A malicious encrypted traffic classification method and system based on conversation spatio-temporal feature map

Abstract

This invention proposes a method and system for classifying malicious encrypted traffic based on session spatiotemporal feature maps. The method includes: using a predefined sliding window to slide across a cleaned encrypted traffic session, extracting statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet payload α-Renyi entropy; using the packet size and packet arrival time features as the Y-axis and X-axis respectively, and mapping the packet payload α-Renyi entropy into grayscale values ​​to construct a session spatiotemporal feature map; inputting the session spatiotemporal feature map into a ResNet-50 model with a CBAM attention mechanism for malicious encrypted traffic classification. The proposed solution can adapt to different malicious encrypted traffic application scenarios, thereby achieving more efficient and accurate encrypted traffic classification.

Description

Technical Field

[0001] This invention belongs to the field of computer network security, and in particular relates to a method and system for classifying malicious encrypted traffic based on session spatiotemporal feature maps. Background Technology

[0002] In recent years, with increasing emphasis on privacy protection and rising cybersecurity standards, encrypted communication has become the norm. Encryption protocols such as HTTPS and TLS / SSL play a crucial role in ensuring data transmission security. However, this has also brought new challenges, as traditional methods for analyzing plaintext data traffic are gradually becoming ineffective. Faced with this situation, cybersecurity continues to explore new methods to adapt to today's encrypted environment.

[0003] Malicious encrypted traffic classification is an advanced cybersecurity technology that aims to identify and classify encrypted data streams without relying on decryption algorithms. This technology protects user privacy while effectively detecting and preventing potential security threats, thus contributing to network oversight.

[0004] With the advancement of artificial intelligence and machine learning technologies, their application in encrypted traffic classification has gradually attracted attention. By training complex models, these technologies can more accurately identify and classify different types of encrypted traffic, thereby improving the efficiency and effectiveness of detection and defense. The current state of malicious encrypted traffic classification technology can be mainly divided into three categories: (1) Malicious encrypted traffic classification based on traffic statistical features. This method focuses on analyzing the statistical features of data packets. By calculating and analyzing statistical information such as the mean length of data packets and arrival intervals, specific types of traffic can be identified. For example, different types of traffic can be distinguished by analyzing statistical indicators such as peak traffic and frequency. The advantage of this method is that it can comprehensively consider multiple statistical features, thereby improving the accuracy of classification. However, statistical analysis methods may require a large amount of data and complex calculations when facing highly dynamic and complex network environments, and are highly sensitive to noisy data. (2) Malicious encrypted traffic classification based on deep learning traffic packet features. The main idea of ​​this method is to convert network traffic data into features suitable for deep learning models to process, and then use the trained model for classification. For example, converting traffic packets into time series, feature vectors, etc. Commonly used methods include feature extraction of traffic packets (such as statistical features and spectral features) and data normalization. Its advantage is that deep learning models can handle a large amount of complex traffic data and automatically extract features, which is more efficient than traditional methods. Deep learning has a strong representation ability, and this method performs well in identifying complex traffic patterns. The classification accuracy is usually high and it has good generalization ability. However, the performance of its model is highly dependent on the quality and diversity of training data. If the training data is insufficient or biased, it may affect the classification effect. Its model is usually a "black box" model, which is difficult to explain its internal decision-making process, making it difficult to understand the decision basis of the model. (3) Malicious encrypted traffic classification based on traffic payload information of deep learning. The main idea of ​​this method is to extract the encrypted payload information in the network traffic data and use NLP-like technology to convert the encrypted payload information into a fixed-length vector representation using word embedding technology. Through the pre-trained language model of encrypted traffic, its powerful language understanding ability is used to further analyze whether the encrypted traffic is malicious traffic. However, this type of method relies on a pre-trained dataset with a large amount of training data, and the model is highly complex. For the classification of malicious encrypted traffic of untrained types, it is necessary to select and adjust according to specific scenarios and requirements, resulting in poor robustness.

