Network traffic classification method, system and device and storage medium

Abstract

The invention belongs to the field of traffic classification, and particularly relates to a network traffic classification method, system and device and a storage medium, and the method comprises the following steps: sniffing and analyzing network traffic to obtain packet length sequence data and payload byte stream data, and carrying out word segmentation through identifiers to obtain packet length sequence data and payload byte stream data; the method comprises the steps that word segmentation packet length sequence data and word segmentation byte stream data are obtained to train a mask model, fusion training data are input into a trained byte stream model and a trained packet length sequence model after training, an output result is combined with a query vector, an effective load byte stream embedded vector sequence and a packet length embedded vector sequence are obtained, and the effective load byte stream embedded vector sequence is obtained; and inputting the network traffic into a full connection layer of the fusion model for splicing to obtain a classification probability, adjusting a weight parameter of the fusion model through a loss function to obtain an optimized fusion model, and inputting the network traffic into the optimized fusion model to obtain a classification result. The method has the advantages that the model can be trained without a large amount of high-quality mark data, and the effect of classifying the network traffic is achieved.

Description

Technical Field

[0001] The present invention belongs to the field of traffic classification, and particularly relates to a network traffic classification method, system, device, and storage medium. Background Art

[0002] Network traffic analysis refers to the monitoring and analysis of data transmission in a network to obtain detailed information about network performance, security, and usage. By analyzing network traffic, potential security threats such as malware, network attacks (such as DDoS attacks), or unauthorized access can be identified. By detecting abnormal traffic in a timely manner, the security team can take measures to protect network security. Therefore, network traffic analysis is crucial for network management and network security.

[0003] In related technologies, traditional machine learning methods and deep learning methods are mainly used for network traffic classification. Traditional machine learning methods mainly rely on expert knowledge to select artificial features, while deep learning methods automatically extract features from raw network traffic through representation learning, thus avoiding complex feature engineering.

[0004] In view of the above related technologies, existing network traffic classification methods require a large amount of high-quality labeled data to improve classification accuracy, and a large amount of high-quality labeled data requires a large amount of time to standardize, greatly increasing the labor and consuming more time. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a network traffic classification method, system, device, and storage medium, which can train a model without a large amount of high-quality labeled data and realize the classification of network traffic.

[0006] A network traffic classification method includes:

[0007] Copying the data packets of the local network to a capture port through a switch, and a monitor sniffing and parsing the data packets through the capture port to obtain packet length sequence data and payload byte stream data;

[0008] Setting an identifier;

[0009] According to the identifier, segmenting the packet length sequence data and the payload byte stream data to obtain segmented packet length sequence data and segmented byte stream data;

[0010] Inputting the segmented packet length sequence data into a masked language model for training to obtain a trained byte stream model;

[0011] Inputting the segmented byte stream data into a masked language model for training to obtain a trained packet length sequence model;

[0012] Obtain the fused training data;

[0013] Input the fused training data into the training byte stream model and the training packet length sequence model to obtain a training byte stream vector and a training packet length sequence vector;

[0014] Combine the training byte stream vector and the training packet length sequence vector to form a query vector;

[0015] Based on the training byte stream vector, the training packet length sequence vector, and the query vector, obtain a payload byte stream embedding vector sequence and a packet length embedding vector sequence;

[0016] Construct a fusion model according to the query vector and the fusion formula;

[0017] Input the payload byte stream embedding vector sequence and the packet length embedding vector sequence into the fully connected layer of the fusion model for splicing to obtain a classification probability. According to the classification probability and the loss function, adjust the weight parameters of the fusion model to obtain an optimized fusion model. Input the network traffic into the optimized fusion model to obtain a classification result.

[0018] Optionally, the segmenting the packet length sequence data and the payload byte stream data according to the identifier to obtain segmented packet length sequence data and segmented byte stream data includes:

[0019] The identifier includes a start identifier, a separator identifier, a padding identifier, a mask identifier, and an unknown identifier;

[0020] The start identifier indicates the start of the sequence, the separator identifier indicates segmenting by byte value, the padding identifier indicates padding the sequence with insufficient length with the padding identifier, the mask identifier indicates a replacement and masking mark, and the unknown identifier indicates an unknown mark in the corpus;

[0021] For the payload byte stream, obtain the bytes of the first preset length of the payload byte stream as a data packet;

[0022] Use the byte value as the segmentation unit, and segment the payload byte stream through the identifier to obtain segmented byte stream data;

[0023] For the segmented packet length sequence, obtain the uplink packet length corresponding to the uplink and the downlink packet length corresponding to the downlink according to the packet length sequence. Define the uplink packet length of the uplink as positive to obtain a positive uplink packet length, and define the downlink packet length of the downlink as negative to obtain a negative downlink packet length;

[0024] Use the packet length as the segmentation unit and the positive and negative as the direction, and segment the uplink packet length and the downlink packet length through the identifier to obtain segmented packet length sequence data.

