Encrypted network traffic classification method and system based on large model hierarchical fine tuning

Abstract

The invention discloses an encrypted network flow classification method based on large model hierarchical fine tuning, comprising the following steps: obtaining an input tensor used for representing encrypted network flow data to be classified; inputting the input tensor into a local time sequence aggregator, so that the local time sequence aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism; inputting the short-time high-frequency burst features and the input tensor into a hierarchical fine-tuning large model to enable the hierarchical fine-tuning large model to extract encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fusing the short-time high-frequency burst features and the encrypted traffic features to obtain advanced spatial-temporal features; and based on the short-time high-frequency burst feature and the advanced spatial-temporal feature, obtaining a classification result of the encrypted network traffic data to be classified. According to the method, the accuracy of classifying the encrypted network traffic data can be improved, and meanwhile, the training resource consumption is reduced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network flow analysis and identification, and particularly relates to an encrypted network flow classification method and system based on large model hierarchical fine-tuning. BACKGROUND

[0002] With the acceleration of the information age, various new network applications emerge in an endless stream, leading to explosive growth of traffic data on the Internet. Accurate classification of network traffic is crucial for optimizing network resource management, ensuring service quality, and supporting service providers in providing customized services. Given that more and more network communications begin to use encryption protocols such as Internet Protocol Security (IPsec) and Transport Layer Security (TLS) to protect user privacy, encrypted traffic now accounts for a large portion of total network traffic. While these encryption measures improve the security of communications, they also pose new challenges, as they obscure the specific content of the traffic, making traffic analysis more difficult. In the face of the characteristics of the current network environment, in order to ensure the security of cyberspace, network traffic classification technology plays an increasingly important role in monitoring network security incidents and perceiving network conditions. This technology is not only a key means of distinguishing between normal network activity and potential malicious traffic, but also an important tool for promoting the development of network security research and practical applications. Therefore, developing effective encrypted traffic classification methods has far-reaching significance for improving network security levels.

[0003] In recent years, with the continuous development of deep learning technology, it has brought new possibilities for network traffic analysis and encrypted traffic identification tasks. Currently, encrypted traffic is mainly classified based on convolutional neural networks (CNN), statistical features, and traditional machine learning methods. Although traditional classification methods can improve the content recognition ability of encrypted traffic to some extent, there are obvious deficiencies in accuracy and robustness in complex scenarios. For example, Beauty and the Burst is a typical encrypted traffic classification method based on convolutional neural networks. The core idea of this method is to segment and normalize the original traffic sequence, extract the time series statistical features of the traffic, and use a CNN model to automatically model and classify these features. However, the CNN model mainly focuses on spatial local features, which can lead to a decrease in classification accuracy in complex scenarios. In addition, traditional classification methods usually use uniform model parameters, which makes it difficult to adapt efficiently to specific traffic scenarios while ensuring the generality of multiple encrypted traffic types. That is, the model has limited transferability in new scenarios, and with the increase in the number of model layers and parameters, the computational resource consumption of training and inference is significantly increased, especially in large-scale traffic scenarios, resulting in high deployment and maintenance costs.

[0004] Therefore, how to improve the accuracy of classifying encrypted traffic in a complex scene while reducing the consumption of training resources is a technical problem that needs to be solved at present. SUMMARY

[0005] In view of the problem of how to improve the accuracy of classifying encrypted traffic in a complex scene, the present application provides an encrypted network traffic classification method based on large model hierarchical fine-tuning. The technical problem to be solved by the present application is realized by the following technical scheme: The present application provides an encrypted network traffic classification method based on large model hierarchical fine-tuning, comprising: obtaining an input tensor, the input tensor being used to represent encrypted network traffic data to be classified; The input tensor is input into a local time series aggregator, so that the local time series aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism; The short-time high-frequency burst features and the input tensor are input into a hierarchical fine-tuning large model, so that the hierarchical fine-tuning large model extracts encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fuses the short-time high-frequency burst features and the encrypted traffic features to obtain high-level spatio-temporal features; Based on the short-time high-frequency burst features and the high-level spatio-temporal features, a classification result of the encrypted network traffic data to be classified is obtained.

[0006] In an embodiment of the present application, the input tensor is obtained, comprising: The initial encrypted network traffic data is obtained, the initial encrypted network traffic data is segmented according to a preset time window, the original features of each traffic segment are extracted, and each original feature is normalized and standardized to obtain the input tensor.

