Encryption traffic detection method and system based on federated learning and quantum-inspired optimization

Abstract

The application discloses an encrypted traffic detection method and system based on federated learning and quantum-inspired optimization, and belongs to the technical field of traffic detection.The method comprises the following steps: collecting multi-modal data, wherein the multi-modal data comprises real attack data, scanner data and artificial simulated attack data; performing data fusion and preprocessing on the multi-modal data to obtain preprocessed fusion data; performing segmentation and vectorization processing on the preprocessed fusion data to obtain a 128-dimensional feature vector; performing screening on the 128-dimensional feature vector to obtain a 30-dimensional high-differentiation feature vector subset; acquiring structured feature data; training a multi-node CatBoost model based on a federated learning framework by using the structured feature data to obtain a trained global model; and inputting the 30-dimensional high-differentiation feature vector subset into the trained global model to perform preset multi-task threat detection and obtain multi-task detection results.The application can improve the flexibility and detection efficiency of the system, protect data privacy and avoid data delay.

Description

Technical Field

[0001] This invention belongs to the field of traffic detection technology, specifically relating to an encrypted traffic detection method and system based on federated learning and quantum-inspired optimization. Background Technology

[0002] As cyberattacks become increasingly sophisticated, security inspection of network traffic has become a crucial aspect of ensuring system security. Existing technologies often employ detection systems based on plaintext feature rules. These systems pre-build a rule base containing known attack characteristics, such as malicious code snippets and protocol anomaly fields, and identify potential malicious activities by matching network traffic payloads. However, these solutions have significant shortcomings in addressing modern cyber threats. Plaintext feature rule-based detection systems are completely ineffective against attack payloads transmitted through encrypted channels such as TLS / SSL (Security TLS / SSL). Because the traffic payload is encrypted, it's impossible to directly parse the payload content to extract features for matching. This results in such detection methods failing to detect attacks within encrypted channels, creating a significant security blind spot.

[0003] Therefore, for encrypted traffic, existing technologies typically employ feature-based rule-based methods to analyze client fingerprints for detection, such as analyzing JA3 / JA35 fingerprints. However, these methods require continuous updates to the fingerprint database, and attackers can easily modify specific fingerprints of new attack tools to circumvent fingerprint-based detection rules. The update cycle of the rule database often lags far behind the rate of attack method mutations, resulting in a defensive vacuum in the detection system after a new attack emerges, making it unable to effectively cope with zero-day attacks or rapidly evolving threats. Some solutions attempt to decrypt encrypted traffic before detection, but since legitimate business traffic and encrypted attack traffic are indistinguishable in appearance from the decrypted signature, decryption detection struggles to accurately differentiate between the two. For example, HTTPS (Hypertext Transfer Protocol Secure) video streams and encrypted command execution environments like Webshells can easily lead to a large number of false positives, increasing the workload of security operations personnel and potentially reducing awareness of real threats due to frequent false positives. Some emerging detection solutions employ centralized machine learning methods, uploading all traffic data to a central server for model training and threat identification. However, this approach carries a high risk of data privacy breaches and may not comply with regulatory requirements. Furthermore, the centralized processing model is relatively slow to respond to distributed threats, such as Distributed Denial of Service (DDoS) attacks that span multiple network nodes, making it difficult to meet the security protection requirements for scenarios with high real-time demands.

[0004] Therefore, how to provide an effective technical solution to address the problems in existing technologies, such as the inability to detect attack payloads transmitted through encrypted channels like TLS / SSL, the rule base update cycle lagging far behind the speed of attack method mutations, high false alarm rate, high risk of data privacy leakage, and slow response to distributed threats, has become an urgent problem to be solved. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for detecting encrypted traffic based on federated learning and quantum-inspired optimization, in order to solve at least one problem existing in the prior art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a method for detecting encrypted traffic based on federated learning and quantum-inspired optimization, comprising:

[0008] Collect real attack data, scanner data, and human-simulated attack data; fuse the real attack data, scanner data, and human-simulated attack data to obtain fused data; preprocess the fused data to obtain preprocessed fused data.

[0009] The preprocessed fused data is segmented to obtain multiple single-list data. Based on the trained encoding model, the single-list data is vectorized to obtain 128-dimensional feature vectors. Based on the quantum-inspired algorithm and objective function, the 128-dimensional feature vectors are filtered to obtain a 30-dimensional high-discrimination feature vector subset. The 30-dimensional high-discrimination feature vector subset includes protocol layer feature vectors, traffic statistics feature vectors, payload semantic feature vectors, and time-series behavior feature vectors.

