Traffic identification method and device and electronic equipment

Abstract

The invention discloses a traffic identification method, a traffic identification device and electronic equipment. The method comprises the following steps: acquiring encrypted traffic data in a network; packet-level feature extraction and flow-level feature extraction are carried out on the encrypted traffic data, packet-level features and flow-level features corresponding to the encrypted traffic data are obtained, and the packet-level features are used for representing attribute features of a single data packet in the encrypted traffic data; the flow level feature is used for representing the feature of the whole data flow corresponding to the encrypted flow data; fusing the packet level feature and the flow level feature to obtain a fusion feature corresponding to the encrypted flow data; and carrying out classification identification on the fusion features to obtain a classification result of the encrypted traffic data. According to the method and the device, the technical problem that the identification accuracy of the encrypted traffic application is relatively low due to the fact that the encrypted traffic content is invisible and deep information in traffic data is difficult to fully mine by a single feature extraction method in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a traffic identification method, device, and electronic device. Background Art

[0002] With the rapid development of information technology, the internet has become deeply integrated into people's daily lives and the operations of various industries, becoming an indispensable infrastructure for modern society. However, with the widespread use of the internet, cybersecurity threats are becoming increasingly complex and diverse. The frequency and methods of cyberattacks are constantly evolving, posing a serious threat to personal privacy, corporate data, and national security.

[0003] In this complex cybersecurity landscape, the widespread use of encryption technology has become a crucial safeguard. By encoding data, encryption prevents unauthorized access and theft, thereby safeguarding user privacy. Furthermore, encryption technology uses data integrity verification mechanisms to prevent data tampering during transmission, ensuring its authenticity and integrity. With growing awareness of personal privacy and the increasing demand for data protection across various industries, an increasing number of applications and services are adopting various encryption protocols, such as HTTPS, VPNs, and encrypted email. This not only improves data security but also compels enterprises to adopt encryption technology to meet regulatory compliance requirements.

[0004] However, the widespread use of encryption technology has also brought new challenges to network security, particularly in the detection and analysis of encrypted traffic. For example, data content-based detection methods are ineffective when dealing with encrypted traffic and cannot effectively identify specific applications and services. For another example, because the content of encrypted traffic is encrypted during transmission, third parties cannot directly read the data content, rendering traffic analysis methods based on plaintext content ineffective in encrypted environments and making effective traffic classification and threat detection difficult. Furthermore, the diversity and complexity of encryption protocols, such as emerging protocols like TLS1.3 and QUIC, have dramatically increased the difficulty of identifying specific applications and services. The high degree of similarity in encrypted traffic characteristics across different applications, as well as the differences in the characteristics of encrypted and non-encrypted traffic, place higher demands on traffic analysis technology.

[0005] To address the challenge of identifying encrypted traffic, researchers have turned to methods based on the statistical characteristics and behavioral patterns of network traffic. These methods attempt to indirectly identify the applications and services behind encrypted traffic by analyzing packet-level features such as packet length distribution, time interval, direction, and protocol type, as well as flow-level features such as traffic duration, overall size, and statistical properties of byte sequences. While analysis methods based on traffic characteristics have somewhat compensated for the shortcomings of content analysis, they still face challenges such as limited feature representation capabilities, poor model generalization, and insufficient adaptability to new encryption protocols.

[0006] To more effectively identify and classify encrypted traffic, academia and industry have recently begun exploring solutions that incorporate deep learning technology. Deep learning models, particularly convolutional neural networks, recurrent neural networks, and long-short-term memory networks, have become crucial tools for encrypted traffic analysis due to their powerful feature learning and pattern recognition capabilities. These models can automatically learn and extract complex features from encrypted traffic without manual design, thereby improving identification accuracy and robustness.

[0007] However, in the context of the aforementioned deep learning models, the encrypted traffic identification methods in related technologies still have many shortcomings when faced with increasingly complex and changing network environments. For example, methods based on traffic feature analysis still rely on manually designed features, making it difficult to fully tap into the deep-level information in traffic data. Although machine learning-based methods have improved feature extraction capabilities to a certain extent, they still rely on large amounts of labeled data and complex feature engineering, limiting their application in large-scale and dynamic network environments. Therefore, although deep learning models perform well in terms of accuracy, their high computational complexity and resource consumption limit their application in real-time detection scenarios. There is a contradiction between achieving efficient real-time detection and high accuracy, making it difficult to achieve both. At the same time, in terms of feature fusion, the integration of multi-granularity features at the packet level and flow level has not fully utilized the complementary advantages of features of different granularities, resulting in limited comprehensive feature representation capabilities and affecting the overall detection effect.

[0008] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0009] The embodiments of the present application provide a traffic identification method, device, and electronic device to at least solve the technical problem that the encrypted traffic content is invisible and the single feature extraction method in the related technology is difficult to fully mine the deep information in the traffic data, resulting in low accuracy in identifying encrypted traffic applications.

[0010] According to one aspect of an embodiment of the present application, a traffic identification method is provided, including: obtaining encrypted traffic data in a network; performing packet-level feature extraction and flow-level feature extraction on the encrypted traffic data respectively, to obtain packet-level features and flow-level features corresponding to the encrypted traffic data, wherein the packet-level features are used to represent the attribute features of a single data packet in the encrypted traffic data, and the flow-level features are used to represent the features of the entire data stream corresponding to the encrypted traffic data; fusing the packet-level features and the flow-level features to obtain fused features corresponding to the encrypted traffic data; classifying and identifying the fused features to obtain a classification result of the encrypted traffic data, wherein the classification result is used to reflect the application category corresponding to the encrypted traffic data.

