Unknown encrypted traffic identification method and system based on small sample incremental learning, and storage medium

Abstract

The invention provides an unknown encrypted traffic identification method and system based on small sample incremental learning, and a storage medium, and the method comprises the steps: 1, carrying out the fine-grained classification of known traffic: extracting the features of each level of original encrypted traffic, building a respective variational auto-encoder for each type of known traffic, generating a potential representation, and carrying out the fine-grained classification of the known traffic; inputting into a classifier to classify known attacks in a fine-grained manner; step 2, specific label distribution of unknown traffic: judging whether the sample is a drift sample or an unknown sample by adopting a scoring function, and performing hierarchical clustering on the samples according to each hierarchical feature to realize label distribution of the unknown traffic; and step 3, dynamically updating the classification model: training a new classifier by adopting a new sample, connecting other classifiers to form a classification graph, and updating nodes of the classifiers by adopting a graph attention network to realize small sample incremental learning. The method has the beneficial effects that low-sample incremental modeling of a new class is effectively supported, and the fine-grained recognition capability and the model generalization adaptability are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method, system and storage medium for identifying unknown encrypted traffic based on small sample incremental learning. Background Art

[0002] Traffic classification, as a basic capability for network management and security protection, can identify specific services, applications, malware, network attacks, etc., which helps to improve the quality of network services and user experience, and supports tasks such as malware identification and intrusion detection. At present, with the steady improvement of users' network security awareness and the continuous improvement of domestic and foreign network security laws and regulations, network traffic encryption technology has been widely used in network communications. Although encrypted communication technology effectively protects user privacy and data security, it also provides convenience for hiding malicious traffic. At the same time, new applications and attack behaviors continue to emerge, and traffic characteristics often change dynamically. The encrypted traffic classification model cannot detect unknown samples and drifting samples, and it is difficult to adapt to the new environment. Existing encrypted traffic classification methods face the following two major challenges: (1) The identification of unknown encrypted traffic is not fine-grained enough: Most current methods focus on solving binary classification or "N+1" classification problems, that is, only judging whether the traffic sample belongs to a known category or an unknown category, or treating the unknown category as a unified "other category". Although this coarse-grained classification method can identify unknown traffic to a certain extent, it cannot further distinguish the differences between unknown traffic, for example, it cannot subdivide unknown samples into subcategories such as unknown 1, unknown 2 or unknown 3. For network security analysis, fine-grained unknown traffic classification not only helps to reveal the behavioral characteristics of new types of traffic, but also provides more accurate support for emergency response, malicious behavior tracing and rule formulation. Patent No. CN119996039A proposes an encrypted traffic classification method based on a two-stage adaptive architecture. In the first stage, unknown traffic data is identified. In the second stage, the detected unknown traffic features are converted into a standardized format and input into a large language model (LLM) with semantically enhanced prompt templates to generate specific application labels, thereby achieving multi-category segmentation of unknown traffic. However, this method is highly dependent on manually designed prompt templates, resulting in poor versatility and adaptability; at the same time, the LLM model itself has problems such as weak interpretability and opaque reasoning process, and its reasoning and generation process is accompanied by high computing resource overhead.

[0003] (2) Model incremental learning requires a large number of labeled samples: After detecting a new category, in order not to affect the recognition performance of the original known category, it needs to be updated to the existing model in an incremental manner. Patent No. CN120151017A proposes an incremental learning method based on knowledge distillation, which uses data from old and new categories to jointly construct a new training set to update the classification model. However, this method requires a large amount of labeled data to achieve incremental updates of the classification model to adapt to the new environment. However, in practical applications, this method relies on a large amount of labeled data to achieve effective adaptation to the new environment. In the encrypted traffic analysis scenario, due to the hidden nature of traffic characteristics and the dynamic changes of new behaviors, only a limited number of labeled samples can usually be obtained. Small sample learning provides a feasible solution. It can train the model with only a small number of labeled samples, enabling it to quickly adapt to unknown data and accurately classify it. Patent No. CN119892460A proposes a small sample malicious traffic detection method based on hierarchical semantics and prototype learning. After dividing the metadata dataset into small sample tasks, the prototype network is used to detect unknown encrypted malicious traffic. However, this method is only based on the byte information of the original traffic and uses a three-layer network structure for hierarchical feature extraction. It does not consider the temporal relationship between data packets in the network flow, nor does it distinguish the semantic differences between headers and payloads. Therefore, it has certain limitations in the fitting ability and diversity of prototype representation.

