An unknown encrypted traffic identification method and system based on small sample incremental learning and a storage medium

Abstract

The application provides a kind of unknown encrypted traffic identification method, system and storage medium based on small sample incremental learning, which comprises the following steps: step 1, fine-grained classification of known traffic: extracting the features of each level of the original encrypted traffic, establishing a respective variational autoencoder for each type of known traffic, generating a latent representation, and inputting it into a classifier to fine-grain classify known attacks; step 2, specific label assignment of unknown traffic: using a scoring function to determine whether the sample is a drift sample or an unknown sample, and clustering these samples according to the hierarchical features to achieve label assignment of unknown traffic; step 3, dynamic updating of the classification model: after training a new classifier with new samples, the other classifiers are connected to form a classification graph, and the classifier nodes are updated using a graph attention network to achieve small sample incremental learning. The beneficial effects of the present application are: effectively supporting low sample incremental modeling of new classes, significantly improving fine-grained recognition ability and model generalization adaptability.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of artificial intelligence, and in particular to an unknown encrypted traffic identification method and system based on small sample incremental learning and a storage medium. BACKGROUND

[0002] Traffic classification, as a basic capability of network management and security protection, can identify specific services, applications, malware, network attacks, etc., and help improve network service quality and user experience quality, and support malware identification and intrusion detection tasks. At present, with the steady improvement of user network security awareness and the continuous improvement of domestic and foreign network security laws and regulations, network traffic encryption technology is widely used in network communication. Although encryption communication technology effectively protects user privacy and data security, it also provides convenience for hiding malicious traffic. At the same time, new application programs and attack behaviors are constantly emerging, and traffic features often change dynamically. The encrypted traffic classification model cannot detect unknown samples and drift samples, and it is difficult to adapt to the new environment. The existing encrypted traffic classification methods face the following two main challenges:

[0003] (1) Insufficient granularity of unknown encrypted traffic identification: Most current methods mainly focus on solving the binary classification or "N+1" classification problem, that is, only judging whether the traffic sample belongs to the known category or the unknown category, or treating the unknown category as a unified "other category". Although this coarse-grained classification method can identify unknown traffic to some extent, it cannot further distinguish the differences between unknown traffic, for example, it cannot subdivide unknown samples into unknown 1, unknown 2, or unknown 3 subcategories. For network security analysis, fine-grained unknown traffic classification not only helps to reveal the behavior characteristics of new traffic, but also provides more accurate support for emergency response, malicious behavior tracing, and rule making. Patent No. CN119996039A proposes an encrypted traffic classification method based on a two-stage adaptive architecture, which identifies unknown traffic data in the first stage, and converts the detected unknown traffic features into a standardized format in the second stage, and inputs a large language model (LLM) combined with a semantically enhanced prompt template to generate specific application labels, thereby realizing multi-class subdivision of unknown traffic. However, this method highly depends on the artificially designed prompt template, resulting in poor universality and adaptability; at the same time, the LLM model itself has weak interpretability and opaque reasoning process, and its reasoning and generation process is accompanied by high computational resource overhead.

[0004] (2) Model incremental learning needs a large number of labeled samples: After detecting a new class, in order not to affect the recognition performance of the original known class, it needs to be updated to the existing model in an incremental manner. The patent with publication number CN120151017A proposes an incremental learning method based on knowledge distillation, which uses the data of old and new classes to jointly construct a new training set to update the classification model. However, this method requires a large amount of labeled data to realize the incremental update of the classification model to adapt to the new environment. However, this method relies on a large amount of labeled data in practical applications to effectively adapt to the new environment. In the encrypted traffic analysis scenario, due to the concealment of traffic features and the dynamic changes of new behaviors, only a limited number of labeled samples can be obtained. Small sample learning provides a feasible solution, which can train the model under the condition of only a small number of labeled samples, so that it has the ability to quickly adapt to unknown data and accurate classification. The patent with publication number CN119892460A proposes a small sample malicious traffic detection method based on hierarchical semantics and prototype learning. After dividing the metadata set into small sample tasks, the prototype network is used to realize unknown encrypted malicious traffic detection. However, this method is based only on the byte information of the original traffic and uses a three-layer network structure for hierarchical feature extraction, without considering the timing relationship between data packets in the network flow or distinguishing the semantic differences between headers and payloads, so there are certain limitations in the fitting ability and diversity of the prototype representation.