[0011] Optionally, before performing packet-level feature extraction on the encrypted traffic data, the method also includes: determining the five-tuple information corresponding to each data packet in the encrypted traffic data, wherein the five-tuple information includes the source IP, destination IP, source port, destination port and protocol type of each data packet; and dividing the encrypted traffic data into multiple network flows based on the five-tuple information and a preset time interval.

[0012] Optionally, the packet-level features include at least: packet length distribution, packet time interval and encryption protocol type of the encrypted traffic data, wherein the packet length distribution is used to represent the statistical distribution of data packets of different sizes in the encrypted traffic data, the packet time interval is used to represent the time interval between consecutive data packets in the encrypted traffic data, and the encryption protocol type is used to represent the protocol type used for the encrypted traffic data.

[0013] Optionally, after obtaining the packet-level features corresponding to the encrypted traffic data, the method further includes: performing numerical processing on the packet-level features to obtain a numerical vector corresponding to the packet-level features; processing the numerical vector through multiple consecutive hidden layers in a multi-layer perceptron to obtain a first eigenvector, wherein each hidden layer includes multiple neurons, and the multiple neurons use a first activation function to perform a nonlinear transformation on the numerical vector, and the first eigenvector is used to reflect the complex relationship and combination pattern of the packet-level features; processing the first eigenvector through the output layer in the multi-layer perceptron to obtain a second eigenvector, wherein the output layer uses a second activation function to convert the first eigenvector into a probability distribution, and the second eigenvector is used to reflect the potential application category corresponding to the encrypted traffic data.

[0014] Optionally, before performing flow-level feature extraction on the encrypted traffic data, the method also includes: determining the original byte sequence of the encrypted traffic data, wherein the original byte sequence is used to represent the complete data content of the encrypted traffic data; determining the byte length of the original byte sequence, and converting the original byte sequence into a three-dimensional grayscale image when the byte length meets the preset byte length; when the byte length does not meet the preset byte length, padding the original byte sequence with a preset value to obtain a target byte sequence, and converting the target byte sequence into a three-dimensional grayscale image.

[0015] Optionally, flow-level feature extraction is performed on the encrypted traffic data, including: performing a convolution operation on the three-dimensional grayscale image through multiple convolution layers in a convolutional neural network to obtain a feature map corresponding to the flow-level features; processing the feature map through an average pooling layer in the convolutional neural network to obtain a third feature vector, wherein the third feature vector is used to reflect the temporal characteristics and statistical patterns of the flow-level features.

[0016] Optionally, the packet-level features and the flow-level features are fused to obtain fused features corresponding to the encrypted traffic data, including: determining a third activation function for fusing the packet-level features and the flow-level features; determining a first weight corresponding to the second feature vector, and determining a second weight corresponding to the third feature vector; determining the fused features based on the third activation function, the first weight, the second weight, the second feature vector and the third feature vector.

[0017] According to another aspect of an embodiment of the present application, a traffic identification device is also provided, including: an acquisition module for acquiring encrypted traffic data in a network; an extraction module for performing packet-level feature extraction and flow-level feature extraction on the encrypted traffic data, respectively, to obtain packet-level features and flow-level features corresponding to the encrypted traffic data, wherein the packet-level features are used to represent the attribute features of a single data packet in the encrypted traffic data, and the flow-level features are used to represent the features of the entire data stream corresponding to the encrypted traffic data; a fusion module for fusing packet-level features and flow-level features to obtain fused features corresponding to the encrypted traffic data; an identification module for classifying and identifying the fused features to obtain a classification result of the encrypted traffic data, wherein the classification result is used to reflect the application category corresponding to the encrypted traffic data.

[0018] According to another aspect of the embodiments of the present application, an electronic device is provided, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned traffic identification method.

[0019] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned traffic identification method by running the computer program.

[0020] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned traffic identification method when executed by a processor.

[0021] In an embodiment of the present application, encrypted traffic data in the network is obtained; packet-level feature extraction and flow-level feature extraction are performed on the encrypted traffic data respectively to obtain packet-level features and flow-level features corresponding to the encrypted traffic data, wherein the packet-level features are used to represent the attribute features of a single data packet in the encrypted traffic data; the flow-level features are used to represent the features of the entire data stream corresponding to the encrypted traffic data; the packet-level features and the flow-level features are fused to obtain fused features corresponding to the encrypted traffic data; the fused features are classified and identified to obtain classification results of the encrypted traffic data, wherein the classification results are used to reflect the application categories corresponding to the encrypted traffic data, thereby achieving the purpose of accurately identifying application categories in encrypted network traffic, thereby achieving the technical effect of efficiently monitoring and managing network traffic while ensuring data security and improving the level of network security protection, thereby solving the technical problem of low accuracy in encrypted traffic application identification due to the fact that the encrypted traffic content is invisible and the single feature extraction method in the related technology is difficult to fully mine the deep information in the traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1 is a hardware structure diagram of a computer terminal for implementing a traffic identification method according to an embodiment of the present application;

[0024] Figure 2 is a flow chart of a traffic identification method according to an embodiment of the present application;

[0025] Figure 3 is a schematic diagram of a flow identification process according to an embodiment of the present application;

[0026] Figure 4 This is a structural diagram of a flow identification device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] First, some nouns or terms that appear in the process of explaining the embodiments of this application are subject to the following explanations:

[0030] Encrypted traffic refers to data packets transmitted over a network, in which the data body is encoded using encryption technology to protect the confidentiality of the data and prevent unauthorized third-party monitoring or tampering during transmission. Encrypted traffic is commonly found in network communications using protocols such as HTTPS, SSL / TLS, and VPN.