[0004] Existing unknown traffic identification methods for encrypted traffic generally lack fine-grained recognition capabilities for unknown categories and mechanisms for continuous incremental model updates. Existing fine-grained unknown traffic identification technologies rely on the reasoning and generation capabilities of LLMs, require the construction of manual prompt templates, and rely on high-performance computing resources. Furthermore, existing incremental model learning technologies often rely on large numbers of labeled samples for training or perform inadequate feature extraction. Modeling is based on byte information from raw traffic, ignoring the temporal relationships between packets and the semantic differences in message structure. This results in incomplete information and insufficient expressive power in the extracted features across both temporal and spatial dimensions. Summary of the Invention

[0005] In order to solve the problems of weak fine-grained recognition capability of unknown categories and reliance on large samples for incremental learning in existing encrypted traffic identification methods, the present invention provides an unknown encrypted traffic identification method based on small-sample incremental learning, comprising: Step 1: Fine-grained classification of known traffic: Extract the hierarchical features of the original encrypted traffic, build a variational autoencoder for each type of known traffic, generate a latent representation, and input it into the classifier to fine-grainedly classify known attacks; Step 2: Assign specific labels to unknown traffic: Use a scoring function to determine whether a sample is a drift sample or an unknown sample, and perform hierarchical clustering on these samples according to the characteristics of each level to achieve label assignment for unknown traffic; Step 3, dynamic update of the classification model: After training a new classifier with new samples, other classifiers are connected to each other to form a classification graph, and the graph attention network is used to update the classifier nodes to achieve small sample incremental learning.

[0006] As a further improvement of the present invention, in step 1, the following is further included: Step A1: Extract multimodal features of network flows at the flow level, packet level, and byte level, including flow-level sequence features, packet header text features, and payload byte multi-image features; Step A2: Design a multimodal decoupled variational autoencoder to encode the modal features of the network flow at the flow level, packet level, and byte level, respectively, obtain the shared latent variables and private latent variables of each modality, and then obtain the fused semantic feature representation of the encrypted flow; Step A3: Based on the fusion features of each type of known traffic, the corresponding prototype vector is constructed. The classifier determines whether the sample belongs to the corresponding known class or unknown traffic by calculating the distance between the input sample and each prototype.

[0007] As a further improvement of the present invention, in step 2, the following is further included: Step B1: In the flow-level clustering stage, the first-level coarse-grained clustering of unknown samples is performed using the extracted flow-level sequence features to preliminarily divide subgroups with behavioral differences; Step B2: For each coarse-grained cluster, further use the text information in the packet header to perform medium-grained clustering to refine the network protocol behavior pattern; Step B3: Perform third-level fine-grained clustering based on the image features constructed from the payload bytes.

[0008] As a further improvement of the present invention, in step 3, the following is further included: Step C1: Freeze the classifier parameters and prototype vectors of the learned traffic categories, retaining the discrimination ability and feature expression of the old categories; Step C2: Using samples from the newly emerged category, learn the prototype vector of the category and train the corresponding new category classifier; the prototype vectors of the new category and the old category together form a node set in the prototype graph, and establish an edge connection structure based on the feature similarity between them; Step C3: Use the graph attention network to pass messages and update representations of nodes in the graph; Step C4: Integrate the newly learned category classifier parameters and the updated prototype vector into the existing model structure to complete the dynamic incremental learning of the model.

