Multi-segment bts former intelligent identification method for bidirectional flow

Abstract

The application discloses a kind of multi-segment BTSFormer intelligent identification methods for double flow, belong to network security and flow identification field.The application is by fixed window and is divided into communication stage sub-section by packet length sequence, respectively, and global semantic modeling between sections is carried out.In section, embedded layer and multilayer Bi-GRU are used to extract context features, and CLS Token is introduced between sections and the behavior semantics of each section are fused using multi-head self-attention mechanism MSA to generate a global feature vector at the flow level to input the classifier, realizing the application class determination of encrypted traffic;In the training phase, cross-entropy loss is combined with L2 regularization for optimization to ensure the model generalization ability and convergence.The application is based on only the observable packet length sequence during encrypted communication process for modeling, and does not depend on plaintext content, IP address or port number, with privacy protection and deployment versatility;The model structure is lightweight, clear, and can be deployed on edge devices or security gateways, supporting real-time traffic identification and high-concurrency scenarios.

Description

Technical Field

[0001] This invention relates to the field of network security and traffic identification, and in particular to an intelligent identification method for encrypted network traffic, which falls under the category of privacy-preserving traffic classification and network monitoring technology. Background Technology

[0002] With the widespread deployment of network encryption technology and the increasing awareness of personal privacy protection, more and more network communications are shifting to transmission based on encryption protocols. Mainstream protocols such as HTTPS, QUIC, and TLS are gradually replacing traditional plaintext protocols as the default form of internet data exchange. Statistics show that over 90% of internet traffic currently uses some form of end-to-end encryption. While this trend effectively protects the confidentiality and integrity of user data, it also brings a growing challenge: traditional network traffic identification technologies face serious failures in encrypted scenarios. Network security systems, auditing platforms, and service identification engines urgently need new technological means to achieve visualization and intelligent identification of encrypted traffic.

[0003] Network traffic identification technology is a prerequisite for achieving a series of critical network security tasks, including intrusion detection, QoS management, access control, content filtering, and behavior auditing. In unencrypted network environments, traffic identification typically relies on Deep Packet Inspection (DPI) or rule-based matching methods based on protocol fields. By analyzing application-layer fields, keywords, IP port numbers, or characteristic patterns in data packets, the system can accurately determine the application type or user behavior to which the communication flow belongs. However, these methods have gradually lost their effectiveness with the widespread adoption of encryption protocols: encrypted communication hides the plaintext content of the application layer, and ports and IPs often cannot provide stable identifiers, thus rendering the DPI mechanism ineffective in parsing content.

[0004] To address this challenge, researchers have increasingly turned to using "non-encrypted" metadata for traffic identification. Metadata refers to structured information in the communication process, such as packet length, arrival time, transmission direction, and flow duration; this information can still be observed even in encrypted channels. In recent years, metadata-based traffic identification methods have developed rapidly and can be mainly categorized as follows:

[0005] (1) Statistical feature-based methods: These methods typically extract statistical metrics from network flows, such as maximum / minimum packet length, average transmission rate, and first packet latency, and use traditional machine learning models such as random forests, support vector machines, and K-nearest neighbors (KNN) for classification. These methods are computationally simple and suitable for online deployment, but they are highly dependent on feature engineering, have poor adaptability to different applications or protocol changes, and are easily susceptible to adversarial feature perturbation attacks.

[0006] (2) End-to-end modeling methods based on deep learning: With the development of neural networks, researchers have attempted to use models such as Multilayer Perceptron (MLP), Convolutional Neural Network (CNN), and Recurrent Neural Network (RNN) to learn from the original packet sequences, reducing the reliance on manually designed features. Among them, CNN can extract local spatial features, and Long Short-Term Memory (LSTM) is suitable for modeling temporal dependencies in sequences. These methods have improved the accuracy of encrypted traffic identification to some extent, but because the models usually model the complete sequence and lack an understanding of phased behavioral changes, they are susceptible to interference from information redundancy and the diversity of flow patterns in complex scenarios.

[0007] (3) Graph Neural Network-Based Structural Modeling Methods: In recent years, some studies have constructed network flows as graph structures and used graph neural networks such as GCN and GAT to model the relationships between flows. These methods can capture the correlation of application behaviors at a higher level of abstraction, but in real-world scenarios, it is difficult to accurately construct the graph structure between flows, and the computational resource overhead is large, resulting in high deployment complexity. In addition, the key premise of graph structure modeling still relies on shared identifiers or behavioral similarities between flows, which is unstable in contexts such as privacy communication, short-stream or peer-to-peer transmission.

[0008] Furthermore, to overcome the problem of data scarcity, some works have introduced data augmentation strategies, such as simulated sample construction, generative adversarial networks (GANs), or the more recent LLM-based synthetic labeling methods. Although these methods can improve the generalization ability of the models, the authenticity and confidentiality of the traffic generated in highly encrypted contexts still face risks.

[0009] From a practical deployment perspective, network operators and security service providers tend to prefer a traffic identification scheme with the following characteristics: (1) It does not rely on plaintext content and is compatible with end-to-end encrypted environments; (2) It does not require highly complex data reconstruction or graph structure generation and consumes low computing resources; (3) It can process high-frequency and high-speed data streams in the network in real time; (4) It has good task generalization ability and is suitable for various tasks such as application identification, anomaly detection, and attack identification.

[0010] Current technologies have not yet been able to simultaneously address the needs of all these aspects, especially in terms of how to fully extract the phased behavioral characteristics of lightweight data (such as packet length sequences), where a systematic solution is still lacking. Although packet length information is simple, it exhibits strong semantic differences in different communication phases (such as handshake, data transmission, and connection termination). If its temporal structure can be precisely modeled and combined with global contextual information, it has the potential to significantly improve the identification accuracy of encrypted traffic.