[0031] Packet granularity characteristics: In network communications, data is sent in packets. Packet granularity characteristics refer to the properties and statistical information of individual packets, such as packet size, time interval, direction (i.e., whether the packet is sent or received), and protocol type. These characteristics can be used to analyze the behavioral patterns of packets in network communications.

[0032] Flow granularity features: Flow granularity features refer to the characteristics of a group of data packets, or network flows. Unlike packet granularity, flow granularity features focus more on the behavior of the entire data flow, such as the duration, overall size, statistical characteristics of byte sequences, and communication frequency. Flow granularity features can provide more macroscopic information about network communication behavior.

[0033] Multi-Layer Perceptron (MLP): A feedforward neural network consisting of an input layer, one or more hidden layers, and an output layer. MLPs can be used to process data with nonlinear relationships, learning and optimizing through forward and backpropagation algorithms. In this application, MLPs are used to process packet-level statistical features.

[0034] 3D-CNN (3D Convolutional Neural Network): A deep learning model used to process data with three-dimensional structure, such as video frame sequences or 3D images. In encrypted traffic recognition, 3D CNN is used to process network flows converted into 3D grayscale images to extract spatiotemporal dependencies in flow-level features.

[0035] Softmax Classifier: A commonly used multi-classification model, the Softmax classifier typically serves as the output layer of a neural network. It converts the neural network's output into a probability distribution, which is used to predict the probability that the input data belongs to each category. In encrypted traffic identification, the Softmax classifier is used to ultimately determine the application or service category to which the network flow corresponds.

[0036] One-hot encoding: A method for converting categorical variables into numeric vectors, commonly used for processing categorical data. In one-hot encoding, each categorical variable is converted into a binary vector with only one element set to 1 and all other elements set to 0. The position of the 1 element indicates the specific category.

[0037] In order to solve the problem of low accuracy in identifying encrypted traffic in related technologies, the present invention provides a traffic identification method that can be run on Figure 1 Among the computer terminals shown, the computer terminal will be described below.

[0038] The traffic identification method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG1 shows a hardware structure block diagram of a computer terminal for implementing a flow identification method. Figure 1As shown, the computer terminal 10 may include one or more (illustrated by 102a, 102b, ..., 102n in the figure) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0039] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry." The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuitry may be a single, independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0040] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the traffic identification method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned traffic identification method. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0041] The transmission module 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission module 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission module 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0042] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0043] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0044] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a traffic identification method. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0045] Figure 2 is a flow chart of a traffic identification method according to an embodiment of the present application. Figure 2 As shown, the method includes the following steps:

[0046] Step S202: Obtain encrypted traffic data in the network.

[0047] In step S202, encrypted traffic data on the network can be captured in real time using network monitoring tools or data capture technology. This typically involves deploying sniffers at key network nodes or using network analysis software, such as Wireshark or TCPdump, to capture encrypted data packets passing through the network. The encrypted traffic data may be communications based on protocols such as HTTPS, SSL / TLS, and VPN, where the payload of these packets is encrypted during transmission over the network.

[0048] Step S204, performing packet-level feature extraction and stream-level feature extraction on the encrypted traffic data respectively, to obtain packet-level features and stream-level features corresponding to the encrypted traffic data, wherein the packet-level features are used to represent the attribute features of a single data packet in the encrypted traffic data, and the stream-level features are used to represent the features of the entire data stream corresponding to the encrypted traffic data.

[0049] In the above step S204, it is necessary to perform multi-level analysis on the captured encrypted traffic data, such as extracting features from both the packet level and the flow level to construct a comprehensive traffic description. Among them, packet-level feature extraction focuses on parsing and analyzing the characteristics of individual data packets, such as the size distribution of data packets, the arrival time interval between packets, packet header details, transmission direction, and the type of encryption protocol used. These features provide in-depth insights into the basic properties of data packets and help understand the underlying behavior of traffic. Flow-level feature extraction focuses on capturing the macro behavior of the entire data flow, including the duration of the data flow, the total number of transmitted bytes, the sequence pattern of data packets, and the packet rate. By converting the flow data into grayscale images, the timing and distribution information of the traffic is retained, providing an intuitive visual representation for subsequent deep learning processing.

[0050] The key to this step lies in the combined use of packet-level and flow-level information, overcoming the limitations of single-granularity features. Through sophisticated feature engineering, the system is able to extract information from encrypted traffic that is crucial for application identification. Packet-level features reflect the individual properties of encrypted packets, while flow-level features provide a perspective on the overall behavior of traffic. The combination of these two enables the system to more accurately understand the characteristics of encrypted traffic, laying a solid foundation for subsequent feature fusion and classification and identification.

[0051] Step S206: Fusing the packet-level features and the flow-level features to obtain fused features corresponding to the encrypted traffic data.

