypted traffic data packets as output to train the NiN hybrid dense residual network to obtain an encrypted traffic data packet recognition model.

[0037] In practical applications, such as Figure 1 As shown, the NiN hybrid dense residual network is constructed by sequentially connecting a feature input module, a first NiN module, a first residual cascade structure, a first max pooling layer, a second NiN module, a dense cascade structure, a transition module, a second max pooling layer, a third NiN module, a second residual module, a global average pooling layer, a fully connected layer, and a classification output module from the input end to the output end. The input end of the feature input module constitutes the input end of the NiN hybrid dense residual network, and the output end of the classification output module constitutes the output end of the NiN hybrid dense residual network. The first residual cascade structure includes at least one first residual module sequentially connected from the input end to the output end. The input end of the first first residual module constitutes the input end of the first residual cascade structure, and the output end of the last first residual module constitutes the output end of the first residual cascade structure. The dense cascade structure includes at least two dense modules sequentially connected from the input end to the output end. The input end of the first dense module constitutes the input end of the dense cascade structure, and the output end of the last dense module constitutes the output end of the dense cascade structure.

[0038] The first NiN module, the second NiN module, and the third NiN module have the same structure. Each NiN module includes a 1×1 convolutional layer, a ReLU activation function layer, another 1×1 convolutional layer, and another ReLU activation function layer connected in series from the input end to the output end. The input end of the first 1×1 convolutional layer in sequence constitutes the input end of the NiN module, and the output end of the last ReLU activation function layer in sequence constitutes the output end of the NiN module.

[0039] The structure of the second residual module is the same as that of each of the first residual modules. Each residual module includes a 3×3 convolutional layer, a batch normalization layer, a ReLU activation function layer, another 3×3 convolutional layer, a batch normalization layer, a fusion layer, and a ReLU activation function layer connected in series from the input end to the output end. The input end of the first 3×3 convolutional layer in sequence constitutes the input end of the residual module, the input end of the fusion layer is also connected to the input end of the residual module, and the output end of the last ReLU activation function layer in sequence constitutes the output end of the residual module.

[0040] Each dense module has the same structure. Each dense module includes four convolutional normalization activation modules connected in series from the input to the output. The input of the first convolutional normalization activation module constitutes the input of the dense module, and the output of the fourth convolutional normalization activation module constitutes the output of the dense module. Each convolutional normalization activation module has the same structure. Each convolutional normalization activation module includes a 3×3 convolutional layer, a batch normalization layer, a ReLU activation function layer, and a concatenation layer connected in series from the input to the output. The input of the 3×3 convolutional layer constitutes the input of the convolutional normalization activation module, and the output of the concatenation layer constitutes the output of the convolutional normalization activation module. The input of the concatenation layer in each convolutional normalization activation module is also connected to the input of the dense module and the output of the preceding convolutional normalization activation module.

[0041] The transition module consists of a 1×1 convolutional layer, a batch normalization layer, a ReLU activation function layer, and an average pooling layer connected in series from the input to the output. The input of the 1×1 convolutional layer constitutes the input of the transition module, and the output of the average pooling layer constitutes the output of the transition module.

[0042] In the sequential analysis and processing of target traffic feature values ​​corresponding to encrypted traffic data packets by the aforementioned NiN hybrid dense-residual network, the feature input module serves as the input to the NiN hybrid dense-residual network, receiving the target traffic feature values ​​corresponding to the encrypted traffic data packets. This invention assumes that the dimension of the input feature quantity is x. Input data is batched into the feature input module, with each batch having a shape of [batch_size, x]. Traffic features typically contain multiple numerical attributes used to describe each encrypted traffic data packet. The main task of the feature input module is to format these features into a format suitable for subsequent layers. In application, this can be expressed by a formula: assuming the dimension of the input feature quantity is x, the input data is represented as X∈R^{N×x}, where N is the number of samples and x is the dimension of the feature quantity.

[0043] The first NiN module uses 1×1 convolution operations to map the dimension of the input data from x features to 128 channels. This process is accomplished by two layers of 1×1 convolutions. After convolution, the ReLU activation function is applied. The role of the NiN module is to improve the expressive power of features through local linear combination, while introducing non-linearity to generate more complex and high-dimensional feature maps, providing richer information for subsequent layers. In application, this can be expressed by the formula: input X_in∈R^{N×x}, output X_out∈R^{N×128}, that is, mapping the input features from 70 to 128.

