Encrypted traffic detection method based on multi-dimensional feature parallel fusion

Abstract

The invention relates to an encrypted traffic detection method based on multi-dimensional feature parallel fusion, and belongs to the technical field of network security. According to the method, when a multi-dimensional feature parallel fusion framework is constructed, the limitation of traditional statistical features on dynamic evolution characterization of encryption behaviors and the dependency of graph neural network topology modeling on computing resources are fully considered; through collaborative optimization of a Markov chain dynamic quantization protocol interaction state transition rule and a lightweight graph attention hierarchical compression mechanism, a detection model gives consideration to deep feature perception capability and efficient reasoning capability at the same time; based on the classification decision realized by the fusion mechanism, the recognition robustness and real-time defense efficiency of the encrypted malicious traffic are remarkably improved, and the active security protection level of the network is effectively enhanced.

Description

Technical Field

[0001] The present invention relates to an encrypted traffic detection method based on parallel fusion of multi-dimensional features, belonging to the technical field of network security. Background Art

[0002] Feature engineering is a key technology for traffic detection. Since the rise of machine learning, machine learning algorithms such as support vector machines (SVMs), naive Bayes (NBs), random forests (RFs), and XGBoost have achieved excellent results in traffic detection by leveraging statistical metrics such as session duration, packet length distribution, and byte entropy. However, machine learning algorithms can only serve as classifiers. While they offer strong interpretability, they struggle to adapt to the complex traffic patterns generated dynamically by new encryption protocols. In contrast, deep learning models, with their highly nonlinear structures, are well-suited for complex datasets. In recent years, traffic detection methods using deep learning methods such as convolutional and recurrent neural networks for feature extraction and classification have become a research hotspot. For example, these methods employ convolutional neural networks or recurrent architectures to directly learn feature representations from raw traffic. However, these deep learning methods typically ignore external connections between network traffic flows and focus primarily on internal information. While this improves model generalization, they suffer from two drawbacks: first, they ignore the state transition patterns in network protocol interactions; second, they place high demands on hardware resources and real-time processing, limiting their feasibility for deployment on edge devices. In fact, Graph Convolutional Network (GCN) has been introduced into the field of malicious traffic detection due to its powerful modeling ability for non-Euclidean data. GCN generates a graph embedding representation by aggregating neighborhood node information, and can automatically learn the topological correlation features of entities (such as IP, session) in network traffic. Some studies have proven its effectiveness in detecting complex attack scenarios (such as lateral movement and C&C communication). However, most studies on encrypted traffic classification analyze the traffic dimension and session dimension in isolation, or graph-based methods tend to only emphasize the external connections between network flows, and fail to effectively integrate multi-level information such as temporal state, topological correlation, and server-side behavior, resulting in blind spots in the detection of hidden threats. With the popularization of TLS / SSL encryption protocols, attackers abuse encrypted tunnels to hide malicious behaviors (such as ransomware instruction transmission and APT infiltration). Existing detection methods face severe challenges due to the limited traditional feature representation capabilities and inefficient multimodal information fusion. Traditional methods based on traffic content analysis have become ineffective. Existing technologies often rely on artificial features, making it difficult to capture the dynamic patterns of new encrypted traffic, deep learning models ignoring the topological correlation between traffic, and graph neural networks (GCN) have high computational overhead and cannot meet real-time detection needs.

[0003] In 2015, Bruna et al. from the University of California, Berkeley proposed a graph-theoretic frequency-domain convolution method based on Plaus matrix decomposition. This method extended the convolution operation to non-Euclidean graph structures for the first time, laying a mathematical foundation for GCN to handle network topology relationships. The basic principles of this model are as follows:

[0004] Assume that there are N business flows and each flow has M-dimensional features. Define the traffic feature matrix as (The i-th row represents the characteristics of the i-th flow). Then the flow adjacency matrix is ​​defined Indicates the adjacency relationship of flows in the traffic graph. When flows i and j have a common IP host, A ij =1, otherwise A ij = 0 represents the flow as a node, and the edge represents the flow with a public IP host, i.e. A ij = 1. After introducing the first-order approximate renormalization technique, the specific steps of the operation of a GCN unit are:

[0005] First, N business flows are combined into an N-dimensional unit matrix I N Add an A operation to expand,

[0006] Get the expanded value.

[0007] Then, based on this value, the degree matrix is ​​accumulated and calculated to obtain of.

[0008]

[0009] Finally, the two values ​​are multiplied to get Perform renormalized Laplace matrix operations and introduce the weight matrix W and ReLU activation function f(·)

[0010]

[0011] Through such operations, we can get a layer of GCN operation unit. In the future, we can build multiple layers of GCN operation units based on the definition of the connection layer. The method is:

[0012] First, the weight matrix with H input features Input to the hidden layer will have a weight matrix of F predefined applications Hidden to the output layer.

[0013] Then, the weight matrix W (0) and W (1) Training is done by gradient descent. For multi-class classification with F classes, the loss function is minimized by minimizing the cross entropy error on the set of labeled examples:

[0014]

[0015] Finally, the entire 2-layer GCN architecture model is as follows:

[0016]

[0017] There are two shortcomings when the GCN graph convolution method is extended to large-scale network traffic graphs to classify network traffic: on the one hand, the GCN message passing mechanism requires global access to the adjacency matrix. When processing ultra-large-scale networks (such as more than 10^4 nodes), its computational complexity causes memory explosion and a surge in inference latency; on the other hand, if a single GCN model relies on a pre-built static traffic graph for both feature extraction and classification, it cannot respond in real time to dynamic behaviors such as the addition / disappearance of nodes and changes in edge weights, resulting in reduced real-time performance and classification accuracy.