[0011] Therefore, there is an urgent need for a new method for identifying encrypted traffic that can fully utilize the phased feature information contained in the packet length sequence while keeping computation and transmission overhead low, extract communication behavior representation through end-to-end deep modeling, and achieve efficient and accurate identification of multiple types of traffic in encrypted environments. Summary of the Invention

[0012] To address the aforementioned problems in existing technologies, this invention provides a multi-segment BTSFormer intelligent identification method for dual-traffic. Starting from observable lightweight features in encrypted communication, this invention utilizes packet length as the core information source to construct a structured, phased-modeling neural network identification framework, abbreviated as BTSFormer (Bidirectional Temporal Segments + Transformer). This framework enables in-depth modeling and efficient discrimination of behavioral patterns at different stages of encrypted traffic. Addressing the lack of visibility in the current network landscape with its large volume of encrypted communication traffic, this method accurately classifies the applications or communication behaviors associated with encrypted traffic without parsing encrypted data content or relying on plaintext fields. It is suitable for network application identification, anomaly detection, and attack traffic classification tasks in end-to-end encrypted environments.

[0013] The technical solution of the present invention is as follows:

[0014] A method for intelligent identification of multi-segment BTSFormer with dual traffic includes the following steps:

[0015] Step S1: Capture the length information of bidirectional data packets from network traffic and construct a packet length sequence that includes both uplink and downlink directions;

[0016] Step S2: Perform segmentation on the constructed packet length sequence according to a fixed window size to generate multiple sub-segment sequences;

[0017] Step S3: Input each sub-segment into the deep feature extraction model and perform linear projection. Perform intra-segment temporal modeling and inter-segment global dependency modeling respectively to generate a high-dimensional semantic feature vector representing the entire network flow.

[0018] Step S4: Load the high-dimensional semantic feature vector into the classifier outputting the corresponding predicted category for application recognition or anomaly detection.

[0019] Preferably, the upward or downward direction attribute of the packet length sequence in step S1 is defined using positive or negative values:

[0020]

[0021] in This indicates the length of the upstream data packet sent from the source node to the destination node. Indicates the length of the downlink data packet sent from the destination node to the source node;

[0022] Preferably, the packet length sequence in step S1 is generated by capturing encrypted network traffic data in real time using a lightweight monitoring module, which includes: a programmable switch and a network acquisition node;

[0023] Furthermore, the lightweight monitoring module described in step S1 is deployed on a programmable switch or network acquisition node to collect encrypted traffic data in network communication in real time, extract the complete packet length sequence in each network flow, and construct a bidirectional packet length vector sequence.

[0024] Preferably, when performing the segmentation process in step S2, zero-padding is used to fill in any ends whose length is less than the fixed window size.

[0025] Preferably, each segment sequence in step S2 corresponds to a semantic stage in the communication process, including: handshake stage, data transmission stage, and release stage;

[0026] Furthermore, the segmentation process described in step S2 divides the complete packet length sequence captured in the network stream into segments of a fixed window size M. Each segment corresponds to a semantic stage in the communication process, such as the handshake stage, data transmission stage, and release stage, thereby transforming the long sequence structure into several subsequences with stage-specific behavioral characteristics. This segmentation mechanism not only improves the accuracy of local modeling but also provides controllable-granularity modeling units for subsequent modules.

[0027] Preferably, the deep feature model in step S3 includes: a projection layer, an intra-segment feature extraction module, and an inter-segment feature extraction module;

[0028] The specific method for step S3 is as follows:

[0029] (1) Each segment sequence is linearly projected through the projection layer of the deep feature extraction model and embedded into a high-dimensional feature space of dimension D;

[0030] (2) Perform intra-segment temporal modeling, and use multi-level segment-level coding blocks to extract intra-segment features. Each coding block contains a bidirectional gated recurrent unit (GRU), a residual connection and a layer normalization module.

[0031] (3) Perform global dependency modeling between segments, flatten and linearly transform the segment-level output to generate segment representation vectors of a unified dimension, introduce global classification marker CLS Token, and combine all segment representation vectors into the multi-head self-attention mechanism module to generate high-dimensional semantic feature vectors representing the entire network flow.

[0032] Furthermore, in step S3, a bidirectional gated recurrent neural network (Bi-GRU) is used to deeply extract the temporal features of the sequence, and combined with residual connections and layer normalization mechanisms to improve the modeling stability and expressive power. The output embedding results of each segment are flattened and linearly transformed to obtain a segment-level representation vector of uniform length, which serves as the input for global modeling.

[0033] Furthermore, in step S3, to further capture the behavioral dependencies between different communication stages, a global aggregation token CLS Token and a multi-head self-attention mechanism are introduced to construct a modeling path for inter-segment context. All segment representations and CLS Tokens are used as input, and after positional encoding to enhance their order information, global behavioral semantics are fused through the attention mechanism. The output of CLS Token serves as the semantic representation of the entire packet length sequence in a high-dimensional space, which can be fed into a classifier to complete the final application recognition or anomaly detection task.

[0034] Preferably, the classifier in step S4 is based on a single-layer feedforward neural network structure, with the input being a high-dimensional semantic feature vector generated by CLS Token and the output being the predicted probability of the application category or behavior tag to which the encrypted traffic belongs.

[0035] Preferably, in step S4, the classifier uses a single-layer feedforward neural network model with cross-entropy loss as the optimization objective during the training phase, and introduces an L2 regularization term to improve the model's generalization ability. The loss function is as follows:

[0036]

[0037] in Here, Y represents the model prediction result, Θ represents the model parameters, and λ represents the regularization coefficient.

