Network traffic classification method, device and equipment based on multi-feature fusion

Abstract

This application provides a network traffic classification method, apparatus, and device based on multi-feature fusion, belonging to the field of artificial intelligence. The method includes: preprocessing traffic data to obtain a traffic grayscale image; selecting a minority class traffic sample set from the traffic grayscale image; simulating the minority class traffic sample set using a WGAN model to construct generated samples; supplementing the generated samples into the traffic grayscale image to form a balanced sample set; inputting the balanced sample set into a ViT hybrid model to extract features and obtain sequence features; fusing the sequence features based on a cross-attention mechanism to obtain a target traffic image; and classifying the target traffic image using a multilayer perceptron module in the perception layer to obtain the classification result. This application can effectively combine global and local features of network traffic data for classification, while also lightweighting the model architecture, improving the model's accuracy, and effectively handling situations where the number of samples for some traffic types is small.

Description

Technical Field

[0001] This application belongs to the field of artificial intelligence, specifically relating to a network traffic classification method, apparatus, and device based on multi-feature fusion. Background Technology

[0002] In recent years, deep learning methods have demonstrated strong potential and advantages in the field of encrypted traffic classification. Compared to traditional techniques based on specific features or rules, deep learning methods can automatically extract and mine deep-level features from traffic data, thereby achieving more accurate classification. During training, deep learning models tend to learn the features of traffic types with a high proportion of traffic, because these majority class samples appear frequently in the training set, making it easier for the model to capture their patterns. In real-world network environments, with the continuous development of internet technology and the expansion of network scale, the categories of applications are becoming increasingly diverse, and new types of network traffic are constantly emerging.

[0003] However, in existing technologies, these new traffic types generally face the problem of insufficient data, posing a significant challenge to network traffic classification. Furthermore, deep learning models are typically complex in structure and have numerous parameters. While this endows them with powerful learning capabilities, it also introduces the risk of overfitting, resulting in poor generalization ability. Therefore, designing lightweight network structures to reduce the number of parameters and computational complexity, and improving the accuracy and generalization ability of classification models, has become a crucial problem that urgently needs to be solved. Summary of the Invention

[0004] The purpose of this application is to provide a network traffic classification method, apparatus, and device based on multi-feature fusion, in order to solve the problem in the prior art that the data sample size for new traffic types is usually insufficient, and deep learning models are prone to overfitting, resulting in poor generalization ability of the model.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a network traffic classification method based on multi-feature fusion, the method comprising:

[0007] Preprocess the traffic data to obtain a traffic grayscale image;

[0008] Select a subset of traffic samples from the grayscale traffic map;

[0009] The generated samples are constructed by simulating a minority class of traffic sample sets using the WGAN model; the WGAN model includes a target generator and a target discriminator.

[0010] The generated samples are added to the traffic grayscale image to form a balanced sample set;

[0011] A balanced sample set is input into the ViT hybrid model to extract features and obtain sequence features; the header of the sequence features is set with a classification label containing location information.

[0012] A target traffic map is obtained by fusing sequence features based on a cross-attention mechanism.

[0013] The target traffic map is classified using a multi-layer perceptron module in the perception layer, and the classification results are obtained. The classification results include application type classification and service type classification.

[0014] Preferably, the specific steps for preprocessing traffic data to obtain a traffic grayscale image include:

[0015] Divide the traffic data into multiple bidirectional session stream files;

[0016] Anonymize the bidirectional session stream file to obtain an anonymous bidirectional session stream file;

[0017] The byte length of traffic in a unified anonymous bidirectional session stream file is used to obtain a bidirectional session stream file of uniform length.

[0018] Convert a uniform-length bidirectional session stream file into a traffic grayscale image.

[0019] Preferably, the specific steps for selecting a minority class of traffic samples from the traffic grayscale image include:

[0020] The distribution of sample quantity for different traffic types in the grayscale traffic map is statistically analyzed to obtain the distribution statistics results.

[0021] Based on the distribution statistics and the preset screening threshold, a minority of traffic sample sets are selected.