[0009] As a further improvement of the present invention, in step A1, the following is further included: Step a1: Extract flow-level sequence features from network flows, including packet length sequences and packet time series , forming the timing input , extracting latent representations through bidirectional gated recurrent units : ; Step a2: Extract IP, port, protocol, SSL / TLS version, and certificate from the fields in the packet header, expressed as a text sequence , w 1 Represents the first word of a text sequence, w 2 Represents the second word of the text sequence, w n Represents the first n Words, get word vector sequence through pre-trained Word2Vec embedding , e n yes w n The corresponding vector representation is then average pooled to obtain the potential representation : ; Step a3: Extract fixed-length bytes from the packet payload and convert each byte into an integer in the range [0, 255]. Each byte corresponds to a grayscale pixel value, thus generating an image representation. , input convolutional neural network to extract potential representation : ; In the step A2, it further includes: Step s1: Latent representation for each modality Use linear layer decoupling to obtain shared representation and private representation , refers to the linear layer decoupling function of the shared representation, Refers to the linear layer decoupling function of the private representation; when decoupling, it is necessary to meet the principle that shared representations should be similar and private representations should be different, so the loss function is designed L To constrain: , in, and is a hyperparameter used to balance the shared loss and private losses Two-part impact, shared loss and private losses The calculation is as follows: , , in, and Respectively represent i Hedi j A shared representation of the modalities, and Respectively represent i Hedi j A private representation of a modality, i and j Refers to the modality number; Step s2: Perform weighted fusion on the obtained shared vectors to obtain ,in is the weight, V com represents the shared vector after fusion, c i Indicates the i The shared representation of the modalities is obtained by concatenating the obtained private vectors. ,in V dist Refers to the concatenated private vector, d 1 ，d 2 ，d 3 It is the private representation of the three modes, and finally combined into the final representation .

[0010] As a further improvement of the present invention, step A3 further includes: Step y1: Create a prototype vector for each type of traffic. If the known sample set of type c is Among them, the sample The fusion is expressed as , then the prototype vector of the cth class Defined as: ; Step y2: Measure the Euclidean distance between each input sample and each prototype for classification ,If the distance exceeds the threshold, it is unknown traffic, and if it is below the threshold, it is classified as the nearest category.

[0011] As a further improvement of the present invention, the step B1 is specifically as follows: In the flow-level clustering stage, the kernel density estimation method is used to measure the sample Density : , in is the total sample size, is the bandwidth parameter, d is the feature dimension, and at the same time, calculate the i Sample points The shortest distance to any sample with a higher density , the calculation formula is as follows: , in, i and j is the sample number, is the density, if there is no such point, then Take the maximum distance between all samples, and then score them based on the comprehensive score Automatically select initial cluster centers, The calculation is as follows: , and then assign other samples to the cluster with the closest distance; The step B2 is specifically as follows: recalculating the sample in the data packet feature space Density , and normalized to get the relative density: , If the relative density If the value exceeds the threshold, it is considered as a core point, representing the potential center of the local cluster. Then the distance between the edge samples of each cluster and the core point is calculated and assigned to the cluster with the closest distance. The step B2 is specifically as follows: after constructing the image feature space, recalculate the relative density , establish several micro-cluster candidate points, take the encoding cost after clustering as the objective function, and classify the edge nodes Determine whether joining a cluster reduces the overall coding length. If the minimum description length criterion is met, that is, the sample belongs to the cluster, which reduces the overall complexity of the model, then merge it.

[0012] As a further improvement of the present invention, the step C1 is specifically as follows: In the initial stage, the multimodal feature extraction part related to the old category is frozen, and the classifier parameters are ensured to remain unchanged by stopping the gradient propagation, so as to stably retain the old knowledge and the prototype set of K old categories. Expressed as: ; The step C2 is specifically as follows: facing M new categories, reconstruct their prototype vectors And train the corresponding classifier, build a prototype graph based on the prototype vector and its similarity, the nodes in the graph are the sets of new and old prototype vectors , the edge weights are calculated based on cosine similarity: , in, Refers to the edge in the prototype graph i and the edge j The weight between T represents the transpose operation, Indicates the i prototype vectors, Indicates the j prototype vectors; The step C3 is specifically as follows: using a two-layer attention network to realize semantic information propagation, updating the prototype vector and classifier parameters, and the attention coefficient between nodes. Defined as: , in, is the shared linear transformation matrix, is the learnable attention vector, Represents a vector concatenation operation that enhances the expressiveness of the new prototype by minimizing the KL divergence between the predicted probability distribution and the old prototype vector distribution.

