A mobile traffic classification method based on multi-scale pyramid token sliding window

Abstract

The application discloses the field of flow data processing, and proposes a mobile flow classification method based on a multi-scale pyramid token sliding window. Different scale sliding windows are designed based on the pyramid pooling principle to perform multi-granularity segmentation on token sequences, better capture the distribution characteristics and perform embedded representation, and then convert the fragments into fixed-length vector representation through the multi-scale sliding window mechanism, effectively fuse the multi-scale features, and apply LSTM for deep feature extraction, capture the forward and backward time sequence dependence relationship in each sub-sequence fragment, and introduce the attention mechanism in each time step output, and strengthen the key feature and the feature representation of the difficult classification and easily confused category. The application solves the classification boundary ambiguity and performance bottleneck problem caused by the single scale feature extraction and the lack of effective feature fusion strategy in the existing mobile flow classification method, and improves the classification accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of traffic data processing, in particular to a mobile traffic classification method based on a multi-scale pyramid token sliding window. BACKGROUND

[0002] With the rapid development of the network industry, network security has gradually become an extremely important link, among which, in particular, mobile traffic identification and classification, high-precision and real-time classification of mobile traffic, have important significance for network management, user experience optimization and security protection.

[0003] In the prior art, when facing real complex mobile network environment, the traditional method often has two core technical problems related to each other, first, the existing method focuses on single scale (or fixed window) feature extraction, ignoring the multi-scale space-time information contained in mobile traffic data, in actual application, the attention scale of traffic features is significantly different in different scenarios: some applications (such as video streaming) need to observe traffic behavior from a macro global perspective to capture overall trends, while some applications (such as instant messaging short connections) need to focus on micro local behavior fragments to avoid dilution of key information, the traditional single scale method cannot adaptively consider both aspects, second, the existing multi-scale processing method, but often lacks effective feature fusion strategy, resulting in information loss or insufficient utilization when integrating information of different scales, it is difficult to form a unified feature representation with high discriminability, therefore, the prior art generally has the problems of fuzzy classification boundary and performance decline when processing complex and variable mobile traffic data, especially the identification accuracy of sudden traffic, abnormal traffic and similar feature "difficult classification" application classes is significantly limited.

[0004] Therefore, how to design a mobile traffic classification method based on a multi-scale pyramid token sliding window to avoid the influence of complex and variable mobile traffic data and improve the accuracy of classification has become a problem to be solved. SUMMARY

[0005] Based on this, this invention proposes a mobile traffic classification method based on a multi-scale pyramid token sliding window. Tokenization converts continuous numerical sequences into discrete semantic token sequences. Based on the pyramid pooling principle, sliding windows of different scales are designed to segment the token sequences at multiple granularities to better capture their distribution characteristics and embed them into representations. Then, the multi-scale sliding window mechanism converts the segments into fixed-length vector representations, achieving effective fusion of multi-scale features. LSTM is applied for deep feature extraction, capturing the forward and backward temporal dependencies within each sub-sequence segment. Furthermore, an attention mechanism is introduced at each time step output to enhance the representation of key features and features of difficult-to-classify and easily confused categories. This invention solves the problems of blurred classification boundaries and performance bottlenecks in existing mobile traffic classification methods caused by neglecting multi-scale information due to single-scale feature extraction and the lack of effective feature fusion strategies, thus improving classification accuracy.

[0006] This invention proposes a mobile traffic classification method based on a multi-scale pyramid token sliding window, comprising:

[0007] Mobile traffic data is acquired and preprocessed to obtain a mobile traffic spatiotemporal sequence. The preprocessing is based on multimodal spatiotemporal feature data, and the mobile traffic spatiotemporal sequence includes a packet length sequence and a spatiotemporal interval sequence.

[0008] The mobile traffic spatiotemporal sequence is tokenized to obtain a mobile traffic token sequence. The tokenization process includes packet length sequence tokenization and time interval sequence tokenization.