[0022] Preferably, the specific steps for constructing and generating samples by simulating a minority class traffic sample set using the WGAN model include:

[0023] Construct an initial WGAN model including an initial generator and an initial discriminator;

[0024] The initial generated samples are constructed by simulating the grayscale structure of the minority class traffic sample set using an initial generator;

[0025] The initial discriminator distinguishes between minority traffic and initially generated samples to obtain the discrimination result;

[0026] Based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model containing a target generator and a target discriminator.

[0027] Generate samples using the target generator in the WGAN model.

[0028] Preferably, based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model containing a target generator and a target discriminator. The specific steps include:

[0029] Calculate the generation loss value based on the noise level, the initial generated samples, and the loss function of the initial generator;

[0030] Calculate the discrimination loss value based on the discrimination result and the loss function of the initial discriminator;

[0031] Based on the generation loss value and the discrimination loss value, the initial generator and the initial discriminator are trained iteratively to obtain the target generator and the target discriminator, thus forming the WGAN model.

[0032] Preferably, the specific steps for inputting a balanced sample set into the ViT mixture model to extract features and obtain sequence features include:

[0033] The balanced sample set is divided into a training set and a test set by stratified sampling.

[0034] The ViT hybrid model is used to segment grayscale images in the training set into multiple segments;

[0035] Multiple segments are arranged into multiple sequences, and then the corresponding feature vectors are obtained after passing through a linear projection layer;

[0036] Positional encoding and classification labels are added to the feature vectors to obtain sequence features.

[0037] Preferably, the specific steps for dividing the balanced sample set into a training set and a test set through stratified sampling include:

[0038] Based on traffic type, the balanced sample set is hierarchically grouped to obtain multiple independent levels;

[0039] Random sampling is performed on multiple independent levels according to a preset ratio to obtain sampled samples;

[0040] The sampled samples are assigned to the training set, and the remaining samples are assigned to the test set.

[0041] Preferably, the specific steps for adding positional encoding and classification labels to the feature vector to obtain sequence features include:

[0042] Add positional encoding to the feature vector to obtain the position-labeled feature vector;

[0043] Arrange all the positional feature vectors into a sequence;

[0044] Add classification labels to the beginning of the sequence to form sequence features.

[0045] Compared with the prior art, the technical solution provided in this application has at least the following beneficial effects:

[0046] This application first preprocesses traffic data to obtain a traffic grayscale image; then selects a minority traffic sample set from the grayscale image; simulates the minority traffic sample set using a WGAN model to construct generated samples; the WGAN model includes a target generator and a target discriminator; the generated samples are added to the traffic grayscale image to form a balanced sample set; the balanced sample set is input into a ViT hybrid model to extract features, obtaining sequence features; the header of the sequence features is set with a classification label containing location information; the sequence features are fused based on a cross-attention mechanism to obtain a target traffic image; the target traffic image is classified using a multilayer perceptron module in the perception layer to obtain classification results; the classification results include application type classification and service type classification. This application can effectively combine global and local features of network traffic data for classification, while achieving lightweight model architecture through reasonable design, improving model accuracy, and effectively handling situations where some traffic types are novel, niche, or have specific application scenarios.

[0047] Secondly, embodiments of this application provide a network traffic classification device based on multi-feature fusion, comprising:

[0048] The data preprocessing module is used to preprocess traffic data to obtain a traffic grayscale image;

[0049] The filtering module is used to filter out a set of minority traffic samples from the traffic grayscale image;

[0050] The sample construction module is used to simulate a minority class traffic sample set using the WGAN model and construct generated samples; the WGAN model includes a target generator and a target discriminator.

[0051] The sample balancing module is used to supplement the generated samples into the traffic grayscale image to form a balanced sample set;

[0052] The feature extraction module is used to input a balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein, the header of the sequence features is set with a classification label containing location information;

[0053] The feature fusion module is used to fuse sequence features based on a cross-attention mechanism to obtain the target traffic map;

[0054] The classification module is used to classify the target traffic map using the multi-layer perceptron module of the perception layer, and obtain the classification results; the classification results include application type classification and service type classification.

[0055] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0056] It is understood that the beneficial effects of the technical solutions provided in the second and third aspects above can be found in the relevant descriptions in the first aspect above, and will not be repeated here.