[0005] In summary, while the methods described above each have their advantages, they also have certain limitations. To further improve the effectiveness and applicability of encrypted traffic classification technology, we introduce an innovative deep learning-based encrypted traffic classification method. Starting from the network behavior characteristics of encrypted traffic, this method extracts the temporal and spatial features of an encrypted session, constructing a session spatiotemporal feature map. This map includes features such as session packet size, packet arrival time, and information entropy. This method differs significantly from the traditional method of converting traffic data into grayscale images, which converts the binary data stream of traffic into grayscale images. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a technical solution for classifying malicious encrypted traffic based on session spatiotemporal feature maps.

[0007] The first aspect of this invention discloses a method for classifying malicious encrypted traffic based on session spatiotemporal feature maps, the method comprising:

[0008] Step S1: Use traffic processing tools to perform session segmentation on encrypted network traffic; perform data cleaning on the encrypted network traffic after session segmentation to remove noise and incomplete data packets;

[0009] Step S2: Use a sliding window of predefined duration to slide over the cleaned encrypted traffic session and extract the statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet load α-Renyi entropy.

[0010] Step S3: Using the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, the packet payload α-Renyi entropy is mapped into grayscale values ​​to form a grayscale image that reflects the traffic features, i.e., the session spatiotemporal feature map.

[0011] Step S4: Input the session spatiotemporal feature map into the ResNet-50 model with CBAM attention mechanism for malicious encrypted traffic classification.

[0012] According to the method of the first aspect of the present invention, in step S1, the data cleaning of the encrypted network traffic after session segmentation, removing noise and incomplete data packets, includes:

[0013] Remove packets with a length exceeding 1500 bytes from encrypted traffic sessions.

[0014] According to the method of the first aspect of the present invention, in step S2, the step of using a sliding window of a predefined duration to slide over the cleaned encrypted traffic session and extract statistical features of the encrypted traffic session includes:

[0015] A sliding window with a duration of 60 seconds is set along both the uplink and downlink directions of the encrypted traffic session. The window slides over a complete session stream with a sliding step size of 15 seconds to obtain a traffic segment with a maximum duration of 60 seconds. Statistical features of the 60-second traffic segment are then extracted.

[0016] According to the method of the first aspect of the present invention, in step S2, the packet size feature is: information about the packet size, i.e., the amount of data transmitted in each packet.

[0017] According to the method of the first aspect of the present invention, in step S2, the packet arrival time feature is: the time interval between data packet arrivals.

[0018] According to the method of the first aspect of the present invention, in step S2, extracting the packet payload α-Renyi entropy of the encrypted traffic session includes:

[0019] Reading the data packet payload, using bytes as statistical elements, the element set is {0x00, 0x01, ..., 0xFF}, a total of 256 elements. Let the input data be... data The IP length in the encrypted traffic session is Len Each byte element appears 100 times in data. , i =0, 1, ..., 255;

[0020]

[0021] in, This represents the packet load α-Renyi entropy; These are preset parameters.

[0022] According to the method of the first aspect of the present invention, in step S3, the step of mapping the packet load α-Renyi entropy into grayscale values ​​by using the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, and constructing a grayscale image reflecting the traffic features, includes:

[0023] The X-axis represents the arrival time of data packets. Here, a sliding window with a duration of 60 seconds is set, sliding over a complete encrypted traffic session with a sliding step of 15 seconds. The maximum duration of a window is 60 seconds. To unify the time scale, all arrival time values ​​are standardized to between 0 and 1500. The Y-axis represents the size of the data packets. The size of a data packet will not exceed 1500 bytes, which is the MTU value of Ethernet. Therefore, the Y-axis is limited to between 0 and 1500 bytes, resulting in a basic square image. For a unit of data in 60 seconds, there will be multiple packet sizes and packet arrival times. Each pair of packet size and packet arrival time data corresponds to a point on the image. Finally, the packet load α-Renyi entropy of the payload information is mapped to a brightness range of 0 to 240 to represent the grayscale information of the point. Ultimately, the encrypted traffic session is represented as a square image containing multiple grayscale points.

