Malicious doh tunnel traffic detection method, device and storage medium

Abstract

The application discloses a malicious DoH tunnel flow detection method and device and a storage medium, relates to the technical field of network security, and comprises the following steps: acquiring to-be-detected flow and extracting a plurality of to-be-detected flow features of the to-be-detected flow; inputting each to-be-detected flow feature into a target malicious flow detection model for detection to obtain a malicious flow detection result output by the target malicious flow detection model, wherein the target malicious flow detection model is trained by a malicious flow feature data set that has undergone important feature screening, semantic enhancement and semantic processing. According to the application, important feature screening is used to remove redundant and irrelevant features, focus on key information, highlight malicious flow semantics through semantic enhancement, and suppress environmental noise interference; and then, semantic processing is used to deeply model flow features, so that the model has high detection accuracy, can adapt to complex and changeable network environments and flow modes, and improves the robustness and generalization ability of the model.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, device and storage medium for detecting malicious DoH tunnel traffic. Background Technology

[0002] DNS (Domain Name System), as a core infrastructure of the Internet, is responsible for mapping domain names to IP addresses. However, traditional DNS uses plaintext UDP (User Datagram Protocol) for transmission, making it vulnerable to security threats such as eavesdropping and tampering. To alleviate this problem, DoH (HTTPS-based DNS) was standardized. It encapsulates DNS queries within HTTPS traffic and transmits them through port 443, effectively protecting the privacy and security of DNS transmission.

[0003] However, DoH's encryption features have also been exploited by attackers to create malicious DoH tunnels for transmitting malicious commands and leaking sensitive data. In particular, the HTTP / 2 multiplexing feature allows attackers to carry a large number of concurrent DoH queries within a single tunnel, further enhancing the concealment and concurrency of malicious traffic and posing new challenges to network security protection.

[0004] Therefore, there is an urgent need for a new method to effectively identify and block malicious DoH tunnel traffic in complex network environments. Summary of the Invention

[0005] The main purpose of this application is to provide a method, device and storage medium for detecting malicious DoH tunnel traffic, which aims to effectively identify and block malicious DoH tunnel traffic in complex network environments.

[0006] To achieve the above objectives, this application proposes a method for detecting malicious DoH tunnel traffic, the method comprising:

[0007] Obtain the traffic to be detected, and extract several traffic features of the traffic to be detected;

[0008] Each of the traffic features to be detected is input into the target malicious traffic detection model for detection, and the malicious traffic detection result output by the target malicious traffic detection model is obtained. The target malicious traffic detection model is trained from a malicious traffic feature dataset that has undergone important feature screening, semantic enhancement and semantic processing.

[0009] In one embodiment, the training process of the target malicious traffic detection model includes:

[0010] Obtain a malicious traffic feature dataset and perform data preprocessing on the malicious traffic feature dataset to obtain a model training set and a model test set;

[0011] Based on the model training set, the initial malicious traffic detection model is trained to obtain the undetermined malicious traffic detection model.

[0012] The model to be tested is performed on the model test set and the test tag set corresponding to the model test set to obtain the target malicious traffic detection model.

[0013] In one embodiment, the step of training an initial malicious traffic detection model based on the model training set to obtain a pending malicious traffic detection model includes:

[0014] According to the mutual information value calculation method, the contribution value of each sample traffic feature in the model training set is evaluated, and the first sample feature sequence is determined based on the contribution value of each sample traffic feature.

[0015] The first sample feature sequence is semantically enhanced to obtain the second sample feature sequence;

[0016] The second sample feature sequence is input into the initial malicious traffic detection model for model training, and the traffic classification result output by the initial malicious traffic detection model is obtained;

[0017] Based on the traffic classification results, it is determined whether the initial malicious traffic detection model meets the preset iteration conditions, and the pending malicious traffic detection model is obtained.

[0018] In one embodiment, evaluating the contribution value of each sample traffic feature in the model training set according to the mutual information value calculation method, and determining the first sample feature sequence based on the contribution value of each sample traffic feature, includes:

[0019] Based on the mutual information value calculation method and the sample label value corresponding to each sample traffic feature, the contribution value corresponding to each sample traffic feature is calculated.

[0020] Add the sample flow features whose contribution value is greater than the preset gain threshold to the initial sample feature sequence;

[0021] Based on the contribution value, the sample flow features in the initial sample feature sequence are sorted to determine the first sample feature sequence.

[0022] In one embodiment, the step of performing semantic enhancement processing on the first sample feature sequence to obtain the second sample feature sequence includes:

[0023] Based on the scaling factor and the position transformation factor, the first sample feature sequence is subjected to environment-adaptive modulation processing to obtain the first enhanced feature sequence.

[0024] The first sample feature sequence is subjected to mean dimensionality reduction, fast Fourier transform, time-frequency joint modulation, and channel dimension concatenation to obtain the second enhanced feature sequence.

[0025] The first enhanced feature sequence and the second enhanced feature sequence are fused to obtain the second sample feature sequence.

[0026] In one embodiment, the initial malicious traffic detection model includes a temporal convolutional network, a forward-gated multi-head attention layer, a multi-scale semantic integration layer, an average pooling layer, and a fully connected layer;

[0027] The step of inputting the second sample feature sequence into the initial malicious traffic detection model for model training, and obtaining the traffic classification result output by the initial malicious traffic detection model, includes:

[0028] The second sample feature sequence is input into the residual structure of the temporal convolutional network for dilated causal convolution, weight normalization, function activation and random masking to obtain the first traffic processing result;

[0029] The first traffic processing result is captured by the positively gated multi-head attention layer to generate a second traffic processing result.

[0030] The third traffic processing result is obtained by deeply integrating and multi-scale modeling the second traffic processing result through a multi-scale semantic integration layer.

[0031] The third traffic processing result is mapped through the average pooling layer and the fully connected layer to output the traffic classification result.

[0032] In one embodiment, determining whether the initial malicious traffic detection model meets preset iteration conditions based on the traffic classification results to obtain the pending malicious traffic detection model includes:

[0033] Based on the traffic classification results, determine whether the initial malicious traffic detection model meets the preset iteration conditions;

[0034] If not, then based on the model training set, the initial malicious traffic detection model is iteratively trained until the initial malicious traffic detection model meets the preset iteration conditions;

[0035] If so, the initial malicious traffic detection model will be used as the pending malicious traffic detection model.

[0036] In one embodiment, the step of performing model testing on the undetermined malicious traffic detection model based on the model test set and the test tag set corresponding to the model test set to obtain the target malicious traffic detection model includes:

[0037] For any test traffic feature in the model test set, the test traffic feature is input into the undetermined malicious traffic detection model for detection, and the test detection result output by the undetermined malicious traffic detection model is obtained, so as to obtain the test detection result set corresponding to the model test set;

[0038] The test detection result set is compared and analyzed with the test label set to obtain model test analysis data;

[0039] The target malicious traffic detection model is obtained by comparing the model test analysis data with the preset compliance threshold.

[0040] Furthermore, to achieve the above objectives, this application also proposes a malicious DoH tunnel traffic detection device, which includes:

[0041] The acquisition module is used to acquire the traffic to be detected and extract several traffic features of the traffic to be detected;

[0042] The output module is used to input each of the traffic features to be detected into the target malicious traffic detection model for detection, and obtain the malicious traffic detection result output by the target malicious traffic detection model. The target malicious traffic detection model is trained from a malicious traffic feature dataset that has undergone important feature screening, semantic enhancement and semantic processing.

[0043] In addition, to achieve the above objectives, this application also proposes a malicious DoH tunnel traffic detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the malicious DoH tunnel traffic detection method described above.

[0044] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the malicious DoH tunnel traffic detection method described above.

[0045] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the malicious DoH tunnel traffic detection method described above.

[0046] This application provides a method, device, and storage medium for detecting malicious DoH tunnel traffic. The method acquires the traffic to be detected and extracts several features of the traffic to be detected. These features are then input into a target malicious traffic detection model for detection, resulting in a malicious traffic detection result output by the model. The target malicious traffic detection model is trained on a malicious traffic feature dataset that has undergone important feature filtering, semantic enhancement, and semantic processing. This process removes redundant and irrelevant features, focuses on key information, and enhances the semantics of malicious traffic to suppress environmental noise interference. Furthermore, semantic processing deeply models the traffic features, resulting in high detection accuracy and precise identification of malicious traffic. This allows the model to adapt to complex and changing network environments and traffic patterns, providing good detection capabilities for different types of malicious traffic and improving its robustness and generalization ability. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart illustrating an embodiment of the malicious DoH tunnel traffic detection method of this application.

