Encrypted network traffic classification method based on scalable federated forgetting learning

Abstract

The present invention relates to the technical field of artificial intelligence, specifically to an encrypted network traffic classification method based on scalable federated forgetting learning. The method is particularly suitable for use in network management and network service quality assurance, ensuring classification accuracy while taking into account dynamically changing application scenarios. The method comprises: a client locally constructs a federated model containing feature extraction layer parameters and fully connected classifier layer parameters; a local dataset is locally trained on the model to obtain feature extraction parameters and fully connected layer parameters; when a client requests data deletion, an auxiliary forgetting module is enabled, and a distillation operation is performed between the learning module and the auxiliary forgetting module to generate a forgetting module; after training, a global model adaptable to different application scenarios is constructed in a modular manner. Through local model initialization, local data training, auxiliary forgetting module training, and module adaptive aggregation, the accuracy and adaptability of the model classification are greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to an encrypted network traffic classification method based on scalable federated forgetting learning. Background Art

[0002] In recent years, encrypted network traffic classification methods based on federated learning have become one of the most effective approaches for network management and data privacy protection. With the rapid development of artificial intelligence (AI) technology, the rights of data subjects are receiving increasing attention. The EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CPA) have introduced provisions granting federated learning participants the "right to be forgotten," granting them the right to request that companies or businesses delete their personal data and contributions. Because traditional traffic classification methods based on federated learning cannot ensure that participants can withdraw their data contributions, researchers have begun to focus on federated machine "forgetfulness." With the increasing demand for AI models to protect the "right to be forgotten," federated forgetting learning has emerged as a new paradigm for encrypted traffic classification.

[0003] However, existing federated forgetting learning techniques ignore the phenomenon of silent apps, which can cause two major problems: 1. Classifier instability: Google typically removes approximately 25,100 apps from its platform every quarter. These removed apps are called "silent apps." The presence of "silent apps" can cause network traffic classifiers to misclassify other app categories as silent apps, thereby reducing model stability; 2. Regulatory rules vary across regions, resulting in some clients (such as ) requires temporarily removing specific applications, while other clients still need to classify these applications and their associated traffic. When these applications regain regulatory compliance and are reinstated, the model must quickly restore its previous classification accuracy. However, traditional model aggregation methods lack scalability and are therefore unable to effectively cope with such dynamic changes. Therefore, a novel encrypted network traffic classification method based on scalable federated forgetting learning is urgently needed to address this issue. Summary of the Invention

[0004] The purpose of the present invention is to provide an encrypted network traffic classification method based on scalable federated forgetting learning to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] An encrypted network traffic classification method based on scalable federated forgetting learning, including:

[0007] S100. Each client locally builds a federated model containing the parameters of the feature extraction layer and the fully connected classifier layer, and initializes it.

[0008] S200: Obtain a local data set for each client for its application scenario, and perform local training on the model to obtain feature extraction parameters. and fully connected layer parameters ;

[0009] S300: When a client requests to delete data, the client is set as a forgetting client, and an auxiliary forgetting module is enabled. A distillation operation is performed between the learning module and the auxiliary forgetting module to generate a forgetting module.

[0010] S400: After the training is completed, the client uploads its model parameters to the server; all clients first upload their own feature extraction layer parameters The server aggregates the parameters into a global feature extraction layer; clients that do not request data deletion are set as non-forgotten clients. For the fully connected classifier layer, the forgetting modules of the forgetting clients are aggregated separately from the parameters of the non-forgotten clients. Finally, a modular approach is used to construct a global model that can adapt to different application scenarios.

[0011] Preferably, the federation model in S100 includes:

[0012] Assume that there are K clients participating in collaborative training to build a federated model ,in Used to extract network traffic characteristics, is a classifier;

[0013] According to the formula, the optimization goal of the training process is obtained:

[0014] ;

[0015] in, represents the loss function, A function representing the model, and represents the parameters of the model, Indicates the Client's The labels corresponding to the samples, 、 Respectively represent The client dataset size.