[0057] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0058] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0059] Figure 1 This is a schematic flowchart of a network traffic classification method based on multi-feature fusion provided in some embodiments of this application;

[0060] Figure 2 This is a schematic diagram of the process structure of a network traffic classification method based on multi-feature fusion provided in some embodiments of this application;

[0061] Figure 3 This is a block diagram illustrating a network traffic classification device based on multi-feature fusion, as shown in some embodiments of this application;

[0062] Figure 4 These are block diagrams illustrating electronic devices according to some embodiments of this application. Detailed Implementation

[0063] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0064] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0065] The following description, in conjunction with the accompanying drawings, details a network traffic classification method based on multi-feature fusion provided in this application through specific embodiments and application scenarios.

[0066] Figure 1 and Figure 2 These are schematic flowcharts and structural diagrams illustrating a network traffic classification method based on multi-feature fusion according to the first embodiment of this application. Please refer to [link / reference]. Figure 1 and Figure 2 The method includes:

[0067] Step S101: Preprocess the traffic data to obtain a traffic grayscale image;

[0068] Specifically, the traffic data is divided into multiple bidirectional session stream files; the bidirectional session stream files are anonymized to obtain anonymous bidirectional session stream files; the byte length of the traffic in the anonymous bidirectional session stream files is standardized to obtain uniform-length bidirectional session stream files; and the uniform-length bidirectional session stream files are converted into traffic grayscale images.

[0069] In one possible implementation, the SplitCap tool is used to segment network traffic in .pcap format into bidirectional session streams based on five-tuple information. This requires that the source IP address, source port, destination IP address, destination port, and transport layer protocol used by the packets be identical, and the session streams are saved in .pcap format. To prevent partial traffic information from affecting experimental performance evaluation, the traffic needs to be anonymized. Each traffic category has a unique IP address in the dataset; if IP addresses and MAC addresses are not removed, the model may overfit.

[0070] To facilitate subsequent model input and processing, this embodiment requires a standardized byte length for the cleaned traffic data. The Maximum Transmission Unit (MTU) in a network defines a maximum packet length of 1500 bytes; this chapter selects 784 bytes as the standard length. The raw traffic is pruned; files exceeding the specified length are cut, while those shorter are padded with 0x00 at the end to reach the required length. Each byte in the session corresponds to a grayscale pixel value; for example, 0x00 represents black, and 0xFF represents white. The session file is then converted into a grayscale image.

[0071] Step S102: Select a minority traffic sample set from the traffic grayscale image;

[0072] Specifically, the distribution of sample quantity of different traffic types in the grayscale traffic map is statistically analyzed to obtain the distribution statistics results; based on the distribution statistics results and the preset screening threshold, a minority traffic sample set is selected.

[0073] In one possible implementation, the distribution of sample numbers for different traffic types is statistically analyzed based on the obtained traffic grayscale image. A few types of traffic samples, such as DNS covert tunnels, Tor anonymous traffic, and malicious IoT traffic, are selected based on a preset threshold (e.g., sample percentage < 5% or absolute number < 1000).

[0074] Step S103: Simulate a minority class traffic sample set using the WGAN model to construct generated samples; wherein, the WGAN model includes a target generator and a target discriminator;

[0075] Specifically, an initial WGAN model including an initial generator and an initial discriminator is constructed; the initial generator is used to simulate the grayscale structure of the minority class traffic sample set to construct initial generated samples; the initial discriminator is used to distinguish between minority class traffic and initial generated samples to obtain the discrimination result; based on the discrimination result, the initial WGAN model is iteratively trained to obtain a WGAN model containing a target generator and a target discriminator; and the target generator in the WGAN model is used to construct generated samples.

[0076] Specifically, based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model containing a target generator and a target discriminator. Specifically, the generation loss value is calculated based on the noise level, the initial generated samples, and the loss function of the initial generator; the discrimination loss value is calculated based on the discrimination results and the loss function of the initial discriminator; and the initial generator and the initial discriminator are iteratively trained based on the generation loss value and the discrimination loss value respectively to obtain the target generator and the target discriminator, thus forming the WGAN model.

[0077] In one possible implementation, when the model is being trained, because the number of minority class samples is too small and accounts for a negligible proportion of the total training data, the model's learning process will overly favor the features of the majority class traffic type, which accounts for a large proportion. When classifying minority class traffic, the model is prone to bias and has difficulty accurately identifying its features, which in turn seriously affects the overall classification performance.