[0050] Figure 2 A flowchart of a temporal convolutional network provided for the malicious DoH tunnel traffic detection method of this application;

[0051] Figure 3 A flowchart illustrating the forward-gated multi-head attention layer for the malicious DoH tunnel traffic detection method of this application;

[0052] Figure 4 A simplified flowchart illustrating the malicious DoH tunnel traffic detection method of this application;

[0053] Figure 5 This is a schematic diagram of the module structure of the malicious DoH tunnel traffic detection device according to an embodiment of this application;

[0054] Figure 6This is a schematic diagram of the hardware operating environment involved in the malicious DoH tunnel traffic detection method in this application embodiment.

[0055] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0056] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0057] DNS (Domain Name System) is one of the most important infrastructures of the Internet, primarily used to map domain names to machine-readable IP addresses. However, because traditional DNS uses plaintext UDP transmission, it has long been vulnerable to security threats such as eavesdropping and tampering. DoH, standardized in RFC 8484, aims to alleviate the privacy and security problems caused by plaintext DNS transmission. It allows DNS queries from users to be encapsulated in HTTPS traffic and transmitted to a DoH server via port 443. However, this mechanism has also been exploited by attackers to hide malicious tunneling activities, posing a significant threat to network security.

[0058] DoH malicious tunnels can be used by attackers to execute malicious command transmissions and leak sensitive data. Due to the encryption nature of DoH, the packet payload content is invisible, rendering traditional detection techniques such as IP blacklists and deep DNS packet analysis ineffective. More seriously, HTTP / 2 is the recommended minimum transport version for DoH, and its multiplexing capabilities allow attackers to simultaneously handle a large number of concurrent DoH queries within a single established tunnel. This not only significantly increases the concurrency and stealth of malicious traffic but also further exacerbates the risk of failure for existing detection and defense methods.

[0059] Currently, ensuring the accurate transmission and efficient utilization of traffic semantics, and achieving high accuracy and robustness in detecting malicious DoH tunnel traffic in real and complex network environments, remains a key challenge in DoH tunnel detection research. Previous models rely on extracting a large number of traffic features to improve detection performance, but they pay insufficient attention to the efficiency of feature utilization, including time-frequency information utilization, anomaly pattern capture, and semantic enhancement. Existing models typically only capture shallow representations between features, lacking the ability to model deep traffic semantic relationships, thus limiting the improvement of traffic detection accuracy. Furthermore, introducing redundant features can lead to model overfitting risks, increase computational complexity, and limit their application value in practical traffic detection.

[0060] Furthermore, malicious DoH tunnel traffic often hides within large-scale benign traffic, and this traffic class imbalance exacerbates the difficulty of detection. In a highly imbalanced traffic environment, the semantic representation of a few malicious flows tends to be sparse and ambiguous due to interference from environmental noise and benign traffic context information. This semantic ambiguity not only increases the risk of misclassification but also significantly weakens the robustness and generalization ability of the model.

[0061] Therefore, it is necessary to design a suitable malicious DoH tunnel detection model to address the above problems.

[0062] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0063] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device, big data service platform, or malicious DoH tunnel traffic detection system capable of performing the above functions. The following description uses a malicious DoH tunnel traffic detection system as an example to illustrate this embodiment and the subsequent embodiments.

[0064] Based on this, embodiments of this application provide a method for detecting malicious DoH tunnel traffic, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the malicious DoH tunnel traffic detection method of this application.

[0065] In this embodiment, the malicious DoH tunnel traffic detection method includes steps S11-S12:

[0066] Step S11: Obtain the traffic to be detected and extract several traffic features of the traffic to be detected;

[0067] It should be noted that the traffic to be detected refers to data streams transmitted in a network environment that need to be determined to contain malicious attributes. This can be encrypted network traffic (such as encrypted DNS traffic transmitted using DoH technology) or unencrypted network traffic, encompassing various data packets exchanged between the client and server. The characteristics of the traffic to be detected refer to quantifiable information extracted from the traffic to be detected that can characterize the essential attributes or behavioral patterns of the traffic.

[0068] Specifically, raw traffic is acquired using network capture tools, and then feature engineering methods are employed to filter and extract features that reflect differences in traffic behavior from the raw traffic, ultimately forming a structured feature set for model use. In one possible implementation, when extracting features of the traffic to be detected, the focus can be on the session interaction phase of the traffic, specifically including features such as the total number of Client-side Application Data messages, the total number of Server-side Application Data messages, the maximum length of Client-side Application Data messages, the maximum length of Server-side Application Data messages, and the transition matrix of Server-side Application Data message arrival time intervals. These features can effectively distinguish the behavioral differences between benign and malicious traffic, and are not limited here; they can be set according to the actual situation.

[0069] Step S12: Input each of the traffic features to be detected into the target malicious traffic detection model for detection, and obtain the malicious traffic detection result output by the target malicious traffic detection model. The target malicious traffic detection model is trained from a malicious traffic feature dataset that has undergone important feature screening, semantic enhancement and semantic processing.

[0070] It should be noted that the target malicious traffic detection model refers to a model that has undergone a complete training and testing process and can stably output malicious traffic detection results. It possesses the ability to analyze the characteristics of input traffic and determine its attributes. Important feature selection refers to the process of evaluating the contribution of each feature in the original feature set using specific evaluation methods (such as mutual information value calculation methods), selecting a subset of features with high discriminative power for traffic classification tasks. The aim is to remove redundant features and reduce the computational complexity of the model. Semantic enhancement refers to the process of processing the selected feature sequences to strengthen the semantic expression of malicious traffic. This includes operations such as environment-adaptive modulation and time-frequency joint modulation, which can suppress environmental noise interference and highlight malicious features. Semantic processing refers to the process of deeply processing the enhanced features using methods such as temporal modeling and attention mechanisms. By capturing temporal dependencies and global contextual information, it improves the model's ability to understand complex traffic patterns.

[0071] It's important to further clarify that the malicious traffic feature dataset refers to a dataset containing a large number of benign and malicious traffic samples and their corresponding features, serving as the fundamental data source for model training. The malicious traffic detection result refers to the conclusion output by the target malicious traffic detection model after analyzing the input features, typically presented as probability values ​​or class labels, indicating whether the traffic to be detected is malicious. The purpose of this step is to utilize a well-trained model to accurately analyze the input features and quickly output detection results. Its core effect is to achieve efficient identification of malicious traffic, especially in class-imbalanced environments where malicious traffic is sparse.

[0072] Specifically, the structured features of the traffic to be detected are input into the model. These features are then processed through modules such as temporal convolution, attention capture, and multi-scale integration within the model, ultimately mapping the results to a classification outcome. In one possible implementation, the malicious traffic detection result can be a probability value between 0 and 1. A probability value greater than 0.5 indicates the traffic is malicious, while a probability value less than or equal to 0.5 indicates it is benign. This probability value directly reflects the model's confidence in the detection result.

[0073] It should also be noted that the training foundation of the target malicious traffic detection model determines its detection performance. After important feature screening, the model input focuses on key information, avoiding interference from irrelevant features. Semantic enhancement processing strengthens the subtle semantic differences of malicious traffic, making the model more likely to capture abnormal patterns. Semantic processing further improves the model's discrimination ability by deeply modeling the temporal and contextual relationships between features. The combined effect of these three factors gives the target malicious traffic detection model high accuracy and strong robustness.

[0074] In this embodiment, the target malicious traffic detection model undergoes important feature screening to remove redundant and irrelevant features, focusing on key information. Semantic enhancement is used to highlight the semantics of malicious traffic and suppress environmental noise interference. Furthermore, semantic processing is used to deeply model traffic features, resulting in high model detection accuracy and the ability to accurately identify malicious traffic. This allows the model to adapt to complex and ever-changing network environments and traffic patterns, providing good detection capabilities for different types of malicious traffic and improving its robustness and generalization ability.

[0075] In one feasible implementation, the training process of the target malicious traffic detection model includes:

[0076] Step S21: Obtain the malicious traffic feature dataset and perform data preprocessing on the malicious traffic feature dataset to obtain the model training set and the model test set.