[0016] Preferably, the learning module in S300 includes:

[0017] In the learning modules of each client, a convolutional neural network is used to perform supervised learning NTC tasks and define a label space. , from the perspective of the global NTC model, the loss function is as follows:

[0018] ;

[0019] in, Indicates the total number of categories of the client. represents the loss function, Indicates the The client's data set is of size , Indicates the number of clients, Indicates the Client's samples, Indicates the Client's The labels corresponding to the samples, represents the function of the model, where and Represents the parameters of the model.

[0020] Preferably, the forgetting module in S300 includes:

[0021] S301. In the forgetting mechanism in federated learning, when the client When a request is made to delete its data, the system is optimized through a forget module and retrained on the deleted data;

[0022] Setting up the client Try to class The data is forgotten, then set Is the client The original dataset on Is the client The dataset that needs to forget categories: , Is the client On the remaining datasets: ;

[0023] Based on the dataset Modify tag generation , where the label domain of the active application is mapped to the new label domain, and the mapping relationship is: ;

[0024] in, is the domain, is the corresponding domain; , given The category to be deleted is a collection, , ,So ;

[0025] This gives the mapping function ; Get the latest tag index;

[0026] in, Indicates that in the original list Small number of removed elements;

[0027] Finally obtained ;

[0028] S302. Obtain the model trained by the learning module , according to the parameter freezing formula: , frozen model layer, so that during training The layer parameters are not updated and gradients are not calculated;

[0029] in, represents the loss function, Indicates frozen parameters;

[0030] Get the client Auxiliary forgetting module , its objective function is:

[0031] ;

[0032] in, Represents the client Auxiliary forgetting model for its data, the model is based on the dataset Optimize to meet client needs Request to be forgotten; represents the cross entropy loss, dataset Is the client Designed dataset to assist learning of forgetting models;

[0033] Then the model of the forgetting module is obtained according to the objective function , ;

[0034] Once fine-tuning is complete, follow the unfreezing formula: , the first half of the neuron's parameters will be unfrozen;

[0035] in, Indicates the degree of thawing parameters. =1, indicating complete thawing;

[0036] Finally, the labels are passed through the inverse mapping function , remapped back to the original domain, .

[0037] Preferably, the forgetting module needs to meet two requirements during the entire forgetting process:

[0038] a1. The forget operation cannot affect the remaining data Model accuracy:

[0039] Model of the forgetting module For the remaining data The logit output should be the same as the original model Stay consistent, that is: ;

[0040] in, Represents the original model No. logit values, represents the inverse mapping function, Represents the trained forgetting model Input The logit output is , represents the inverse mapping of the label function;

[0041] a2. How to deal with forgotten data after forgetting Exhibits incorrect classification behavior:

[0042] Forgetting Model The logit output should be consistent with the forgotten data There are differences in the original labels, namely:

[0043] ;

[0044] in, express The true label.

[0045] Preferably, S400 includes:

[0046] S401, set up shared clients, and divide them into two categories: non-forgotten client set and forget client collection , and satisfies ;

[0047] Get the feature extraction layer parameters of all clients , sum and average to get the global feature parameters : ;

[0048] Get the fully connected layer parameters of the non-forgetful client , sum and average, and we get : ;

[0049] Get the fully connected layer parameters of the forget client , sum and average, and we get :

[0050] ;

[0051] S402, the calculated global feature parameters Combined with the aggregation results of different fully connected layers, two global models are formed:

[0052] Global Model Aggregates the feature layer parameters of all clients and the fully connected layer parameters of non-forgotten clients: ;

[0053] Global Model Aggregate the feature layer parameters of all clients and forget the fully connected layer parameters of the client: .

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] The present invention enables the auxiliary forgetting module to selectively prune the neurons corresponding to silent applications in the classifier to minimize the negative impact of these applications on the stability of the overall model, thereby effectively enhancing the robustness of the system to frequently changing or silent application scenarios; by optimizing the forgetting module, it specifically retrains the deleted data to ensure that the model no longer relies on these forgotten data. This mechanism ensures the transparency of the model and respects user privacy; by adaptively aggregating the modules of forgetting clients and non-forgetting clients, a global model that can adapt to different application scenarios is constructed, which flexibly meets the diverse needs of clients, maintains the stability and adaptability of the model when data requirements are constantly changing, and can efficiently cope with the impact of silent applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0057] Figure 1 It is a framework diagram of the encrypted traffic classification method based on scalable federated forgetting learning of the present invention;