[0078] To effectively address this challenge, this embodiment leverages WGAN to train on minority class samples through a dynamic game between the generator and discriminator. This allows the generator to deeply learn the latent distribution characteristics of minority class samples: based on the input noise vector, the generator simulates the feature structure of the minority traffic grayscale image, gradually constructing images similar to real minority traffic samples. The discriminator, on the other hand, needs to possess keen discriminative ability to distinguish between real and generated samples. Subsequently, the discriminator is fixed, and by minimizing the generator's loss, it is encouraged to generate samples that more closely resemble real data. This process is repeated, and as the training rounds progress, the minority traffic samples generated by the generator become increasingly realistic, gradually supplementing the original dataset. This significantly increases the proportion of minority class samples in the dataset, effectively alleviating the data imbalance problem and providing a more balanced and richer data foundation for subsequent model training. This significantly improves the model's classification accuracy and generalization ability for various traffic types.

[0079] It's worth noting that, compared to traditional GANs, which suffer from pattern collapse and training instability during training, limiting their widespread application, WGAN introduces the Wasserstein distance (also known as Earth-Mover distance, used to represent the similarity between two distributions) to measure the difference between the data distribution and the generator's distribution. The core idea is to replace the traditional GAN's loss function with a function that minimizes the Wasserstein distance. This distance provides a smoother gradient signal to the generator because it considers the "quality" and distance of the shift required to transform one distribution into another, offering significant advantages when the two distributions have little or no overlap.

[0080] The generator G loss function of WGAN is:

[0081]

[0082] The discriminant D loss function of WGAN is:

[0083]

[0084] in, This represents the loss value of the WGAN generator; This represents the loss value of the discriminator; This represents the discriminator's score for the real data x; This indicates that the discriminator is responsible for the generated data. The goal is to maximize this loss to increase the Wasserstein distance between the real and generated data. This indicates that for real data x in its distribution Expectations; This indicates the distribution of the generator noise input z. The expectation is that data is generated by sampling noise z. The mean of its discriminator score is calculated to measure the "authenticity" of the generated data.

[0085] For the Wasserstein distance estimation to be effective, the discriminator D must satisfy the K-Lipschitz condition, that is, for any input x, y, we have In practice, this constraint is often achieved through weight pruning or gradient penalty techniques.

[0086] In iterative training, the discriminator D is first updated while the generator G is fixed. The discriminator parameters are then updated according to the loss function and K-Lipschitz constraints described above. Next, the generator G is updated: with the discriminator D fixed, the parameters are minimized... Update the generator parameters to make G generate samples that are closer to real data.

[0087] Step S104: Add the generated samples to the traffic grayscale image to form a balanced sample set;

[0088] It's important to note that after data augmentation using WGAN, the minority class samples in the imbalanced dataset have had their number expanded. The original majority class samples are then merged with the generated minority class samples to form a more balanced dataset with a more even class distribution. The balanced dataset offers a dual advantage: firstly, the majority class samples retain the statistical characteristics of mainstream traffic, providing a foundation for model classification; secondly, the generated minority class samples, by simulating rare patterns in real-world scenarios, force the model to learn more discriminative features.

[0089] Step S105: Input the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein, the header of the sequence features is set with a classification label containing location information;

[0090] Specifically, the balanced sample set is divided into a training set and a test set through stratified sampling; the grayscale images in the training set are segmented into multiple segments based on the ViT hybrid model; the multiple segments are arranged into multiple sequences and then passed through a linear projection layer to obtain the corresponding feature vectors; positional encoding and classification labels are added to the feature vectors to obtain sequence features.

[0091] Specifically, the balanced sample set is divided into a training set and a test set through stratified sampling. Specifically, the balanced sample set is stratified and grouped according to traffic type to obtain multiple independent levels; random sampling is performed on each of the multiple independent levels according to a preset ratio to obtain sampled samples; the sampled samples are assigned to the training set, and the remaining samples are assigned to the test set.

[0092] Specifically, positional encoding and classification labels are added to the feature vectors to obtain sequence features. Specifically, positional encoding is added to the feature vectors to obtain positional feature vectors; all positional feature vectors are arranged into a sequence; and classification labels are added to the beginning of the sequence to form sequence features.

