Two-stage encryption traffic classification method and system based on plaintext and ciphertext balance

Abstract

The invention discloses a two-stage encrypted traffic classification method and system based on plaintext and ciphertext balance, and belongs to the field of network space security. In order to solve the problems that an existing deep learning model is low in calculation efficiency in encrypted traffic classification and cannot effectively utilize a plaintext and ciphertext relationship, a two-stage processing mechanism based on a balance filter is mainly adopted, and adaptive classification of plaintext and ciphertext traffic is realized by constructing a plaintext classification model and a ciphertext classification model. According to the method, the calculation efficiency of the prediction stage can be remarkably improved while the classification accuracy is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security, and in particular relates to a two-stage encryption traffic classification method and system based on cleartext and ciphertext balance. Background Art

[0002] Encrypted traffic analysis technology, which monitors and analyzes encrypted network communications without decrypting the data, plays a core role in network security maintenance and network operations management. It is crucial for network service providers because a deep understanding of the characteristics of encrypted traffic can help unlock key insights for improving network performance and management efficiency. This technology has a wide range of applications, including identifying the types of encrypted applications and detecting anomalous behavior, as well as classifying virtual private networks (VPNs), thereby comprehensively improving network security defenses. For example, by identifying anomalous patterns in encrypted traffic, malicious activity or intrusion attempts can be detected and prevented in a timely manner, ensuring the security of the network environment.

[0003] In today's networks, encrypted traffic data primarily exists in the form of packets, imbued with rich semantic content. These packets typically consist of two main components: the header, which contains key information such as the source IP address, destination IP address, source port number, destination port number, and protocol type, and is typically in unencrypted plaintext; and the payload, the actual data being transmitted, which is typically encrypted. Early network traffic classification methods relied primarily on plaintext information to analyze traffic data. This included using transport layer protocol port numbers (User Datagram Protocol (UDP) or Transmission Control Protocol (TCP)) or leveraging plaintext information such as Server Name Indicator (SNI). Port-based methods are simple to implement and have low time complexity, making them effective when only applications targeting specific ports need to be classified. However, with the diversification of applications and protocols, and the emergence of techniques such as port hopping and port masquerading, port-based classification methods have become less accurate and unreliable. SNI-based methods use the hostname information requested during the Transport Layer Security (TLS) handshake to determine traffic classification. These methods offer high accuracy and are easy to implement. However, not all clients support SNI, especially older browsers or operating systems. When these clients try to access SNI-enabled websites, SNI-based methods will fail.

[0004] As encryption protocols continue to evolve, the limitations of plaintext classification models have become increasingly apparent. Early plaintext classification methods relied heavily on manually designed feature engineering, and using only plaintext information may not be sufficient in some scenarios. Consequently, researchers have turned to deep learning (DL)-based models, which automatically extract features without restricting data to plaintext or encrypted text. This approach has improved the adaptability and robustness of network traffic classification methods.

[0005] Currently, DL-based models can be roughly divided into two forms: feature-based and byte-based:

[0006] Feature-based methods typically extract information from encrypted traffic data, such as packet length, packet direction, and time intervals. They then use deep learning methods such as convolutional neural networks (CNNs) and long short-term memory (LSTMs) to learn traffic feature representations. These methods can capture complex patterns in encrypted packets without the need for feature engineering.

[0007] Byte-based models directly process raw traffic bytes, typically represented by methods based on pre-trained models. A growing number of researchers are leveraging pre-trained language models for encrypted traffic classification. These models follow the self-supervised pre-training paradigm, which has proven highly effective for natural language processing tasks. The model is first trained in a self-supervised manner on a large amount of unlabeled network traffic data to learn a universal traffic representation. This is achieved through pre-defined tasks such as masked token prediction and homologous BURST prediction, which allow the model to capture raw bytes and explore the intrinsic characteristics of traffic. ET-BERT obtains contextual data representations through pre-training on large-scale traffic data. NetGPT provides a generative pre-trained model for traffic understanding and generation tasks.

[0008] However, both feature-based and byte-based models use both plaintext and ciphertext as input for automated feature extraction. While this approach can theoretically handle a wide range of data types, it ignores the correlation between plaintext and ciphertext, as well as the potential impact on downstream tasks. For example, plaintext data typically contains more semantic information, which helps to more accurately identify and classify traffic types. However, ciphertext, due to its highly obfuscated nature, makes it more difficult to directly extract effective features. Therefore, this one-size-fits-all approach can lead to performance degradation in certain scenarios.