[0077] It should be noted that a malicious traffic feature dataset refers to a dataset that contains malicious DoH tunnel traffic samples and benign DoH traffic samples, with each sample accompanied by corresponding feature information. Its source is usually a publicly available network security dataset (such as the CIRA-CIC-DoHBrw2020 dataset) or a private dataset collected by simulating malicious DoH tunnel attack scenarios. The features in the dataset must cover key attributes that can describe traffic transmission behavior and interaction patterns.

[0078] It's important to further clarify that data preprocessing refers to operations such as data labeling, data cleaning, irrelevant feature removal, and data normalization on the malicious traffic feature dataset. The aim is to eliminate data noise, standardize feature formats, and improve data quality, providing reliable input for subsequent model training and testing, and preventing model training bias or decreased detection accuracy due to data issues. The model training set refers to a subset of the preprocessed malicious traffic feature dataset used to train the initial malicious traffic detection model. It contains a large number of labeled samples for the model to learn the feature differences between benign and malicious traffic. The model test set refers to a subset of the preprocessed malicious traffic feature dataset used to test model performance. This subset of samples does not participate in model training and is only used to verify the model's generalization ability on unseen data.

[0079] The core purpose of this step is to provide high-quality, structured data support for model training and testing. Data preprocessing ensures data validity, and dividing the training and testing sets creates a closed loop of "learning patterns through training and verifying results through testing," thus ensuring the stability of subsequent model training and the reliability of detection results.

[0080] Specifically, in one embodiment, a malicious traffic feature dataset is obtained, and the malicious traffic feature dataset is preprocessed to obtain a model training set and a model test set. The data preprocessing includes:

[0081] Data Labeling: Based on the public dataset CIRA-CIC-DoHBrw2020, it is labeled as benign traffic and malicious DoH tunnel traffic; Data Cleaning: The original dataset is cleaned, including removing duplicate data and abnormal traffic data containing null values; Irrelevant Feature Removal: Features irrelevant to the traffic classification task are removed, including traffic identifiers (IP address, port number) and environment-specific features (timestamp, flow duration); Data Normalization: The dataset is divided into training and test sets, such as randomly dividing the preprocessed data into model training and model test sets in a 7:3 or 8:2 ratio. During the partitioning process, it is necessary to ensure that the sample ratio of benign and malicious traffic in the training and test sets is consistent with that of the original dataset to avoid class imbalance problems affecting model training.

[0082] Among them, the maximum value of the training set is calculated. and minimum value Perform max-min normalization and set the normalization parameters and This is applied to the test set to ensure consistency in the dimensions of features, thus promoting model convergence. The formula for calculating the maximum and minimum normalization is:

[0083]

[0084] in, This represents the original data for the i-th feature. This represents the normalized data for the i-th feature. Let represent the minimum value of the i-th feature. This represents the maximum value of the i-th feature.

[0085] Step S22: Based on the model training set, train the initial malicious traffic detection model to obtain the undetermined malicious traffic detection model;

[0086] It should be noted that the initial malicious traffic detection model refers to a model that has not been trained and only has a basic network structure. It includes core modules such as a Temporal Convolutional Network (TCN), a forward-gated multi-head attention layer, a multi-scale semantic integration layer (ConvNeXt), an average pooling layer, and a fully connected layer. However, the parameters within these modules (such as convolutional kernel weights and attention weight matrices) are all randomly initialized values, and it does not yet possess the ability to detect malicious traffic. Model training refers to the iterative process of inputting the model's training set into the initial malicious traffic detection model, calculating the difference between the model's output and the true labels (loss value), and using optimization algorithms to update the model parameters in reverse. The goal is to allow the model to gradually learn the characteristics and patterns of benign and malicious traffic, continuously improving classification accuracy.

[0087] Furthermore, the pending malicious traffic detection model refers to a model whose parameters have been updated to meet preset iteration conditions (such as the number of training rounds reaching a threshold, the loss value converging stably, etc.) after training on the model training set, but whose performance has not yet been verified by the model test set. It has the preliminary ability to detect malicious DoH tunnel traffic, but the detection effect needs to be further evaluated.

[0088] Specifically, based on the mutual information value calculation method, the contribution value of each sample traffic feature in the model training set is evaluated, and based on the contribution value of each sample traffic feature, a first sample feature sequence is determined. Then, the first sample feature sequence is subjected to semantic enhancement processing to obtain a second sample feature sequence. The second sample feature sequence is then input into the initial malicious traffic detection model for model training to obtain the traffic classification result output by the initial malicious traffic detection model. Based on the traffic classification result, it is determined whether the initial malicious traffic detection model meets the preset iteration conditions to obtain the pending malicious traffic detection model.

[0089] Step S23: Perform model testing on the undetermined malicious traffic detection model based on the model test set and the test tag set corresponding to the model test set to obtain the target malicious traffic detection model.

[0090] It's important to note that the test label set refers to a set of labels that corresponds one-to-one with the model's test set. Each test sample has a unique true label ("benign" or "malicious") in the test label set. This label is used to compare the model's output test detection results to evaluate model performance. The target malicious traffic detection model refers to a model that has been validated through model testing, whose performance metrics meet preset thresholds (e.g., accuracy ≥98%, recall ≥97%, F1 score ≥97.5%), and can be used in real-world malicious DoH tunnel traffic detection scenarios, possessing stable and reliable detection capabilities. The core purpose of this step is to validate model performance through an independent test set, select the final model that meets application requirements, and avoid poor detection performance in real-world scenarios due to "overfitting the training set."

[0091] For details, please refer to steps S81-S83, which will not be elaborated here.

[0092] This embodiment allows the target malicious traffic detection model to be deployed in real-world network environments (such as enterprise gateways, network security audit systems, etc.) to perform malicious attribute detection on real-time collected traffic. In practical applications, the target malicious traffic detection model can quickly receive feature inputs from the traffic to be detected. Through internal temporal modeling, semantic capture, and multi-scale integration modules, it accurately outputs malicious traffic detection results, effectively identifying malicious tunnels hidden in encrypted DoH traffic. Especially in complex network scenarios with highly concealed malicious traffic and class imbalance, it can still maintain a high detection accuracy and robustness, reducing security risks such as sensitive data leakage and malicious command execution caused by missed malicious traffic detection.

[0093] In one feasible implementation, the step of training the initial malicious traffic detection model based on the model training set to obtain a pending malicious traffic detection model includes:

[0094] Step S31: According to the mutual information value calculation method, evaluate the contribution value of each sample traffic feature in the model training set, and determine the first sample feature sequence based on the contribution value of each sample traffic feature.

[0095] It's important to note that mutual information calculation is a mathematical method used to quantify the correlation between features and labels. Its core is to measure the degree of information sharing between features and labels by calculating their joint probability distribution and marginal probability distribution. A higher mutual information value indicates a greater contribution of the feature to label classification. Sample traffic features refer to the specific indicators describing traffic attributes contained in each traffic sample in the model training set, such as packet size, transmission interval, and the number of Application Data messages. The contribution value, obtained through the mutual information calculation method, characterizes the importance of sample traffic features in the task of "distinguishing between benign and malicious traffic." The contribution value directly reflects the discriminative power of the feature.

[0096] It should be further clarified that the first sample feature sequence refers to the feature set formed by selecting high-contribution features from all sample traffic features and sorting them according to their contribution values. It only contains features that play a core role in the classification task. The core purpose of this step is to remove redundant features, reduce the computational complexity of the model, accurately select key features that are highly relevant to traffic classification through mutual information values, avoid irrelevant features from interfering with model learning, and improve the interpretability of the model input, providing a high-quality feature foundation for subsequent semantic enhancement and temporal modeling.

[0097] For details, please refer to steps S41-S43, which will not be elaborated here.

[0098] Step S32: Perform semantic enhancement processing on the first sample feature sequence to obtain the second sample feature sequence;

[0099] It should be noted that semantic enhancement processing refers to the optimization of the first sample feature sequence to strengthen the semantic expression of malicious traffic and suppress environmental noise. This includes two core operations: "environmentally adaptive modulation" and "time-frequency joint masking." The aim is to improve the discriminative power of the features, making it easier for the model to capture abnormal patterns in malicious traffic. The second sample feature sequence refers to the final enhanced feature sequence obtained by linearly transforming and fusing the first and second enhanced feature sequences. The core purpose of this step is to enhance the semantics of malicious traffic through the collaborative efforts of two modules: the environmentally adaptive modulation module adapts to the actual traffic environment and suppresses noise, while the time-frequency joint masking module amplifies frequency domain anomalies and strengthens abnormal patterns. The fusion of these two modules makes the features more discriminative.