[0038] Preferably, the single-layer feedforward neural network model used by the classifier in step S4 is trained using an adaptive optimization algorithm. During the training process, a learning rate decay mechanism and an early stopping strategy are combined to prevent overfitting and improve training efficiency.

[0039] Furthermore, in the classifier model output stage of step S4, a single-layer feedforward neural network is used to map the CLS representation to a specific classification space. This is optimized using the cross-entropy loss function, and an L2 regularization term is introduced to constrain the model parameter size, thereby reducing the risk of overfitting. During the model training stage, an early stopping strategy and a learning rate reduction mechanism are combined to ensure that the model achieves high accuracy while maintaining good convergence speed and robustness. After training, the model is deployed on the PyTorch framework, supporting standardized API calls, adapting to multi-threaded inference scenarios, and possessing strong engineering feasibility.

[0040] Furthermore, the classifier training model described in step S4 is ultimately deployed in the online identification system, which can realize automatic identification and response to the application, behavior type, or abnormal state of unknown encrypted communication streams;

[0041] Furthermore, the intelligent identification method uses only the "packet length sequence" as the core input, abandoning the reliance of traditional traffic identification methods on information such as plaintext metadata, port number, IP address, and packet content. It has stronger privacy protection capabilities and protocol independence, and is suitable for privacy-friendly identification tasks in encrypted traffic environments.

[0042] Furthermore, the intelligent identification method, through packet length sequence-driven modeling, effectively achieves high-precision identification of encrypted traffic application or behavior types while maintaining data privacy and system lightweightness. It is applicable to various practical deployment environments such as smart gateways, intrusion detection systems, and network auditing platforms, and has significant practical value and industrial promotion prospects.

[0043] Furthermore, the BTSFormer model possesses advantages such as end-to-end compatibility, lightweight design, and clear structure; and it significantly outperforms existing statistical feature models, deep neural network models, and graph neural network models on multiple public datasets: achieving accuracies of 0.9287, 0.9750, and 0.8790 on the Application, MedBIoT, and USTC-TFS datasets, respectively, all of which are currently the best; compared to traditional statistical methods, it improves accuracy by 8.61% in encrypted anomaly detection tasks; compared to mainstream GNN models such as GCN and GAT, it improves accuracy by approximately 10.5% and 7.02%, respectively; moreover, this model exhibits extremely high stability and versatility in different tasks, making it a representative high-performance identification scheme in current encrypted communication scenarios.

[0044] The present invention also provides an application based on the intelligent recognition method, wherein the classifier in step S4 is deployed in an analysis system or recognition system based on the PyTorch framework, and provides real-time inference services to the outside world through a standardized API interface for use in edge gateways, intrusion detection systems or cloud security platforms.

[0045] The beneficial technical effects of this invention are as follows:

[0046] (1) Strong privacy protection, fully applicable to encrypted traffic scenarios: This invention does not require accessing plaintext content or decrypting any data. It only relies on the observable packet length information in encrypted traffic for identification. It naturally supports mainstream encryption protocols such as HTTPS, TLS, and QUIC. It has strong privacy friendliness and deployment versatility, and is especially suitable for network environments with strict privacy or compliance requirements.

[0047] (2) Introducing a phase modeling mechanism to improve recognition accuracy and robustness: By dividing the packet length sequence into sub-segments corresponding to the communication phase and modeling each phase independently, this invention can capture the differences between handshake, data transmission, disconnection and other behavioral patterns in encrypted communication in a more refined manner, effectively improving the model's recognition accuracy for complex applications and abnormal behaviors, while enhancing its adaptability to different communication styles and data packet rhythms.

[0048] (3) End-to-end structural design avoids manual feature dependence and has stronger generalization ability: This invention adopts an end-to-end deep model architecture, which integrates GRU structure and self-attention mechanism. Without the need for manual design of statistical features, it automatically learns the temporal features and global relationships in encrypted traffic, which solves the problems of heavy dependence on feature engineering and difficult transfer in traditional methods. It has shown good adaptability in multiple tasks (application identification, attack detection, anomaly identification).

[0049] (4) Lightweight and efficient, suitable for deployment in online recognition systems: Compared with solutions based on graph structures or complex deep stacking models, this invention only relies on the packet length vector for feature input and maintains a modular and low-redundancy design in the modeling structure, significantly reducing the number of model parameters and computational resource consumption. The model has fast inference speed and low response latency, making it suitable for deployment in edge devices, smart gateways, or real-time security monitoring platforms.

[0050] (5) The experimental verification is sufficient, and the recognition performance is significantly better than existing methods: On multiple public datasets (Application, MedBIoT, USTC-TFS), the BTSFormer model proposed in this invention achieves the best recognition accuracy to date, with the highest reaching 0.9750. It shows significant improvement over traditional statistical models, deep neural network models and graph neural network models, and the accuracy remains above 87% in all tasks, demonstrating strong stability and practical usability. Attached Figure Description

[0051] Figure 1 This is a flowchart illustrating the multi-segment BTSFormer intelligent recognition method for dual-flow proposed in this invention, used to demonstrate the overall processing from data acquisition, sequence segmentation, feature extraction to classification output;

[0052] Figure 2 This is a schematic diagram of the BTSFormer model proposed in this invention, used to illustrate the specific components and information flow of intra-segment feature extraction and inter-segment attention mechanisms in the segmented modeling structure. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0054] It should be noted that in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention. Those skilled in the art can understand the specific meaning of the above terms in the present invention according to the specific circumstances.