[0013] The present invention also discloses an unknown encrypted traffic identification system based on small sample incremental learning, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when called by the processor.

[0014] The present invention further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the method described in the present invention when called by a processor.

[0015] The beneficial effects of the present invention are: 1. The present invention introduces a three-level structure of stream-packet-byte, combined with time series, header text and payload image, to enhance the language consistency and expression integrity of spatiotemporal feature modeling; utilizes a hierarchical clustering method to fully explore traffic differences in the feature structure and realize subclass division of unknown encrypted traffic; 2. The present invention constructs a prototype graph structure and introduces a graph attention network for knowledge enhancement and continuous learning, effectively supporting low-sample incremental modeling of new classes, solving the core bottlenecks of sample size, template dependence and representation quality in traditional methods, and significantly improving fine-grained recognition capabilities and model generalization adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the fine-grained classification technology framework of known traffic in the present invention; Figure 2 This is a schematic diagram of the specific label allocation technology framework for unknown traffic in the present invention; Figure 3 It is a schematic diagram of the dynamic update technology framework of the classification model of the present invention; Figure 4 This is a flow chart of a method for finely identifying unknown encrypted traffic based on small sample incremental learning in the present invention. DETAILED DESCRIPTION

[0017] Word2Vec: also called word embeddings, Chinese noun vector, is a word vector model that transforms each word into w i Mapped into a vector representation e i ,Word2Vec is a tool that can convert words into dense vectors, which can capture the semantic relationship between words.

[0018] This paper proposes a method for identifying unknown encrypted traffic based on small-sample incremental learning. First, a multimodal hierarchical feature extraction and fusion mechanism is designed to extract multimodal features from three levels: network flow, packet, and byte. Private / shared latent variable modeling is used to achieve semantic decoupling and fusion of features, effectively avoiding modal interference and improving expressiveness and discriminability. Furthermore, an independent learner is constructed for each known category, and an additive angular margin loss function is used to enforce inter-category boundaries, thereby enabling accurate identification of known, unknown, and drifting samples. For the latter two categories of samples, a hierarchical clustering method based on a three-layer structure (stream-packet-byte) is proposed to effectively improve the quality of fine-grained clustering of unknown encrypted traffic. Finally, a graph structure is constructed between learners, and an incremental learning mechanism based on a graph attention network is designed to dynamically update learner representations when new classes are added, achieving continuous learning capabilities under small-sample conditions. Through key technologies such as multimodal hierarchical modeling, prototype-enhanced discrimination, and incremental optimization of graph structures, this paper effectively addresses the core issues of unknown traffic identification in encrypted traffic scenarios: insufficient fine-grainedness, insufficient samples, and continuous evolution.

[0019] like Figure 4 As shown in the figure, the present invention proposes a method for identifying unknown encrypted traffic based on small sample incremental learning. It extracts multimodal features from encrypted traffic, identifies unknown traffic types in a fine-grained manner, and dynamically updates the classification model for small samples. The main steps include: Step 1: Fine-grained classification of known traffic: Extract the hierarchical features of the original encrypted traffic, build a variational autoencoder for each type of known traffic, generate a latent representation, and input it into the classifier to fine-grainedly classify known attacks; Step 2: Assign specific labels to unknown traffic: Use a scoring function to determine whether a sample is a drift sample or an unknown sample, and perform hierarchical clustering on these samples according to the characteristics of each level to achieve label assignment for unknown traffic; Step 3, dynamic update of the classification model: After training a new classifier with new samples, other classifiers are connected to each other to form a classification graph, and the graph attention network is used to update the classifier nodes to achieve small sample incremental learning.