[0018] To address the GCN model's issues, researchers have used various optimization algorithms to increase GCN model training speed, thereby optimizing model performance and computational complexity. One proposed a network traffic classification method that combines the statistical features of graph convolutional structures with decision trees (Combining Trace Graph with Statistical Features for Network Traffic Classification). This method uses a sparsely stored GCN model only in the feature extraction phase, and then uses a decision tree to classify based on features, thereby improving classification speed and recall. The classification process of this method mainly includes three steps:

[0019] In the first step, the simplified GCN model is trained to extract network traffic features. Sparse-dense matrix multiplication is used to represent sparse matrices. Limiting the maximum value of the neighbor edge of Edge in the traffic tracking graph maximizes the retention of the neighborhood information of the traffic trajectory graph and improves the computational efficiency.

[0020] The second step is to process and enhance local structural information. We use the homogeneity between flows and their multi-order neighborhoods to provide more useful local structural information, and define the K-order neighborhood of the flow in the flow tracking graph as the flow that reaches from the central flow through K hops, where the spectral convolution operation on the graph is defined as the signal With the filter g in the Fourier domain θ (Λ) = product of diag(θ):

[0021] y=g θ (L)x=g θ (UΛU T )x=Ug θ (Λ)U T x

[0022] In addition, for large graphs, the eigendecomposition of L is computationally expensive. To alleviate the computational problem, we use K-order truncated Chebyshev polynomials to approximate g θ (Λ):

[0023]

[0024] in, λ max is the largest eigenvalue of the matrix L. Chebyshev polynomial T K (x) can be obtained by the recursive formula T K (x) = 2xT K-1 (x)-T K-2 (x) calculation, where T0 = 1, T1 = x. θ Applying the convolution of , we get the following approximation:

[0025]

[0026] T k yes The value of the K-order Chebyshev polynomial is approximately represented by the following recursive relation:

[0027]

[0028] The overall K-order model is of the form:

[0029]

[0030] Through the K-order domain model, we can enhance structural information in graph-structured network traffic while optimizing the speed of feature training and extraction. By using Chebyshev polynomials to approximate frequency domain convolution, we can reduce the computational complexity to O(|E|) (the number of edges), enabling GCN to efficiently process graphs with tens of thousands of nodes.

[0031] In the third step, during GCN model training, the traffic trajectory map of the combine harvester is combined with the statistical features, and the combined feature points are classified through a machine learning algorithm decision tree to leverage the advantages of both and achieve higher classification accuracy with less labeled data.

[0032] From the above principles, it can be seen that the existing traffic classification algorithm that combines traffic trajectory graphs and statistical features can better optimize the structural characteristics of graph network traffic. However, the GCN structural characteristics do not consider multi-level information such as the temporal state, topological association, and server behavior of low-order flows, and the single traditional decision tree structure classifier is prone to overfitting, which makes the encrypted traffic classification directly affect the generalization ability of the model. Summary of the Invention

[0033] The application aims to provide an encrypted traffic detection method based on multi-dimensional feature parallel fusion to solve the problems of slow detection rate and low classification accuracy caused by single feature set dimension when using graph convolutional neural network for feature extraction.

[0034] The application provides an encrypted traffic detection method based on multi-dimensional feature parallel fusion HMF-GAT (Hierarchical Multi-dimensional Feature Fusion with Graph Attention Network) to solve the above technical problems, which comprises the following steps:

[0035] 1) Extract two-dimensional traditional features: session flow level (TCP state second-order Markov feature, session traffic statistical feature) and traffic packet dimension feature;

[0036] 2) Construct a dynamic heterogeneous graph (node = IP / port entity, edge = request-response relationship), and extract graph structure semantic features by improved lightweight graph attention network (GAT);

[0037] 3) After the traditional feature is vectorized (Scikit-learn standardization), it is spliced with the graph feature (GAT output) into a fusion feature vector, and a machine learning classifier is used to realize end-to-end classification, and the traffic detection result is output.

[0038] Further, the step 1) uses Scapy to analyze the TCP state sequence to construct a second-order Markov chain, and calculates the state transition probability matrix, and the objective function is:

[0039] P(X t+1 =x t+1 |X t =x t ,X t-1 =x t-1 ,...,X0=x0)=P(X t+1 =x t+1 |X t =x t ,X t-1 =x t-1 )

[0040] Wherein, X t represents the state of the system at time t, and the second-order Markov formula is used to describe the TCP state transition probability, which focuses on the TCP states S t-1 ,S t ,S t+1 Then for a given binary state sequence (S t-1 ,S t ), the next state St+1 The probability is: P(S t+1 =s t+1 |S t =s t ,S t-1 =s t-1 )Use the state transition probability matrix to quantify the TCP state characteristics.

[0041] Furthermore, the Wireshark tool is used to extract traditional traffic features: six key features in two dimensions: session flow level (session duration, total number of session bytes, server IP features) and traffic packet level (packet length sequence features, length distribution features, packet statistical features), to obtain multi-level optimal traditional traffic features.