[0044] In the application of the first NiN module, the convolution operation is: X out =ReLU(W*X) in +b), W∈R^{128×x} is the convolution kernel, b is the bias term, and * represents the convolution operation. In the application, the NiN module is designed to include two 1×1 convolutional layers. The weight matrices of the first and second layers are a1∈R^{128×x} and a2∈R^{128×128}, respectively.

[0045] The first residual concatenation structure specifically uses two consecutive first residual modules, each employing two convolutional layers with a kernel size of 3×3. Each layer is followed by a batch normalization layer and a ReLU activation function layer. Within the first residual module, the input is directly added to the output (a skip connection) to prevent the vanishing gradient problem and maintain information flow within the deep network. By introducing this first residual concatenation structure, the network can still be trained effectively even with an increased number of layers. The batch normalization layer helps accelerate the training process and improve stability.

[0046] In the first residual cascaded structure application, the residual operations are represented as: Y1 = ReLU(W1*X+b1), Y2 = W2*Y1+b2; the residual connection is represented as: Y out=X+Y2; where W1 and W2 are convolution kernels, X is the input feature, Y1 is the feature after the first convolution, Y2 is the feature after the second convolution, b1 and b2 are bias terms, the number of input channels is 128, and the number of output channels remains unchanged at 128.

[0047] The first max pooling layer reduces the dimensionality of the feature map by extracting the maximum value in the local region. The pooling window size is set to 2, so the feature channels remain unchanged, but the spatial dimension of the features is reduced. Pooling operation can reduce the amount of computation while retaining the most important feature information, thus enhancing the robustness of the model.

[0048] In the first max pooling layer application, the pooling operation is represented as: X out =max(X in (i:i+2)), where i is the pooling window index, X in The input features are 128 in both input and output channels, and the pooling operation only changes the feature dimension.

[0049] The second NiN module again uses 1×1 convolutions to increase the number of channels from 128 to 256. This means the feature dimension is further increased, providing more space for feature representation. By increasing the number of channels, the model can capture features at more different levels and prepare more complex feature maps for subsequent dense blocks. In the application of the second NiN module, the convolution operation is represented as: X out =ReLU(W*X) in +b), where W∈R^{256×128}.

[0050] The dense concatenation structure uses three consecutive dense modules with identical structures to ensure that deeper features in the data can be learned. Each dense module consists of multiple convolutional layers, and the input of each layer is the concatenation of the outputs of all previous layers. The dense modules introduce a deep connection mechanism, so that the input of each layer not only includes the output of the previous layer, but also the outputs of all preceding layers. Dense connections enhance the flow of information, effectively solve the gradient vanishing problem, and improve feature reuse. Here, each dense module has 4 layers, and each layer outputs 64 features. The final dense concatenation structure outputs a feature map with T channels. out =T in +4×64+4×64+4×64=1024, meaning that after the dense cascaded structure, the number of feature channels expands to 1024, where T in Given the number of input channels, dense operations are represented as: Y l =ReLU(W l *Concatenate(X0,X1,...,X l-1 )+b l ), where W lX is the convolution kernel of the l-th layer. l For the output of layer l, b l This corresponds to the bias term.

[0051] The transition module reduces the number of channels and the size of the feature map through 1×1 convolutions and average pooling. The transition block reduces the number of channels from 1024 to 512 and reduces the spatial dimensionality through average pooling. The role of the transition block is to control the computational complexity of the model while maintaining the efficient flow of feature information. In application, the transition operation is represented as: X out =AvgPooling(ReLU(W*X) in +b)), where W∈R^{512×1024}.

[0052] The second max-pooling layer is the same as the first max-pooling layer, using a pooling window size of 2. Pooling further reduces the spatial dimensionality of features, which helps to reduce computational costs and enhance feature abstraction capabilities. The pooling operation is represented as: X out =max(X in (i:i+2)), where i is the pooling window index, X in The input features are 512 channels each, and the pooling operation only changes the feature dimension.

[0053] The third NiN module increases the number of channels from 512 to 1024 through 1×1 convolutions. This design further enhances the network's feature representation capabilities, allowing the model to extract richer high-dimensional features. Increasing the number of channels is to capture more complex patterns and relationships at deeper layers of the model. In application, the convolution operation is represented as: X out =ReLU(W*X) in +b), where W∈R^{1024×512}.

[0054] The second residual module contains two convolutional layers, each followed by a batch normalization layer and a ReLU activation function layer. It directly passes the input to the output through skip connections. The second residual module is used to further capture deeper features while maintaining gradient flow through residual connections. In application, the operation of the second residual module is represented as: Y out = X + W2 * ReLU(W1 * X + b1) + b2, where W1 and W2 are convolution kernels, X is the input feature, and Y is the input feature. out For output features.

