Large language model encrypted traffic classification method based on thinking chain prompt optimization
By integrating the package and flow-level traffic characteristics, using thinking chain distillation technology to optimize the large language model, and generate a traffic field word segmentation device, solving the problem of relying on expert features and a large number of data sets in encrypted traffic classification, achieving higher accuracy and interpretability.
Patent Information
- Application Number
- CN202510253825.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-05
- Publication Date
- 2025-07-25
AI Technical Summary
The prior art relies on expert features and a large number of data sets in encrypted traffic classification, has poor generalization capabilities and insufficient interpretability, making it difficult to deal with unknown data and unknown threats.
By integrating the package and flow-level flow characteristics, the large language model is optimized using thinking chain distillation technology, a traffic field word participle is generated, and the teacher model GPT-4 generates a prompt data set fine-tuning the student model llama-3-8b to enhance the model's reasoning ability and interpretability.
It improves the accuracy and generalization ability of encrypted traffic classification, enhances the interpretability of the model, and can better handle unknown data and unknown threats.
Smart Images
Figure CN120372371A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security and relates to a method for classifying encrypted traffic of a large language model optimized based on chain-of-thought prompting. Background Art
[0002] Network traffic classification is an important research direction in the field of network security, aiming to identify potential threats in traffic or classify traffic categories from different applications or services. Due to the wide adoption of encryption technologies (such as TLS) and anonymous network technologies (such as VPN, Tor), it has become more challenging to accurately detect complex traffic.
[0003] Traditional traffic detection technologies such as the deep packet inspection (DPI) method based on payload and the identification detection technology based on ports are often powerless in the face of encrypted traffic. Currently, the methods for detecting encrypted traffic can be divided into two categories. The first type of active detection method is to obtain plain text through certificate decryption, and then detect traffic by means of DPI or rule matching. The second type is to construct an encrypted traffic feature set based on traffic behavior patterns and use non-decryption methods such as machine learning to detect and identify encrypted traffic.
[0004] Since the original intention of encrypted traffic design and its wide use are both based on protecting user privacy, and the active detection method of certificate decryption consumes a lot of hardware performance, the current mainstream research direction is to use non-decryption technologies such as machine learning or deep learning for encrypted traffic detection. However, the methods based on machine learning and deep learning usually use manually crafted features and supervised labels for learning, and develop complex machine learning models for specific tasks. The cost of developing models to cover all tasks will be extremely large. And this method cannot handle unknown data and requires a large amount of data sets. When facing unknown data scenarios such as concept drift and 0-day attacks, the generalization performance of the model is often poor. In addition, due to the nature of deep learning itself, the interpretability of classification methods is poor.
[0005] In summary, the common problems existing in the above-mentioned existing technologies are as follows: 1) The packet payload in encrypted traffic is unreadable and traditional classification technologies cannot be used; 2) The methods based on machine learning and deep learning rely on expert features or a large number of labeled data sets, and have poor generalization ability and are difficult to handle unknown data; 3) The methods based on machine learning and deep learning have poor interpretability.
[0006] In conclusion, an encrypted traffic classification technology that does not overly rely on experts or data sets, has generalization ability, and has interpretability is needed. Summary of the Invention
[0007] The technical solution of the present invention is used to solve the problem of how to improve the accuracy of encrypted traffic classification.
[0008] The present invention solves the above technical problems through the following technical solutions: The present invention provides a method for classifying encrypted traffic of a large language model optimized based on chain-of-thought prompting, including: S1 Obtain network traffic data, clean and filter the traffic, process it into traffic data with different classification labels, and split it according to packet-level traffic data and flow-level traffic data; S2 Extract the attributes of packet-level traffic data and the features of flow-level traffic data respectively for feature fusion to obtain a traffic feature fusion sequence, and use the traffic feature fusion sequence to construct a training data set and a traffic domain corpus; S3 Based on the traffic domain corpus, use the BPE method to train a traffic domain tokenizer for the llama-3-8b model; S4 Integrate the closed-source large language model GPT4 as a teacher model into the student model llama-3-8b model through chain-of-thought, so as to enhance the step-by-step reasoning ability of the llama-3-8b model and obtain an encrypted traffic classification model; S5 Input the traffic fusion sequence into the encrypted traffic classification model, generate multiple reasoning chains and corresponding prediction labels for each traffic data, sample multiple reasoning chains and vote, and select the category with the most occurrences as the final output traffic category.