[0005] Existing unknown traffic identification methods for encrypted traffic generally lack fine-grained identification ability for unknown classes and continuous incremental update mechanism of the model. Existing unknown traffic fine-grained identification techniques rely on the reasoning and generation ability of LLM, need to construct artificial prompt templates, and rely on high-performance computing resources. At the same time, existing model incremental learning techniques usually rely on a large number of labeled samples for training, or the feature extraction is not sufficient, based on the byte information of the original traffic for modeling, ignoring the timing relationship between data packets and the semantic differences of message structures, resulting in incomplete information in time and space dimensions of the extracted features, and insufficient expression ability. SUMMARY

[0006] In order to solve the problems of weak unknown class fine-grained identification ability and large sample dependence of incremental learning in existing encrypted traffic identification methods, the present application provides an unknown encrypted traffic identification method based on small sample incremental learning, comprising:

[0007] Step 1, fine-grained classification of known traffic: extract the hierarchical features of the original encrypted traffic, establish a respective variational autoencoder for each known traffic, generate a latent representation, and input it into a classifier to classify the known attacks in a fine-grained manner;

[0008] Step 2, specific label assignment of unknown traffic: using a scoring function to determine whether the sample is a drift sample or an unknown sample, and performing hierarchical clustering on the samples according to the hierarchical features to realize label assignment of unknown traffic;

[0009] Step 3, dynamic updating of classification model: after training a new classifier using new samples, other classifiers are connected to form a classification graph, and the classifier nodes are updated using a graph attention network to realize small sample incremental learning.

[0010] As a further improvement of the application, in the step 1, further comprising:

[0011] Step A1: extracting multi-modal features of network flows at the flow level, the packet level and the byte level, including sequence features at the flow level, text features of packet headers and multi-image features of payload bytes;

[0012] Step A2: designing a multi-modal decoupling variational autoencoder to encode the modal features of network flows at the flow level, the packet level and the byte level, obtaining shared latent variables and private latent variables for each modal, and then obtaining a fused semantic feature representation of the encrypted flow;

[0013] Step A3: based on the fused features of each known traffic, constructing a corresponding prototype vector, and the classifier judging whether the sample belongs to the corresponding known class or unknown traffic by calculating the distance between the input sample and each prototype.

[0014] As a further improvement of the application, in the step 2, further comprising:

[0015] Step B1: in the flow level clustering stage, using the extracted flow level sequence features to perform first layer coarse-grained clustering on unknown samples, and preliminarily dividing into sub-populations with different behaviors;

[0016] Step B2: further using the text information in the packet header to perform medium-grained clustering on the samples in each coarse-grained cluster, and refining the network protocol behavior mode;

[0017] Step B3: performing third layer fine-grained clustering according to the image features constructed by the payload bytes.

[0018] As a further improvement of the application, in the step 3, further comprising:

[0019] Step C1: freezing the classifier parameters and prototype vectors of the learned traffic categories, and retaining the discrimination ability and feature expression of the old categories;

[0020] Step C2: learn the prototype vector of the new class using the samples of the new class, train the corresponding new class classifier; the prototype vectors of the new class and the old class constitute a node set in a prototype graph, and the edge connection structure is established according to the feature similarity between them;

[0021] Step C3: message passing and representation updating of nodes in the graph are performed by using a graph attention network;

[0022] Step C4: the parameters of the newly learned class classifier and the updated prototype vector are integrated into the existing model structure to complete the dynamic incremental learning of the model.