[0052] In the above step S206, an adaptive weight mechanism can be used to combine the multi-granularity features at the packet level and the flow level to form a powerful fused feature representation, providing richer information for subsequent classification and identification. Among them, the adaptive weight mechanism can dynamically adjust the weights of packet-level features and flow-level features based on the feature importance learned by the deep learning model during the training process. This approach ensures that the final fused feature not only contains the basic attribute description of the traffic, but also fully considers the overall behavior pattern of the traffic, making the feature representation closer to the actual state of the encrypted traffic, thereby significantly improving the accuracy of application classification.

[0053] Step S208 , classifying and identifying the fused features to obtain a classification result of the encrypted traffic data, wherein the classification result is used to reflect the application category corresponding to the encrypted traffic data.

[0054] In step S208, the fused feature vector is input into a classifier (e.g., a Softmax classifier) for application category identification. The Softmax classifier can calculate the probability distribution of different application categories based on the fused feature vector, thereby determining the application or service category behind the encrypted traffic.

[0055] Through steps S202 to S208, the goal of accurately identifying application categories in encrypted network traffic is achieved, thereby achieving the technical effect of efficiently monitoring and managing network traffic while ensuring data security, thereby improving network security protection levels. This further solves the technical problem of low accuracy in encrypted traffic application identification due to the lack of visibility of encrypted traffic content and the difficulty of single feature extraction methods in related technologies in fully exploring the deep information in traffic data. Detailed explanation is provided below.

[0056] In the above step S202, after obtaining the encrypted traffic data in the network, it also includes: determining the five-tuple information corresponding to each data packet in the encrypted traffic data, wherein the five-tuple information includes the source IP, destination IP, source port, destination port and protocol type of each data packet; dividing the encrypted traffic data into multiple network flows according to the five-tuple information and the preset time interval.

[0057] In an embodiment of the present application, the acquired original encrypted traffic data will be divided into independent network flows, providing ordered input units for subsequent feature extraction and classification recognition.

[0058] Specifically, the system can divide network flows based on the five-tuple information of the data packet and the preset time interval Δt (such as 60 seconds). Among them, the five-tuple information is the basic identifier of the network flow, which is composed of the source IP address, destination IP address, source port number, destination port number and protocol type (such as TCP, UDP, etc.). If two consecutive data packets have the same five-tuple information and the time interval is less than the set threshold Δt, then the two data packets are considered to be part of the same network flow. This division method ensures the continuity and time correlation of the network flow, and helps to maintain the context information of the data packet in subsequent processing, which is crucial for analyzing the connection status and behavior patterns of encrypted traffic. The specific traffic segmentation formula is as follows:

[0059]

[0060] Where, F i represents the i-th network flow, P i represents the i-th data packet, represents the timestamp of the kth data packet, represents the timestamp of the k+1th data packet, and Δt represents the preset time interval.

[0061] By combining quintuple information and time intervals, the system effectively segments captured encrypted traffic data into independent network flows, each representing a complete communication session. This process not only rationally organizes the data but also provides clear processing targets for subsequent packet-level and flow-level feature extraction, ensuring accurate feature extraction and feasible classification and recognition. The segmented network flows are more compatible with the input requirements of deep learning models, improving both training efficiency and recognition accuracy.

[0062] In the above step S204, the packet-level features include at least: packet length distribution, packet time interval and encryption protocol type of the encrypted traffic data, wherein the packet length distribution is used to represent the statistical distribution of data packets of different sizes in the encrypted traffic data, the packet time interval is used to represent the time interval between consecutive data packets in the encrypted traffic data, and the encryption protocol type is used to represent the protocol type used for the encrypted traffic data.

[0063] In the packet-level feature extraction phase of this application, detailed feature analysis is required for each segmented network flow to extract key features, including packet length distribution, packet interval time, and protocol type encoding. The extraction of these features helps to construct a multi-dimensional description that can reflect the characteristics of application services and is the basis for identifying encrypted traffic applications. The specific feature extraction analysis is as follows:

[0064] (1) Packet length distribution: Calculate the mean, variance, and entropy of the packet lengths of the first m packets.

[0065] Packet length is a key attribute of data packets. Different applications often produce packet length sequences with varying distribution patterns. The mean of the packet length distribution reflects the average size of a packet, the variance indicates the degree of fluctuation in packet length, and the entropy measures the randomness or uncertainty of the packet length distribution. These statistical metrics can capture typical patterns in packet length in encrypted traffic, providing rich information for subsequent packet-level feature analysis.

[0066] (2) Packet Interval: Calculate the mean and standard deviation of the packet arrival time.

[0067] Packet intervals are a temporal characteristic of traffic behavior that can reveal an application's transmission patterns and real-time requirements. For example, live video streaming may exhibit a relatively uniform, short-interval packet sequence, while web browsing may include long periods of silence and short periods of activity. By analyzing the mean and standard deviation of packet intervals, the system can identify temporal behavior characteristics in encrypted traffic, providing a temporal basis for application classification.

[0068] (3) Encryption protocol type: One-hot encoding is used to convert different protocol types into feature vectors. For example, TLS1.3 is encoded as [1, 0, 0], QUIC is encoded as [0, 1, 0], and other protocol types are encoded as [0, 0, 1].