[0009] The mobile traffic token sequence is feature extracted using a multi-scale sliding window to obtain bidirectional temporal features of mobile traffic. The feature extraction is based on a sliding window with a pyramid-incrementing structure.

[0010] The bidirectional temporal features of the mobile traffic are fused to obtain multimodal and multiscale fused features, wherein the feature fusion is based on multiscale splicing and cross-modal fusion.

[0011] Classification is performed based on the multimodal and multiscale fusion features to obtain the final classification result.

[0012] In summary, according to the mobile traffic classification method based on the multi-scale pyramid token sliding window, the continuous numerical sequence is converted into a discrete semantic token sequence through tokenization processing, different scales of sliding windows are designed based on the pyramid pooling principle, the token sequence is divided into multiple granularities, the distribution characteristics are better captured and embedded, the multi-scale sliding window mechanism is used to convert the fragments into fixed-length vector representation, the effective fusion of multi-scale features is realized, and LSTM is used for deep feature extraction, the forward and backward time sequence dependence in each sub-sequence fragment is captured, and the attention mechanism is introduced at each time step output, and the feature representation of key features and difficult classification and easily confused categories is strengthened. The present application solves the problems of fuzzy classification boundary and performance bottleneck caused by ignoring multi-scale information and lacking effective feature fusion strategy in the existing mobile traffic classification method, and improves the accuracy of classification. Specifically, mobile traffic data is acquired and preprocessed to obtain mobile traffic space-time sequences, the preprocessing is based on multi-modal space-time feature data, the mobile traffic space-time sequences include packet length sequences and time interval sequences, and the preprocessing provides a basis for subsequent processing, the mobile traffic space-time sequences are tokenized to obtain mobile traffic token sequences, the tokenization processing includes packet length sequence tokenization processing and time interval sequence tokenization processing, the distribution characteristics are better captured and embedded, and the mobile traffic token sequences are extracted according to the multi-scale sliding window to obtain mobile traffic bidirectional time sequence features, the feature extraction is based on the sliding window of the pyramid incremental structure, the forward and backward time sequence dependence in each sub-sequence fragment is captured, the mobile traffic bidirectional time sequence features are fused to obtain multi-modal multi-scale fusion features, the feature fusion is based on multi-scale splicing and cross-modal fusion, and the feature representation of key features and difficult classification and easily confused categories is strengthened, and the multi-modal multi-scale fusion features are classified to obtain the final classification result. The present application solves the problems of fuzzy classification boundary and performance bottleneck caused by ignoring multi-scale information and lacking effective feature fusion strategy in the existing mobile traffic classification method, and improves the accuracy of classification.

[0013] Further, the step of acquiring mobile traffic data and preprocessing to obtain mobile traffic space-time sequences specifically includes:

[0014] Mobile traffic data is acquired and original traffic session flow extraction is performed to obtain a plurality of original traffic session flows, each original traffic session flow includes single complete application layer communication process data;

[0015] According to the data packet arrival order, the data packet length values of each original traffic session flow are extracted to obtain a packet length original sequence, and the packet length original sequence is subjected to truncation processing and zero padding processing to obtain a packet length sequence, the packet length sequence being a normalized packet length numerical sequence with fixed length values;

[0016] The adjacent data packet arrival time intervals are calculated to obtain a time interval original sequence, and the time interval original sequence is subjected to truncation processing and zero padding processing to obtain a time interval sequence, the time interval sequence being a normalized time interval numerical sequence with fixed length values;

[0017] The packet length sequence and the time interval sequence are subjected to normalization processing.