[0042] Furthermore, in step 2), when using GAT to extract structural feature values, the GAT model is improved to obtain a lightweight structure, and a dual-head → single-head attention hierarchical model is used:

[0043] 1) First layer: Use the dual-head attention mechanism to weighted aggregate neighbor node information:

[0044]

[0045] K is the number of attention heads, and the output of each head is By averaging the final output h i The model uses multiple attention heads to perform a weighted summation of each node’s neighboring nodes;

[0046] 2) Second layer: When compressing features to the binary classification space, the single-head attention mechanism is used to improve the efficiency of feature extraction, and the output of the first layer h (1) Compressed to category space: where β ij is the single-head attention coefficient, U∈R 2h×c is the classification weight matrix, output is the probability distribution of node categories;

[0047] 3) The masked attention mechanism is used to limit the range of neighbor nodes to the top-10 weight edges to reduce the error of single extreme features.

[0048] Furthermore, when training with the GAT model, a dynamic early stopping strategy is used: training is terminated when the validation set loss does not decrease for five consecutive rounds to achieve an increase in detection rate.

[0049] Furthermore, step 3) utilizes traditional feature vectorization (Scikit-learn standardization) and flattened graph feature embedding (GAT output) to parallelly splice into a fused feature vector, and then uses a machine learning classifier to implement end-to-end classification output of traffic detection results to achieve a multi-dimensional feature set of traffic dimension, session dimension and internal / external structural features.

[0050] Furthermore, in the classification using traditional machine learning algorithms, the extreme gradient boosting (XGBoost) strategy is used to iteratively train weak classifiers (decision trees) and form a strong classifier through weighted combination. The objective function of the XGBoost classifier is:

[0051]

[0052] in: The loss function uses the cross entropy loss function to measure the model prediction value and the true value y i The difference between them is used to correct the deviation; the regularization term Ω(f k ), reducing the complexity of the model and improving its robustness.

[0053] The beneficial effects of the present invention are: when constructing a multi-dimensional feature parallel fusion framework, the present invention fully considers the limitations of traditional statistical features in characterizing the dynamic evolution of encryption behavior and the dependence of graph neural network topology modeling on computing resources, and through the collaborative optimization of the interactive state transfer law of the Markov chain dynamic quantization protocol and the lightweight graph attention hierarchical compression mechanism, the detection model takes into account both deep feature perception capabilities and efficient reasoning capabilities; the classification decision based on this fusion mechanism significantly improves the recognition robustness and real-time defense effectiveness of encrypted malicious traffic, effectively enhancing the level of active network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a flowchart of an implementation method of an encrypted traffic detection method based on parallel fusion of multi-dimensional features according to an embodiment of the present invention;

[0055] Figure 2 This is a TCP state transition diagram according to an embodiment of the present invention;

[0056] Figure 3 is a computational flow chart of a graph attention convolutional network (GATConv) model in an embodiment of the present invention;

[0057] Figure 4 1 is a flowchart of the implementation of feature extraction training of the attention convolutional network in an embodiment of the present invention;

[0058] Figure 5This is a tree diagram comparing the performance of the present invention and existing methods on the DataCon2020 encrypted traffic raw dataset;

[0059] Figure 6 This is a tree diagram comparing the performance of the present invention and existing methods on the DataCon2020 encrypted traffic balance dataset;

[0060] Figure 7 This is a scatter plot comparing the detection rates of the present invention and the existing methods on the DataCon2020 encrypted traffic raw data set;

[0061] Figure 8 This is a scatter plot comparing the detection rates of the present invention and the existing methods on the DataCon2020 encrypted traffic balance dataset; DETAILED DESCRIPTION

[0062] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0063] The present invention first extracts multi-dimensional traditional features (TCP state second-order Markov transition probability, packet sequence, server IP, etc.) at the session flow level and packet level from network traffic, and builds a lightweight graph attention model with the goal of optimizing feature fusion efficiency under the dual conditions of graph neural network computational complexity constraints and real-time requirements; then, through a parallel splicing mechanism, the graph structure semantic features and traditional statistical features are fused and input into the XGBoost classifier; finally, efficient and accurate identification of encrypted malicious traffic is achieved. The present invention fully considers the blind spots of traditional statistical features in characterizing dynamic state transitions of encryption protocols (such as the temporal evolution characteristics of TCP state machines) and the redundant calculation problems of graph neural networks for cross-session associations. The detection system based on this framework significantly improves the robustness of identifying hidden encryption threats by quantifying abnormal state jumps (such as the state transition probability offset of SYN flood attacks), effectively enhancing the active response capability of network security defense.

[0064] In addition, the present invention combines graph structure feature extraction with dynamic behavior modeling to achieve dual optimization under the HMF-GAT framework: for the timing characteristics of TCP protocol interaction, a second-order Markov chain is used to model the state transition path, breaking through the static analysis limitations of traditional statistical features; for the computational bottleneck of existing graph models in traffic detection, the feature abstraction process of the graph attention network is converted into the node importance optimization problem of the interaction graph, and a hierarchical attention mechanism is used for topological modeling. A "dual-head aggregation-single-head compression" attention hierarchy is designed in the GAT model: the dual-head attention mechanism (first layer) is used to capture the multi-dimensional interaction pattern between heterogeneous nodes, and the single-head attention (second layer) is used to perform feature space dimensionality reduction and semantic focusing, forming a collaborative optimization pipeline of feature abstraction-compression-fusion; for the insufficient representation of traditional features and the complexity of neural network models, feature parallel fusion XGBoost classifier is used for classification, which effectively solves the generalization ability of the model and improves the detection rate. The implementation process of this method (referred to as the HMF-GAT algorithm) is as follows: Figure 1 As shown, the following is a detailed description.

