A network traffic classification method, system, device and storage medium

Abstract

The application belongs to the field of traffic classification, and particularly relates to a network traffic classification method, system, device and storage medium, which comprises the following steps: sniffing and analyzing network traffic to obtain packet length sequence data and payload byte stream data; obtaining tokenized packet length sequence data and tokenized byte stream data through identifier tokenization; training a mask model; inputting fused training data into a trained byte stream model and a trained packet length sequence model; combining an output result with a query vector to obtain a payload byte stream embedding vector sequence and a packet length embedding vector sequence; inputting the payload byte stream embedding vector sequence and the packet length embedding vector sequence into a full connection layer of a fusion model to splice and obtain a classification probability; adjusting weight parameters of the fusion model through a loss function to obtain an optimized fusion model; and inputting network traffic into the optimized fusion model to obtain a classification result. The application can train a model without a large amount of high-quality labeled data, and realizes the effect of classifying network traffic.

Description

Technical Field

[0001] This invention belongs to the field of traffic classification, specifically relating to a network traffic classification method, system, device, and storage medium. Background Technology

[0002] Network traffic analysis refers to the monitoring and analysis of data transmission within a network to obtain detailed information about network performance, security, and usage. By analyzing network traffic, potential security threats, such as malware, cyberattacks (like DDoS attacks), or unauthorized access, can be identified. By promptly detecting abnormal traffic, security teams can take steps to protect network security. Therefore, network traffic analysis is crucial for network management and network security.

[0003] In related technologies, network traffic classification mainly adopts traditional machine learning methods and deep learning methods. Traditional machine learning methods mainly rely on expert knowledge to select manual features, while deep learning methods automatically extract features from raw network traffic through representation learning, thereby avoiding complex feature engineering.

[0004] Regarding the aforementioned technologies, existing network traffic classification methods require a large amount of high-quality labeled data to improve classification accuracy. However, a large amount of high-quality labeled data requires a significant amount of time to standardize, greatly increasing the workload and time required. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a network traffic classification method, system, device and storage medium that can train a model without a large amount of high-quality labeled data and achieve network traffic classification.

[0006] A network traffic classification method, comprising: The local network data packets are copied to the capture port through the switch. The monitoring machine sniffs and parses the data packets through the capture port to obtain packet length sequence data and payload byte stream data. Set the identifier; Based on the identifier, the packet length sequence data and the payload byte stream data are segmented into words to obtain segmented packet length sequence data and segmented byte stream data; The segmented packet long sequence data is input into the mask language model for training to obtain the trained packet long sequence model; The segmented byte stream data is input into the masked language model for training to obtain the trained byte stream model; Acquire fusion training data; The fused training data is input into the training byte stream model and the training packet-length sequence model to obtain the training byte stream vector and the training packet-length sequence vector. The training byte stream vector and the training packet length sequence vector are combined to form a query vector; Based on the training byte stream vector, the training packet length sequence vector, and the query vector, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained. Construct a fusion model based on the query vector and the fusion formula; The payload byte stream embedding vector sequence and the packet length embedding vector sequence are input into the fully connected layer of the fusion model for concatenation to obtain the classification probability. Based on the classification probability and the loss function, the weight parameters of the fusion model are adjusted to obtain the optimized fusion model. Network traffic is input into the optimized fusion model to obtain the classification result.

[0007] Optionally, the step of segmenting the packet length sequence data and payload byte stream data into words based on the identifier to obtain segmented packet length sequence data and segmented byte stream data includes: The identifiers include start identifier, separator identifier, padding identifier, mask identifier, and unknown identifier; The start identifier indicates the beginning of the sequence, the separator identifier indicates word segmentation by byte value, the padding identifier indicates that the insufficient length of the sequence is filled with padding identifier, the mask identifier indicates that the masked token is replaced, and the unknown identifier indicates the unknown token in the corpus. For the payload byte stream, the first preset length of bytes of the payload byte stream is obtained as the data packet; Using byte values ​​as the unit of word segmentation, the payload byte stream is segmented using the identifier to obtain segmented byte stream data; For segmented packet-length sequences, the uplink packet length and downlink packet length corresponding to the uplink and downlink are obtained according to the packet length sequence. The uplink packet length is defined as positive to obtain the positive uplink packet length, and the downlink packet length is defined as negative to obtain the negative downlink packet length. Using packet length as the unit of word segmentation and positive and negative as the direction, the upstream packet length and the downstream packet length are segmented into words using the identifier to obtain segmented packet length sequence data.

