Network traffic classification method, device and equipment based on multi-feature fusion

Abstract

The invention provides a network traffic classification method, device and equipment based on multi-feature fusion, and belongs to the field of artificial intelligence. The method comprises the following steps: preprocessing traffic data to obtain a traffic grey-scale map; screening a minority class traffic sample set from the traffic grey-scale map; simulating a minority class traffic sample set through a WGAN model, and constructing and generating a sample; supplementing the generated sample into the flow grey-scale map to form a balanced sample set; inputting the balanced sample set into a ViT hybrid model to extract features, and obtaining sequence features; fusing the sequence features based on a cross attention mechanism to obtain a target traffic diagram; and classifying the target flow diagram by utilizing a multi-layer perceptron module of the perceptual layer to obtain a classification result. According to the method, the global features and the local features of the network traffic data can be effectively combined for classification, meanwhile, the model architecture is lightened, the accuracy of the model is improved, and the situation that the number of partial traffic type samples is small can be effectively handled.

Description

Technical Field

[0001] The present application belongs to the field of artificial intelligence, and specifically relates to a network traffic classification method, apparatus and device based on multi-feature fusion. Background Art

[0002] In recent years, deep learning methods have demonstrated strong potential and advantages in the field of encrypted traffic classification. Compared to traditional techniques based on specific features or rules, deep learning methods can automatically extract and mine deep-level features in traffic data, thereby achieving more accurate classification. During training, deep learning models tend to learn the characteristics of traffic types that account for a large proportion, because these majority class samples appear frequently in the training set, making it easier for the model to capture their patterns. In real-world network environments, with the continuous development of Internet technology and the expansion of network scale, application categories are becoming increasingly complex, and new types of network traffic are constantly emerging.

[0003] However, existing technologies generally face a data shortage for these new traffic types, posing significant challenges to network traffic classification. Furthermore, deep learning models are typically complex and have numerous parameters. While this gives them powerful learning capabilities, it also carries the risk of overfitting, resulting in poor generalization. Therefore, designing lightweight network structures to reduce the number of parameters and computational complexity, and to improve the accuracy and generalization of classification models, has become a critical issue that needs to be addressed. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a network traffic classification method, device and equipment based on multi-feature fusion to solve the problem in the prior art that the data sample size of new traffic types is usually insufficient, the deep learning model is prone to the risk of overfitting, and the model's generalization ability is poor.

[0005] In order to solve the above technical problems, this application is implemented as follows: In a first aspect, an embodiment of the present application provides a network traffic classification method based on multi-feature fusion, the method comprising: Preprocess the traffic data to obtain a traffic grayscale map; Filter out minority traffic sample sets from the traffic grayscale image; The WGAN model is used to simulate a minority class traffic sample set and construct a generated sample. The WGAN model includes a target generator and a target discriminator. Add the generated samples to the traffic grayscale map to form a balanced sample set; The balanced sample set is input into the ViT hybrid model to extract features and obtain sequence features; wherein the head of the sequence feature is set with a classification label containing position information; The target flow map is obtained by fusing sequence features based on the cross-attention mechanism; The target traffic graph is classified using the multi-layer perceptron module of the perception layer to obtain classification results; the classification results include application type classification and service type classification.

[0006] Preferably, the flow data is preprocessed to obtain a flow grayscale map, and the specific steps include: Divide traffic data into multiple bidirectional conversation flow files; Anonymizing the two-way conversation flow file to obtain an anonymous two-way conversation flow file; Unifying the byte length of traffic in the anonymous two-way conversation flow file to obtain a two-way conversation flow file with a uniform length; Convert the uniform-length bidirectional conversation flow files into traffic grayscale graphs.

[0007] Preferably, the specific steps of screening out a minority class traffic sample set from the traffic grayscale image include: Count the number of samples of different traffic types in the traffic grayscale map to obtain the distribution statistics; Based on the distribution statistics results and the preset screening threshold, a set of minority traffic samples is screened out.