[0024] A second aspect of this invention discloses a malicious encrypted traffic classification system based on session spatiotemporal feature maps, the system comprising:

[0025] The first processing module is configured to use traffic processing tools to perform session segmentation on encrypted network traffic; and to perform data cleaning on the encrypted network traffic after session segmentation to remove noise and incomplete data packets.

[0026] The second processing module is configured to use a sliding window of a predefined duration to slide over the cleaned encrypted traffic session and extract statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet load α-Renyi entropy.

[0027] The third processing module is configured to use the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, and map the packet payload α-Renyi entropy into grayscale values ​​to form a grayscale image that reflects the traffic features, namely, the session spatiotemporal feature map.

[0028] The fourth processing module is configured to input the session spatiotemporal feature map into a ResNet-50 model with CBAM attention mechanism for malicious encrypted traffic classification.

[0029] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the malicious encrypted traffic classification method based on session spatiotemporal feature maps according to any one of the first aspects of this disclosure.

[0030] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a malicious encrypted traffic classification method based on session spatiotemporal feature maps according to any one of the first aspects of this disclosure.

[0031] In summary, the proposed solution can adapt to different malicious encrypted traffic application scenarios, thereby achieving more efficient and accurate encrypted traffic classification. Overall, this malicious encrypted traffic classification method based on session spatiotemporal feature maps brings new possibilities to the field of network security. Attached Figure Description

[0032] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0033] Figure 1 A flowchart illustrating a method for classifying malicious encrypted traffic based on session spatiotemporal feature maps according to an embodiment of the present invention;

[0034] Figure 2 This is a flowchart illustrating the extraction of traffic flow statistical features according to an embodiment of the present invention;

[0035] Figure 3 This is a flowchart illustrating the generation of a session spatiotemporal feature map according to an embodiment of the present invention;

[0036] Figure 4 This is a flowchart illustrating the classification of malicious encrypted traffic using a ResNet-50 neural network according to an embodiment of the present invention.

[0037] Figure 5 This is a structural diagram of a malicious encrypted traffic classification system based on session spatiotemporal feature maps according to an embodiment of the present invention;

[0038] Figure 6 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] The first aspect of this invention discloses a method for classifying malicious encrypted traffic based on session spatiotemporal feature maps. Figure 1 This is a flowchart of a malicious encrypted traffic classification method based on session spatiotemporal feature maps according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes:

[0041] Step S1: Use traffic processing tools to perform session segmentation on encrypted network traffic; perform data cleaning on the encrypted network traffic after session segmentation to remove noise and incomplete data packets;

[0042] Step S2: Use a sliding window of predefined duration to slide over the cleaned encrypted traffic session and extract the statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet load α-Renyi entropy.

[0043] Step S3: Using the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, the packet payload α-Renyi entropy is mapped into grayscale values ​​to form a grayscale image that reflects the traffic features, i.e., the session spatiotemporal feature map.

[0044] Step S4: Input the session spatiotemporal feature map into the ResNet-50 model with CBAM attention mechanism for malicious encrypted traffic classification.

[0045] In step S1, the encrypted network traffic is segmented into sessions using a traffic processing tool; the segmented encrypted network traffic is then cleaned to remove noise and incomplete data packets.

[0046] In some embodiments, in step S1, the data cleaning of the encrypted network traffic after session segmentation, removing noise and incomplete data packets, includes:

[0047] Remove packets with a length exceeding 1500 bytes from encrypted traffic sessions.

