Encrypted traffic classification method and device, equipment, storage medium and program product

Abstract

The invention provides an encrypted traffic classification method and device, equipment, a storage medium and a program product, and the method comprises the steps: obtaining a plurality of classification rule sets, and dividing an encrypted traffic set into first classification difficulty traffic and second classification difficulty traffic; determining a classification result of the first classification difficulty traffic; generating a session image based on the second classification difficulty traffic; decomposing the session image into a plurality of data packets, performing embedding processing, and capturing interaction information among all the data packets to obtain global features; extracting spatial features of the data packet, and extracting time dependence of the spatial features to obtain spatial-temporal features of the data packet; and fusing the global features and the spatial-temporal features to obtain fused features, and generating a classification result of the second classification difficulty traffic. Wherein the classification efficiency is improved by classifying and analyzing the encrypted traffic with different classification difficulties, and the classification precision is improved by classifying the encrypted traffic with higher classification difficulty on the basis of global features and spatio-temporal features of the encrypted traffic.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, and particularly relates to an encrypted traffic classification method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] This section is intended to provide background or context to the embodiments of the disclosure recited in the claims. The description herein does not constitute admission that the prior art is prior art nor does it constitute an admission of any description in this section as prior art to an application.

[0003] Network traffic encryption is a means to protect data privacy and communication security. However, network traffic encryption brings great challenges to network traffic management.

[0004] In the related art, there are three types of encrypted traffic classification schemes: encrypted traffic classification schemes based on deep packet inspection technology, encrypted traffic classification schemes based on machine learning, and encrypted traffic classification schemes based on deep learning.

[0005] However, in the encrypted traffic classification scheme based on deep packet inspection technology, the accuracy is limited due to the widespread use of dynamic ports and protocol camouflage technology by applications.

[0006] In the encrypted traffic classification scheme based on machine learning, the resistance to traffic obfuscation, padding and other adversarial techniques is weak, and the accuracy in the actual environment often fails to meet the application requirements.

[0007] In the encrypted traffic classification scheme based on deep learning, there are problems of bloated models and large computational overhead, and the complete session traffic needs to be collected to make a judgment, resulting in a significant increase in processing delay, which is limited in applicability in scenarios with high real-time requirements.

[0008] In summary, the encrypted traffic classification schemes provided in the related art have the problems of low efficiency and low precision. SUMMARY

[0009] Therefore, the purpose of the present disclosure is to provide an encrypted traffic classification method, device, equipment, storage medium and program product, which at least solves one of the technical problems in the related art to some extent.

[0010] To achieve the above purpose, an encrypted traffic classification method is provided in an exemplary embodiment of the present disclosure, comprising: Obtaining a plurality of classification rule sets, classifying an encrypted traffic set based on the plurality of classification rule sets to obtain a classification result set, and dividing the encrypted traffic set into first classification difficulty traffic and second classification difficulty traffic based on the classification result set, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic. determine a classification result of the first classification difficulty traffic based on the classification result set; process the second classification difficulty traffic to generate a conversation image; decompose the conversation image into a plurality of data packets and perform embedding processing, capture interaction information between all the data packets, and obtain global features; extract spatial features of the data packets, extract time dependence of the spatial features, and obtain spatio-temporal features of the data packets; fuse the global features and the spatio-temporal features to obtain fused features, and generate a classification result of the second classification difficulty traffic based on the fused features.

[0011] In some example embodiments, the generation of the plurality of classification rule sets includes: obtain an encrypted traffic set, intercept part of the data packets in the encrypted traffic set, and extract classification features from the part of the data packets; construct a plurality of training sample subsets based on the classification features, construct a plurality of classification trees based on the plurality of training sample subsets, and generate the plurality of classification rule sets based on the plurality of classification trees.

[0012] In some example embodiments, the obtaining of the encrypted traffic set, the intercepting of part of the data packets in the encrypted traffic set, and the extracting of the classification features from the part of the data packets include: obtain original traffic data, and divide the original traffic data into a plurality of flows, wherein the original traffic data includes a plurality of data packets, and each of the flows includes a plurality of data packets; extract a payload length, a transmission control protocol window size, and a timestamp of each data packet in each of the flows, convert the timestamp into a time interval between a current data packet and a previous data packet, and the classification features include the payload length, the transmission control protocol window size, and the time interval; arrange the classification features of each data packet in each of the flows in a packet sequence order to obtain classification features of the flow.

[0013] In some example embodiments, the constructing of the plurality of training sample subsets based on the classification features, the constructing of the plurality of classification trees based on the plurality of training sample subsets, and the generating of the plurality of classification rule sets based on the plurality of classification trees include: determine application labels of the classification features, and construct a training sample set based on the classification features and the application labels; extract a plurality of training sample subsets from the training sample set; constructing a classification tree based on each of the training sample subsets, determining key leaf nodes in the classification tree, and generating the classification rule set based on the leaf nodes, wherein the classification rule set comprises a plurality of rules.

[0014] In some example embodiments, the classifying the encrypted traffic set based on the plurality of classification rule sets to obtain a classification result set, and dividing the encrypted traffic set into first classification difficulty traffic and second classification difficulty traffic based on the classification result set, comprises: In response to determining that the number of classification rule sets corresponding to the same classification result is greater than or equal to a number threshold, determining that the target traffic is the first classification difficulty traffic; and / or, in response to determining that the number of classification rule sets corresponding to the same classification result is less than the number threshold, determining that the target traffic is the second classification difficulty traffic.

[0015] In some example embodiments, the processing the second classification difficulty traffic to generate a session image, comprises: dividing the second classification difficulty traffic into a plurality of network flows; arranging the bidirectional flows in the network flows in a preset time sequence based on the timestamps of the bidirectional flows, and combining the bidirectional flows to generate a session flow; enhancing, truncating, or padding the session flow to obtain a processed session flow; converting the processed session flow into a plurality of packet images; combining the plurality of packet images to generate the session image.

[0016] In some example embodiments, the decomposing the session image into a plurality of packets and performing embedding processing to capture interaction information between all the packets to obtain global features, comprises: performing a two-dimensional convolution operation on the session image to obtain a packet embedding of each packet; determining a position embedding of each packet in the session image; after converting the length of each packet into a one-hot vector, generating a length embedding through a linear layer; adding the packet embedding, the position embedding, and the length embedding to obtain an embedding representation of each packet; projecting a query, a key, and a value into a plurality of subspaces based on a K-attention mechanism, calculating a self-attention weight matrix using a scaled dot-product attention mechanism, concatenating outputs of all attention heads, and then obtaining an output of a multi-head self-attention layer through linear projection; extracting a first vector from the output of the multi-head self-attention layer as a global feature of the session.

[0017] In some example embodiments, the extracting the spatial features of the data packets, the extracting the time dependency of the spatial features, and the obtaining the spatio-temporal features of the data packets, comprise: segmenting the conversation image into data packet images, and performing convolution operation on each of the data packet images to generate a set of feature maps; applying global max pooling and global average pooling to the set of feature maps, and inputting a fully connected layer with an activation function; weighting the feature maps according to the channel attention values; batch normalization and residual connection; performing operation on each of the data packet images based on the residual attention convolution layer, learning the channel weights to make the model focus on the key feature maps in the convolution process, adjusting the feature information at different positions in the weighted feature maps through convolution to highlight the key spatial features, and flattening the output of the last layer of the residual attention convolution layer to obtain the spatial features of the data packets; after obtaining the spatial features of each data packet through the residual attention convolution layer, inputting the spatial features of each data packet in time sequence and reverse sequence into a bidirectional long short-term memory network layer to capture the time dependency of the spatial features, and obtaining the spatio-temporal features.