[0008] Preferably, the WGAN model is used to simulate a minority class traffic sample set to construct a generated sample. The specific steps include: Build an initial WGAN model including an initial generator and an initial discriminator; Use the initial generator to simulate the grayscale structure of the minority class traffic sample set and construct the initial generated sample; The initial discriminator is used to distinguish the minority class traffic and the initial generated samples to obtain the discrimination result; Based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model that includes a target generator and a target discriminator. The target generator in the WGAN model is used to construct generated samples.

[0009] Preferably, based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model including a target generator and a target discriminator. The specific steps include: Calculate the generation loss value based on the noise amount, the initial generated sample and the loss function of the initial generator; Calculate the discriminant loss value based on the discriminant result and the loss function of the initial discriminator; According to the generation loss value and the discrimination loss value, the initial generator and the initial discriminator are iteratively trained respectively to obtain the target generator and the target discriminator to form the WGAN model.

[0010] Preferably, the balanced sample set is input into the ViT hybrid model to extract features and obtain sequence features. The specific steps include: The balanced sample set is divided into training set and test set by stratified sampling; The grayscale images in the training set are segmented into multiple segments based on the ViT hybrid model; Arrange multiple fragments into multiple sequences and obtain the corresponding feature vectors after passing them through the linear projection layer; Add position encoding and classification labels to the feature vector to obtain sequence features.

[0011] Preferably, the balanced sample set is divided into a training set and a test set by stratified sampling, and the specific steps include: According to the traffic type, the balanced sample set is stratified and grouped to obtain multiple independent layers; Random sampling is performed on multiple independent levels according to preset proportions to obtain sampling samples; The sampled samples are divided into the training set, and the remaining samples are divided into the test set.

[0012] Preferably, the specific steps of adding position codes and classification labels to the feature vectors to obtain sequence features include: Add position encoding to the feature vector to obtain the position-labeled feature vector; Arrange all the index feature vectors into a sequence; Add a classification label to the head of the sequence to form the sequence feature.

[0013] Compared with the prior art, the above technical solution provided by this application includes at least the following beneficial effects: This application first preprocesses the traffic data to obtain a traffic grayscale map; selects a minority traffic sample set from the traffic grayscale map; simulates the minority traffic sample set through the WGAN model to construct a generated sample; wherein, the WGAN model includes a target generator and a target discriminator; adds the generated sample to the traffic grayscale map to form a balanced sample set; inputs the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein, the head of the sequence feature is provided with a classification label containing position information; the sequence features are fused based on the cross-attention mechanism to obtain the target traffic map; the target traffic map is classified using the perception layer multi-layer perceptron module to obtain the classification result; the classification result includes application type classification and service type classification. This application can effectively combine the global features and local features of network traffic data for classification, and at the same time use reasonable design to achieve lightweight model architecture, improve the accuracy of the model, and can effectively deal with the situation where some traffic types are novel, niche or have specific application scenarios.

[0014] In a second aspect, an embodiment of the present application provides a network traffic classification device based on multi-feature fusion, comprising: Data preprocessing module, used to preprocess traffic data and obtain traffic grayscale map; The filtering module is used to filter out minority traffic sample sets from the traffic grayscale image; The sample construction module is used to simulate a minority class traffic sample set through the WGAN model to construct a generated sample. The WGAN model includes a target generator and a target discriminator. The sample balancing module is used to add the generated samples to the traffic grayscale map to form a balanced sample set; A feature extraction module is used to input the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein the head of the sequence feature is provided with a classification label containing position information; Feature fusion module, used to fuse sequence features based on the cross-attention mechanism to obtain the target flow map; The classification module is used to classify the target traffic graph using the perception layer multi-layer perceptron module to obtain classification results; the classification results include application type classification and service type classification.

[0015] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the method described in the first aspect are implemented.

[0016] It can be understood that the beneficial effects of the technical solutions provided in the second and third aspects can be found in the relevant description of the first aspect, and will not be repeated here.