[0048] Specifically, a dataset of encrypted network traffic containing both malicious and normal elements is used, encrypted through multiple transport tunnels to simulate real-world encrypted network traffic. The prepared encrypted traffic is then split into session fragments using the SplitCap tool. The splitting principle is based on the session 5-tuple information, which includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol. After splitting, the session traffic data is cleaned to remove noise and incomplete packets. Each session is analyzed, and packets exceeding 1500 bytes in length are removed to ensure data reliability and the uniqueness of the dimensions for subsequent conversion of traffic features into grayscale images, generating the final dataset.

[0049] In step S2, a sliding window of predefined duration is used to slide over the cleaned encrypted traffic session to extract statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet load α-Renyi entropy.

[0050] In some embodiments, in step S2, the step of using a predefined duration sliding window to slide over the cleaned encrypted traffic session and extracting statistical features of the encrypted traffic session includes:

[0051] A sliding window with a duration of 60 seconds is set along both the uplink and downlink directions of the encrypted traffic session. The window slides over a complete session stream with a sliding step size of 15 seconds to obtain a traffic segment with a maximum duration of 60 seconds. Statistical features of the 60-second traffic segment are then extracted.

[0052] The packet size feature is information about the size of the data packets, that is, the amount of data transmitted in each data packet.

[0053] The packet arrival time characteristic is: the time interval between the arrival of data packets.

[0054] The packet payload α-Renyi entropy extracted from encrypted traffic sessions includes:

[0055] Reading the data packet payload, using bytes as statistical elements, the element set is {0x00, 0x01, ..., 0xFF}, a total of 256 elements. Let the input data be... data The IP length in the encrypted traffic session is Len Each byte element appears 100 times in data. , i =0, 1, ..., 255;

[0056]

[0057] in, This represents the packet load α-Renyi entropy; These are preset parameters.

[0058] Specifically, feature extraction is performed on the cleaned encrypted traffic sessions. For example... Figure 2 As shown, a sliding window with a duration of 60 seconds is set along both the uplink and downlink directions of the encrypted traffic session. This window slides over a complete session stream with a step size of 15 seconds, resulting in a traffic segment with a maximum duration of 60 seconds. Three sets of features are extracted from this 60-second traffic segment: packet size features, packet arrival time features, and α-Renyi entropy. Packet size features refer to information about the size of data packets, i.e., the amount of data transmitted in each packet. By analyzing the packet size distribution of a one-way flow, we can understand the statistical information such as the behavior of malicious traffic. Packet arrival time features refer to the time interval between the arrival of traffic data packets. By the time difference between adjacent data packets in a one-way flow, we can obtain the rate and interval distribution of data packet arrivals. These characteristics can reveal data packet transmission patterns, such as the presence of regular periodicity or sudden transmission activity. Load α-Renyi entropy refers to the fact that Renyi entropy is a generalized form of information entropy, while α-Renyi entropy is a variant of Renyi entropy. Calculating the α-Renyi entropy of traffic load information in a one-way flow allows us to understand the differences and randomness between data packets, helping us discover patterns or abnormal behavior in different types of malicious encrypted traffic. The specific calculation method for the α-Renyi entropy of traffic load information is as follows: read the traffic packet load, using bytes as statistical elements, resulting in an element set of {0x00, 0x01, ..., 0xFF}, a total of 256 elements. Let the input data be data, the IP length in the traffic data be Len, and the number of times each byte element appears in data be... Therefore, i = 0, 1, ..., 255; the formula for calculating α-Renyi entropy is (in actual calculations, α is assigned the value of 0.5):

[0059] .

[0060] In step S3, the packet size feature and packet arrival time feature of the encrypted traffic session are used as the Y-axis and X-axis, respectively, and the packet load α-Renyi entropy is mapped into grayscale values ​​to form a grayscale image that reflects the traffic features, namely the session spatiotemporal feature map.