[0009] Furthermore, existing research primarily focuses on improving classification accuracy, continuously optimizing model performance by introducing more complex algorithms or increasing the amount of training data. However, in practical deployments, model computational efficiency is equally crucial, not only for accuracy. Balancing the relationship between plaintext and ciphertext to quickly classify traffic data during the prediction phase is crucial. Therefore, while maintaining high accuracy, greater consideration must be given to the model's prediction efficiency.

[0010] The shortcomings of the prior art are mainly:

[0011] 1. With the evolution of network environments and the rapid advancement of encryption protocols, traditional plaintext classification models (such as port number-based or server name indication-based methods) can no longer meet the needs of encrypted traffic classification.

[0012] 2. Regarding the relationship between plaintext and ciphertext, current feature-based and byte-based models use both plaintext and ciphertext as input for automated feature extraction. However, they ignore the correlation between plaintext and ciphertext and their potential impact on downstream tasks.

[0013] 3. From the perspective of prediction efficiency, existing research mainly focuses on how to improve classification accuracy. By introducing more complex algorithms or increasing the amount of training data to continuously optimize model performance, it fails to further balance the relationship between plaintext and ciphertext, resulting in low computational efficiency of the model during the prediction stage. Summary of the Invention

[0014] The purpose of the present invention is to solve the problems of low computational efficiency and separation of plaintext and ciphertext processing in existing encrypted traffic classification methods, and to propose a two-stage encrypted traffic classification method and system based on plaintext and ciphertext balance, which can adaptively select the processing path and significantly improve the computational efficiency while ensuring classification accuracy.

[0015] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0016] A two-stage encrypted traffic classification method based on plaintext-ciphertext balance includes the following steps:

[0017] 1) Extract the plaintext and ciphertext information of the traffic data packet;

[0018] 2) Based on the plaintext information, a classification model is used to make a preliminary classification prediction on the data packet to predict whether the plaintext is classifiable. This data set with classifiability labels is obtained. This data set with classifiability labels is then used to train a balanced filter to predict whether the plaintext is classifiable.

[0019] 3) Use the trained balanced filter to predict whether the plaintext information of the newly input data packet is classifiable;

[0020] 4) If the plaintext information is predicted to be classifiable, the plaintext information is input into the plaintext classification model using a convolutional neural network for classification, and the corresponding traffic category label is output;

[0021] 5) If the plaintext information is predicted to be unclassifiable, the plaintext information and ciphertext information of the data packet are input into the ciphertext classification model for classification, and the corresponding traffic category label is output.

[0022] Furthermore, the plaintext information extracted in step 1) refers to the feature vector composed of the five-tuple feature, TCP header field and TLS header field of each data packet, and the ciphertext information refers to the byte sequence of the TLS payload in the data packet.

[0023] Furthermore, in step 2), the method of using the classification model to make preliminary classification predictions for the data packet is: comparing the prediction results with the original category labels of the data packets; if they match, they are marked as plaintext classifiable, otherwise they are marked as plaintext unclassifiable; the classification model is a neural network model based on deep learning.

[0024] Furthermore, the balancing filter in step 2) adopts the PACREP model, and the steps of training the PACREP model include: taking the plaintext information in the data set with the classifiability label as input, sending it into a neural network structure containing multiple linear layers and nonlinear activation functions for training, and outputting the predicted classifiability probability, which is converted into a classifiability label according to a set threshold.

[0025] Furthermore, the plaintext classification model in step 4) includes a one-hot encoding layer, a 1D convolution layer, a pooling layer, a dropout layer, and a classification layer, wherein the one-hot encoding layer is used to encode discrete fields in the plaintext information into a vector representation of a fixed dimension, the 1D convolution layer is used to extract sequence features, the pooling layer is used for dimensionality reduction, the dropout layer prevents overfitting, and the classification layer is a fully connected layer and outputs category labels.

[0026] Furthermore, the ciphertext classification model in step 5) includes a syntax tree construction module, a BERT model and a classifier, wherein the syntax tree construction module is used to model the grammatical structure of plaintext information and ciphertext information to generate a syntactic hierarchy; the BERT model is used to extract context-related deep feature representations; the classifier is a multi-layer perceptron structure that outputs the final traffic category label.

[0027] Furthermore, the processing steps of the syntax tree construction module include:

[0028] Perform word segmentation on the input plaintext and ciphertext information to obtain a preliminary word sequence;

[0029] Based on predefined context-free grammar rules, perform syntactic analysis on the word sequence and construct the corresponding syntax tree structure;

[0030] Encode the syntax tree structure into a structured representation.