[0017] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which: Figure 1 This is a flowchart of a network traffic classification method based on multi-feature fusion provided by some embodiments of the present application; Figure 2 This is a schematic diagram of the flow structure of a network traffic classification method based on multi-feature fusion provided by some embodiments of the present application; Figure 3 is a block diagram of a network traffic classification device based on multi-feature fusion shown in some embodiments of the present application; Figure 4is a block diagram of an electronic device according to some embodiments of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0020] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects and are not used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments of this application can be implemented in an order other than those illustrated or described herein. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0021] The following describes in detail a network traffic classification method based on multi-feature fusion provided by an embodiment of the present application through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0022] Figure 1 and Figure 2 The flowchart and the flowchart of the network traffic classification method based on multi-feature fusion are shown in FIG. Figure 1 and Figure 2 , the method comprising: Step S101: pre-processing the flow data to obtain a flow grayscale map; Specifically, traffic data is divided into multiple bidirectional conversation flow files; the bidirectional conversation flow files are anonymized to obtain anonymous bidirectional conversation flow files; the byte length of traffic in the anonymous bidirectional conversation flow files is unified to obtain uniform-length bidirectional conversation flow files; and the uniform-length bidirectional conversation flow files are converted into traffic grayscale maps.

[0023] In one possible implementation, the SpiltCap tool is used to segment network traffic in .pcap format into bidirectional conversation flows based on five-tuple information. This requires that the source IP address, source port, destination IP address, destination port, and transport layer protocol used by the packets be identical, and the conversation flows are saved in .pcap format. To prevent partial traffic information from affecting experimental performance evaluation, the traffic is anonymized. Each traffic category has a unique IP address in the dataset. If the IP and MAC addresses are not removed, the model may overfit.

[0024] To facilitate subsequent model input and processing, this example requires standardizing the byte length of cleaned traffic data. The network's Maximum Transmission Unit (MTU) defines a maximum packet length of 1500 bytes; this chapter uses 784 bytes as the standard length. The raw traffic is clipped; files exceeding the specified length are clipped, while those under the required length are padded with 0x00 to the specified length. Each byte in the session corresponds to a grayscale pixel value; for example, 0x00 represents black and 0xFF represents white. The session file is then converted to a grayscale image.

[0025] Step S102: Filter out a minority class traffic sample set from the traffic grayscale image; Specifically, the number of samples of different traffic types in the traffic grayscale map is statistically analyzed to obtain distribution statistics results; based on the distribution statistics results and a preset screening threshold, a minority class traffic sample set is screened out.

[0026] In one possible implementation, the grayscale image of traffic is used to calculate the distribution of samples of different traffic types. Based on a preset threshold (e.g., sample proportion <5% or absolute number <1000), minority traffic samples are screened out, such as DNS covert tunnels, Tor anonymous traffic, and malicious IoT traffic.

[0027] Step S103: Simulate a minority class traffic sample set through a WGAN model to construct a generated sample; wherein the WGAN model includes a target generator and a target discriminator; Specifically, an initial WGAN model including an initial generator and an initial discriminator is constructed; the initial generator is used to simulate the grayscale structure of the minority class traffic sample set to construct the initial generated samples; the initial discriminator is used to distinguish the minority class traffic from the initial generated samples to obtain the discrimination results; based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model including a target generator and a target discriminator; and the target generator in the WGAN model is used to construct the generated samples.

[0028] Among them, based on the discrimination result, the initial WGAN model is iteratively trained to obtain a WGAN model including a target generator and a target discriminator. Specifically, the generation loss value is calculated according to the noise amount, the initial generated sample and the loss function of the initial generator; the discrimination loss value is calculated according to the discrimination result and the loss function of the initial discriminator; according to the generation loss value and the discrimination loss value, the initial generator and the initial discriminator are iteratively trained respectively to obtain the target generator and the target discriminator to form the WGAN model.

[0029] In one possible implementation, when the model is trained, because the number of minority class samples is too small and their proportion in the entire training data is negligible, the model's learning process will be overly inclined to the characteristics of the majority class traffic type, which accounts for a large proportion. When classifying minority class traffic, the model is prone to deviations and it is difficult to accurately identify its characteristics, which seriously affects the overall classification performance.