[0061] In some embodiments, in step S3, mapping the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, and mapping the packet payload α-Renyi entropy into grayscale values ​​to construct a grayscale image reflecting the traffic features includes:

[0062] like Figure 3 As shown, the X-axis represents the arrival time of data packets. Here, a sliding window with a duration of 60 seconds is set, sliding over a complete encrypted traffic session stream, with a sliding step size of 15 seconds; the maximum duration of a window is 60 seconds. To unify the time scale, all arrival time values ​​are standardized to between 0 and 1500, so each unit represents 0.04 seconds (60s / 1500 = ...). 0.04s); the Y-axis represents the size of the data packet, which will not exceed 1500 bytes, i.e., the MTU value of Ethernet, so the Y-axis is limited to between 0 and 1500 bytes; thus, a square base image is obtained; for a unit of data of 60 seconds, there will be multiple packet sizes and packet arrival times, and each pair of packet size and packet arrival time data corresponds to a point on the image. For example, if a data packet arrives at 30 seconds and is 750 bytes in size, then the coordinate point in the two-dimensional scatter plot is (750, 750); finally, the packet load α-Renyi entropy of the payload information is mapped to the brightness range of 0~240 to represent the grayscale information of the point; finally, the encrypted traffic session is represented as a square image containing multiple grayscale points.

[0063] In step S4, the session spatiotemporal feature map is input into the ResNet-50 model with CBAM attention mechanism for malicious encrypted traffic classification.

[0064] Specifically, using the CBAM attention mechanism of the ResNet-50 model for malicious encrypted traffic classification means that the attention mechanism includes channel attention and spatial attention, which can focus on different channel information and spatial location in the image, respectively, improving the model's ability to capture complex patterns. Channel attention allows the model to focus on the channel information of certain feature maps, while spatial attention helps the model focus on information in key regions of the image. The ResNet-50 model itself has powerful feature representation and sequence modeling capabilities, which can further enhance its sensitivity and recognition ability for encrypted traffic image features. Specific implementation details are as follows: Figure 4 As shown, 1500*1500 image data is input into the ResNet-50 attention mechanism for feature extraction, and a 2048-dimensional feature is output. The 2048-dimensional feature is then input into a multi-layer fully connected layer for the classification of malicious traffic data, and the final output is the category label.

[0065] In summary, the proposed solution utilizes the size and arrival time characteristics of encrypted traffic data packets, combined with the information entropy of the traffic, to map them onto the grayscale values ​​of an image, transforming basic traffic data into an intuitive grayscale image. Its advantages lie in overcoming the limitations of traditional encrypted traffic processing, effectively improving efficiency and accuracy while also possessing flexibility and adaptability. It can classify malicious encrypted traffic without time or geographical restrictions. Its advantages also include applicability not only to HTTPS encrypted traffic but also to VPN, Tor, and other encrypted traffic classification methods, exhibiting minimal limitations. It primarily uses statistical features to construct grayscale images. Its advantages include non-infringement of privacy, minimal storage requirements, fast classification speed, and the ability to perform online malicious encrypted traffic classification. It utilizes information entropy and a self-attention mechanism, employing a ResNet-50 neural network for malicious encrypted traffic classification. Its advantages include the ResNet-50 network's ability to effectively fuse spatial information from grayscale images to further improve classification accuracy.

[0066] The second aspect of this invention discloses a malicious encrypted traffic classification system based on session spatiotemporal feature maps. Figure 5 This is a structural diagram of a malicious encryption traffic classification system based on session spatiotemporal feature maps according to an embodiment of the present invention; as follows: Figure 5 As shown, the system 100 includes:

[0067] The first processing module 101 is configured to use a traffic processing tool to perform session segmentation on encrypted network traffic; and to perform data cleaning on the encrypted network traffic after session segmentation to remove noise and incomplete data packets.

[0068] The second processing module 102 is configured to use a sliding window of a predefined duration to slide over the cleaned encrypted traffic session and extract statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet load α-Renyi entropy.

[0069] The third processing module 103 is configured to use the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, and map the packet load α-Renyi entropy into grayscale values ​​to form a grayscale image that reflects the traffic features, namely, a session spatiotemporal feature map.

