Identification method and device of instant messaging application and readable storage medium

Abstract

The invention provides an instant messaging application identification method and device and a readable storage medium, and the method comprises the steps: carrying out the feature extraction of an encrypted data stream of a to-be-identified application, and obtaining the encryption load bytes of a data packet in the encrypted data stream and the multimodal feature data in a plaintext form; extracting each piece of statistical feature data in the multi-modal feature data, and constructing a fusion feature matrix based on each piece of statistical feature data; extracting each flow-level feature in the multi-modal feature data, and generating a semantic text sequence based on each flow-level feature and the encrypted load byte; and inputting the fusion feature matrix and the semantic text sequence into a pre-trained application type recognition model to obtain an application type recognition result of the to-be-recognized application. The instant messaging application can be accurately and reliably identified based on the encrypted data stream.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus and readable storage medium for identifying instant messaging applications. Background Technology

[0002] Instant messaging (IM) applications play a crucial role in modern internet communication, providing users with a convenient way to exchange information in real time. With increasing awareness of cybersecurity and a greater emphasis on user privacy, most mainstream IM applications widely employ encrypted communication protocols to protect the security of user data transmission, such as TLS (Transport Layer Security) or SSL (Secure Sockets Layer). These encryption measures effectively prevent malicious third parties from stealing or tampering with communication content during transmission.

[0003] In information security-related fields such as network traffic management, security monitoring, and content auditing, accurately identifying IM applications within network traffic is crucial. This is of great significance for ensuring compliance, implementing security strategies, managing network resources, and preventing potential threats such as malware propagation and sensitive information leaks.

[0004] Therefore, how to accurately classify and identify instant messaging applications and non-instant messaging applications has become a problem that needs to be solved. Summary of the Invention

[0005] The technical problem to be solved by this application is to address the above-mentioned shortcomings of the prior art by providing a method, apparatus and readable storage medium for identifying instant messaging applications, so as to solve the problems existing in the prior art.

[0006] Firstly, this application provides a method for identifying instant messaging applications, the method comprising:

[0007] S1. Extract features from the encrypted data stream of the application to be identified to obtain the encrypted payload bytes and plaintext multimodal feature data of the data packets in the encrypted data stream;

[0008] S2. Extract statistical feature data from the multimodal feature data, and construct a fusion feature matrix based on the statistical feature data. The fusion feature matrix represents the inherent pattern characteristics of the application to be identified.

[0009] S3. Extract the stream-level features from the multimodal feature data, and generate a semantic text sequence based on the stream-level features and the encrypted payload bytes. The semantic text sequence represents the global pattern features of the encrypted data stream.

[0010] S4. Input the fused feature matrix and the semantic text sequence into the pre-trained application type recognition model to obtain the application type recognition result of the application to be identified. The application type recognition result indicates whether the application to be identified belongs to an instant messaging application or a non-instant messaging application. The application category recognition model is a classification model trained based on the encrypted data streams of instant messaging applications and non-instant messaging applications.

[0011] In some embodiments, at least one of the following is included:

[0012] In S2, the statistical feature data includes at least one of the following: packet length, packet arrival interval, packet direction, time to live (TTL), transmission control protocol (TCP) flags, window size, and packet payload length.

[0013] In S3, the stream-level features include at least one of the following: protocol type, encryption suite, protocol version number, server domain name, certificate information, heartbeat interval, protocol header field, retransmission count, and zero window count.

[0014] In some embodiments, S2, constructing a fusion feature matrix based on each statistical feature data includes:

[0015] Based on the messages in the encrypted data stream, a feature matrix is ​​constructed for each statistical feature. In each feature matrix, the target element is the character content of the target message in the encrypted data stream corresponding to each statistical feature. The target element is any element in the feature matrix, and the target message is any message in the encrypted data stream.

[0016] The fused feature matrix is ​​obtained by combining the feature matrices of each statistical feature along the channel dimension.

[0017] In some embodiments, a feature matrix of each statistical feature is constructed based on the messages in the encrypted data stream, including:

[0018] For each statistical characteristic, perform the following processing:

[0019] An initial matrix of statistical features is initialized, wherein the number of rows in the initial matrix is ​​a preset communication behavior-time window value;

[0020] Based on the number of rows of the initial matrix, the encrypted data stream is sliced ​​at the message level to obtain a continuous message sequence corresponding to each row of the initial matrix. The number of messages in the continuous message sequence is the same as the number of columns of the initial matrix.

[0021] The message corresponding to each element in each row is determined from the continuous message sequence corresponding to each row of the initial matrix, and the data of each element in each row is filled based on the character content corresponding to the statistical feature type in the message to obtain the feature matrix of the statistical features.

[0022] In some embodiments, S3, generating a semantic text sequence based on each stream level feature and the encrypted payload bytes includes:

[0023] Based on a preset keyword conversion table, text extraction is performed on each flow level feature to obtain the text of each first initial feature;

[0024] The encrypted payload bytes are converted into hexadecimal strings, and a start marker is added to each string to obtain the second initial feature text of each data packet;

[0025] The semantic text sequence is obtained by sequentially concatenating each first initial feature text and each second initial feature text in a preset order.

[0026] In some embodiments, the training process of the application type recognition model includes:

[0027] Retrieve historical encrypted data streams from both instant messaging and non-instant messaging applications;

[0028] The feature extraction is performed on the historical encrypted data stream to obtain multimodal historical feature data in the form of each historical encrypted payload byte and plaintext.

[0029] Extract historical statistical feature data from the multimodal historical feature data, and construct a historical fusion feature matrix based on each historical statistical feature data;

[0030] Extract the historical stream-level features from the multimodal historical feature data, and generate a historical semantic text sequence based on the historical stream-level features and the historical encrypted payload bytes;

[0031] Based on the application type corresponding to the historical encrypted data stream, labels are added to the historical fusion feature matrix and the historical semantic text sequence to obtain training data;

[0032] The initial classification model is trained based on the training data to obtain the application type recognition model.

[0033] In some embodiments, the application category recognition model includes a convolutional network branch, an encoder branch, a feature fusion layer, and an output layer;

[0034] The convolutional network branch is used to extract the first feature of the fused feature matrix;

[0035] The encoder branch is used to extract the second feature of the semantic text sequence;

[0036] The feature fusion layer is used to fuse the first feature and the second feature to obtain a fused feature;

[0037] The output layer is used to output the application type identification result of the application to be identified based on the fusion features.

[0038] In some embodiments, it also includes:

[0039] Keyword extraction is performed on the semantic text sequence to obtain the keywords of the semantic text sequence;

[0040] The preset mapping table is updated based on the extracted keywords. The preset mapping table stores keywords and keyword identifiers. The keyword identifier is used to uniquely identify the keyword in the application category identification model.

[0041] Save the updated preset mapping table to the application category recognition model.

[0042] In some embodiments, it also includes:

[0043] After receiving the updated feature extraction rules of the application to be identified, a shared object file is generated based on the updated feature extraction rules using a preset compilation script;

[0044] The preset feature extraction script is hot-updated using the shared object file, and the updated preset feature extraction script is used to extract features from the encrypted data stream of the application to be identified.

[0045] Secondly, this application provides an identification device for instant messaging applications, the device comprising:

[0046] The data extraction unit is configured to extract features from the encrypted data stream of the application to be identified, and obtain the encrypted payload bytes and plaintext multimodal feature data of the data packets in the encrypted data stream;

[0047] A matrix construction unit is configured to extract statistical feature data from the multimodal feature data and construct a fusion feature matrix based on the statistical feature data, wherein the fusion feature matrix characterizes the inherent pattern characteristics of the application to be identified.