[0055] Furthermore, the technical solutions of the various embodiments of the present invention can be combined with each other, but only if they are feasible for those skilled in the art. If the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0056] Example 1:

[0057] This embodiment provides a method for intelligent identification of multi-segment BTSFormer for dual-traffic systems. The specific process is as follows: Figure 1 As shown.

[0058] Step S1: Data acquisition. Capture the length information of bidirectional data packets from network traffic and construct a packet length sequence that includes both uplink and downlink directions.

[0059] This step uses a lightweight monitoring module deployed on a programmable switch or network acquisition node to collect encrypted traffic data from network communications in real time, extract the complete packet length sequence from each network flow, and construct a bidirectional packet length vector sequence. Positive values ​​represent the length of uplink traffic packets, and negative values ​​represent the length of downlink traffic packets. The specific steps are as follows:

[0060] (1) Deploy a network traffic acquisition module to monitor encrypted communication flows in the target network environment in real time. The acquisition module can be deployed in a programmable switch, edge node, or server front-end device to collect data packet-level information passing through the device.

[0061] (2) For each network flow, extract the complete packet length sequence from the flow and construct a bidirectional packet length sequence by combining it with the transmission direction of the data packets. in This indicates the length of the data packet sent from the source node to the destination node in the uplink direction. This indicates the length of the downlink data packet sent from the destination node to the source node, thus encoding uplink and downlink communication behavior without relying on plaintext information.

[0062] Step S2: Sequence segmentation. The constructed packet length sequence is segmented according to a fixed window size to generate multiple sub-segment sequences.

[0063] This step divides the original packet-length sequence into segments of a fixed length M, obtaining a set of segmented sub-segments. Segments shorter than the required length are then zero-padded to ensure consistent dimensionality across all segments. The specific steps are as follows:

[0064] (1) The original packet length sequence Divide the window into several segments according to a fixed window size M to obtain a set of sub-segments. Each segment has a length of M. When the length N of the original sequence is not divisible by M, the last segment is padded with zeros to ensure that all segment vectors have the same dimension, which facilitates subsequent unified modeling.

[0065] (2) The segmented set is used as the model input, the order information is retained, and it is sent to the feature encoding module for deep processing.

[0066] In this embodiment, to fully explore the behavioral characteristics of different stages in network flow communication, a sequence segmentation method based on a fixed window length is proposed. This method divides the complete packet length sequence into multiple sub-sequence segments with stage semantics (such as the handshake stage, data transmission stage, and release stage), thereby transforming the long sequence structure into several sub-sequences with stage-specific behavioral characteristics. This segmentation mechanism not only improves the accuracy of local modeling but also provides controllable-granularity modeling units for subsequent modules.

[0067] Network communication typically involves multiple stages, including connection establishment, request and response, data transmission, and connection release. The packet length sequences presented in different stages exhibit significant differences in structural distribution and frequency patterns. To capture these stage-specific differences and improve the resolution of stream representation, this invention performs structured segmentation of the original input sequence, enabling subsequent modules to independently model each stage, thereby improving the final classification and recognition performance.

[0068] Specifically, let the input packet length sequence be... Where N is the total number of data packets in the network flow. This invention uses a fixed window size M. Segmentation is performed to obtain... Each sub-segment is denoted as Each sub-segment This represents a subsequence of length M. For the last segment whose length is less than M, a zero-padding strategy is used to pad it, ensuring that the input dimension of each segment is consistent, facilitating parallel computation and unified encoding of the model.

[0069] This segmentation mechanism not only enables the model to learn fine-grained sequence features within different communication stages, but also allows it to capture semantic relationships between stages in subsequent stages through inter-segment modeling structures (such as attention mechanisms). For example, in encrypted applications, request stages may consist mainly of small packets, data transmission stages are dominated by large packets, while release stages revert to a sparse, short packet pattern. Through structured partitioning, BTSFormer can model such complex packet-level behavioral sequences in a modular manner, thereby significantly improving the model's adaptability to encrypted traffic and its recognition accuracy.

[0070] This method is simple to operate, has low computational overhead, and can seamlessly integrate with programmable network systems (such as the P4 platform), demonstrating good applicability and scalability in real-time traffic monitoring and modeling tasks. Through this mechanism, BTSFormer no longer relies on a unified modeling strategy for global sequences, but instead constructs local features on a stage-by-stage basis. This makes the model exhibit significant robustness and performance advantages when facing the problem of capturing implicit contextual features in encrypted scenarios.

[0071] Step S3: Feature extraction. Input each sub-segment into the deep feature extraction model and perform linear projection. Perform intra-segment temporal modeling and inter-segment global dependency modeling respectively to generate a high-dimensional semantic feature vector representing the entire network flow.

[0072] This step applies to each segment. Perform feature mapping and embed it into a high-dimensional space to obtain an embedding vector. This data is then fed into a multi-layer segment-level coding block (SEB) for sequence modeling to extract intra-segment temporal features. Each SEB consists of the following three layers:

[0073] • Bidirectional GRU layer: Traverses the sequence along both the forward and reverse directions to capture contextual temporal dependencies;

[0074] • Residual connection and linear projection: The bidirectional GRU outputs are spliced ​​together and superimposed with the residual path through a linear layer;

[0075] • Layer normalization and feedforward network: Normalize and nonlinearly map the output of each layer to enhance feature representation and gradient stability.

[0076] The segment-level output is then flattened and linearly transformed to obtain a segment representation with a unified dimension. To capture the dependencies between communication stages, a global aggregation token (CLS Token) is introduced and input together with the segment representations into the multi-head self-attention module (MSA) to construct the inter-segment interaction relationship and obtain the overall semantic feature representation of the traffic.