[0031] Furthermore, the input of the BERT model is composed of the concatenation of the syntax tree encoding representation and the original text vector representation, and the fused contextual semantic features are extracted through a multi-layer Transformer encoder.

[0032] Furthermore, the classifier consists of at least two fully connected layers. The first layer receives the fusion vector output by BERT and performs nonlinear transformation, and the second layer outputs the final traffic category prediction result.

[0033] A two-stage encrypted traffic classification system based on plaintext-ciphertext balance includes:

[0034] Data packet extraction module, used to extract the plaintext information and ciphertext information of traffic data packets;

[0035] The preliminary classification model is used to make preliminary classification predictions on data packets, predict whether the plaintext is classifiable, and obtain a data set with classifiability labels;

[0036] A balanced filter that predicts whether the plaintext information of a packet is classifiable after training on a dataset with classifiability labels;

[0037] The plaintext classification model is used to classify categorizable plaintext information and output the corresponding traffic category label;

[0038] The ciphertext classification model is used to classify unclassifiable plaintext information based on the plaintext and ciphertext information of the data packet and output the corresponding traffic category label;

[0039] The model training module is used to train the balanced filter, plaintext classification model, and ciphertext conversion model.

[0040] The beneficial effects achieved by the present invention are as follows:

[0041] 1. This invention introduces a balanced filter to divide traffic data into two branches: plaintext and ciphertext. It uses a plaintext classification model and a ciphertext classification model for adaptive processing, respectively. It can efficiently determine whether traffic classification can be completed based on plaintext alone, thereby avoiding unnecessary ciphertext processing, improving classification efficiency while ensuring model performance.

[0042] 2. In the second stage, the present invention adaptively selects to use the plaintext or ciphertext classification model for subsequent classification based on the judgment results of the first stage, which has flexibility and adaptability, and effectively improves the accuracy and processing efficiency of traffic classification.

[0043] 3. This invention fully considers computational efficiency in the prediction stage and significantly reduces computing resource consumption by optimizing the plaintext and ciphertext processing paths while ensuring classification accuracy. It is suitable for actual deployment scenarios with high real-time requirements.

[0044] 4. The present invention considers and utilizes the correlation between plaintext and ciphertext, and no longer processes the two types of data in isolation. Through joint analysis and modeling, it achieves effective fusion and balance of plaintext and ciphertext, thereby improving the accuracy and reliability of the overall traffic classification system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a two-stage encryption traffic classification flow chart based on cleartext and ciphertext balance of the present invention.

[0046] Figure 2 It is a diagram of the data construction process.

[0047] Figure 3 It is a schematic diagram of the plaintext classification model structure.

[0048] Figure 4 This is a diagram of the BERT architecture. DETAILED DESCRIPTION

[0049] In order to make the various technical features and advantages or technical effects of the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below through embodiments.

[0050] The embodiment of the present invention proposes a two-stage encryption traffic classification method and system based on the balance of plaintext and ciphertext, such as Figure 1 As shown, the core module includes a balanced filter (first stage) and a plaintext or ciphertext classification model (second stage). Specifically, the balanced filter in the first stage is used to determine whether there is sufficient plaintext information to support the execution of subsequent traffic classification tasks. The main purpose of this module is to make full use of plaintext information and quickly determine whether the traffic can be classified using only plaintext, so as to decide whether to further analyze the plaintext and ciphertext separately. In the second stage, the plaintext or ciphertext classification model will be adaptively selected based on the results of the first stage to decide whether to use the plaintext classification model or the ciphertext classification model for the final classification. This adaptive selection ensures the flexibility and accuracy of the classification process. The following is a detailed description of the method of the present invention:

[0051] 1. Problem Definition

[0052] Given a PCAP file, parse it with the Scapy tool to get multiple data packets. Each data packet contains header information X p and load information X e ,Formally, the data packet can be represented as:

[0053]

[0054] Here, M represents the number of words in the plaintext, N represents the total number of words in the plaintext and ciphertext, p represents the plaintext, and e represents the ciphertext. Each data packet also corresponds to a category label y.

[0055] The encrypted traffic classification task is decomposed into two subtasks: First, in the first stage, the plaintext information is judged to determine whether it is sufficient to support the subsequent traffic classification task. In the second stage, based on the judgment results of the first stage, the plaintext classification model or the ciphertext classification model is adaptively selected to perform traffic classification, and the category label is finally obtained.