[0055] The global average pooling layer averages the values ​​of each feature channel, ultimately generating a feature vector of size [batch_size, 1024]. Through global average pooling, the model can significantly reduce the number of parameters, avoid overfitting, and provide a compact feature representation for classification tasks. In application, the global average pooling operation is represented as: Where T is the feature length, j is the channel index, the number of input channels is 1024, and the number of output channels remains at 1024.

[0056] The fully connected layer maps features to Y categories (the number of target categories) through a linear transformation. After the fully connected layer, a softmax activation function is used to output the probability of each category. The fully connected layer is used for the final classification decision, mapping features to a probability distribution of the output label. In practice, the fully connected operation is represented as: Z = Softmax(W fc *X+b fc ), where W fc ∈R^{1024×15} is the weight matrix, b fc This is a bias term.

[0057] The classification output module uses the softmax activation function to convert the model's output into probabilities for each class, and finally makes a prediction based on the class with the highest probability. This module provides the final classification result for the input data, outputting a prediction of which class each traffic sample belongs to. In application, the output prediction is represented as: Where Z is the output of the fully connected layer. For predicted labels.

[0058] In step B above, during the training process of the NiN hybrid dense-residual network, as follows: Figure 4 As shown, the main key steps include: data cleaning, data standardization and normalization, data labeling, data segmentation, and model training. After these steps, the training of the NiN hybrid dense residual network can be completed, and an encrypted traffic data packet recognition model can be obtained.

[0059] The data cleaning process mainly involves three steps: handling default values, removing duplicate data, and handling outliers. Some traffic may lose data due to interruptions during packet capture, so it is necessary to handle missing feature values, such as filling or deleting them. Some data packets may be recorded repeatedly, so it is necessary to remove duplicate data packets or traffic during preprocessing and detect and handle outliers. Ensuring the rationality of feature data is also essential.

[0060] In the steps of data standardization and normalization, the mean of each feature is set to 0 and the standard deviation to 1, eliminating the influence of different dimensions between features and making the model easier to learn; in the normalization process, feature values ​​are mapped to the range of [-1,1], so that different features have the same scale and improve the performance of the algorithm.

[0061] In the data tagging step, the initial design selects each sample encrypted traffic data packet corresponding to each preset traffic category, which is the classification tagging here, marking its traffic nature.

[0062] In the data splitting step, the dataset is divided into a training set and a test set in a ratio of 8:2. The former is used for model training, and the latter is used for model validation and testing.

[0063] During model training, training parameters are preset for the NiN hybrid dense residual network, and the model converges after a certain number of training rounds. The trained model is then saved.

[0064] In the model prediction and model validation steps, the effectiveness of the model is tested and validated using the previously divided test dataset. The model's accuracy, false positive rate, false negative rate, etc., are recorded, and a test report is generated.

[0065] Following steps A to B above, an encrypted traffic data packet identification model is obtained. In further practical implementation, step i is performed to apply the encrypted traffic data packet identification model to identify and detect the encrypted traffic data packets to be analyzed.

[0066] Step i. Extract the target traffic feature values ​​corresponding to the encrypted traffic data packets to be analyzed, input them into the encrypted traffic data packet recognition model for processing, obtain the traffic classification category corresponding to the encrypted traffic data packets to be analyzed, and realize the recognition and detection of the encrypted traffic data packets to be analyzed.

[0067] In the specific execution of step i, such as Figure 5 As shown, the main steps include: reading the encrypted traffic data packets to be analyzed, loading the model, and predicting and classifying the model. After these steps, the prediction and classification of the encrypted traffic data packets to be analyzed can be completed.

[0068] First, the encrypted traffic data packet to be analyzed is read. Then, the encrypted traffic feature extraction module is applied to further perform traffic reading, traffic parsing, and traffic feature extraction on the encrypted traffic data packet to be analyzed, so as to obtain the preset target traffic feature values ​​corresponding to the encrypted traffic data packet to be analyzed, which are used as inputs for the encrypted traffic data packet recognition model.

[0069] Then, the encrypted traffic data packet identification model receives the input of preset target traffic feature values ​​corresponding to the encrypted traffic data packets to be analyzed. The encrypted traffic data packet identification model predicts the category probability of each encrypted traffic data packet to be analyzed. The predicted category with the highest probability is selected for the classification of the encrypted traffic data packets to be analyzed. The record is saved in the classification document, and finally the classification report is output. At this point, the encrypted traffic classification work is completed.