[0077] S3.1 Intra-segment feature extraction: For each segment, use embedding layer + bidirectional GRU + residual + LayerNorm to extract features.

[0078] In this embodiment, after completing the phased segmentation processing of the packet length sequence, a deep sequence encoding module is further designed to extract rich internal features from each sub-segment and capture the global dependencies between segments. This module consists of three key sub-modules: a projection layer, an internal segment feature extractor, and an external segment feature extractor, which together form the "segment-level deep feature modeling structure" (i.e., the deep feature extraction model) of this invention.

[0079] First, for any segmented input sub-segment A projection layer is used to map it from the original bag-length representation to a high-dimensional feature space to enhance its representational power. The mapping process is shown below:

[0080]

[0081] in, Let b be the projection matrix. emb ∈R D Let be the bias term, and D be the dimension of the deep embedding space. The final embedding representation is as follows: Used for subsequent time series modeling.

[0082] In the intra-segment feature extraction stage, the embedded segment representation is fed into the intra-segment feature encoding module. To better model the internal context structure and temporal dependencies of each segment, this invention designs a multi-layer segment encoding block (SEB). This module uses a bidirectional gated recurrent unit (Bi-GRU) structure to extract forward and reverse features of the sequence, and improves stability and expressive power through residual connections and normalization mechanisms. Assume the input to the first layer encoder is... The processing flow of the L-th layer encoder is as follows:

[0083]

[0084] Here, Concat represents the concatenation of forward and reverse GRU outputs, LayerNorm (LN) is used to improve training stability, and FeedForward is a standard feedforward network. Through a multi-layer stacked structure, the model progressively deepens its temporal understanding of packet length patterns. Finally, the final deep encoding representation of each segment is as follows: To interface with the inter-segment modeling module, the embedded representation is flattened and linearly transformed to obtain a segment-level representation vector of uniform dimension:

[0085]

[0086] Among them, W ′ ∈R (M×D)×D For the projection weights, b ′ ∈R D This is a bias term.

[0087] S3.2 Introduce CLS Token, use multi-head self-attention to model inter-segment global dependencies, and obtain a global semantic feature representation of the complete communication flow (that is, a high-dimensional semantic feature vector representing the entire network flow).

[0088] (1) To model the global relationships between segments, a global classification token CLSToken is introduced, which, along with the segment representations, is input into a multi-head self-attention (MSA) mechanism. The input sequence is in the form of:

[0089]

[0090] PE stands for segment-level position code, ensuring that the sequential relationship between segments can be modeled.

[0091] (2) The context information of all segments is aggregated through the attention mechanism, and the global semantic feature representation of the complete communication flow is obtained by CLS Token aggregation, which is used as the input of the final classifier.

[0092] In this embodiment, during the inter-segment feature modeling stage, a global aggregation token (CLS Token) and a multi-head self-attention mechanism (MSA) are introduced to capture the semantic relationships and dependency paths between various communication stages. The CLS token serves as the carrier of the global representation, participates in subsequent attention operations, and fuses all segment representation information. The specific process is as follows:

[0093]

[0094] in, The positional encoding matrix ensures that the order relationship between different segments in the input sequence is preserved. The attention mechanism, by constructing inter-segment dependencies, enables semantic modeling of the complete communication flow, giving the model global context awareness.

[0095] Step S4: Classification output. The high-dimensional semantic feature vector is loaded into the classifier to output the corresponding predicted category for application recognition or anomaly detection.

[0096] This step inputs the global feature representation corresponding to the CLS Token into a single-layer feedforward neural network for classification calculation, and outputs the prediction result through linear transformation and normalization operations. During the training phase, the cross-entropy loss function is used as the optimization objective, and an L2 regularization term is introduced to constrain the model parameters and improve generalization ability. The final model is deployed in an online identification system, enabling automatic identification and response to the application, behavior type, or abnormal state of unknown encrypted communication streams. The specific steps are as follows:

[0097] (1) Input the CLS Token obtained in step S3 into the classifier module. The classifier consists of a single-layer feedforward neural network, which is used to map high-dimensional features to the task label space.

[0098] (2) During the model training process, the cross-entropy loss function is used as the optimization objective function, supplemented by L2 regularization to prevent overfitting.

[0099] In this embodiment, after completing intra-segment feature extraction and inter-segment context modeling, the model further performs classification output for downstream tasks based on the feature representation obtained from the Global Cluster Token (CLS Token). Specifically, the CLS Token, as the global semantic representation of the entire packet length sequence in the high-dimensional feature space, is input into a single-layer feedforward network for category determination.

[0100] Let the final CLS characterization be The classification result is then obtained through the following linear transformation:

[0101]

[0102] Where, φ∈R D×m Let b represent the weight matrix, where b ∈ R. m Here, is the bias term, m is the total number of classes in the classification task, and LN represents layer normalization, used to improve training stability. The final output... This is a normalized prediction vector, where each dimension represents the predicted probability of the corresponding class.

[0103] During training, the cross-entropy loss function is used as the optimization objective function to measure the difference between the predicted results and the true labels. The specific form of the loss function is as follows:

[0104]

[0105] in, The total loss value is Ω, which represents the training sample set. Let Y be the probability distribution output by the model, and Y be the one-hot encoding of the true label. λ is the L2 norm of all model parameters, used as a regularization term to suppress overfitting, and λ is the regularization coefficient, set to 0.1 in this embodiment. This regularization design effectively constrains the parameter size and improves the model's generalization ability in small sample sizes or highly encrypted environments.

[0106] The model training employs an adaptive optimizer (such as Adam) and incorporates an early stopping mechanism and a learning rate decay strategy. If the validation set performance shows no improvement for an extended period, the learning rate is automatically adjusted or training is terminated to ensure convergence speed and performance stability.