[0018] In some example embodiments, the fusing the global features and the spatio-temporal features to obtain fusion features, and generating the classification result of the second classification difficulty traffic based on the fusion features, comprise: using a temperature parameter to control the weight balance between different feature extraction modules; calculating the normalized weights of different features, and fusing vectors; inputting the fusion vectors into two fully connected layers, and applying nonlinear transformation to the hidden layers to obtain higher-order representations; determining the classification result of the second classification difficulty traffic through an activation function.

[0019] Based on the same inventive concept, the second aspect of the example embodiments of the present disclosure provides an encrypted traffic classification device, comprising: a classification difficulty determination module configured to obtain a plurality of classification rule sets, classify an encrypted traffic set based on the plurality of classification rule sets to obtain a classification result set, and divide the encrypted traffic set into first classification difficulty traffic and second classification difficulty traffic based on the classification result set, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic; a first classification difficulty traffic classification module configured to determine the classification result of the first classification difficulty traffic based on the classification result set; a conversation image generation module configured to process the second classification difficulty traffic to generate a conversation image; a global feature extraction module configured to decompose the conversation image into a plurality of data packets and perform embedding processing, capture interaction information between all the data packets, and obtain global features; a space-time feature extraction module configured to extract spatial features of the data packets, extract time dependence of the spatial features, and obtain space-time features of the data packets; a second classification difficulty traffic classification module configured to fuse the global features and the space-time features to obtain fused features, and generate a classification result of the second classification difficulty traffic based on the fused features.

[0020] In some example embodiments, the classification difficulty determination module is specifically configured to: obtain an encrypted traffic set, intercept part of data packets in the encrypted traffic set, and extract classification features from the part of data packets; construct a plurality of training sample subsets based on the classification features, construct a plurality of classification trees based on the plurality of training sample subsets, and generate the plurality of classification rule sets based on the plurality of classification trees.

[0021] In some example embodiments, the classification difficulty determination module is specifically configured to: obtain original traffic data, and divide the original traffic data into a plurality of flows, wherein the original traffic data includes a plurality of data packets, and each of the flows includes a plurality of data packets; extract a payload length, a transmission control protocol window size, and a timestamp of each data packet in each of the flows, convert the timestamp into a time interval between a current data packet and a previous data packet, and the classification features include the payload length, the transmission control protocol window size, and the time interval; arrange the classification features of each data packet in each of the flows in a packet sequence order to obtain classification features of the flow.

[0022] In some example embodiments, the classification difficulty determination module is specifically configured to: determine an application label of the classification features, and construct a training sample set based on the classification features and the application label; extract a plurality of training sample subsets from the training sample set; construct a classification tree based on each of the training sample subsets, determine key leaf nodes in the classification tree, and generate the classification rule set based on the leaf nodes, wherein the classification rule set includes a plurality of rules.

[0023] In some example embodiments, the classification difficulty determination module is specifically configured to: In response to determining that the number of the classification rule sets corresponding to the same classification result is greater than or equal to a number threshold, determining that the target traffic is first classification difficulty traffic; In response to determining that the number of the classification rule sets corresponding to the same classification result is less than the number threshold, determining that the target traffic is second classification difficulty traffic.

[0024] In some example embodiments, the session image generation module is specifically configured to: divide the second classification difficulty traffic into a plurality of network flows; arrange the bidirectional flows in the network flows in a preset time sequence based on timestamps of the bidirectional flows, and combine the bidirectional flows to generate a session flow; enhance, truncate or fill the session flow to obtain a processed session flow; convert the processed session flow into a plurality of packet images; combine the plurality of packet images to generate the session image.

[0025] In some example embodiments, the global feature extraction module is specifically configured to: perform a two-dimensional convolution operation on the session image to obtain a packet embedding of each packet; determine a position embedding of each packet in the session image; convert a length of each packet into a one-hot vector, and then generate a length embedding through a linear layer; add the packet embedding, the position embedding and the length embedding to obtain an embedding representation of each packet; project a query, a key and a value into a plurality of subspaces based on a K attention mechanism, calculate a self-attention weight matrix using a scaled dot-product attention mechanism, splice outputs of all attention heads, and then obtain an output of a multi-head self-attention layer through linear projection; extract a first vector from the output of the multi-head self-attention layer as a global feature of the session.

[0026] In some example embodiments, the spatio-temporal feature extraction module is specifically configured to: divide the session image into packet images, and perform a convolution operation on each of the packet images to generate a feature map set; implement global max pooling and global average pooling on the feature map set, and input a fully connected layer with an activation function; weight the feature maps according to channel attention values; perform batch normalization and residual connection; The residual attention convolutional layer is used to perform operation on each data packet image, learn channel weights, focus on key feature maps during convolution, adjust feature information at different positions in the weighted feature map through convolution to highlight key spatial features, flatten the output of the last layer of the residual attention convolutional layer to obtain spatial features of the data packet, and output the spatial features of the data packet. After obtaining the spatial features of each data packet by the residual attention convolutional layer, the spatial features of each data packet are input into a bidirectional long short-term memory network layer in a time sequence and in reverse order to capture the time dependence of the spatial features, so as to obtain the spatio-temporal features.

[0027] In some example embodiments, the second classification difficulty traffic classification module is specifically configured to: use a temperature parameter to control the weight balance between different feature extraction modules; calculate the normalized weights of different features, and fuse the vectors; input the fused vectors into two fully connected layers, and apply a nonlinear transformation to the hidden layer to obtain higher-order representations; determine the classification result of the second classification difficulty traffic by using an activation function.

[0028] Based on the same inventive concept, the third aspect of the example embodiments of the present disclosure provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the method of the first aspect when executing the program.

[0029] Based on the same inventive concept, the fourth aspect of the example embodiments of the present disclosure provides a non-transitory computer-readable storage medium, which stores computer instructions for causing a computer to execute the method of the first aspect.

[0030] Based on the same inventive concept, the fifth aspect of the example embodiments of the present disclosure provides a computer program product, which includes computer program instructions, and when the computer program instructions are executed on a computer, the computer executes the method of the first aspect.