[0070] The fourth processing module 104 is configured to input the session spatiotemporal feature map into a ResNet-50 model with CBAM attention mechanism for malicious encrypted traffic classification.

[0071] According to the system of the second aspect of the present invention, the first processing module 101 is specifically configured to perform data cleaning on the encrypted network traffic after session segmentation, removing noise and incomplete data packets, including:

[0072] Remove packets with a length exceeding 1500 bytes from encrypted traffic sessions.

[0073] Specifically, a dataset of encrypted network traffic containing both malicious and normal elements is used, encrypted through multiple transport tunnels to simulate real-world encrypted network traffic. The prepared encrypted traffic is then split into session fragments using the SplitCap tool. The splitting principle is based on the session 5-tuple information, which includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol. After splitting, the session traffic data is cleaned to remove noise and incomplete packets. Each session is analyzed, and packets exceeding 1500 bytes in length are removed to ensure data reliability and the uniqueness of the dimensions for subsequent conversion of traffic features into grayscale images, generating the final dataset.

[0074] According to the system of the second aspect of the present invention, the second processing module 102 is specifically configured to extract statistical features of the encrypted traffic session by sliding a predefined duration sliding window over the cleaned encrypted traffic session, including:

[0075] A sliding window with a duration of 60 seconds is set along both the uplink and downlink directions of the encrypted traffic session. The window slides over a complete session stream with a sliding step size of 15 seconds to obtain a traffic segment with a maximum duration of 60 seconds. Statistical features of the 60-second traffic segment are then extracted.

[0076] The packet size feature is information about the size of the data packets, that is, the amount of data transmitted in each data packet.

[0077] The packet arrival time characteristic is: the time interval between the arrival of data packets.

[0078] The packet payload α-Renyi entropy extracted from encrypted traffic sessions includes:

[0079] Reading the data packet payload, using bytes as statistical elements, the element set is {0x00, 0x01, ..., 0xFF}, a total of 256 elements. Let the input data be... data The IP length in the encrypted traffic session is Len Each byte element appears 100 times in data. , i =0, 1, ..., 255;

[0080]

[0081] in, This represents the packet load α-Renyi entropy; These are preset parameters.

[0082] Specifically, feature extraction is performed on the cleaned encrypted traffic sessions. For example... Figure 2 As shown, a sliding window with a duration of 60 seconds is set along both the uplink and downlink directions of the encrypted traffic session. This window slides over a complete session stream with a step size of 15 seconds, resulting in a traffic segment with a maximum duration of 60 seconds. Three sets of features are extracted from this 60-second traffic segment: packet size features, packet arrival time features, and α-Renyi entropy. Packet size features refer to information about the size of data packets, i.e., the amount of data transmitted in each packet. By analyzing the packet size distribution of a one-way flow, we can understand the statistical information such as the behavior of malicious traffic. Packet arrival time features refer to the time interval between the arrival of traffic data packets. By the time difference between adjacent data packets in a one-way flow, we can obtain the rate and interval distribution of data packet arrivals. These characteristics can reveal data packet transmission patterns, such as the presence of regular periodicity or sudden transmission activity. Load α-Renyi entropy refers to the fact that Renyi entropy is a generalized form of information entropy, while α-Renyi entropy is a variant of Renyi entropy. Calculating the α-Renyi entropy of traffic load information in a one-way flow allows us to understand the differences and randomness between data packets, helping us discover patterns or abnormal behavior in different types of malicious encrypted traffic. The specific calculation method for the α-Renyi entropy of traffic load information is as follows: read the traffic packet load, using bytes as statistical elements, resulting in an element set of {0x00, 0x01, ..., 0xFF}, a total of 256 elements. Let the input data be data, the IP length in the traffic data be Len, and the number of times each byte element appears in data be... Therefore, i = 0, 1, ..., 255; the formula for calculating α-Renyi entropy is (in actual calculations, α is assigned the value of 0.5):

[0083] .