[0107] After training, the model is deployed on a recognition system that supports the PyTorch framework, and a standard interface is provided for upper-layer platforms to call, enabling real-time identification, alarming, and classification of encrypted traffic. The system can run in scenarios such as network security auditing, intrusion detection, and smart gateways, and has high accuracy, low latency, and high concurrency processing capabilities.

[0108] Example 2:

[0109] This embodiment proposes a feature extraction model based on packet length sequences, BTSFormer, to achieve lightweight, non-intrusive application identification of encrypted traffic. This model innovatively utilizes network stream data containing only packet length information as input, achieving high-precision identification of application categories in encrypted traffic without accessing the original data content or relying on protocol parsing. This solution fully considers data privacy protection and network deployment feasibility, making it particularly suitable for real-time identification tasks in encrypted transmission scenarios.

[0110] The BTSFormer model takes a bidirectional packet length sequence as input to comprehensively capture the communication behavior between the source and destination nodes. Let the bidirectional packet length sequence of a network flow be represented as... in This indicates the length of the data packet sent from the source node to the destination node. This indicates the length of the reverse data packet. By introducing positive and negative values ​​to distinguish the direction of flow, the model can capture the interactive features in communication under a unified vector representation, improving contextual understanding.

[0111] like Figure 2 As shown, the BTSFormer model mainly includes the following three modules:

[0112] (1) Segment Partition: The complete packet-long sequence is divided into several sub-sequences with a fixed window size. Each segment corresponds to a complete communication stage, such as handshake, data transmission, connection termination, and other operations. This design can divide the original long sequence into small segments with semantic consistency, which helps to capture the micro-structural features within the stage and improves the compactness and scalability of feature expression.

[0113] (2) Internal & External Segment Feature Extraction Module: This module is the core component of BTSFormer, mainly responsible for extracting local dynamic features from each segment and modeling the global correlation between segments. For intra-segment modeling, a bidirectional GRU structure is adopted, and the contextual temporal relationship within the segment is extracted through forward and backward gating mechanisms. For inter-segment modeling, the model introduces the multi-head attention mechanism of the Transformer architecture, and uses global classification tokens (CLS tokens) to aggregate the embedding information of all segments, thereby realizing global semantic modeling of the complete flow behavior.

[0114] (3) Output & Training Module: The model ultimately inputs the global representation vector into a multilayer perceptron classifier to perform specific traffic task discrimination, such as application identification, anomaly detection, and attack identification. During the training phase, the cross-entropy loss function is used as the optimization objective, and a regularization term is introduced to improve the model's generalization performance. The specific training process combines an early stopping mechanism and a learning rate decay strategy to ensure convergence efficiency while avoiding overfitting.

[0115] Through the above structural design, BTSFormer can construct a refined and expressive stream representation using only lightweight packet-level metadata (i.e., packet-long sequences), thereby achieving high-accuracy identification in various downstream tasks. It is particularly suitable for typical identification problems in encrypted communication environments where application types are not visible but behavioral patterns are observable. This model combines structural simplicity with expressive power, has a low deployment threshold, high computational efficiency, and good engineering applicability and practical application value.

[0116] Example 3:

[0117] The encrypted traffic intelligent identification model BTSFormer in this embodiment is implemented based on the PyTorch framework and deployed on a workstation running Ubuntu 22.04. This workstation is equipped with 64GB of memory, an Intel Core i9-13900K processor, and an NVIDIA GeForce RTX 4090 graphics processor to meet the model's high-efficiency operation requirements. During model training, the initial learning rate is set to 0.001. If the model performance does not improve within 35 consecutive training epochs, the learning rate is automatically reduced by a decay factor of 0.5. The Adam optimizer with a batch size of 32 is used during training, and the maximum number of training epochs is set to 1000 to prevent overfitting. If the validation set performance does not improve within 50 consecutive epochs, an early stopping mechanism is automatically triggered, and the model parameters are fixed based on the result corresponding to the epoch with the best validation set performance. After model training is completed, it is deployed to the actual operating environment and provides inference services through a preset configuration interface. Before model deployment, a grid search was performed on various benchmark methods to optimize hyperparameter settings, ensuring that the model of this invention has superior application recognition performance. All training processes use 10% of the data as a validation set, and the final model's evaluation metrics on the test set are the average of multiple training iterations, demonstrating stability and reliability.

[0118] Throughout the training process, the model employs adaptive optimization algorithms (such as Adam) for parameter updates, combined with an early stopping mechanism and a learning rate reduction strategy to avoid overfitting. Specifically, when the validation set performance does not show significant improvement over several consecutive training rounds, the system automatically reduces the learning rate and ultimately terminates training early. After model training is complete, it is stored in a standard PyTorch deployment environment and can be integrated with production-grade network traffic acquisition systems via API, supporting multi-threaded inference and batch traffic identification tasks.

[0119] This embodiment uses a self-built and publicly released encrypted traffic application identification dataset as the basis for training and deployment. This dataset covers a variety of mainstream encrypted application types and features diverse structures and comprehensive coverage.

[0120] In addition, to ensure the model's generality and robustness, this embodiment also introduces three representative datasets for supplementary training and performance comparison, as follows:

[0121] (1) Application Dataset: This dataset is used for traffic classification tasks and contains approximately 256,849 network flows, covering traffic from 21 real applications such as Alipay, Baidu, Bilibili, Douyin, GitHub, iCloud, Meituan, Taobao, Weibo, and Zhihu. It has broad application representativeness and covers mainstream encrypted communication behaviors in actual networks.