[0008] Optionally, the step of inputting the segmented byte stream data into the masked language model for training to obtain the trained byte stream model includes: A first preset percentage of words in the segmented byte stream are masked to obtain a mask sequence; Replace the words in the second preset percentage of the mask sequence with the mask, replace the words in the third preset percentage of the mask sequence with new words, and leave the words in the fourth preset percentage of the mask sequence unchanged to obtain the training sequence. The sum of the second preset percentage, the third preset percentage, and the fourth preset percentage is 1. The training sequence is trained using a masked language model to obtain a training byte stream model.

[0009] Optionally, obtaining the payload byte stream embedding vector sequence and the packet length embedding vector sequence based on the training byte stream vector, the training packet length sequence vector, and the query vector includes: Formulas for obtaining embedded vector sequences; Based on the training byte stream vector, training packet length sequence vector, query vector, and embedding vector sequence formula, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained. The formula for the embedded vector sequence is expressed as follows:

[0010]

[0011] in, Embed a vector sequence into the payload byte stream. For packet length embedding vector sequence, To train byte stream vectors, For training, a long sequence vector of packets, This is the query vector.

[0012] Optionally, the step of inputting the payload byte stream embedding vector sequence and the packet length embedding vector sequence into a fully connected layer for concatenation to obtain the classification probability includes: Feature extraction is performed on the payload byte stream embedding vector sequence and the packet length embedding vector sequence to obtain the payload feature vector and the packet length sequence feature vector; The payload feature vector and the packet length sequence feature vector are input into the fully connected layer to generate classification probabilities.

[0013] Optionally, adjusting the weight parameters of the fusion model based on the classification probability and loss function to obtain an optimized fusion model, and inputting the network traffic into the optimized fusion model to obtain the classification result includes: Determine whether the classification probability is greater than a preset probability; If the classification probability is lower than the preset probability, the weight parameters of the fusion model are adjusted by the loss function to obtain an optimized fusion model. The network traffic is then input into the optimized fusion model to obtain the classification result.

[0014] Optionally, the loss function is expressed as:

[0015] in, It's a real label. It is a prediction probability. It is a collection of tags. It is the number of samples. is the sample number, c is the category number, and Y is the category label.

[0016] A network traffic classification system, comprising: The data acquisition module is used to copy data packets from the local network to the capture port through the switch. The monitoring machine sniffs and parses the data packets through the capture port to obtain packet length sequence data and payload byte stream data. The settings module is used to set identifiers; The word segmentation module is used to segment the packet length sequence data and the payload byte stream data into words according to the identifier, so as to obtain segmented packet length sequence data and segmented byte stream data; The first training module is used to input the segmented packet long sequence data into the mask language model for training, and obtain the training packet long sequence model. The second training module is used to input the segmented byte stream data into the masked language model for training, and obtain the trained byte stream model. The acquisition module is used to acquire fused training data; The output module is used to input the fused training data into the training byte stream model and the training packet-length sequence model to obtain the training byte stream vector and the training packet-length sequence vector. A query vector construction module is used to assemble the training byte stream vector and the training packet-length sequence vector into a query vector. The learning module is used to obtain the payload byte stream embedding vector sequence and the packet length embedding vector sequence based on the training byte stream vector, the training packet length sequence vector, and the query vector. The model building module is used to build a fusion model based on the query vector and the fusion formula; The classification module is used to input the payload byte stream embedding vector sequence and the packet length embedding vector sequence into the fully connected layer of the fusion model for concatenation to obtain the classification probability. Based on the classification probability and the loss function, the weight parameters of the fusion model are adjusted to obtain the optimized fusion model. The network traffic is then input into the optimized fusion model to obtain the classification result.

[0017] A terminal device includes a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, it employs a network traffic classification method.

[0018] A computer-readable storage medium storing a computer program that, when loaded and executed by a processor, employs a network traffic classification method.