[0084] According to the system of the second aspect of the present invention, the third processing module 103 is specifically configured to, wherein, taking the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, and mapping the packet payload α-Renyi entropy into grayscale values ​​to form a grayscale image reflecting the traffic features, includes:

[0085] like Figure 3As shown, the X-axis represents the arrival time of data packets. Here, a sliding window with a duration of 60 seconds is set, sliding over a complete encrypted traffic session stream, with a sliding step size of 15 seconds; the maximum duration of a window is 60 seconds. To unify the time scale, all arrival time values ​​are standardized to between 0 and 1500, so each unit represents 0.04 seconds (60s / 1500 = ...). 0.04s); the Y-axis represents the size of the data packet, which will not exceed 1500 bytes, i.e., the MTU value of Ethernet, so the Y-axis is limited to between 0 and 1500 bytes; thus, a square base image is obtained; for a unit of data of 60 seconds, there will be multiple packet sizes and packet arrival times, and each pair of packet size and packet arrival time data corresponds to a point on the image. For example, if a data packet arrives at 30 seconds and is 750 bytes in size, then the coordinate point in the two-dimensional scatter plot is (750, 750); finally, the packet load α-Renyi entropy of the payload information is mapped to the brightness range of 0~240 to represent the grayscale information of the point; finally, the encrypted traffic session is represented as a square image containing multiple grayscale points.

[0086] According to the system of the second aspect of the present invention, the fourth processing module 104 is specifically configured to perform the malicious encrypted traffic classification task using the CBAM attention mechanism ResNet-50 model. This means that the attention mechanism includes channel attention and spatial attention, which can respectively focus on different channel information and spatial location in the image, improving the model's ability to capture complex patterns. The channel attention mechanism enables the model to focus on the channel information of certain feature maps, while the spatial attention mechanism helps the model focus on information in key regions of the image. The ResNet-50 model itself has powerful feature representation and sequence modeling capabilities, which can further enhance the sensitivity and recognition ability of encrypted traffic image features. Specific implementation details are as follows: Figure 4 As shown, 1500*1500 image data is input into the ResNet-50 attention mechanism for feature extraction, and a 2048-dimensional feature is output. The 2048-dimensional feature is then input into a multi-layer fully connected layer for the classification of malicious traffic data, and the final output is the category label.

[0087] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the malicious encrypted traffic classification method based on session spatiotemporal feature maps according to any one of the first aspects of this invention.

[0088] Figure 6 This is a structural diagram of an electronic device according to an embodiment of the present invention, such as... Figure 6As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0089] Those skilled in the art will understand that Figure 6 The structure shown is merely a structural diagram of the part related to the technical solution of this disclosure and does not constitute a limitation on the electronic device to which the solution of this application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0090] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a malicious encrypted traffic classification method based on session spatiotemporal feature maps according to any one of the first aspects of this invention.