[0009] Further, the method of respectively extracting the attributes of packet-level traffic data and the features of flow-level traffic data for feature fusion to obtain a traffic feature fusion sequence is as follows: for each data packet, extract the packet-level features respectively, splice each packet-level feature to form an overall packet-level feature, and combine the packet-level and flow-level features to form a traffic feature fusion sequence.
[0010] Further, the input formats of the training data set and the traffic domain corpus are: {"instruction": [task description] <flow>[Flow-level feature] <packet>[Package-level feature 1], <packet>[Package-level feature 2], …, <packet>[Package-level feature k], "output": [label]}, where <flow>For distinguishing packet-level features and flow-level features, <packet>Packet-level features used to distinguish different packets in the same flow, where label is the label to be learned and predicted.
[0011] Furthermore, the specific steps for training a traffic domain tokenizer for the llama-3-8b model using the BPE method based on the traffic domain corpus are as follows: (1) Determine the desired vocabulary size; (2) Add the suffix '' at the end of each word and count the frequency of each word; (3) Split all words in the corpus into single characters, create an initial dictionary with all single characters, and count the frequency of each character; (4) Select the most frequent adjacent symbol pair, add the new character to the vocabulary, and then fuse all occurrences of this character pair in the corpus; (5) Repeat steps (2) and (3) until the number of words in the vocabulary reaches the set amount. If the set amount has been reached, discard the remaining vocabulary.
[0012] Furthermore, the method of distilling and integrating the closed-source large language model GPT4 as a teacher model into the student model llama-3-8b model through chain of thought to enhance the step-by-step reasoning ability of the llama-3-8b model and obtain an encrypted traffic classification model is as follows: (1) Select the large language model GPT-4 as the teacher model, provide exemplary reasoning chains as prompts for the training samples in part of the training dataset, and form a prompt dataset; (2) Use the large language model GPT-4 to generate predicted labels and reasoning chains; (3) Generate multiple reasoning chains for each traffic sample, sample the generated multiple reasoning chains and the corresponding predicted labels, and construct a fine-tuning corpus containing input questions, reasoning chains, and predicted labels based on the sampling results; (4) Use the fine-tuning corpus to design a loss function to fine-tune the student model llama-3-8b model to maximize the joint probability of generating reasoning chains and predicted labels, thereby obtaining an encrypted traffic classification model.
[0013] Furthermore, the formula for the fine-tuning corpus is as follows:
[0014] where, represents the i-th input question the k-th reasoning chain among the N reasoning chains generated; represents the i-th input question the predicted label corresponding to the k-th reasoning chain among the N reasoning chains generated.
[0015] Further, the loss function is designed as follows:
[0016] where L is the loss function, denotes the expectation calculation for variables (x, y, z), and the variables (x, y, z) are sampled according to the fine-tuning corpus C; denotes the conditional probability of the joint variables (y, z) given the input x.
[0017] Further, the calculation formula for the output traffic category is as follows:
[0018] where, is the output traffic category; is the number of generated inference chains; denotes the m-th predicted label; denotes the indicator function, which takes 1 when the condition in the parentheses holds and 0 otherwise; denotes the selection function that selects the category with the most occurrences of the predicted label.
[0019] The present invention also provides an electronic device, including a memory and a processor. The memory is used to store a program that supports the processor to execute the above-mentioned method for classifying encrypted traffic of a large language model optimized by chain-of-thought prompting, and the processor is configured to execute the program stored in the memory.
[0020] The present invention also provides a storage medium, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the above-mentioned method for classifying encrypted traffic of a large language model optimized by chain-of-thought prompting.