[0010] Obtain structured feature data, use the structured feature data to train a multi-node CatBoost model based on a federated learning framework, and obtain the trained global model;

[0011] A subset of 30-dimensional high-discrimination feature vectors is input into the trained global model to perform preset multi-task threat detection, and the multi-task detection results are obtained.

[0012] In one possible design, the fused data is preprocessed to obtain preprocessed fused data, including:

[0013] The merged data is deleted based on preset irrelevant fields, and the merged data after deletion is processed to remove duplicate values, fill in missing values ​​and blank values;

[0014] The filled fused data is sorted alphabetically by first letter, and the sorted fused data is then subjected to text extraction to obtain preprocessed fused data.

[0015] In one possible design, the objective function is expressed as follows:

[0016] ;

[0017] In the above formula, Indicates the importance of feature i. This represents the correlation between feature i and feature j. Indicates whether to select a feature, where, ,when When the value is 0, it indicates that no feature is selected. When the value is 1, it indicates the selection of features. Represents the penalty function. Indicates whether to select the i-th feature. For binary decision variables, ,when When the value is 0, it means that the i-th feature is not selected. When the value is 1, it indicates that the i-th feature is selected, where n is a natural number.

[0018] In one possible design, a multi-node CatBoost model based on a federated learning framework is trained using structured feature data to obtain a trained global model, including:

[0019] The structured feature data is desensitized, outliers are truncated, and normalized to obtain normalized structured feature data.

[0020] Normalized structured feature data is input into a multi-node CatBoost model based on a federated learning framework for training, resulting in a trained multi-node CatBoost model.

[0021] The parameters of the trained multi-node CatBoost model are weighted and aggregated, and the trained global model is obtained based on the processed parameters.

[0022] In one possible design, before inputting a subset of 30-dimensional high-discrimination feature vectors into the trained global model for pre-defined multi-task threat detection, the following is also included:

[0023] The 30-dimensional high-discrimination feature vector subset is standardized to obtain the standardized 30-dimensional high-discrimination feature vector subset.

[0024] The standardized 30-dimensional high-discrimination feature vector subset is divided into multiple data subsets according to the preset multi-tasks. The multiple data subsets are then assigned to different preset multi-tasks, which include C2 detection, DNS tunnel detection, Webshell detection, and attack scanning detection.

[0025] In one possible design, the multi-task detection results include C2 detection results, DNS tunnel detection results, Webshell detection results, and attack scan detection results; the step of inputting a subset of 30-dimensional high-discrimination feature vectors into the trained global model for preset multi-task threat detection, to obtain multi-task detection results, includes:

[0026] A dynamic pipeline framework is adopted, and C2 detection, DNS tunnel detection, Webshell detection and attack scanning detection are performed on multiple data subsets based on the trained global model to obtain C2 detection results, DNS tunnel detection results, Webshell detection results and attack scanning detection results.

[0027] In one possible design, the trained global model includes isolated forests and GRU networks, Bi-LSTM networks, XGBoost classifiers, and STL models; the trained global model is used to perform C2 detection, DNS tunnel detection, Webshell detection, and attack scanning detection on multiple data subsets to obtain C2 detection results, DNS tunnel detection results, Webshell detection results, and attack scanning detection results, including:

[0028] C2 detection was performed on multiple data subsets based on isolated forest and GRU network to obtain C2 detection results;

[0029] DNS tunnel detection is performed on multiple data subsets based on a Bi-LSTM network to obtain DNS tunnel detection results;

[0030] Webshell detection was performed on multiple data subsets using the XGBoost classifier to obtain Webshell detection results.

[0031] Attack scanning and detection are performed on multiple data subsets based on the STL model to obtain attack scanning and detection results.

[0032] Secondly, the present invention provides an encrypted traffic detection system based on federated learning and quantum-inspired optimization, used to implement the encrypted traffic detection method based on federated learning and quantum-inspired optimization described in the first aspect, comprising:

[0033] The acquisition module is used to collect real attack data, scanner data, and human-simulated attack data. It performs data fusion on the real attack data, scanner data, and human-simulated attack data to obtain fused data, stores the fused data on different nodes, and preprocesses the fused data to obtain preprocessed fused data.