[0025] Optionally, the step of inputting the segmented byte stream data into a masked language model for training to obtain a trained byte stream model includes:

[0026] Performing a masking operation on a part of the first preset percentage of words in the segmented byte stream to obtain a masked sequence;

[0027] Replacing a second preset percentage of words in the masked sequence with masks, replacing a third preset percentage of words in the masked sequence with new words, and keeping a fourth preset percentage of words in the masked sequence unchanged to obtain a training sequence, where the sum of the second preset percentage, the third preset percentage, and the fourth preset percentage is 1;

[0028] Training the training sequence through a masked language model to obtain a trained byte stream model.

[0029] Optionally, the step of obtaining the payload byte stream embedding vector sequence and the packet length embedding vector sequence according to the byte stream vector, the training packet length sequence vector, and the query vector includes:

[0030] Obtaining an embedding vector sequence formula;

[0031] According to the trained byte stream vector, the training packet length sequence vector, the query vector, and the embedding vector sequence formula, obtaining the payload byte stream embedding vector sequence and the packet length embedding vector sequence;

[0032] The embedding vector sequence formula is expressed as:

[0033] X′ bytes = CrossAttention(X bytes , [X bytes |X ps )

[0034] X′ ps = CrossAttention(X ps , [X bytes |X ps )

[0035] where X′ bytes is the payload byte stream embedding vector sequence, X′ ps is the packet length embedding vector sequence, X bytes is the trained byte stream vector, X ps is the training packet length sequence vector, and [X bytes |X ps is the query vector.

[0036] Optionally, the process of inputting the embedded vector sequence of the payload byte stream and the embedded vector sequence of the packet length into a fully connected layer for splicing to obtain classification probabilities includes:

[0037] Performing feature extraction on the embedded vector sequence of the payload byte stream and the embedded vector sequence of the packet length to obtain a payload feature vector and a packet length sequence feature vector;

[0038] Inputting the payload feature vector and the packet length sequence feature vector into a fully connected layer to generate classification probabilities.

[0039] Optionally, the process of adjusting the weight parameters of the fusion model according to the classification probabilities and the loss function to obtain an optimized fusion model, and inputting the network traffic into the optimized model to obtain classification results includes:

[0040] Determining whether the classification probability is greater than a preset probability;

[0041] If the classification probability is lower than the preset probability, adjusting the weight parameters of the fusion model through the loss function to obtain an optimized fusion model, and inputting the network traffic into the optimized model to obtain classification results.

[0042] Optionally, the loss function is expressed as:

[0043]

[0044] Where is the true label, is the predicted probability, Y is the label set, N is the number of samples, i is the sample number, c is the class number, and Y is the class label.

[0045] A network traffic classification system includes:

[0046] A data acquisition module, configured to copy packets of the local network to a capture port through a switch, and a monitor machine sniffs and analyzes the packets through the capture port to obtain packet length sequence data and payload byte stream data;

[0047] A setting module, configured to set an identifier;

[0048] A word segmentation module, configured to segment the packet length sequence data and the payload byte stream data according to the identifier to obtain segmented packet length sequence data and segmented byte stream data;

[0049] A first training module, configured to input the segmented packet length sequence data into a masked language model for training to obtain a trained byte stream model;

[0050] The second training module is used to input the segmented byte stream data into a masked language model for training to obtain a training packet length sequence model;

[0051] The acquisition module is used to acquire fusion training data;

[0052] The output module is used to input the fusion training data into a training byte stream model and a training packet length sequence model to obtain a training byte stream vector and a training packet length sequence vector;

[0053] The query vector construction module is used to form a query vector from the training byte stream vector and the training packet length sequence vector;

[0054] The learning module is used to obtain a payload byte stream embedding vector sequence and a packet length embedding vector sequence according to the training byte stream vector, the training packet length sequence vector, and the query vector;

[0055] The model construction module is used to construct a fusion model according to the query vector and a fusion formula;

[0056] The classification module is used to splice the payload byte stream embedding vector sequence and the packet length embedding vector sequence into the fully connected layer of the fusion model to obtain a classification probability, adjust the weight parameters of the fusion model according to the classification probability and a loss function to obtain an optimized fusion model, and input network traffic into the optimized fusion model to obtain a classification result.