[0021] The advantages of the present invention are as follows: By fusing packet-level and flow-level features, the present invention obtains a traffic feature fusion sequence as training data. Adopting the method of chain-of-thought distillation, a teacher model GPT-4 that generates a chain of thought in a few-shot manner is used to generate a prompt dataset, and the student model llama-3-8b is fine-tuned with the prompt dataset, and a new traffic domain tokenizer is trained for the student model. The present invention uses the fusion features of traffic packet-level and flow-level, and can learn the overall and local features of encrypted traffic. The present invention trains and generates a traffic domain tokenizer, enabling the model to more accurately understand traffic data. The present invention utilizes the chain-of-thought distillation technology to enhance the step-by-step reasoning ability of the model, making the model more interpretable. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Figure 1 is a flowchart of the method for classifying encrypted traffic of a large language model optimized by chain-of-thought prompting according to Embodiment 1 of the present invention; Figure 2 This is the flowchart of the method for training a tokenizer in the traffic field for the llama-3-8b model using the BPE method in the first embodiment of the present invention. Detailed implementation manners
[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.
[0024] The technical solutions of the present invention will be further described below in conjunction with the accompanying drawings of the specification and specific embodiments: Embodiment 1 As Figure 1 shown, the large language model encrypted traffic classification method based on chain of thought prompting optimization in the embodiment of the present invention includes the following steps: Step 1: Obtain network traffic data, clean and filter the traffic, process it into traffic data with different classification labels, and split it according to packet-level traffic data and flow-level traffic data.
[0025] The cleaning and filtering of traffic mainly remove the duplicate and invalid parts in the collected traffic. For example, the original packet data always contains some packets that are not relevant to the research on malicious encrypted traffic detection, such as ARP, DHCP, and ICMP packets, and these packets need to be cleaned and deleted. On the other hand, duplicate, out-of-order, damaged, incomplete, or empty data packets caused by changes in network conditions also need to be cleaned and deleted. In addition, for some unnecessary information contained in the PCAP file, such as the PCAP file header, it can be removed through packet filtering technology.
[0026] The granularity of traffic can be divided into the Packet level (packet level) and the Flow level (flow level). The information at the packet level and the flow level can be fused with each other to assist the encrypted traffic classification model in learning global and local features. The Packet level studies the characteristics of data packets, including the size of the data packets and their distribution, the time interval to reach the destination site, etc. The Flow level focuses on the main characteristics of the flow, including the flow duration, the number of flow bytes, and the process of the flow reaching the destination site. A flow is all data packets with the same five-tuple (source IP, source port, destination IP, destination port, transport layer protocol).
[0027] After completing the cleaning and segmentation of the traffic, to meet the input requirements of some models, data truncation or zero-padding is needed to ensure that the lengths of the input data are consistent. Generally, large language models (LLMs) have limitations on the number of tokens in the input. When segmenting the traffic, it is necessary to control the length of a single data packet or the number of data packets on a single flow; The method for controlling the length of a single data packet is as follows: The maximum length of a data packet is 1024 bytes. The truncated length of the data packet is the smaller value between the maximum length and the actual length. The maximum length of the data packet is set according to actual requirements; The method for controlling the number of data packets on a single flow is as follows: The maximum number of data packets on a single flow is 10, and the maximum length of each packet is 256 bytes. The truncated number of data packets in a single flow is the smaller value between the maximum number and the actual number. The truncated length of the data packet is the smaller value between the maximum length and the actual length. The maximum number of data packets on a single flow and the maximum length of each packet are set according to actual requirements.
[0028] Step 2: Extract the attributes of the packet-level traffic data and the features of the flow-level traffic data respectively for feature fusion to obtain a traffic feature fusion sequence, and use the traffic feature fusion sequence to construct a training data set and a traffic domain corpus.
[0029] The advantage of packet-level traffic data features lies in their fine-grained information. The header features of each data packet can provide very detailed communication behavior information to help identify the microscopic behavior of the traffic. Attack patterns (such as port scanning, DDoS attacks, etc.) are usually manifested through abnormal packet-level traffic data behaviors. Therefore, packet-level traffic data features are very effective in identifying these details.
[0030] The advantage of flow-level traffic data features lies in their global information. Flow-level features can capture the overall behavior and patterns of network traffic by aggregating the statistical information of multiple data packets. For example, features such as the duration of the flow, the number of data packets, and the data traffic can reflect session-level behaviors and help identify long-term traffic trends and patterns. Flow-level analysis can retain the temporal relationship between data packets, which is very important for detecting attacks that require considering temporal changes (such as DDoS attacks, TCP connection hijacking). Flow-level features reflect the interaction process between data packets, while packet-level analysis often ignores this cross-packet temporal relationship.