[0034] The filtering module is used to segment the preprocessed fused data to obtain multiple single list data. Based on the trained encoding model, the single list data is vectorized to obtain a 128-dimensional feature vector. Based on the quantum heuristic algorithm and objective function, the 128-dimensional feature vector is filtered to obtain a 30-dimensional high-discrimination feature vector subset. The 30-dimensional high-discrimination feature vector subset includes protocol layer feature vectors, traffic statistics feature vectors, payload semantic feature vectors, and time-series behavior feature vectors.

[0035] The training module is used to acquire structured feature data, and to train a multi-node CatBoost model based on a federated learning framework using the structured feature data to obtain the trained global model.

[0036] The detection module is used to input a subset of 30-dimensional high-discrimination feature vectors into the trained global model to perform preset multi-task threat detection and obtain multi-task detection results.

[0037] Thirdly, the present invention provides a computer device comprising a memory, a processor, and a transceiver connected in sequence and communication, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in the first aspect.

[0038] Fourthly, the present invention provides a computer program product containing instructions that, when executed on a computer, cause the computer to perform the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in the first aspect.

[0039] The beneficial effects of this invention are as follows:

[0040] (1) This invention discloses an encrypted traffic detection method and system based on federated learning and quantum-inspired optimization. It does not require decryption of the encrypted traffic payload, thus avoiding the risk of privacy leakage. The global model is obtained through training with the federated learning framework, avoiding the latency and privacy issues caused by the centralization of the dataset, and providing continuous evolution protection capabilities.

[0041] (2) By optimizing feature selection through quantum-inspired algorithms, a 30-dimensional high-discrimination feature subset is selected from the 128-dimensional feature vector, which can retain 95% of the information and has high efficiency;

[0042] (3) By using the federated learning framework, data does not leave the local machine, only parameters are transmitted, avoiding cross-node sharing of raw traffic, maintaining detection performance in the case of multi-node collaboration, and meeting the needs of data privacy protection.

[0043] (4) This invention supports parallel detection of multiple tasks. Each task is processed by an independent model, sharing common features and dynamically loading task-specific features, thereby improving system flexibility and detection efficiency. Attached Figure Description

[0044] Figure 1 This is a flowchart of the encrypted traffic detection method provided in the first aspect of this embodiment;

[0045] Figure 2 This is a block diagram of the encrypted traffic detection system provided in the second aspect of this embodiment. Detailed Implementation

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in conjunction with the accompanying drawings and descriptions of the embodiments or the prior art. Obviously, the following description of the structure of the accompanying drawings is only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0047] It should be understood that although the terms first, second, etc., may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another. For example, a first unit may be referred to as a second unit, and similarly, a second unit may be referred to as a first unit, without departing from the scope of the exemplary embodiments of the invention.

[0048] Example:

[0049] like Figure 1 As shown, the first aspect of this embodiment provides a method for detecting encrypted traffic based on federated learning and quantum-inspired optimization, including but not limited to the following steps:

[0050] S1. Collect real attack data, scanner data, and human-simulated attack data; fuse the real attack data, scanner data, and human-simulated attack data to obtain fused data; preprocess the fused data to obtain preprocessed fused data.

[0051] The real attack data includes actual attack logs from the company's security devices, such as WAF (Web Application Firewall) and IPS (Intrusion Prevention System), which provide real-world threat samples. The scanner data consists of test data obtained by simulating network attacks using automated tools. The manually simulated attack data consists of data verified by the security team through simulated scenarios.

[0052] In one possible design, real attack data, scanner data, and artificially simulated attack data are fused using a phased incremental training approach combined with elastic weight solidification. The process involves three rounds: Round 1: Adversarial fine-tuning of the real attack data to enhance the ability to identify real-world threats; Round 2: Fusing protocol mutation data generated from scanner data to improve generalization against covert attacks; Round 3: Injecting artificially simulated attack data to enhance inference capabilities against zero-day threats. The fused data is distributed across multiple internal nodes, such as WAF, IPS, and gateways, eliminating the need for centralized storage and ensuring privacy.

[0053] Specifically, in step S1, the fused data is preprocessed to obtain preprocessed fused data, including:

[0054] S11. Delete the fused data based on the preset irrelevant fields, and perform duplicate value removal, missing value filling, and blank value filling on the deleted fused data;

[0055] S12. Sort the filled fused data according to the first letter, and extract the text from the sorted fused data to obtain the preprocessed fused data.