[0030] To effectively solve this problem, this embodiment uses WGAN to train minority class samples through the dynamic game between the generator and the discriminator, and deeply learns the potential distribution characteristics of minority class samples: the generator simulates the characteristic structure of the minority class traffic grayscale image based on the input noise vector, and gradually constructs an image similar to the real minority class traffic sample. The discriminator needs to have a keen ability to distinguish between real samples and generated samples. Then the discriminator is fixed, and by minimizing the loss of the generator, the generator is prompted to generate samples that are closer to the real data. This cycle repeats itself. As the training rounds continue to advance, the minority class traffic samples generated by the generator will become more and more realistic, and will gradually be added to the original data set, so that the proportion of minority class samples in the data set is significantly increased, thereby effectively alleviating the data imbalance problem, providing a more balanced and rich data foundation for subsequent model training, and effectively improving the model's classification accuracy and generalization ability for various types of traffic.

[0031] It's important to note that compared to the original GAN, problems such as pattern collapse and training instability during training have limited its widespread application. WGAN introduces the Wasserstein distance (also known as the Earth-Mover distance, which indicates the degree of similarity between two distributions) to measure the difference between the data distribution and the generator's distribution. The core of the WGAN is to replace the traditional GAN loss function with a function that minimizes the Wasserstein distance. This distance provides a smoother gradient signal for the generator because it considers the "quality" and distance of the movement required to transform one distribution into another. This advantage is particularly evident when the two distributions have little or no overlap.

[0032] The loss function of the generator G of WGAN is: The discriminator D loss function of WGAN is: in, Represents the loss value of the WGAN generator; Represents the loss value of the discriminator; Represents the score of the discriminator on the real data x; Represents the discriminator's generated data The goal is to maximize this loss to increase the Wasserstein distance between the real data and the generated data; Represents the distribution of real data x expectations on Represents the noise input z to the generator in its distribution The expectation on z is generated by sampling noise z , calculate the mean of its discriminator scores to measure the “realism” of the generated data. In order to make the estimation of Wasserstein distance valid, it is necessary to ensure that the discriminator D satisfies the K-Lipschitz condition, that is, for any input x, y, In practice, this constraint is often implemented through weight clipping or gradient penalty techniques.

[0033] In iterative training, first update the discriminator D, fix the generator G, and update the discriminator parameters according to the above loss function and K-Lipschitz constraint. Then update the generator G: fix the discriminator D, and minimize Update the generator parameters to encourage G to generate samples that are closer to the real data.

[0034] Step S104: Add the generated samples to the flow grayscale map to form a balanced sample set; It's important to note that after data augmentation using WGAN, the number of minority class samples in an imbalanced dataset is expanded. The original majority class samples are then merged with the generated minority class samples to form a balanced dataset with a more balanced class distribution. A balanced dataset offers two advantages: first, the majority class samples retain the statistical characteristics of mainstream traffic, providing a foundation for the model's classification; second, the generated minority class samples simulate rare patterns in real-world scenarios, forcing the model to learn more discriminative features.

[0035] Step S105: Input the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein the head of the sequence feature is provided with a classification label containing position information; Specifically, the balanced sample set is divided into training set and test set through stratified sampling; the grayscale image in the training set is segmented into multiple segments based on the ViT mixture model; the multiple segments are arranged into multiple sequences, and the corresponding feature vectors are obtained after passing through the linear projection layer; position encoding and classification labels are added to the feature vector to obtain sequence features.

[0036] Among them, the balanced sample set is divided into a training set and a test set through stratified sampling. Specifically, the balanced sample set is stratified and grouped according to the traffic type to obtain multiple independent levels; random sampling is performed on the multiple independent levels according to the preset proportion to obtain sampling samples; the sampling samples are assigned to the training set, and the remaining samples are assigned to the test set.

[0037] Specifically, position coding and classification labels are added to the feature vector to obtain sequence features. Specifically, position coding is added to the feature vector to obtain a marker feature vector; all marker feature vectors are arranged into a sequence; and a classification label is added to the head of the sequence to form a sequence feature.

[0038] In one possible implementation, after completing data augmentation and forming a balanced dataset, this embodiment divides it into a training set and a test set through stratified sampling, then trains the ViT-MobileNetV2 hybrid model based on the training set, and uses the test set to verify the classification effect.