[0023] As a further improvement of the application, in the step A1, further comprising:

[0024] Step a1: extracting sequence features of the flow level from the network flow, including a data packet length sequence and a data packet time sequence , to form a time sequence input , and extracting a latent representation by using a bidirectional gated recurrent unit :

[0025] ;

[0026] Step a2: extracting IP, port, protocol, SSL / TLS version, and certificate from the fields in the data packet header to form a text sequence , w 1 representing the first word of the text sequence, w 2 representing the second word of the text sequence, w n representing the first n word of the text sequence, obtaining a word vector sequence , e n is w n corresponding vector representation, and then obtaining a latent representation by using average pooling :

[0027] ;

[0028] Step a3: extracting fixed-length bytes from the data packet payload, converting each byte into an integer in the range of [0, 255], and converting each byte into a gray pixel value to obtain an image representation , and inputting the image representation into a convolutional neural network to extract a latent representation :

[0029] ;

[0030] In the step A2, further comprising:

[0031] Step s1: latent representation of each modality Linear layer decoupling to get shared representation and private representation , Linear layer decoupling function refers to shared representation, Linear layer decoupling function refers to private representation; When decoupling, the principle that shared representation should be similar and private representation should be different should be met, so the loss function is designed L Constrained:

[0032] ,

[0033] Wherein, And are hyperparameters, used to balance the influence of shared loss and private loss Two parts, shared loss and private loss are calculated as follows:

[0034] ,

[0035] ,

[0036] Wherein, And represent the shared representation of the first i and the second j modality, And represent the private representation of the first i and the second j modality, i And j refer to the modality number;

[0037] Step s2: weighted fusion is performed on the obtained shared vector to obtain , wherein is the weight, V com represents the fused shared vector, c i represents the shared representation of the first i modality; The obtained private vector is spliced to obtain , wherein V dist represents the spliced private vector,d 1 ，d 2 ，d 3 combining the three modalities' private representations into a final representation .

[0038] As a further improvement of the present application, in the step A3, further comprises:

[0039] Step y1: Establishing a prototype vector for each type of traffic, if the known sample set of the cth type is Where the sample is fused into , the prototype vector of the cth type is defined as:

[0040] ;

[0041] Step y2: Measure the Euclidean distance between each input sample and each prototype for classification , if the distance exceeds the threshold, it is unknown traffic, if it is below the threshold, it will be classified as the nearest category.

[0042] As a further improvement of the present application, the step B1 is specifically:

[0043] In the flow level clustering stage, the kernel density estimation method is used to measure the density of the sample :

[0044] ,

[0045] Where is the total number of samples, is the bandwidth parameter, and d is the feature dimension. At the same time, the shortest distance i between the cth sample point and any sample with higher density is calculated , and the calculation formula is as follows:

[0046] ,

[0047] Where, i and j are sample numbers, is the density, if there is no such point, then take the maximum distance between all samples, and then according to the comprehensive score automatically select the initial cluster center, calculated as follows: Then assign other samples to the nearest cluster;

[0048] The step B2 is specifically as follows: recalculating the sample in the data packet feature space Density , and normalized to get the relative density:

[0049] ,

[0050] If the relative density If the value exceeds the threshold, it is considered as a core point, representing the potential center of the local cluster. Then the distance between the edge samples of each cluster and the core point is calculated and assigned to the cluster with the closest distance.

[0051] The step B2 is specifically as follows: after constructing the image feature space, recalculate the relative density , establish several micro-cluster candidate points, take the encoding cost after clustering as the objective function, and classify the edge nodes Determine whether joining a cluster reduces the overall coding length. If the minimum description length criterion is met, that is, the sample belongs to the cluster, which reduces the overall complexity of the model, then merge it.

[0052] As a further improvement of the present invention, the step C1 is specifically as follows:

[0053] In the initial stage, the multimodal feature extraction part related to the old category is frozen, and the classifier parameters are ensured to remain unchanged by stopping the gradient propagation, so as to stably retain the old knowledge and the prototype set of K old categories. Expressed as:

[0054] ;

[0055] The step C2 is specifically as follows: facing M new categories, reconstruct their prototype vectors And train the corresponding classifier, build a prototype graph based on the prototype vector and its similarity, the nodes in the graph are the sets of new and old prototype vectors , the edge weights are calculated based on cosine similarity:

[0056] ,

[0057] in, Refers to the edge in the prototype graph i and the edge j The weight between T represents the transpose operation, Indicates the i prototype vectors, Indicates the j prototype vectors;

[0058] The step C3 is specifically as follows: using a two-layer attention network to realize semantic information propagation, updating the prototype vector and classifier parameters, and the attention coefficient between nodes. is defined as:

[0059] ,

[0060] wherein, is a shared linear transformation matrix, is a learnable attention vector, denotes a vector concatenation operation, and the expression capability of the new prototype is enhanced by minimizing the KL divergence between the predicted probability distribution and the old prototype vector distribution.