[0100] For details, please refer to steps S51-S53, which will not be elaborated here.

[0101] Step S33: Input the second sample feature sequence into the initial malicious traffic detection model for model training, and obtain the traffic classification result output by the initial malicious traffic detection model;

[0102] It should be noted that the traffic classification result refers to the result output by the fully connected layer, which is used to indicate traffic attributes and is usually presented in the form of a probability vector.

[0103] For details, please refer to steps S61-S64, which will not be elaborated here.

[0104] Step S34: Based on the traffic classification results, determine whether the initial malicious traffic detection model meets the preset iteration conditions, and obtain the pending malicious traffic detection model.

[0105] It's important to note that preset iteration conditions refer to the criteria used to determine whether model training should stop. These are typically based on model performance metrics or training process parameters and may include criteria such as "the number of training epochs reaches a preset threshold," "the training set loss value stabilizes and converges stably for multiple consecutive epochs (fluctuations are less than a preset range)," and "the training set accuracy reaches a preset target value." The aim is to ensure that the model learns sufficiently while avoiding overfitting. Model iterative training refers to the cyclical process of re-inputting data, calculating the loss, and updating parameters based on the model's training set when the preset iteration conditions are not met, gradually improving the model's classification accuracy. The core purpose of this step is to optimize model parameters through iterative training, allowing the model to gradually transition from "random prediction" to "accurate classification." Simultaneously, the preset iteration conditions control the training process, balancing model performance and training efficiency, and preventing underfitting due to insufficient training or overfitting due to overtraining.

[0106] For details, please refer to steps S71-S73, which will not be elaborated here.

[0107] This embodiment filters high-contribution features by mutual information values, removes redundant and low-value features, reduces input dimensions, and lowers model computational overhead. Simultaneously, it avoids redundant features interfering with model learning, effectively mitigating overfitting risks and improving model generalization ability. Semantic enhancement is applied to the first sample feature sequence (environment-adaptive modulation to suppress noise, and time-frequency joint masking to amplify frequency domain anomalies) to highlight the discriminative semantics of malicious DoH tunnel traffic, making it easier for the model to capture abnormal patterns, especially in imbalanced scenarios where malicious traffic is sparse, thus improving the recognition of malicious semantics. After the second sample feature sequence is input into the initial model, TCN learns long-term temporal dependencies, positively gated multi-head attention strengthens global semantic associations, and ConvNeXt integrates multi-scale semantics. Multi-module collaboration accurately models deep feature associations of traffic, providing support for high-quality classification results. Iteration conditions are determined based on traffic classification results to avoid underfitting or overfitting, ensuring model parameters are optimized to a stable state. Simultaneously, focusing on high-value features and enhanced semantics shortens the training cycle and improves training efficiency.

[0108] In one feasible implementation, the step of evaluating the contribution value of each sample traffic feature in the model training set according to the mutual information value calculation method, and determining the first sample feature sequence based on the contribution value of each sample traffic feature, includes:

[0109] Step S41: Calculate the contribution value corresponding to each sample traffic feature according to the mutual information value calculation method and the sample label value corresponding to each sample traffic feature.

[0110] It's important to note that the mutual information value in the mutual information calculation method is the contribution value, while the sample label value refers to the label used to identify the attributes of the sample traffic. In the malicious DoH tunnel traffic detection scenario, the sample label value only includes two categories—"benign DoH traffic" and "malicious DoH tunnel traffic"—which serve as the reference standard for judging whether the sample traffic features have the ability to "distinguish malicious traffic." The core purpose of this step is to accurately identify the sample traffic features that play a key role in traffic classification, establish the association between features and labels through mutual information values, avoid interference from irrelevant features in subsequent model training, and ensure that subsequent steps can focus on high-value features.

[0111] Specifically, the mutual information value calculation method is used to evaluate the contribution of each sample traffic feature to traffic classification, and the important feature subset is selected as the model input based on the ranking of mutual information values ​​(i.e. contribution values).

[0112] The mutual information value is calculated as follows:

[0113]

[0114] in, For mutual information value, Representative characteristics, Represents a label. Describes the joint probability distribution. and This represents the marginal probability distribution.

[0115] Step S42: Add the sample flow features whose contribution value is greater than the preset gain threshold to the initial sample feature sequence;

[0116] It should be noted that the preset gain threshold refers to the critical value used to filter high-contribution sample flow features. It needs to be set according to the feature distribution characteristics of the model training set, the classification task requirements, and the classification target. It should not be too high, which would cause key features to be removed, nor too low, which would cause redundant features to remain. It is the core parameter that determines the quality of the initial sample feature sequence. There are no restrictions here, and it can be set according to the actual situation.

[0117] It should be further clarified that the initial sample feature sequence refers to the temporary feature set formed after filtering features with contribution values ​​greater than a preset gain threshold from all sample traffic features. It only contains features with practical discriminative value for "benign / malicious DoH traffic classification" and forms the basis for subsequent feature ranking; it has not yet undergone ordered processing. The core purpose of this step is to remove redundant and low-value features, perform "preliminary screening" of sample traffic features through the preset gain threshold, reduce the computational overhead of subsequent semantic enhancement and model training, and prevent low-contribution features from interfering with the model's learning of malicious traffic semantics, ensuring that subsequent processing focuses on core features.

[0118] Specifically, in one embodiment, the preset gain threshold can be set using a "statistical sorting method": First, sort the contribution values ​​of all sample flow features from largest to smallest, calculate the cumulative gain of the contribution values ​​(e.g., the cumulative mutual information value of the top 20% of features accounts for 80% of the total cumulative value), and then set the minimum contribution value of the top 30% to 50% of features as the preset gain threshold. For example, after sorting all feature contribution values, take the minimum contribution value (0.35) of the top 40% of features as the threshold, and then add the sample flow features with contribution values ​​greater than the preset gain threshold to the initial sample feature sequence to ensure that the selected features can both cover the core discrimination information and effectively reduce the number of features.

[0119] Step S43: Sort the sample flow features in the initial sample feature sequence according to the contribution value to determine the first sample feature sequence.

[0120] It should be noted that sorting refers to the operation of arranging the features in the initial sample feature sequence in descending order of their contribution values. The purpose is to clarify the importance and priority of features, focusing first on features with high contribution values ​​to strengthen the expression of core semantics. The core objective of this step is to achieve "ordering" of features. By sorting by contribution value, the model can prioritize key features in subsequent processing, improving the targeting of semantic enhancement. For example, in environment adaptive modulation, higher learnable scaling factors can be assigned to features ranked higher; in time-frequency joint masking, time-frequency anomalies of features ranked higher can be amplified first, thereby further improving the discriminative power of malicious traffic semantics.

[0121] Specifically, in one possible implementation, the sorting operation can employ a "stable sorting algorithm" (such as merge sort) to ensure that sample flow features with the same contribution value can maintain their relative order in the initial sample feature sequence, avoiding disorder of feature association due to sorting; after sorting, the first sample feature sequence can be verified to ensure that the contribution values ​​of all features are strictly decreasing and there are no duplicate or missing features.

[0122] This embodiment uses mutual information value calculation to filter features highly correlated with "benign / malicious DoH traffic classification", eliminates irrelevant and low-contribution features, avoids redundant information interfering with the model's learning of the semantics of malicious traffic, provides key traffic features with high information content for subsequent traffic modeling, has strong input interpretability, reduces model complexity, and alleviates the risk of model overfitting caused by redundant features.

[0123] In one feasible implementation, the step of performing semantic enhancement processing on the first sample feature sequence to obtain the second sample feature sequence includes:

[0124] Step S51: Based on the scaling factor and the position transformation factor, perform environment adaptive modulation processing on the first sample feature sequence to obtain the first enhanced feature sequence;

[0125] It should be noted that step S51 is used to implement environment adaptive modulation, which adaptively adjusts according to the actual traffic input during model training. This facilitates the model learning discriminative traffic semantics and enhances malicious semantic expression in class-imbalanced environments where malicious traffic is sparse. Scaling factor This refers to learnable parameters introduced in environment-adaptive modulation. Their function is to scale the first sample feature sequence element-wise, enhancing the signal strength of key features. It will adaptively adjust based on actual traffic input during model training. (Position transformation factor) This refers to environmental adaptive modulation and The learnable parameters are used to apply a bias to the scaled feature sequence, further optimize the feature distribution, and suppress the interference of environmental noise (such as random fluctuations in benign traffic) on semantic expression.