[0039] First, the training and test sets are divided through stratified sampling. All samples in the balanced dataset are stratified and grouped by traffic type, ensuring that each traffic category is considered an independent stratum. For example, if there are 10 traffic categories in the dataset, 8 of which are majority classes (accounting ≥5%) and 2 are minority classes (originally accounting for <5% but increasing after enhancement), each category is considered an independent stratum. Next, samples within each stratum are randomly sampled according to a fixed ratio (e.g., 8:2). For each traffic category, the total number of samples N is calculated, and 0.8×N samples are proportionally selected to be assigned to the training set, leaving 0.2×N samples to be assigned to the test set. In this way, the proportions of each traffic category in the training and test sets are exactly the same as in the balanced dataset, avoiding the class distribution shift caused by random partitioning.

[0040] Specifically, during model training, the ViT hybrid model segments the grayscale image in the training set into n segments, arranges these segments into a sequence, and passes them through a linear projection layer to obtain a feature vector. Since the self-attention mechanism requires pairwise interaction between all elements, a positional encoding method is required. With positional encoding, the resulting labeled feature vector contains both the original information of the image segment and its positional information. The resulting labeled feature vector maintains the same input structure as the original transformer model and is directly passed to the transformer encoding module to produce multiple outputs. The ViT hybrid model borrows from the BERT model by adding a classification label to the labeled feature vector, with the positional encoding set to 0. Because each labeled feature vector interacts with other labeled feature vectors, the classification label can learn useful information from them, allowing judgment based solely on the output of the classification label. The MLP head is a general classification module, and the cross-entropy function is used for model training.

[0041] Step S106: fusing sequence features based on the cross-attention mechanism to obtain a target flow graph; The converter encoding layer of the ViT hybrid model consists of multiple encoding modules. The multi-head attention mechanism in the encoding module helps the model extract rich features from different subspaces by calculating multiple attention score matrices in parallel. The formula is as follows: Where 0<i≤h, h represents the number of “heads” of the multi-head attention mechanism; are the query matrix, key matrix, and value matrix, respectively, all derived from the linear transformation of the input vector; represents the dimension of the key vector, is a learnable parameter matrix.

[0042] Compared to CNNs, the ViT hybrid model lacks image-specific inductive biases. For example, in CNNs, locality and translation invariance are reflected at every layer, effectively permeating the entire model. However, in the ViT hybrid model, locality and translation invariance are only maintained at the MLP layer, while the self-attention layer is global. This lack of locality means that the characteristic that adjacent regions in an image should have similar features is underutilized, hindering the network's ability to learn and express image information features, thereby limiting its ability to fully capture features and accurately classify them in network traffic classification tasks.

[0043] This paper proposes combining the lightweight CNN architecture MobileNetV2 with ViT. MobileNetV2's design focuses on reducing parameters and computational complexity. For example, the use of depthwise separable convolution significantly reduces the computational complexity and parameter count of traditional convolution. MobileNetV2 primarily optimizes the network by introducing a linear bottleneck structure and an inverse residual structure, resulting in a deeper network layer while reducing the model size and increasing speed. The MobileNetV2 network model has 17 bottleneck layers, one standard convolutional layer, and two point-by-point convolutional layers, for a total of 54 trainable parameter layers.

[0044] Step S107: using the multi-layer perceptron module of the perception layer to classify the target traffic graph to obtain a classification result; the classification result includes application type classification and service type classification.

[0045] After model training completes and classifies by service and application type, the classification is validated using a test set. The improved model significantly enhances its ability to distinguish encrypted and unencrypted traffic and achieves fine-grained recognition of various applications through the fusion of multiple features from ViT and MobileNetV2. At the service type level, the model not only captures the global temporal characteristics of encrypted traffic (such as long connection stability and traffic burst patterns) through ViT, but also leverages MobileNetV2 to extract high-entropy characteristics of local bytes (such as the random distribution of encrypted payloads), significantly improving the accuracy of encrypted traffic identification and reducing false positives caused by misclassifying unencrypted traffic as encrypted. At the application type level, the model significantly improves recall for a small number of traffic types, such as Tor anonymous traffic and DNS covert tunneling, significantly reducing false positives. It can also effectively identify new types of encrypted traffic not labeled in the training set. Combined with the efficient computing performance provided by its lightweight design, it enables precise response to dynamic network resource management and security defenses, providing accurate and real-time technical support for traffic classification and optimization in complex network environments.