[0061] The application further discloses an unknown encrypted traffic identification system based on small sample incremental learning, which comprises a memory, a processor and a computer program stored in the memory.

[0062] The application further discloses a computer readable storage medium, which stores a computer program configured to realize the steps of the method of the application when called by a processor.

[0063] The application has the following advantages: 1. The application introduces a three-level structure of flow-packet-byte, combines time series, header text and load image, and strengthens the language consistency and expression integrity of space-time feature modeling; the hierarchical clustering method is used to fully mine the traffic differences in the feature structure, and the subclass division of unknown encrypted traffic is realized; 2. The application constructs a prototype graph structure and introduces a graph attention network for knowledge enhancement and continuous learning, effectively supports low sample incremental modeling of new classes, solves the core bottlenecks of sample quantity, template dependence and representation quality in traditional methods, and significantly improves the fine-grained recognition ability and model generalization adaptability. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 is a schematic diagram of a fine-grained classification technology framework of known traffic of the application;

[0065] Figure 2 is a schematic diagram of a specific label allocation technology framework of unknown traffic of the application;

[0066] Figure 3 is a schematic diagram of a dynamic updating technology framework of the classification model of the application;

[0067] Figure 4 is a flowchart of a fine identification method of unknown encrypted traffic based on small sample incremental learning of the application. DETAILED DESCRIPTION

[0068] Word2Vec: also called word embeddings, Chinese term vector, is a word vector model that converts each wordw i Mapping into a vector representation e i Word2Vec is a tool that can convert words into dense vectors, capturing the semantic relationship between words.

[0069] The application is based on small sample incremental learning, and proposes an unknown encrypted traffic identification method based on small sample incremental learning. First, a multi-modal hierarchical feature extraction and fusion mechanism is designed to extract multi-modal features from three levels of network flow, data packet and byte, and to realize feature semantic decoupling and fusion through private / shared latent variable modeling, effectively avoiding modal interference, improving expression ability and discriminability. Further, an independent learner is constructed for each known category, and a separable angle interval loss function is used to strengthen the boundary between categories, so as to realize accurate identification of known samples, unknown samples and drift samples. For the latter two types of samples, a hierarchical clustering method based on the three-layer structure of flow-packet-byte is proposed, which effectively improves the fine-grained clustering quality of unknown encrypted traffic. Finally, a graph structure is constructed between the learners, and an incremental learning mechanism based on graph attention network is designed to dynamically update the learner representation when adding new categories, realizing the continuous learning ability under the condition of small samples. Through key technologies such as multi-modal hierarchical modeling, prototype enhanced discrimination and graph structure incremental optimization, the application effectively solves the core problems of insufficient fine-grained identification, insufficient samples and continuous evolution of unknown traffic in the encrypted traffic scene.

[0070] As shown in Figure 4 The application proposes an unknown encrypted traffic identification method based on small sample incremental learning, extracts multi-modal features from encrypted traffic, fine-grained identifies unknown traffic types, and realizes dynamic updating of the classification model for small samples, the main steps including:

[0071] Step 1, fine-grained classification of known traffic: extract features of each level of original encrypted traffic, build a variational autoencoder for each known traffic, generate latent representation, and input it into the classifier to fine-grained classify known attacks;

[0072] Step 2, specific label assignment of unknown traffic: use the scoring function to determine whether the sample is a drift sample or an unknown sample, and perform hierarchical clustering on these samples according to the hierarchical features to realize the label assignment of unknown traffic;

[0073] Step 3, dynamic updating of the classification model: after training a new classifier with new samples, the other classifiers are connected to form a classification graph, and the graph attention network is used to update the classifier nodes to realize small sample incremental learning.