[0007] In an embodiment of the present application, the local time series aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism, comprising: The local time series aggregator performs linear projection operation on each original feature in the input tensor through a deep convolution mechanism to extract short-time high-frequency burst features of each original feature.

[0008] In an embodiment of the present application, the convolution kernel in the deep convolution mechanism is 1x1, the step is 1, and the number of convolution layers is 1.

[0009] In an embodiment of the present application, the hierarchical fine-tuning large model comprises L layers of LLaMA encoder layers connected in sequence, L being a positive integer greater than zero, each layer of LLaMA encoder layer comprising a multi-head self-attention mechanism module, a feedforward network and an RMS normalization layer connected in sequence, the multi-head self-attention module being used to extract encrypted traffic features in the input tensor through three groups of query, key and value vectors, the feedforward network being used to perform position-independent nonlinear transformation and feature expansion on each original feature, and the RMS normalization layer being used to perform root mean square normalization on the encrypted traffic features and the short-time high-frequency burst features to obtain advanced spatio-temporal features.

[0010] In an embodiment of the present application, the hierarchical fine-tuning large model comprises a first group of LLaMA encoder layers and a second group of LLaMA encoder layers, the first group of LLaMA encoder layers comprising LLaMA encoder layers of the 1st layer to the Uth layer, the second group of LLaMA encoder layers comprising LLaMA encoder layers of the U+1th layer to the Lth layer, U being a positive integer greater than zero and less than L, only the model parameters of the RMS normalization layer of each LLaMA encoder layer in the first group of LLaMA encoder layers being trainable and updated to retain general traffic features in the input tensor, and each model parameter of each LLaMA encoder layer in the second group of encoder layers being trainable and updated to enable the hierarchical fine-tuning large model to extract encrypted traffic features while retaining general traffic features in the input tensor.

[0011] In an embodiment of the present application, based on the short-time high-frequency burst features and the advanced spatio-temporal features, a classification result of the encrypted network traffic data to be classified is obtained, comprising: splicing the short-time high-frequency burst features and the advanced spatio-temporal features to obtain spliced features; mapping the spliced features to a target class space through a fully connected layer, and generating a probability distribution of each class through a Softmax function to obtain the classification result of the encrypted network traffic data to be classified.

[0012] Another aspect of the present application provides an encrypted network traffic classification system based on hierarchical fine-tuning of a large model, comprising: a preprocessing module configured to obtain an input tensor, the input tensor being used to represent encrypted network traffic data to be classified; a feature extraction module configured to input the input tensor into a local time series aggregator, so that the local time series aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism; the feature extraction module is further configured to input the short-time high-frequency burst features and the input tensor into a hierarchical fine-tuning large model, so that the hierarchical fine-tuning large model extracts encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fuses the short-time high-frequency burst features and the encrypted traffic features to obtain advanced spatio-temporal features. The classification module is configured to obtain a classification result of the encrypted network traffic data to be classified based on the short-time high-frequency burst feature and the advanced spatio-temporal feature.

[0013] Another aspect of the present application provides a storage medium having a computer program stored therein, the computer program being configured to perform the steps of the encrypted network traffic classification method based on large model hierarchical fine-tuning according to any one of the above embodiments.

[0014] Another aspect of the present application provides an electronic device comprising a memory and a processor, the memory having a computer program stored therein, and the processor being configured to implement the steps of the encrypted network traffic classification method based on large model hierarchical fine-tuning according to any one of the above embodiments when invoking the computer program in the memory.

[0015] Compared with the prior art, the present application has the following advantages: The present application can accurately capture the short-time high-frequency burst feature in the encrypted network traffic data through the local temporal aggregator (LTA). Unlike the traditional temporal convolution method, the LTA can identify and capture the local fluctuations of the encrypted network traffic, such as burst traffic surge and temporal pattern anomaly, through a deep convolution mechanism. These local features are exactly what attackers rely on when transmitting hidden information. Therefore, the LTA can effectively improve the content recognition accuracy of the encrypted network traffic data by extracting the short-time high-frequency burst feature in the encrypted network traffic data, thereby improving the accuracy of classifying the encrypted network traffic data.