[0046] The network traffic classification method based on multi-feature fusion provided by the above embodiment, first of all, in the actual network environment, newly emerging network traffic types often face the dilemma of insufficient data volume, which can easily lead to insufficient learning of minority class traffic features by the classification model during training, thereby affecting the classification accuracy and the generalization ability of the model. The present invention uses WGAN technology to perform data enhancement, and significantly increases the proportion of minority class samples in the data set by generating samples similar to the minority class and integrating them into the data set. In this way, the classification model can fully access and learn the characteristic information of minority class traffic during the training process, avoiding classification bias caused by data imbalance. When facing a complex and changing network environment, the model is no longer limited to learning the features of the majority class traffic, but can comprehensively and balancedly learn the features of various types of traffic, thereby greatly improving the classification accuracy of various types of traffic, enhancing the generalization ability of the model in different network scenarios, and enabling it to more stably and reliably cope with the challenges of various unknown traffic types.

[0047] Secondly, this embodiment strengthens feature fusion and model performance optimization by designing a lightweight ViT-MobileNet hybrid model. This dual-branch architecture organically combines the ViT hybrid model's powerful global feature capture capabilities with MobileNet's superior local feature extraction capabilities. The ViT hybrid model can grasp the overall trends and global correlations of network traffic data at a macro level, while MobileNet focuses on mining detailed features such as the local structure of packets and traffic changes within specific time periods. The two complement each other, enabling the model to learn comprehensive and multi-layered network traffic feature information. Furthermore, after fusing ViT and MobileNet, the hybrid model is pruned to precisely remove redundant components. This operation significantly reduces the number of model parameters and computational complexity while maintaining model performance, achieving a lightweight model. This lightweight model significantly improves operational efficiency, enabling more efficient processing of large-scale network traffic data. It also enhances the model's adaptability, ensuring stable and efficient traffic classification in diverse network environments and traffic types, providing more powerful and reliable technical support for network traffic classification tasks.

[0048] It should be noted that the execution subject of the network traffic classification method based on multi-feature fusion provided in the embodiment of the present application can be a network traffic classification device based on multi-feature fusion, or a control module in the network traffic classification device based on multi-feature fusion for executing and loading the network traffic classification method based on multi-feature fusion. In the embodiment of the present application, the execution of the network traffic classification method based on multi-feature fusion by the network traffic classification device based on multi-feature fusion is taken as an example to illustrate the network traffic classification device based on multi-feature fusion provided in the embodiment of the present application.

[0049] Figure 3 This is a schematic diagram of a network traffic classification device based on multi-feature fusion according to the second embodiment of the present application. Figure 3 , the network traffic classification device 200 based on multi-feature fusion includes: Data preprocessing module 201: preprocesses traffic data to obtain a traffic grayscale map; Specifically, traffic data is divided into multiple bidirectional conversation flow files; the bidirectional conversation flow files are anonymized to obtain anonymous bidirectional conversation flow files; the byte length of traffic in the anonymous bidirectional conversation flow files is unified to obtain uniform-length bidirectional conversation flow files; and the uniform-length bidirectional conversation flow files are converted into traffic grayscale maps.

[0050] Screening module 202: used to screen out a minority class of traffic sample sets from the traffic grayscale image; Specifically, the number of samples of different traffic types in the traffic grayscale map is statistically analyzed to obtain distribution statistics results; based on the distribution statistics results and a preset screening threshold, a minority class traffic sample set is screened out.

[0051] Sample construction module 203: used to simulate a minority class traffic sample set through a WGAN model to construct a generated sample; wherein the WGAN model includes a target generator and a target discriminator; Specifically, an initial WGAN model including an initial generator and an initial discriminator is constructed; the initial generator is used to simulate the grayscale structure of the minority class traffic sample set to construct the initial generated samples; the initial discriminator is used to distinguish the minority class traffic from the initial generated samples to obtain the discrimination results; based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model including a target generator and a target discriminator; and the target generator in the WGAN model is used to construct the generated samples.