[0019] The beneficial effects of this invention are: Data is collected by a monitoring device to obtain packet length sequence data and payload byte stream data. Then, it is segmented using identifiers and input into a masked language model for training, resulting in a training byte stream model and a training packet length sequence model. Next, fused training data is input into these models to obtain training byte stream vectors and training packet length sequence vectors, which are then combined to form a query vector. Based on these vectors, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained. These two sequences are then fused using a fusion model and input into the fully connected layer of the fusion model to obtain classification probabilities. The weight parameters of the fusion model are adjusted using a loss function to obtain an optimized fusion model. Finally, based on the optimized fusion model and network traffic, the classification result is obtained. This application trains the model using unlabeled data, training the byte stream model and the packet long sequence model separately. It learns the underlying structure and common patterns of network traffic through self-supervised learning, thereby obtaining a general and meaningful representation of network traffic. Training can be completed without a large amount of labeled data. Moreover, it makes full use of the multimodal information of network flow. The fusion of the two modal representation results can fully utilize the multimodal information of network flow, thereby achieving efficient identification of network flow. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a network traffic classification method according to the present invention. Detailed Implementation

[0021] A network traffic classification method, such as Figure 1 As shown, it includes: S1. The local network data packets are copied to the capture port through the switch. The monitoring machine sniffs and parses the data packets through the capture port to obtain the packet length sequence data and the payload byte stream data.

[0022] Specifically, network traffic is identified by a five-tuple (source IP, source port, destination IP, destination port, and protocol), representing a bidirectional set of data packets transmitted between a client (source IP, source port) and a server (destination IP, destination port) via a certain network protocol (such as TCP and UDP). Network traffic is heterogeneous data with multiple modalities; the raw byte stream and the transmission mode are two important modalities. Specifically, the raw byte stream represents the content information of the network traffic, while the transmission mode reflects its underlying behavioral information.

[0023] This modality refers to the sequence of bytes contained in a network traffic data packet. A network data packet consists of a header and a payload. The transmitted bytes determine the function of the network traffic. Due to error correction and verification mechanisms in the protocol, the raw byte stream represents the static characteristics of network traffic.

[0024] Transmission mode: This mode represents all side-channel information in network traffic besides the actual transmitted bytes, such as packet length, direction, and timestamps. Extracting behavioral information is crucial for encrypted traffic analysis because the byte patterns contained in the packet payload are limited. Due to fluctuations in the network environment, packet transmission is susceptible to network noise, such as packet loss, retransmission, and out-of-order delivery. Therefore, transmission mode is a dynamic characteristic.

[0025] Considering the instability of strong identification fields in the header and time-related information, the payload byte stream and packet length sequence are chosen to represent the modalities of the original byte stream and the transmission mode, respectively.

[0026] On the network gateway switch, we configured port mirroring to copy packets from the local network to a designated capture port. This capture port is connected to the monitoring machine. On the monitoring machine, we deployed a Zeek cluster for traffic sniffing and parsing. The Zeek cluster is a group of workers that collaboratively analyze network link traffic in a coordinated manner. Since Zeek is not multi-threaded, the only current option is to distribute the workload across multiple cores from the front end once the limit of a single processor core is reached. The workers sniff network packets and perform protocol analysis on the reconstructed network flow. We also developed two Zeek plugins (ps.zeek and bytes.zeek) to record the packet length sequence and payload byte stream for each network flow, respectively.

[0027] The data obtained through the monitoring machine is terabytes of unlabeled network traffic data.

[0028] S2, Set the identifier.

[0029] Specifically, the identifier is set to segment the payload byte stream and packet-length sequence.

[0030] S3. Based on the identifier, the packet length sequence data and the payload byte stream data are segmented into words to obtain the segmented packet length sequence data and the segmented byte stream data.

[0031] Based on the identifier, the packet length sequence data and payload byte stream data are segmented into words to obtain segmented packet length sequence data and segmented byte stream data, including: Identifiers include start identifier, separator identifier, padding identifier, mask identifier, and unknown identifier.

[0032] Specifically, the start identifier, separator identifier, padding identifier, mask identifier, and unknown identifier are represented by ([CLS], [SEP], [PAD], [MASK], and [UNK], respectively.

[0033] The start identifier indicates the beginning of the sequence, the separator identifier indicates word segmentation by byte value, the padding identifier indicates that the sequence with insufficient length is padded with the padding identifier, the mask identifier indicates that the masked token is replaced, and the unknown identifier indicates unknown tokens in the corpus.