[0016] In addition, the hierarchical parameter fine-tuning mechanism of the hierarchical fine-tuning large language model (HiFT-LLM) can learn the specific spatio-temporal patterns of encrypted traffic on the basis of preserving the general knowledge of the pre-trained large model, so as to extract the encrypted traffic features in the input tensor. This not only reduces the number of model parameters to be trained and the consumption of training resources, but also enhances the adaptability and generalization performance of the hierarchical fine-tuning large language model to different encrypted network traffic scenarios, balancing the generality and specificity. Finally, based on the short-time high-frequency burst feature and the advanced spatio-temporal feature, the classification result of the encrypted network traffic data to be classified is obtained, ensuring the efficiency and stability from data processing to classification result output, facilitating the deployment and expansion in actual scenarios, and effectively meeting the demand for deep analysis of encrypted network traffic in complex network environments, i.e. solving the adaptability and expansibility problem of the traditional scheme in complex scenarios.

[0017] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1is a flowchart of an encrypted network traffic classification method based on large model hierarchical fine-tuning provided by an embodiment of the present application. Figure 2 is a structural schematic diagram of the large model hierarchical fine-tuning provided by an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined object, the following will be described in detail in combination with the drawings and specific embodiments, and the encrypted network traffic classification method based on large model hierarchical fine-tuning according to the present application.

[0020] The foregoing and other technical contents, features and effects of the present application can be clearly presented in the following detailed description of specific embodiments in combination with the drawings. Through the description of the specific embodiments, the technical means and effects adopted by the present application to achieve the predetermined object can be more deeply and specifically understood. However, the attached drawings are provided for reference and illustration only, and are not intended to limit the technical solutions of the present application.

[0021] It should be noted that, in this document, relational terms such as first and second and the like can only be used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations exist in any such actual relationship or order. Moreover, the terms "comprising", "including" or any other variant thereof are intended to cover non-exclusive inclusion, so that a product or device including a list of elements does not necessarily include only those elements, but can include other elements not explicitly listed. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the product or device including the element.

[0022] The present application is directed to how to improve the accuracy of classifying encrypted traffic in complex scenarios while reducing the consumption of training resources, and provides an encrypted network traffic classification method based on large model hierarchical fine-tuning. Please refer to Figure 1 The method comprises the following steps: Step 1: Obtain an input tensor, which is used to represent encrypted network traffic data to be classified.

[0023] Among them, the encrypted network traffic data can be web browsing traffic, instant messaging traffic, file transfer traffic, online audio streaming traffic, etc., which is not limited by the embodiments of the present application.

[0024] In some embodiments, the initial encrypted network traffic data can be obtained, and the initial encrypted network traffic data can be divided into a plurality of time windows T seq(This can also be understood as the time step) Segment the data, extract the original features of each traffic segment, and normalize and standardize each original feature to obtain the input tensor X.

[0025] Step 2: Input the input tensor into the Local Temporal Aggregator (LTA) so that the LTA can extract short-term high-frequency burst features from the input tensor through a deep convolution mechanism.

[0026] In some embodiments, after the input tensor X is input into the local temporal aggregator, the local temporal aggregator can perform a linear projection operation on each original feature in the input tensor X, i.e. the original feature of each traffic segment, through a deep convolution mechanism, to extract short-term high-frequency burst features of each original feature (e.g., bitrate changes, keyframes, etc. in a video stream).

[0027] To streamline the algorithm, the depthwise convolution mechanism uses a 1×1 kernel, a stride of 1, and 1 convolutional layer.

[0028] Specifically, the formula for performing linear projection is as follows:

[0029] in, This represents the short-term, high-frequency burst characteristics of the i-th flow segment. Indicates that for the first t The learnable weight matrix at each time step, This represents all batches (B) in the input tensor X. This represents a learnable bias term. Indicates the dimension of the output feature.

[0030] It should be noted that the local view provided by the local time-series aggregator, acting as a detector for high-frequency time-series changes, effectively complements the low-frequency global representations provided by other global representation modules. In network side-channel attacks, the local time-series aggregator can identify and capture local fluctuations in encrypted network traffic data, such as sudden traffic surges and abnormal timing patterns. These local fluctuations are precisely what attackers rely on when transmitting covert information.

[0031] Furthermore, by explicitly decoupling spatiotemporal dimension operations, the local temporal aggregator effectively circumvents the suppression of short-term, high-frequency burst characteristics by the global traffic propagation model, significantly enhancing the system's sensitivity to high-frequency abnormal signals in attack traffic. These microsecond-level pulses carry crucial fingerprints of video content; by accurately parsing such signals, the model successfully infers the specific content identifiers of encrypted videos, thereby revealing potential privacy information.

[0032] Step 3: inputting the short-time high-frequency burst feature and the input tensor into the hierarchical fine-tuning large model, so that the hierarchical fine-tuning large model extracts the encrypted traffic features in the input tensor based on the hierarchical parameter fine-tuning mechanism, and fuses the short-time high-frequency burst feature and the encrypted traffic feature to obtain high-level spatio-temporal features.