[0126] Furthermore, the first enhanced feature sequence refers to the feature sequence obtained after the first sample feature sequence is adaptively modulated by the environment, which has a clearer semantic expression and stronger noise resistance.

[0127] Specifically, a learnable scaling factor is introduced. Position transformation factor ,in , The model is adaptively generated based on actual traffic input during training. This is achieved by analyzing the feature sequence of the first input sample. Element-wise scaling and bias are applied to enhance the overall flow semantics and suppress environmental noise interference. The calculation formula is as follows:

[0128]

[0129] in, This refers to the first enhanced feature sequence. This indicates element-wise multiplication.

[0130] Step S52: Perform mean dimensionality reduction, fast Fourier transform, time-frequency joint modulation, and channel dimension splicing on the first sample feature sequence to obtain the second enhanced feature sequence;

[0131] It should be noted that step S52 is used to implement the time-frequency joint mask. Since the abnormal characteristics of malicious traffic are not only reflected in the time domain, but also exhibit abnormal patterns in the frequency domain, the abnormal segments in the frequency domain are amplified to enhance the model's attention to the semantics of abnormal traffic and further enhance the detection capability of malicious traffic.

[0132] Further explanation is needed: mean dimensionality reduction refers to taking the mean of the first sample feature sequence along the channel dimension, compressing multi-channel features into a single feature sequence; Fast Fourier Transform (FFT) refers to performing a frequency domain transformation on the short-time segment after mean dimensionality reduction, which can decompose the flow characteristics in the time domain into multiple frequency domain components; Time-frequency joint modulation refers to combining frequency domain energy filtering and time domain activation, selecting high-energy time-frequency blocks and generating time domain masks through a Top-k strategy to amplify anomalous features; Channel dimension concatenation refers to merging the enhanced sequence after time-frequency joint modulation with the first sample feature sequence along the channel dimension. The second enhanced feature sequence refers to the feature sequence obtained after the first sample feature sequence undergoes mean dimensionality reduction, FFT, time-frequency joint modulation, and channel dimension concatenation, which integrates anomalous information from both the time and frequency domains.

[0133] Specifically, for the first sample feature sequence Perform mean dimensionality reduction along the channel dimension, and use a preset window length. The overlapping short-time segments corresponding to the dimensionality-reduced feature sequences constructed with the step size step.

[0134] Furthermore, a Fast Fourier Transform is performed on each short time segment to obtain the frequency domain components. The range of the frequency domain index k is: Further calculations were performed on the corresponding energy spectrum:

[0135]

[0136] in, Indicates the signal at the frequency index The amount of energy at that location (energy value). Represents frequency domain components The real part, Represents frequency domain components The imaginary part;

[0137] A Top-k strategy is used to select several time-frequency blocks with the highest energy values ​​on the energy spectrum matrix, and the corresponding binary mask matrix is ​​generated:

[0138]

[0139] in, This represents the mask value corresponding to the f-th frequency domain component in the i-th time window. This represents the set of the k time-frequency indices with the highest energy values ​​in the energy spectrum matrix, where k is a pre-set threshold.

[0140] Furthermore, the corresponding window intervals are activated in the time dimension according to the binary mask matrix to form the time domain mask at the t-th time step. To increase attention to anomalous segments in the time domain;

[0141]

[0142] This allows the time-domain mask to be applied to the original first sample feature sequence, and through a learnable gain factor... After scaling, the enhanced sequence after time-frequency joint modulation is obtained:

[0143]

[0144] in, It is an enhanced sequence after time-frequency joint modulation. For time domain mask, This is the feature sequence of the first sample.

[0145] The modulated enhanced sequence is concatenated with the original first sample feature sequence along the channel dimension to obtain the second enhanced feature sequence. And use it as input for the subsequent time series modeling module:

[0146]

[0147] Step S53: Fuse the first enhanced feature sequence and the second enhanced feature sequence to obtain the second sample feature sequence.

[0148] Specifically, by combining the two semantic enhancement modules in the first two steps, malicious semantic expressions can be effectively amplified based on the actual traffic environment, suppressing the negative impact of traffic noise on the model. The semantically enhanced output data integrates the contents of the two modules, and its calculation method is as follows:

[0149]

[0150] in, It represents a linear transformation.

[0151] This embodiment modulates the first sample feature sequence using learnable scaling and position transformation factors, adaptively amplifying key features of malicious traffic and suppressing random noise in benign traffic, making the semantic expression of the first enhanced feature sequence clearer. Performing operations such as mean dimensionality reduction and fast Fourier transform on the first sample feature sequence can uncover abnormal patterns that are difficult to detect in the time domain (such as high-frequency components corresponding to periodic data transmission in malicious DoH tunnels). Time-frequency joint modulation further amplifies these anomalies, while channel-dimensional splicing preserves the original features and adds frequency domain information, giving the second enhanced feature sequence a dual-dimensional discrimination capability of "time + frequency". Finally, the first enhanced feature sequence (stronger in noise resistance and optimized overall semantics) and the second enhanced feature sequence (stronger in capturing frequency domain anomalies) are fused. By unifying the dimensions through linear transformation, the advantages of the two enhancement methods are complemented, making the second sample feature sequence both anti-interference and able to accurately locate malicious patterns, thus solving the problem of semantic ambiguity in malicious traffic. The second sample feature sequence obtained after fusion has the same dimension as the first sample feature sequence, which can be directly input into the semantic processing time series model (TCN, forward gating multi-head attention, etc.) to avoid the dimension mismatch problem. At the same time, its rich semantic information can improve the model's learning effect on long-range dependencies and global semantics. The dual enhancement fusion enables the second sample feature sequence to simultaneously have the ability to resist environmental noise and capture multi-domain anomalies, so that the subsequent model can still stably identify malicious traffic in complex scenarios where malicious traffic is highly concealed (such as DoH encryption, HTTP / 2 multiplexing) or class imbalance.

[0152] In one feasible implementation, the initial malicious traffic detection model includes a temporal convolutional network, a forward-gated multi-head attention layer, a multi-scale semantic integration layer, an average pooling layer, and a fully connected layer; the step of inputting the second sample feature sequence into the initial malicious traffic detection model for model training to obtain the traffic classification result output by the initial malicious traffic detection model includes:

[0153] Step S61: Input the second sample feature sequence into the residual structure of the temporal convolutional network to perform dilated causal convolution, weight normalization, function activation and random masking to obtain the first traffic processing result;

[0154] It's important to note that Temporal Convolutional Networks (TCNs) are the core modules responsible for capturing the long-term temporal dependencies of DoH (DoH) traffic. Their core design is "dilated causal convolution + residual structure," aiming to expand the model's receptive field while ensuring temporal causality (output depends only on current and historical inputs) to learn the transmission patterns of traffic over long time scales (such as the periodic data leakage patterns of malicious DoH tunnels). The residual structure is a core component of TCN, consisting of a two-layer stacked structure of "dilated causal convolution → weight normalization → function activation → random masking." Residual connections add the component input to the two-layer output, mitigating the gradient vanishing problem in deep networks and ensuring smooth transmission of temporal traffic information across layers.

[0155] Furthermore, the first traffic processing result refers to the feature sequence obtained after the second sample feature sequence has been fully processed by the TCN residual structure. Its shape is consistent with the second sample feature sequence (e.g., [B,L], where B = batch size and L = sequence length), but it has incorporated the long-range temporal dependency information of DoH traffic. The temporal abnormal patterns of malicious traffic (e.g., periodic data transmission) are initially highlighted, which is the basic input for subsequent contextual semantic capture.

[0156] Specifically, to alleviate the gradient vanishing problem caused by increasing network depth, TCN introduces a residual structure, whose components include dilated causal convolution, weight normalization, ReLU activation, and Dropout.