[0034] Specifically, the corpus is composed of data obtained through monitoring. In actual testing, unknown characters may be encountered, so this unknown identifier is used to replace them.

[0035] For the payload byte stream, the first preset length of bytes of the payload byte stream is obtained as the data packet.

[0036] Specifically, the first 256 bytes (out of a total of 512 bytes) of the transport layer payload are used in both the uplink and downlink to represent the raw byte stream (data packets) of the network flow.

[0037] Using byte values ​​as the unit of word segmentation, the payload byte stream is segmented using identifiers to obtain segmented byte stream data.

[0038] Specifically, byte values ​​are used as the basic unit for word segmentation, thereby enabling word segmentation of the load byte stream modality of the network stream.

[0039] For segmented packet length sequences, the uplink packet length corresponding to the uplink and the downlink packet length corresponding to the downlink are obtained according to the packet length sequence. The uplink packet length of the uplink is defined as positive to obtain the positive uplink packet length, and the downlink packet length of the downlink is defined as negative to obtain the negative downlink packet length.

[0040] Using packet length as the unit of word segmentation and positive and negative as the direction, the upstream packet length and the downstream packet length are segmented into words using the identifier to obtain segmented packet length sequence data.

[0041] Specifically, for packet length, its absolute value is the length of the transport layer payload, while its sign indicates the direction of the packet in the network flow. Uplink packet length is defined as positive, and downlink packet length as negative. For tokenization of packet length sequences, the directional packet length is directly used as the basic unit of tokenization, i.e., positive and negative.

[0042] S4. Input the segmented byte stream data into the mask language model for training to obtain the trained byte stream model.

[0043] The segmented byte stream data is input into the masked language model for training, resulting in the trained byte stream model, which includes: A masking operation is performed on a portion of the first preset percentage of words in the segmented byte stream to obtain a mask sequence.

[0044] Replace the words in the second preset percentage of the mask sequence with the mask, replace the words in the third preset percentage of the mask sequence with new words, and leave the words in the fourth preset percentage of the mask sequence unchanged to obtain the training sequence. The sum of the second preset percentage, the third preset percentage, and the fourth preset percentage is 1.

[0045] The training sequence is trained using a masked language model to obtain a training byte stream model.

[0046] Specifically, two sub-models (a byte stream training model and a packet-length sequence training model) were designed to represent information from two different network traffic patterns, respectively. Specifically, BERT-bytes was used for the payload byte stream, while BERT-ps was used for the packet-length sequence. To mitigate insufficient information extraction due to potential interference between modalities, both sub-models underwent single-modal pre-training.

[0047] Bytes are mapped to Euclidean space, which includes byte value embedding, position embedding, and type embedding. Position embedding indicates the byte's location within the payload byte stream, while type embedding indicates whether the byte belongs to the uplink or downlink stream. All three embeddings are implemented using embedding layers with learnable parameters and are achieved through addition. That is:

[0048] in, Embedding byte values For location embedding, For type embedding, For byte embedding.

[0049] Packet length embedding: Each packet length is mapped to Euclidean space, which includes packet length value embedding and position embedding. The position embedding represents the position information of the packet length value in the packet length sequence. Both embeddings are implemented using embedding layers with learnable parameters, and packet length embedding is achieved by addition.

[0050]

[0051] in, Embedding for package length values, For location embedding, Embedded for package length.

[0052] The combination of byte embedding and packet length embedding enables the model to extract and model traffic data at two different levels (content and length), thereby improving the accuracy of traffic analysis. The unimodal pre-training approach aims to mitigate potential interference between byte streams and packet length streams, allowing each model to focus on its specific information extraction task, improving the clarity and effectiveness of the information.

[0053] The pre-training process is implemented using a masked language model. Its basic principle is to mask out the words to be predicted and then predict the original value of the masked word based on other unmasked words provided in the context. During training, 15% (the first preset percentage) of the tokens in the input sequence need to be masked. Specifically, the masking operation for the selected 15% of tokens includes a third part: 80% (the second preset percentage) are directly replaced with [MASK], 10% (the third preset percentage) are directly replaced with new tokens, and the remaining 10% (the fourth preset percentage) remain unchanged. The MLM uses [MASK] as noise and obtains bidirectional semantic information through autoencoder training.