[0018] Further, the step of tokenizing the mobile traffic spatio-temporal sequence to obtain a mobile traffic token sequence specifically includes:

[0019] The mobile traffic spatio-temporal sequence is tokenized according to an equal-frequency binning algorithm;

[0020] The tokenization processing includes packet length sequence tokenization processing and time interval sequence tokenization processing;

[0021] The packet length sequence tokenization processing includes: determining a packet length binning boundary, dividing continuous packet length values in the packet length sequence into different intervals, each interval having a unique corresponding token ID, and converting the packet length values in the packet length sequence into corresponding token IDs according to the intervals to obtain a packet length token sequence;

[0022] The time interval sequence tokenization processing includes: determining a time interval binning boundary, mapping continuous time interval numerical values in the time interval sequence into a discrete token sequence to obtain a time interval token sequence, each token ID in the time interval token sequence having a unique corresponding time interval numerical value;

[0023] Each token ID in the packet length token sequence and the time interval token sequence is subjected to a trainable embedding layer, the embedding layer being used to map the token ID into a dense vector representation to obtain a packet length embedding matrix and a time interval embedding matrix, and the mobile traffic token sequence is obtained according to the packet length embedding matrix and the time interval embedding matrix.

[0024] Further, the step of extracting features from the mobile traffic token sequence according to a multi-scale sliding window to obtain mobile traffic bidirectional time sequence features specifically includes:

[0025] According to the multi-scale sliding window, the mobile traffic token sequence is extracted, and the multi-scale sliding window is a set of sliding windows of different scales, and the size of the sliding window in the set is arranged in a pyramid increasing structure;

[0026] The mobile traffic token sequence is multi-scale sequence segmented to obtain a plurality of mobile traffic token sub-sequence segments, and the multi-scale sequence segmentation is slidingly segmented by each sliding window in the set;

[0027] The mobile traffic token sub-sequence segment under each scale is respectively input into the bidirectional long short-term memory network for feature encoding, and the final hidden states of the forward and backward directions in the bidirectional long short-term memory network are spliced to obtain hidden state features, and the specific algorithm of the feature encoding is as follows:

[0028] ,

[0029] ,

[0030] ,

[0031] ,

[0032] Among them, represents the packet length mode forward timing feature encoding, represents the packet length mode backward timing feature encoding, represents the time interval mode forward timing feature encoding, represents the time interval mode backward timing feature encoding, represents the bidirectional long short-term memory network, represents the scale, represents the packet length mode, represents the time interval mode, represents the time step index, represents the window scale, represents the mobile traffic token sub-sequence segment of the packet length mode, represents the mobile traffic token sub-sequence segment of the time interval mode, represents the number of hidden units of a single direction of the bidirectional long short-term memory network, represents the packet length mode hidden state feature, represents the time interval mode hidden state feature;

[0033] According to the hidden state feature, the mobile traffic bidirectional timing feature is obtained.

[0034] Further, the mobile traffic bidirectional timing feature is fused to obtain a multi-modal multi-scale fusion feature.

[0035] respectively, the intra-modal multi-scale splicing is performed on the packet length modal and the time interval modal in the mobile traffic bidirectional time sequence feature, the intra-modal multi-scale splicing fuses all features of the same scale in the same modal to obtain intra-modal fusion features of different scales, and then the intra-modal fusion features of different scales are spliced to obtain intra-modal multi-scale fusion features;

[0036] The intra-modal multi-scale fusion features of different modalities are cross-modal fused to obtain multi-modal multi-scale fusion features.

[0037] Further, the step of cross-modal fusion of intra-modal multi-scale fusion features of different modalities to obtain multi-modal multi-scale fusion features further comprises:

[0038] The attention weight of each time step corresponding feature in the multi-modal multi-scale fusion feature is calculated, and the specific algorithm of the attention weight is as follows:

[0039] ,

[0040] ,

[0041] wherein, Attention score Learnable parameter, Nonlinear activation function, Weight matrix, Bias vector Time step corresponding feature, i Time step, Attention weight, Total time step, j Cycle index;

[0042] The weighted sum is performed according to the attention weight to obtain a global semantic representation vector, and the specific algorithm of obtaining the global semantic representation vector is as follows:

[0043] ,

[0044] wherein, Global semantic representation vector.