[0157] TCN employs dilated causal convolution with high parallelism to capture multi-scale temporal traffic patterns, and uses a residual structure to ensure the cross-layer propagation of traffic information, thereby fully learning long-range traffic dependencies. The causal convolution is used to maintain temporal causality by padding the left side of the input second sample feature sequence with zero elements, making the output depend only on the current and previous inputs to avoid future information leakage. For the second sample feature sequence x, with a convolution kernel of size K, the output at time t... The calculation method is as follows:

[0158]

[0159] in, This represents the input sequence at time ti. represents the kernel weight, and i represents the kernel index.

[0160] Subsequently, TCN introduced dilated convolution to expand the receptive field, the mathematical expression of which is:

[0161]

[0162] in, Let represent the value of the output sequence at time step s, f represent the convolution kernel of length k, i represent the position of the element in the convolution kernel, and d represent the dilation factor. The dilation factor increases exponentially with the number of network layers, thus achieving a larger receptive field with a constant total number of parameters. That is, by combining the dilation factor with causality constraints, the receptive field can be expanded without increasing the number of parameters, thereby enabling the modeling of long-range temporal dependencies.

[0163] Weight normalization: The weight parameters of the convolution kernel are standardized to maintain numerical stability during training and accelerate model convergence.

[0164] ReLU activation function: Introduces a non-linear mapping mechanism after convolution to enhance feature representation and improve the network's fitting performance.

[0165] Dropout layer: By randomly blocking the output of some neurons during training, the neural network's dependence on specific features is reduced, thereby effectively suppressing overfitting.

[0166] like Figure 2 As shown, in each residual structure, the upper layer input is sequentially subjected to dilated causal convolution, weight normalization, ReLU activation, and Dropout. The structure is repeated twice, and the input of the block is added to the output of the above two-layer stack through residual connection. ReLU activation is used to obtain the final output result of the layer, thereby expanding the receptive field while achieving stable learning of traffic temporal patterns.

[0167] Step S62: The first traffic processing result is captured by the contextual semantics through the positive gated multi-head attention layer to generate the second traffic processing result;

[0168] Specifically, positive gating multi-head attention is used to suppress the model from aggregating negatively related contextual information, thereby enhancing attention to contexts positively related to malicious semantics, and the multi-head attention mechanism is used to strengthen the model's modeling of global traffic dependencies.

[0169] For reference Figure 3In the multi-head self-attention module, the first input flow processing result, i.e., the feature matrix Z, is processed through three sets of learnable linear mappings to obtain the query vector Q, the key vector K, and the value vector V. The specific calculation method is as follows:

[0170]

[0171] in, The weight matrix is ​​a learnable matrix. This is the corresponding bias term.

[0172] Subsequently, Q, K, and V are divided into H sub-query vectors, sub-key vectors, and sub-value vectors, respectively, to enable parallel computation of attention weights in each attention subspace. Within each attention subspace, the values ​​of each branch are non-negative, and a ReLU activation function is introduced after its linear mapping output for non-linear transformation. The calculation method for the non-negative constrained sub-query and sub-key vectors is as follows:

[0173]

[0174]

[0175] Where h represents the attention head index.

[0176] By applying the aforementioned non-negativity constraint, the similarity values ​​corresponding to negatively related contexts can be compressed to smaller values ​​during the attention weight calculation stage, thereby effectively reducing their interference with semantic representation. The attention weight calculation formula is as follows:

[0177]

[0178] in, The vector dimension of a single attention head. This represents the subquery vector in the h-th attention head. and sub-key vector The similarity.

[0179] By combining attention weights with sub-value vectors Multiply to obtain a single attention head Output:

[0180] =

[0181] Finally, the outputs of each attention head are concatenated to obtain the output of the positively gated multi-head attention, which is the second flow processing result:

[0182]

[0183] in, This is a learnable weight matrix.

[0184] Therefore, compared to traditional attention mechanisms, positively gated multi-head attention can further highlight the matching relationship between malicious semantics and its positively related context, avoiding the masking of malicious semantic features by a large number of benign semantics. At the same time, by capturing semantic information from each subspace through multiple attention heads, it improves the learning of global traffic dependencies.

[0185] Step S63: Deeply integrate and multi-scale model the second traffic processing result through a multi-scale semantic integration layer to obtain the third traffic processing result;

[0186] Specifically, ConvNeXt is introduced to deeply integrate and multi-scale model traffic semantic information, thereby improving semantic representation capabilities. The processing results of the input second traffic are then analyzed. ,in For batch size, For sequence length, Given the number of channels, firstly, depthwise separable convolution is used to perform channel-by-channel convolution on the input. For the j-th channel, the convolution output at time step t is:

[0187]

[0188] Where K represents the kernel size and d represents the dilation rate. represents the convolution kernel parameters in the j-th channel, and t represents the time step;

[0189] Then, for each time step t, normalization is performed along the channel dimension:

[0190]

[0191] in, , , and These are learnable parameters.

[0192] Then, a pointwise convolutional transformation is performed, which consists of two fully connected layers. The first layer expands the number of channels to enhance the nonlinear expressive power of the model, and the second layer restores the channels to achieve information remapping. For all channel features at time step t... The calculation method for pointwise convolution transformation is as follows:

[0193]

[0194] in, , , , These are learnable parameters;

[0195] Subsequently, channel scaling is performed, and a closed-loop structure is formed through residual connections to obtain the output:

[0196]

[0197] in, The third flow processing result output by ConvNext. For the output of positively gated multi-head attention, This is a learnable scaling factor.

[0198] To improve training stability and alleviate the gradient vanishing problem, the output of ConvNext is combined with the output of positively gated multi-head attention, thereby fully integrating the results of multi-scale semantic information integration and global dependency modeling results.

[0199] Step S64: Map the third traffic processing result through the average pooling layer and the fully connected layer to output the traffic classification result.

[0200] It's important to note that the average pooling layer refers to the module that performs global average pooling on the "sequence length dimension (L)" of the third-order traffic processing result. Its core function is to compress redundant information in the temporal dimension and extract key semantic features globally. Although the third-order traffic processing result has integrated multi-scale semantics, it still contains local features from 128 time steps. Average pooling transforms the sequence features of [B,L,C] into a global feature vector of [B,C] by calculating the mean of each channel across all time steps. This avoids local noise (such as benign traffic fluctuations at individual time steps) interfering with the final classification and significantly reduces the computational overhead of subsequent fully connected layers. The fully connected layer refers to the module that maps the global feature vector to the "traffic category dimension." DoH traffic detection is a binary classification task (benign / malicious), and its core function is to transform high-dimensional semantic features into interpretable classification results.

[0201] Specifically, the first step is global average pooling: the mean of the third traffic processing result ([B,L,C]) is calculated on the sequence length dimension (L), that is, the output value of each channel c is the average of the feature values ​​of all time steps of that channel, and finally the global feature vector of [B,C] is obtained. This vector condenses the multi-scale semantic information of each DoH traffic sample on all channels. The core features of malicious traffic (such as "long-range temporal anomaly + global semantic association + multi-scale integration anomaly") are preserved, and local noise is filtered out.

[0202] The second step, fully connected layer mapping and classification output: The global feature vector [B, C] is input into the fully connected layer, and linear mapping is performed through a learnable weight matrix and bias term to obtain the original predicted value. During the training phase, the original predicted value can be further transformed into a probability distribution using the Softmax function. During the inference phase, the category with the highest probability can be directly selected as the final judgment result. The final traffic classification result is a probability vector [B, 2] during the training phase (used to calculate cross-entropy loss to update model parameters), and a category label (or corresponding probability value) of "benign" or "malicious" during the inference phase. For the complete process, please refer to [link to documentation]. Figure 4 .

[0203] This embodiment combines the residual structure of a Temporal Convolutional Network (TCN) with dilated causal convolution to expand the receptive field without increasing the number of parameters, accurately capturing long-range temporal patterns of DoH traffic (such as the periodic data transmission intervals of malicious tunnels). Weight normalization, ReLU activation, and Dropout (random masking) ensure training stability and suppress overfitting, providing high-quality temporal features for subsequent semantic processing. The positively gated multi-head attention layer uses ReLU non-negative constraints to filter contexts positively correlated with malicious semantics and suppress negatively correlated interference (such as redundant information in benign traffic). The parallel modeling of global semantic dependencies by multiple attention heads allows the second traffic processing results to highlight the key semantic associations of malicious DoH tunnels, solving the problem of malicious semantics being masked by benign context. The multi-scale semantic integration layer (ConvNeXt) uses depthwise separable convolution and pointwise convolution (dilated...) Operations such as +restore channel) integrate traffic semantics at different scales (such as short-term burst anomalies and long-term transmission patterns). Residual connections ensure information transmission across layers, allowing the third-party traffic processing results to fully cover the multi-dimensional features of malicious traffic and improve the model's adaptability to complex patterns. The average pooling layer compresses the sequence dimension of the third-party traffic processing results, extracts global key features, and avoids local noise interference. The fully connected layer maps global features to the "benign / malicious" category dimension, outputting clear traffic classification results. From TCN temporal modeling and attention semantic focusing to ConvNeXt multi-scale integration, pooling, and fully connected classification, each module works together to cover the temporal, semantic, and multi-scale features of traffic. Furthermore, normalization operations (weight normalization and Dropout) improve model stability, maintaining high robustness in complex scenarios such as DoH encryption and class imbalance.