[0069] Protocol type encoding is key information for identifying encrypted traffic applications. Different applications tend to use specific protocols for communication. Through one-hot encoding, the system can convert protocol type information into a format that is easily processed by machine learning models, facilitating subsequent feature fusion and classification.

[0070] Furthermore, after obtaining the packet-level features corresponding to the encrypted traffic data, it also includes: numerically processing the packet-level features to obtain a numerical vector corresponding to the packet-level features; processing the numerical vector through multiple continuous hidden layers in a multi-layer perceptron to obtain a first eigenvector, wherein each hidden layer includes multiple neurons, and the multiple neurons use a first activation function to perform a nonlinear transformation on the numerical vector, and the first eigenvector is used to reflect the complex relationship and combination pattern of the packet-level features; processing the first eigenvector through the output layer in the multi-layer perceptron to obtain a second eigenvector, wherein the output layer uses a second activation function to convert the first eigenvector into a probability distribution, and the second eigenvector is used to reflect the potential application category corresponding to the encrypted traffic data.

[0071] In the embodiments of the present application, by converting packet-level features into numerical vectors that can be understood and learned by the deep learning model, and by using a multi-layer neural network structure of a multi-layer perceptron (MLP), not only the depth of feature representation is improved, but also the accuracy and robustness of encrypted traffic application recognition are improved. The specific process can be as follows:

[0072] First, after extracting statistical features such as packet length distribution, packet interval time, and protocol type code, these features are digitized and converted into numerical vectors. Numerical processing involves converting features into digital form for easier computer processing and input into deep learning models. For example, the mean, variance, and entropy of packet length distribution, the mean and standard deviation of packet interval time, and the vector value of the protocol type code are all integrated into a numerical vector containing all packet-level features. This digitization ensures the structure of the feature data, enabling deep learning models to effectively read and analyze it.

[0073] Secondly, the numerical vector is input into multiple consecutive hidden layers in a multilayer perceptron. The consecutive hidden layers of the multilayer perceptron can gradually build high-order representations of features, converting simple statistical features into more abstract and relevant feature representations. The hidden layers in the multilayer perceptron are composed of multiple neurons, which use a first activation function (such as ReLU, tanh, or sigmoid function) to perform a nonlinear transformation on the numerical vector, thereby capturing the complex relationships and combination patterns between packet-level features and obtaining the first feature vector.

[0074] The first eigenvector is then processed by the output layer of the multilayer perceptron. This layer uses a second activation function (such as Softmax) to convert the eigenvector into a probability distribution, forming a second eigenvector. This second eigenvector contains the probabilistic information about the potential application categories corresponding to the encrypted traffic data, assigning a probability value to each possible application category. This probability distribution not only reflects the model's assessment of the likelihood of different application categories but also provides a basis for decision-making in the final application identification.

[0075] In the embodiments of this application, the original statistical features at the packet level are gradually abstracted into complex feature representations that can reflect the characteristics of the application through digitization, hidden layer processing, and output layer conversion. Ultimately, the probability distribution output by the multi-layer perceptron is used to accurately identify encrypted traffic applications, demonstrating the powerful capabilities of deep learning models in feature extraction and classification recognition. The specific expression can be as follows:

[0076] h packet =ReLU(W1x packet +b1)

[0077] Where h packet represents the eigenvector after MLP transformation, that is, the second eigenvector mentioned above; x packet represents the feature vector of the input MLP, that is, the above numerical vector; W1 represents the weight matrix of MLP; b1 represents the bias term of MLP.

[0078] In the above step S204, before performing flow-level feature extraction on the encrypted traffic data, the method further includes: determining the original byte sequence of the encrypted traffic data, wherein the original byte sequence is used to represent the complete data content of the encrypted traffic data; determining the byte length of the original byte sequence, and converting the original byte sequence into a three-dimensional grayscale image when the byte length meets a preset byte length; and padding the original byte sequence with a preset value to obtain a target byte sequence when the byte length does not meet the preset byte length, and converting the target byte sequence into a three-dimensional grayscale image.

[0079] In the embodiment of the present application, before performing flow-level feature extraction on encrypted traffic data, it is first necessary to determine the original byte sequence of each network flow and process it according to the preset byte length requirements to ensure that the data can be input into the deep learning model for analysis in a unified format. The specific process can be as follows:

[0080] First, the complete data content of the segmented network flow is obtained to form a raw byte sequence. Each packet in transit is composed of a series of bytes, and the raw byte sequence is the collection of bytes from all packets in the network flow. This sequence contains the entire data content of the encrypted traffic and serves as the raw data foundation for stream-level feature extraction.

[0081] Secondly, the total length of the original byte sequence is determined. If the length of the original byte sequence meets the preset byte length requirement (for example, the byte length preset to generate a 32×32×1 three-dimensional grayscale image), the conversion can be performed directly.

[0082] Specifically, when the byte length of the original byte sequence meets the preset byte length requirement, the original byte sequence is converted into a three-dimensional grayscale image. This process involves mapping the byte data to the pixel values of the image. Each byte may correspond to a pixel in the image, and the grayscale value of the pixel is determined by the byte value. Through this conversion, the system aims to reorganize the one-dimensional byte sequence into a three-dimensional image with spatial structure, preserving the temporal and spatial characteristics of the traffic data, facilitating the subsequent spatiotemporal feature extraction of the 3D CNN.