[0031] As can be seen from the above, the encrypted traffic classification method, apparatus, device, storage medium, and program product provided in this disclosure include: acquiring a plurality of classification rule sets; classifying an encrypted traffic set based on the plurality of classification rule sets to obtain a classification result set; dividing the encrypted traffic set into a first classification difficulty traffic and a second classification difficulty traffic based on the classification result set, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic; determining the classification result of the first classification difficulty traffic based on the classification result set; processing the second classification difficulty traffic to generate a session image; decomposing the session image into a plurality of data packets and performing embedding processing to capture the interaction information between all the data packets to obtain global features; extracting the spatial features of the data packets and extracting the temporal dependence of the spatial features to obtain the spatiotemporal features of the data packets; fusing the global features and the spatiotemporal features to obtain fused features; and generating the classification result of the second classification difficulty traffic based on the fused features. The method improves the efficiency of encrypted traffic classification by classifying encrypted traffic at different classification difficulties, and improves the accuracy of encrypted traffic classification by classifying encrypted traffic based on its global features and spatiotemporal features for traffic with higher classification difficulty. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in this disclosure or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 A flowchart illustrating an encrypted traffic classification method provided as an exemplary embodiment of this disclosure; Figure 2 A flowchart illustrating a classification feature extraction method provided for an exemplary embodiment of this disclosure; Figure 3 A flowchart illustrating a method for generating a classification rule set provided for an exemplary embodiment of this disclosure; Figure 4 A flowchart illustrating a method for determining classification difficulty provided in an exemplary embodiment of this disclosure; Figure 5 A schematic flowchart illustrating a session image generation method provided as an exemplary embodiment of this disclosure; Figure 6 A flowchart illustrating a global feature extraction method provided for an exemplary embodiment of this disclosure; Figure 7 A schematic flowchart illustrating a spatiotemporal feature extraction method provided for an exemplary embodiment of this disclosure; Figure 8 A flowchart illustrating a second-classification difficulty traffic classification method provided as an exemplary embodiment of this disclosure; Figure 9 A schematic diagram of a structure of an encrypted traffic classification device provided for an exemplary embodiment of the present disclosure; Figure 10 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of the present disclosure. Detailed Implementation

[0034] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0035] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0036] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0037] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0038] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0039] To make the objectives, technical solutions, and advantages of this disclosure clearer, the principles and spirit of this disclosure will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement this disclosure, and are not intended to limit the scope of this disclosure in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0040] In this article, it is important to understand that any number of elements in the accompanying figures is for illustrative purposes and not for limitation, and any naming is for distinction only and has no limiting meaning.

[0041] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar words used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly. The article "a" or "an" preceding an element does not exclude the existence of multiple such elements.

[0042] The principles and spirit of this disclosure will be explained in detail below with reference to several representative embodiments.

[0043] As described in the background section, with the rapid development of internet technology and the deepening of digital transformation, network traffic encryption has become a necessary means to ensure data privacy and communication security. The large-scale deployment of modern encryption protocols such as TLS 1.3 and QUIC has significantly improved the confidentiality and integrity of network traffic. One analysis showed that over 80% of internet traffic is encrypted, 70% of malware communications are encrypted, and 60% of enterprises cannot effectively decrypt HTTPS. Meanwhile, with the full implementation of data protection regulations such as the General Data Protection Regulation (GDPR), data encryption has transformed from an optional security measure into a rigid requirement for compliant operations. However, while this widespread encryption improves privacy protection, it also poses significant challenges to network traffic management. Related network monitoring and security detection technologies are undergoing unprecedented restructuring, especially in emerging scenarios such as 5G networks, the Internet of Things (IoT), and edge computing. The exponential growth of encrypted traffic is putting existing processing solutions to severe tests in terms of performance, cost, and efficiency.

[0044] Therefore, improving network security monitoring, protection, and scheduling capabilities in the context of increasingly dominant encrypted traffic has become an urgent technical challenge. The inventors of this disclosure have discovered that current encrypted traffic classification technologies face three major dilemmas: Deep Packet Inspection (DPI) is almost completely ineffective against encrypted traffic, while port- and protocol-based analysis methods have limited accuracy due to the widespread use of dynamic port and protocol masquerading techniques in modern applications; In machine learning methods, statistical feature-based methods, while fast, are weakly resistant to traffic obfuscation and padding techniques, often failing to meet application requirements in real-world environments; Deep learning-based methods, while achieving high classification accuracy, generally suffer from bloated models and high computational overhead, requiring complete session traffic collection for judgment, leading to significantly increased processing latency and limited applicability in scenarios with high real-time requirements. With the widespread adoption of TLS 1.3 and the rapid promotion of new encryption protocols such as QUIC, the characteristic patterns of encrypted traffic are undergoing fundamental changes, posing a continuous risk of performance degradation to existing classification systems based on fixed feature sets.

[0045] In summary, existing technologies generally suffer from poor adaptability, low computational efficiency and accuracy, high privacy risks, and weak resistance to circumvention, making it difficult to meet the demands for accurate classification and intelligent orchestration in today's dynamic encrypted traffic environment. Therefore, there is an urgent need to explore a new encrypted traffic analysis method that leverages its powerful feature learning capabilities and end-to-end optimization potential to build an efficient, robust, and scalable encrypted traffic analysis framework.

[0046] To address the aforementioned issues, this disclosure provides an encrypted traffic classification scheme, specifically comprising: acquiring several classification rule sets; classifying an encrypted traffic set based on the several classification rule sets to obtain a classification result set; dividing the encrypted traffic set into first-classification-difficulty traffic and second-classification-difficulty traffic based on the classification result set, wherein the classification difficulty of the second-classification-difficulty traffic is greater than that of the first-classification-difficulty traffic; determining the classification result of the first-classification-difficulty traffic based on the classification result set; processing the second-classification-difficulty traffic to generate a session image; decomposing the session image into several data packets and embedding them to capture the interaction information between all the data packets to obtain global features; extracting the spatial features of the data packets and extracting the temporal dependence of the spatial features to obtain the spatiotemporal features of the data packets; fusing the global features and the spatiotemporal features to obtain fused features; and generating the classification result of the second-classification-difficulty traffic based on the fused features.

[0047] Among them, the classification and analysis of encrypted traffic with different classification difficulties, namely, simple analysis for encrypted traffic with low classification difficulty and more complex analysis for encrypted traffic with higher classification difficulty, improves the efficiency of encrypted traffic classification compared with the unified analysis in related technologies. Furthermore, for encrypted traffic that is more difficult to classify, it is classified based on its global and spatiotemporal characteristics, thus improving the accuracy of encrypted traffic classification.

[0048] After introducing the basic principles of this disclosure, various non-limiting embodiments of this disclosure will be described in detail below.

[0049] refer to Figure 1 This is a flowchart illustrating an encrypted traffic classification method provided by an exemplary embodiment of the present disclosure.

[0050] The encrypted traffic classification method includes the following steps: Step S110: Obtain several classification rule sets, classify the encrypted traffic set based on the several classification rule sets to obtain a classification result set, and divide the encrypted traffic set into first classification difficulty traffic and second classification difficulty traffic based on the classification result set, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic.

[0051] In practice, the classification rule set can be pre-generated or generated in real time.

[0052] In some exemplary embodiments, the generation method of the plurality of classification rule sets includes: Obtain an encrypted traffic set, extract a portion of the data packets from the encrypted traffic set, and extract classification features from the portion of the data packets; Several training sample subsets are constructed based on the classification features, several classification trees are constructed based on the several training sample subsets, and several classification rule sets are generated based on the several classification trees.

[0053] refer to Figure 2 In some exemplary embodiments, the step of acquiring an encrypted traffic set, intercepting a portion of data packets within the encrypted traffic set, and extracting classification features from the portion of data packets includes: Step S210: Obtain raw traffic data and divide the raw traffic data into several streams, wherein the raw traffic data contains several data packets, and each stream contains several data packets; Step S220: Extract the payload length, transmission control protocol window size, and timestamp of each data packet in each stream, and convert the timestamp into the time interval between the current data packet and the previous data packet. The classification features include the payload length, the transmission control protocol window size, and the time interval. Step S230: Arrange the classification features of each data packet in each stream according to the packet sequence order to obtain the classification features of the stream.

[0054] In practice, short sequence preprocessing is used, and the preceding sequence is truncated. The data packets are then analyzed, and features that can highly distinguish different flows are extracted from them.