[0048] A sequence generation unit is configured to extract each stream-level feature from the multimodal feature data, and generate a semantic text sequence based on each stream-level feature and the encrypted payload bytes, wherein the semantic text sequence represents the global pattern features of the encrypted data stream;

[0049] The type recognition unit is configured to input the fused feature matrix and the semantic text sequence into a pre-trained application type recognition model to obtain the application type recognition result of the application to be identified. The application type recognition result indicates whether the application to be identified belongs to an instant messaging application or a non-instant messaging application. The application category recognition model is a classification model trained based on the encrypted data streams of instant messaging applications and non-instant messaging applications.

[0050] Thirdly, this application provides an identification device for instant messaging applications, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the instant messaging application identification method described in the first aspect above.

[0051] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the instant messaging application identification method described in the first aspect.

[0052] This application provides a method, apparatus, and readable storage medium for identifying instant messaging applications. The method includes: extracting features from an encrypted data stream of an application to be identified to obtain multimodal feature data in the form of encrypted payload bytes and plaintext of data packets in the encrypted data stream; extracting statistical feature data from the multimodal feature data and constructing a fusion feature matrix based on the statistical feature data, wherein the fusion feature matrix represents the inherent pattern characteristics of the application to be identified; extracting stream-level features from the multimodal feature data and generating a semantic text sequence based on the stream-level features and the encrypted payload bytes, wherein the semantic text sequence represents the global pattern characteristics of the encrypted data stream; inputting the fusion feature matrix and the semantic text sequence into a pre-trained application type identification model to obtain an application type identification result for the application to be identified, wherein the application type identification result indicates that the application to be identified belongs to an instant messaging application or a non-instant messaging application, and the application type identification model is a classification model trained based on the encrypted data streams of instant messaging applications and non-instant messaging applications. This application provides a method for identifying instant messaging applications. Even when the data stream of the application to be detected is fully encrypted, it can effectively identify whether it belongs to an instant messaging application. This solves the technical problem that existing technologies cannot identify instant messaging applications from data streams due to encryption. It achieves accurate and reliable identification of instant messaging applications based on encrypted data streams. Attached Figure Description

[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0054] Figure 1A flowchart illustrating an instant messaging application identification method provided in this application embodiment;

[0055] Figure 2 A flowchart illustrating another instant messaging application identification method provided in this application embodiment;

[0056] Figure 3 A structural block diagram of the application category recognition model provided in the embodiments of this application;

[0057] Figure 4 A structural block diagram of the convolutional network branch in the application category recognition model provided in this application embodiment;

[0058] Figure 5 This is a structural block diagram of the encoder branch in the application category recognition model provided in the embodiments of this application;

[0059] Figure 6 A schematic diagram of the structure of an identification device for an instant messaging application provided in an embodiment of this application;

[0060] Figure 7 A schematic diagram of the structure of an electronic device provided in this application;

[0061] Figure 8 This is a schematic diagram of the structure of an identification device for another instant messaging application provided in an embodiment of this application.

[0062] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0063] To enable those skilled in the art to better understand the technical solution of this application, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0064] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining this application and are not intended to limit this application.

[0065] It is understood that, without conflict, the various embodiments and features in the embodiments of this application can be combined with each other.

[0066] It is understood that, for ease of description, only the parts relevant to this application are shown in the accompanying drawings, while parts unrelated to this application are not shown in the drawings.

[0067] It is understood that each unit or module involved in the embodiments of this application may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0068] It is understood that the terms "first," "second," etc., used in the embodiments of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0069] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this application may occur in a different order than those marked in the accompanying drawings.

[0070] It is understood that the flowcharts and block diagrams of this application illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this application. Each block in a flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagrams and flowcharts may be implemented using a hardware-based system to implement the specified function, or using a combination of hardware and computer instructions.

[0071] It is understood that the units and modules involved in the embodiments of this application can be implemented by software or by hardware. For example, the units and modules can be located in the processor.

[0072] It is understood that the specific values ​​of each parameter in this application are merely illustrative examples, and in practical applications, the parameters can be optimized and adjusted based on specific requirements.

[0073] Currently, existing technologies for identifying instant messaging applications mainly rely on deep inspection of the communication content within the application's data stream. These solutions typically require analyzing the plaintext content of the data stream and identifying specific keywords, protocol features, application-layer signatures, or specific behavioral patterns to determine the application type.

[0074] For example, detecting features such as message sending frequency, specific chat protocol fields, and application identifiers (App IDs) present in unencrypted packet payloads or headers. These features originate from application-layer communication interaction patterns or unencrypted protocol metadata.

[0075] However, when the IM application under test uses a strong encryption protocol (such as TLS) to encrypt the communication content, existing identification methods that mainly rely on analyzing the communication content itself (plaintext content) cannot obtain or parse the required plaintext information, causing their identification function to completely fail. Specifically, because encryption turns the application layer data payload into unreadable ciphertext, methods based on content keywords, specific protocol fields, or application layer signatures lose their basis and cannot work effectively.

[0076] To address the shortcomings of existing technologies, this application provides a method for identifying instant messaging applications. Even when the data stream of the application to be detected is fully encrypted, it can effectively identify whether it belongs to an instant messaging application. This solves the technical problem that existing technologies cannot identify instant messaging applications from data streams due to encryption, and achieves accurate and reliable identification of instant messaging applications based on encrypted data streams.

[0077] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0078] This application provides a method for identifying instant messaging applications. The workflow of this method can be implemented by electronic devices, such as computers, handheld smart terminals, etc. For ease of explanation, the embodiments of this application are described with computers as the main body for method execution.

[0079] Figure 1 A schematic diagram of the instant messaging application identification method provided in the embodiments of this application is shown below. Figure 1 As shown, this application provides a method for identifying instant messaging applications, the method including steps S1-S4, as follows:

[0080] S1. Extract features from the encrypted data stream of the application to be identified to obtain the encrypted payload bytes and plaintext multimodal feature data of the data packets in the encrypted data stream;

[0081] The encrypted payload byte is the encrypted byte of the payload of each data packet, which is the encrypted data content in the encrypted data.

[0082] In this process, the encrypted data stream is represented as a continuous sequence of bytes. Different parts of the encrypted data stream are distinguished by flag bits or by defining sequence positions. The positions of different parts of the encrypted data stream in the byte sequence can be determined based on the transmission protocol type.

[0083] In this application, step S1 can be implemented by defining feature extraction rules for the feature extraction script to extract bytes at different positions in the encrypted data stream, wherein the multimodal feature data is a sequence of bytes at different positions that represent different information types.

[0084] In some embodiments, the method further includes:

[0085] After receiving the updated feature extraction rules of the application to be identified, a shared object file is generated based on the updated feature extraction rules using a preset compilation script;

[0086] The preset feature extraction script is hot-updated using the shared object file, and the updated preset feature extraction script is used to extract features from the encrypted data stream of the application to be identified.

[0087] Figure 2 Another flowchart illustrating a method for identifying instant messaging applications provided in this application, as shown below. Figure 2 As shown, the encrypted data stream of the application to be identified is input into a preset feature extraction script, which then extracts features from the encrypted data stream to obtain multimodal feature data and each encrypted payload byte. Subsequently, the multimodal feature data and each encrypted payload byte are sent to the data construction module to obtain a fused feature matrix and a semantic text sequence. Finally, the fused feature matrix and semantic text sequence are input into the application category recognition model to obtain the application type recognition result of the application to be identified. Specifically, upon receiving the updated feature extraction rules of the application to be identified, the extraction rules are abstracted using the Abstract Syntax Tree (AST) built into the preset compilation script to ensure the structure and parsability of the rules. Then, the preset compilation script compiles the rules based on the abstracted updated feature extraction rules to generate a shared object file (.so file). Finally, the shared object file is dynamically loaded into the preset feature extraction script for hot updating. The updated feature extraction rules can be generated by technicians using a Domain Specific Language (DSL).