[0074] In step 1, multi-modal hierarchical features of encrypted traffic are extracted, prototype vectors are constructed through multi-modal decoupling representation learning, fine-grained encrypted traffic classification is realized, and the implementation process is as followsFigure 1 The process includes:

[0075] Step A1: Extract the multi-modal features of network flow at the flow level, packet level and byte level respectively, including sequence features at the flow level, text features of packet headers and multi-image features of payload bytes;

[0076] Step A2: Design a multi-modal decoupling variational autoencoder to encode the three modal features respectively, obtain the shared latent variables and private latent variables of each modal, and then obtain the fusion semantic feature representation of the encrypted flow;

[0077] Step A3: Based on the fusion features of each known traffic, construct the corresponding prototype vector. The classifier judges whether the sample belongs to the corresponding known class or belongs to unknown traffic by calculating the distance between the input sample and each prototype.

[0078] In step 2, to achieve fine-grained identification of small sample unknown encrypted traffic, a hierarchical clustering strategy is used to divide the samples from byte level, packet level to flow level in turn, and the implementation process is as shown in Figure 2 The process includes:

[0079] Step B1: In the flow level clustering stage, the first layer of coarse-grained clustering is performed on unknown samples using the extracted flow level sequence features, and the sub-population with obvious behavior difference is preliminarily divided;

[0080] Step B2: For the samples in each coarse-grained cluster, further medium-grained clustering is performed using the text information in the packet header to refine the network protocol behavior mode;

[0081] Step B3: Finally, the third layer of fine-grained clustering is performed according to the image features constructed by the payload bytes to discover more microscopic variants or fine categories, and to improve the accuracy of unknown attack identification.

[0082] In step 3, to achieve small sample oriented model incremental learning, the prototype vectors of old categories are frozen, and the prototype vectors of new categories are learned, and the implementation process is as shown in Figure 3 The process includes:

[0083] Step C1: Freeze the classifier parameters and prototype vectors of the learned traffic categories, retain the discrimination ability and feature expression of the old categories, and prevent catastrophic forgetting in the subsequent incremental process;

[0084] Step C2: Use a small number of samples of the newly appeared category to learn the prototype vector of the category, and train the corresponding new category classifier; the prototype vectors of new categories and old categories jointly constitute a node set in a prototype graph, and the edge connection structure is established according to the feature similarity between them;

[0085] Step C3: Message passing and representation updating of nodes in the graph are performed by using a graph attention network (GAT), so that the new and old categories can share semantic information, and the adaptation ability of the new category prototype to small samples is improved.

[0086] Step C4: The newly learned category classifier parameters and the updated prototype vectors are integrated into the existing model structure to complete the dynamic incremental learning of the model.

[0087] Next, the implementation process of the present application is described in detail.

[0088] Step 1: Fine-grained classification of known traffic.

[0089] First, sequence features at the flow level are extracted from network flows, including packet length sequence and packet time sequence , to form a time series input , and a potential representation is extracted by a bidirectional gated recurrent unit (Bi-Directional Gated Recurrent Unit, Bi-GRU):

[0090] ;

[0091] From the fields in the packet header, IP, port, protocol, SSL / TLS version (SSL / TLS is the security protocol version used for network traffic transmission, such as SSLv3, TLS 1.2, TLS 1.3, etc., where SSL is an early version and TLS is a subsequent iteration), certificate, etc. are extracted, represented as a text sequence , such as the text sequence: [ "192.168.1.1", "443", "TLS", "TLS1.2", "Let'sEncrypt" ] where: w 1 represents the first word (such as an IP), w n represents the n word (such as the certificate issuer), which is obtained by pre-training Word2Vec embedding , and then using average pooling to obtain a potential representation :

[0092] ;

[0093] Extract fixed-length bytes from the packet payload and convert each byte into an integer in the range [0, 255], where each byte corresponds to a grayscale pixel value, to generate an image representation. , input Convolutional Neural Network (CNN) to extract potential representation :