[0056] 2. Stage 1 - Balancing Screener

[0057] In the first stage of training, a balanced filter based on plaintext information is proposed to assess whether the plaintext is sufficient to support subsequent traffic classification (a binary classification task). Since existing datasets do not contain labeled information for this task, it is necessary to first construct corresponding labeled data. Given that this task is inherently a relatively simple traffic classification problem, current mainstream classification models (such as ET-BERT) can be used to annotate the data.

[0058] Specifically, using only plaintext information as input, the ET-BERT model is trained for standard traffic classification, using the cross-entropy classification loss function. After training, the model is used to make predictions for all data samples. The data labeling process is as follows: For the plaintext data in the test set, the ET-BERT model outputs a predicted category label and compares this label with the original sample label. If the predicted label matches the original label, the sample is marked as "1" (indicating that the plaintext can be classified); if not, it is marked as "0" (indicating that the plaintext cannot be classified). This process constructs a labeled dataset with plaintext classification capabilities.

[0059] Subsequently, the labeled data is used to train the balanced filter model, which is built based on the PACREP architecture and uses the cross entropy classification loss function during training. p , the model outputs the predicted probability of its classification ability, which is expressed as follows:

[0060] p(y|X p )=PACREP(X p )

[0061] Among them, PACREP is the basic classification model, X p is the plaintext input feature, y is the category label, y∈{0,1}.

[0062] After screening, two subsets can be obtained: the plaintext separable subset and the plaintext inseparable subset, which serve as the input basis for the second-stage adaptive classification model.

[0063] 3. Stage 2 — Plaintext Classification Model

[0064] To rapidly process and classify large amounts of data, this paper employs a convolutional neural network (CNN) to process traffic data. CNNs are highly efficient in feature extraction and can capture local contextual relationships within the data, thereby improving the model's classification performance. They are particularly well-suited for scenarios requiring rapid decision-making.

[0065] Specifically, the plaintext classification model first classifies the input plaintext information X p Tokenization is performed to generate a sequence of strings. Then, a one-hot encoding layer is used to convert these strings into corresponding numerical representations to obtain the vector {h1,h2,…,h M}, this value is convenient for subsequent calculations. The conversion process formula is as follows:

[0066]

[0067] Where M represents the number of words in the plaintext, and p represents the plaintext data.

[0068] The model then uses a 1D convolution layer to capture local dependencies in the sequence data and extract the interaction information between various parts of the plaintext (such as TCP window, packet length information, etc.). The advantage of 1D convolution is that it effectively processes sequence data by sliding the convolution filter on the input data, thereby discovering patterns and associations in the local context. After the convolution operation, the resulting encoding vector is represented as:

[0069]

[0070] in, d c Indicates the dimension of 1D convolution.

[0071] Next, the model uses a max pooling layer to reduce the dimensionality of the hidden vector and highlight the most important features. This operation helps improve computational efficiency and enhances the model's robustness to changes in input data. After that, a dropout layer is used to prevent the model from overfitting. Finally, the features are passed to the probability normalization layer, which outputs the probability distribution p∈R for each category. l , where l is the number of label categories in the dataset. For example, the CHNAPP dataset has a value of 6, which includes six application categories: Youku, QQ Mail, QQ Music, WeChat, Taobao, and Weibo. This distribution represents the probability that the input traffic data belongs to each category.

[0072] The plaintext classification model training dataset includes ISCXVPN and CHNAPP traffic datasets. During the training process, the plaintext part is extracted from the traffic data packet. As input, the output is the corresponding application category label. During training, the cross entropy classification loss function is used to optimize the plaintext classification model.

[0073] 4. Phase 2 — Ciphertext Classification Model

[0074] Phase 2 proposes a ciphertext classification model based on structural parsing. This innovatively constructs a syntax tree for traffic data and incorporates deep learning methods to handle the complexity of encrypted traffic. While computationally more complex, this approach provides highly accurate encrypted traffic classification, especially since, after the first phase of filtering, only a small portion of data flows to that branch, ensuring efficient processing.

[0075] The ciphertext classification model mainly adopts the BERT architecture, the architecture diagram is as follows Figure 4 As shown in the figure, the model consists of three parts: a syntax tree construction and parsing module, a BERT model, and a classifier. BERT and the classifier are trained jointly. The ciphertext classification model is trained using the ISCXVPN and CHNAPP traffic datasets. During training, both the plaintext and payload parts of the traffic packets are extracted and processed using an abstract syntax tree (Abs-Tree). The resulting character sequence serves as input, and the output label is the specific application category. The cross-entropy classification loss function is used during training.