[0088] S2. Extract statistical feature data from the multimodal feature data, and construct a fusion feature matrix based on the statistical feature data. The fusion feature matrix represents the inherent pattern characteristics of the application to be identified.

[0089] In some embodiments, in S2, the statistical feature data includes at least one of the following: packet length, packet arrival interval, packet direction, Time to Live (TTL), Transmission Control Protocol (TCP) flags, window size, and packet payload length. The definitions of each statistical feature data are as follows:

[0090] (1) The data packet length is the byte length of each data packet in the encrypted data stream.

[0091] (2) Inter-Arrival Time (IAT) is the time interval between each data packet in an encrypted data stream and the previous data packet.

[0092] (3) The direction of the data packet indicates whether the data packet is sent from the uplink or the downlink.

[0093] (4) TTL (Time to Live) is the maximum number of hops that an IP packet can survive in a network.

[0094] (5) TCP flags (Transmission Control Protocol, TCP) are flags that reflect the connection status and control information of the transmission control protocol. Their types include, but are not limited to: Synchronize Sequence Numbers (SYN), Acknowledgment (ACK), Finish (FIN), Reset (RST), Push (PSH), Urgent (URG), etc.

[0095] (6) The window size represents the flow control capability of the application to be identified.

[0096] (7) The payload length of each data packet represents the amount of data sent by the application to be identified.

[0097] Research has found that although the data content in an encrypted data stream is encrypted and hidden, the underlying protocol implementation, functional requirements (such as text chat, voice calls, video calls, file transfers, etc.), and user interaction habits for different applications are reflected by statistical characteristic data, specifically including the following aspects:

[0098] 1. The length of data packets and the interval between data packet arrivals directly reflect the macroscopic and microscopic traffic rhythms of the application, such as data transmission rate, periodicity, and burstiness.

[0099] 2. TCP flags and window size reveal the mechanisms for establishing, maintaining, closing, and controlling TCP connections. Different IM applications may employ different connection strategies (long connections, short connections, connection reuse), or exhibit unique characteristics in congestion control and retransmission mechanisms, all of which are reflected in changes to TCP flags and window size.

[0100] 3. TTL provides indirect information about the number of hops a data packet has traversed in the network, while the packet direction clarifies the flow of communication. These characteristics help distinguish whether an application is performing unidirectional data transmission (such as file upload / download) or high-frequency bidirectional interaction (such as real-time voice / video).

[0101] 4. Packet payload length is a direct reflection of the data volume. Different types of messages or functions (such as short text, emoticons, images, and voice frames) usually correspond to different payload length ranges or distribution patterns. Even if the content is unreadable, its length characteristics can provide important semantic clues.

[0102] Therefore, this application extracts each statistical feature data from the multimodal feature data by configuring the type of statistical feature data, and constructs a fusion feature matrix based on each statistical feature data, thereby using the fusion feature matrix to represent the inherent pattern characteristics of the application to be identified.

[0103] S3. Extract the stream-level features from the multimodal feature data, and generate a semantic text sequence based on the stream-level features and the encrypted payload bytes. The semantic text sequence represents the global pattern features of the encrypted data stream.

[0104] Among them, flow-level features refer to features that appear only once in either encrypted or unencrypted data streams.

[0105] In some embodiments, in S3, the stream-level features include at least one of the following: protocol type, cipher suite, protocol version number, server domain name, certificate information, heartbeat interval, protocol header fields, retransmission count, and zero window count. The definitions of each stream-level feature are as follows:

[0106] (1) The protocol type is the transport layer protocol used by the encrypted data stream, such as Transmission Control Protocol TCP or User Datagram Protocol (UDP).

[0107] (2) A cipher suite is a set of encryption algorithms negotiated and determined during the handshake process of Transport Layer Security (TLS) or Secure Sockets Layer (SSL).

[0108] (3) The protocol version number is the version number of the Transport Layer Security (TLS) protocol or the Secure Sockets Layer (SSL) protocol.

[0109] (4) Server Name Indication (SNI) is an extension of the TSL protocol.

[0110] (5) Certificate information is detailed information about the server integer, such as the issuer and the common name of the subject.

[0111] (6) Heartbeat interval is the time interval pattern of heartbeat packets sent by the application to be identified to maintain the connection.

[0112] (7) The protocol header field is the header field of the transport protocol used by the application to be identified, which represents the type of transport protocol, such as the User Agent field and the Host field.

[0113] (8) The number of retransmissions represents the retransmission behavior of data packets in a TCP connection.

[0114] (9) Zero window count represents the behavior of the receiver sending zero window announcements in a TCP connection.

[0115] Research has revealed that although the data content in an encrypted data stream is encrypted and hidden, the design of the underlying protocol, traffic usage, and transmission habits of different applications are reflected in the stream-level characteristics and encrypted payload bytes of the encrypted data stream, specifically including the following aspects:

[0116] 1. The content of the protocol type can be used to clarify the data transmission rules and standards specified for different applications. Different protocol types correspond to different application scenarios and communication modes.

[0117] 2. The contents of the encryption suite represent the algorithm and key exchange method used for data encryption;

[0118] 3. The protocol version number indicates the update and evolution status of the protocol;

[0119] 4. The server domain name identifies the server that handles the data interaction of the application to be identified;

[0120] 5. Certificate information is used to verify the identities of the server and client, and reflects the security and trustworthiness of the server and client;

[0121] 6. Different applications will set different heartbeat intervals to adapt to the different business needs of the applications;

[0122] 7. The contents of the protocol header fields can be used to distinguish the data transmission characteristics of different applications;

[0123] 8. The number of retransmissions varies significantly across different applications.

[0124] 9. The number of zero-window events reflects the flow control situation of different receivers during the data reception process.

[0125] Furthermore, although the content of the encrypted payload bytes is encrypted, the length and distribution of the bytes can reflect the size of the data and the pattern of transmission. Different types of messages or functions (such as simple instructions, complex data blocks, multimedia data, etc.) usually correspond to different ranges of encrypted payload byte lengths or distribution patterns. Even if the content is unreadable, its length characteristics can provide important semantic clues.

[0126] Therefore, it can be seen that the semantic content of stream-level features and encrypted payload bytes characterizes the pattern features of various aspects of the encrypted data stream. Thus, this application extracts each stream-level feature from the multimodal feature data by configuring the type of stream-level features, and generates a semantic text sequence based on each stream-level feature and each encrypted payload byte, thereby extracting the semantics represented by the content of the stream-level features and encrypted payload bytes, and then using the obtained semantic text sequence to characterize the global pattern features of the encrypted data stream.

[0127] S4. Input the fused feature matrix and the semantic text sequence into the pre-trained application type recognition model to obtain the application type recognition result of the application to be identified. The application type recognition result indicates whether the application to be identified belongs to an instant messaging application or a non-instant messaging application. The application category recognition model is a classification model trained based on the encrypted data streams of instant messaging applications and non-instant messaging applications.

[0128] In this application, the application category recognition model can be a classification model obtained by combining identifiable text sequence features and identifiable matrix features. This application configures the model to be trained using encrypted data streams from various instant messaging applications, enabling the application category recognition model to learn the features in the encrypted data streams of each instant messaging application. It also configures the model to input a fused feature matrix and semantic text sequence into the application type recognition model, allowing the model to perform feature comparison and output the application type recognition result of the application to be identified, thereby achieving the identification of instant messaging applications / non-instant messaging applications using encrypted data.

[0129] It should be noted that in practical application scenarios, steps S2 and S3 can be executed sequentially (e.g., S2 is executed first and then S3, or S3 is executed first and then S2), or they can be executed in parallel (i.e., S2 and S3 are executed simultaneously). This application does not impose too many restrictions or elaborate on the execution order of the two steps.