[0204] In one feasible implementation, the step of determining whether the initial malicious traffic detection model meets preset iteration conditions based on the traffic classification result to obtain the pending malicious traffic detection model includes:

[0205] Step S71: Based on the traffic classification results, determine whether the initial malicious traffic detection model meets the preset iteration conditions;

[0206] Specifically, in one embodiment, the preset iteration conditions typically include three core metrics, which must be met simultaneously: The first is the training rounds metric, i.e., the total number of training rounds reaches a preset threshold (e.g., 100 rounds), ensuring that the model has enough opportunities to learn the traffic characteristics and patterns in the training set; the second is the loss value metric, i.e., the cross-entropy loss value of the model on the training set fluctuates less than a preset range (e.g., 0.005) for multiple consecutive rounds (e.g., 5 rounds), indicating that the model parameters have stabilized and further training is unlikely to reduce the loss; the third is the training set performance metric, i.e., the model's accuracy, recall, and F1 score on the training set reach preset target values ​​(e.g., accuracy ≥ 99%, recall ≥ 98.5%, F1 score ≥ 98.8%), ensuring that the model has the ability to accurately classify the traffic in the training set.

[0207] During the judgment process, the system first needs to calculate the loss value, accuracy, recall, F1 score and other indicators for the current training round based on the traffic classification results and the true labels of the samples (benign / malicious). Then, these indicators are compared with the thresholds of the preset iteration conditions: if all indicators meet the threshold requirements, the initial malicious traffic detection model is judged to meet the preset iteration conditions; if any indicator is not met (such as the loss value fluctuation is still greater than 0.005, or the accuracy is not 99%), it is judged not to meet the conditions.

[0208] Step S72: If not, then based on the model training set, perform iterative training on the initial malicious traffic detection model until the initial malicious traffic detection model meets the preset iteration conditions.

[0209] Specifically, the model iterative training process strictly follows the logic of "gradient descent optimization," and is executed in four cyclical steps: Step 1, Batch Data Input: Extract second sample feature sequences (features after semantic enhancement) and their corresponding true labels (benign = 0, malicious = 1) from the model training set in batches (e.g., batch size 64), and input them into the initial malicious traffic detection model; Step 2, Model Forward Propagation: The model captures long-range temporal dependencies through TCN, strengthens global semantic associations through a forward-gated multi-head attention layer, and integrates multi-scale semantics through ConvNeXt, ultimately outputting the traffic classification result (probability vector). This process is consistent with steps S61-S64; Step 3, Loss Calculation and Backpropagation: Using the cross-entropy loss function, calculate the loss value between the traffic classification result and the true label (the larger the loss value, the greater the model prediction bias). Then, backpropagate using the Adam optimizer based on the loss value to update all learnable parameters of the model (such as the convolutional kernel weights of TCN, the linear mapping matrix of the attention layer, and ConvNeXt). (e.g., pointwise convolution parameters, etc.) During the update process, the learning rate can be dynamically adjusted according to the strategy (e.g., decaying to 50% of the original every 10 rounds); the fourth step is indicator verification and cycle determination: after each round of training iteration, calculate the loss value, accuracy and other indicators of the current round and compare them with the preset iteration conditions: if they are still not met, continue to extract the next batch of data and repeat the above process; if they are met, stop the iteration.

[0210] Step S73: If yes, then the initial malicious traffic detection model is used as the pending malicious traffic detection model.

[0211] Specifically, this embodiment uses the CIRA-CIC-DoHBrw2020 public dataset to present the actual performance of the proposed model compared with five existing works. Table 1 shows the traffic detection results on the original dataset, and Table 2 shows the traffic detection results under an imbalanced traffic environment (the ratio of benign traffic to malicious traffic is 9:1). As can be seen from Tables 1 and 2, the method proposed in this invention can achieve the optimal accuracy in detecting malicious traffic and better detection robustness with fewer feature inputs.

[0212] Table 1

[0213]

[0214] Table 2

[0215]

[0216] In one feasible implementation, the step of performing model testing on the undetermined malicious traffic detection model based on the model test set and the test tag set corresponding to the model test set to obtain the target malicious traffic detection model includes:

[0217] Step S81: For any test traffic feature in the model test set, input the test traffic feature into the undetermined malicious traffic detection model for detection, and obtain the test detection result output by the undetermined malicious traffic detection model to obtain the test detection result set corresponding to the model test set;

[0218] It should be noted that the test traffic features refer to the feature sequence corresponding to each traffic sample in the model test set. The shape is consistent with the feature sequence of the second sample during the training process (e.g., [B,L,C], where B is the test batch size, L is the sequence length, and C is the number of channels). This ensures that the feature format input to the model is consistent and avoids the test results being affected by differences in preprocessing.

[0219] Specifically, the detection process for any test traffic feature is exactly the same as the process of "second sample feature sequence → traffic classification result" during training, and will not be elaborated here.

[0220] Step S82: Compare and analyze the test detection result set with the test label set to obtain model test analysis data;

[0221] It should be noted that the model testing analysis data includes four categories of key performance indicators (KPIs). The first category is accuracy, which reflects the overall classification accuracy of the model for all samples. The second category is precision, which reflects the proportion of samples that the model judges as malicious that are actually malicious, avoiding misclassification of benign traffic as malicious (false positives). The third category is recall, which reflects the proportion of malicious samples that the model can identify, avoiding omissions of malicious traffic (false negatives). The fourth category is F1 score, which comprehensively measures precision and recall to avoid bias from a single indicator.

[0222] Specifically, in the calculation process, firstly, the category label is determined based on the probability vector of the test detection result set (e.g., 1 if the probability is ≥0.5, otherwise 0); then, a confusion matrix is ​​constructed, and the number of true positives (predicted 1, true 1), true negatives (predicted 0, true 0), false positives (predicted 1, true 0), and false negatives (predicted 0, true 1) are counted; finally, the four categories of indicators are substituted into the formula to calculate the model test analysis data, so as to quantify the generalization ability of the model to be determined, and judge whether the model meets the actual application requirements through multi-dimensional indicators, so as to avoid ignoring the risk of false positives and false negatives due to a single indicator (such as only focusing on accuracy).

[0223] Step S83: Compare the model test analysis data with the preset threshold to obtain the target malicious traffic detection model.

[0224] It should be noted that the preset threshold refers to the performance standard set based on the goal of "high accuracy and robustness in detecting malicious traffic". Multiple indicators must be met to achieve the target, so as to avoid ignoring the risks in actual application (such as missed detection leading to malicious traffic not being blocked) due to the achievement of a single indicator.

[0225] Specifically, the accuracy, precision, recall, F1 score, false negative rate, and false positive rate in the model test analysis data are compared with the preset thresholds. Only when all indicators meet the threshold requirements is the pending malicious traffic detection model determined to have passed the test and can be identified as the target malicious traffic detection model. If any indicator fails to meet the threshold (e.g., recall rate 97% < 97.5%), the test is deemed to have failed, and the process must return to step S72 to adjust the training strategy (e.g., increase the number of training rounds, optimize the learning rate, adjust the preset gain threshold for feature selection), retrain the pending model, and then execute steps S81-S83 again until all indicators meet the thresholds.

[0226] This embodiment involves inputting any test traffic feature from the model test set into the undetermined malicious traffic detection model for detection, obtaining the test detection result output by the undetermined malicious traffic detection model, and thus obtaining the test detection result set corresponding to the model test set. The test detection result set is then compared and analyzed with the test label set to obtain model test analysis data. This model test analysis data is then compared with a preset threshold to obtain the target malicious traffic detection model. Furthermore, the model test set consists of independent data that was not used in training. By verifying the performance of the undetermined model, it can be determined whether the model only fits the training set (overfitting), ensuring that the target model can accurately detect unknown DoH traffic in the real network.