[0055] Raw traffic data contains various data packets, which are then divided into streams. To achieve more accurate classification. Let's assume... express The sequence of data packets, where Representing the One data packet, show Total of One data packet. For First, intercept and obtain That is, including the previous data packets , recorded as .when Insufficient number of data packets At that time, towards Replenish An empty package.

[0056] right Each data packet extracts three key features: payload length, TCP window size, and timestamp. The timestamp is then converted to a time interval relative to the previous data packet. These are then processed using... and express In The payload length, TCP window size, and interval are specified. A step function is used to convert the time interval value.

[0057]

[0058] for The classification features of each data packet in the stream are arranged in the order of the packet sequence to obtain... Classification feature vector , recorded as , This step yields a new training sample set, denoted as... Where M represents the number of training streams, express The application tags, and , here This represents the number of application categories to be classified. Finally, Input step S120: Exemplary embodiment of an improved short sequence trainer.

[0059] refer to Figure 3 In some exemplary embodiments, the step of constructing a plurality of training sample subsets based on the classification features, constructing a plurality of classification trees based on the plurality of training sample subsets, and generating a plurality of classification rule sets based on the plurality of classification trees includes: Step S310: Determine the application label of the classification feature, and construct a training sample set based on the classification feature and the application label; Step S320: Extract several training sample subsets from the training sample set; Step S330: Construct a classification tree based on each subset of training samples, determine the key leaf nodes in the classification tree, and generate the classification rule set based on the leaf nodes, wherein the classification rule set contains several rules.

[0060] In practice, a short sequence trainer is constructed, utilizing... Construct a simplified flow classification model (EFC-Model) to... All flows are divided into first-class difficulty flows and second-class difficulty flows, and the category of the first-class difficulty flow is directly output. The classification difficulty of the second-class difficulty flow is greater than that of the first-class difficulty flow. The first-class difficulty flow is an easy-to-classify flow, and the second-class difficulty flow is a difficult-to-classify flow. A tree-based machine learning algorithm is used to generate efficient classification rules, which includes three sequential components: constructing subsets, building classification trees, and generating rules.

[0061] from A certain number of samples are randomly selected multiple times to form several different training subsets. The sampling operation starts from... Random selection One sample ( Using the sampling rate, these samples are used to form a new subset. Repeat the above operation. After that, we get the following: A new set of training subsets ,Right now ,in .

[0062] for Building a classification tree for Construct a subset of training samples Different categories Each classification tree is used to determine whether a flow belongs to an easily classified flow or a difficult-to-classify flow.

[0063] For each category, select several key leaf nodes to generate a classification rule set consisting of multiple rules. For Leaf nodes containing only samples from a single application category are selected. The node purity value of each leaf node is calculated using the node purity calculation formula ("Gini" value and "entropy" value). For each leaf node with a purity value of 0, a classification rule is generated, with its label matching the label of the samples within that leaf node. Use all these nodes to form a rule set .against Generate a training subset A set of rules, namely .

[0064] refer to Figure 4 In some exemplary embodiments, the step of classifying the encrypted traffic set based on the plurality of classification rule sets to obtain a classification result set, and dividing the encrypted traffic set into first-class difficulty traffic and second-class difficulty traffic based on the classification result set, includes: Step S410: In response to determining that the number of classification rule sets corresponding to the same classification result is greater than or equal to the number threshold, the target traffic is determined to be traffic with the first classification difficulty. And / or, Step S420: In response to determining that the number of classification rule sets corresponding to the same classification result is less than the number threshold, the target traffic is determined to be traffic with second classification difficulty.

[0065] In practical implementation, traffic sets Output Application tags. When there are more than or equal to A set of rules When the same application tag is predicted, A flow that can be correctly classified in the early stages of its duration is considered an easily classified flow. Otherwise, it is considered a difficult flow to classify. For difficult flows, the EFC model outputs a label of "-1", and proceeds to subsequent steps to output predicted labels.

[0066] Step S120: Determine the classification result of the first classification difficulty traffic based on the classification result set.

[0067] In practical implementation, when there are more than or equal to A set of rules When the same application tag is predicted, It can be correctly classified in the early stages of its flow duration, and this classification is taken as the classification result of the first classification difficulty flow.

[0068] Step S130: Process the second category of difficulty traffic to generate a session image.

[0069] refer to Figure 5In some exemplary embodiments, processing the second-classified difficulty traffic to generate a session image includes: Step S510: Divide the second category of difficulty traffic into several network flows; Step S520: Based on the timestamps of the bidirectional streams in the network stream, arrange the bidirectional streams in a preset time order, and combine the bidirectional streams to generate a session stream; Step S530: Enhance, truncate, or pad the session stream to obtain a processed session stream; Step S540: Convert the processed session stream into several data packet images; Step S550: Combine the several data packet images to generate the session image.

[0070] In practice, the raw data packet is preprocessed as follows: Raw network traffic data is available Represented as: ,in and They represent the first The timestamp, source IP address, destination IP address, source port, and destination port number of each data packet.

[0071] Will Divided into different network flows: Each stream Includes IPs with the same source Same source port Same destination IP and the same destination port The set of data packets, in which Indicates the first The number of packets in a stream.

[0072] Arrange the timestamps of the bidirectional streams in chronological order and combine them to generate a session stream. ,Right now ,in This indicates that the source IP is Src, the destination IP is Dst, and the source port is... Data flow, This indicates that the source IP is Dst, the destination IP is Src, and the source port is... The data stream. The symbols represent combination operations. During the combination process, data packets are arranged in ascending order of timestamps.

[0073] The application layer data packets of each session stream are retained, and a fixed number of data packets are extracted from the session, i.e., data augmentation is performed using fixed-step sampling.

[0074] For session stream extract The application layer data in each of the data packets byte, of which a perfect square , It is also a perfect square. If the application layer data length exceeds... If the number of bytes is insufficient, then use... Padding. Similarly, if the number of packets is less than... Then fill to .

[0075] Read the data packet byte by byte, convert each byte to an integer, and then convert it to a size of . The data packet image is represented as .

[0076] Combine these packet images into a session image.

[0077] Step S140: Decompose the session image into several data packets and perform embedding processing to capture the interaction information between all the data packets and obtain global features.

[0078] refer to Figure 6 In some exemplary embodiments, the step of decomposing the session image into several data packets and embedding them to capture the interaction information between all the data packets and obtain global features includes: Step S610: Perform a two-dimensional convolution operation on the session image to obtain the packet embedding of each data packet; Step S620: Determine the embedding position of each data packet in the session image; Step S630: After converting the length of each data packet into a one-hot vector, a length embedding is generated through a linear layer; Step S640: Add the data packet embedding, the position embedding, and the length embedding to obtain the embedding representation of each data packet; Step S650: Based on the K attention mechanism, the query, key and value are projected to several subspaces. The self-attention weight matrix is ​​calculated using the scaling dot product attention mechanism. After concatenating the outputs of all attention heads, the output of the multi-head self-attention layer is obtained through linear projection. Step S660: Extract the first vector from the output of the multi-head self-attention layer as the global feature of the session.

[0079] In specific implementation, a data packet visual transformer is provided. In the session embedding layer, the data packet visual transformer decomposes the session image into multiple data packets for embedding processing, captures the interaction information between all the data packets, and obtains global features.