[0020] In step 1, the multimodal hierarchical features of encrypted traffic are extracted, and the prototype vector is constructed through multimodal decoupling representation learning to achieve fine-grained encrypted traffic classification. The implementation process is as follows: Figure 1 The process includes: Step A1: Extract multimodal features of network flows at the flow level, packet level, and byte level, including flow-level sequence features, packet header text features, and payload byte multi-image features; Step A2: Design a multimodal decoupled variational autoencoder to encode the three modal features separately, obtain the shared latent variables and private latent variables of each modality, and then obtain the fused semantic feature representation of the encrypted stream; Step A3: Based on the fusion features of each known traffic type, the corresponding prototype vector is constructed. The classifier determines whether the sample belongs to the corresponding known class or unknown traffic by calculating the distance between the input sample and each prototype.

[0021] In step 2, in order to achieve fine-grained identification of unknown encrypted traffic of small samples, a hierarchical clustering strategy is used to divide samples from byte level, packet level to flow level. The implementation process is as follows: Figure 2 As shown, the process includes: Step B1: In the flow-level clustering stage, the first-level coarse-grained clustering of unknown samples is performed using the extracted flow-level sequence features to preliminarily divide subgroups with obvious behavioral differences; Step B2: For each coarse-grained cluster, further use the text information in the packet header to perform medium-grained clustering to refine the network protocol behavior pattern; Step B3: Finally, a third-level fine-grained clustering is performed based on the image features constructed from the payload bytes to discover more microscopic variants or subcategories, thereby improving the accuracy of identifying unknown attacks.

[0022] In step 3, in order to realize incremental learning of the model for small samples, the old category prototype vector is frozen and the new category prototype vector is learned. The implementation process is as follows: Figure 3 As shown, the process includes: Step C1: Freeze the classifier parameters and prototype vectors of the learned traffic categories to retain the discrimination ability and feature expression of the old categories and prevent catastrophic forgetting in the subsequent incremental process; Step C2: Using a small number of samples from the newly emerged category, learn the prototype vector of the category and train the corresponding new category classifier; the prototype vectors of the new category and the old category together form a node set in the prototype graph, and the edge connection structure is established based on the feature similarity between them; Step C3: Use the Graph Attention Network (GAT) to pass messages and update representations of nodes in the graph, enabling semantic information to be shared between new and old categories while improving the adaptability of new category prototypes to small samples. Step C4: Integrate the newly learned category classifier parameters and the updated prototype vector into the existing model structure to complete the dynamic incremental learning of the model.

[0023] Next, the implementation process of the present invention is described in detail.

[0024] Step 1: Fine-grained classification of known traffic.

[0025] First, we extract the flow-level sequence features from the network flow, including the packet length sequence and packet time series , forming the timing input , extracting potential representations through Bi-Directional Gated Recurrent Unit (Bi-GRU) : ; Extract IP, port, protocol, SSL / TLS version (SSL / TLS is the security protocol version used for network traffic transmission, such as SSLv3, TLS 1.2, TLS 1.3, etc., where SSL is an early version and TLS is a subsequent iteration), certificate, etc. from the field extraction in the packet header and express it as a text sequence , for example, a text sequence: [ "192.168.1.1", "443", "TLS", "TLS1.2", "Let'sEncrypt" ] where: w 1 Indicates the first word (such as an IP), w n Indicates the n words (e.g. certificate issuer), obtained through pre-trained Word2Vec embedding , and then use average pooling to get the potential representation : ; Extract fixed-length bytes from the packet payload and convert each byte into an integer in the range [0, 255], where each byte corresponds to a grayscale pixel value, to generate an image representation. , input Convolutional Neural Network (CNN) to extract potential representation : , Then the latent representation of each modality Use linear layer decoupling to obtain shared representation and private representation , refers to the linear layer decoupling function of the shared representation, Refers to the linear layer decoupling function of the private representation; when decoupling, it is necessary to meet the principle that shared representations should be similar and private representations should be different, so the loss function is designed L To constrain: , in, and is a hyperparameter used to balance the shared loss and private losses Two-part impact, shared loss and private losses The calculation is as follows: , , in, and Respectively represent i Hedi j A shared representation of the modalities, and Respectively represent i Hedi j A private representation of a modality, i and j Refers to the modality number; Perform weighted fusion on the shared vectors to obtain ,in is the weight, V com represents the shared vector after fusion, c i Indicates the iThe shared representation of the modalities is obtained by concatenating the obtained private vectors. ,in V dist Refers to the concatenated private vector, d 1 ，d 2 ，d 3 It is the private representation of the three modes, and finally combined into the final representation .