[0057] A terminal device includes a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, a network traffic classification method is adopted.

[0058] A computer-readable storage medium stores a computer program. When the computer program is loaded and executed by a processor, a network traffic classification method is adopted.

[0059] The beneficial effects of the present invention are:

[0060] Data is collected by a monitoring machine to obtain packet length sequence data and payload byte stream data, which are then tokenized by an identifier and input into a masked language model for training to obtain a trained byte stream model and a trained packet length sequence model. Then, the fused training data is input into the trained byte stream model and the trained packet length sequence model to obtain a trained byte stream vector and a trained packet length sequence vector, which are combined to form a query vector. Then, based on the trained byte stream vector, the trained packet length sequence vector, and the query vector, a payload byte stream embedding vector sequence and a packet length embedding vector sequence are obtained. The payload byte stream embedding vector sequence and the packet length embedding vector sequence are fused by a fusion model and input into the fully connected layer of the fusion model to obtain a classification concept. The weight parameters of the fusion model are adjusted by a loss function to obtain an optimized fusion model, and a classification result is obtained based on the optimized fusion model and network traffic. In this application, the model is trained using unlabeled data, and the trained byte stream model and the trained packet length sequence model are trained separately. The underlying structure and general patterns of network traffic are learned in a self-supervised manner, so as to obtain a general meaningful representation of network traffic. Training can be completed without a large amount of labeled data. Moreover, by making full use of the multi-modal information of network flows, the fusion of the two modal representation results can achieve the full utilization of the multi-modal information of network flows, thereby realizing the efficient identification of network flows. Description of the Drawings

[0061] Figure 1 It is a schematic flowchart of a network traffic classification method of the present invention. Detailed Embodiments

[0062] A network traffic classification method, as Figure 1 shown, includes:

[0063] S1. Copy the data packets of the local network to the capture port through a switch, and the monitoring machine sniffs and analyzes the data packets through the capture port to obtain packet length sequence data and payload byte stream data.

[0064] Specifically, network traffic is identified by a five-tuple (source IP, source port, destination IP, destination port, and protocol), representing a set of bidirectional data packets transmitted between a client (source IP, source port) and a server (destination IP, destination port) through a certain network protocol (such as TCP and UDP). Network traffic is heterogeneous data with multiple modalities, and the original byte stream and the transmission mode are two important modalities. Specifically, the original byte stream represents the content information of network traffic, while the transmission mode reflects its potential behavioral information.

[0065] This modality refers to the byte sequence contained in network traffic data packets. A network data packet consists of a header and a payload. The transmitted bytes determine the function of the network traffic. Due to the error correction and verification mechanisms in the protocol, the original byte stream represents the static characteristics of the network traffic.

[0066] Transmission mode: This modality represents all the side-channel information in network traffic except the actual transmitted bytes, such as packet length, direction, and timestamp. For encrypted traffic analysis, it is crucial to extract behavioral information because the byte patterns contained in the packet payload are limited. Due to the fluctuations in the network environment, packet transmission is vulnerable to network noise, such as packet loss, retransmission, and out-of-order. Therefore, the transmission mode belongs to dynamic characteristics.

[0067] Considering the strong identification fields in the header and the instability of time-related information, the payload byte stream and the packet length sequence are selected to represent the modalities of the original byte stream and the transmission mode respectively.

[0068] On the switch of the network gateway, we configured port mirroring to copy the data packets in the local network to the specified capture port. The capture port is connected to the monitor. On the monitor, we deployed a Zeek cluster for traffic sniffing and parsing. The Zeek cluster is a group of workers that jointly analyze the network link traffic in a coordinated manner. Since Zeek is not multi-threaded, the only current option is for the front-end to distribute the workload to multiple cores once the limit of a single processor core is reached. The worker sniffs the network data packets and performs protocol analysis on the reconstructed network flow. We also developed two Zeek plugins (ps.zeek and bytes.zeek) to record the packet length sequence and the payload byte stream of each network flow respectively.

[0069] The data obtained through the monitor is terabyte-level unlabeled network traffic data.

[0070] S2. Set identifiers.

[0071] Specifically, the identifiers are set for tokenizing the payload byte stream and the packet length sequence.

[0072] S3. According to the identifiers, tokenize the packet length sequence data and the payload byte stream data to obtain the tokenized packet length sequence data and the tokenized byte stream data.