[0056] Preferably, in this embodiment, the preset irrelevant fields are user-defined fields, including but not limited to id, source, destination, ip, or PROTOCOL; removing duplicate values ​​from the data ensures the uniqueness of the data; missing values ​​in numeric fields are filled with -1, and blank missing fields are replaced with "blank"; text extraction from the data also includes removing punctuation marks, extracting request keywords and file addresses, etc.; preprocessing also includes retaining threat labels for data with tag conflicts.

[0057] S2. The preprocessed fused data is segmented to obtain multiple single-list data. The single-list data is vectorized based on the trained encoding model to obtain 128-dimensional feature vectors. The 128-dimensional feature vectors are filtered based on quantum heuristic algorithm and objective function to obtain a 30-dimensional high-discrimination feature vector subset. The 30-dimensional high-discrimination feature vector subset includes protocol layer feature vectors, traffic statistics feature vectors, payload semantic feature vectors, and time-series behavior feature vectors.

[0058] Among them, protocol layer feature vectors include, but are not limited to, TLS handshake parameters and certificate issuers; traffic statistics feature vectors include, but are not limited to, mean packet length, variance, and burst index; payload semantic feature vectors include, but are not limited to, URL entropy and domain name length; and time-series behavior feature vectors include, but are not limited to, heartbeat interval and traffic periodicity.

[0059] In one possible design, the preprocessed fused data is segmented, specifically into multiple single-list data based on protocol or field type. Each single-list data focuses on a single feature. For example, for the http and URL fields, dynamic parameters are extracted and removed; for instance, / api / login?user=123 is segmented into / api / login. For the DNS query field, the main domain name is extracted; for example, for c2.malicious.tk, malicious.tk is retained. By vectorizing these features into 128 dimensions, they are ultimately stored as independent .npy files, enabling privacy-free collaborative analysis of multi-source threat features.

[0060] In one possible design, the encoding model is built based on the BERT model (Bidirectional Encoder Representations from Transformers, a pre-trained language model). Vectorized data in .npy format is obtained and input into the encoding model for training. Supervised learning optimizes the parameters of the encoding model's adaptation layer. The trained encoding model can map single-list data to threat tags and store them in a text tag mapping dictionary, where the key is text and the value is a vector. An example storage format for the text tag mapping dictionary is {"malicious URL": 1, "normal domain name": 0}. The text tag mapping dictionary aggregates the results from each node in federated learning. It is used for real-time threat matching and federated knowledge sharing. On local nodes, the text tag mapping dictionary is directly queried to quickly determine whether traffic characteristics represent a known threat. For example, if an HTTP URL of / api / exploit.php is detected and mapped to threat tag 1, an interception is triggered.

[0061] The objective function is calculated as follows: ;

[0062] In the above formula, Indicates the importance of feature i. This represents the correlation between feature i and feature j. Indicates whether to select a feature, where, ,when When the value is 0, it indicates that no feature is selected. When the value is 1, it indicates the selection of features. Represents the penalty function. Indicates whether to select the i-th feature. For binary decision variables, ,when When the value is 0, it means that the i-th feature is not selected. When the value is 1, it indicates that the i-th feature is selected, where n is a natural number.

[0063] By modeling high-dimensional feature selection as a constrained QUBO problem and solving it using Qiskit's quantum-inspired optimizer, we can ensure that the selected features meet the requirements for quantity and information content.

[0064] S3. Obtain structured feature data, use the structured feature data to train a multi-node CatBoost model based on a federated learning framework, and obtain the trained global model;

[0065] Specifically, in step S3, a multi-node CatBoost model based on a federated learning framework is trained using structured feature data to obtain the trained global model, including:

[0066] S31. Perform desensitization, outlier truncation, and normalization on the structured feature data to obtain normalized structured feature data;

[0067] The structured feature data includes BERT-encoded text features, standardized protocol features, temporal behavior features, and threat tags labeled with local rules. Sensitive text fields in the structured feature data are desensitized using HMAC-SHA256 hashing, such as converting / api / exploit.php to the irreversible hash value 9f86d081. Outlier truncation and normalization are performed on numerical features.

[0068] S32. Input the normalized structured feature data into the multi-node CatBoost model based on the federated learning framework for training to obtain the trained multi-node CatBoost model;

[0069] CatBoost is a gradient boosting decision tree (GBDT) algorithm. During training, it configures the mixed feature parameters of a multi-node CatBoost model, addresses the problem of sample imbalance in the stratified sampling process, and protects the parameters through gradient clipping and Laplacian noise injection.

[0070] S33. Perform weighted average aggregation on the parameters of the trained multi-node CatBoost model, and obtain the trained global model based on the processed parameters.