[0058] Figure 2 This is a flowchart of forgetting training of the forgetting client of the present invention. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0060] See also Figure 1-Figure 2 , the present invention provides a technical solution:

[0061] Example 1: An encrypted network traffic classification method based on scalable federated forgetting learning, the method comprising:

[0062] S100, local model initialization: Each client locally builds a federated model containing the feature extraction layer parameters and the fully connected classifier layer parameters and initializes it;

[0063] Preferably, the federation model in S100 includes:

[0064] In our FedUnSilApp application, we use a horizontal federated learning scenario. We assume that there are K clients participating in collaborative training to build a federated model. ,in Used to extract network traffic characteristics, is a classifier;

[0065] According to the formula, the optimization goal of the training process is obtained:

[0066] ;

[0067] in, represents the loss function, A function representing the model, and represents the parameters of the model, Indicates the Client's The labels corresponding to the samples, 、 Respectively represent The client dataset size.

[0068] S200: Obtain a local data set for each client for its application scenario, and perform local training on the model to obtain feature extraction parameters. and fully connected layer parameters ;

[0069] S300: When a client requests to delete data, the client is set as a forgetting client, and an auxiliary forgetting module is enabled. A distillation operation is performed between the learning module and the auxiliary forgetting module to generate a forgetting module.

[0070] Some clients may request data removal for privacy or flexibility reasons. For example, frequently deactivated "silent apps" may need to be forgotten. In these cases, the framework activates an auxiliary forget module to selectively prune neurons in the classifier corresponding to these silent apps. This minimizes their negative impact on overall model stability, effectively enhancing the system's robustness to frequently changing or silent application scenarios.

[0071] Preferably, the learning module in S300 includes:

[0072] In the learning modules of each client, a convolutional neural network is used to perform supervised learning NTC tasks and define a label space. , from the perspective of the global NTC model, the loss function is as follows:

[0073] ;

[0074] in, Indicates the total number of categories of the client. represents the loss function, Indicates the The client's data set is of size , Indicates the number of clients, Indicates the Client's samples, Indicates the Client's The labels corresponding to the samples, represents the function of the model, where and Represents the parameters of the model.

[0075] Preferably, the forgetting module in S300 includes:

[0076] S301. In the forgetting mechanism in federated learning, when the client When a request is made to delete its data, the system is optimized through a forget module and retrained on the deleted data;

[0077] Setting up the client Try to class The data is forgotten, then set Is the client The original dataset on Is the client The dataset that needs to forget categories: , Is the client On the remaining datasets: ;

[0078] Based on the dataset Modify tag generation , where the label domain of the active application is mapped to the new label domain, , which involves establishing a correspondence between the original label set and the rearranged label set, and the mapping relationship is: ;

[0079] in, is the domain, is the corresponding domain; , given The category to be deleted is a collection, , ,So ;

[0080] This gives the mapping function ; Get the latest tag index;

[0081] in, Indicates that in the original list Small number of removed elements;

[0082] Finally obtained ;

[0083] S302. Obtain the model trained by the learning module , according to the parameter freezing formula: , frozen model layer, so that during training The layer parameters are not updated and gradients are not calculated;

[0084] in, represents the loss function, Indicates frozen parameters;

[0085] Get the client Auxiliary forgetting module , its objective function is:

[0086] ;

[0087] in, Represents the client Auxiliary forgetting model for its data, the model is based on the dataset Optimize to meet client needs Request to be forgotten; represents the cross entropy loss, dataset Is the client Design data set to assist learning forgetting model; optimization goal: minimize the data set The loss is normalized to the dataset size The average value of .

[0088] Then the model of the forgetting module is obtained according to the objective function , ;

[0089] Once fine-tuning is complete, follow the unfreezing formula: , the first half of the neuron's parameters will be unfrozen;

[0090] in, Indicates the degree of thawing parameters. =1, indicating complete thawing;

[0091] Finally, the labels are passed through the inverse mapping function , remapped back to the original domain, .