[0091] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for classifying malicious encrypted traffic based on session spatiotemporal feature maps, characterized in that, The method includes: Step S1: Use traffic processing tools to perform session segmentation on encrypted network traffic; perform data cleaning on the encrypted network traffic after session segmentation to remove noise and incomplete data packets; Step S2: Use a sliding window of predefined duration to slide over the cleaned encrypted traffic session and extract the statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet load α-Renyi entropy. In step S2, extracting the packet payload α-Renyi entropy of the encrypted traffic session includes: Reading the data packet payload, using bytes as statistical elements, the element set is {0x00, 0x01, ..., 0xFF}, a total of 256 elements. Let the input data be... data The IP length in the encrypted traffic session is Len Each byte element appears 100 times in data. , i =0, 1, ..., 255; in, This represents the packet load α-Renyi entropy; Preset parameters; Step S3: Using the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, the packet payload α-Renyi entropy is mapped into grayscale values ​​to form a grayscale image that reflects the traffic features, i.e., the session spatiotemporal feature map. In step S3, the step of mapping the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, and mapping the packet payload α-Renyi entropy into grayscale values ​​to form a grayscale image reflecting the traffic features includes: The X-axis represents the arrival time of data packets. Here, a sliding window with a duration of 60 seconds is set and slides across a complete encrypted traffic session with a sliding step of 15 seconds. The maximum duration of a window is 60 seconds. To unify the time scale, all arrival time values ​​are standardized to between 0 and 1500. The Y-axis represents the size of the data packets. The size of a data packet will not exceed 1500 bytes, which is the MTU value of Ethernet. Therefore, the Y-axis is limited to between 0 and 1500 bytes. This results in a basic square image. For a unit of data in 60 seconds, there will be multiple packet sizes and packet arrival times. Each pair of packet size and packet arrival time data corresponds to a point on the image. Finally, the packet load α-Renyi entropy of the payload information is mapped to a brightness range of 0 to 240 to represent the grayscale information of the point. Ultimately, the encrypted traffic session is represented as a square image containing multiple grayscale points. Step S4: Input the session spatiotemporal feature map into the ResNet-50 model with CBAM attention mechanism for malicious encryption traffic classification; specifically including: The session spatiotemporal feature map is input into a ResNet-50 model with CBAM attention mechanism for feature extraction, outputting a 2048-dimensional feature; the 2048-dimensional feature is then input into a multi-layer fully connected layer for the classification of malicious traffic data, and finally outputs a category label.

2. The malicious encrypted traffic classification method based on session spatiotemporal feature maps according to claim 1, characterized in that, In step S1, the data cleaning of the encrypted network traffic after session segmentation, removing noise and incomplete data packets, includes: Remove packets with a length exceeding 1500 bytes from encrypted traffic sessions.

3. The malicious encrypted traffic classification method based on session spatiotemporal feature maps according to claim 1, characterized in that, In step S2, the step of using a predefined duration sliding window to slide over the cleaned encrypted traffic session and extracting statistical features of the encrypted traffic session includes: A sliding window with a duration of 60 seconds is set along both the uplink and downlink directions of the encrypted traffic session. The window slides over a complete session stream with a sliding step size of 15 seconds to obtain a traffic segment with a maximum duration of 60 seconds. Statistical features of the 60-second traffic segment are then extracted.

4. The malicious encrypted traffic classification method based on session spatiotemporal feature maps according to claim 1, characterized in that, In step S2, the packet size feature is: information about the packet size, that is, the amount of data transmitted in each packet.

5. The malicious encrypted traffic classification method based on session spatiotemporal feature maps according to claim 1, characterized in that, In step S2, the packet arrival time characteristic is: the time interval between data packet arrivals.

6. A system for classifying malicious encrypted traffic based on session spatiotemporal feature maps, the system employing the method described in any one of claims 1-5, characterized in that, The system includes: The first processing module is configured to use traffic processing tools to perform session segmentation on encrypted network traffic; and to perform data cleaning on the encrypted network traffic after session segmentation to remove noise and incomplete data packets. The second processing module is configured to use a sliding window of a predefined duration to slide over the cleaned encrypted traffic session and extract statistical features of the encrypted traffic session: packet size features, packet arrival time features, and packet load α-Renyi entropy. The third processing module is configured to use the packet size feature and packet arrival time feature of the encrypted traffic session as the Y-axis and X-axis respectively, and map the packet payload α-Renyi entropy into grayscale values ​​to form a grayscale image that reflects the traffic features, namely, the session spatiotemporal feature map. The fourth processing module is configured to input the session spatiotemporal feature map into a ResNet-50 model with CBAM attention mechanism for malicious encrypted traffic classification.

7. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, it implements the steps in the malicious encrypted traffic classification method based on session spatiotemporal feature maps according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the malicious encrypted traffic classification method based on session spatiotemporal feature maps according to any one of claims 1 to 5.

Images