[0071] The parameters of the trained multi-node CatBoost model are uploaded to a central server. The central server processes the parameters to generate a global model, which is then distributed to each node for continuous optimization. This eliminates the need to share raw traffic data and allows for rapid adaptation to new cross-node threats. In federated learning, each node uploads de-identified hash values ​​and tags to a text tag mapping dictionary. By aggregating high-frequency threat tags, the global model is optimized, enabling cross-domain threat intelligence synchronization. At the same time, differential privacy technology ensures that the original text is not leaked, balancing detection efficiency and privacy security.

[0072] In one possible design, the standardization process is also included: the 30-dimensional high-discrimination feature vector subset is standardized to obtain a standardized 30-dimensional high-discrimination feature vector subset.

[0073] The standardized 30-dimensional high-discrimination feature vector subset is divided into multiple data subsets according to the preset multi-tasks. The multiple data subsets are then assigned to different preset multi-tasks, which include C2 detection, DNS tunnel detection, Webshell detection, and attack scanning detection.

[0074] Multiple data subsets are allocated to different preset multitasking tasks according to preset allocation rules. For example, the detection of DNS tunnels does not require data subsets from the HTTP protocol.

[0075] The calculation expression for standardizing a subset of 30-dimensional high-discrimination feature vectors is as follows:

[0076] ;

[0077] In the above formula, This represents a standardized subset of 30-dimensional high-discrimination feature vectors. This represents a subset of 30-dimensional high-discrimination feature vectors. This represents the median. It is represented as the interquartile range.

[0078] S4. Input the 30-dimensional high-discrimination feature vector subset into the trained global model to perform preset multi-task threat detection and obtain the multi-task detection results.

[0079] In one possible design, before performing preset multi-task threat detection, a moving average of the traffic statistics features is calculated based on the hourly full-traffic system data, establishing a baseline for normal behavior. If the currently extracted vector features deviate from the normal behavior baseline by more than three times the standard deviation, threat detection is triggered. The full-traffic system is existing technology and will not be described in detail here.

[0080] The calculation expression for the currently extracted vector features is:

[0081] ;

[0082] In the above formula, This represents the currently extracted vector feature value. This represents the mean of the baseline for normal behavior. The standard deviation represents the baseline of normal behavior.

[0083] The multi-task detection results include C2 detection results, DNS tunnel detection results, Webshell detection results, and attack scan detection results.

[0084] Specifically, in step S4, a subset of 30-dimensional high-discrimination feature vectors is input into the trained global model to perform preset multi-task threat detection, obtaining multi-task detection results, including:

[0085] S41. A dynamic pipeline framework is adopted, and C2 detection, DNS tunnel detection, Webshell detection and attack scanning detection are performed on multiple data subsets based on the trained global model to obtain C2 detection results, DNS tunnel detection results, Webshell detection results and attack scanning detection results.

[0086] The trained global model structure is a gradient boosting tree with a depth of 6, which includes, but is not limited to, isolated forests, GRU networks, Bi-LSTM networks, XGBoost classifiers, and STL models.

[0087] Furthermore, the calculation expression for the multi-task detection result is as follows: In the formula, This represents the number of leaf nodes in the k-th tree. Indicates the weight of the leaf node. Indicates the feature division region, Indicates an indicator function, This represents the output of the k-th tree. Indicates the number of trees. This represents the feature vector in a 30-dimensional high-discrimination feature vector subset, where the feature partitioning region is generated through feature splitting and is related to the distribution of the input features, and the leaf node weights are automatically learned by gradient descent during training.

[0088] Specifically, in step S41, C2 detection, DNS tunnel detection, Webshell detection, and attack scanning detection are performed on multiple data subsets based on the trained global model, resulting in C2 detection results, DNS tunnel detection results, Webshell detection results, and attack scanning detection results, including:

[0089] S411. Perform C2 detection on multiple data subsets based on isolated forest and GRU network to obtain C2 detection results;

[0090] Specifically, the input data subset includes network layer traffic metadata and TLS / SSL handshake information. First feature engineering is performed on the network layer traffic metadata and TLS / SSL handshake information. Detection is conducted using an isolated forest and a GRU network. The isolated forest detects bursty connection anomalies, while the GRU network learns the heartbeat packet timing pattern. The network layer traffic metadata includes a 5-tuple, connection duration, and packet size sequence. The TLS / SSL handshake information includes the certificate SAN field and cipher suite anomalies. The first feature engineering process includes extracting the main frequency energy ratio through Fourier transform and cross-validating the certificate chain's credibility based on the CA database and validity period. The C2 detection result represents the identified high-frequency short connections and abnormal traffic.