[0065] 1. Extract multi-dimensional traditional features at the session flow level and packet level from network traffic.

[0066] Traditional network traffic features do not rely on deep learning models or graph structures; instead, they rely on conventional feature engineering. They extract basic traffic attributes and communication status information directly from the data through explicit statistical and analytical operations. These features, selected for fundamental network characteristics, capture different dimensions of traffic behavior, complementing and enhancing the detection capabilities of the model. By analyzing network traffic characteristics across multiple dimensions, we can characterize the behavioral patterns and inherent correlations of encrypted traffic, constructing a feature space that combines statistical properties with semantic expression.

[0067] First, we use Scapy to parse the TCP state sequence and build a second-order Markov chain. The timing transition characteristics of the TCP protocol state machine can be used to model the legitimacy and abnormal behavior of the session. Figure 2 , reflecting the behavior and characteristics of the TCP connection at different state stages. The second-order Markov characteristic considers the transition relationship between the current state and the next state, not just the frequency of occurrence of a single state. This method can more accurately reflect the time dependency and dynamic characteristics of state transitions in the TCP state sequence, thereby providing richer information for network traffic analysis. In the second-order Markov model, the probability of the system transitioning from time t to t+1 depends not only on the state at time t, but also on the state at time t-1. Mathematically, this can be expressed as:

[0068] P(X t+1 =x t+1 |X t =x t ,X t-1 =xt-1 ,...,X0=x0)=P(X t+1 =x t+1 |X t =x t ,X t-1 =x t-1 )

[0069] Among them, X t Represents the state of the system at time t, and applies the second-order Markov formula to describe the TCP state transition probability. Focus on the TCP state S at three consecutive time points t-1 ,S t ,S t+1 Then for a given binary state sequence (S t-1 ,S t ), reach the next state S t+1 The probability is:

[0070] P(S t+1 =s t+1 |S t =s t ,S t-1 =s t-1 )

[0071] Because SYN flood attacks cause a surge in the baseline percentage of the SYN_RECEIVED state, the KL divergence of the conditional probability matrix of its state transition path and normal traffic exceeds 12.8. Furthermore, the state dwell time parameters (such as shape parameter α and rate parameter β) fitted by the gamma distribution can detect TCP hijacking attacks. The probability that the α value of an abnormal session deviates by more than 3σ from the normal range is as high as 78%. A state transition probability matrix constructed based on a second-order Markov chain can quantify abnormal state changes under long-term dependencies.

[0072] Secondly, the Wireshark tool is used to directly obtain traditional traffic characteristics from the data: six key characteristics in two dimensions: session flow level (session duration, total number of session bytes, server IP characteristics) and traffic packet level (packet length sequence characteristics, length distribution characteristics, packet statistical characteristics), to obtain multi-level optimal traditional traffic characteristics.

[0073] Session-level statistical features, by aggregating transmission metadata within a time window, reveal macro-behavioral patterns in end-to-end communication. Metrics such as the uplink / downlink packet ratio, total byte count, session duration, and inter-packet time variance can distinguish between legitimate services and malicious activity. C2 communication typically exhibits short bursts of high concurrency and low byte counts, with a packet ratio skewness exceeding 3.2. Video streaming services, however, exhibit high total byte counts and low inter-packet time variance due to their long connections. The packet sequence n-gram model extracts patterns of packet lengths at fixed positions to construct behavioral fingerprints for malicious traffic. The Emotet trojan has a 92% match probability for the five-tuple packet sequence {403, 105, 51, 176, 508}, significantly exceeding the random distribution of legitimate traffic. The spatiotemporal distribution and associated topological characteristics of server IP addresses are key indicators for identifying malicious service nodes. Malicious server clusters are often concentrated in specific autonomous domains (such as AS12389) or geographical regions (e.g., some Eastern European countries). Their IP address reputation scores and historical behavioral profiles (such as active hours and DNS resolution records) deviate significantly from those of legitimate service nodes. Combined with IP entropy analysis, it can detect puppet host groups in distributed attacks. For example, the Shannon entropy of the source IP of DDoS attack traffic is often lower than the baseline threshold of legitimate services. Further integration of IP and digital certificate correlation analysis can identify phishing servers through abnormal matching between the certificate common name (CN) and SubjectAltName (such as wildcard abuse, domain name spelling variation). Empirical evidence shows that more than 80% of malicious servers use self-signed certificates or expired certificates, while this proportion is less than 5% for legitimate services.

[0074] The statistical characteristics of data packets are explicit features that are not hidden by encryption in encrypted traffic. Their length distribution characteristics and interaction patterns directly reflect the business logic of the application layer protocol. The packet length sequence in the TLS / SSL handshake phase follows the protocol specifications and is highly consistent. However, the packet length distribution in the data transmission phase varies significantly depending on the service type (such as video streaming, instant messaging, and file transfer). Using the sequence of packet sizes or time intervals between packets in a session, we can obtain the packet length / time series S = {P1, P2, ..., P n}, where each value P in the sequence i (where i∈[1,n]) represents the size of the i-th packet, or the time interval between the i-th packet and the (i+1)-th packet before it. The order in which packets are transmitted in a session is consistent with the order in which the packets are arranged in this sequence.