[0080] Perform a 2D convolution operation on the session image, with a stride of [value missing]. The core size is The number of channels is Finally, the embedded representation of each data packet is obtained. .

[0081] make Indicates the first in the session The position embedding of each data packet is expressed as:

[0082] in The position embedding of the first One dimension, Indicates the first in the session stream The location of each data packet.

[0083] After converting each data packet length into a one-hot vector, a length embedding is generated through a linear layer. Let... Indicates the first The length of each data packet can be converted into the following one-hot vector. :

[0084] Learnable parameters use Calculate the length embedding .

[0085] Embed the data packet Location embedding and length embedding Add them together to obtain the final embedded representation of each data packet. : .

[0086] based on Attention mechanisms project queries, keys, and values ​​onto... Subspace, for the first Size, its query ,key Sum Calculated using the following linear projection:

[0087] in and For learnable weight matrix, Set as .

[0088] The self-attention weight matrix is ​​calculated using a scaled dot product attention mechanism:

[0089] Indicates the first Attention weight matrix for size, The scaling factor is used to solve the gradient explosion problem. For the first Output of the head self-attention mechanism.

[0090] After concatenating the outputs of all attention heads, the final output of the multi-head self-attention layer is obtained through linear projection. ,in Indicates the number of heads. This indicates splicing along the last dimension. This is a learnable weight matrix.

[0091] Output sequence from the final layer of the data packet visual transformer Extract the first vector and treat it as a global feature of the session: .

[0092] Step S150: Extract the spatial features of the data packet, extract the temporal dependence of the spatial features, and obtain the spatiotemporal features of the data packet.

[0093] refer to Figure 7 In some exemplary embodiments, the step of extracting the spatial features of the data packet, extracting the temporal dependence of the spatial features, and obtaining the spatiotemporal features of the data packet includes: Step S710: Segment the session image into data packet images, and perform a convolution operation on each data packet image to generate a feature map set; Step S720: Perform global max pooling and global average pooling on the feature map set, and input it into a fully connected layer with activation function; Step S730: Weight the feature map according to the attention value of each channel; Step S740: Batch normalization and residual join; Step S750: Perform operations on each data packet image based on the residual attention convolutional layer, learn the weights of each channel so that the model focuses on key feature maps during the convolution process, adjust the feature information at different positions in the weighted feature map through convolution to highlight key spatial features, and flatten the output of the last layer of the residual attention convolutional layer to obtain the spatial features of the data packet. Step S760: After obtaining the spatial features of each data packet through the residual attention convolutional layer, the spatial features of each data packet are input into the bidirectional long short-term memory network layer in chronological order and in reverse order to capture the temporal dependence of the spatial features and obtain the spatiotemporal features.

[0094] In practical implementation, a Spatiotemporal Feature Extraction (STFE) module is constructed. This module consists of two core components: a residual attention convolutional layer (ResAtConv) with residual connections and attention mechanisms, and a bidirectional LSTM layer (Bi-LSTM).

[0095] The session image is segmented into packet images, and a convolution operation is performed on each packet to generate a set of feature maps. .

[0096] right Global max pooling (GMP) and global average pooling (GAP) are performed, and each feature map is compressed into a scalar that retains important information. It will be compressed into two vectors (dimension equal to) (Number of channels), input to a fully connected (FC) layer with a sigmoid activation function.

[0097] The feature maps are weighted according to the attention values ​​of each channel, highlighting the feature maps that make significant contributions and suppressing the feature maps that are not important.

[0098] application The convolutional kernel adjusts features at different locations. This module employs batch normalization and residual connections, a process that can be formalized as follows:

[0099] Performing a ResAtConv operation once for each data packet image allows the model to learn the channel weights, enabling it to focus on key feature maps during convolution.

[0100] pass Convolutional processing adjusts feature information at different locations in the weighted feature map to highlight key spatial features. The output of the final ResAtConv layer is flattened to obtain the spatial features of the data packet. : .

[0101] After obtaining the spatial features of each data packet through ResAtConv, these features are input into Bi-LSTM in sequence.

[0102] Spatial characteristics of each data packet Input LSTM cells in chronological and reverse order to capture spatial features. Time dependence.

[0103]

[0104] in Indicates time step The forward hidden state of the LSTM. Indicates time step The backward hidden state is obtained. The final states of the forward and backward hidden state sequences are concatenated to obtain the spatiotemporal features of the session. These concatenated hidden states are then subjected to a nonlinear transformation through a fully connected layer (FC) with LeakyRELU activation function. ,in This represents the maximum time step, i.e., the length of the data packet sequence.

[0105] Step S160: The global features and the spatiotemporal features are fused to obtain fused features, and the classification result of the second classification difficulty traffic is generated based on the fused features.

[0106] refer to Figure 8 In some exemplary embodiments, the step of fusing the global features and the spatiotemporal features to obtain fused features, and generating a classification result for the second classification difficulty traffic based on the fused features, includes: Step S810: Use temperature parameters to control the weight balance between different feature extraction modules; Step S820: After calculating the normalized weights of different features, fuse the vectors; Step S830: Input the fusion vector into two fully connected layers and apply a nonlinear transformation to the hidden layer to obtain a higher-order representation; Step S840: Determine the classification result of the second category difficulty traffic through the activation function.

[0107] In practical implementation, a feature fusion classification layer is used. A dynamic weighting mechanism is proposed to calculate global features. and spatiotemporal characteristics Weighting coefficients. Weighted fusion. and Then, the fused features are input into two fully connected layers (FC) and a classification probability distribution is generated through the softmax function.

[0108] Use temperature parameters This is used to control the weight balance among different feature extraction modules. Its mathematical expression is:

[0109]

[0110] in and For learnable parameters, Represents the hyperbolic tangent function. Represents an exponential function. These are the unnormalized weights of the features. and These are the independent unnormalized weights of global and local features, respectively. Temperature parameter. As a hyperparameter, it can balance the attention FFC pays to different features and alleviate the extreme cases of weight coefficients during normalization.

[0111] After calculating the normalized weights for different features, the fusion vector is... It can be represented as: . .

[0112] Will The input is fed into two fully connected layers, and a nonlinear transformation is applied to the hidden layers to obtain a higher-order representation.

[0113] Through the softmax function (i.e.) Determine the type of encrypted traffic.

[0114] As can be seen from the above, the encrypted traffic classification method provided in this disclosure includes: acquiring a plurality of classification rule sets; classifying an encrypted traffic set based on the plurality of classification rule sets to obtain a classification result set; dividing the encrypted traffic set into a first classification difficulty traffic and a second classification difficulty traffic based on the classification result set, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic; determining the classification result of the first classification difficulty traffic based on the classification result set; processing the second classification difficulty traffic to generate a session image; decomposing the session image into a plurality of data packets and performing embedding processing to capture the interaction information between all the data packets to obtain global features; extracting the spatial features of the data packets and extracting the temporal dependence of the spatial features to obtain the spatiotemporal features of the data packets; fusing the global features and the spatiotemporal features to obtain fused features; and generating the classification result of the second classification difficulty traffic based on the fused features. The classification analysis of encrypted traffic with different classification difficulties improves the efficiency of encrypted traffic classification. For encrypted traffic with higher classification difficulty, classification based on its global features and spatiotemporal features improves the accuracy of encrypted traffic classification.