[0070] In practical applications, to realize the application of the encrypted traffic detection method designed above, a corresponding system was further designed, such as... Figure 2As shown, the system includes an encrypted traffic feature extraction module, a model training module, and a model prediction and classification module. The encrypted traffic feature extraction module is responsible for extracting preset target traffic feature values ​​from encrypted traffic data packets for subsequent model training and prediction. In application, the encrypted traffic feature extraction module is used to perform traffic reading, traffic parsing, and traffic feature extraction on sample encrypted traffic data packets and encrypted traffic data packets to be analyzed, respectively, to obtain the preset target traffic feature values ​​corresponding to the encrypted traffic data packets and the encrypted traffic data packets to be analyzed, namely, the traffic data packet duration (Flow Duration), the number of forward / backward packets (Total Fwd / BackwardPackets), the statistical features of packet length (Max, Min, Mean, Std of Packet Length), the number of bytes per second and packets per second (Flow Bytes / s, Flow Packets / s), the statistics of traffic arrival time interval (Flow IAT Mean, Std, Max, Min), and TCP flags (such as FIN, SYN, ACK, etc.).

[0071] In practical applications of encrypted traffic feature extraction modules, the feature extraction process can be described by the formula: X i =[f1(x i ),f2(x i ),...,f n (x i )], where X i f1(x) represents the i-th encrypted traffic data packet. i ),f2(x i ),...,f n (x i ) represent the features extracted from encrypted traffic data packets, and the feature dimension n depends on the specific extraction rules.

[0072] The model training module is based on the sample dataset. It takes the target traffic feature value corresponding to the sample encrypted traffic data packet as input and the traffic classification category corresponding to the sample encrypted traffic data packet as output. It combines the cross-entropy loss function to train the NiN hybrid dense residual network to obtain the encrypted traffic data packet recognition model.

[0073] In practical applications, the design of the model training module includes data normalization and standardization, dataset splitting, setting training parameters, and model training. The purpose of data standardization is to make the mean of each feature 0 and the standard deviation 1, which can eliminate the influence of different dimensions between features and make the model easier to learn. The purpose of normalization is to map feature values ​​to a specified range. Here, the feature range [-1,1] is used, which can make different features have the same scale, which helps to improve the performance of the algorithm.

[0074] The dataset split is set according to the typical training-to-test ratio of 8:2. Training parameters can be set according to specific needs, including the number of training epochs and the learning rate. The training process uses the cross-entropy loss function and optimization algorithms for gradient descent and weight updates. Where L is the loss function and y is the true label. is the predicted value, and C is the total number of categories.

[0075] The model prediction and classification module utilizes a pre-trained encrypted traffic packet recognition model to identify and classify the preset target traffic feature values ​​corresponding to new encrypted traffic packets to be analyzed. This mainly includes reading the encrypted traffic packets to be analyzed and outputting the classification results. The classification output module in the encrypted traffic packet recognition model is responsible for classifying the traffic based on the model prediction results, dividing the encrypted traffic packets to be analyzed into different categories (such as normal traffic, attack traffic, etc.). The processing flow involves determining the category corresponding to the highest probability by comparing probability values. Output: The final encrypted traffic classification result, such as attack type (DoS, DDoS, etc.) or normal traffic; this module can also record the classification results and generate classification reports to facilitate subsequent network security analysis.

[0076] Applying the encrypted traffic detection method of this invention to practice, the sample encrypted traffic data packets and the encrypted traffic data packets to be analyzed are obtained from the original traffic data packets according to steps a to c as follows: Figure 3 As shown.

[0077] Step a. Traffic data segmentation: Based on the traffic 5-tuple information corresponding to the source IP, destination IP, source port, destination port, and protocol type, the encrypted traffic in the original traffic data packet is segmented to obtain each primary encrypted traffic. In practice, traffic can also be segmented according to time windows, and encrypted traffic within a certain time range is treated as a single stream. In this way, long-running original traffic data packets can be segmented into smaller independent streams for subsequent processing.