[0076] The specific steps are as follows:

[0077] (1) Syntax parsing: First, the traffic data is parsed to obtain a parsed syntax tree, which is then converted into a character sequence. This character sequence is used as input and passed through the BERT model to obtain a rich hidden representation, thereby improving the model's ability to handle complex traffic patterns, especially playing an important role in the effective classification of encrypted traffic. The formula is defined as follows:

[0078]

[0079] Where N represents the total number of traffic data words, p represents plaintext, e represents ciphertext, and Abs-Tree represents the abstract syntax tree.

[0080] (2) BERT model: Next, the BERT model processes the character sequence obtained from the syntax tree and outputs the corresponding hidden representation. The formula is as follows:

[0081] {g1,g2,…,g N}=BERT({g1,h2,…,h N})

[0082] Among them, {g1,g2,…,g N} is the output hidden representation of the BERT model.

[0083] (3) Classifier processing: Finally, the updated hidden representation {g1,g2,…,g N Input a classifier, such as a multi-layer perceptron (MLP), to output the probability distribution of traffic classes, as follows:

[0084] P(y)=Softmax(Classifier({g1,g2,…,g N}))

[0085] Among them, Classifier is a multi-layer linear perceptron, and y is the category label, such as email, QQ music, Weibo and other applications.

[0086] Through the above steps, the model can efficiently process encrypted traffic data and effectively perform classification.

[0087] 5. Experimental Results

[0088] The method was validated on the ISCXVPN and CHNAPP datasets. The ISCXVPN dataset includes traffic classification tasks for various applications, such as YouTube and Facebook. The CHNAPP dataset, on the other hand, focuses on traffic classification for Chinese applications, including Youku, QQ Mail, QQ Music, WeChat, Taobao, and Weibo.

[0089] To effectively evaluate model performance, this experiment used two primary metrics: macro-F1 and micro-F1. Specifically, macro-F1 calculates the F1 score for each class independently and averages them, giving equal weight to each class. This helps evaluate model performance on imbalanced data. In contrast, micro-F1 calculates the overall F1 score for all classes, regardless of the number of classes.

[0090] The calculation steps of marco-F1 are as follows:

[0091] 1) Calculate the precision P and recall R of each category;

[0092] 2) Calculate the F1 score for each category using the formula:

[0093]

[0094] 3) Calculate the average F1 score of all categories to get marco-F1.

[0095] The calculation steps of micro-F1 are as follows:

[0096] 1) Summarize all prediction results and true labels;

[0097] 2) Calculate the overall precision P and recall R;

[0098] 3) Calculate micro-F1 using the following formula:

[0099]

[0100] The calculation formulas for precision and recall are:

[0101]

[0102] Among them, TP is true positive, which indicates the number of samples correctly classified by the classifier; FP is false positive, which indicates the number of samples of other categories mistakenly classified as the current category by the classifier; FN is false negative, which indicates the number of samples of the current category that the classifier fails to correctly classify.

[0103] In terms of model efficiency, the "Effi." metric is used, which represents the number of samples predicted per second by the model. The higher the value of the above evaluation metric, the better.

[0104] The experimental results are shown in Table 1. Our method outperforms existing methods and baseline models across the board on the ISCXVPN and CHNAPP datasets. In particular, our method achieves a 2- to 5-fold improvement in prediction efficiency compared to the current state-of-the-art methods. For example, in the ISCXVPN application classification task, our method achieves a significant improvement in the macro-F1 metric, while also increasing efficiency by over 5 times. In the CHNAPP application classification task, our method also achieves improvements in the micro-F1 metric. Although the macro-F1 metric decreases slightly by 0.15%, the overall efficiency increases by nearly 2 times.

[0105] On the other hand, ET-BERT and YaTC add an additional pre-training stage before fine-tuning, which adds additional time overhead compared to directly fine-tuning BERT.

[0106] In general, the analysis of effectiveness and efficiency verifies the superiority of the method of the present invention, emphasizes the importance of analyzing the correlation between plaintext and ciphertext, and highlights the necessity of analyzing plaintext and encrypted traffic.