[0115] This method achieves high-precision and high-efficiency identification of encrypted traffic by integrating lightweight fast screening with deep fusion feature analysis techniques. First, an ensemble decision tree model is used for rapid coarse classification of encrypted traffic. Statistical features such as packet length, time interval, and TCP window size of the first few packets are extracted to construct a lightweight tree-based machine learning model for classification. Second, for the remaining 10% of complex traffic, the system automatically transitions to a deep fine-grained classification stage: on one hand, a packet visual transformer is used to visualize the traffic session, and a multi-head self-attention mechanism is used to capture the spatial dependencies between packets; on the other hand, an attention-enhanced bidirectional LSTM network is used to deeply analyze the temporal features of the packet sequence. Finally, a dynamic weight mechanism is introduced to achieve adaptive fusion of global and spatiotemporal features, effectively suppressing model overfitting. This disclosure combines a two-stage classification mechanism with deep learning methods, achieving dual optimization of real-time performance and high accuracy in encrypted traffic classification under high-throughput network environments. It provides an innovative solution to the current challenge of balancing real-time requirements and classification accuracy in encrypted traffic identification.

[0116] This invention enables efficient classification of encrypted traffic in power information systems, balancing processing speed and classification accuracy while optimizing network resource allocation. The method first performs a rapid preliminary classification of encrypted traffic in the initial stage using lightweight statistical features such as packet length, time interval, and TCP window size, dividing the traffic into easily classifiable and difficult-to-classify categories. The easily classifiable traffic category directly outputs its classification result. Secondly, in the second stage, deep feature extraction is performed on the difficult-to-classify traffic. An attention-based packet visual transformer module captures global traffic features, and a bidirectional LSTM module extracts spatiotemporal features. Finally, by introducing a dynamic weighting mechanism, adaptive fusion of global and spatiotemporal features is achieved. This realizes a dual optimization of real-time performance and high accuracy in encrypted traffic classification under high-throughput network environments, providing an innovative solution to the current challenge of balancing real-time requirements and classification accuracy in encrypted traffic identification.

[0117] Specifically, the technical solution disclosed herein has the following advantages: A two-stage processing framework is proposed, which achieves a smaller average latency when the proportion of easy flows in encrypted traffic is high, and improves processing speed by two orders of magnitude compared to traditional methods. In the first stage, a lightweight machine learning model is used to perform real-time rapid screening of encrypted traffic, classifying traffic into easy and difficult categories based on the statistical characteristics of the first few packets, achieving millisecond-level response. A tree-based machine learning method is used for classification, directly outputting the corresponding category for easy-to-classify flows. In the second stage, multimodal deep feature extraction is performed on difficult-to-classify traffic, combining attention mechanisms and the temporal modeling capabilities of bidirectional LSTM, and high-precision classification is achieved through dynamic weight fusion.

[0118] Design an attention-based packet visual transformer and a spatiotemporal feature extraction module: The packet visual transformer fully preserves spatiotemporal information and extracts global features through triple embedding operations; the spatiotemporal feature extraction module accurately captures spatiotemporal features through self-attention convolution and bidirectional LSTM network.

[0119] A dynamic weighting mechanism is proposed to adaptively adjust the weights of global and spatiotemporal features to achieve optimal feature fusion. By introducing a temperature parameter, the weight imbalance problem during feature fusion is avoided, ensuring that each feature extraction module learns sufficiently during the training phase.

[0120] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0121] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0122] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides an encrypted traffic classification device.

[0123] refer to Figure 9 An encrypted traffic classification device includes: The classification difficulty determination module 910 is configured to acquire several classification rule sets, classify the encrypted traffic set based on the several classification rule sets to obtain a classification result set, and divide the encrypted traffic set into first classification difficulty traffic and second classification difficulty traffic based on the classification result set, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic. The first category difficulty traffic classification module 920 is configured to determine the classification result of the first category difficulty traffic based on the classification result set; The conversation image generation module 930 is configured to process the second category difficulty traffic to generate a conversation image; The global feature extraction module 940 is configured to decompose the session image into several data packets and perform embedding processing, capture the interaction information between all the data packets, and obtain global features. The spatiotemporal feature extraction module 950 is configured to extract the spatial features of the data packet, extract the temporal dependence of the spatial features, and obtain the spatiotemporal features of the data packet. The second category difficulty traffic classification module 960 is configured to fuse the global features and the spatiotemporal features to obtain fused features, and generate the classification result of the second category difficulty traffic based on the fused features.

[0124] In some exemplary embodiments, the classification difficulty determination module 910 is specifically configured as follows: Obtain an encrypted traffic set, extract a portion of the data packets from the encrypted traffic set, and extract classification features from the portion of the data packets; Several training sample subsets are constructed based on the classification features, several classification trees are constructed based on the several training sample subsets, and several classification rule sets are generated based on the several classification trees.

[0125] In some exemplary embodiments, the classification difficulty determination module 910 is specifically configured as follows: Obtain raw traffic data and divide the raw traffic data into several streams, wherein the raw traffic data contains several data packets, and each stream contains several data packets; Extract the payload length, transmission control protocol window size, and timestamp of each data packet in each stream, and convert the timestamp into the time interval between the current data packet and the previous data packet. The classification features include the payload length, the transmission control protocol window size, and the time interval. The classification features of each data packet in each stream are arranged in the order of the packet sequence to obtain the classification features of the stream.

[0126] In some exemplary embodiments, the classification difficulty determination module 910 is specifically configured as follows: Determine the application labels of the classification features, and construct a training sample set based on the classification features and the application labels; Several subsets of training samples are extracted from the training sample set; Construct a classification tree based on each subset of training samples; The key leaf nodes in the classification tree are determined, and the classification rule set is generated based on the leaf nodes, wherein the classification rule set contains several rules.

[0127] In some exemplary embodiments, the classification difficulty determination module 910 is specifically configured as follows: In response to determining that the number of classification rule sets corresponding to the same classification result is greater than or equal to a number threshold, the target traffic is determined to be traffic with the first classification difficulty. And / or, in response to determining that the number of the classification rule sets corresponding to the same classification result is less than a number threshold, the target traffic is determined to be traffic with second classification difficulty.

[0128] In some exemplary embodiments, the session image generation module 930 is specifically configured as follows: The traffic of the second category of difficulty is divided into several network flows; Based on the timestamps of the bidirectional streams in the network stream, the bidirectional streams are arranged in a preset time order, and the bidirectional streams are combined to generate a session stream; The session stream is enhanced, truncated, or padded to obtain a processed session stream; The processed session stream is converted into several data packet images; The session image is generated by combining the several data packet images.

[0129] In some exemplary embodiments, the global feature extraction module 940 is specifically configured as follows: Perform a two-dimensional convolution operation on the session image to obtain the packet embedding for each data packet; Determine the embedding location of each data packet in the session image; After converting the length of each data packet into a one-hot vector, a length embedding is generated through a linear layer; The data packet embedding, the position embedding, and the length embedding are added together to obtain the embedding representation of each data packet; Based on the K-attention mechanism, the query, key and value are projected to several subspaces. The self-attention weight matrix is ​​calculated using the scaled dot product attention mechanism. After concatenating the outputs of all attention heads, the output of the multi-head self-attention layer is obtained through linear projection. The first vector is extracted from the output of the multi-head self-attention layer and used as the global feature of the session.