[0130] In some embodiments, to facilitate subsequent management and control of instant messaging applications, after performing step S4, the method further includes: based on the application type identification result of the application to be identified, marking the encrypted data stream of the processed application to be identified as instant messaging traffic or non-instant messaging traffic.

[0131] This application extracts features from the encrypted data stream of the application to be identified, obtaining multimodal feature data of the encrypted payload bytes and plaintext form of each data packet. Based on the statistical feature data in the multimodal feature data, a fused feature matrix is ​​constructed. Since the statistical feature data includes at least one of the following: packet length, packet arrival interval, packet direction, TTL, TCP flags, window size, and payload length of each data packet, the statistical feature data characterizes the inherent characteristics of the behavior pattern of data packets during communication and the interaction rules at the protocol level. Since the communication behavior patterns and protocol interaction rules of different applications vary significantly, the fused feature matrix constructed based on the statistical feature data effectively represents the inherent pattern characteristics of the application to be identified. Furthermore, due to the significant differences in the operating mechanisms, communication protocol interaction processes, and user behavior habits of the encrypted data traffic sent or received by different applications, and the differences in the encryption methods used by different applications for communication data streams, the encrypted data streams of different applications also differ in form. Therefore, this application collects flow-level information characterizing the properties of encrypted data traffic by configuring flow-level features, including at least one of protocol type, cipher suite, protocol version number, server domain name, certificate information, heartbeat interval, protocol header fields, retransmission count, and zero window count. It also configures each flow-level feature and each encrypted payload byte based on multimodal feature data, enabling the generated semantic text sequence to accurately represent the global modal features of the encrypted data stream. Finally, by configuring an application category recognition model trained using encrypted data streams from various instant messaging applications, and by configuring the fused feature matrix and semantic text sequence as input to the preset application category recognition model, the application category recognition model compares the input with the features of the encrypted data streams of various instant messaging applications, outputting an application category recognition result indicating whether the application to be identified is an instant messaging application. This achieves the identification of instant messaging applications / non-instant messaging applications using encrypted communication.

[0132] In some embodiments, S2, constructing a fusion feature matrix based on each statistical feature data includes:

[0133] Based on the messages in the encrypted data stream, a feature matrix is ​​constructed for each statistical feature. In each feature matrix, the target element is the character content of the target message in the encrypted data stream corresponding to each statistical feature. The target element is any element in the feature matrix, and the target message is any message in the encrypted data stream.

[0134] The fused feature matrix is ​​obtained by combining the feature matrices of each statistical feature along the channel dimension.

[0135] Specifically, since encrypted data streams contain multiple messages, each with its own statistical characteristics, and these characteristics differ across messages, directly concatenating these statistical characteristics into a long sequence and using it as input to the application category identification model would increase sparsity during processing, reducing the accuracy of the final application type identification result.

[0136] Therefore, this application constructs feature matrices for each statistical feature based on messages in encrypted data streams, thereby collecting and organizing these statistical features. It also configures the combination of these feature matrices along the channel dimension to obtain a fused feature matrix, thus avoiding the risk of increased sparsity caused by long sequences. This application, by configuring the matrix, ensures both the quality of the extracted time-series data and avoids the sparsity and computational complexity associated with long sequences.

[0137] Furthermore, since each feature matrix corresponds to a different type of statistical feature, the data in each feature matrix have different dimensions and different value ranges, which reduces the representation accuracy of the inherent pattern characteristics of the fused feature matrix for the recognition application. Therefore, this application also includes: after obtaining the fused feature matrix, normalizing the fused feature matrix to eliminate the differences in dimensions and value ranges.

[0138] In some embodiments, the normalization of the fused feature matrix can be achieved using the standard deviation normalization (Z-score) method, specifically through the formula... The fused feature matrix is ​​then normalized. Here, x is the value of the target element, μ is the mean of all elements in the feature matrix corresponding to a statistical feature, and σ is the standard deviation of all elements in the feature matrix corresponding to a statistical feature. It is the normalized value of the target element.

[0139] In some embodiments, a feature matrix of each statistical feature is constructed based on the messages in the encrypted data stream, including:

[0140] For each statistical characteristic, perform the following processing:

[0141] An initial matrix of statistical features is initialized, wherein the number of rows in the initial matrix is ​​a preset communication behavior-time window value;

[0142] Based on the number of rows of the initial matrix, the encrypted data stream is sliced ​​at the message level to obtain a continuous message sequence corresponding to each row of the initial matrix. The number of messages in the continuous message sequence is the same as the number of columns of the initial matrix.

[0143] The message corresponding to each element in each row is determined from the continuous message sequence corresponding to each row of the initial matrix, and the data of each element in each row is filled based on the character content corresponding to the statistical feature type in the message to obtain the feature matrix of the statistical features.

[0144] The preset communication behavior-time window value can be an empirical value obtained by technicians based on their observations and summaries of communication application behavior patterns. This application configures the number of rows in the initial matrix to be the preset communication behavior-time window value, configures the number of messages in the continuous message sequence to be the same as the number of columns in the initial matrix, and configures message-level slicing of the encrypted data stream based on the number of rows in the initial matrix to obtain the continuous message sequence corresponding to each row of the initial matrix. This allows the obtained continuous message sequence to capture the micro-interaction sequences and local temporal features of the application to be identified within a short period (such as TCP handshakes, short message sending, and heartbeat intervals), while avoiding the risks of sparsity and large matrix dimensions caused by excessively long sequences, thus improving the accuracy of the final fused feature matrix.

[0145] In some embodiments, if the total number of packets in the encrypted data stream is not greater than the dimension value of the initial matrix, then when performing packet-level slicing of the encrypted data stream based on the number of rows of the initial matrix, insufficient packets can be supplemented with a value of 0.

[0146] For example, assuming the initial matrix has a dimension of 8×8, if the total number of messages in the encrypted data stream is 64, then after message-level slicing, a total of 8 consecutive message sequences are obtained, each consisting of 8 consecutive messages. If the total number of messages in the encrypted data stream is 63, then after message-level slicing, a total of 8 consecutive message sequences are obtained, each consisting of 8 consecutive messages. Furthermore, the last message in the eighth consecutive message sequence contains 0.

[0147] In some embodiments, S3, generating a semantic text sequence based on each stream level feature and the encrypted payload bytes includes:

[0148] Based on a preset keyword conversion table, text extraction is performed on each flow level feature to obtain the text of each first initial feature;

[0149] The encrypted payload bytes are converted into hexadecimal strings, and a start marker is added to each string to obtain the second initial feature text of each data packet;

[0150] The semantic text sequence is obtained by sequentially concatenating each first initial feature text and each second initial feature text in a preset order.

[0151] Specifically, for different applications to be identified, redundant characters in each stream-level feature (such as flag bits in encrypted data streams) and the byte format of encrypted payload bytes vary. This data diversity is detrimental to the identification and processing of subsequent application category recognition models. Therefore, this application configures text extraction of each stream-level feature based on a preset keyword conversion table, converts each encrypted payload byte into a hexadecimal string, and adds a start marker to each string. This unifies the format of the stream-level features and encrypted payload bytes of different applications to be identified, thereby enabling the identification of different applications using a single application category recognition model and improving the universality of the instant messaging application identification method of this application.

[0152] In this application, the preset keyword conversion table is a data table used to store at least the stream-level feature types and their corresponding keyword content. The preset keyword conversion table can be customized based on the actual application scenario. For ease of understanding, Table 1 below shows an example of a preset keyword conversion table:

[0153] ;

[0154] Table 1

[0155] In some embodiments, to avoid the application category recognition model being unable to distinguish the first initial feature texts in the semantic text sequence, leading to a decrease in output accuracy, a starting marker column can be added to the preset keyword conversion table as shown in Table 1. This is configured so that after extracting text from each flow-level feature, the extracted text is concatenated with its corresponding starting marker to obtain each first initial feature text. This assists in the subsequent steps of concatenating each first initial feature text and each second initial feature text in a preset order, while also facilitating the application category recognition model's identification of each data point in the semantic text sequence, thus improving the type recognition accuracy of the application category recognition model for the application being identified.