[0026] Establish a prototype vector for each type of traffic. If the known sample set of type c is , where the sample The fusion is expressed as , then the prototype vector of the cth class Defined as: , Finally, the Euclidean distance between each input sample and each prototype is measured for classification ,If the distance exceeds the threshold, it is unknown traffic, and if it is below the threshold, it is classified as the nearest category.

[0027] Step 2: Assign specific labels to unknown traffic.

[0028] First, in the flow-level clustering stage, the kernel density estimation method is used to measure the sample Density : , in is the total sample size, is the bandwidth parameter, d is the feature dimension, and at the same time, each sample point is calculated The shortest distance to any sample with a higher density , the calculation formula is as follows: , in, i and j is the sample number, is the density. If there is no such point, then Take the maximum distance between all samples. Then, based on the comprehensive score Automatically select initial cluster centers, The calculation is as follows: , and then assign the other samples to the cluster with the closest distance.

[0029] Next, for the samples within each flow-level cluster, we further use the packet-level features to perform medium-granularity clustering. Recalculate the samples in the packet feature space. Density , and normalized to get the relative density: , If the relative density If the value exceeds the threshold, it is considered as a core point, representing the potential center of the local cluster. Then the distance between the edge samples of each cluster and the core point is calculated and assigned to the cluster with the closest distance. Finally, after constructing the image feature space, recalculate the relative density , establish several micro-cluster candidate points, take the encoding cost after clustering as the objective function, and classify the edge nodes Determine whether joining a cluster reduces the overall coding length. If the minimum description length criterion is met, that is, the sample belongs to the cluster, which reduces the overall complexity of the model, then merge it.

[0030] Step 3: Dynamic update of classification model.

[0031] In the initial stage, in order to prevent catastrophic forgetting, the multimodal feature extraction part related to the old category is frozen, and the classifier parameters are ensured to remain unchanged by stopping the gradient propagation, so as to stably retain the old knowledge. The prototype set of K old categories Expressed as: ; Faced with M new categories, reconstruct their prototype vectors And train the corresponding classifier, build a prototype graph based on the prototype vector and its similarity, the nodes in the graph are the sets of new and old prototype vectors , the edge weights are calculated based on cosine similarity: , in, Refers to the edge in the prototype graph i and the edge j The weight between T represents the transpose operation, represents the i-th prototype vector, represents the j-th prototype vector; Then, a two-layer GAT is used to realize semantic information propagation, update the prototype vector and classifier parameters, and the attention coefficient between nodes. Defined as: , in, is the shared linear transformation matrix, is the learnable attention vector, Represents a vector concatenation operation that enhances the expressiveness of the new prototype by minimizing the KL divergence (Kullback-Leibler Divergence) between the predicted probability distribution and the old prototype vector distribution.

[0032] Finally, the updated prototype vectors and classifiers are deployed in the actual environment.

[0033] The present invention also discloses an unknown encrypted traffic identification system based on small sample incremental learning, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when called by the processor.

[0034] The present invention further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the method described in the present invention when called by a processor.