[0054] The pre-training process is carried out on terabytes of network stream data. Its purpose is to enable BERT-bytes and BERT-ps to learn the underlying structure and common patterns of network traffic in a self-supervised manner, thereby obtaining a general and meaningful representation of network traffic.

[0055] S5. Input the segmented packet long sequence data into the mask language model for training to obtain the trained packet long sequence model.

[0056] Specifically, the training method for training the long sequence model is the same as the training method for training the byte stream model.

[0057] S6. Obtain fusion training data.

[0058] The fusion training data consists of data with known network traffic categories, and is composed of packet length sequence data and payload byte stream data.

[0059] S7. Input the fused training data into the training byte stream model and the training packet long sequence model to obtain the training byte stream vector and the training packet long sequence vector.

[0060] Specifically, after pre-training on massive amounts of unlabeled data, BERT-bytes and BERTps can effectively represent the content and behavioral information of network flows, respectively. To improve the analytical performance of downstream tasks, a fusion model is designed to fully utilize information from network flows, including payload byte streams and packet length sequences.

[0061] In the payload byte stream and packet length sequence, some markers need to be aware of cross-modal information, while others are only relevant to their own modality. For example, if the TLS record length represented by bytes exceeds the maximum segment size (MSS), one or more consecutive packets with an MSS length will appear. In contrast, bytes representing field lengths are typically only relevant to subsequent field bytes and do not affect the packet length sequence. Therefore, directly applying cross-attention to the outputs of both modalities can corrupt the unimodal representation, thereby degrading model performance.

[0062] S8. Based on the fusion model, the training byte stream vector and the training packet length sequence vector are combined to form the query vector.

[0063] Specifically, the concatenated output of the two modalities is used as the query vector in the cross-attention mechanism. For network traffic, after inputting its payload byte stream, the output of BERT-bytes is represented as follows: After inputting its packet length sequence, the output of BERT-ps is expressed as follows: Then, and Concatenate to form a query vector .

[0064] S9. Based on the training byte stream vector, the training packet length sequence vector, and the query vector, obtain the payload byte stream embedding vector sequence and the packet length embedding vector sequence.

[0065] Based on the training byte stream vector, the training packet length sequence vector, and the query vector, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained, including: Obtain the formula for the embedded vector sequence.

[0066] Based on the training byte stream vector, the training packet length sequence vector, the query vector, and the embedding vector sequence formula, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained.

[0067] The formula for embedding vector sequences is expressed as:

[0068]

[0069] in, Embed a vector sequence into the payload byte stream. For packet length embedding vector sequence, To train byte stream vectors, For training, a long sequence vector of packets, This is the query vector.

[0070] Specifically, will and Concatenate to form a query vector Then respectively with and Calculate the cross-attention score. This process enables the marker in each modality to simultaneously attend to information from all modalities. After the cross-attention mechanism, the embedding vector sequence of the payload byte stream and packet length sequence is obtained.

[0071] The specific implementation of the cross-attention mechanism can be represented as follows:

[0072] in, for or , Let be the query vector, where , , , These are the query vector, key vector, value vector, and element dimension, respectively. , as well as It is a weight matrix with learnable parameters, and T represents the transpose matrix.

[0073] S10. Construct a fusion model based on the query vector and the fusion formula.

[0074] Specifically, the fusion formula is as follows:

[0075] middle This indicates that network traffic belongs to the tag space. The probability vectors of different categories in the data. and These are the weight matrix and bias vector of the fully connected layer, respectively.

[0076] After modal fusion, we use data from the payload byte stream and packet length sequence. (from) )and (from) The [CLS] vector corresponding to the two modes of network traffic is used to represent the network traffic. These two representations are concatenated and input into a fully connected layer to generate the recognition result. for The first vector, for The first vector.

[0077] S11. Input the payload byte stream embedding vector sequence and the packet length embedding vector sequence into the fully connected layer of the fusion model for concatenation to obtain the classification probability. Based on the classification probability and the loss function, adjust the weight parameters of the fusion model to obtain the optimized fusion model. Input the network traffic into the optimized fusion model to obtain the classification result.