[0033] Specifically, as shown in Figure 2 The hierarchical fine-tuning large model includes L layers of LLaMA encoder layers connected in sequence, L is a positive integer greater than zero, and each layer of LLaMA encoder layer includes a multi-head self-attention mechanism module (Multi-Head Self-Attention, Self-Attn), a feed-forward network (Feed-Forward Network, FFN) and an RMS normalization layer (RMSNorm) connected in sequence. In the embodiment of the application, the rotation position encoding (RoPE) is embedded in the attention calculation to encode the position information of the data packet in time sequence without introducing additional trainable parameters.

[0034] In the embodiment of the application, as shown in Figure 2 The hierarchical fine-tuning large model includes a first group of LLaMA encoder layers and a second group of LLaMA encoder layers, the first group of LLaMA encoder layers includes the first layer to the U layer of LLaMA encoder layer, and the second group of LLaMA encoder layers includes the U+1 layer to the L layer of LLaMA encoder layer, U is a positive integer greater than zero and less than L.

[0035] Because the model parameters in the RMS normalization layer play a crucial role in adapting to the change of input data distribution and maintaining gradient stability. Therefore, each LLaMA encoder layer in the first group of LLaMA encoder layers only normalizes the trainable update of the parameters, that is, only the model parameters in the RMS normalization layer are trainable, to retain the general traffic features in the input tensor, while avoiding the risk of overfitting under limited data, by keeping the self-attention mechanism module and the feed-forward network fixed, thereby retaining the basic patterns and structural features in the encrypted network traffic data.

[0036] Each model parameter of each LLaMA encoder layer in the second group of encoder layers is trainable, so that the hierarchical fine-tuning large model can learn complex spatio-temporal patterns related to encrypted network traffic and network side channel attack tasks while retaining general traffic features in the input tensor, especially the data transmission patterns in encrypted network traffic. By training and updating each model parameter in the U+1 layer to the L layer of LLaMA encoder layer, the hierarchical fine-tuning large model can more accurately learn the features of encrypted network traffic, and then accurately extract encrypted traffic features.

[0037] Specifically, in the process of training update (fine-tuning) of each model parameter, the set of trainable parameters of the model can be defined as:

[0038] wherein, represents all model parameters updated in the training update process, is a trainable parameter in the standardization component (such as a scaling factor or a bias term in RMSNorm), is all model parameters in the LLaMA encoder layers from the U+1th layer to the Lth layer.

[0039] It should be noted that this selective fine-tuning strategy greatly reduces the number of parameters that need to be trained, greatly improving the training efficiency compared to full model adaptation.

[0040] As can be seen from the above, the hierarchical fine-tuning of the large model is stacked by L layers of LLaMA encoder layers, each encoder layer contains three key sub-components, namely the multi-head self-attention mechanism module, the feedforward network and the RMS normalization layer, and each sub-component undertakes different functions.

[0041] Among them, the multi-head self-attention module is used to extract encrypted traffic features in the input tensor X through three groups of query, key and value vectors, and its core calculation can be represented as:

[0042] wherein, are linear mapping matrices of the input tensor X, is a scaling factor, is a transpose operation on .

[0043] The feedforward network is after the multi-head self-attention module, which is used for position-independent nonlinear transformation and feature expansion of the original features of each traffic segment, that is, the feedforward network independently processes the original features of each traffic segment, effectively refining and expanding the key information in the multi-head self-attention module output, and improving the perception ability of fine-grained traffic patterns. Its main calculation process can be represented as:

[0044] wherein, is the nonlinear transformation result of the feedforward network to the input tensor X, , and are trainable model parameters, is a gating activation function.

[0045] The RMS normalization layer is used to perform root mean square normalization on the encrypted traffic features and the short-time high-frequency burst features within each LLaMA encoder layer to stabilize the training and accelerate the convergence, and obtain advanced spatio-temporal features, and the calculation thereof can be represented as:

[0046]

[0047] wherein, is the input tensor after root mean square normalization, , are trainable scaling parameters and offset parameters, respectively, is a numerical stability term, is a Hadamard product.

[0048] It should be noted that by omitting mean centering and relying only on root mean square scaling, RMSNorm has lower computational overhead than traditional LayerNorm, and also plays a key role in maintaining stable internal representations in deep networks and alleviating gradient vanishing or explosion.