[0075] Finally, selecting a set of efficient features helps to improve the computational efficiency of the model, avoids unnecessary computational burden caused by redundant features, and also maintains good real-time performance in encrypted traffic detection. Because in the network traffic detection scenario, computational efficiency and real-time performance are often very important considerations. The present invention fully considers the key behaviors and structures of traffic when selecting traditional features. The multi-dimensional features from the session level to the traffic level cover multiple aspects of traffic while avoiding feature redundancy and overfitting problems. It plays a core role in distinguishing encrypted traffic from ordinary traffic, and can also be combined with graph convolution features extracted by deep learning to improve the overall effect of encrypted traffic detection. This choice enables the model to have strong recognition capabilities while maintaining high efficiency and real-time performance, and has strong discrimination capabilities in encrypted traffic detection.

[0076] 2. Construct a dynamic heterogeneous graph (node ​​= IP / port entity, edge = request-response relationship) and extract the semantic features of the graph structure through an improved lightweight graph attention network (dual-head-single-head attention GAT).

[0077] To address the constraints of graph structure complexity and real-time requirements, a lightweight encrypted traffic representation learning model with a "dual-head-single-head" attention hierarchy is designed. The graph attention model is used to capture the topological dependencies between traffic entities. The implementation process of graph structure semantic feature extraction is as follows:

[0078] Step 1: Graph Attention (GAT) model construction

[0079] First, a five-tuple is used to identify a network communication. The five-tuple flow between the i-th pair of communication nodes is defined as the set {SrcIP, DstIP, SrcPort, DstPort, TP}, where the source IP address, destination IP address, source port number, destination port number, and transport layer protocol between the communication nodes are in the flow. Then, the model architecture process is defined based on the five-tuple: the traffic interaction graph is G = (V, E), where node v i ∈V represents IP entity, edge e ij ∈E represents the communication relationship between IPs. Node feature matrix X graph =GAT(A,E), A is the adjacency matrix, E is the initial node embedding (port number, protocol type and other topology-related meta-attributes). Figure 3 , the model uses graph attention convolution (GATConv) to achieve feature abstraction, and the specific implementation steps are as follows:

[0080] (1) Node feature linear transformation

[0081] For each node i, the input feature h i , first through a linear transformation h i ′=Wh iGet the new feature representation, where W is the weight matrix to be learned.

[0082] (2) Graph Attention Mechanism Operation

[0083] For node i and one of its neighbor nodes j, calculate the attention coefficient e ij :

[0084] e ij =LeakyReLU(a T [Wh i ||Wh j ])

[0085] Where a is the attention weight vector to be learned, and || represents the connection operation of the features.

[0086] Attention coefficient e ij The weight α is obtained after softmax normalization ij :

[0087]

[0088] Where N(i) represents all neighbor nodes of node i.

[0089] (3) Weighted summation

[0090] Use the attention coefficient α ij Perform weighted summation of the features of neighboring nodes:

[0091]

[0092] Where σ is the activation function ReLU.

[0093] (4) Graph Attention Convolutional Layer Calculation

[0094] The first layer of GATConv uses a multi-head attention mechanism. The features of each node will be calculated by multiple attention heads, and then the outputs of these heads are averaged. For the multi-head attention mechanism, assuming there are K attention heads (there are two attention heads in the first layer, K = 2), the output of each head is Then the final output by averaging is:

[0095]

[0096] The model uses multiple attention heads to perform weighted summation of neighboring nodes of each node, updates node representation, and captures more different graph structure information. The second layer uses a single-head attention mechanism to improve feature extraction efficiency by simplifying the model and aggregating the first layer output h (1) Compressed to category space:

[0097]

[0098] where β ij is the single-head attention coefficient, U∈R 2h×c is the classification weight matrix, output is the probability distribution of node categories.

[0099] Step 2: Graph Attention (GAT) model training and feature extraction

[0100] The designed lightweight graph attention model is used to capture the topological dependencies between traffic entities, such as Figure 4 , this operation process includes the following six steps:

[0101] (1) Setting the optimizer and loss function

[0102] Use Adam (Adaptive Moment Estimation) optimizer. Adam is a widely used optimization algorithm that combines RMSProp and momentum methods. The main advantage of Adam is that it can adaptively adjust the learning rate to improve convergence efficiency. Its operation can be divided into two steps. The first step is to initialize the parameters: the learning rate α controls the step size of the parameter update. A larger value may lead to non-convergence, and a smaller value will slow down the convergence speed (usually set to 0.001); the first-order decay rate β1 determines the influence of the historical gradient on the current gradient, and the second-order decay rate β2 controls the influence of the square value of the historical gradient on the current update (usually β1 = 0.9, β2 = 0.999); a small constant ∈ (usually ∈ = 10 -8 , used to prevent division by zero errors); initialize the first-order moment estimate m0 = 0; initialize the second-order moment estimate v0 = 0; initialize the time step t = 0. The second step updates the parameters: for each iteration step t, increase the time step t = t + 1; calculate the gradient (The gradient of the loss function with respect to the parameters) updates the first-order moment estimate and the second-order moment estimate:

[0103] m t =β1m t-1 +(1-β1)g t

[0104]

[0105] To perform bias correction:

[0106]

[0107] Update the parameters θ:

[0108]

[0109] Among them, m tis the first-order moment estimate of the current time step, representing the exponentially weighted average of the gradient; v t is the second-order moment estimate at the current time step, representing the exponentially weighted average of the squared gradient; and are bias-corrected first- and second-order moment estimates to ensure that there is no bias due to initialization in the early stages of training.