[0073] According to the identifiers, tokenize the packet length sequence data and the payload byte stream data to obtain the tokenized packet length sequence data and the tokenized byte stream data, including:

[0074] The identifiers include a start identifier, a delimiter identifier, a padding identifier, a mask identifier, and an unknown identifier.

[0075] Specifically, the start identifier, separator identifier, padding identifier, mask identifier, and unknown identifier are represented by ([CLS], [SEP], [PAD], [MASK], and [UNK], respectively.

[0076] The start identifier indicates the start of a sequence, the separator identifier indicates word segmentation by byte value, the padding identifier indicates padding the sequence with insufficient length with the padding identifier, the mask identifier indicates the mark for replacement and masking, and the unknown identifier indicates the unknown mark in the corpus.

[0077] Specifically, the corpus is composed of data obtained by a monitoring machine. In actual detection, unknown characters may be encountered, and this unknown identifier is used to replace them.

[0078] For the payload byte stream, the bytes of the first preset length of the payload byte stream are obtained as the data packet.

[0079] Specifically, the first 256 bytes (a total of 512 bytes) of the transport layer payload are applied in the uplink and downlink respectively to represent the original byte stream (data packet) of the network flow.

[0080] Using the byte value as the word segmentation unit, the payload byte stream is segmented by the identifier to obtain the segmented byte stream data.

[0081] Specifically, using the byte value as the basic unit of word segmentation, the word segmentation of the payload byte stream mode of the network flow is realized.

[0082] For the segmented packet length sequence, according to the packet length sequence, the uplink packet length corresponding to the uplink and the downlink packet length corresponding to the downlink are obtained. The uplink packet length of the uplink is defined as positive to obtain the positive uplink packet length, and the downlink packet length of the downlink is defined as negative to obtain the negative downlink packet length.

[0083] Using the packet length as the word segmentation unit and the positive and negative as the directions, the uplink packet length and the downlink packet length are segmented by the identifier to obtain the segmented packet length sequence data.

[0084] Specifically, for the data packet length, its absolute value is the length of the transport layer payload, and its sign indicates the direction of the data packet in the network flow. The uplink packet length is defined as positive, and the downlink packet length is defined as negative. For the tokenization of the packet length sequence, the packet length with direction is directly used as the basic unit of word segmentation, that is, positive and negative.

[0085] S4. Input the segmented packet length sequence data into the masked language model for training to obtain the trained byte stream model.

[0086] Inputting the segmented byte stream data into the masked language model for training to obtain the trained byte stream model includes:

[0087] Mask a portion of the first preset percentage of words in the tokenized byte stream to obtain a masked sequence.

[0088] Replace the second preset percentage of words in the masked sequence with masks, replace the third preset percentage of words in the masked sequence with new words, and keep the fourth preset percentage of words in the masked sequence unchanged to obtain a training sequence, where the sum of the second preset percentage, the third preset percentage, and the fourth preset percentage is 1.

[0089] Train the training sequence through a masked language model to obtain a trained byte stream model.

[0090] Specifically, two sub-models (the trained byte stream model and the trained packet length sequence model) are designed to represent information from two network traffic patterns respectively. Specifically, BERT-bytes is used for the payload byte stream, while BERT-ps is used for the packet length sequence. To mitigate the insufficient information extraction caused by potential interference between modalities, the two sub-models are pre-trained in a single modality.

[0091] Map the bytes to Euclidean space, which includes byte value embedding, position embedding, and type embedding. Among them, the position embedding represents the position information of the byte in the payload byte stream, and the type embedding represents whether the byte belongs to the up / down stream. All three embeddings are implemented using an embedding layer with learnable parameters, and the byte embedding is achieved by addition. That is:

[0092]

[0093] where, e byte is the byte value embedding, is the position embedding, e type is the type embedding, is the byte embedding.

[0094] Packet length embedding: Map each packet length to Euclidean space, which includes packet length value embedding and position embedding. Among them, the position embedding represents the position information of the packet length value in the packet length sequence. Both embeddings are implemented using an embedding layer with learnable parameters, and the packet length embedding is achieved by addition.

[0095]

[0096] where, e pl is the packet length value embedding, is the position embedding, is the packet length embedding.

[0097] The combination of byte embedding and packet length embedding enables the model to extract and model traffic data at two different levels (content and length), thereby improving the accuracy of traffic analysis. The single-modal pre-training method aims to reduce the potential interference between the byte stream and the packet length stream, enabling each model to focus on its specific information extraction task and improving the clarity and effectiveness of the information.