[0045] Further, the step of classifying according to the multi-modal multi-scale fusion feature to obtain the final classification result comprises:

[0046] Input the multi-modal multi-scale fusion feature into a full connection layer, obtain an unnormalized classification score vector through linear transformation, and obtain a mobile application category prediction probability distribution of the unnormalized classification score vector according to a Softmax function;

[0047] According to the cross-entropy loss function, the classification loss is optimized, and according to the reconstruction loss based on the automatic encoder, the representative feature constraint is performed, the weighted sum of the classification loss and the reconstruction loss is calculated, and the end-to-end model optimization is performed through the gradient descent algorithm.

[0048] The application provides a mobile traffic classification system based on a multi-scale pyramid token sliding window, which comprises:

[0049] A preprocessing module is configured to acquire mobile traffic data and perform preprocessing to obtain a mobile traffic space-time sequence, wherein the preprocessing is based on multi-modal space-time feature data, and the mobile traffic space-time sequence comprises a packet length sequence and a time interval sequence.

[0050] A tokenization processing module is configured to perform tokenization processing on the mobile traffic space-time sequence to obtain a mobile traffic token sequence, wherein the tokenization processing comprises packet length sequence tokenization processing and time interval sequence tokenization processing.

[0051] A feature extraction module is configured to perform feature extraction on the mobile traffic token sequence according to a multi-scale sliding window to obtain mobile traffic bidirectional time sequence features, wherein the feature extraction is based on a pyramid incremental structure sliding window.

[0052] A feature fusion module is configured to perform feature fusion on the mobile traffic bidirectional time sequence features to obtain multi-modal multi-scale fusion features, wherein the feature fusion is based on multi-scale splicing and cross-modal fusion.

[0053] A classification module is configured to perform classification according to the multi-modal multi-scale fusion features to obtain a final classification result.

[0054] The application further provides a storage medium, which stores one or more programs, and the programs are executed by a processor to implement the mobile traffic classification method based on the multi-scale pyramid token sliding window.

[0055] The application further provides a computer device, which comprises a memory and a processor.

[0056] The memory is configured to store a computer program.

[0057] The processor is configured to execute the computer program stored in the memory to implement the mobile traffic classification method based on the multi-scale pyramid token sliding window. BRIEF DESCRIPTION OF DRAWINGS

[0058] Figure 1 The flowchart shows the mobile traffic classification method based on a multi-scale pyramid token sliding window proposed in the first embodiment of the present invention.

[0059] Figure 2 This is a schematic diagram of the structure of the mobile traffic classification system based on a multi-scale pyramid token sliding window proposed in the second embodiment of the present invention.

[0060] The following detailed description, in conjunction with the accompanying drawings, will further illustrate the present invention. Detailed Implementation

[0061] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Several embodiments of the invention are illustrated in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete.

[0062] It should be noted that when a component is said to be "fixed to" another component, it can be directly on the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.

[0063] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0064] Please see Figure 1 The diagram shows a flowchart of the mobile traffic classification method based on a multi-scale pyramid token sliding window proposed in the first embodiment of the present invention. This mobile traffic classification method based on a multi-scale pyramid token sliding window includes steps S01 to S05, wherein:

[0065] Step S01: Acquire mobile traffic data and preprocess it to obtain the spatiotemporal sequence of mobile traffic;

[0066] It should be noted that in the embodiment, the preprocessing is based on the multi-modal spatio-temporal feature data, the mobile traffic spatio-temporal sequence includes a packet length sequence and a time interval sequence, mobile traffic data is acquired and original traffic flow extraction is performed to acquire a plurality of original traffic flows, each of the original traffic flows includes single complete application layer communication process data;

[0067] The packet length values of each original traffic flow are extracted according to the packet arrival order to acquire a packet length original sequence, and the packet length original sequence is subjected to truncation processing and zero padding processing to acquire a packet length sequence, the packet length sequence being a normalized packet length numerical sequence with fixed length values;

[0068] The adjacent packet arrival time intervals are calculated to acquire a time interval original sequence, and the time interval original sequence is subjected to truncation processing and zero padding processing to acquire a time interval sequence, the time interval sequence being a normalized time interval numerical sequence with fixed length values;

[0069] The packet length sequence and the time interval sequence are subjected to normalization processing.