[0122] (2) MedBIoT Dataset: This dataset is geared towards attack detection scenarios and contains approximately 296,805 traffic data points, covering three typical botnet attacks (Mirai, Bashilite, and Torii). Among them, the traffic data for Mirai and Bashilite are labeled according to the propagation stage and command and control (C&C) communication, which is suitable for initial threat identification and modeling.

[0123] (3)USTC-TFSDataset: This dataset is used for anomaly detection tasks and contains approximately 297,359 network flows, divided into 10 categories of normal traffic and 10 categories of malicious traffic, covering various scenarios such as browsing, video, file transfer, and VoIP. Malicious traffic types include botnets, banking Trojans, ransomware, and command and control communication (C2), and it is widely used in intrusion detection and security analysis research.

[0124] The aforementioned dataset provides comprehensive and realistic experimental support for the training and testing of this embodiment, ensuring that the proposed encrypted traffic application identification system has good adaptability and scalability in diverse network environments.

[0125] During training, accuracy is used as the core evaluation metric to measure model performance, and its calculation method is defined as follows:

[0126]

[0127] Where Ω represents the test set sample set, For the model prediction results, Y i The true label is I(·), which is an indicator function that takes the value 1 when the prediction is correct and 0 otherwise.

[0128] To address the application category discrimination problem in encrypted traffic, this invention selects the cross-entropy loss function as the optimization objective during the training process to effectively handle multi-class classification tasks.

[0129] Table 1 Comparison of accuracy with existing flow classification baselines

[0130]

[0131]

[0132] In the implementation of this invention, to comprehensively verify the feature extraction capability and classification performance of the proposed BTSFormer model in the encrypted traffic application identification task, a set of systematic experiments was designed. Three representative public datasets—Application, MedBIoT, and USTC-TFS—were selected, corresponding to encrypted application identification, attack detection, and anomaly identification scenarios, respectively. Simultaneously, the model of this invention was compared with various mainstream baseline models, covering traditional statistical models (Statistics-Based Model), Multilayer Perceptron (MLP), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM) Network, Graph Convolutional Network (GCN), Graph Attention Network (GAT), distributed application identification models (dApp), and the GraphIoT model that integrates application layer semantics.

[0133] As shown in Table 1, a set of systematic experiments was designed to comprehensively evaluate the performance of the proposed BTSFormer model in the encrypted traffic application identification task. The experiments used three representative public network traffic datasets: the Application dataset (for real-world encrypted application identification), the MedBIoT dataset (for botnet attack detection), and the USTC-TFS dataset (for multi-class anomaly detection). These three datasets cover a variety of scenarios, from normal application behavior to complex attack characteristics, and can fully test the model's adaptability and generalization ability in various encrypted communication environments. Accuracy was used as the primary evaluation metric, and the experiments were repeated five times on each model to reduce random bias. The average performance was reported at the end.

[0134] On the Application dataset, the BTSFormer model achieved an accuracy of 0.9287, significantly outperforming all comparable models. Specifically, the traditional statistical model achieved an accuracy of 0.8551, representing an 8.61% improvement over the traditional model. Traditional statistical methods typically rely on basic features extractable from plaintext, such as IP addresses, port numbers, and TCP flags. However, these features are no longer available in encrypted environments, leading to a significant performance degradation in statistical models. BTSFormer, on the other hand, can model solely based on packet length sequences without relying on plaintext features. Furthermore, its segmented, phased coding structure makes it highly robust in encrypted scenarios.

[0135] Comparisons with mainstream deep neural network methods also demonstrate BTSFormer's significant advantages. In the Application dataset, BTSFormer outperforms MLP, CNN, and LSTM models by 18% (0.7873→0.9287), 6.83% (0.8693→0.9287), and 3.83% (0.8944→0.9287), respectively. MLP models, due to their shallow structure and limited learning capacity, are unable to effectively model complex patterns in packet sequences, thus performing the worst. While CNNs can extract local features, they lack the ability to model temporal dependencies. LSTMs can capture long-range dependencies to some extent, but they lack a cross-stage context modeling mechanism. BTSFormer, by introducing a segment-based segmentation mechanism and combining it with the bidirectional gating structure of GRU, can more accurately model context states, making it particularly suitable for phased behavioral sequences in encrypted communication (such as handshakes, data transmission, and disconnection).

[0136] In the MedBIoT attack detection scenario, BTSFormer achieved an accuracy of 0.9750, ranking first among all models and far surpassing some graph neural network models considered to perform well in this field. For example, compared to GCN (0.9643) and GAT (0.9691), BTSFormer improved accuracy by 1.11% and 0.61%, respectively; compared to dApp models based on distributed structure modeling, its improvement reached 35.62% (0.7189→0.9750). This result fully demonstrates BTSFormer's significant advantages in detecting complex attack behaviors, especially in situations where traditional traffic content cannot be extracted under encrypted conditions, yet it can still accurately identify different types of botnet attack communication patterns.

[0137] On the USTC-TFS dataset, BTSFormer also performed exceptionally well, achieving an accuracy of 0.8790. This represents a 46.43% improvement in accuracy compared to the Statistics model's 0.6003, the largest improvement in this set of experiments. This result demonstrates that BTSFormer can effectively identify complex anomalous behavior in encrypted scenarios and is suitable for network environments with high security requirements. Compared to MLP (0.8272), CNN (0.8392), and LSTM (0.8725), BTSFormer improved by 6.26%, 4.74%, and 0.75%, respectively, showing its modeling advantage in handling long sequences and combining global and local features. In comparison with GNN-like models, BTSFormer also exhibited a systematic advantage, with its accuracy exceeding GCN (0.8628) and GraphIoT (0.7845), improving by 1.88% and 12.05%, respectively.