[0098] The pre-training process is implemented through a masked language model. The basic principle is to mask the word to be predicted and then predict the original value of the masked word based on other unmasked words provided by the context. During training, 15% (the first preset percentage) of the tokens in the input sequence need to be masked. Specifically, the masking operation for the selected 15% of the tokens also includes a third part: directly replacing 80% (the second preset percentage) of them with [MASK], directly replacing 10% (the third preset percentage) with a new token, and leaving the remaining 10% (the fourth preset percentage) unchanged. MLM uses [MASK] as noise and obtains bidirectional semantic information through self-encoding training.

[0099] The pre-training process is carried out on TB-level network flow data. The purpose is to enable BERT-bytes and BERT-ps to learn the underlying structure and general patterns of network traffic through self-supervised methods, thereby obtaining a general meaningful representation of network traffic.

[0100] S5. Input the tokenized byte stream data into the masked language model for training to obtain a trained packet length sequence model.

[0101] Specifically, the training method of the trained packet length sequence model is the same as that of the trained byte stream model.

[0102] S6. Obtain the fused training data.

[0103] The fused training data is data of known network traffic categories and is also composed of packet length sequence data and payload byte stream data.

[0104] S7. Input the fused training data into the trained byte stream model and the trained packet length sequence model to obtain a trained byte stream vector and a trained packet length sequence vector.

[0105] Specifically, after pre-training on a large amount of unlabeled data, BERT-bytes and BERTps can effectively represent the content and behavior information of network flows respectively. To improve the analysis performance of downstream tasks, a fused model is designed to fully utilize the information from network flows, including payload byte streams and packet length sequences.

[0106] In the payload byte stream and the packet length sequence, some tokens need to perceive cross-modal information, while other tokens are only related to their own modality. For example, if the length of the TLS record represented by the bytes exceeds the maximum segment size (MSS), one or more consecutive packets with the MSS length will appear. In contrast, the bytes representing the field length are usually only related to the subsequent field bytes and do not affect the packet length sequence. Therefore, directly applying cross-attention to the outputs of the two modalities may disrupt the unimodal representations, thereby degrading the performance of the model.

[0107] S8. According to the fusion model, compose the training byte stream vector and the training packet length sequence vector into a query vector.

[0108] Specifically, use the concatenated output of the two modalities as the query vector in the cross-attention mechanism. For network traffic, after inputting its payload byte stream, the output of BERT-bytes is represented as X bytes , and after inputting its packet length sequence, the output of BERT-ps is represented as X ps . Then, concatenate X bytes and X ps to form the query vector [X bytes |X ps .

[0109] S9. According to the training byte stream vector, the training packet length sequence vector, and the query vector, obtain the payload byte stream embedding vector sequence and the packet length embedding vector sequence.

[0110] Obtaining the payload byte stream embedding vector sequence and the packet length embedding vector sequence according to the byte stream vector, the training packet length sequence vector, and the query vector includes:

[0111] Obtain the formula for the embedding vector sequence.

[0112] According to the training byte stream vector, the training packet length sequence vector, the query vector, and the formula for the embedding vector sequence, obtain the payload byte stream embedding vector sequence and the packet length embedding vector sequence.

[0113] The formula for the embedding vector sequence is expressed as:

[0114] X′ bytes = CrossAttention(X bytes ,[X bytes |X ps )

[0115] X′ ps = CrossAttention(X ps ,[X bytes |X ps )

[0116] Among them, X' bytes is the embedding vector sequence of the payload byte stream, and X' ps is the embedding vector sequence of the packet length, X bytes is the training byte stream vector, and X ps is the training packet length sequence vector. [X bytes |X ps is the query vector.

[0117] Specifically, X bytes and X ps are concatenated to form the query vector [X bytes |X ps , and then the cross-attention scores are calculated with X bytes and X ps respectively. This process enables the tokens in each single modality to simultaneously attend to the information in all modalities. After passing through the cross-attention mechanism, the embedding vector sequences of the payload byte stream and the packet length sequence are obtained.

[0118] The specific implementation of the cross-attention mechanism can be expressed as follows:

[0119]

[0120] Among them, X1 is X bytes or X ps , X2 is the query vector, where K = W k X1, Q = W q X2, V = W v X1, d k are the query vector, key vector, value vector, and element dimension respectively. W k , W v and W q are weight matrices with learnable parameters, and T represents the transpose matrix.

[0121] S10. Construct a fusion model according to the query vector and the fusion formula.

[0122] Specifically, the fusion formula is:

[0123] p = Softmax(W[x bytes |x ps +b)

[0124] where p = [p c c∈Y is the probability vector indicating that the network traffic belongs to different classes in the label space Y. W and b are the weight matrix and bias vector of the fully connected layer respectively.