[0130] In some exemplary embodiments, the spatiotemporal feature extraction module 950 is specifically configured as follows: The session image is segmented into data packet images, and a convolution operation is performed on each data packet image to generate a set of feature maps; Global max pooling and global average pooling are applied to the feature map set, and the result is input into a fully connected layer with an activation function. The feature map is weighted according to the attention value of each channel; Batch normalization and residual join; The residual attention convolutional layer performs operations on each data packet image, learns the weights of each channel so that the model focuses on key feature maps during the convolution process, adjusts the feature information at different positions in the weighted feature map through convolution to highlight key spatial features, and flattens the output of the last layer of the residual attention convolutional layer to obtain the spatial features of the data packet. After obtaining the spatial features of each data packet through the residual attention convolutional layer, the spatial features of each data packet are input into the bidirectional long short-term memory network layer in chronological order and in reverse order to capture the temporal dependence of the spatial features and obtain the spatiotemporal features.

[0131] In some exemplary embodiments, the second classification difficulty traffic classification module 960 is specifically configured as follows: Temperature parameters are used to control the weight balance among different feature extraction modules; After calculating the normalized weights of different features, the fused vector is obtained; The fusion vector is input into two fully connected layers, and a nonlinear transformation is applied to the hidden layer to obtain a higher-order representation; The classification result of the second category difficulty traffic is determined by the activation function.

[0132] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, in implementing this disclosure, the functions of each module can be implemented in one or more software and / or hardware.

[0133] The apparatus of the above embodiments is used to implement the corresponding encrypted traffic classification method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0134] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the encrypted traffic classification method described in any of the above embodiments.

[0135] Figure 10 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0136] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0137] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0138] The input / output interface 1030 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touch screens, microphones, various sensors, etc., and output devices may include displays, speakers, vibrators, indicator lights, etc.

[0139] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0140] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0141] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0142] The electronic devices described above are used to implement the corresponding encrypted traffic classification methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0143] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the encrypted traffic classification method as described in any of the above embodiments.

[0144] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0145] The aforementioned non-transitory computer-readable storage media can be any available medium or data storage device that a computer can access, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0146] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the encrypted traffic classification method as described in any of the embodiments in the exemplary method section above, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0147] Based on the same inventive concept, corresponding to the encrypted traffic classification method described in any of the above embodiments, this disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to perform the encrypted traffic classification method. Corresponding to the execution entity for each step in each embodiment of the encrypted traffic classification method, the processor executing the corresponding step can belong to the corresponding execution entity.

[0148] The computer program product of the above embodiments is used to cause the computer and / or the processor to execute the encrypted traffic classification method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0149] Those skilled in the art will recognize that embodiments of this disclosure can be implemented as a system, method, or computer program product. Therefore, this disclosure can be implemented as entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this disclosure can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0150] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (not exhaustive) of a computer-readable storage medium may include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0151] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0152] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0153] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0154] It should be understood that each block of a flowchart and / or block diagram, as well as combinations of blocks in a flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine that, when executed by a computer or other programmable data processing device, creates means for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0155] These computer program instructions may also be stored in a computer-readable medium that enables a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce a product comprising an instruction apparatus that implements the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0156] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, such that the instructions that execute on the computer or other programmable apparatus can provide a process for implementing the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0157] Furthermore, although the operations of the methods of this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. Rather, the steps depicted in the flowcharts may be executed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0158] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. Each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0159] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0160] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0161] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this disclosure can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0162] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0163] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

[0164] While the spirit and principles of this disclosure have been described with reference to several specific embodiments, it should be understood that this disclosure is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for convenience of expression. This disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. The scope of the appended claims is to be interpreted in the broadest sense, thereby encompassing all such modifications and equivalent structures and functions.

Claims

1. A method for classifying encrypted traffic, characterized in that, include: A set of classification rules is obtained, and the encrypted traffic set is classified based on the set of classification rules to obtain a classification result set. Based on the classification result set, the encrypted traffic set is divided into a first classification difficulty traffic and a second classification difficulty traffic, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic. The classification result of the first classification difficulty traffic is determined based on the classification result set; The traffic of the second category of difficulty is processed to generate a session image; The session image is decomposed into several data packets and embedded to capture the interaction information between all the data packets, thus obtaining global features. Extract the spatial features of the data packet, extract the temporal dependence of the spatial features, and obtain the spatiotemporal features of the data packet; The global features and the spatiotemporal features are fused to obtain fused features, and the classification result of the second classification difficulty traffic is generated based on the fused features.

2. The method according to claim 1, characterized in that, The methods for generating the aforementioned classification rule sets include: Obtain an encrypted traffic set, extract a portion of the data packets from the encrypted traffic set, and extract classification features from the portion of the data packets; Several training sample subsets are constructed based on the classification features, several classification trees are constructed based on the several training sample subsets, and several classification rule sets are generated based on the several classification trees.

3. The method according to claim 2, characterized in that, The process of acquiring an encrypted traffic set, intercepting a portion of data packets from the encrypted traffic set, and extracting classification features from the portion of data packets includes: Obtain raw traffic data and divide the raw traffic data into several streams, wherein the raw traffic data contains several data packets, and each stream contains several data packets; Extract the payload length, transmission control protocol window size, and timestamp of each data packet in each stream, and convert the timestamp into the time interval between the current data packet and the previous data packet. The classification features include the payload length, the transmission control protocol window size, and the time interval. The classification features of each data packet in each stream are arranged in the order of the packet sequence to obtain the classification features of the stream.

4. The method according to claim 2, characterized in that, The process of constructing several training sample subsets based on the classification features, constructing several classification trees based on the several training sample subsets, and generating several classification rule sets based on the several classification trees includes: Determine the application labels of the classification features, and construct a training sample set based on the classification features and the application labels; Several subsets of training samples are extracted from the training sample set; A classification tree is constructed based on each subset of training samples, key leaf nodes in the classification tree are determined, and a classification rule set is generated based on the leaf nodes, wherein the classification rule set contains several rules.

5. The method according to claim 1, characterized in that, The process of classifying the encrypted traffic set based on the aforementioned set of classification rules yields a classification result set. Based on this classification result set, the encrypted traffic set is further divided into a first-class difficulty traffic set and a second-class difficulty traffic set, including: In response to determining that the number of classification rule sets corresponding to the same classification result is greater than or equal to a number threshold, the target traffic is determined to be traffic with the first classification difficulty. And / or, in response to determining that the number of the classification rule sets corresponding to the same classification result is less than a number threshold, the target traffic is determined to be traffic with second classification difficulty.

6. The method according to claim 1, characterized in that, The step of processing the second category of difficulty traffic to generate a session image includes: The traffic of the second category of difficulty is divided into several network flows; Based on the timestamps of the bidirectional streams in the network stream, the bidirectional streams are arranged in a preset time order, and the bidirectional streams are combined to generate a session stream; The session stream is enhanced, truncated, or padded to obtain a processed session stream; The processed session stream is converted into several data packet images; The session image is generated by combining the several data packet images.

7. The method according to claim 1, characterized in that, The process of decomposing the session image into several data packets and embedding them to capture the interaction information between all the data packets and obtain global features includes: Perform a two-dimensional convolution operation on the session image to obtain the packet embedding for each data packet; Determine the embedding location of each data packet in the session image; After converting the length of each data packet into a one-hot vector, a length embedding is generated through a linear layer; The data packet embedding, the position embedding, and the length embedding are added together to obtain the embedding representation of each data packet; Based on the K-attention mechanism, the query, key and value are projected to several subspaces. The self-attention weight matrix is ​​calculated using the scaled dot product attention mechanism. After concatenating the outputs of all attention heads, the output of the multi-head self-attention layer is obtained through linear projection. The first vector is extracted from the output of the multi-head self-attention layer and used as the global feature of the session.