[0107] Table 1. Effectiveness scores of models on ISCXVPN and CHNAPP datasets

[0108]

[0109] Although the present invention has been disclosed as above by way of embodiments, they are not intended to limit the present invention. Any appropriate modification or equivalent substitution of the technical solution of the present invention by a person skilled in the art should be included in the protection scope of the present invention. The protection scope of the present invention shall be based on that defined in the claims.

Claims

1. A two-stage encryption traffic classification method based on plaintext and ciphertext balance, characterized by: The following steps are involved: 1) Extract the plaintext and ciphertext information of the traffic data packet; 2) Based on the plaintext information, a classification model is used to make a preliminary classification prediction on the data packet to predict whether the plaintext is classifiable. This data set with classifiability labels is obtained. This data set with classifiability labels is then used to train a balanced filter to predict whether the plaintext is classifiable. 3) Use the trained balanced filter to predict whether the plaintext information of the newly input data packet is classifiable; 4) If the plaintext information is predicted to be classifiable, the plaintext information is input into the plaintext classification model using a convolutional neural network for classification, and the corresponding traffic category label is output; 5) If the plaintext information is predicted to be unclassifiable, the plaintext information and ciphertext information of the data packet are input into the ciphertext classification model for classification, and the corresponding traffic category label is output.

2. The method according to claim 1, wherein The plaintext information extracted in step 1) refers to the feature vector composed of the five-tuple feature, TCP header field and TLS header field of each data packet, and the ciphertext information refers to the byte sequence of the TLS payload in the data packet.

3. The method according to claim 1, wherein In step 2), the method of using the classification model to make preliminary classification predictions for the data packet is as follows: the prediction result is compared with the original category label of the data packet. If there is a match, it is marked as plaintext classifiable, otherwise it is marked as plaintext unclassifiable; the classification model is a neural network model based on deep learning.

4. The method according to claim 1, wherein In step 2), the balancing filter adopts the PACREP model. The steps of training the PACREP model include: taking the plaintext information in the dataset with the classifiability label as input, feeding it into a neural network structure containing multiple linear layers and nonlinear activation functions for training, and outputting the predicted classifiability probability, which is converted into a classifiability label according to a set threshold.

5. The method according to claim 1, wherein In step 4), the plaintext classification model includes a one-hot encoding layer, a 1D convolution layer, a pooling layer, a dropout layer, and a classification layer. The one-hot encoding layer is used to encode discrete fields in the plaintext information into a vector representation of a fixed dimension. The 1D convolution layer is used to extract sequence features. The pooling layer is used for dimensionality reduction. The dropout layer prevents overfitting. The classification layer is a fully connected layer and outputs category labels.

6. The method according to claim 1, wherein In step 5), the ciphertext classification model includes a syntax tree construction module, a BERT model, and a classifier. The syntax tree construction module is used to model the grammatical structure of plaintext and ciphertext information and generate a syntactic hierarchy. The BERT model is used to extract context-related deep feature representations. The classifier is a multi-layer perceptron structure that outputs the final traffic category label.

7. The method according to claim 6, wherein The processing steps of the syntax tree construction module include: Perform word segmentation on the input plaintext and ciphertext information to obtain a preliminary word sequence; Based on predefined context-free grammar rules, perform syntactic analysis on the word sequence and construct the corresponding syntax tree structure; Encode the syntax tree structure into a structured representation.

8. The method according to claim 6 or 7, wherein: The input of the BERT model is composed of the concatenation of the syntax tree encoding representation and the original text vector representation, and the fused contextual semantic features are extracted through a multi-layer Transformer encoder.

9. The method according to claim 6, wherein The classifier consists of at least two fully connected layers. The first layer receives the fusion vector output by BERT and performs nonlinear transformation. The second layer outputs the final traffic category prediction result.

10. A two-stage encrypted traffic classification system based on plaintext-ciphertext balance, used to execute the method according to any one of claims 1 to 9, characterized in that: include: Data packet extraction module, used to extract the plaintext information and ciphertext information of traffic data packets; The preliminary classification model is used to make preliminary classification predictions on data packets, predict whether the plaintext is classifiable, and obtain a data set with classifiability labels; A balanced filter that predicts whether the plaintext information of a packet is classifiable after training on a dataset with classifiability labels; The plaintext classification model is used to classify categorizable plaintext information and output the corresponding traffic category label; The ciphertext classification model is used to classify unclassifiable plaintext information based on the plaintext and ciphertext information of the data packet and output the corresponding traffic category label; The model training module is used to train the balanced filter, plaintext classification model, and ciphertext conversion model.

Images