[0110] Use the cross entropy loss function. The cross entropy loss function is a commonly used loss function for classification problems. It quantifies the difference between the predicted distribution and the true distribution. The optimization goal is to minimize this loss. For binary classification problems, the cross entropy loss function can be expressed as:

[0111]

[0112] Among them, y i is the true label (0 or 1); is the probability predicted by the model (value between 0 and 1); N is the total number of samples; is the loss value, which represents the difference between the prediction and the actual label.

[0113] (2) Perform forward propagation and calculate logits: Input the graph structure g and node features node_features into the GAT model for training, perform forward propagation, and calculate the output logits.

[0114] (3) Calculate the loss: Use the cross entropy loss function to calculate the loss between the predicted logits and the true label target.

[0115] (4) Backpropagation and optimization: Use the optimizer to update the model weight parameters and calculate the gradient through loss.backward() for backpropagation.

[0116] (5) Early stopping mechanism: Set up an early stopping mechanism to monitor the loss of the model on the validation set. If the loss does not decrease within a certain epoch (the best parameter is set to epoch = 5 in this model experiment), stop training early.

[0117] (6) Extracting features from the best model: Finally, the trained GAT model is used to extract the semantic features of the graph structure, and the high-dimensional embedding representation of the graph structure is converted into a one-dimensional array compatible with the traditional feature dimension. The flatten operation is used to flatten the matrix into a one-dimensional array vector through dimension folding:

[0118]

[0119] Specifically, assume that the node embedding matrix output by GAT is (N is the number of nodes, d is the embedding dimension), first linear mapping: flatten: E→v flat where v flat [k] = E [k / d],kmodd ; Then unfold in row-major order (traverse all elements from left to right, from top to bottom starting from the first row and first column element of the matrix, and store the traversal result in a continuous memory space in order): Finally, output a one-dimensional feature vector.

[0120] Through the above process, multi-dimensional feature extraction such as session level, flow packet level and graph structure semantics can be realized.

[0121] 3. After traditional feature vectorization (Scikit-learn standardization), parallel splicing with graph feature embedding (GAT output) into fusion feature vector, using machine learning classifier to realize end-to-end classification, outputting traffic detection results, the specific implementation process is as follows:

[0122] Step 1 Standardization processing

[0123] Standardization processing is used to eliminate feature scale differences and make each dimension value conform to the standard normal distribution (mean is 0, standard deviation is 1). Scikit-learn's StandardScaler operation is used to execute the following linear transformation for traditional feature vectorization: μ: training set feature mean vector (dimension m) σ: training set feature standard deviation vector (dimension m)

[0124] Specifically, let the traditional feature set be (n is the number of samples, m is the feature dimension), then the standardization process is defined as:

[0125]

[0126] where, μj: the mean of the jth feature of the training set; σj: the standard deviation of the jth feature of the training set; n train n: the number of samples in the training set (i.e. the number of data points); X raw,ij Xij: the value of the jth feature of the ith sample (row) in the original data matrix, and finally output the standardized feature matrix

[0127] Step 2 Feature fusion and classification implementation

[0128] (1) Feature splicing operation: connect the traditional feature vector after standardization (dimension M) and the flattened graph feature vector (dimension N) at the beginning and end along the feature dimension direction to generate a fusion feature vector (total dimension M+N), and the objective function is: where [·; ·] denotes concatenation along the feature dimension, and dim(V fused ) = m + Nd and Nd > 10 3 (typical embodiment) for defining the dominance of high-dimensional graph features.

[0129] Through the above process, multi-dimensional feature fusion in parallel can be realized.

[0130] (2) Classifier decision classification

[0131] The fusion feature vector is input into the pre-trained machine learning classifier to output the final traffic detection label. The classifier decision function is: f classifier The selection and application of the classifier are the core problems of improving the robustness and accuracy of classification. The deep learning method graph structure can provide rich context information when performing classification tasks, but its resource overhead is large and the efficiency is low. In view of this, in order to achieve efficient classification while taking into account efficiency, the machine learning method XGBoost (eXtreme Gradient Boosting) is selected as the classifier. XGBoost is an ensemble learning algorithm based on gradient boosting, widely used in classification and regression tasks in machine learning. The algorithm builds multiple decision trees to enhance the predictive performance of the model, and introduces a regularization term to effectively prevent overfitting. And f classifier is the prediction function of XGBoost, which satisfies: where K is the total number of decision trees used for efficient computation and processing of large-scale data, is the output of the kth tree, and a k is the weight coefficient. The core principle of XGBoost is based on the gradient boosting framework, which gradually adds new decision trees to correct the residual error of the previous round of model, so as to optimize the model performance. The objective function of XGBoost is further represented as:

[0132]

[0133] where t is the current iteration round (t e {1, 2, …, K}); n is the number of training samples; y i is the true label of the nth sample; is the cumulative prediction value of the previous round model; f t (x i ) is the prediction output of the tth tree; l(·) is a differentiable loss function used to measure the difference between the model prediction value and the true value y i ; and Ω(f k ) is the regularization term, and its objective function is:

[0134]

[0135] wherein T is the number of leaf nodes of the current tree; w is the leaf node weight vector (w j represents the score of the jth leaf node); γ is a leaf split complexity penalty coefficient (γ>0); λ is an L2 regularization coefficient (λ≥0), which is introduced to control the complexity of the model, effectively prevent overfitting, improve the generalization ability of the model, and realize the improvement of the classification efficiency.