[0052] Among them, based on the discrimination result, the initial WGAN model is iteratively trained to obtain a WGAN model including a target generator and a target discriminator. Specifically, the generation loss value is calculated according to the noise amount, the initial generated sample and the loss function of the initial generator; the discrimination loss value is calculated according to the discrimination result and the loss function of the initial discriminator; according to the generation loss value and the discrimination loss value, the initial generator and the initial discriminator are iteratively trained respectively to obtain the target generator and the target discriminator to form the WGAN model.

[0053] Sample balancing module 204: used to add generated samples to the traffic grayscale map to form a balanced sample set; Feature extraction module 205: used to input the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein the header of the sequence feature is provided with a classification label containing position information; Specifically, the balanced sample set is divided into training set and test set through stratified sampling; the grayscale image in the training set is segmented into multiple segments based on the ViT mixture model; the multiple segments are arranged into multiple sequences, and the corresponding feature vectors are obtained after passing through the linear projection layer; position encoding and classification labels are added to the feature vector to obtain sequence features.

[0054] Among them, the balanced sample set is divided into a training set and a test set through stratified sampling. Specifically, the balanced sample set is stratified and grouped according to the traffic type to obtain multiple independent levels; random sampling is performed on the multiple independent levels according to the preset proportion to obtain sampling samples; the sampling samples are assigned to the training set, and the remaining samples are assigned to the test set.

[0055] Specifically, position coding and classification labels are added to the feature vector to obtain sequence features. Specifically, position coding is added to the feature vector to obtain a marker feature vector; all marker feature vectors are arranged into a sequence; and a classification label is added to the head of the sequence to form a sequence feature.

[0056] Feature fusion module 206: used to fuse sequence features based on the cross-attention mechanism to obtain a target flow map; Classification module 207: used to classify the target traffic graph using the perception layer multi-layer perceptron module to obtain classification results; the classification results include application type classification and service type classification.

[0057] The multi-feature fusion-based network traffic classification device in the embodiments of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, the mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), while the non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television, ATM, or self-service machine, etc., without specific limitations in the embodiments of the present application.

[0058] The network traffic classification device based on multi-feature fusion in the embodiment of the present application can be a device having an operating system. The operating system can be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0059] The network traffic classification device based on multi-feature fusion provided in the embodiment of the present application can achieve Figures 1 to 2 In order to avoid repetition, the various processes implemented by the network traffic classification device based on multi-feature fusion in the method embodiment will not be described here.

[0060] Optionally, see Figure 4 The embodiment of the present application also provides an electronic device 300, including a processor 301, a memory 302, and a computer program 303 stored in the memory 302 and executable on the processor 301. When the computer program 303 is executed by the processor 301, the various processes of the above-mentioned network traffic classification method embodiment based on multi-feature fusion are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0061] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned network traffic classification method embodiment based on multi-feature fusion is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0062] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0063] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned network traffic classification method embodiment based on multi-feature fusion, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0064] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0065] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0066] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a more preferred embodiment. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of this application.

[0067] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A network traffic classification method based on multi-feature fusion, characterized in that: include: Preprocess the traffic data to obtain a traffic grayscale map; Filtering a minority class traffic sample set from the traffic grayscale image; Simulating the minority class traffic sample set through a WGAN model to construct a generated sample; wherein the WGAN model includes a target generator and a target discriminator; Adding the generated samples to the traffic grayscale map to form a balanced sample set; Inputting the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein the head of the sequence feature is provided with a classification label containing position information; The target flow map is obtained by fusing the sequence features based on the cross attention mechanism; The target traffic graph is classified using the perception layer multi-layer perceptron module to obtain a classification result; the classification result includes application type classification and service type classification.

2. The network traffic classification method based on multi-feature fusion according to claim 1 is characterized in that: The specific steps of preprocessing the traffic data to obtain the traffic grayscale map include: Dividing the traffic data into a plurality of bidirectional conversation flow files; Anonymizing the two-way conversation stream file to obtain an anonymous two-way conversation stream file; Unifying the byte length of traffic in the anonymous two-way conversation flow file to obtain a two-way conversation flow file with a unified length; The uniform-length bidirectional conversation flow file is converted into a traffic grayscale graph.