[0035] The key points of the present invention are: 1. This invention extracts multimodal features at the network flow, packet, and byte levels, identifies unknown traffic, and then performs hierarchical clustering based on the network flow-packet-byte hierarchy. Compared to existing technologies, this invention addresses the problems of existing methods in insufficient structural understanding of encrypted traffic and insufficient fine-grained classification of unknown traffic by extracting multimodal decoupled features and performing hierarchical clustering. 2. This paper designs an incremental learning method for small sample sizes. By constructing a prototype graph structure and employing a graph attention network, it achieves incremental learning with small sample sizes. Compared to existing technologies, this paper emphasizes feature structure expression, sample utilization efficiency, and semantic preservation, offering greater adaptability and interpretability.

[0036] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A method for identifying unknown encrypted traffic based on small sample incremental learning, characterized in that: include: Step 1: Fine-grained classification of known traffic: Extract the hierarchical features of the original encrypted traffic, build a variational autoencoder for each type of known traffic, generate a latent representation, and input it into the classifier to fine-grainedly classify known attacks; Step 2: Assign specific labels to unknown traffic: Use a scoring function to determine whether a sample is a drift sample or an unknown sample, and perform hierarchical clustering on these samples according to the characteristics of each level to achieve label assignment for unknown traffic; Step 3, dynamic update of the classification model: After training a new classifier with new samples, other classifiers are connected to each other to form a classification graph, and the graph attention network is used to update the classifier nodes to achieve small sample incremental learning.

2. The unknown encrypted traffic identification method according to claim 1, characterized in that: In step 1, the method further includes: Step A1: Extract multimodal features of network flows at the flow level, packet level, and byte level, including flow-level sequence features, packet header text features, and payload byte multi-image features; Step A2: Design a multimodal decoupled variational autoencoder to encode the modal features of the network flow at the flow level, packet level, and byte level, respectively, obtain the shared latent variables and private latent variables of each modality, and then obtain the fused semantic feature representation of the encrypted flow; Step A3: Based on the fusion features of each type of known traffic, the corresponding prototype vector is constructed. The classifier determines whether the sample belongs to the corresponding known class or unknown traffic by calculating the distance between the input sample and each prototype.

3. The unknown encrypted traffic identification method according to claim 1, characterized in that: In step 2, the method further includes: Step B1: In the flow-level clustering stage, the first-level coarse-grained clustering of unknown samples is performed using the extracted flow-level sequence features to preliminarily divide subgroups with behavioral differences; Step B2: For each coarse-grained cluster, further use the text information in the packet header to perform medium-grained clustering to refine the network protocol behavior pattern; Step B3: Perform third-level fine-grained clustering based on the image features constructed from the payload bytes.

4. The method for identifying unknown encrypted traffic according to claim 1, wherein: In step 3, the method further includes: Step C1: Freeze the classifier parameters and prototype vectors of the learned traffic categories, retaining the discrimination ability and feature expression of the old categories; Step C2: Using samples from the newly emerged category, learn the prototype vector of the category and train the corresponding new category classifier; the prototype vectors of the new category and the old category together form a node set in the prototype graph, and establish an edge connection structure based on the feature similarity between them; Step C3: Use the graph attention network to pass messages and update representations of nodes in the graph; Step C4: Integrate the newly learned category classifier parameters and the updated prototype vector into the existing model structure to complete the dynamic incremental learning of the model.

5. The method for identifying unknown encrypted traffic according to claim 2, wherein: In the step A1, it further includes: Step a1: Extract flow-level sequence features from network flows, including packet length sequences and packet time series , forming the timing input , extracting latent representations through bidirectional gated recurrent units : ； Step a2: Extract IP, port, protocol, SSL / TLS version, and certificate from the fields in the packet header, expressed as a text sequence , w 1 Represents the first word of a text sequence, w 2 Represents the second word of the text sequence, w n Represents the first n Words, get word vector sequence through pre-trained Word2Vec embedding , e n yes w n The corresponding vector representation is then average pooled to obtain the potential representation : ； Step a3: Extract fixed-length bytes from the packet payload and convert each byte into an integer in the range [0, 255]. Each byte corresponds to a grayscale pixel value, thus generating an image representation. , input convolutional neural network to extract potential representation : ； In the step A2, it further includes: Step s1: Latent representation for each modality Use linear layer decoupling to obtain shared representation and private representation , refers to the linear layer decoupling function of the shared representation, Refers to the linear layer decoupling function of the private representation; when decoupling, it is necessary to meet the principle that shared representations should be similar and private representations should be different, so the loss function is designed L To constrain: , in, and is a hyperparameter used to balance the shared loss and private losses Two-part impact, shared loss and private losses The calculation is as follows: , , in, and Respectively represent i Hedi j A shared representation of the modalities, and Respectively represent i Hedi j A private representation of a modality, i and j Refers to the modality number; Step s2: Perform weighted fusion on the obtained shared vectors to obtain ,in is the weight, V com represents the shared vector after fusion, c i Indicates the i The shared representation of the modalities is obtained by concatenating the obtained private vectors. ,in V dist Refers to the concatenated private vector, d 1 ，d 2 ，d 3 It is the private representation of the three modes, and finally combined into the final representation .