[0031] For the packet-level granularity, a data packet contains a header field and a payload part; the header field contains frame-related features such as frame encapsulation type, packet timestamp, packet sequence number, etc.; Ethernet-related features such as Ethernet source address, destination address, etc.; IP (network layer) related features such as IP protocol version, IP header length, IP flag bits, etc.; TCP (transport layer) related features such as TCP segment length, sequence number, acknowledgment number, etc.; UDP (transport layer) related features such as UDP datagram length, UDP checksum, etc.; the payload part: encrypted text content.
[0032] For the flow-level granularity, some global information is extracted from the flow, such as flow duration, number of data packets, data packet rate, data packet size (maximum, minimum, average, variance, sum).
[0033] The input of the large language model is jointly composed of packet-level features and flow-level features, which can supplement the lack of fine-grained features at the flow level.
[0034] Generally, a flow contains multiple data packets, suppose there are k. For each data packet p1, p2, …, pk, packet-level features are extracted respectively, and each packet-level feature is concatenated to form the overall packet-level feature, and the packet-level and flow-level features are combined into a traffic feature fusion sequence.
[0035] Since the large language model is designed for text tasks, these extracted network traffic features need to be converted into "text" format to be used as the natural language serialization input of the large language model. The final input format is: {"instruction": [task description] <flow>[Flow-level feature] <packet>[Package-level feature 1], <packet>[Package-level feature 2], …, <packet>[Package-level feature k], "output": [label]}, where <flow>For distinguishing packet-level features and flow-level features, <packet>Packet-level features for differentiating different packets in the same flow, where label is the label (category) to be learned and predicted.
[0036] Classify all processed serialized inputs according to labels and combine them into a training data set and a traffic domain corpus; the training data set is stored in the form of a text file, and the traffic domain corpus is stored in the form of a text file.
[0037] Step 3: Based on the traffic domain corpus, use the BPE method to train a traffic domain tokenizer for the llama-3-8b model.
[0038] Different from the text data used in the pre-training of large language models, network traffic data consists of heterogeneous headers and payloads, and the payload contains plaintext or encrypted data. To overcome the modality gap between natural language and heterogeneous traffic data, a traffic domain tokenizer needs to be trained so that the large language model can adapt to traffic inputs.
[0039] As Figure 2 shown, the specific steps are as follows: (1) Determine the desired vocabulary size; (2) Add a suffix '' at the end of each word and count the frequency of each word; (3) Split all words in the corpus into single characters, create an initial dictionary with all single characters, and count the frequency of each character; (4) Select the most frequent adjacent symbol pair, add the new character to the vocabulary, and then fuse all occurrences of this character pair in the corpus; (5) Repeat steps (2) and (3) until the number of words in the vocabulary reaches the set amount. If the set amount has been reached, the remaining vocabulary is directly discarded.
[0040] Step 4: Distill and integrate the closed-source large language model GPT4 as a teacher model into the student model llama-3-8b through chain of thought, thereby enhancing the step-by-step reasoning ability of the llama-3-8b model to obtain an encrypted traffic classification model.
[0041] The specific steps are as follows: (1) Select the large language model GPT-4 as the teacher model, and provide a small number of exemplary reasoning chains as prompts for the training samples x in part of the training data set i to form a prompt data set.
[0042] The method for forming the prompt data set is: manually or select several examples with reasoning chains from existing work to form a small number of exemplary prompt sets P={(x,y,z)}, where: x is the input question, y is the predicted label, and z is the corresponding exemplary reasoning chain.
[0043] The template of the prompt dataset is as follows: Input question x: "Given the following traffic data <flow>[Flow-level characteristics] <packet>[Package-level feature 1], <packet>[Package-level feature 2], …, <packet>
Packet-level feature k
All tags
[0044] Predicted label y: "Video streaming".
[0045] (2)Use the large language model GPT-4 to generate predicted labels and reasoning chains. The specific method is as follows: Design a prompt dataset for the large language model GPT-4, and input the training dataset into the large language model GPT-4 so that the large language model GPT-4 generates reasoning chains and predicted labels.