[0093] In one possible implementation, after data augmentation is completed and a balanced dataset is formed, this embodiment divides it into a training set and a test set through stratified sampling. Then, the ViT-MobileNetV2 hybrid model is trained based on the training set, and the classification effect is verified using the test set.

[0094] First, stratified sampling is used to divide the training and test sets. All samples in the balanced dataset are grouped stratified by traffic type, ensuring each traffic category is an independent stratum. For example, if the dataset contains 10 traffic categories, with 8 being the majority (≥5%) and 2 being the minority (originally <5% but increased after enhancement), each category is considered an independent stratum. Next, for samples within each stratum, random sampling is performed at a fixed ratio (e.g., 8:2). For each traffic category, the total number of samples N is calculated, and 0.8 × N samples are randomly selected for the training set, with the remaining 0.2 × N samples allocated to the test set. This method ensures that the traffic distribution proportions in the training and test sets are completely consistent with the balanced dataset, avoiding category distribution shifts caused by random partitioning.

[0095] Specifically, during model training, the ViT hybrid model divides the grayscale images in the training set into n segments, arranges these n segments into a sequence, and passes them through a linear projection layer to obtain a feature vector. Since the self-attention mechanism involves pairwise interactions between all elements, a positional encoding method is added. With positional encoding, the overall feature vector contains both the original information of the image segments and their positional information. After obtaining the feature vector, it is kept consistent with the input structure of the original converter model and directly sent to the converter encoding module to obtain multiple outputs. The ViT hybrid model borrows from the BERT model by adding a classification label to the feature vector, with its positional encoding set to 0. Because each feature vector interacts with other feature vectors, this classification label can learn useful information from other feature vectors, allowing for judgment based solely on the output of this classification label. The MLP Head is a general classification module, and finally, the cross-entropy function is used for model training.

[0096] Step S106: Fuse sequence features based on cross-attention mechanism to obtain target traffic map;

[0097] The transformer encoding layer of the ViT hybrid model consists of multiple encoding modules. The multi-head attention mechanism in the encoding modules helps the model extract rich features from different subspaces by computing multiple attention score matrices in parallel, as shown in the following formula:

[0098]

[0099] Where 0 < i ≤ h, h represents the number of "heads" in the multi-head attention mechanism; These are the query matrix, key matrix, and value matrix, respectively, all derived from linear transformations of the input vector; The dimension of the key vector. It is a learnable parameter matrix.

[0100] Compared to CNNs, ViT hybrid models lack image-specific inductive biases. For example, in CNN models, locality and translation invariance are present in every layer, meaning this prior knowledge permeates the entire model. However, in ViT hybrid models, locality and translation invariance are only present in the MLP layers, while the self-attention layers are global. This lack of locality means that the property that adjacent regions in an image should have more similar features is not fully utilized, hindering the network's ability to learn and express image information features. This limits its ability to comprehensively capture and accurately classify features in network traffic classification tasks.

[0101] This invention proposes to combine the lightweight CNN architecture MobileNetV2 with ViT. MobileNetV2 itself is designed to reduce parameters and computational complexity; for example, the use of depthwise separable convolutions significantly reduces the computational cost and number of parameters required for traditional convolutions. MobileNetV2 primarily introduces linear bottleneck structures and inverse residual structures to optimize the network, resulting in a deeper network while maintaining a smaller model size and faster speed. The MobileNetV2 network model has a total of 17 bottleneck layers, one standard convolutional layer, two pointwise convolutional layers, and a total of 54 trainable parameter layers.

[0102] Step S107: Use the multi-layer perceptron module of the perception layer to classify the target traffic map and obtain the classification results; the classification results include application type classification and service type classification.

[0103] After the model training is completed and classified by service type and application type, this step will use a test set for classification verification. The improved model, through multi-feature fusion of ViT and MobileNetV2, can significantly enhance the ability to distinguish between encrypted and unencrypted traffic and the fine-grained identification effect of various applications: At the service type level, the model can capture the global temporal features of encrypted traffic (such as long connection stability and traffic burst patterns) through ViT, and can also extract the high entropy characteristics of local bytes (such as the random distribution characteristics of encrypted payloads) with the help of MobileNetV2, which greatly improves the accuracy of encrypted traffic identification and reduces false alarms where unencrypted traffic is misclassified as encrypted traffic; At the application type level, the model can significantly improve the recall rate of a few types of traffic such as Tor anonymous traffic and DNS covert tunnels, greatly reduce the false positive rate, and effectively identify new types of encrypted traffic not labeled in the training set. Combined with the high-efficiency computing performance brought by the lightweight design, it realizes the dynamic management of network resources and accurate response to security defense, providing accurate and real-time technical support for traffic classification and optimization in complex network environments.