6. The unknown encrypted traffic identification method according to claim 5, characterized in that: In the step A3, it further includes: Step y1: Create a prototype vector for each type of traffic. If the known sample set of type c is , where the sample The fusion is expressed as , then the prototype vector of the cth class Defined as: ； Step y2: Measure the Euclidean distance between each input sample and each prototype for classification ,If the distance exceeds the threshold, it is unknown traffic, and if it is below the threshold, it is classified as the nearest category.

7. The method for identifying unknown encrypted traffic according to claim 3, wherein: The step B1 is specifically as follows: In the flow-level clustering stage, the kernel density estimation method is used to measure the sample Density : ， in is the total sample size, is the bandwidth parameter, d is the feature dimension, and at the same time, calculate the i Sample points The shortest distance to any sample with a higher density , the calculation formula is as follows: ， in, i and j is the sample number, is the density, if there is no such point, then Take the maximum distance between all samples, and then score them based on the comprehensive score Automatically select initial cluster centers, The calculation is as follows: , and then assign other samples to the cluster with the closest distance; The step B2 is specifically as follows: recalculating the sample in the data packet feature space Density , and normalized to get the relative density: ， If the relative density If the value exceeds the threshold, it is considered as a core point, representing the potential center of the local cluster. Then the distance between the edge samples of each cluster and the core point is calculated and assigned to the cluster with the closest distance. The step B2 is specifically as follows: after constructing the image feature space, recalculate the relative density , establish several micro-cluster candidate points, take the encoding cost after clustering as the objective function, and classify the edge nodes Determine whether joining a cluster reduces the overall coding length. If the minimum description length criterion is met, that is, the sample belongs to the cluster, which reduces the overall complexity of the model, then merge it.

8. The method for identifying unknown encrypted traffic according to claim 4, wherein: The step C1 is specifically as follows: In the initial stage, the multimodal feature extraction part related to the old category is frozen, and the classifier parameters are ensured to remain unchanged by stopping the gradient propagation, so as to stably retain the old knowledge and the prototype set of K old categories. Expressed as: ； The step C2 is specifically as follows: facing M new categories, reconstruct their prototype vectors And train the corresponding classifier, build a prototype graph based on the prototype vector and its similarity, the nodes in the graph are the sets of new and old prototype vectors , the edge weights are calculated based on cosine similarity: ， in, Refers to the edge in the prototype graph i and the edge j The weight between T represents the transpose operation, Indicates the i prototype vectors, Indicates the j prototype vectors; The step C3 is specifically as follows: using a two-layer attention network to realize semantic information propagation, updating the prototype vector and classifier parameters, and the attention coefficient between nodes. Defined as: ， in, is the shared linear transformation matrix, is the learnable attention vector, Represents a vector concatenation operation that enhances the expressiveness of the new prototype by minimizing the KL divergence between the predicted probability distribution and the old prototype vector distribution.

9. A system for identifying unknown encrypted traffic based on small sample incremental learning, characterized in that: include: A memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method according to any one of claims 1 to 8 when called by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of any one of claims 1 to 8 when called by a processor.

Images