[0125] After modality fusion, we use x' from the payload byte stream and the packet length sequence​bytes (from X' bytes ) and x' ps (from X' ps ) are used to represent two modalities of network traffic. We concatenate these two representations and input them into a fully connected layer to generate recognition results. Among them, x' bytes is the first vector of X' bytes , and x' ps is the first vector of X' ps .

[0126] S11. Embed the payload byte stream into a vector sequence and the packet length into a vector sequence, input them into the fully connected layer of the fusion model for concatenation to obtain classification probabilities. According to the classification probabilities and the loss function, adjust the weight parameters of the fusion model to obtain an optimized fusion model. Input the network traffic into the optimized fusion model to obtain classification results.

[0127] Embedding the payload byte stream into a vector sequence and the packet length into a vector sequence and inputting them into the fully connected layer for concatenation to obtain classification probabilities includes:

[0128] Extract features from the payload byte stream embedding vector sequence and the packet length embedding vector sequence to obtain a payload feature vector and a packet length sequence feature vector.

[0129] Input the payload feature vector and the packet length sequence feature vector into the fully connected layer of the fusion model to generate classification probabilities.

[0130] According to the classification probabilities and the loss function, adjust the weight parameters of the fusion model to obtain an optimized fusion model. Input the network traffic into the optimized model to obtain classification results including:

[0131] Judge whether the classification probability is greater than the preset probability.

[0132] Specifically, judge whether the classification accuracy of the trained model meets the requirements. If it does not meet the requirements, use the method of backpropagation through the loss function to change the parameter weights of the fusion model for further training.

[0133] If the classification probability is lower than the preset probability, adjust the weight parameters of the fusion model through the loss function to obtain an optimized fusion model. Input the network traffic into the optimized model to obtain classification results.

[0134] The loss function is expressed as:

[0135]

[0136] Among them, is the true label, is the predicted probability, Y is the set of labels, N is the number of samples, i is the sample number, c is the class number, and Y is the class label.

[0137] After the model is pre-trained on a large-scale dataset, its parameters usually converge and reach a relatively stable state. Directly making large adjustments to all model parameters on a small-scale dataset is likely to lead to overfitting. During the fine-tuning process, we proceed in the following two stages:

[0138] The first stage: This is the warm-up stage of fine-tuning. Specifically, we freeze all pre-trained parameters and only update the gradients of the classification head. This process prevents the gradient updates from the classification head from affecting the pre-trained parameters without going through training. After this stage, the classification head already has a preliminary performance.

[0139] The second stage: This is the full-parameter fine-tuning stage. We unfreeze the pre-trained parameters and fine-tune all the model parameters at a low learning rate. This process can enable the model to achieve improved performance.

[0140] A network traffic classification system, comprising:

[0141] A data collection module, configured to copy the data packets of the local network to the capture port through a switch, and the monitor machine sniffs and parses the data packets through the capture port to obtain the packet length sequence data and the payload byte stream data.

[0142] A setting module, configured to set an identifier.

[0143] A word segmentation module, configured to segment the packet length sequence data and the payload byte stream data according to the identifier to obtain the segmented packet length sequence data and the segmented byte stream data.

[0144] A first training module, configured to input the segmented packet length sequence data into a masked language model for training to obtain a trained byte stream model.

[0145] A second training module, configured to input the segmented byte stream data into a masked language model for training to obtain a trained packet length sequence model.

[0146] An acquisition module, configured to acquire the fused training data.

[0147] An output module, configured to input the fused training data into the trained byte stream model and the trained packet length sequence model to obtain a trained byte stream vector and a trained packet length sequence vector.

[0148] A query vector construction module, configured to form a query vector from the trained byte stream vector and the trained packet length sequence vector.

[0149] A learning module, configured to obtain a payload byte stream embedding vector sequence and a packet length embedding vector sequence according to a training byte stream vector, a training packet length sequence vector, and a query vector.

[0150] A model construction module, configured to construct a fusion model according to a query vector and a fusion formula.

[0151] A classification module, configured to splice the payload byte stream embedding vector sequence and the packet length embedding vector sequence into a fully connected layer of the fusion model to obtain classification probabilities, adjust weight parameters of the fusion model according to the classification probabilities and a loss function to obtain an optimized fusion model, and input network traffic into the optimized fusion model to obtain a classification result.

[0152] An embodiment of the present application further discloses a terminal device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, a network traffic classification method is adopted.