[0094] ,

[0095] Then the latent representation of each modality Use linear layer decoupling to obtain shared representation and private representation , refers to the linear layer decoupling function of the shared representation, Refers to the linear layer decoupling function of the private representation; when decoupling, it is necessary to meet the principle that shared representations should be similar and private representations should be different, so the loss function is designed L To constrain:

[0096] ,

[0097] in, and is a hyperparameter used to balance the shared loss and private losses Two-part impact, shared loss and private losses The calculation is as follows:

[0098] ,

[0099] ,

[0100] in, and Respectively represent i Hedi j A shared representation of the modalities, and Respectively represent i Hedi j A private representation of a modality, i and j Refers to the modality number;

[0101] Perform weighted fusion on the shared vectors to obtain ,in is the weight, V com represents the shared vector after fusion, c i Indicates thei shared representation of one modality; the resulting private vector is concatenated to get where V dist denotes the private vector after concatenation, d 1 ，d 2 ，d 3 private representation of three modalities, and finally combined into the final representation .

[0102] Prototype vectors are established for each type of traffic. If the known sample set of the cth type is where the sample is the fusion representation of , then the prototype vector of the cth type is defined as:

[0103] ,

[0104] Finally, the Euclidean distance between each input sample and each prototype is measured to classify . If the distance exceeds the threshold, it is unknown traffic, and if it is below the threshold, it is classified as the nearest category.

[0105] Step 2: Specific label assignment for unknown traffic.

[0106] First, in the flow-level clustering stage, the kernel density estimation method is used to measure the density of the sample :

[0107] ,

[0108] where is the total number of samples, is the bandwidth parameter, and d is the feature dimension. At the same time, the shortest distance between each sample point and any sample with higher density is calculated, and the calculation formula is as follows:

[0109] ,

[0110] where i and j are the sample numbers, is the density. If there is no such point, then take the maximum distance between all samples. Then, according to the comprehensive score , the initial cluster center is automatically selected, which is calculated as follows: Then, other samples are assigned to the nearest cluster.

[0111] Next, for each sample within the flow level cluster, further micro-clustering is performed using packet level features. The density of samples is recalculated in the packet feature space and normalized to get the relative density:

[0112] ,

[0113] If the relative density exceeds the threshold, it is considered as a core point, representing the potential center of the local cluster. Then the distance between the edge sample and the core point is calculated, and it is assigned to the nearest cluster.

[0114] Finally, after constructing the image feature space, the relative density is recalculated, and several micro-cluster candidate points are established. The encoding cost after clustering is used as the objective function to determine whether the edge node joins a cluster reduces the overall encoding length. If it meets the minimum description length criterion, i.e., the sample belongs to the cluster, which reduces the overall complexity of the model, then the merging is performed.

[0115] Step 3: Dynamic update of classification model.

[0116] In the initial stage, to prevent catastrophic forgetting, the multi-modal feature extraction part related to the old categories is frozen, and the classifier parameters are kept unchanged by stopping gradient propagation, to stabilize and retain old knowledge. The prototype set of K old categories is represented as:

[0117] ;

[0118] Facing M new categories, the prototype vectors are reconstructed and the corresponding classifiers are trained. The prototype graph is constructed based on the prototype vectors and their similarity. The nodes in the graph are the old and new prototype vector sets , and the weight of the edge is calculated based on the cosine similarity:

[0119] ,

[0120] where is the weight of edge i and edge j in the prototype graph, T denotes the transpose operation, denotes the i-th prototype vector, denotes the j-th prototype vector.

[0121] Then, two-layer GAT is used to realize semantic information propagation, to update the prototype vectors and classifier parameters, and the attention coefficient between nodes ​​Defined as:

[0122] ,

[0123] in, is the shared linear transformation matrix, is the learnable attention vector, Represents a vector concatenation operation that enhances the expressiveness of the new prototype by minimizing the KL divergence (Kullback-Leibler Divergence) between the predicted probability distribution and the old prototype vector distribution.

[0124] Finally, the updated prototype vectors and classifiers are deployed in the actual environment.

[0125] The present invention also discloses an unknown encrypted traffic identification system based on small sample incremental learning, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when called by the processor.

[0126] The present invention further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the method described in the present invention when called by a processor.