[0156] It should be noted that there can be multiple preset orders, which can be set according to the actual application scenario. Here is one example: the arrangement rule of the preset order is that after the initial semantic text sequence start mark, each first initial feature text is concatenated in turn according to the arrangement order of the stream-level feature types in the preset keyword conversion table. On this basis, each second initial feature text is concatenated in turn according to the order of each data packet corresponding to each second initial feature text in the encrypted data stream.

[0157] In some embodiments, the implementation of adding start markers to each string can be as follows: for each string, add a first marker (such as PKT_Payload_START) and a second marker (such as PKT_Payload_END) to its beginning and end respectively to obtain each second initial feature text.

[0158] In some embodiments, since the application category recognition model has a limit on the length of the input features, after obtaining the semantic text sequence, the semantic text sequence can be truncated from the tail to the head based on the input length limit of the application category recognition model, and the truncated part can be retained so that the length of the truncated semantic text sequence is not greater than the upper limit of the input length limit.

[0159] In some embodiments, to facilitate understanding of semantic text sequences, specific examples are provided below. Examples of semantic text sequences are shown in Table 2:

[0160] ;

[0161] Table 2

[0162] In Table 2 above, the annotation column provides a description of the type of the first initial feature text and the second initial feature text.

[0163] In some embodiments, the training process of the application type recognition model includes:

[0164] Retrieve historical encrypted data streams from both instant messaging and non-instant messaging applications;

[0165] The feature extraction is performed on the historical encrypted data stream to obtain multimodal historical feature data in the form of each historical encrypted payload byte and plaintext.

[0166] Extract historical statistical feature data from the multimodal historical feature data, and construct a historical fusion feature matrix based on each historical statistical feature data;

[0167] Extract the historical stream-level features from the multimodal historical feature data, and generate a historical semantic text sequence based on the historical stream-level features and the historical encrypted payload bytes;

[0168] Based on the application type corresponding to the historical encrypted data stream, labels are added to the historical fusion feature matrix and the historical semantic text sequence to obtain training data;

[0169] The initial classification model is trained based on the training data to obtain the application type recognition model.

[0170] This application uses training data to train an initial classification model to obtain an application category recognition model. The input of the application category recognition model is a fused feature matrix and a semantic text sequence, and the output is the application type of the application to be identified, which is an instant messaging application or a non-instant messaging application.

[0171] In some embodiments, to further improve the efficiency of managing instant messaging applications, during the training process of the application category identification model, in addition to configuring the label content to include whether the historical encrypted data stream comes from an instant messaging application or a non-instant messaging application, the label content can also be configured to include the specific application name of the application from which the historical encrypted data stream originates. This allows the trained application category identification model to output the application name of the application to be identified, in addition to the application type of the application to be identified, in actual application scenarios.

[0172] In some embodiments, the historical fusion feature matrix can be processed by normalizing the fusion feature matrix during the training process of the applied category recognition model, thereby accelerating the convergence rate of the applied category recognition model and improving its generalization ability.

[0173] In some embodiments, the application category recognition model includes a convolutional network branch, an encoder branch, a feature fusion layer, and an output layer;

[0174] The convolutional network branch is used to extract the first feature of the fused feature matrix;

[0175] The encoder branch is used to extract the second feature of the semantic text sequence;

[0176] The feature fusion layer is used to fuse the first feature and the second feature to obtain a fused feature;

[0177] The output layer is used to output the application type identification result of the application to be identified based on the fusion features.

[0178] Specifically, Figure 3 The structural block diagram of the application category recognition model provided in the embodiments of this application is as follows: Figure 3 As shown, the convolutional network branch and the encoder branch send input data to the feature fusion layer, which then merges the features into the output layer. The output layer then outputs the application type of the application to be identified.

[0179] It should be noted that in practical applications, the convolutional network branch can be a convolutional neural network (CNN) capable of recognizing vector graph structure data (i.e., fused feature matrices). The encoder branch can be a pre-trained language model based on the Transformer architecture (Bidirectional Encoder Representations from Transformers, BERT) that extracts semantic information and contextual dependencies.

[0180] Figure 4The structural block diagram of the convolutional network branch in the application category recognition model provided in the embodiments of this application is as follows: Figure 4 As shown, the convolutional network branches include the first layer (convolutional layer 1), the second layer (max pooling layer 1), the third layer (convolutional layer 2), the fourth layer (max pooling layer 2), the fifth layer (convolutional layer 3), the sixth layer (global average pooling layer), and the seventh layer (fully connected layer) configured in sequence.

[0181] The Conv2D Layer 1 serves as the initial layer for the convolutional network branch, used to extract preliminary, fine-grained local spatial features and short-range temporal patterns from the fused feature matrix. These patterns can include minute fluctuations in specific packet sizes, short patterns in TCP flag sequences, and so on.

[0182] Among them, the MaxPooling2D Layer 1 is used to downsample the features output by the convolutional layer 1 in order to retain significant features while reducing the dimensionality of the data space, thereby enhancing the robustness of the convolutional network branches to small feature shifts.

[0183] Convolutional layer 2 is used to extract high-order pooling features from the output of max pooling layer 1 to expand the receptive field of the convolutional network branches.

[0184] Among them, max pooling layer 2 is used to compress the features output by convolutional layer 2 to reduce redundancy, while improving the model's perception of abstract flow patterns.

[0185] Convolutional layer 3 is used to extract the highest-dimensional, global discriminative features.

[0186] The Global Average Pooling 2D Layer is used to compress the spatial dimension of each discriminative feature into a single value, thereby converting the three-dimensional feature tensor into a one-dimensional vector to aggregate feature information from all spatial locations.

[0187] The fully connected (Dense Layer) performs non-linear transformations and dimension mappings on the feature vectors after global average pooling to project them into the convolutional feature representation space.

[0188] In some embodiments, convolutional layer 1 can employ 64 3×3 convolutional kernels. The small 3x3 kernel size effectively captures the direct relationships between adjacent elements (such as consecutive packet features) in the input fusion feature matrix, making it ideal for identifying rapidly changing, localized features in communication traffic. Following the convolution operation, batch normalization is performed to stabilize the distribution of inputs at each layer, accelerating model training and reducing sensitivity to initial weights. Finally, a non-linear processing is introduced through the ReLU (Rectified Linear Unit) activation function to enhance the model's ability to learn complex patterns.

[0189] In some embodiments, max-pooling layer 1 uses a 2x2 pooling window. This halves the size of the fused feature matrix, effectively reducing the computational cost of subsequent layers and allowing the model to focus more on the presence of features rather than their precise location. For encrypted data streams, this means the model can better identify core patterns, even if these patterns are slightly offset in time or structure.

[0190] In some embodiments, convolutional layer 2 can use 128 3x3 convolutional kernels. Increasing the number of kernels (from 64 to 128) allows the model to learn more diverse feature representations. This layer can recognize mesoscale features such as heartbeat patterns specific to the application being identified, or specific data packet interaction sequences during session establishment. Similarly, batch normalization and ReLU activation function processing are then performed.

[0191] In some embodiments, max pooling layer 2 can use a 2x2 pooling window for downsampling. Through continuous pooling operations, the model can more effectively capture macroscopic behavioral characteristics of encrypted data streams spanning a large time range or multiple data packets, such as data transmission volume curves within a specific time period and periodic changes in connection activity.