[0078] Step b. Traffic data deduplication and filtering: Filter each primary encrypted traffic stream to obtain the primary encrypted traffic streams corresponding to each preset target type encryption protocol, forming each intermediate encrypted traffic stream. In specific applications, it is first necessary to remove some irrelevant traffic, such as filtering out broadcast traffic, multicast traffic, and other network packets unrelated to encrypted traffic analysis (such as IPv6, ARP packets, etc.). Then, extract the traffic of specific protocols, that is, the primary encrypted traffic streams that conform to the target type encryption protocol. For the encrypted traffic analysis designed for this invention, usually only the traffic of specific encryption protocols (such as TLS, SSH, IPSec, etc.) is retained, and unencrypted traffic data is filtered out.

[0079] Step c. Traffic data reassembly: Based on the traffic quintuple information and timestamp, reassemble the intermediate encrypted traffic belonging to the same traffic session to form a complete traffic session and constitute encrypted traffic data packets. In specific applications, for TCP traffic, ensure that each encrypted traffic data packet is reassembled in order; at the same time, it can further distinguish between forward encrypted traffic data packets (client-to-server) and backward encrypted traffic data packets (server-to-client), and can also handle bidirectional traffic separately as needed.

[0080] After determining each encrypted traffic data packet in the above manner, the encrypted traffic feature extraction module can be used to further perform traffic reading, traffic parsing, and traffic feature extraction on the sample encrypted traffic data packets and the encrypted traffic data packets to be analyzed, so as to obtain the preset target traffic feature values ​​corresponding to each encrypted traffic data packet.

[0081] This invention presents an encrypted traffic detection method that innovatively incorporates a NiN hybrid dense residual network, integrating NiN modules, residual modules, and dense modules. Based on a sample dataset, the method analyzes the target traffic feature values ​​corresponding to encrypted traffic data packets. The NiN hybrid dense residual network is trained to obtain an encrypted traffic data packet recognition model, which is then used to identify and detect the encrypted traffic data packets to be analyzed. This invention also designs a corresponding system, incorporating modules for feature extraction, network training, and prediction / classification to efficiently achieve the identification and detection of encrypted traffic data packets. The NiN hybrid dense residual network designed in this invention employs a multi-module network learning approach, resulting in higher model robustness and a lower false negative rate. It can uncover deeper features in encrypted traffic data, achieving efficient and stable data analysis and classification, and improving the efficiency of encrypted traffic identification and detection.

[0082] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for encrypted traffic detection based on NiN hybrid dense-residual network, characterized in that: The following steps A to B are performed to obtain an encrypted traffic data packet identification model; then step i is performed to apply the encrypted traffic data packet identification model to identify and detect the encrypted traffic data packet to be analyzed; Step A. A preset number of sample encrypted traffic data packets corresponding to a preset each traffic classification are constructed, and each sample encrypted traffic data packet is extracted to correspond to a preset each target traffic feature value. Each target traffic feature value corresponding to a single sample encrypted traffic data packet is combined with the traffic classification category corresponding to the sample encrypted traffic data packet to construct a sample, and then a sample data set is obtained, and then step B is entered; Step B. A NiN mixed dense-residual network is constructed, and based on the sample data set, each target traffic feature value corresponding to a sample encrypted traffic data packet in the sample is taken as input, and the traffic classification category corresponding to the sample encrypted traffic data packet is taken as output. The NiN mixed dense-residual network is trained to obtain an encrypted traffic data packet identification model; The NiN mixed dense-residual network includes a feature input module, a first NiN module, a first residual series structure, a first maximum pooling layer, a second NiN module, a dense series structure, a transition module, a second maximum pooling layer, a third NiN module, a second residual module, a global average pooling layer, a full connection layer, and a classification output module, which are sequentially connected in the direction from the input end to the output end. The input end of the feature input module constitutes the input end of the NiN mixed dense-residual network, and the output end of the classification output module constitutes the output end of the NiN mixed dense-residual network. The first residual series structure includes at least one first residual module connected in the direction from the input end to the output end. The input end of the first residual module in sequence constitutes the input end of the first residual series structure, and the output end of the last first residual module in sequence constitutes the output end of the first residual series structure. The dense series structure includes at least two dense modules connected in the direction from the input end to the output end. The input end of the dense module in sequence constitutes the input end of the dense series structure, and the output end of the last dense module in sequence constitutes the output end of the dense series structure. The structures of the first NiN module, the second NiN module and the third NiN module are the same as each other, and each NiN module comprises, in sequence from an input end to an output end direction, a convolutional layer, a ReLU activation function layer, a convolutional layer, a ReLU activation function layer, wherein the first one in sequence the input end of the convolutional layer constitutes the input end of the NiN module, and the output end of the last ReLU activation function layer in sequence constitutes the output end of the NiN module; Step i. Each target traffic feature value corresponding to the encrypted traffic data packet to be analyzed is extracted, and the encrypted traffic data packet identification model is inputted for processing to obtain the traffic classification category corresponding to the encrypted traffic data packet to be analyzed, thereby realizing identification and detection of the encrypted traffic data packet to be analyzed.