[0127] The key points of the present invention are:

[0128] 1. This invention extracts multimodal features at the network flow, packet, and byte levels, identifies unknown traffic, and then performs hierarchical clustering based on the network flow-packet-byte hierarchy. Compared to existing technologies, this invention addresses the problems of existing methods in insufficient structural understanding of encrypted traffic and insufficient fine-grained classification of unknown traffic by extracting multimodal decoupled features and performing hierarchical clustering.

[0129] 2. This paper designs an incremental learning method for small sample sizes. By constructing a prototype graph structure and employing a graph attention network, it achieves incremental learning with small sample sizes. Compared to existing technologies, this paper emphasizes feature structure expression, sample utilization efficiency, and semantic preservation, offering greater adaptability and interpretability.

[0130] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A method for identifying unknown encrypted traffic based on small sample incremental learning, characterized in that: include: Step 1: Fine-grained classification of known traffic: Extract the hierarchical features of the original encrypted traffic, build a variational autoencoder for each type of known traffic, generate a latent representation, and input it into the classifier to fine-grainedly classify known attacks; Step 2: Assign specific labels to unknown traffic: Use a scoring function to determine whether a sample is a drift sample or an unknown sample, and perform hierarchical clustering on these samples according to the characteristics of each level to achieve label assignment for unknown traffic; Step 3: Dynamic update of the classification model: After training a new classifier with new samples, other classifiers are connected to form a classification graph, and the graph attention network is used to update the classifier nodes to achieve small-sample incremental learning; In step 1, the method further includes: Step A1: Extract multimodal features of network flows at the flow level, packet level, and byte level, including flow-level sequence features, packet header text features, and payload byte multi-image features; Step A2: Design a multimodal decoupled variational autoencoder to encode the modal features of the network flow at the flow level, packet level, and byte level, respectively, obtain the shared latent variables and private latent variables of each modality, and then obtain the fused semantic feature representation of the encrypted flow; Step A3: Based on the fusion features of each known traffic type, a corresponding prototype vector is constructed. The classifier determines whether the sample belongs to the corresponding known class or unknown traffic by calculating the distance between the input sample and each prototype. In step 2, the method further includes: Step B1: In the flow-level clustering stage, the first-level coarse-grained clustering of unknown samples is performed using the extracted flow-level sequence features to preliminarily divide subgroups with behavioral differences; Step B2: For each coarse-grained cluster, further use the text information in the packet header to perform medium-grained clustering to refine the network protocol behavior pattern; Step B3: Perform third-level fine-grained clustering based on the image features constructed from the payload bytes.

2. The unknown encrypted traffic identification method according to claim 1, characterized in that: In step 3, the method further includes: Step C1: Freeze the classifier parameters and prototype vectors of the learned traffic categories, retaining the discrimination ability and feature expression of the old categories; Step C2: Using samples from the newly emerged category, learn the prototype vector of the category and train the corresponding new category classifier; the prototype vectors of the new category and the old category together form a node set in the prototype graph, and establish an edge connection structure based on the feature similarity between them; Step C3: Use the graph attention network to pass messages and update representations of nodes in the graph; Step C4: Integrate the newly learned category classifier parameters and the updated prototype vector into the existing model structure to complete the dynamic incremental learning of the model.