[0046] The template of the input training dataset is as follows: Given the following traffic data 【 <flow>[Flow-level characteristics] <packet>[Package-level feature 1], <packet>[Package-level feature 2], …, <packet>[Packet-level feature k], which contains the feature information of the entire flow, the header fields and payload information of the first 10 packets. Please determine which application category the encrypted normal or malicious traffic belongs to and explain the reasoning process. These categories include: [All Tags].
[0047] The target output for generating the inference chain is as follows: 1) The average packet size is close to the median value, which conforms to the characteristics of real-time communication; 2) The time interval is stable and the data stream is continuous; 3) Two-way communication indicates the existence of interaction.
[0048] Predicted label: Real-time voice communication.
[0049] (3) Generate N inference chains for each traffic sample, sample the generated N inference chains and the corresponding predicted labels. The sampling formula is as follows:
[0050] where, is the sampling symbol, means sampling out from , represents the k-th inference chain among the N inference chains generated by the i-th input problem ; represents the predicted label corresponding to the k-th inference chain among the N inference chains generated by the i-th input problem ; represents the output distribution generated by the teacher model T under the condition of the given input problem and the hint set P.
[0051] Organize the sampling results as follows:
[0052] Construct a fine-tuning corpus C containing the input problem, inference chain and predicted label based on the sampling results as follows:
[0053] (4) Use the fine-tuning corpus C to design a loss function to fine-tune the student model llama-3-8b model to maximize the joint probability of generating the inference chain and the predicted label, thereby obtaining an encrypted traffic classification model.
[0054] The designed loss function is as follows:
[0055] where L is the loss function, Indicates that the expected calculation is performed on the variables (x, y, z), and the variables (x, y, z) are sampled according to the fine-tuning corpus C; Indicates the conditional probability of the joint variables (y, z) given the input x.
[0056] Step 5: Input the traffic fusion sequence into the encrypted traffic classification model, generate multiple inference chains and corresponding prediction labels for each traffic data, sample multiple inference chains and vote, and select the category with the most occurrences as the final output traffic category.
[0057] The calculation formula for the output traffic category is as follows:
[0058] Where, is the output traffic category; is the number of generated inference chains; represents the m-th prediction label; represents the indicator function, which takes 1 when the condition in the parentheses holds, otherwise takes 0; represents the selection function for selecting the category with the most occurrences of the prediction label.
[0059] Embodiment 2 An electronic device includes a memory and a processor. The memory is used to store a program that supports the processor to execute the encrypted traffic classification method of the large language model optimized based on the thought chain prompt in Embodiment 1, and the processor is configured to execute the program stored in the memory.
[0060] Embodiment 3 A storage medium stores a computer program, and the computer program executes the steps of the encrypted traffic classification method of the large language model optimized based on the thought chain prompt in Embodiment 1 when run by a processor.
[0061] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.< / packet> < / packet> < / packet> < / flow> < / packet> < / packet> < / packet> < / flow> < / packet> < / flow> < / packet> < / packet> < / packet> < / flow> < / packet> < / flow> < / packet> < / packet> < / packet> < / flow>
Claims
1. A method for classifying encrypted traffic of large language models optimized based on chain-of-thought prompting, characterized in that Including: S1 Obtain network traffic data, clean and filter the traffic, process it into traffic data with different classification labels, and split it according to packet-level traffic data and flow-level traffic data; S2 Extract the attributes of packet-level traffic data and the features of flow-level traffic data respectively for feature fusion, obtain a traffic feature fusion sequence, and construct a training data set and a traffic domain corpus using the traffic feature fusion sequence; S3 Based on the traffic domain corpus, use the BPE method to train a traffic domain tokenizer for the llama-3-8b model; S4 Integrate the closed-source large language model GPT4 as a teacher model into the student model llama-3-8b model through the chain of thought, thereby enhancing the step-by-step reasoning ability of the llama-3-8b model to obtain an encrypted traffic classification model; S5 Input the traffic fusion sequence into the encrypted traffic classification model, generate multiple reasoning chains and corresponding prediction labels for each traffic data, sample multiple reasoning chains and vote, and select the category with the most occurrences as the final output traffic category.