[0083] When the byte length of the original byte sequence does not meet the preset byte length requirement, it is necessary to fill the original sequence with a preset padding value (such as 0 or other specific value) until the preset length is reached. The padded sequence is called the target byte sequence and is also converted into a three-dimensional grayscale image. This padding and conversion step ensures the consistency of the feature representation of all network flows in size, facilitating unified processing by deep learning models while also avoiding processing difficulties caused by varying data lengths.

[0084] Furthermore, flow-level feature extraction is performed on the encrypted traffic data, including: performing a convolution operation on the three-dimensional grayscale image through multiple convolutional layers in a convolutional neural network to obtain a feature map corresponding to the flow-level features; processing the feature map through the average pooling layer in the convolutional neural network to obtain a third feature vector, wherein the third feature vector is used to reflect the temporal characteristics and statistical patterns of the flow-level features.

[0085] In the embodiment of the present application, flow-level feature extraction is achieved through a 3D convolutional neural network (CNN), which aims to capture the complex temporal and spatial features of encrypted traffic data converted into a three-dimensional grayscale image. This process involves feature extraction from multiple convolutional layers and feature integration by an average pooling layer, ultimately generating a third feature vector reflecting the flow-level features. The specific process can be as follows:

[0086] First, the 3D grayscale image is convolved through multiple convolutional layers in a convolutional neural network.

[0087] The first convolutional layer uses a 3×3×3 convolution kernel, 64 output channels, a stride of 1, and a ReLU activation function. This layer aims to capture and amplify basic local features in the image, such as the distribution of packet lengths and preliminary patterns in time intervals. The ReLU activation function helps the model learn nonlinear features and enhances their expressiveness.

[0088] The second convolutional layer also uses a 3×3×3 convolution kernel, but the output channels are increased to 128, with a stride of 2. This layer further extracts higher-level features through a larger stride and more output channels, and performs dimensionality reduction on the feature maps to reduce the demand for computing resources and improve the robustness of the model.

[0089] The third convolutional layer uses the same convolution kernel size and stride settings, and the number of output channels is further increased to 256. This layer further refines the feature representation, captures the complex temporal and spatial patterns in encrypted traffic, and provides richer and more detailed feature descriptions for subsequent feature integration and classification.

[0090] Secondly, after multiple layers of convolution operations, the original 3D grayscale image is converted into a series of feature maps, each of which represents a different level of feature representation. These feature maps contain the complex temporal and spatial patterns of encrypted traffic data and are key to subsequent feature integration and classification.

[0091] Finally, the feature map is processed through an average pooling layer in a convolutional neural network to generate a third eigenvector. This generated third eigenvector condenses the temporal and spatial features extracted from the three-dimensional grayscale image. It contains information about the dynamic behavior of encrypted traffic, such as packet transmission frequency, packet size trends, and protocol-specific timing patterns. This process not only reduces the feature dimensionality and computational complexity of the model, but also preserves key information in the feature map.

[0092] In the above step S206, the packet-level features and the flow-level features are fused to obtain fused features corresponding to the encrypted traffic data, including: determining a third activation function for fusing the packet-level features and the flow-level features; determining a first weight corresponding to the second feature vector, and determining a second weight corresponding to the third feature vector; and determining the fused features based on the third activation function, the first weight, the second weight, the second feature vector and the third feature vector.

[0093] In the embodiments of this application, an adaptive weighting mechanism and Sigmoid activation function are used to achieve intelligent integration of packet-level and flow-level features. The fused feature vector combines the static and dynamic characteristics of encrypted traffic, providing a more comprehensive and accurate feature description for subsequent classification and identification, effectively improving the accuracy and flexibility of encrypted traffic application identification. The specific expression is as follows:

[0094]

[0095] h fusion =α·h packet +β·h flow

[0096] Where h fusion represents fusion features; h packet represents the packet-level feature vector, i.e., the second feature vector mentioned above; h flow represents the flow-level eigenvector, i.e., the third eigenvector mentioned above; α represents the first weight; β represents the second weight; σ is the Sigmoid function; and b α are learnable parameters.

[0097] In step S208, the fused feature vector is input into a classifier (such as a Softmax classifier) to identify the application category. The Softmax classifier can map the fused feature to a set of probability values, each of which corresponds to a possible application category. The probability represents the likelihood that the given traffic data belongs to that category. The specific expression is as follows:

[0098]

[0099] Where, P(y=c|h fusion ) represents the given fusion feature h fusion When , the probability of category y being c; exp represents the indicator function; represents the weight vector of the cth class; b c represents the bias term of class c; represents the weight vector of the c′th class; b c′represents the bias term of the c′th class; C represents the total number of application categories; L represents the cross entropy loss function; N represents the total number of samples; represents the probability that the i-th sample belongs to category c.

[0100] Figure 3 This is a schematic diagram of a flow identification process according to an embodiment of the present application. Figure 3 As shown, the system first collects encrypted traffic data from the network in real time and segments it into independent network flows based on five-tuple information (source IP, destination IP, source port, destination port, and protocol type). Subsequently, packet-level feature extraction is performed on each network flow, including calculation of packet length distribution and packet interval time, and feature conversion is performed using a multi-layer perceptron. Furthermore, the network flow is innovatively converted into grayscale images to facilitate efficient extraction of flow-level temporal and spatial features using a 3D convolutional neural network (3D-CNN). Next, an adaptive weighting mechanism is used to fuse packet-level and flow-level features to generate a comprehensive multi-granularity feature representation. Finally, the fused feature vector is input into a softmax classifier to determine the application category corresponding to the encrypted traffic data and accurately identify the encrypted traffic. The entire process embodies a complete technical chain from data collection, feature extraction, feature fusion, to classification and recognition, highlighting the comprehensiveness, intelligence, and high accuracy of the method.