[0104] The network traffic classification method based on multi-feature fusion provided in the above embodiments addresses the challenge of insufficient data for newly emerging network traffic types in real-world network environments. This can easily lead to inadequate learning of minority class traffic features during training, thus affecting classification accuracy and the model's generalization ability. This invention utilizes WGAN technology for data augmentation, generating samples similar to the minority class and integrating them into the dataset, significantly increasing the proportion of minority class samples in the dataset. In this way, the classification model can fully access and learn the feature information of minority class traffic during training, avoiding classification bias caused by data imbalance. When facing complex and ever-changing network environments, the model is no longer limited to learning the features of the majority class traffic but can comprehensively and evenly learn the features of all types of traffic, thereby greatly improving the classification accuracy of various traffic types and enhancing the model's generalization ability in different network scenarios, enabling it to more stably and reliably cope with the challenges of various unknown traffic types.

[0105] Secondly, this embodiment strengthens feature fusion and model performance optimization by designing a lightweight ViT-MobileNet hybrid model. This model organically combines the powerful global feature capture capability of the ViT hybrid model with the superior local feature extraction capability of MobileNet through a dual-branch architecture. The ViT hybrid model can grasp the overall trend and global correlation of network traffic data from a macroscopic perspective, while MobileNet focuses on mining detailed features such as the local structure of data packets and traffic changes within specific time periods. The two complement each other, enabling the model to learn network traffic feature information comprehensively and at multiple levels. Furthermore, after fusing ViT and MobileNet, a pruning operation is performed on the hybrid model to accurately remove redundant parts. This operation significantly reduces the number of parameters and computational complexity while maintaining model performance, achieving a lightweight model. The lightweight model significantly improves its operating efficiency, enabling it to process large-scale network traffic data more efficiently. It also enhances the model's adaptability, ensuring stable and efficient traffic classification under different network environments and traffic types, providing stronger and more reliable technical support for network traffic classification tasks.

[0106] It should be noted that the network traffic classification method based on multi-feature fusion provided in this application embodiment can be executed by a network traffic classification device based on multi-feature fusion, or by a control module within that device for executing the loading of the network traffic classification method based on multi-feature fusion. This application embodiment uses the execution of the loading of the network traffic classification method based on multi-feature fusion by a network traffic classification device based on multi-feature fusion as an example to illustrate the network traffic classification device based on multi-feature fusion provided in this application embodiment.

[0107] Figure 3 This is a schematic diagram of a network traffic classification device based on multi-feature fusion according to the second embodiment of this application. Please refer to [link / reference]. Figure 3 The network traffic classification device 200 based on multi-feature fusion includes:

[0108] Data preprocessing module 201: preprocesses the traffic data to obtain a traffic grayscale image;

[0109] Specifically, the traffic data is divided into multiple bidirectional session stream files; the bidirectional session stream files are anonymized to obtain anonymous bidirectional session stream files; the byte length of the traffic in the anonymous bidirectional session stream files is standardized to obtain uniform-length bidirectional session stream files; and the uniform-length bidirectional session stream files are converted into traffic grayscale images.

[0110] Filtering module 202: Used to filter out a set of minority traffic samples from the traffic grayscale image;

[0111] Specifically, the distribution of sample quantity of different traffic types in the grayscale traffic map is statistically analyzed to obtain the distribution statistics results; based on the distribution statistics results and the preset screening threshold, a minority traffic sample set is selected.