[0138] Notably, BTSFormer is the only model among all comparison models to achieve an accuracy exceeding 87% on all three datasets, demonstrating exceptional task versatility and robustness. Analysis of five independent experiments reveals that BTSFormer's standard deviation across different datasets is significantly lower than other models, proving its training process is more stable and less susceptible to interference from initial weights, data splitting, and other factors. Furthermore, it exhibits strong advantages in model compression and computational efficiency, thanks to its use of lightweight packet-length feature inputs and efficient sequence encoding, which significantly reduces resource consumption during model training and inference.

[0139] In summary, the BTSFormer model proposed in this invention achieves leading classification performance in three typical encrypted traffic identification tasks. By constructing phased packet length sequence features and introducing a bidirectional gating mechanism, this model can effectively capture contextual change patterns in encrypted communication. In a system comparison of statistical, deep learning, and graph neural network models, BTSFormer demonstrates superior performance in accuracy, stability, and generalization ability, achieving a peak accuracy of 0.9750 in the attack detection task. Experimental results show that BTSFormer not only solves the performance degradation problem caused by information loss in traditional models under encrypted scenarios but also achieves efficient modeling of complex communication behaviors through structural innovation, possessing strong application value and potential for technology promotion.

[0140] This invention does not rely on plaintext content, IP addresses, or port numbers; it models solely based on observable packet length sequences during encrypted communication, offering strong privacy protection and broad deployment versatility. Furthermore, the invention's model structure is lightweight and clearly modular, allowing deployment on edge devices or security gateways, supporting real-time traffic identification and high-concurrency scenarios. Experimental results on multiple public datasets demonstrate that the method achieves an accuracy of up to 97.50%, significantly outperforming existing mainstream statistical, deep neural network, and graph neural network methods in multiple tasks such as application identification, anomaly detection, and attack classification, thus possessing broad engineering application value and promising prospects for widespread adoption.

[0141] Although the embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, and for those of ordinary skill in the art, various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. Therefore, the present invention is not limited to the specific details without departing from the general concept defined by the claims and their equivalents.

Claims

1. A double-flow-oriented multi-segment BTSFormer intelligent identification method, characterized in that, Includes the following steps: Step S1: Capture the length information of bidirectional data packets from network traffic and construct a packet length sequence that includes both uplink and downlink directions; Step S2: Perform segmentation on the constructed packet length sequence according to a fixed window size to generate multiple sub-segment sequences, wherein each sub-segment sequence corresponds to a semantic stage in the communication process, and the semantic stage includes: handshake stage, data transmission stage, and release stage; Step S3: Input each sub-segment into the deep feature extraction model and perform linear projection. Perform intra-segment temporal modeling and inter-segment global dependency modeling respectively to generate a high-dimensional semantic feature vector representing the entire network flow. The deep feature extraction model includes: a projection layer, an intra-segment feature extraction module, and an inter-segment feature extraction module. The specific method of step S3 is as follows: (1) Each sub-segment sequence is linearly projected through the projection layer of the deep feature extraction model and embedded into a high-dimensional feature space of dimension D; (2) Perform intra-segment temporal modeling and use multi-level segment-level coding blocks to extract intra-segment features. Each coding block contains a bidirectional gated recurrent unit (GRU), a residual connection and a layer normalization module. (3) Perform global dependency modeling between segments, flatten and linearly transform the segment-level output to generate segment representation vectors of uniform dimension, introduce global classification marker CLS Token, and combine all segment representation vectors into the multi-head self-attention mechanism module to generate high-dimensional semantic feature vectors representing the entire network flow. Step S4: Load the high-dimensional semantic feature vector into the classifier outputting the corresponding predicted category for application recognition or anomaly detection.

2. The intelligent recognition method according to claim 1, characterized in that, The uplink or downlink direction attribute of the packet length sequence in step S1 is defined using positive or negative values: in This indicates the length of the upstream data packet sent from the source node to the destination node. This indicates the length of the downlink data packet sent from the destination node to the source node.

3. The intelligent recognition method according to claim 1, characterized in that, The packet length sequence mentioned in step S1 is generated by capturing encrypted network traffic data in real time using a lightweight monitoring module, which includes a programmable switch and a network acquisition node.

4. The intelligent recognition method according to claim 1, characterized in that, When performing the segmentation process in step S2, zero-padding is used to fill in any ends whose length is less than the fixed window size.

5. The intelligent recognition method according to claim 1, characterized in that, The classifier described in step S4 is based on a single-layer feedforward neural network structure. Its input is a high-dimensional semantic feature vector generated by CLS Token, and its output is the predicted probability of the application category or behavior tag to which the encrypted traffic belongs.

6. The intelligent recognition method according to claim 5, characterized in that, In step S4, the classifier uses a single-layer feedforward neural network model. During the training phase, the cross-entropy loss function is used as the optimization objective, and an L2 regularization term is introduced to improve the model's generalization ability. The loss function is as follows: in For the model prediction results, For real labels, For model parameters, This is the regularization coefficient.

7. The intelligent recognition method according to claim 5, characterized in that, The classifier in step S4 uses a single-layer feedforward neural network model trained with an adaptive optimization algorithm. During training, a learning rate decay mechanism and an early stopping strategy are combined to prevent overfitting and improve training efficiency.

8. A system based on the intelligent recognition method according to any one of claims 1-7, characterized in that, The classifier described in step S4 is deployed in an analysis or identification system based on the PyTorch framework and provides real-time inference services to the outside world through a standardized API interface for use in edge gateways, intrusion detection systems or cloud security platforms.

Images