[0101] In the embodiments of this application, a 3D convolutional neural network is used to efficiently extract temporal and spatial features at the flow level, while a multi-layer perceptron is used to mine statistical features at the packet level. This is combined with an adaptive weight fusion mechanism to dynamically adjust the importance of the two features, thereby achieving accurate classification of encrypted traffic. This approach overcomes the limitations of single feature extraction, effectively integrating packet-level and flow-level information, and improving the robustness and generalization capabilities of recognition. This approach, especially when faced with new encryption protocols and complex network environments, can provide more accurate and real-time application identification services, significantly improving the effectiveness of network security monitoring and traffic management.

[0102] According to an embodiment of the present application, a flow identification device is provided. It should be noted that the flow identification device of the embodiment of the present application can be used to execute the flow identification method provided in the embodiment of the present application. The flow identification device provided in the embodiment of the present application is introduced below.

[0103] Figure 4 This is a structural diagram of a flow identification device provided according to an embodiment of the present application. Figure 4 As shown, the device includes:

[0104] An acquisition module 40 is used to acquire encrypted traffic data in the network;

[0105] An extraction module 42 is configured to perform packet-level feature extraction and stream-level feature extraction on the encrypted traffic data, respectively, to obtain packet-level features and stream-level features corresponding to the encrypted traffic data, wherein the packet-level features are used to represent attribute features of a single data packet in the encrypted traffic data, and the stream-level features are used to represent features of the entire data stream corresponding to the encrypted traffic data;

[0106] A fusion module 44 is used to fuse the packet-level features and the flow-level features to obtain fused features corresponding to the encrypted traffic data;

[0107] The identification module 46 is used to classify and identify the fused features to obtain a classification result of the encrypted traffic data, wherein the classification result is used to reflect the application category corresponding to the encrypted traffic data.

[0108] Through the acquisition module, extraction module, fusion module and identification module in the above-mentioned traffic identification device, the purpose of accurately identifying the application categories in encrypted network traffic is achieved, thereby achieving the technical effect of efficiently monitoring and managing network traffic while ensuring data security and improving the level of network security protection. It also solves the technical problem of low accuracy in encrypted traffic application identification due to the invisible content of encrypted traffic and the difficulty of single feature extraction methods in related technologies to fully explore the deep information in traffic data.

[0109] In the traffic identification device provided in an embodiment of the present application, the extraction module is also used to determine the five-tuple information corresponding to each data packet in the encrypted traffic data, wherein the five-tuple information includes the source IP, destination IP, source port, destination port and protocol type of each data packet; and the encrypted traffic data is divided into multiple network flows based on the five-tuple information and a preset time interval.

[0110] In the traffic identification device provided in the embodiment of the present application, the extraction module is also used to perform numerical processing on the packet-level features to obtain a numerical vector corresponding to the packet-level features; the numerical vector is processed by multiple continuous hidden layers in a multi-layer perceptron to obtain a first eigenvector, wherein each hidden layer includes multiple neurons, and the multiple neurons use a first activation function to perform a nonlinear transformation on the numerical vector, and the first eigenvector is used to reflect the complex relationship and combination pattern of the packet-level features; the first eigenvector is processed by the output layer in the multi-layer perceptron to obtain a second eigenvector, wherein the output layer uses a second activation function to convert the first eigenvector into a probability distribution, and the second eigenvector is used to reflect the potential application category corresponding to the encrypted traffic data.

[0111] In the traffic identification device provided in the embodiment of the present application, the extraction module is also used to determine the original byte sequence of the encrypted traffic data, wherein the original byte sequence is used to represent the complete data content of the encrypted traffic data; determine the byte length of the original byte sequence, and when the byte length meets the preset byte length, convert the original byte sequence into a three-dimensional grayscale image; when the byte length does not meet the preset byte length, fill the original byte sequence with a preset value to obtain a target byte sequence, and convert the target byte sequence into a three-dimensional grayscale image.

[0112] In the flow identification device provided in an embodiment of the present application, the extraction module is also used to perform a convolution operation on the three-dimensional grayscale image through multiple convolution layers in a convolutional neural network to obtain a feature map corresponding to the flow level feature; the feature map is processed through the average pooling layer in the convolutional neural network to obtain a third feature vector, wherein the third feature vector is used to reflect the temporal characteristics and statistical patterns of the flow level feature.

[0113] In the traffic identification device provided in the embodiment of the present application, the fusion module is also used to determine a third activation function for fusing packet-level features and flow-level features; determine a first weight corresponding to the second eigenvector, and determine a second weight corresponding to the third eigenvector; and determine the fusion feature based on the third activation function, the first weight, the second weight, the second eigenvector and the third eigenvector.

[0114] An embodiment of the present application also provides an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned traffic identification method.

[0115] It should be noted that the above electronic equipment is used to perform Figure 2 The traffic identification method shown, therefore the relevant explanations in the above traffic identification method are also applicable to the electronic device and will not be repeated here.