[0112] Sample construction module 203: used to simulate a minority class traffic sample set using the WGAN model and construct generated samples; wherein, the WGAN model includes a target generator and a target discriminator;

[0113] Specifically, an initial WGAN model including an initial generator and an initial discriminator is constructed; the initial generator is used to simulate the grayscale structure of the minority class traffic sample set to construct initial generated samples; the initial discriminator is used to distinguish between minority class traffic and initial generated samples to obtain the discrimination result; based on the discrimination result, the initial WGAN model is iteratively trained to obtain a WGAN model containing a target generator and a target discriminator; and the target generator in the WGAN model is used to construct generated samples.

[0114] Specifically, based on the discrimination results, the initial WGAN model is iteratively trained to obtain a WGAN model containing a target generator and a target discriminator. Specifically, the generation loss value is calculated based on the noise level, the initial generated samples, and the loss function of the initial generator; the discrimination loss value is calculated based on the discrimination results and the loss function of the initial discriminator; and the initial generator and the initial discriminator are iteratively trained based on the generation loss value and the discrimination loss value respectively to obtain the target generator and the target discriminator, thus forming the WGAN model.

[0115] Sample balancing module 204: used to supplement the generated samples into the traffic grayscale image to form a balanced sample set;

[0116] Feature extraction module 205: used to input a balanced sample set into the ViT mixture model to extract features and obtain sequence features; wherein, the header of the sequence features is set with a classification label containing position information;

[0117] Specifically, the balanced sample set is divided into a training set and a test set through stratified sampling; the grayscale images in the training set are segmented into multiple segments based on the ViT hybrid model; the multiple segments are arranged into multiple sequences and then passed through a linear projection layer to obtain the corresponding feature vectors; positional encoding and classification labels are added to the feature vectors to obtain sequence features.

[0118] Specifically, the balanced sample set is divided into a training set and a test set through stratified sampling. Specifically, the balanced sample set is stratified and grouped according to traffic type to obtain multiple independent levels; random sampling is performed on each of the multiple independent levels according to a preset ratio to obtain sampled samples; the sampled samples are assigned to the training set, and the remaining samples are assigned to the test set.

[0119] Specifically, positional encoding and classification labels are added to the feature vectors to obtain sequence features. Specifically, positional encoding is added to the feature vectors to obtain positional feature vectors; all positional feature vectors are arranged into a sequence; and classification labels are added to the beginning of the sequence to form sequence features.

[0120] Feature fusion module 206: used to fuse sequence features based on cross-attention mechanism to obtain target traffic map;

[0121] Classification module 207: Used to classify the target traffic map using the multi-layer perceptron module of the perception layer, and obtain the classification results; the classification results include application type classification and service type classification.

[0122] The network traffic classification device based on multi-feature fusion in this application embodiment can be a device, or it can be a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0123] The network traffic classification device based on multi-feature fusion in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0124] The network traffic classification device based on multi-feature fusion provided in this application embodiment can achieve... Figures 1 to 2 The various processes implemented by the network traffic classification device based on multi-feature fusion in the method embodiment will not be described again here to avoid repetition.

[0125] Optionally, please refer to Figure 4This application also provides an electronic device 300, including a processor 301, a memory 302, and a computer program 303 stored in the memory 302 and executable on the processor 301. When the computer program 303 is executed by the processor 301, it implements the various processes of the above-described network traffic classification method based on multi-feature fusion and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0126] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described network traffic classification method based on multi-feature fusion and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0127] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0128] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described network traffic classification method embodiment based on multi-feature fusion, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0129] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0130] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0131] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0132] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A network traffic classification method based on multi-feature fusion, characterized in that, include: Preprocess the traffic data to obtain a traffic grayscale image; A minority of traffic sample sets are selected from the traffic grayscale image; The minority class traffic sample set is simulated using a WGAN model to construct generated samples. The WGAN model includes a target generator and a target discriminator. Specifically, this includes: constructing an initial WGAN model including an initial generator and an initial discriminator; using the initial generator to simulate the grayscale structure of the minority class traffic sample set to construct initial generated samples; using the initial discriminator to distinguish between the minority class traffic and the initial generated samples to obtain a discrimination result; iteratively training the initial WGAN model based on the discrimination result to obtain a WGAN model containing a target generator and a target discriminator; and using the target generator in the WGAN model to construct generated samples. The generated samples are added to the traffic grayscale image to form a balanced sample set; The balanced sample set is input into the ViT hybrid model to extract features and obtain sequence features; wherein, the header of the sequence features is set with a classification label containing positional information; The target traffic map is obtained by fusing the sequence features based on the cross-attention mechanism. The target traffic map is classified using a multi-layer perceptron module in the perception layer to obtain classification results; the classification results include application type classification and service type classification.

2. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The specific steps for preprocessing the traffic data to obtain a traffic grayscale image include: The traffic data is divided into multiple bidirectional session stream files; The bidirectional session stream file is anonymized to obtain an anonymous bidirectional session stream file; The byte length of the traffic in the anonymous bidirectional session stream file is unified to obtain a bidirectional session stream file of uniform length; The uniform-length bidirectional session stream file is converted into a traffic grayscale image.

3. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The specific steps for selecting a minority traffic sample set from the traffic grayscale image include: The distribution of sample quantity for different traffic types in the grayscale traffic image is statistically analyzed to obtain the distribution statistics results. Based on the distribution statistics and the preset screening threshold, a minority traffic sample set is selected.

4. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The specific steps for iteratively training the initial WGAN model based on the discrimination result to obtain a WGAN model containing a target generator and a target discriminator include: The generation loss value is calculated based on the noise level, the initial generated samples, and the loss function of the initial generator; Calculate the discrimination loss value based on the discrimination result and the loss function of the initial discriminator; Based on the generation loss value and the discrimination loss value, the initial generator and the initial discriminator are trained iteratively to obtain the target generator and the target discriminator, thereby forming the WGAN model.

5. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The specific steps for inputting the balanced sample set into the ViT hybrid model to extract features and obtain sequence features include: The balanced sample set is divided into a training set and a test set by stratified sampling. The grayscale images in the training set are segmented into multiple segments based on the ViT hybrid model. The multiple segments are arranged into multiple sequences, and the corresponding feature vectors are obtained after passing through a linear projection layer; Positional encoding and classification labels are added to the feature vector to obtain sequence features.

6. The network traffic classification method based on multi-feature fusion according to claim 5, characterized in that, The specific steps of dividing the balanced sample set into a training set and a test set through stratified sampling include: Based on traffic type, the balanced sample set is hierarchically grouped to obtain multiple independent levels; Random sampling is performed on each of the multiple independent levels according to a preset ratio to obtain sampled samples; The sampled samples are assigned to the training set, and the remaining samples are assigned to the test set.

7. The network traffic classification method based on multi-feature fusion according to claim 5, characterized in that, The specific steps for adding positional encoding and classification labels to the feature vector to obtain sequence features include: Add positional encoding to the feature vector to obtain the position label feature vector; Arrange all the positional feature vectors into a sequence; A classification label is added to the beginning of the sequence to form sequence features.

8. A network traffic classification device based on multi-feature fusion, used to execute the network traffic classification method based on multi-feature fusion as described in any one of claims 1-7, characterized in that, include: The data preprocessing module is used to preprocess traffic data to obtain a traffic grayscale image; The filtering module is used to filter out a set of minority traffic samples from the traffic grayscale image; A sample construction module is used to simulate the minority class traffic sample set using a WGAN model to construct generated samples. The WGAN model includes a target generator and a target discriminator. Specifically, it includes: constructing an initial WGAN model including an initial generator and an initial discriminator; using the initial generator to simulate the grayscale structure of the minority class traffic sample set to construct initial generated samples; using the initial discriminator to distinguish between the minority class traffic and the initial generated samples to obtain a discrimination result; iteratively training the initial WGAN model based on the discrimination result to obtain a WGAN model containing a target generator and a target discriminator; and using the target generator in the WGAN model to construct generated samples. The sample balancing module is used to supplement the generated samples into the traffic grayscale image to form a balanced sample set; The feature extraction module is used to input the balanced sample set into the ViT hybrid model to extract features and obtain sequence features; wherein, the header of the sequence features is provided with a classification label containing positional information; The feature fusion module is used to fuse the sequence features based on a cross-attention mechanism to obtain the target traffic map; The classification module is used to classify the target traffic map using the multi-layer perceptron module of the perception layer to obtain classification results; the classification results include application type classification and service type classification.

9. An electronic device, characterized in that, include: The memory, the processor, and the program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, are the steps of the network traffic classification method based on multi-feature fusion as described in any one of claims 1-7.

Images