[0153] Among them, the terminal device may be a computer device such as a desktop computer, a laptop computer, or a cloud server. And the terminal device includes, but is not limited to, a processor and a memory. For example, the terminal device may further include an input / output device, a network access device, and a bus, etc.

[0154] Among them, the processor may adopt a central processing unit (CPU). Of course, according to actual usage, other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. may also be adopted. The general-purpose processor may adopt a microprocessor or any conventional processor, etc. The present application does not make any restrictions on this.

[0155] Among them, the memory may be an internal storage unit of the terminal device. For example, the hard disk or memory of the terminal device, or it may also be an external storage device of the terminal device. For example, a plug-in hard disk, a smart media card (SMC), a secure digital card (SD), or a flash card (FC) equipped on the terminal device, etc. And the memory may also be a combination of the internal storage unit and the external storage device of the terminal device. The memory is used to store the computer program and other programs and data required by the terminal device. The memory may also be used to temporarily store data that has been output or will be output. The present application does not make any restrictions on this.

[0156] Among them, through this terminal device, a network traffic classification method in the above embodiment is stored in the memory of the terminal device, and is loaded and executed on the processor of the terminal device, which is convenient for use.

[0157] The embodiments of the present application also disclose a computer-readable storage medium, and the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, a network traffic classification method in the above embodiments is adopted.

[0158] Among them, the computer program can be stored in a computer-readable medium. The computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file, or some middleware form, etc. The computer-readable medium includes any entity or device, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disc, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the computer-readable medium includes, but is not limited to, the above components.

[0159] Among them, through this computer-readable storage medium, a network traffic classification method in the above embodiments is stored in the computer-readable storage medium, and is loaded and executed on the processor to facilitate the storage and application of the above method.

[0160] Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of protection of the present application is limited to these examples; under the concept of the present application, the technical features in the above embodiments or different embodiments can also be combined, and the steps can be implemented in any order, and there are many other variations in different aspects of one or more embodiments of the present application as described above, and they are not provided in detail for the sake of brevity.

[0161] One or more embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the present application. Therefore, any omission, modification, equivalent substitution, improvement, etc. made within the spirit and principle of one or more embodiments of the present application shall be included in the scope of protection of the present application.

Claims

1. A network traffic classification method, characterized in that, Including: Copy the data packets of the local network to the capture port through a switch, and the monitor sniffs and parses the data packets through the capture port to obtain packet length sequence data and payload byte stream data; Set an identifier; According to the identifier, segment the packet length sequence data and the payload byte stream data to obtain segmented packet length sequence data and segmented byte stream data; Input the segmented packet length sequence data into a masked language model for training to obtain a trained byte stream model; Input the segmented byte stream data into a masked language model for training to obtain a trained packet length sequence model; Obtain fused training data; Input the fused training data into the trained byte stream model and the trained packet length sequence model to obtain a trained byte stream vector and a trained packet length sequence vector; Combine the trained byte stream vector and the trained packet length sequence vector into a query vector; According to the trained byte stream vector, the trained packet length sequence vector and the query vector, obtain a payload byte stream embedding vector sequence and a packet length embedding vector sequence; Construct a fusion model according to the query vector and a fusion formula; Input the payload byte stream embedding vector sequence and the packet length embedding vector sequence into the fully connected layer of the fusion model for splicing to obtain a classification probability. According to the classification probability and a loss function, adjust the weight parameters of the fusion model to obtain an optimized fusion model. Input network traffic into the optimized fusion model to obtain a classification result.

2. The network traffic classification method according to claim 1, characterized in that, The step of segmenting the packet length sequence data and the payload byte stream data according to the identifier to obtain segmented packet length sequence data and segmented byte stream data includes: The identifier includes a start identifier, a separator identifier, a padding identifier, a mask identifier and an unknown identifier; The start identifier represents the start of a sequence, the separator identifier represents segmenting by byte value, the padding identifier represents padding the sequence with insufficient length with the padding identifier, the mask identifier represents a mark for replacement and masking, and the unknown identifier represents an unknown mark in the corpus; For the payload byte stream, obtain the bytes of the first preset length of the payload byte stream as data packets; Taking the byte value as the segmentation unit, segment the payload byte stream through the identifier to obtain segmented byte stream data; For the segmented packet length sequence, obtain the uplink packet length corresponding to the uplink and the downlink packet length corresponding to the downlink according to the packet length sequence. Define the uplink packet length of the uplink as positive to obtain a positive uplink packet length, and define the downlink packet length of the downlink as negative to obtain a negative downlink packet length; Taking the packet length as the segmentation unit and the positive and negative as the directions, segment the uplink packet length and the downlink packet length through the identifier to obtain segmented packet length sequence data.