[0091] S412. DNS tunnel detection is performed on multiple data subsets based on a Bi-LSTM network to obtain DNS tunnel detection results;

[0092] Specifically, the input data subset includes DNS query logs and response message timings. Second feature engineering is performed on these data. A Bi-LSTM network is used to learn the contextual dependencies of long-connection DNS requests. A rule engine filters explicit anomalies. DNS query logs include QNAME, QTYPE, and RDLENGTH. Response message timings include the interval distribution of requests from the same client. Second feature engineering includes entropy anomalies and calculation of subdomain hierarchy depth. The DNS tunnel detection result is the result of domain entropy anomalies and long-connection behavior.

[0093] S413. Webshell detection is performed on multiple data subsets based on the XGBoost classifier to obtain Webshell detection results;

[0094] Specifically, the input data subset includes HTTP request logs and web server file metadata. Third-party feature engineering is performed on these data, and the payload distribution pattern is learned using an XGBoost classifier. Known Webshell fingerprints are matched using rule chains. The HTTP request logs include URL path, request body size, and cookie fields. The web server file metadata includes modification time and file permission hashes. Third-party feature engineering includes calculating the encrypted payload entropy and detecting file timestamp anomalies. The Webshell detection result is derived from analyzing the encrypted payload size distribution and request patterns.

[0095] S414. Attack scanning and detection are performed on multiple data subsets based on the STL model to obtain the attack scanning and detection results.

[0096] Specifically, the NetFlow / IPFIX flow records and application layer protocol parsing results in the input data subset are subjected to fourth feature engineering processing. The periodic trends of traffic are decomposed by STL, residual anomalies are detected, and the thresholds are adjusted according to the historical baseline. The NetFlow / IPFIX flow records include source / destination ports, protocol type, and flag bits. The fourth feature engineering processing includes calculating the SYN flood index and protocol compliance score. The attack scan detection results are the results of capturing bursty traffic and abnormal protocol usage.

[0097] In one possible design, the above model supports real-time incremental updates, each model runs independently, shares common features, dynamically loads task-specific features, and dynamically adjusts the classification threshold according to the real-time false alarm rate to ensure that the real-time false alarm rate is <0.015.

[0098] Furthermore, during C2 detection, the cross-entropy is weighted, with a selectable weight of 5, to give higher weight to threat samples and alleviate the problem of insufficient C2 threat samples. During DNS tunnel detection, FocalLoss is used for updating to solve the class imbalance problem, reduce the weight of already classified samples, and focus on difficult samples, such as minority class DNS tunnel samples.

[0099] The first aspect of this embodiment provides a method for detecting encrypted traffic based on federated learning and quantum-inspired optimization. This method overcomes the limitations of traditional encrypted traffic detection technologies, improves detection accuracy and efficiency, and simultaneously protects privacy and optimizes resources. Specifically:

[0100] (1) This embodiment does not require traffic decryption. By integrating multimodal features, it can accurately identify encryption threats. The system supports the monitoring of various threats such as C2 communication, DNS tunneling, Webshell transmission and attack scanning, avoiding the risk of privacy leakage. It is suitable for high encryption scenarios such as HTTPS, providing enterprises with a more secure and universal protection method.

[0101] (2) By introducing a federated learning framework, the model can be optimized through distributed collaboration of multiple internal nodes, which can quickly learn the threat patterns across nodes, improve real-time performance and accuracy, avoid the extension of datasets and privacy issues, and provide continuous evolution protection capabilities for dynamic network environments.

[0102] (3) By optimizing feature selection through quantum-inspired algorithms, the system can be deployed in a lightweight manner in a containerized microservice architecture, adapting to mainstream cloud platforms, providing the internal security team with a low-cost, high-performance detection solution, and reducing the need for hardware upgrades;

[0103] (4) Federated learning enables data to remain local and only model parameters to be transmitted for updates, avoiding cross-node sharing of raw traffic. It is suitable for multi-device scenarios within enterprises and provides dual guarantees of compliance and practicality.

[0104] (5) The dynamic Pipeline framework is adopted to support parallel detection of four types of detection tasks. Each task is processed by an independent CatBoost model, sharing common features and dynamically loading task-specific features. It can be started and stopped on demand through containerized microservice encapsulation, and supports scalability based on business needs, providing good adaptability and expansion space for future threat scenarios.