[0136] Through the process, the encrypted traffic is classified and detected in the XGBoost classifier according to the parallel fusion of multi-dimensional features.

[0137] Experimental verification

[0138] In order to verify the performance of the HMF-GAT encrypted traffic detection algorithm of the present application, the following experiments are carried out under the same computing environment, and the existing encrypted traffic detection methods based on graph neural network algorithm (GCN-EAT, GCN-DT, GCN-TC), single traffic feature detection method based on machine learning algorithm (RF, NB, XGBoost, KNN, LR) and the HMF-GAT method proposed by the present application are used to classify the same data set, and the experimental results are compared and analyzed.

[0139] 1) Experimental setup

[0140] The test data set used in this experiment is the DataCon 2020 Open Dataset of Encrypted Malicious Traffic provided by Qianxin Technology Research Institute, which covers the traffic data of malicious software and normal software. The malicious traffic in the data set is derived from the encrypted traffic generated by exe type malicious software, and the benign traffic is derived from the encrypted traffic generated by exe type normal software. These traffic data mainly contain TLS / SSL packets transmitted through port 443. The computing environment used in the experiment realizes GAT using the PyTorch neural network framework, and the specific configuration of the experimental platform is shown in Table 1:

[0141] Table 1

[0142]

[0143]

[0144] First, the Wireshark tool is used to disassemble the data packets in the data set, and then extract the one-way flow based on IP and Dst. The data set contains 10000 traffic data packets (pcap), of which 5000 are malicious traffic data packets and another 5000 are benign traffic data packets. The specific distribution is shown in Table 2:

[0145] Table 2

[0146]

[0147] Then, given the significant difference in the number of flows between malicious and benign traffic, the study further explores the experimental results under the balanced data set after conducting experiments on the original data set. When there is too much malicious traffic, a stratified undersampling strategy is used to sample according to the proportion of traffic in each file to achieve balanced processing of the data set. The sampling probability of the file is calculated as follows:

[0148]

[0149] To prevent the deficiencies caused by probability sampling, a dynamic resampling strategy is used to dynamically adjust to ensure that the total number meets the standard. The specific distribution of the balanced data set after adjustment is shown in Table 3:

[0150] Table 3

[0151]

[0152] 2) Experimental evaluation and comparative analysis

[0153] First, determine the evaluation indicators to assess the performance of the encrypted traffic detection model. The widely recognized performance evaluation indicators are used to analyze the classification ability of the model from multiple dimensions. These evaluation indicators include accuracy, precision, recall, F1 score, and detection rate. Accuracy reflects the proportion of correct classification by the model; precision measures the accuracy of the model's prediction of malicious traffic; recall focuses on the proportion of actual malicious traffic that the model can identify; F1 score combines precision and recall to provide a balanced indicator of the two; and detection rate directly reflects the efficiency of the model in actual application. The calculation formulas of these evaluation indicators are as follows:

[0154]

[0155] Where TP represents positive samples predicted as positive; TN represents negative samples predicted as negative, FP represents negative samples predicted as positive; FN represents positive samples predicted as negative. Flow rate represents the number of network flows detected per second, n represents the total number of samples in the model test set, and t represents the total time taken to complete model training and output prediction, in seconds.

[0156] Then, in order to evaluate the optimization effect, the evaluation indexes were counted and compared by using tables, column charts and scatter charts when the original data set was used. The performance of different models on the DataCon2020 encrypted malicious traffic data set without balancing processing is shown in Table 4.

[0157] As can be seen from Table 4, under the same conditions, the accuracy and recall rate of the neural network model MLP and the machine learning model LR are poor; the recall rate of the GCN-TC model is the highest, but the accuracy and precision are low; the XGBoost classifier of single feature classification has low precision and F1 score. The method of the application achieves the best performance in accuracy and F1 score, which is higher than LR and the like. At the same time, it is also superior to the graph structure model in precision and recall rate and detection rate.

[0158] Table 4

[0159]

[0160]

[0161] Finally, since the proportion of malicious traffic in the original data set is relatively high, when dealing with unbalanced data, the classification model tends to focus on the majority class due to the limitation of the data itself, thereby ignoring the minority class. This uneven distribution of data categories seriously limits the recognition performance of the model on the minority class target. Therefore, according to the downsampling and dynamic compensation sampling strategies described above, the proportion of malicious and benign samples is adjusted to be close to 1:1, and then the evaluation indexes are counted and compared in the same way when the balanced data set is used. The performance of different models on the DataCon2020 encrypted malicious traffic data set after balancing processing is shown in Table 5.

[0162] As can be seen from Table 5, under the same detection conditions, the method of the application shows a significant improvement in comprehensive classification performance compared with single feature machine learning models such as XGBoost and random forest; compared with traditional statistical feature models, due to the fusion of graph attention structure features, the accuracy, precision, recall rate and F1 score are systematically optimized; compared with the same graph structure model GCN-EAT, while maintaining the advantage of high recall rate, the detection rate is increased by several times. The above results verify the enhancement effect of the parallel fusion mechanism of graph attention structure features and traditional features on the discrimination ability of the model, and the significant superiority of the hierarchical multi-dimensional feature fusion framework (HMF-GAT) in the cooperative optimization of detection accuracy and real-time performance.