[0192] In some embodiments, convolutional layer 3 may employ 256 3x3 convolutional kernels. Further increasing the number allows the model to learn extremely complex patterns from highly abstract inputs, such as distinguishing protocol handshake differences between different applications to be identified or traffic patterns during specific types of attachment transmissions. Similarly, batch normalization and ReLU activation functions are included.

[0193] In some embodiments, the global average pooling layer can be configured to average the feature maps of each convolutional output of convolutional layer 3, with the output dimension being a vector equal to the number of convolutional kernels (256). The global average pooling layer can preserve the spatial distribution information of features and greatly reduce the number of model parameters, effectively alleviating the overfitting problem, thereby ensuring that the features learned by the model are generalized features of the entire traffic session, rather than relying solely on a local region.

[0194] In some embodiments, the fully connected layer can employ a standard fully connected layer and a regularization layer, randomly causing the output of a portion of neurons to be zero, forcing the network to learn more robust features, thereby unifying the data noise in the encrypted data stream and avoiding overfitting.

[0195] It should be noted that in practical applications, the output of a convolutional network branch is a fixed-dimensional real-valued vector, denoted as E∈ D C This is the output dimension of the fully connected layer. The numerical value of each dimension of the real-valued vector represents the strength of a specific pattern or feature in the fused feature matrix. E is represented as: E = [e1, e2, ..., ...]. The vector E encodes various structural information of the encrypted data stream, its main function being to abstract and summarize the behavioral structural features of the traffic. It provides a mathematical description of the traffic's "skeleton," distinguishing different applications even when the content is encrypted through its unique structural patterns. Through multi-layer convolution and pooling operations, it can capture some inherent correlations existing in the feature vector map at the following three scales:

[0196] 1. Microscopic local patterns: specific fluctuations in the data packet length sequence, subtle changes in the combination of TCP / UDP flag bits, and characteristics of data packet transmission frequency over a short period of time.

[0197] 2. Meso-level temporal correlation: Fixed-order data packet interaction patterns and periodic occurrence patterns of heartbeat packets during the application session establishment phase (such as TLS handshake).

[0198] 3. Macro-level connection topology and behavior: This includes, but is not limited to, the directionality of traffic flow, the duration characteristics of connections, and the overall "shape" formed by the inter-packet dependencies and connection patterns captured by the application to be identified.

[0199] Figure 5 The structural block diagram of the encoder branch in the application category recognition model provided in the embodiments of this application is as follows: Figure 5As shown, the encoder branch includes a three-layer architecture: the first layer is the embedding layer, the second layer is the Transformer Encoder Layers, and the third layer is the [CLS] Token Output Extraction layer.

[0200] The embedding layer transforms discrete keyword identifiers into continuous, high-dimensional vector representations, enabling the model to perform numerical computation and semantic reasoning. It also encodes the positional information of keywords within the semantic text sequence and the segment information they belong to, ensuring the model can capture the temporal and causal relationships of events within the traffic sequence.

[0201] The second layer consists of multiple Transformer encoder blocks, a multi-head attention (MHA) mechanism, a feedforward neural network (FNN), residual connections, and a layer normalization layer. The Transformer encoder blocks in the second layer are used to capture the bidirectional contextual dependencies between keywords in the semantic text sequence and generate semantic features.

[0202] The third layer is used to output a fixed-dimensional vector representing the semantics of the semantic text sequence.

[0203] In some embodiments, the embedding layer may include a token embeddings block and a positional embeddings block. The token embeddings block maps each keyword identifier to a high-dimensional word vector representing the keyword's semantics, enabling the model to perform numerical computation and semantic reasoning. The positional embeddings block marks the absolute position of each keyword in the semantic text sequence, allowing the model to capture the temporal and causal relationships of messages within the semantic text sequence.

[0204] In some embodiments, the multi-head self-attention mechanism of the second layer is used to simultaneously capture all keywords in the semantic text of interest across different representation subspaces, thereby capturing various types of contextual associations. For example, when analyzing encrypted data streams, the multi-head self-attention mechanism can associate specific parameters in the encrypted handshake with patterns in subsequent data transmission.

[0205] In some embodiments, the feedforward network of the second layer is used to perform a nonlinear transformation on the features output by the multi-head self-attention mechanism.

[0206] In some embodiments, residual connections and layer normalization layers are used throughout each Transformer encoder block to mitigate gradient vanishing and stabilize the input distribution, thereby ensuring the convergence rate of the model.

[0207] It should be noted that by configuring the second layer, each Transformer encoder block will fully consider the semantics of other adjacent keywords when extracting the semantics of each keyword, thereby improving the recognition and extraction of semantics such as complex protocol instructions and payload patterns in the encrypted data stream. For example, it can distinguish the meaning of a keyword in different protocol stages.

[0208] It should be noted that the output of the encoder branch is a fixed-dimensional real-valued vector, denoted as F∈ D B This is the dimension of the hidden state vector corresponding to the Token [CLS]. The value of each dimension of the real-valued vector represents the specific semantic and contextual information captured from the semantic text sequence. The vector F is represented as: F = [f1, f2, ..., The vector F profoundly encodes a variety of information about the encrypted data stream at both the semantic and contextual levels. It is not merely a simple aggregation of keyword vectors, but also reflects the encoder branch's deep understanding of the "flow language," an understanding derived in part from its pre-training on a large-scale corpus, and further fine-tuned to adapt to the characteristics of encrypted traffic.

[0209] 1. High-level protocol semantics and language patterns: Vector F can capture the role and meaning of specific fields (even encrypted or encoded) in the communication protocol used by the application to be identified throughout the communication process. For example, it can identify a specific cipher suite negotiation sequence in the TLS handshake log, or the client type implied by the User-Agent string in the HTTP header, even if this information exists in the form of a token ID sequence. Pre-training gives the model prior knowledge of these general semantic patterns.

[0210] 2. Context-dependent "Discourse": The bidirectional context learning capability of the encoder branch enables the F-vector to understand long-distance associations between keywords in semantic text sequences. For example, when an application logs in, sends a message, and logs out, its payload patterns or control command sequences may exhibit unique "language habits." The F-vector can identify these complex, non-local "discourse" features, such as identifying text features at different stages of a conversation: the beginning, continuation, and end.

[0211] 3. Abstract “byte language” characteristics of encrypted payloads: Even with strong encrypted payloads, statistical characteristics or specific byte sequences transformed by the application to be identified may still exist. The encoder branch can learn whether there are “encoding patterns” or “byte vocabularies” that certain applications to be identified tend to produce in these seemingly random byte strings.

[0212] 4. Overall Semantic Summary of Semantic Text Sequence: Vector F can be regarded as a linguistic fingerprint of the semantic text sequence of encrypted data stream, a compressed, high-dimensional, and semantically rich summary of the entire "traffic session text". It can effectively distinguish the unique "language style" of different applications in terms of communication content organization and protocol interaction logic.

[0213] In this application, there are various ways to implement the feature fusion layer for fusing the first feature and the second feature to obtain the fused feature. Here, one example is provided, including the following steps A1 to A3:

[0214] A1. Obtain the first feature and the second feature, and proceed to step A2.

[0215] A2. Concatenate the first feature and the second feature sequentially to obtain the initial fused feature, and proceed to step A3.

[0216] In some embodiments, the dimension of the initial fusion feature obtained in step A2 is the sum of the dimensions of the first feature and the second feature, and the initial fusion feature is a vector including a number of floating-point values ​​corresponding to its dimensions.

[0217] A3. Input the initial fusion features into the fully connected layer and the regularization layer to obtain the fusion features.

[0218] In some embodiments, the fully connected layer in step A3 is configured to utilize the built-in ReLU activation function to capture the nonlinear and complex coupling relationships between multimodal feature data in the encrypted data stream. And the regularization layer in step A3 is configured to prevent model overfitting.