2. The encrypted traffic detection method based on the NiN mixed dense-residual network according to claim 1, characterized in that: The structure of the second residual module and the structure of each first residual module are the same as each other, and each residual module respectively comprises, in a direction from an input end to an output end, a convolutional layer, a batch normalization layer, a fusion layer and a ReLU activation function layer a convolutional layer, a batch normalization layer, a ReLU activation function layer, a convolutional layer, a batch normalization layer, a fusion layer, a ReLU activation function layer, wherein the first one in the sequence The input end of the convolutional layer constitutes the input end of the residual module, the input end of the fusion layer is simultaneously connected to the input end of the residual module, and the output end of the last one in the sequence of the ReLU activation function layers constitutes the output end of the residual module.

3. The method of claim 1, wherein the method is based on a NiN hybrid dense-residual network. Each dense module has an identical structure, consisting of four convolutional normalization activation modules connected in series from the input to the output. The input of the first convolutional normalization activation module forms the input of the dense module, and the output of the fourth convolutional normalization activation module forms the output. Each convolutional normalization activation module has an identical structure, consisting of four convolutional normalization activation modules connected in series from the input to the output. Convolutional layers, batch normalization layers, ReLU activation function layers, and concatenation layers, among which, The input of the convolutional layer constitutes the input of the convolutional normalization activation module, and the output of the splicing layer constitutes the output of the convolutional normalization activation module. The input of the splicing layer in each convolutional normalization activation module is also connected to the input of the dense module and the output of the sequential convolutional normalization activation modules.

4. The encrypted traffic detection method based on the NiN hybrid dense-residual network according to claim 1, characterized in that: The transition module comprises, in sequence from an input end to an output end, a convolutional layer, a batch normalization layer, a ReLU activation function layer, and an average pooling layer, wherein The input end of the convolutional layer constitutes the input end of the transition module, and the output end of the average pooling layer constitutes the output end of the transition module.

5. The method of claim 1, wherein the method is based on a NiN hybrid dense-residual network. The preset each target traffic feature value includes traffic data packet duration, forward / backward data packet number, data packet length statistical feature, number of bytes and data packets per second, traffic arrival time interval statistics, and TCP flag bit.

6. The method of claim 1, wherein the method is based on a NiN hybrid dense-residual network. The sample encrypted traffic data packet and the encrypted traffic data packet to be analyzed are obtained from the original traffic data packet according to the following steps a to c. Step a. Traffic data segmentation. According to the traffic five-tuple information of the source IP, destination IP, source port, destination port, and protocol type corresponding to the traffic, each encrypted traffic in the original traffic data packet is divided to obtain each primary encrypted traffic. Step b. Flow data deduplication filtering, screening each primary encrypted traffic, obtaining each primary encrypted traffic corresponding to each target type encrypted protocol, constituting each secondary encrypted traffic; Step c. Flow data reorganization, according to the flow five tuple information and the timestamp, reorganizing each secondary encrypted traffic belonging to the same flow session, constituting the encrypted traffic data packet.

7. A system for implementing the method for encrypted traffic detection based on the NiN hybrid dense-residual network according to any one of claims 1 to 6, characterized in that it comprises: The encrypted traffic feature extraction module, the model training module, and the model prediction classification module are included. The encrypted traffic feature extraction module is used to read, analyze, and extract features from sample encrypted traffic data packets and to-be-analyzed encrypted traffic data packets, respectively, to obtain each target traffic feature value corresponding to the encrypted traffic data packet and each target traffic feature value corresponding to the to-be-analyzed encrypted traffic data packet. The model training module is based on the sample data set, takes each target traffic feature value corresponding to the sample encrypted traffic data packet in the sample as input, and takes the traffic classification category corresponding to the sample encrypted traffic data packet as output. The model training module combines the cross-entropy loss function and trains the NiN mixed dense-residual network to obtain the encrypted traffic data packet recognition model. The model prediction classification module is used to process the preset each target traffic feature value corresponding to the to-be-analyzed encrypted traffic data packet by using the encrypted traffic data packet recognition model to obtain the traffic classification category corresponding to the to-be-analyzed encrypted traffic data packet, thereby realizing the identification and detection of the to-be-analyzed encrypted traffic data packet.

Images