[0078] The payload byte stream embedding vector sequence and the packet length embedding vector sequence are input into a fully connected layer and concatenated to obtain the classification probabilities, including: Feature extraction is performed on the payload byte stream embedding vector sequence and the packet length embedding vector sequence to obtain the payload feature vector and the packet length sequence feature vector.

[0079] The payload feature vector and the packet length sequence feature vector are input into the fully connected layer of the fusion model to generate classification probabilities.

[0080] Based on the classification probabilities and loss function, the weight parameters of the fusion model are adjusted to obtain an optimized fusion model. Network traffic is then input into this optimized fusion model to obtain classification results, including: Determine whether the classification probability is greater than the preset probability.

[0081] Specifically, determine whether the classification accuracy of the trained model meets the requirements. If it does not, use the backpropagation method of the loss function to change the parameter weights of the fusion model and train it further.

[0082] If the classification probability is lower than the preset probability, the weight parameters of the fusion model are adjusted by the loss function to obtain an optimized fusion model. The network traffic is then input into the optimized fusion model to obtain the classification result.

[0083] The loss function is expressed as:

[0084] in, It's a real label. It is a prediction probability. It is a collection of tags. It is the number of samples. is the sample number, c is the category number, and Y is the category label.

[0085] After pre-training on large-scale data, the model's parameters typically converge and reach a relatively stable state. Making significant adjustments to all model parameters directly on small-scale data can easily lead to overfitting. Therefore, we perform fine-tuning in two stages: Phase 1: This is the warm-up phase for fine-tuning. Specifically, we freeze all pre-trained parameters and only update the gradients of the classifier head. This process prevents gradient updates from the classifier head from affecting the pre-trained parameters without being trained. After this phase, the classifier head will have shown initial performance.

[0086] The second stage is the full parameter fine-tuning stage. We unfreeze the pre-trained parameters and perform full parameter fine-tuning on the model at a lower learning rate. This process can enable the model to achieve improved performance.

[0087] A network traffic classification system, comprising: The data acquisition module is used to copy data packets from the local network to the capture port via a switch. The monitoring machine sniffs and parses the data packets through the capture port to obtain packet length sequence data and payload byte stream data.

[0088] The settings module is used to set identifiers.

[0089] The word segmentation module is used to segment packet length sequence data and payload byte stream data into words based on identifiers, so as to obtain segmented packet length sequence data and segmented byte stream data.

[0090] The first training module is used to input the segmented packet long sequence data into the mask language model for training, and obtain the training packet long sequence model.

[0091] The second training module is used to input the segmented byte stream data into the masked language model for training, thereby obtaining the trained byte stream model.

[0092] The acquisition module is used to acquire fused training data.

[0093] The output module is used to input the fused training data into the training byte stream model and the training packet-length sequence model to obtain the training byte stream vector and the training packet-length sequence vector.

[0094] The query vector building module is used to combine the training byte stream vector and the training packet-length sequence vector into a query vector.

[0095] The learning module is used to obtain the payload byte stream embedding vector sequence and the packet length embedding vector sequence based on the training byte stream vector, the training packet length sequence vector, and the query vector.

[0096] The model building module is used to build a fusion model based on the query vector and the fusion formula.

[0097] The classification module is used to input the payload byte stream embedding vector sequence and the packet length embedding vector sequence into the fully connected layer of the fusion model for concatenation to obtain the classification probability. Based on the classification probability and the loss function, the weight parameters of the fusion model are adjusted to obtain the optimized fusion model. The network traffic is then input into the optimized fusion model to obtain the classification result.

[0098] This application also discloses a terminal device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, it employs a network traffic classification method.

[0099] The terminal device can be a computer device such as a desktop computer, a laptop computer, or a cloud server. The terminal device includes, but is not limited to, a processor and a memory. For example, the terminal device may also include input / output devices, network access devices, and buses.

[0100] The processor can be a central processing unit (CPU). Of course, depending on the actual use, it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc., and this application does not limit it.

[0101] The memory can be an internal storage unit of the terminal device, such as a hard disk or RAM of the terminal device, or an external storage device of the terminal device, such as a plug-in hard disk, smart memory card (SMC), secure digital card (SD), or flash memory card (FC) equipped on the terminal device. Furthermore, the memory can be a combination of internal storage units and external storage devices of the terminal device. The memory is used to store computer programs and other programs and data required by the terminal device. The memory can also be used to temporarily store data that has been output or will be output. This application does not limit this.