[0092] Preferably, the forgetting module needs to meet two requirements during the entire forgetting process:

[0093] a1. The forget operation cannot affect the remaining data Model accuracy:

[0094] Model of the forgetting module For the remaining data The logit output should be the same as the original model Stay consistent, that is: ;

[0095] in, Represents the original model No. logit values, represents the inverse mapping function, Represents the trained forgetting model Input The logit output is , represents the inverse mapping of the label function;

[0096] a2. How to deal with forgotten data after forgetting Exhibits incorrect classification behavior:

[0097] Forgetting Model The logit output should be consistent with the forgotten data There are differences in the original labels, namely:

[0098] ;

[0099] in, express true labels; in other words, this requirement states that the model after forgetting should not remember the forgotten data information.

[0100] S400: After the training is completed, the client uploads its model parameters to the server; all clients first upload their own feature extraction layer parameters The server aggregates the parameters into a global feature extraction layer; the clients that do not request data deletion are set as non-forgotten clients. For the fully connected classifier layer, the forgetting modules of the forgetting clients are aggregated separately from the parameters of the non-forgotten clients. Finally, a global model that can adapt to different application scenarios is constructed in a modular way.

[0101] This two-stage aggregation approach flexibly meets diverse client needs, maintaining model stability and adaptability as data demands evolve. By supporting selective forgetting and adaptive aggregation, this approach effectively addresses the impact of silent applications.

[0102] Preferably, S400 includes:

[0103] S401, set up shared clients, and divide them into two categories: non-forgotten client set and forget client collection , and satisfies ;

[0104] Per-client model Contains two parts of parameters: feature extraction layer parameters PT and full connection layer parameters The goals of the global aggregation module are: 1. Aggregate the feature extraction layer parameters of all clients; 2. Aggregate the fully connected layer parameters of the non-forgotten clients and the forgotten clients respectively; 3. Combine the above aggregation results to form two global models.

[0105] Get the feature extraction layer parameters of all clients , sum and average to get the global feature parameters : ;

[0106] In this step, we have Feature layer parameters Sum and divide by the total number of clients , to obtain the average value. It is the average value of the feature layer parameters of all clients (regardless of whether they are forgotten);

[0107] Get the fully connected layer parameters of the non-forgetful client , sum and average, and we get : ;

[0108] In this step, we set Each client The fully connected layer parameters Sum and divide by the number of non-forgotten clients , to get the average value. This ensures It only contains the fully connected layer information of all non-forgotten clients, and the fully connected layer parameters of the forgotten clients are not involved in the aggregation.

[0109] Get the fully connected layer parameters of the forget client , sum and average, and we get :

[0110] ;

[0111] In this step, we set Each client The fully connected layer parameters Sum and divide by the number of forgotten clients , to get the average value. This ensures It only contains the fully connected layer information of all forgotten clients, and the fully connected layer parameters of non-forgotten clients are not involved in the aggregation.

[0112] S402, the calculated global feature parameters Combined with the aggregation results of different fully connected layers, two global models are formed:

[0113] Global Model Aggregates the feature layer parameters of all clients and the fully connected layer parameters of non-forgotten clients: ;

[0114] Global Model Aggregate the feature layer parameters of all clients and forget the fully connected layer parameters of the client: ;

[0115] It is a model obtained by aggregating the feature layers of all clients and the fully connected layers of non-forgetting clients; The model is obtained by aggregating the feature layer of all clients and the fully connected layer of the forgotten client. These two models play different roles depending on whether the information of the forgotten client needs to be retained.

[0116] According to Tables 1 and 2, after testing on the public datasets NJUPT and MIRAGE, the encrypted network traffic classification method based on scalable federated forgetting learning has an accuracy of 88.16% and 85.17%, far exceeding other existing methods.

[0117] Table 1 Test results on the public dataset NJUPT

[0118]

[0119] Table 2 Test results on the public dataset MIRAGE

[0120]