[0163] Table 5

[0164]

[0165]

[0166] Figure neural network method (GCN-EAT, GCN-DT, GCN-TC), machine learning method (RF, NB, XGBoost, KNN, LR) and the method proposed in the application tree-like comparison such as Figure 5 and Figure 6 As shown in the figure, the vertical axis of the figure is the detection result, and the horizontal axis represents the detection performance index. As can be seen directly from the figure, the method proposed in the application is better than the machine learning and graph neural network methods on the original data set and the balanced data set. While the detection rate scatter plot comparison such as Figure 7 and Figure 8 As shown in the figure, the vertical axis of the figure is the detection comprehensive performance index F1 score, and the horizontal axis represents the detection rate. As can be seen directly from the figure, when the detection performance of the method proposed in the application is better than the machine learning and graph neural network methods on the original data set and the balanced data set, the detection rate can also meet the higher requirements.

Claims

1. An encrypted traffic detection method based on parallel fusion of multi-dimensional features, characterized in that: The method comprises the following steps: 1) Extract two-dimensional traditional features: session flow level (TCP state second-order Markov features, session traffic statistics features) and traffic packet dimension features; 2) Construct a dynamic heterogeneous graph (node ​​= IP / port entity, edge = request-response relationship) and extract the semantic features of the graph structure through an improved graph attention network (GAT); 3) After traditional feature vectorization (Scikit-learn standardization), it is parallelly spliced ​​with graph feature embedding (GAT output) to form a fused feature vector. A machine learning classifier is used to implement end-to-end classification and output the traffic detection results.

2. The encrypted traffic detection method based on parallel fusion of multi-dimensional features according to claim 1 is characterized in that: The extraction of the second-order Markov characteristics of the TCP state includes using Scapy to parse the TCP state sequence to construct a second-order Markov chain, and calculating the state transition probability matrix objective function as follows: P(X t+1 =x t+1 |X t =x t ,X t-1 =x t-1 ,...,X0=x0)=P(X t+1 =x t+1 |X t =x t ,X t-1 =x t-1 ) Among them, X t Represents the state of the system at time t, and applies the second-order Markov formula to describe the TCP state transition probability. Focus on the TCP state S at three consecutive time points t-1 ,S t ,S t+1 Then for a given binary state sequence (S t-1 ,S t ), reach the next state S t+1 The probability is: P(S t+1 =s t+1 |S t =s t ,S t-1 =s t-1 )Use the state transition probability matrix to quantify the TCP state characteristics.

3. The encrypted traffic detection method based on parallel fusion of multi-dimensional features according to claim 1 or 2 is characterized in that: The step 1) uses the Wireshark tool to extract six key features of two dimensions of traditional traffic features: session flow level (session duration, total number of session bytes, server IP features) and traffic packet level (packet length sequence features, length distribution features, packet statistical features), to obtain multi-level optimal traditional traffic features.

4. The encrypted traffic detection method based on parallel fusion of multi-dimensional features according to claim 1 is characterized in that: In step 2), when using GAT to extract structural feature values, the GAT model is improved to obtain a lightweight structure, and a dual-head → single-head attention hierarchical model is used: 1) First layer: Use the dual-head attention mechanism to weighted aggregate neighbor node information: K is the number of attention heads, and the output of each head is By averaging the final output h i The model uses multiple attention heads to perform a weighted summation of each node’s neighboring nodes; 2) Second layer: When compressing features to the binary classification space, the single-head attention mechanism is used to improve the efficiency of feature extraction, and the output of the first layer h (1) Compressed to category space: where β ij is the single-head attention coefficient, U∈R 2h×c is the classification weight matrix, output is the probability distribution of node categories; 3) The masked attention mechanism is used to limit the range of neighbor nodes to the top-10 weight edges to reduce the error of single extreme features.

5. The encrypted traffic detection method based on parallel fusion of multi-dimensional features according to claim 4 is characterized in that: When training the GAT model, a dynamic early stopping strategy is used: training is terminated when the validation set loss does not decrease for five consecutive rounds to achieve an increase in detection rate.

6. The encrypted traffic detection method based on parallel fusion of multi-dimensional features according to claim 1 is characterized in that: In step 3), traditional feature vectorization (Scikit-learn standardization) and flattened graph feature embedding (GAT output) are parallelly spliced ​​into a fused feature vector, and then a machine learning classifier is used to implement end-to-end classification output of traffic detection results to achieve a multi-dimensional feature set of traffic dimension, session dimension, and internal / external structural features.

7. The encrypted traffic detection method based on parallel fusion of multi-dimensional features according to claim 6 is characterized in that: In the classification using traditional machine learning algorithms, the eXtreme Gradient Boosting (XGBoost) strategy is used to iteratively train weak classifiers (decision trees) and form a strong classifier through weighted combination. The objective function of the XGBoost classifier is: in: The loss function uses the cross entropy loss function to measure the model prediction value and the true value y i The difference between them is used to correct the deviation; the regularization term Ω(f k ), reducing the complexity of the model and improving its robustness.

Images