3. The network traffic classification method based on multi-feature fusion according to claim 1 is characterized in that: The specific steps of filtering out a minority class traffic sample set from the traffic grayscale image include: Counting the number of samples of different traffic types in the traffic grayscale image to obtain distribution statistics results; Based on the distribution statistics and a preset screening threshold, a minority class traffic sample set is screened out.

4. The network traffic classification method based on multi-feature fusion according to claim 1 is characterized in that: The specific steps of simulating the minority class traffic sample set by the WGAN model to construct the generated sample include: Build an initial WGAN model including an initial generator and an initial discriminator; Using the initial generator to simulate the grayscale structure of the minority class traffic sample set to construct an initial generated sample; Distinguishing the minority class traffic and the initial generated samples by the initial discriminator to obtain a discrimination result; Based on the discrimination result, iteratively training the initial WGAN model to obtain a WGAN model including a target generator and a target discriminator; The target generator in the WGAN model is used to construct generated samples.

5. The network traffic classification method based on multi-feature fusion according to claim 4 is characterized in that: The specific steps of iteratively training the initial WGAN model based on the discrimination result to obtain a WGAN model including a target generator and a target discriminator include: Calculating a generation loss value according to the noise amount, the initial generation sample, and the loss function of the initial generator; Calculating a discrimination loss value according to the discrimination result and the loss function of the initial discriminator; According to the generation loss value and the discrimination loss value, the initial generator and the initial discriminator are iteratively trained respectively to obtain the target generator and the target discriminator to form a WGAN model.

6. The network traffic classification method based on multi-feature fusion according to claim 1 is characterized in that: The specific steps of inputting the balanced sample set into the ViT hybrid model to extract features and obtain sequence features include: Dividing the balanced sample set into a training set and a test set by stratified sampling; Segmenting the grayscale image in the training set into a plurality of segments based on the ViT hybrid model; Arrange the multiple segments into multiple sequences and obtain corresponding feature vectors after passing them through a linear projection layer; Position codes and classification labels are added to the feature vectors to obtain sequence features.

7. The network traffic classification method based on multi-feature fusion according to claim 6 is characterized in that: The specific steps of dividing the balanced sample set into a training set and a test set by stratified sampling include: According to the traffic type, the balanced sample set is stratified and grouped to obtain multiple independent layers; Random sampling is performed on the multiple independent levels according to a preset ratio to obtain sampling samples; The sampled samples are divided into the training set, and the remaining samples are divided into the test set.

8. The network traffic classification method based on multi-feature fusion according to claim 6 is characterized in that: The specific steps of adding position coding and classification labels to the feature vector to obtain sequence features include: Adding a position code to the feature vector to obtain a position-marked feature vector; Arrange all the index feature vectors into a sequence; A classification label is added to the head of the sequence to form a sequence feature.

9. A network traffic classification device based on multi-feature fusion, used to execute the network traffic classification method based on multi-feature fusion according to any one of claims 1 to 8, characterized in that: include: Data preprocessing module, used to preprocess traffic data and obtain traffic grayscale map; A screening module, configured to screen out a minority class traffic sample set from the traffic grayscale image; A sample construction module, configured to simulate the minority class traffic sample set through a WGAN model to construct a generated sample; wherein the WGAN model includes a target generator and a target discriminator; A sample balancing module, configured to add the generated samples to the traffic grayscale map to form a balanced sample set; A feature extraction module is used to input the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein the header of the sequence feature is provided with a classification label containing position information; A feature fusion module is used to fuse the sequence features based on a cross-attention mechanism to obtain a target flow map; The classification module is used to classify the target traffic graph using the perception layer multi-layer perceptron module to obtain classification results; the classification results include application type classification and service type classification.

10. An electronic device, characterized in that: include: A memory, a processor, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, is a step of the network traffic classification method based on multi-feature fusion as described in any one of claims 1 to 8.

Images