8. The method according to claim 1, characterized in that, The step of extracting the spatial features of the data packet and extracting the temporal dependence of the spatial features to obtain the spatiotemporal features of the data packet includes: The session image is segmented into data packet images, and a convolution operation is performed on each data packet image to generate a set of feature maps; Global max pooling and global average pooling are applied to the feature map set, and the result is input into a fully connected layer with an activation function. The feature map is weighted according to the attention value of each channel; Batch normalization and residual join; The residual attention convolutional layer performs operations on each data packet image, learns the weights of each channel so that the model focuses on key feature maps during the convolution process, adjusts the feature information at different positions in the weighted feature map through convolution to highlight key spatial features, and flattens the output of the last layer of the residual attention convolutional layer to obtain the spatial features of the data packet. After obtaining the spatial features of each data packet through the residual attention convolutional layer, the spatial features of each data packet are input into the bidirectional long short-term memory network layer in chronological order and in reverse order to capture the temporal dependence of the spatial features and obtain the spatiotemporal features.

9. The method according to claim 1, characterized in that, The process of fusing the global features and the spatiotemporal features to obtain fused features, and generating the classification result of the second classification difficulty traffic based on the fused features, includes: Temperature parameters are used to control the weight balance among different feature extraction modules; After calculating the normalized weights of different features, the fused vector is obtained; The fusion vector is input into two fully connected layers, and a nonlinear transformation is applied to the hidden layer to obtain a higher-order representation; The classification result of the second category difficulty traffic is determined by the activation function.

10. An encrypted traffic classification device, characterized in that, include: The classification difficulty determination module is configured to acquire several classification rule sets, classify the encrypted traffic set based on the several classification rule sets to obtain a classification result set, and divide the encrypted traffic set into first classification difficulty traffic and second classification difficulty traffic based on the classification result set, wherein the classification difficulty of the second classification difficulty traffic is greater than that of the first classification difficulty traffic. The first category difficulty traffic classification module is configured to determine the classification result of the first category difficulty traffic based on the classification result set; The conversation image generation module is configured to process the second category difficulty traffic and generate a conversation image; The global feature extraction module is configured to decompose the session image into several data packets and perform embedding processing, capture the interaction information between all the data packets, and obtain global features. The spatiotemporal feature extraction module is configured to extract the spatial features of the data packet, extract the temporal dependence of the spatial features, and obtain the spatiotemporal features of the data packet. The second difficulty traffic classification module is configured to fuse the global features and the spatiotemporal features to obtain fused features, and generate the classification result of the second difficulty traffic based on the fused features.

11. The apparatus according to claim 10, characterized in that, The classification difficulty determination module is specifically configured as follows: Obtain an encrypted traffic set, extract a portion of the data packets from the encrypted traffic set, and extract classification features from the portion of the data packets; Several training sample subsets are constructed based on the classification features, several classification trees are constructed based on the several training sample subsets, and several classification rule sets are generated based on the several classification trees.

12. The apparatus according to claim 11, characterized in that, The classification difficulty determination module is specifically configured as follows: Obtain raw traffic data and divide the raw traffic data into several streams, wherein the raw traffic data contains several data packets, and each stream contains several data packets; Extract the payload length, transmission control protocol window size, and timestamp of each data packet in each stream, and convert the timestamp into the time interval between the current data packet and the previous data packet. The classification features include the payload length, the transmission control protocol window size, and the time interval. The classification features of each data packet in each stream are arranged in the order of the packet sequence to obtain the classification features of the stream.

13. The apparatus according to claim 11, characterized in that, The classification difficulty determination module is specifically configured as follows: Determine the application labels of the classification features, and construct a training sample set based on the classification features and the application labels; Several subsets of training samples are extracted from the training sample set; A classification tree is constructed based on each subset of training samples, key leaf nodes in the classification tree are determined, and a classification rule set is generated based on the leaf nodes, wherein the classification rule set contains several rules.

14. The apparatus according to claim 10, characterized in that, The classification difficulty determination module is specifically configured as follows: In response to determining that the number of classification rule sets corresponding to the same classification result is greater than or equal to a number threshold, the target traffic is determined to be traffic with the first classification difficulty. And / or, in response to determining that the number of the classification rule sets corresponding to the same classification result is less than a number threshold, the target traffic is determined to be traffic with second classification difficulty.

15. The apparatus according to claim 10, characterized in that, The session image generation module is specifically configured as follows: The traffic of the second category of difficulty is divided into several network flows; Based on the timestamps of the bidirectional streams in the network stream, the bidirectional streams are arranged in a preset time order, and the bidirectional streams are combined to generate a session stream; The session stream is enhanced, truncated, or padded to obtain a processed session stream; The processed session stream is converted into several data packet images; The session image is generated by combining the several data packet images.

16. The apparatus according to claim 10, characterized in that, The global feature extraction module is specifically configured as follows: Perform a two-dimensional convolution operation on the session image to obtain the packet embedding for each data packet; Determine the embedding location of each data packet in the session image; After converting the length of each data packet into a one-hot vector, a length embedding is generated through a linear layer; The data packet embedding, the position embedding, and the length embedding are added together to obtain the embedding representation of each data packet; Based on the K-attention mechanism, the query, key and value are projected to several subspaces. The self-attention weight matrix is ​​calculated using the scaled dot product attention mechanism. After concatenating the outputs of all attention heads, the output of the multi-head self-attention layer is obtained through linear projection. The first vector is extracted from the output of the multi-head self-attention layer and used as the global feature of the session.

17. The apparatus according to claim 10, characterized in that, The spatiotemporal feature extraction module is specifically configured as follows: The session image is segmented into data packet images, and a convolution operation is performed on each data packet image to generate a set of feature maps; Global max pooling and global average pooling are applied to the feature map set, and the result is input into a fully connected layer with an activation function. The feature map is weighted according to the attention value of each channel; Batch normalization and residual join; The residual attention convolutional layer performs operations on each data packet image, learns the weights of each channel so that the model focuses on key feature maps during the convolution process, adjusts the feature information at different positions in the weighted feature map through convolution to highlight key spatial features, and flattens the output of the last layer of the residual attention convolutional layer to obtain the spatial features of the data packet. After obtaining the spatial features of each data packet through the residual attention convolutional layer, the spatial features of each data packet are input into the bidirectional long short-term memory network layer in chronological order and in reverse order to capture the temporal dependence of the spatial features and obtain the spatiotemporal features.

18. The apparatus according to claim 10, characterized in that, The second category difficulty traffic classification module is specifically configured as follows: Temperature parameters are used to control the weight balance among different feature extraction modules; After calculating the normalized weights of different features, the fused vector is obtained; The fusion vector is input into two fully connected layers, and a nonlinear transformation is applied to the hidden layer to obtain a higher-order representation; The classification result of the second category difficulty traffic is determined by the activation function.

19. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in any one of claims 1 to 9.

20. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions for causing the computer to perform the method of any one of claims 1 to 9.

21. A computer program product, characterized in that, It includes computer program instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1 to 9.

Images