[0227] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0228] This application also provides a malicious DoH tunnel traffic detection device; please refer to [link / reference]. Figure 5 The malicious DoH tunnel traffic detection device includes:

[0229] The acquisition module 91 is used to acquire the traffic to be detected and extract several traffic features of the traffic to be detected;

[0230] Output module 92 is used to input each of the traffic features to be detected into the target malicious traffic detection model for detection, and obtain the malicious traffic detection result output by the target malicious traffic detection model, wherein the target malicious traffic detection model is trained from a malicious traffic feature dataset that has undergone important feature screening, semantic enhancement and semantic processing.

[0231] The malicious DoH tunnel traffic detection device provided in this application, employing the malicious DoH tunnel traffic detection method in the above embodiments, can solve the technical problems in the background art. Compared with the prior art, the beneficial effects of the malicious DoH tunnel traffic detection device provided in this application are the same as the beneficial effects of the malicious DoH tunnel traffic detection method provided in the above embodiments, and other technical features in the malicious DoH tunnel traffic detection device are the same as the features disclosed in the methods of the above embodiments, and will not be repeated here.

[0232] This application provides a malicious DoH tunnel traffic detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the malicious DoH tunnel traffic detection method in the above embodiment 1.

[0233] The following is for reference. Figure 6 This document illustrates a structural diagram of a malicious DoH tunnel traffic detection device suitable for implementing embodiments of this application. The malicious DoH tunnel traffic detection device in this application embodiment may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The malicious DoH tunnel traffic detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0234] like Figure 6As shown, a malicious DoH tunnel traffic detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the malicious DoH tunnel traffic detection device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the malicious DoH tunnel traffic detection device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows malicious DoH tunnel traffic detection devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0235] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0236] The malicious DoH tunnel traffic detection device provided in this application, employing the malicious DoH tunnel traffic detection method in the above embodiments, can solve the technical problems in the background art. Compared with the prior art, the beneficial effects of the malicious DoH tunnel traffic detection device provided in this application are the same as the beneficial effects of the malicious DoH tunnel traffic detection method provided in the above embodiments, and other technical features in this malicious DoH tunnel traffic detection device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0237] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0238] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0239] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the malicious DoH tunnel traffic detection method in the above embodiments.

[0240] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0241] The aforementioned computer-readable storage medium may be included in a malicious DoH tunnel traffic detection device; or it may exist independently and not be assembled into a malicious DoH tunnel traffic detection device.

[0242] The aforementioned computer-readable storage medium carries one or more programs that, when executed by a malicious DoH tunnel traffic detection device, cause the malicious DoH tunnel traffic detection device to:

[0243] Obtain the traffic to be detected, and extract several traffic features of the traffic to be detected;

[0244] Each of the traffic features to be detected is input into the target malicious traffic detection model for detection, and the malicious traffic detection result output by the target malicious traffic detection model is obtained. The target malicious traffic detection model is trained from a malicious traffic feature dataset that has undergone important feature screening, semantic enhancement and semantic processing.

[0245] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0246] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0247] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0248] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described malicious DoH tunnel traffic detection method, thereby solving the technical problems in the background art. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the malicious DoH tunnel traffic detection method provided in the above embodiments, and will not be repeated here.

[0249] This application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the malicious DoH tunnel traffic detection method described above.

[0250] The computer program product provided in this application can solve the technical problems in the background art. Compared with the prior art, the beneficial effects of the computer program product provided in the embodiments of this application are the same as the beneficial effects of the malicious DoH tunnel traffic detection method provided in the above embodiments, and will not be repeated here.

[0251] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for detecting malicious DoH tunnel traffic, characterized in that, include: Obtain the traffic to be detected, and extract several traffic features of the traffic to be detected; Each of the traffic features to be detected is input into the target malicious traffic detection model for detection, and the malicious traffic detection result output by the target malicious traffic detection model is obtained. The target malicious traffic detection model is trained from a malicious traffic feature dataset that has undergone important feature filtering, semantic enhancement, and semantic processing. Specifically, the malicious traffic feature dataset is obtained and preprocessed to obtain a model training set and a model test set. Based on the model training set, an initial malicious traffic detection model is trained to obtain a pending malicious traffic detection model. Based on the model test set and the corresponding test label set, the pending malicious traffic detection model is tested to obtain the target malicious traffic detection model. According to the mutual information value calculation method, the contribution value of each sample traffic feature in the model training set is evaluated, and the first sample feature sequence is determined based on the contribution value of each sample traffic feature. The first sample feature sequence is semantically enhanced to obtain the second sample feature sequence; The second sample feature sequence is input into an initial malicious traffic detection model for model training to obtain the traffic classification result output by the initial malicious traffic detection model. The initial malicious traffic detection model includes a temporal convolutional network, a forward-gated multi-head attention layer, a multi-scale semantic integration layer, an average pooling layer, and a fully connected layer. The second sample feature sequence is input into the residual structure of the temporal convolutional network for dilated causal convolution, weight normalization, function activation, and random masking to obtain a first traffic processing result. The first traffic processing result is then subjected to contextual semantic capture through the forward-gated multi-head attention layer to generate a second traffic processing result. The second traffic processing result is then deeply integrated and multi-scale modeled through the multi-scale semantic integration layer to obtain a third traffic processing result. The third traffic processing result is mapped through the average pooling layer and the fully connected layer to output the traffic classification result. Based on the traffic classification results, it is determined whether the initial malicious traffic detection model meets the preset iteration conditions, and the pending malicious traffic detection model is obtained.

2. The malicious DoH tunnel traffic detection method as described in claim 1, characterized in that, The step of evaluating the contribution value of each sample traffic feature in the model training set according to the mutual information value calculation method, and determining the first sample feature sequence based on the contribution value of each sample traffic feature, includes: Based on the mutual information value calculation method and the sample label value corresponding to each sample traffic feature, the contribution value corresponding to each sample traffic feature is calculated. Add the sample flow features whose contribution value is greater than the preset gain threshold to the initial sample feature sequence; Based on the contribution value, the sample flow features in the initial sample feature sequence are sorted to determine the first sample feature sequence.

3. The malicious DoH tunnel traffic detection method as described in claim 1, characterized in that, The step of performing semantic enhancement processing on the first sample feature sequence to obtain the second sample feature sequence includes: Based on the scaling factor and the position transformation factor, the first sample feature sequence is subjected to environment-adaptive modulation processing to obtain the first enhanced feature sequence. The first sample feature sequence is subjected to mean dimensionality reduction, fast Fourier transform, time-frequency joint modulation, and channel dimension concatenation to obtain the second enhanced feature sequence. The first enhanced feature sequence and the second enhanced feature sequence are fused to obtain the second sample feature sequence.

4. The malicious DoH tunnel traffic detection method as described in claim 1, characterized in that, The step of determining whether the initial malicious traffic detection model meets the preset iteration conditions based on the traffic classification results, and obtaining the pending malicious traffic detection model, includes: Based on the traffic classification results, determine whether the initial malicious traffic detection model meets the preset iteration conditions; If not, then based on the model training set, the initial malicious traffic detection model is iteratively trained until the initial malicious traffic detection model meets the preset iteration conditions; If so, the initial malicious traffic detection model will be used as the pending malicious traffic detection model.

5. The malicious DoH tunnel traffic detection method as described in claim 1, characterized in that, The step of performing model testing on the undetermined malicious traffic detection model based on the model test set and the corresponding test tag set to obtain the target malicious traffic detection model includes: For any test traffic feature in the model test set, the test traffic feature is input into the undetermined malicious traffic detection model for detection, and the test detection result output by the undetermined malicious traffic detection model is obtained, so as to obtain the test detection result set corresponding to the model test set; The test detection result set is compared and analyzed with the test label set to obtain model test analysis data; The target malicious traffic detection model is obtained by comparing the model test analysis data with the preset compliance threshold.

6. A malicious DoH tunnel traffic detection device, characterized in that, The malicious DoH tunnel traffic detection device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the malicious DoH tunnel traffic detection method as described in any one of claims 1 to 5.

7. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the malicious DoH tunnel traffic detection method as described in any one of claims 1 to 5.

Images