[0105] like Figure 2 As shown, the second aspect of this embodiment provides an encrypted traffic detection system based on federated learning and quantum-inspired optimization, comprising:

[0106] The acquisition module is used to collect real attack data, scanner data, and human-simulated attack data. It performs data fusion on the real attack data, scanner data, and human-simulated attack data to obtain fused data, stores the fused data on different nodes, and preprocesses the fused data to obtain preprocessed fused data.

[0107] The filtering module is used to segment the preprocessed fused data to obtain multiple single list data. Based on the trained encoding model, the single list data is vectorized to obtain a 128-dimensional feature vector. Based on the quantum heuristic algorithm and objective function, the 128-dimensional feature vector is filtered to obtain a 30-dimensional high-discrimination feature vector subset. The 30-dimensional high-discrimination feature vector subset includes protocol layer feature vectors, traffic statistics feature vectors, payload semantic feature vectors, and time-series behavior feature vectors.

[0108] The training module is used to acquire structured feature data, and to train a multi-node CatBoost model based on a federated learning framework using the structured feature data to obtain the trained global model.

[0109] The detection module is used to input a subset of 30-dimensional high-discrimination feature vectors into the trained global model to perform preset multi-task threat detection and obtain multi-task detection results.

[0110] The working process, working details and technical effects of the aforementioned system provided in the second aspect of this embodiment can be found in the encrypted traffic detection method based on federated learning and quantum-inspired optimization described in the first aspect, and will not be repeated here.

[0111] This embodiment provides a third aspect of a computer device for executing the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in the first aspect. The device includes a memory, a processor, and a transceiver connected sequentially in communication. The memory stores a computer program, the transceiver sends and receives messages, and the processor reads the computer program and executes the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in the first aspect. Specifically, the memory may include, but is not limited to, random-access memory (RAM), read-only memory (ROM), flash memory, first-in-first-out (FIFO) memory, and / or first-in-last-out (FILO) memory, etc.; the processor may include, but is not limited to, a microprocessor of the STM32F105 series. Furthermore, the computer device may also include, but is not limited to, a power module, a display screen, and other necessary components.

[0112] The working process, working details and technical effects of the aforementioned computer device provided in the third aspect of this embodiment can be found in the encrypted traffic detection method based on federated learning and quantum-inspired optimization described in the first aspect, and will not be repeated here.

[0113] The fourth aspect of this embodiment provides a computer program product for executing the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in the first aspect, including a computer program or instructions, which, when executed by a computer, are used to implement the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in the first aspect.

[0114] The working process, working details, and technical effects of the aforementioned computer program product provided in this embodiment can be found in the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in the first aspect, and will not be repeated here.

[0115] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting encrypted traffic based on federated learning and quantum-inspired optimization, characterized in that, include: Collect real attack data, scanner data, and human-simulated attack data; fuse the real attack data, scanner data, and human-simulated attack data to obtain fused data; preprocess the fused data to obtain preprocessed fused data. The preprocessed fused data is segmented to obtain multiple single-list data. Based on the trained encoding model, the single-list data is vectorized to obtain 128-dimensional feature vectors. Based on the quantum-inspired algorithm and objective function, the 128-dimensional feature vectors are filtered to obtain a 30-dimensional high-discrimination feature vector subset. The 30-dimensional high-discrimination feature vector subset includes protocol layer feature vectors, traffic statistics feature vectors, payload semantic feature vectors, and time-series behavior feature vectors. Obtain structured feature data, use the structured feature data to train a multi-node CatBoost model based on a federated learning framework, and obtain the trained global model; A subset of 30-dimensional high-discrimination feature vectors is input into the trained global model to perform preset multi-task threat detection, and the multi-task detection results are obtained.

2. The encrypted traffic detection method based on federated learning and quantum-inspired optimization according to claim 1, characterized in that, The fused data is preprocessed to obtain preprocessed fused data, including: The merged data is deleted based on preset irrelevant fields, and the merged data after deletion is processed to remove duplicate values, fill in missing values ​​and blank values; The filled fused data is sorted alphabetically by first letter, and the sorted fused data is then subjected to text extraction to obtain preprocessed fused data.