3. The network traffic classification method according to claim 1, characterized in that, The step of inputting the segmented byte stream data into a masked language model for training to obtain a trained byte stream model includes: Perform a masking operation on a part of the first preset percentage of words in the segmented byte stream to obtain a masked sequence; Replace the words with the second preset percentage in the mask sequence with masks, replace the words with the third preset percentage in the mask sequence with new words, and keep the words with the fourth preset percentage in the mask sequence unchanged to obtain a training sequence, where the sum of the second preset percentage, the third preset percentage, and the fourth preset percentage is 1; Train the training sequence through a masked language model to obtain a trained byte stream model.

4. The network traffic classification method according to claim 1, characterized in that The obtaining of the payload byte stream embedding vector sequence and the packet length embedding vector sequence according to the byte stream vector, the training packet length sequence vector, and the query vector includes: Obtain the embedding vector sequence formula; According to the trained byte stream vector, the training packet length sequence vector, the query vector, and the embedding vector sequence formula, obtain the payload byte stream embedding vector sequence and the packet length embedding vector sequence; The embedding vector sequence formula is expressed as: X′ bytes = CrossAttention(X bytes , [X bytes | X ps ) X′ ps = CrossAttention(X ps , [X bytes |X ps ) Among them, X' bytes is the sequence of payload byte stream embedding vectors, X' ps is the sequence of packet length embedding vectors, X bytes is the training byte stream vector, X ps is the training packet length sequence vector, [X bytes |X ps is the query vector.

5. The network traffic classification method according to claim 1, characterized in that The splicing the payload byte stream embedding vector sequence and the packet length embedding vector sequence into a fully connected layer to obtain the classification probability includes: Extract features from the payload byte stream embedding vector sequence and the packet length embedding vector sequence to obtain a payload feature vector and a packet length sequence feature vector; Input the payload feature vector and the packet length sequence feature vector into a fully connected layer to generate a classification probability.

6. The network traffic classification method according to claim 5, characterized in that, The adjusting the weight parameters of the fusion model according to the classification probability and the loss function to obtain an optimized fusion model, and inputting the network traffic into the optimized model to obtain the classification result includes: Determine whether the classification probability is greater than a preset probability; If the classification probability is lower than the preset probability, adjust the weight parameters of the fusion model through the loss function to obtain an optimized fusion model, and input the network traffic into the optimized model to obtain the classification result.

7. The network traffic classification method according to claim 6, characterized in that, The loss function is expressed as: Among them, is the true label, is the predicted probability, Y is the set of labels, N is the number of samples, i is the sample number, c is the class number, and Y is the class label.

8. A network traffic classification system, characterized in that Includes: A data acquisition module, configured to copy the data packets of the local network to a capture port through a switch, and a monitor machine sniffs and analyzes the data packets through the capture port to obtain packet length sequence data and payload byte stream data; A setting module, configured to set an identifier; A word segmentation module, configured to segment the packet length sequence data and the payload byte stream data according to the identifier to obtain segmented packet length sequence data and segmented byte stream data; A first training module, configured to input the segmented packet length sequence data into a masked language model for training to obtain a trained byte stream model; A second training module, configured to input the segmented byte stream data into a masked language model for training to obtain a trained packet length sequence model; An acquisition module, configured to acquire fusion training data; An output module, configured to input the fusion training data into the trained byte stream model and the trained packet length sequence model to obtain a trained byte stream vector and a trained packet length sequence vector; A query vector construction module, configured to form a query vector from the trained byte stream vector and the trained packet length sequence vector; A learning module, configured to obtain a payload byte stream embedding vector sequence and a packet length embedding vector sequence according to the trained byte stream vector, the trained packet length sequence vector, and the query vector; A model construction module, configured to construct a fusion model according to the query vector and a fusion formula; A classification module, configured to splice the effective payload byte stream embedding vector sequence and the packet length embedding vector sequence into a fully connected layer of the fusion model to obtain classification probabilities, adjust weight parameters of the fusion model according to the classification probabilities and a loss function to obtain an optimized fusion model, and input network traffic into the optimized fusion model to obtain classification results.

9. A terminal device, comprising a memory and a processor, characterized in that, The memory stores a computer program capable of running on a processor. When the processor loads and executes the computer program, the method according to any one of claims 1 to 7 is adopted.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is loaded and executed by the processor, the method according to any one of claims 1 to 7 is adopted.

Images