[0102] In this terminal device, a network traffic classification method from the above embodiments is stored in the terminal device's memory and loaded and executed on the terminal device's processor for convenient use.

[0103] This application also discloses a computer-readable storage medium, which stores a computer program, wherein when the computer program is executed by a processor, it employs a network traffic classification method described in the above embodiments.

[0104] The computer program can be stored in a computer-readable medium. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or certain middleware. The computer-readable medium includes any entity or device capable of carrying computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the computer-readable medium includes, but is not limited to, the above-mentioned components.

[0105] In this embodiment, a network traffic classification method is stored in the computer-readable storage medium and loaded and executed on the processor to facilitate the storage and application of the method.

[0106] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of protection of this application is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this application as described above, which are not provided in detail for the sake of brevity.

[0107] One or more embodiments in this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments in this application should be included within the protection scope of this application.

Claims

1. A network traffic classification method, characterized in that, include: The local network data packets are copied to the capture port through the switch. The monitoring machine sniffs and parses the data packets through the capture port to obtain packet length sequence data and payload byte stream data. The data obtained by the monitoring machine is TB-level unlabeled network traffic data. Set the identifier; Based on the identifier, the packet length sequence data and the payload byte stream data are segmented into words to obtain segmented packet length sequence data and segmented byte stream data; The segmented packet long sequence data is input into the mask language model for training to obtain the trained packet long sequence model; The segmented byte stream data is input into the masked language model for training to obtain the trained byte stream model; Acquire fusion training data, which is data of known network traffic categories, consisting of packet length sequence data and payload byte stream data; The fused training data is input into the training byte stream model and the training packet-length sequence model to obtain the training byte stream vector and the training packet-length sequence vector. The training byte stream vector and the training packet length sequence vector are combined to form a query vector; Based on the training byte stream vector, the training packet length sequence vector, and the query vector, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained. Construct a fusion model based on the query vector and the fusion formula; The payload byte stream embedding vector sequence and the packet length embedding vector sequence are input into the fully connected layer of the fusion model for concatenation to obtain the classification probability. Based on the classification probability and the loss function, the weight parameters of the fusion model are adjusted to obtain the optimized fusion model. Network traffic is input into the optimized fusion model to obtain the classification result. The step of obtaining the payload byte stream embedding vector sequence and the packet length embedding vector sequence based on the training byte stream vector, the training packet length sequence vector, and the query vector includes: Formulas for obtaining embedded vector sequences; Based on the training byte stream vector, training packet length sequence vector, query vector, and embedding vector sequence formula, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained. The formula for the embedded vector sequence is expressed as follows: in, Embed a vector sequence into the payload byte stream. For packet length embedding vector sequence, To train byte stream vectors, For training, a long sequence vector of packets, For query vector; The fusion formula is: in, This indicates that network traffic belongs to the tag space. The probability vectors of different categories in the data. and These are the weight matrix and bias vector of the fully connected layer, respectively. Category.

2. The network traffic classification method as described in claim 1, characterized in that, The step of segmenting the packet length sequence data and payload byte stream data into words based on the identifier to obtain segmented packet length sequence data and segmented byte stream data includes: The identifiers include start identifier, separator identifier, padding identifier, mask identifier, and unknown identifier; The start identifier indicates the beginning of the sequence, the separator identifier indicates word segmentation by byte value, the padding identifier indicates that the insufficient length of the sequence is filled with padding identifier, the mask identifier indicates that the masked token is replaced, and the unknown identifier indicates the unknown token in the corpus. For the payload byte stream, the first preset length of bytes of the payload byte stream is obtained as the data packet; Using byte values ​​as the unit of word segmentation, the payload byte stream is segmented using the identifier to obtain segmented byte stream data; For segmented packet-length sequences, the uplink packet length and downlink packet length corresponding to the uplink and downlink are obtained according to the packet length sequence. The uplink packet length is defined as positive to obtain the positive uplink packet length, and the downlink packet length is defined as negative to obtain the negative downlink packet length. Using packet length as the unit of word segmentation and positive and negative as the direction, the upstream packet length and the downstream packet length are segmented into words using the identifier to obtain segmented packet length sequence data.