[0219] In this application, the output layer is used to map the fused features to the probability distribution of different types of communication applications (including instant messaging applications and non-instant messaging applications), thereby determining the confidence level of the encrypted data stream of the application to be identified belonging to each communication application, and then outputting the application type of the application to be identified.

[0220] Specifically, the output layer is configured with a standard fully connected layer, which performs a linear transformation on the input features and projects the result directly into the category space. The output dimension of this layer is precisely set to the total number of communication application categories that the model can recognize.

[0221] For example, if the model needs to distinguish N types of applications, this fully connected layer will output N numerical values ​​(each value corresponds to a category of communication application). To transform these values ​​into meaningful probabilities, the layer then uses the Softmax activation function. The Softmax function can compress a vector of arbitrary real values ​​into the (0,1) interval and ensure that the sum of all output values ​​is 1, thus forming an efficient probability distribution.

[0222] In some embodiments, the method further includes:

[0223] Keyword extraction is performed on the semantic text sequence to obtain the keywords of the semantic text sequence;

[0224] The preset mapping table is updated based on the extracted keywords. The preset mapping table stores keywords and keyword identifiers. The keyword identifier is used to uniquely identify the keyword in the application category identification model.

[0225] Save the updated preset mapping table to the application category recognition model.

[0226] Specifically, due to the differences in semantic text sequences corresponding to different applications to be identified, the recognition accuracy of a single application category recognition model varies for semantic text sequences corresponding to different applications. Therefore, this application configures the extraction of text from the semantic text sequence to obtain each keyword of the semantic text sequence. Based on each keyword, a preset mapping table is updated. The preset mapping table stores keywords and keyword identifiers. The keyword identifier is used to uniquely identify the keyword in the application category recognition model. The updated preset mapping table is then input into the application category recognition model, enabling the application category recognition model to recognize and label each keyword of the semantic text sequence based on the preset mapping table, thereby improving the recognition accuracy.

[0227] In some embodiments, an example of a preset mapping table is shown in Table 3 below:

[0228]

[0229] Table 3

[0230] In Table 3 above, the token column is the keyword, and the token_id column is the keyword identifier.

[0231] This application provides a method for identifying instant messaging applications, which can effectively identify whether an application belongs to an instant messaging application even when the data stream of the application to be detected is fully encrypted, thereby realizing the identification of instant messaging applications using encrypted communication / non-instant messaging applications.

[0232] It should be understood that although the steps in the flowcharts of the embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0233] Figure 6 A schematic diagram of an identification device for an instant messaging application provided in an embodiment of this application, as shown below. Figure 6 As shown, this application provides an identification device for instant messaging applications, the device comprising:

[0234] The data extraction unit 601 is configured to extract features from the encrypted data stream of the application to be identified, and obtain the encrypted payload bytes and plaintext multimodal feature data of the data packets in the encrypted data stream.

[0235] The matrix construction unit 602 is configured to extract statistical feature data from the multimodal feature data and construct a fusion feature matrix based on the statistical feature data, wherein the fusion feature matrix characterizes the inherent pattern characteristics of the application to be identified.

[0236] The sequence generation unit 603 is configured to extract each stream-level feature from the multimodal feature data, and generate a semantic text sequence based on each stream-level feature and the encrypted payload bytes, wherein the semantic text sequence represents the global pattern features of the encrypted data stream;

[0237] The type recognition unit 604 is configured to input the fused feature matrix and the semantic text sequence into a pre-trained application type recognition model to obtain the application type recognition result of the application to be identified. The application type recognition result indicates whether the application to be identified belongs to an instant messaging application or a non-instant messaging application. The application category recognition model is a classification model trained based on the encrypted data streams of instant messaging applications and non-instant messaging applications.

[0238] In some embodiments, in S2, the statistical feature data includes at least one of packet length, packet arrival interval, packet direction, TTL, TCP flags, window size, and packet payload length.

[0239] In some embodiments, in S3, the stream-level features include at least one of the following: protocol type, cipher suite, protocol version number, server domain name, certificate information, heartbeat interval, protocol header field, retransmission count, and zero window count.

[0240] In some embodiments, the matrix construction unit 602 is configured to construct a fusion feature matrix based on each statistical feature data by: constructing a feature matrix for each statistical feature based on the messages in the encrypted data stream, wherein the target element in each feature matrix is ​​the character content of each statistical feature corresponding to the target message in the encrypted data stream, the target element is any element in the feature matrix, and the target message is any message in the encrypted data stream; and combining the feature matrices of each statistical feature in the channel dimension to obtain the fusion feature matrix.

[0241] In some embodiments, the matrix construction unit 602 is configured to construct feature matrices for each statistical feature based on messages in the encrypted data stream as follows: for each statistical feature, perform the following processing: initialize an initial matrix of the statistical feature, wherein the number of rows in the initial matrix is ​​a preset communication behavior-time window value; slice the encrypted data stream at the message level based on the number of rows in the initial matrix to obtain a continuous message sequence corresponding to each row of the initial matrix, wherein the number of messages in the continuous message sequence is the same as the number of columns in the initial matrix; determine the message corresponding to each element in each row from the continuous message sequence corresponding to each row of the initial matrix, and fill each element in each row with data based on the character content corresponding to the statistical feature type in the message to obtain the feature matrix of the statistical feature.

[0242] In some embodiments, the sequence generation unit 603 is configured to: extract text from each stream-level feature based on a preset keyword conversion table to obtain each first initial feature text; convert the encrypted payload bytes into hexadecimal strings and add a start marker to each string to obtain each second initial feature text of each data packet; and concatenate each first initial feature text and each second initial feature text in a preset order to obtain the semantic text sequence.

[0243] In some embodiments, the instant messaging application identification device provided in this application further includes: a model training unit, which is configured during the training process of the application type identification model to: acquire historical encrypted data streams of instant messaging applications and non-instant messaging applications; perform the feature extraction on the historical encrypted data streams to obtain multimodal historical feature data in the form of each historical encrypted payload byte and plaintext; extract each historical statistical feature data from the multimodal historical feature data, and construct a historical fusion feature matrix based on each historical statistical feature data; extract each historical stream-level feature from the multimodal historical feature data, and generate a historical semantic text sequence based on each historical stream-level feature and the historical encrypted payload byte; add labels to the historical fusion feature matrix and the historical semantic text sequence based on the application type corresponding to the historical encrypted data stream to obtain training data; and train an initial classification model based on the training data to obtain the application type identification model.

[0244] In some embodiments, the application category recognition model includes a convolutional network branch, an encoder branch, a feature fusion layer, and an output layer; wherein, the convolutional network branch is used to extract a first feature from the fused feature matrix; the encoder branch is used to extract a second feature from the semantic text sequence; the feature fusion layer is used to fuse the first feature and the second feature to obtain a fused feature; and the output layer is used to output the application type recognition result of the application to be identified based on the fused feature.

[0245] In some embodiments, the instant messaging application identification device provided in this application further includes: a model update unit, which is configured to: extract keywords from the semantic text sequence to obtain keywords of the semantic text sequence; update a preset mapping relationship table based on the extracted keywords, wherein the preset mapping relationship table stores keywords and keyword identifiers, and the keyword identifiers are used to uniquely identify the keywords in the application category identification model; and save the updated preset mapping relationship table to the application category identification model.

[0246] In some embodiments, the instant messaging application identification device provided in this application further includes: a rule update module, which is configured to: after receiving the updated feature extraction rules of the application to be identified, generate a shared object file based on the updated feature extraction rules using a preset compilation script; perform hot update of the preset feature extraction script using the shared object file; and perform feature extraction on the encrypted data stream of the application to be identified using the updated preset feature extraction script.

[0247] Regarding the limitations on the identification device for instant messaging applications, please refer to the limitations on the identification methods for instant messaging applications in the various embodiments of this application, which will not be repeated here.