3. The unknown encrypted traffic identification method according to claim 1, characterized in that: In the step A1, it further includes: Step a1: Extract flow-level sequence features from network flows, including packet length sequences and packet time series , forming the timing input , extracting latent representations through bidirectional gated recurrent units : ； Step a2: Extract IP, port, protocol, SSL / TLS version, and certificate from the fields in the packet header, expressed as a text sequence , w 1 Represents the first word of a text sequence, w 2 Represents the second word of the text sequence, w n Represents the first n Words, get word vector sequence through pre-trained Word2Vec embedding , e n yes w n The corresponding vector representation is then average pooled to obtain the potential representation : ； Step a3: Extract fixed-length bytes from the packet payload and convert each byte into an integer in the range [0, 255]. Each byte corresponds to a grayscale pixel value, thus generating an image representation. , input convolutional neural network to extract potential representation : ； In the step A2, it further includes: Step s1: Latent representation for each modality Use linear layer decoupling to obtain shared representation and private representation , refers to the linear layer decoupling function of the shared representation, Refers to the linear layer decoupling function of the private representation; when decoupling, it is necessary to meet the principle that shared representations should be similar and private representations should be different, so the loss function is designed L To constrain: , in, and is a hyperparameter used to balance the shared loss and private losses Two-part impact, shared loss and private losses The calculation is as follows: , , in, and Respectively represent i Hedi j A shared representation of the modalities, and Respectively represent i Hedi j A private representation of a modality, i and j Refers to the modality number; Step s2: Perform weighted fusion on the obtained shared vectors to obtain ,in is the weight, V com represents the shared vector after fusion, c i Indicates the i The shared representation of the modalities is obtained by concatenating the obtained private vectors. ,in V dist Refers to the concatenated private vector, d 1 ，d 2 ，d 3 It is the private representation of the three modes, and finally combined into the final representation .

4. The method for identifying unknown encrypted traffic according to claim 3, wherein: In the step A3, it further includes: Step y1: Create a prototype vector for each type of traffic. If the known sample set of type c is , where the sample The fusion is expressed as , then the prototype vector of the cth class Defined as: ； Step y2: Measure the Euclidean distance between each input sample and each prototype for classification ,If the distance exceeds the threshold, it is unknown traffic, and if it is below the threshold, it is classified as the nearest category.

5. The unknown encrypted traffic identification method according to claim 1, characterized in that: The step B1 is specifically as follows: In the flow-level clustering stage, the kernel density estimation method is used to measure the sample Density : ， in is the total sample size, is the bandwidth parameter, d is the feature dimension, and at the same time, calculate the i Sample points The shortest distance to any sample with a higher density , the calculation formula is as follows: ， in, i and j is the sample number, is the density, if there is no such point, then Take the maximum distance between all samples, and then score them based on the comprehensive score Automatically select initial cluster centers, The calculation is as follows: , and then assign other samples to the cluster with the closest distance; The step B2 is specifically as follows: recalculating the sample in the data packet feature space Density , and normalized to get the relative density: ， If the relative density If the value exceeds the threshold, it is considered as a core point, representing the potential center of the local cluster. Then the distance between the edge samples of each cluster and the core point is calculated and assigned to the cluster with the closest distance. The step B2 is specifically as follows: after constructing the image feature space, recalculate the relative density , establish several micro-cluster candidate points, take the encoding cost after clustering as the objective function, and classify the edge nodes Determine whether joining a cluster reduces the overall coding length. If the minimum description length criterion is met, that is, the sample belongs to the cluster, which reduces the overall complexity of the model, then merge it.

6. The method for identifying unknown encrypted traffic according to claim 2, wherein: The step C1 is specifically as follows: In the initial stage, the multimodal feature extraction part related to the old category is frozen, and the classifier parameters are ensured to remain unchanged by stopping the gradient propagation, so as to stably retain the old knowledge and the prototype set of K old categories. Expressed as: ； The step C2 is specifically as follows: facing M new categories, reconstruct their prototype vectors And train the corresponding classifier, build a prototype graph based on the prototype vector and its similarity, the nodes in the graph are the sets of new and old prototype vectors , the edge weights are calculated based on cosine similarity: ， in, Refers to the edge in the prototype graph i and the edge j The weight between T represents the transpose operation, Indicates the i prototype vectors, Indicates the j prototype vectors; The step C3 is specifically as follows: using a two-layer attention network to realize semantic information propagation, updating the prototype vector and classifier parameters, and the attention coefficient between nodes. Defined as: ， in, is the shared linear transformation matrix, is the learnable attention vector, The representation vector concatenation operation enhances the expressiveness of the new prototype by minimizing the KL divergence between the predicted probability distribution and the old prototype vector distribution.

7. A system for identifying unknown encrypted traffic based on small sample incremental learning, characterized in that: include: A memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method according to any one of claims 1 to 6 when called by the processor.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of any one of claims 1 to 6 when called by a processor.

Images