[0049] In the embodiments of the present application, as shown in Figure 2 each LLaMA encoder layer includes two RMS normalization layers, i.e., a first RMS normalization layer and a second RMS normalization layer, the first RMS normalization layer is located after the multi-head self-attention mechanism module and is used to normalize the encrypted traffic features output by the multi-head self-attention mechanism module, and the second RMS normalization layer is located after the feedforward network and is used to normalize the features after the linear transformation Step 4: Based on the short-time high-frequency burst features and the advanced spatio-temporal features, a classification result of the encrypted network traffic data to be classified is obtained.

[0050] In some embodiments, based on the short-time high-frequency burst features and the advanced spatio-temporal features, a classification result of the encrypted network traffic data to be classified is obtained, including: The short-time high-frequency burst features and the advanced spatio-temporal features are spliced to obtain spliced features; The spliced features are mapped to a target class space through a fully connected layer for dimension compression and feature fusion, and a probability distribution of each class is generated through a Softmax function to obtain a classification result of the encrypted network traffic data to be classified.

[0051] In conclusion, the short-time high-frequency burst features in the encrypted network flow data are accurately captured by the local time sequence aggregator, unlike the traditional time sequence convolution method, the local time sequence aggregator can identify and capture the local fluctuations of the encrypted network flow, such as burst traffic surge, time sequence mode anomaly, etc., and these local features are relied on by the attacker when transmitting hidden information, therefore, the local time sequence aggregator can effectively improve the content recognition accuracy of the encrypted network flow data by extracting the short-time high-frequency burst features in the encrypted network flow data, thereby improving the accuracy of classifying the encrypted network flow data.

[0052] In addition, the hierarchical parameter fine-tuning mechanism of the hierarchical fine-tuning large language model is used to learn the specific space-time patterns of the encrypted traffic, so as to extract the encrypted traffic features in the input tensor, which not only reduces the number of model parameters to be trained and reduces the training resource consumption, but also enhances the adaptability and generalization performance of the hierarchical fine-tuning large language model to different encrypted network flow scenarios, and balances the generality and specificity, finally, based on the short-time high-frequency burst features and the advanced space-time features, the classification result of the encrypted network flow data to be classified is obtained, which ensures the efficiency and stability from data processing to classification result output, is convenient for deployment and expansion in actual scene, effectively meets the demand of encrypted network flow deep analysis in complex network environment, that is, solves the adaptability and expansibility problem of the traditional scheme in complex scene.

[0053] Another embodiment of the application provides an encrypted network flow classification system based on hierarchical fine-tuning of a large model, which comprises: A preprocessing module is configured to obtain an input tensor, the input tensor being used to represent encrypted network flow data to be classified; A feature extraction module is configured to input the input tensor into a local time sequence aggregator, so that the local time sequence aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism; The feature extraction module is further configured to input the short-time high-frequency burst features and the input tensor into a hierarchical fine-tuning large model, so that the hierarchical fine-tuning large model extracts encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fuses the short-time high-frequency burst features and the encrypted traffic features to obtain advanced space-time features; A classification module is configured to obtain a classification result of the encrypted network flow data to be classified based on the short-time high-frequency burst features and the advanced space-time features.

[0054] In several embodiments provided by the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic. For example, the division of the modules is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Accordingly, the actual implementation can not be limited to the described division.

[0055] In addition, each function module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically, or two or more modules can be integrated into one module. The integrated module can be realized in the form of hardware or in the form of hardware plus software function module.

[0056] Another embodiment of the present application provides a storage medium, which stores a computer program for executing the steps of the method for classifying encrypted network traffic based on large model hierarchical fine-tuning in the above embodiments.

[0057] Another aspect of the present application provides an electronic device including a memory and a processor, the memory storing a computer program, and the processor invoking the computer program in the memory to implement the steps of the method for classifying encrypted network traffic based on large model hierarchical fine-tuning as described in the above embodiments. Specifically, the integrated module realized in the form of software function module can be stored in a computer readable storage medium. The software function module stored in a storage medium includes a plurality of instructions for causing an electronic device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0058] The above is a further detailed description of the present application in combination with specific preferred embodiments, and the specific implementation of the present application should not be limited to these descriptions. For ordinary skilled persons in the technical field to which the present application belongs, several simple deductions or substitutions can be made without departing from the concept of the present application, and all of them should be considered as falling within the protection scope of the present application.