[0121] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art will be able to modify the technical solutions described in the aforementioned embodiments or substitute equivalents for some of the technical features. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. Encrypted network traffic classification method based on scalable federated forgetting learning, characterized by: The method comprises: S100. Each client locally builds a federated model containing the parameters of the feature extraction layer and the fully connected classifier layer, and initializes it. S200: Obtain a local data set for each client for its application scenario, and perform local training on the model to obtain feature extraction parameters. and fully connected layer parameters ; S300: When a client requests to delete data, the client is set as a forgetting client, and an auxiliary forgetting module is enabled. A distillation operation is performed between the learning module and the auxiliary forgetting module to generate a forgetting module. S400: After the training is completed, the client uploads its model parameters to the server; all clients first upload their own feature extraction layer parameters The server aggregates the parameters into a global feature extraction layer; the clients that do not request data deletion are set as non-forgotten clients. For the fully connected classifier layer, the forgetting modules of the forgetting clients are aggregated separately from the parameters of the non-forgotten clients. Finally, a global model that can adapt to different application scenarios is constructed in a modular way. The learning module in S300 includes: In the learning modules of each client, a convolutional neural network is used to perform supervised learning NTC tasks and define a label space. , from the perspective of the global NTC model, the loss function is as follows: ； in, Indicates the total number of categories of the client. represents the loss function, Indicates the The client's data set is of size , Indicates the number of clients, Indicates the Client's samples, Indicates the Client's The labels corresponding to the samples, represents the function of the model, where and Represents the parameters of the model; The forgetting module in S300 includes: S301. In the forgetting mechanism in federated learning, when the client When a request is made to delete its data, the system is optimized through a forget module and retrained on the deleted data; Setting up the client Try to class The data is forgotten, then set Is the client The original dataset on Is the client The dataset that needs to forget categories: , Is the client On the remaining datasets: ; Based on the dataset Modify tag generation , where the label domain of the active application is mapped to the new label domain, and the mapping relationship is: ; in, is the domain, is the corresponding domain; , given The category to be deleted is a collection, , ,So ; This gives the mapping function ; Get the latest tag index; in, Indicates that in the original list Small number of removed elements; Finally obtained ; S302. Obtain the model trained by the learning module , according to the parameter freezing formula: , frozen model layer, so that during training The layer parameters are not updated and gradients are not calculated; in, represents the loss function, Indicates frozen parameters; Get the client Auxiliary forgetting module , its objective function is: ； in, Represents the client Auxiliary forgetting model for its data, the model is based on the dataset Optimize to meet client needs Request to be forgotten; represents the cross entropy loss, dataset Is the client Designed dataset to assist learning of forgetting models; Then the model of the forgetting module is obtained according to the objective function , ; Once fine-tuning is complete, follow the unfreezing formula: , the first half of the neuron's parameters will be unfrozen; in, Indicates the degree of thawing parameters. =1, indicating complete thawing; Finally, the labels are passed through the inverse mapping function , remapped back to the original domain, ; The forgetting module needs to meet two requirements during the entire forgetting process: a1. The forget operation cannot affect the remaining data Model accuracy: Model of the forgetting module For the remaining data The logit output should be the same as the original model Stay consistent, that is: ； in, Represents the original model No. logit values, represents the inverse mapping function, Represents the trained forgetting model Input The logit output is , represents the inverse mapping of the label function; a2. How to deal with forgotten data after forgetting Exhibits incorrect classification behavior: Forgetting Model The logit output should be consistent with the forgotten data There are differences in the original labels, namely: ； in, express The true label.

2. The encrypted network traffic classification method based on scalable federated forgetting learning according to claim 1 is characterized in that: The federation model in S100 includes: Assume that there are K clients participating in collaborative training to build a federated model ,in Used to extract network traffic characteristics, is a classifier; According to the formula, the optimization goal of the training process is obtained: ； in, represents the loss function, A function representing the model, and represents the parameters of the model, Indicates the Client's The labels corresponding to the samples, 、 Respectively represent The client dataset size.

3. The encrypted network traffic classification method based on scalable federated forgetting learning according to claim 1, characterized in that: The S400 includes: S401, set up shared clients, and divide them into two categories: non-forgotten client set and forget client collection , and satisfies ; Get the feature extraction layer parameters of all clients , sum and average to get the global feature parameters : ; Get the fully connected layer parameters of the non-forgetful client , sum and average, and we get : ； Get the fully connected layer parameters of the forget client , sum and average, and we get : ； S402, the calculated global feature parameters Combined with the aggregation results of different fully connected layers, two global models are formed: Global Model Aggregates the feature layer parameters of all clients and the fully connected layer parameters of non-forgotten clients: ; Global Model Aggregate the feature layer parameters of all clients and forget the fully connected layer parameters of the client: 。

Images