2. The large language model encrypted traffic classification method optimized based on chain-of-thought prompting according to claim 1, wherein, The method of respectively extracting the attributes of packet-level traffic data and the features of flow-level traffic data for feature fusion to obtain a traffic feature fusion sequence is as follows: For each data packet, extract packet-level features respectively, splice each packet-level feature to form an overall packet-level feature, and combine the packet-level and flow-level features to form a traffic feature fusion sequence.
3. The method for classifying encrypted traffic of a large language model optimized based on chain-of-thought prompting according to claim 1, wherein, The input formats of the described training dataset and traffic domain corpus are: {"instruction": [task description] <flow>[Flow-level feature] <packet>[Package-level feature 1], <packet>[Package-level feature 2], …, <packet>[Package-level feature k], "output": [label]}, where <flow>For distinguishing packet-level features and flow-level features, <packet>The packet-level features used to distinguish different packets in the same flow, and the label is the label that needs to be learned and predicted.< / packet> < / flow> < / packet> < / packet> < / packet> < / flow> 4. The method for classifying encrypted traffic of a large language model optimized based on chain-of-thought prompting according to claim 1, wherein, The specific steps of training a traffic domain tokenizer for the llama-3-8b model using the BPE method based on the traffic domain corpus are as follows: (1) Determine the desired vocabulary size; (2) Add the suffix '' at the end of each word and count the frequency of each word; (3) Split all words in the corpus into single characters, establish an initial dictionary with all single characters, and count the frequency of each character; (4) Select the most frequent adjacent symbol pair, add the new character to the vocabulary, and then fuse all such character pairs in the corpus; (5) Repeat the operations in steps (2) and (3) until the number of words in the vocabulary reaches the set amount. If the set amount has been reached, the remaining vocabulary is directly discarded.
5. The encrypted traffic classification method of the large language model optimized based on chain-of-thought prompting according to claim 1, characterized in that The method of integrating the closed-source large language model GPT4 as a teacher model into the student model llama-3-8b model through the chain of thought to enhance the step-by-step reasoning ability of the llama-3-8b model to obtain an encrypted traffic classification model is specifically as follows: (1) Select the large language model GPT-4 as the teacher model, provide exemplary reasoning chains as prompts for the training samples in part of the training data set to form a prompt data set; (2) Use the large language model GPT-4 to generate prediction labels and reasoning chains; (3) Generate multiple reasoning chains for each traffic sample, sample the generated multiple reasoning chains and corresponding prediction labels, and construct a fine-tuning corpus containing input questions, reasoning chains, and prediction labels based on the sampling results; (4) Use the fine-tuning corpus and design a loss function to fine-tune the student model, the llama-3-8b model, to maximize the joint probability of generating the reasoning chain and the predicted label, thereby obtaining the encrypted traffic classification model.
6. The encrypted traffic classification method for large language models optimized based on chain-of-thought prompting according to claim 5, wherein The formula for the fine-tuning corpus is as follows: Among them, represents the i-th input question and the k-th inference chain among the N generated inference chains; represents the i-th input question and the predicted label corresponding to the k-th inference chain among the N generated inference chains.
7. The method for classifying encrypted traffic of a large language model optimized based on chain-of-thought prompting according to claim 5, wherein The loss function is designed as follows: where L is the loss function, denotes the expectation calculation of variables (x, y, z), and variables (x, y, z) are sampled according to the fine-tuning corpus C; denotes the conditional probability of the joint variables (y, z) given the input x.
8. The method for classifying encrypted traffic of a large language model optimized based on chain-of-thought prompting according to claim 1, wherein The calculation formula for the output traffic category is as follows: wherein, is the output traffic category; is the number of generated inference chains; represents the m-th predicted label; represents an indicator function that takes 1 when the condition in the parentheses holds and 0 otherwise; represents a selection function that selects the category with the most occurrences of the predicted label.
9. An electronic device, comprising a memory and a processor, characterized in that, The memory is used to store a program that supports the processor to execute the method for classifying encrypted traffic of the large language model optimized by the chain-of-thought prompt according to any one of claims 1 to 8, and the processor is configured to execute the program stored in the memory.
10. A storage medium, on which a computer program is stored, characterized in that, When the computer program is run by the processor, it executes the steps of the method for classifying encrypted traffic of the large language model optimized by the chain-of-thought prompt according to any one of claims 1 to 8.