3. The network traffic classification method as described in claim 1, characterized in that, The step of inputting the segmented byte stream data into the masked language model for training to obtain the trained byte stream model includes: A first preset percentage of words in the segmented byte stream are masked to obtain a mask sequence; Replace the words in the second preset percentage of the mask sequence with the mask, replace the words in the third preset percentage of the mask sequence with new words, and leave the words in the fourth preset percentage of the mask sequence unchanged to obtain the training sequence. The sum of the second preset percentage, the third preset percentage, and the fourth preset percentage is 1. The training sequence is trained using a masked language model to obtain a training byte stream model.

4. The network traffic classification method as described in claim 1, characterized in that, The step of inputting the payload byte stream embedding vector sequence and the packet length embedding vector sequence into a fully connected layer for concatenation to obtain the classification probability includes: Feature extraction is performed on the payload byte stream embedding vector sequence and the packet length embedding vector sequence to obtain the payload feature vector and the packet length sequence feature vector; The payload feature vector and the packet length sequence feature vector are input into the fully connected layer to generate classification probabilities.

5. The network traffic classification method as described in claim 4, characterized in that, The process involves adjusting the weight parameters of the fusion model based on the classification probability and loss function to obtain an optimized fusion model. The network traffic is then input into the optimized fusion model to obtain classification results, including: Determine whether the classification probability is greater than a preset probability; If the classification probability is lower than the preset probability, the weight parameters of the fusion model are adjusted by the loss function to obtain an optimized fusion model. The network traffic is then input into the optimized fusion model to obtain the classification result.

6. A network traffic classification system, characterized in that, include: The data acquisition module is used to copy local network data packets to the capture port through the switch. The monitoring machine sniffs and parses the data packets through the capture port to obtain packet length sequence data and payload byte stream data. The data obtained by the monitoring machine is TB-level unlabeled network traffic data. The settings module is used to set identifiers; The word segmentation module is used to segment the packet length sequence data and the payload byte stream data into words according to the identifier, so as to obtain segmented packet length sequence data and segmented byte stream data; The first training module is used to input the segmented packet long sequence data into the mask language model for training, and obtain the training packet long sequence model. The second training module is used to input the segmented byte stream data into the masked language model for training, and obtain the trained byte stream model. The acquisition module is used to acquire fused training data. The fused training data is data with known network traffic categories and consists of packet length sequence data and payload byte stream data. The output module is used to input the fused training data into the training byte stream model and the training packet-length sequence model to obtain the training byte stream vector and the training packet-length sequence vector. A query vector construction module is used to assemble the training byte stream vector and the training packet-length sequence vector into a query vector. The learning module is used to obtain the payload byte stream embedding vector sequence and the packet length embedding vector sequence based on the training byte stream vector, the training packet length sequence vector, and the query vector. The model building module is used to build a fusion model based on the query vector and the fusion formula; The classification module is used to input the payload byte stream embedding vector sequence and the packet length embedding vector sequence into the fully connected layer of the fusion model for concatenation to obtain the classification probability. Based on the classification probability and the loss function, the weight parameters of the fusion model are adjusted to obtain the optimized fusion model. The network traffic is input into the optimized fusion model to obtain the classification result. The step of obtaining the payload byte stream embedding vector sequence and the packet length embedding vector sequence based on the training byte stream vector, the training packet length sequence vector, and the query vector includes: Formulas for obtaining embedded vector sequences; Based on the training byte stream vector, training packet length sequence vector, query vector, and embedding vector sequence formula, the payload byte stream embedding vector sequence and the packet length embedding vector sequence are obtained. The formula for the embedded vector sequence is expressed as follows: in, Embed a vector sequence into the payload byte stream. For packet length embedding vector sequence, To train byte stream vectors, For training, a long sequence vector of packets, For query vector; The fusion formula is: in, This indicates that network traffic belongs to the tag space. The probability vectors of different categories in the data. and These are the weight matrix and bias vector of the fully connected layer, respectively, and c represents the class.

7. A terminal device, comprising a memory and a processor, characterized in that, The memory stores a computer program that can run on a processor, and when the processor loads and executes the computer program, it employs the method described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is loaded and executed by the processor, it employs the method described in any one of claims 1 to 5.

Images