3. The encrypted traffic detection method based on federated learning and quantum-inspired optimization according to claim 1, characterized in that, The objective function is calculated as follows: ； In the above formula, Indicates the importance of feature i. This represents the correlation between feature i and feature j. Indicates whether to select a feature, where, ,when When the value is 0, it indicates that no feature is selected. When the value is 1, it indicates the selection of features. Represents the penalty function. This indicates whether to select the i-th feature. For binary decision variables, ,when When the value is 0, it means that the i-th feature is not selected. When the value is 1, it indicates that the i-th feature is selected, where n is a natural number.

4. The encrypted traffic detection method based on federated learning and quantum-inspired optimization according to claim 1, characterized in that, A multi-node CatBoost model based on a federated learning framework is trained using structured feature data to obtain the trained global model, which includes: The structured feature data is desensitized, outliers are truncated, and normalized to obtain normalized structured feature data. Normalized structured feature data is input into a multi-node CatBoost model based on a federated learning framework for training, resulting in a trained multi-node CatBoost model. The parameters of the trained multi-node CatBoost model are weighted and aggregated, and the trained global model is obtained based on the processed parameters.

5. The encrypted traffic detection method based on federated learning and quantum-inspired optimization according to claim 1, characterized in that, Before inputting a subset of 30-dimensional high-discrimination feature vectors into the trained global model for preset multi-task threat detection, the following steps are also included: The 30-dimensional high-discrimination feature vector subset is standardized to obtain the standardized 30-dimensional high-discrimination feature vector subset. The standardized 30-dimensional high-discrimination feature vector subset is divided into multiple data subsets according to the preset multi-tasks. The multiple data subsets are then assigned to different preset multi-tasks, which include C2 detection, DNS tunnel detection, Webshell detection, and attack scanning detection.

6. The encrypted traffic detection method based on federated learning and quantum-inspired optimization according to claim 5, characterized in that, The multi-task detection results include C2 detection results, DNS tunnel detection results, Webshell detection results, and attack scan detection results; The step of inputting a subset of 30-dimensional high-discrimination feature vectors into the trained global model for preset multi-task threat detection, and obtaining multi-task detection results, includes: A dynamic pipeline framework is adopted, and C2 detection, DNS tunnel detection, Webshell detection and attack scanning detection are performed on multiple data subsets based on the trained global model to obtain C2 detection results, DNS tunnel detection results, Webshell detection results and attack scanning detection results.

7. The encrypted traffic detection method based on federated learning and quantum-inspired optimization according to claim 6, characterized in that, The trained global model includes isolated forest and GRU network, Bi-LSTM network, XGBoost classifier and STL model; based on the trained global model, C2 detection, DNS tunnel detection, Webshell detection and attack scanning detection are performed on multiple data subsets to obtain C2 detection results, DNS tunnel detection results, Webshell detection results and attack scanning detection results, including: C2 detection was performed on multiple data subsets based on isolated forest and GRU network to obtain C2 detection results; DNS tunnel detection is performed on multiple data subsets based on a Bi-LSTM network to obtain DNS tunnel detection results; Webshell detection was performed on multiple data subsets using the XGBoost classifier to obtain Webshell detection results. Attack scanning and detection are performed on multiple data subsets based on the STL model to obtain attack scanning and detection results.

8. A encrypted traffic detection system based on federated learning and quantum-inspired optimization, used to implement the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in any one of claims 1 to 7, characterized in that, include: The acquisition module is used to collect real attack data, scanner data, and human-simulated attack data. It performs data fusion on the real attack data, scanner data, and human-simulated attack data to obtain fused data, stores the fused data on different nodes, and preprocesses the fused data to obtain preprocessed fused data. The filtering module is used to segment the preprocessed fused data to obtain multiple single list data. Based on the trained encoding model, the single list data is vectorized to obtain a 128-dimensional feature vector. Based on the quantum heuristic algorithm and objective function, the 128-dimensional feature vector is filtered to obtain a 30-dimensional high-discrimination feature vector subset. The 30-dimensional high-discrimination feature vector subset includes protocol layer feature vectors, traffic statistics feature vectors, payload semantic feature vectors, and time-series behavior feature vectors. The training module is used to acquire structured feature data, and to train a multi-node CatBoost model based on a federated learning framework using the structured feature data to obtain the trained global model. The detection module is used to input a subset of 30-dimensional high-discrimination feature vectors into the trained global model to perform preset multi-task threat detection and obtain multi-task detection results.

9. A computer device, characterized in that, The device includes a memory, a processor, and a transceiver that are sequentially and communicatively connected. The memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or the instructions are executed by the computer, they implement the encrypted traffic detection method based on federated learning and quantum-inspired optimization as described in any one of claims 1 to 7.

Images