[0248] In some embodiments, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods in various embodiments of this application.

[0249] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, computer program modules or other data. Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0250] In some embodiments, this application provides an electronic device including at least one processor and a memory connected to the processor, wherein:

[0251] Memory is used to store computer programs;

[0252] The processor is used to execute computer programs to enable the electronic device to implement the methods in the various embodiments.

[0253] The electronic devices in the embodiments of this application may include, but are not limited to, fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc.

[0254] Figure 7 A schematic diagram of the structure of an electronic device provided in this application, such as... Figure 7 As shown, Figure 7As shown, the electronic device may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. When the electronic device is powered on, the RAM 703 also stores various programs and data required for the operation of the electronic device. The processing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0255] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 708 including, for example, memory cards, hard drives, etc.; and communication devices 709. Communication device 709 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0256] Understandable. Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0257] Figure 8 Another schematic diagram of the identification device for the instant messaging application provided in the embodiments of this application, as shown below. Figure 8 As shown, the device includes a memory 802 and a processor 801. The memory stores a computer program, and the processor is configured to run the computer program to perform the methods in the embodiments of this application.

[0258] The memory is connected to the processor. The memory can be flash memory, read-only memory or other types of memory. The processor can be a central processing unit or a microcontroller.

[0259] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of this application, and this application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this application, and these modifications and improvements are also considered to be within the scope of protection of this application.

Claims

1. A method for identifying instant messaging applications, characterized in that, The method includes: S1. Extract features from the encrypted data stream of the application to be identified to obtain the encrypted payload bytes and plaintext multimodal feature data of the data packets in the encrypted data stream; S2. Extract statistical feature data from the multimodal feature data, and construct a fusion feature matrix based on the statistical feature data. The fusion feature matrix represents the inherent pattern characteristics of the application to be identified. S3. Extract the stream-level features from the multimodal feature data, and generate a semantic text sequence based on the stream-level features and the encrypted payload bytes. The semantic text sequence represents the global pattern features of the encrypted data stream. S4. Input the fused feature matrix and the semantic text sequence into the pre-trained application type recognition model to obtain the application type recognition result of the application to be identified. The application type recognition result indicates whether the application to be identified belongs to an instant messaging application or a non-instant messaging application. The application category recognition model is a classification model trained based on the encrypted data streams of instant messaging applications and non-instant messaging applications.

2. The method for identifying instant messaging applications according to claim 1, characterized in that, Includes at least one of the following: In S2, the statistical feature data includes at least one of the following: packet length, packet arrival interval, packet direction, time to live (TTL), transmission control protocol (TCP) flags, window size, and packet payload length. In S3, the stream-level features include at least one of the following: protocol type, encryption suite, protocol version number, server domain name, certificate information, heartbeat interval, protocol header field, retransmission count, and zero window count.

3. The method for identifying instant messaging applications according to claim 1, characterized in that, In S2, a fusion feature matrix is ​​constructed based on various statistical feature data, including: Based on the messages in the encrypted data stream, a feature matrix is ​​constructed for each statistical feature. In each feature matrix, the target element is the character content of the target message in the encrypted data stream corresponding to each statistical feature. The target element is any element in the feature matrix, and the target message is any message in the encrypted data stream. The fused feature matrix is ​​obtained by combining the feature matrices of each statistical feature along the channel dimension.

4. The method for identifying instant messaging applications according to claim 3, characterized in that, Based on the messages in the encrypted data stream, a feature matrix is ​​constructed for each statistical feature, including: For each statistical characteristic, perform the following processing: An initial matrix of statistical features is initialized, wherein the number of rows in the initial matrix is ​​a preset communication behavior-time window value; Based on the number of rows of the initial matrix, the encrypted data stream is sliced ​​at the message level to obtain a continuous message sequence corresponding to each row of the initial matrix. The number of messages in the continuous message sequence is the same as the number of columns of the initial matrix. The message corresponding to each element in each row is determined from the continuous message sequence corresponding to each row of the initial matrix, and the data of each element in each row is filled based on the character content corresponding to the statistical feature type in the message to obtain the feature matrix of the statistical features.

5. The method for identifying instant messaging applications according to claim 1, characterized in that, In S3, a semantic text sequence is generated based on the features of each stream level and the encrypted payload bytes, including: Based on a preset keyword conversion table, text extraction is performed on each flow level feature to obtain the text of each first initial feature; The encrypted payload bytes are converted into hexadecimal strings, and a start marker is added to each string to obtain the second initial feature text of each data packet; The semantic text sequence is obtained by sequentially concatenating each first initial feature text and each second initial feature text in a preset order.

6. The method for identifying instant messaging applications according to claim 1, characterized in that, The training process of the application type recognition model includes: Retrieve historical encrypted data streams from both instant messaging and non-instant messaging applications; The feature extraction is performed on the historical encrypted data stream to obtain multimodal historical feature data in the form of each historical encrypted payload byte and plaintext. Extract historical statistical feature data from the multimodal historical feature data, and construct a historical fusion feature matrix based on each historical statistical feature data; Extract the historical stream-level features from the multimodal historical feature data, and generate a historical semantic text sequence based on the historical stream-level features and the historical encrypted payload bytes; Based on the application type corresponding to the historical encrypted data stream, labels are added to the historical fusion feature matrix and the historical semantic text sequence to obtain training data; The initial classification model is trained based on the training data to obtain the application type recognition model.

7. The method for identifying instant messaging applications according to claim 1, characterized in that, The application category recognition model includes a convolutional network branch, an encoder branch, a feature fusion layer, and an output layer; The convolutional network branch is used to extract the first feature of the fused feature matrix; The encoder branch is used to extract the second feature of the semantic text sequence; The feature fusion layer is used to fuse the first feature and the second feature to obtain a fused feature; The output layer is used to output the application type identification result of the application to be identified based on the fusion features.

8. The method for identifying instant messaging applications according to any one of claims 1-7, characterized in that, Also includes: Keyword extraction is performed on the semantic text sequence to obtain the keywords of the semantic text sequence; The preset mapping table is updated based on the extracted keywords. The preset mapping table stores keywords and keyword identifiers. The keyword identifier is used to uniquely identify the keyword in the application category identification model. Save the updated preset mapping table to the application category recognition model.

9. The method for identifying instant messaging applications according to any one of claims 1-7, characterized in that, Also includes: After receiving the updated feature extraction rules of the application to be identified, a shared object file is generated based on the updated feature extraction rules using a preset compilation script; The preset feature extraction script is hot-updated using the shared object file, and the updated preset feature extraction script is used to extract features from the encrypted data stream of the application to be identified.

10. An identification device for an instant messaging application, characterized in that, The device includes: The data extraction unit is configured to extract features from the encrypted data stream of the application to be identified, and obtain the encrypted payload bytes and plaintext multimodal feature data of the data packets in the encrypted data stream; A matrix construction unit is configured to extract statistical feature data from the multimodal feature data and construct a fusion feature matrix based on the statistical feature data, wherein the fusion feature matrix characterizes the inherent pattern characteristics of the application to be identified. A sequence generation unit is configured to extract each stream-level feature from the multimodal feature data, and generate a semantic text sequence based on each stream-level feature and the encrypted payload bytes, wherein the semantic text sequence represents the global pattern features of the encrypted data stream; The type recognition unit is configured to input the fused feature matrix and the semantic text sequence into a pre-trained application type recognition model to obtain the application type recognition result of the application to be identified. The application type recognition result indicates whether the application to be identified belongs to an instant messaging application or a non-instant messaging application. The application category recognition model is a classification model trained based on the encrypted data streams of instant messaging applications and non-instant messaging applications.

11. An identification device for an instant messaging application, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to implement the identification method for an instant messaging application as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the identification method for an instant messaging application as described in any one of claims 1-9.

Images