[0116] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned traffic identification method by running the computer program.

[0117] It should be noted that the above non-volatile storage medium is used to execute Figure 2 The traffic identification method shown, therefore the relevant explanations in the above traffic identification method are also applicable to the non-volatile storage medium and will not be repeated here.

[0118] An embodiment of the present application also provides a computer program product, including computer instructions, which implement the above-mentioned traffic identification method when executed by a processor.

[0119] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The traffic identification method shown, therefore the relevant explanations in the above traffic identification method are also applicable to the computer program product and will not be repeated here.

[0120] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0121] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0122] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0123] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0124] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0125] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0126] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A flow identification method, characterized in that: include: Obtain encrypted traffic data in the network; Performing packet-level feature extraction and stream-level feature extraction on the encrypted traffic data respectively to obtain packet-level features and stream-level features corresponding to the encrypted traffic data, wherein the packet-level features are used to represent attribute features of a single data packet in the encrypted traffic data, and the stream-level features are used to represent features of the entire data stream corresponding to the encrypted traffic data; fusing the packet-level features and the flow-level features to obtain a fused feature corresponding to the encrypted traffic data; The fusion feature is classified and identified to obtain a classification result of the encrypted traffic data, wherein the classification result is used to reflect the application category corresponding to the encrypted traffic data.

2. The method according to claim 1, characterized in that Before performing packet-level feature extraction on the encrypted traffic data, the method further includes: Determine the five-tuple information corresponding to each data packet in the encrypted traffic data, wherein the five-tuple information includes the source IP address, destination IP address, source port number, destination port number, and protocol type of each data packet; The encrypted traffic data is divided into a plurality of network flows according to the five-tuple information and a preset time interval.

3. The method according to claim 1, characterized in that The packet-level features include at least: the packet length distribution, packet time interval and encryption protocol type of the encrypted traffic data, wherein the packet length distribution is used to represent the statistical distribution of data packets of different sizes in the encrypted traffic data, the packet time interval is used to represent the time interval between consecutive data packets in the encrypted traffic data, and the encryption protocol type is used to represent the protocol type used by the encrypted traffic data.

4. The method according to claim 1, wherein After obtaining the packet-level features corresponding to the encrypted traffic data, the method further includes: Numerical processing is performed on the packet-level feature to obtain a numerical vector corresponding to the packet-level feature; Processing the numerical vector through multiple consecutive hidden layers in a multilayer perceptron to obtain a first eigenvector, wherein each hidden layer includes multiple neurons, and the multiple neurons use a first activation function to perform a nonlinear transformation on the numerical vector, and the first eigenvector is used to reflect the complex relationship and combination pattern of the packet-level features; The first eigenvector is processed by the output layer in the multilayer perceptron to obtain a second eigenvector, wherein the output layer uses a second activation function to convert the first eigenvector into a probability distribution, and the second eigenvector is used to reflect the potential application category corresponding to the encrypted traffic data.

5. The method according to claim 4, characterized in that Before performing flow-level feature extraction on the encrypted traffic data, the method further includes: Determining an original byte sequence of the encrypted traffic data, wherein the original byte sequence is used to represent the complete data content of the encrypted traffic data; determining a byte length of the original byte sequence, and converting the original byte sequence into a three-dimensional grayscale image if the byte length satisfies a preset byte length; In the case that the byte length does not meet the preset byte length, the original byte sequence is padded with a preset value to obtain a target byte sequence, and the target byte sequence is converted into a three-dimensional grayscale image.

6. The method according to claim 5, characterized in that Performing flow-level feature extraction on the encrypted traffic data includes: Performing a convolution operation on the three-dimensional grayscale image through multiple convolutional layers in a convolutional neural network to obtain a feature map corresponding to the flow-level feature; The feature map is processed by an average pooling layer in the convolutional neural network to obtain a third feature vector, wherein the third feature vector is used to reflect the temporal characteristics and statistical patterns of the flow-level features.

7. The method according to claim 6, characterized in that Fusion of the packet-level features and the flow-level features to obtain fused features corresponding to the encrypted traffic data includes: Determining a third activation function for fusing the packet-level features and the flow-level features; determining a first weight corresponding to the second eigenvector, and determining a second weight corresponding to the third eigenvector; The fusion feature is determined according to the third activation function, the first weight, the second weight, the second eigenvector, and the third eigenvector.

8. A flow identification device, characterized in that: include: An acquisition module is used to obtain encrypted traffic data in the network; an extraction module, configured to perform packet-level feature extraction and stream-level feature extraction on the encrypted traffic data, respectively, to obtain packet-level features and stream-level features corresponding to the encrypted traffic data, wherein the packet-level features are used to represent attribute features of a single data packet in the encrypted traffic data, and the stream-level features are used to represent features of the entire data stream corresponding to the encrypted traffic data; a fusion module, configured to fuse the packet-level features and the flow-level features to obtain a fusion feature corresponding to the encrypted traffic data; An identification module is used to classify and identify the fusion features to obtain a classification result of the encrypted traffic data, wherein the classification result is used to reflect the application category corresponding to the encrypted traffic data.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory and is used to execute the traffic identification method described in any one of claims 1 to 7.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the traffic identification method according to any one of claims 1 to 7 by running the computer program.

11. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the traffic identification method according to any one of claims 1 to 7 is implemented.

Images