Claims

1. A method for encrypted network traffic classification based on large model hierarchical fine-tuning, characterized in that, The method comprises the following steps: An input tensor is obtained, which is used to represent encrypted network traffic data to be classified; The input tensor is input into a local time series aggregator, so that the local time series aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism; The short-time high-frequency burst features and the input tensor are input into a hierarchical fine-tuning large model, so that the hierarchical fine-tuning large model extracts encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fuses the short-time high-frequency burst features and the encrypted traffic features to obtain high-level space-time features; Based on the short-time high-frequency burst features and the high-level space-time features, a classification result of the encrypted network traffic data to be classified is obtained.

2. The large model-based hierarchical fine-tuning encrypted network traffic classification method of claim 1, wherein, The input tensor is obtained by: Obtaining initial encrypted network traffic data, segmenting the initial encrypted network traffic data according to a preset time window, extracting original features of each traffic segment, and normalizing and standardizing each original feature to obtain the input tensor.

3. The method of claim 2, wherein, The local time series aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism, which comprises: The local time series aggregator performs linear projection operation on each original feature in the input tensor through the deep convolution mechanism to extract short-time high-frequency burst features of each original feature.

4. The large model-based hierarchical fine-tuning encrypted network traffic classification method of claim 3, wherein, The convolution kernel in the deep convolution mechanism is 1*1, the step is 1, and the convolution layer number is 1.

5. The large model-based hierarchical fine-tuning encrypted network traffic classification method of claim 2, wherein, The hierarchical fine-tuning large model comprises L layers of LLaMA encoder layers connected in sequence, L is a positive integer greater than zero, each LLaMA encoder layer comprises a multi-head self-attention mechanism module, a feedforward network and an RMS normalization layer connected in sequence, the multi-head self-attention module is used to extract encrypted traffic features in the input tensor through three groups of query, key and value vectors, the feedforward network is used to perform position-independent nonlinear transformation and feature expansion on each original feature, and the RMS normalization layer is used to perform root mean square normalization on the encrypted traffic features and the short-time high-frequency burst features to obtain the high-level space-time features.

6. The large model-based hierarchical fine-tuning encrypted network traffic classification method of claim 5, wherein, The hierarchical fine-tuning large model comprises a first group of LLaMA encoder layers and a second group of LLaMA encoder layers, the first group of LLaMA encoder layers comprises the first layer to the Uth layer of the LLaMA encoder layers, the second group of LLaMA encoder layers comprises the U+1th layer to the Lth layer of the LLaMA encoder layers, U is a positive integer greater than zero and less than L, only the model parameters of the RMS normalization layer of each LLaMA encoder layer in the first group of LLaMA encoder layers can be trained and updated to retain general traffic features in the input tensor, and each model parameter of each LLaMA encoder layer in the second group of encoder layers can be trained and updated, so that the hierarchical fine-tuning large model extracts the encrypted traffic features while retaining the general traffic features in the input tensor.

7. The large model-based hierarchical fine-tuning encrypted network traffic classification method of claim 1, wherein, The classification result of the encrypted network traffic data to be classified is obtained based on the short-time high-frequency burst feature and the advanced spatio-temporal feature, and the classification result of the encrypted network traffic data to be classified is obtained based on the short-time high-frequency burst feature and the advanced spatio-temporal feature. The short-time high-frequency burst feature and the advanced spatio-temporal feature are spliced to obtain spliced features. The spliced features are mapped to a target category space through a full connection layer, and a probability distribution of each category is generated through a Softmax function to obtain the classification result of the encrypted network traffic data to be classified.

8. A large model-based hierarchical fine-tuning encrypted network traffic classification system, characterized in that, It comprises: The preprocessing module is used for acquiring an input tensor, and the input tensor is used for representing encrypted network traffic data to be classified. The feature extraction module is used for inputting the input tensor into a local time series aggregator, so that the local time series aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism. The feature extraction module is also used for inputting the short-time high-frequency burst features and the input tensor into a hierarchical fine-tuning large model, so that the hierarchical fine-tuning large model extracts encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fuses the short-time high-frequency burst features and the encrypted traffic features to obtain advanced spatio-temporal features. The classification module is used for obtaining the classification result of the encrypted network traffic data to be classified based on the short-time high-frequency burst feature and the advanced spatio-temporal feature.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor calls the computer program in the memory to realize the steps of the encrypted network traffic classification method based on large model hierarchical fine-tuning according to any one of claims 1 to 7.

10. A storage medium having stored therein a computer program, characterized in that, The computer program is used for executing the steps of the encrypted network traffic classification method based on large model hierarchical fine-tuning according to any one of claims 1 to 7.

Images