[0070] Step S02: Tokenization processing is performed on the mobile traffic spatio-temporal sequence to acquire a mobile traffic token sequence;

[0071] It should be noted that in the embodiment, the tokenization processing includes packet length sequence tokenization processing and time interval sequence tokenization processing, and the tokenization processing is performed on the mobile traffic spatio-temporal sequence according to an equal frequency binning algorithm;

[0072] The tokenization processing includes packet length sequence tokenization processing and time interval sequence tokenization processing;

[0073] The packet length sequence tokenization processing includes determining packet length binning boundaries, dividing continuous packet length values in the packet length sequence into different intervals, each of the intervals having a unique corresponding token ID, and converting the packet length values in the packet length sequence into corresponding token IDs according to the intervals to acquire a packet length token sequence;

[0074] The time interval sequence tokenization processing includes determining time interval binning boundaries, mapping continuous time interval numerical values in the time interval sequence into a discrete token sequence to acquire a time interval token sequence, each token ID in the time interval token sequence having a unique corresponding time interval numerical value;

[0075] Each token ID in the packet length token sequence and the time interval token sequence is subjected to a trainable embedding layer, the embedding layer being used to map the token ID into a dense vector representation to acquire a packet length embedding matrix and a time interval embedding matrix, and the mobile traffic token sequence is acquired according to the packet length embedding matrix and the time interval embedding matrix.

[0076] Step S03: feature extraction is performed on the mobile flow token sequence according to a multi-scale sliding window to obtain mobile flow bidirectional time sequence features;

[0077] It should be noted that in the embodiment, the feature extraction is based on a sliding window of a pyramid increasing structure, and the mobile flow token sequence is extracted according to a multi-scale sliding window, the multi-scale sliding window being a set of sliding windows of different scales, and the sizes of the sliding windows in the set are sorted according to a pyramid increasing structure;

[0078] The mobile flow token sequence is subjected to multi-scale sequence segmentation to obtain a plurality of mobile flow token sub-sequence segments, and the multi-scale sequence segmentation is performed by sliding segmentation through each sliding window in the set;

[0079] The mobile flow token sub-sequence segments at each scale are respectively input into a bidirectional long short-term memory network for feature encoding, and the final hidden states in the bidirectional long short-term memory network are spliced to obtain hidden state features, and the specific algorithm of the feature encoding is as follows:

[0080] ,

[0081] ,

[0082] ,

[0083] ,

[0084] wherein, represents a packet length mode forward time sequence feature encoding, represents a packet length mode backward time sequence feature encoding, represents a time interval mode forward time sequence feature encoding, represents a time interval mode backward time sequence feature encoding, represents a bidirectional long short-term memory network, represents a scale, represents a packet length mode, represents a time interval mode, represents a time step index, represents a window scale, represents a mobile flow token sub-sequence segment of the packet length mode, represents a mobile flow token sub-sequence segment of the time interval mode, represents a number of hidden units of a single direction of the bidirectional long short-term memory network, represents a packet length mode hidden state feature, represents a time interval mode hidden state feature;

[0085] According to the hidden state feature, a bidirectional time sequence feature of mobile traffic is acquired.

[0086] Step S04: Feature fusion is performed on the bidirectional time sequence feature of mobile traffic to acquire a multi-modal multi-scale fusion feature.

[0087] It should be noted that in the embodiment, the feature fusion is based on multi-scale splicing and cross-modal fusion. The features of the packet length modal and the time interval modal in the bidirectional time sequence feature of mobile traffic are respectively subjected to intra-modal multi-scale splicing. The intra-modal multi-scale splicing fuses all features of the same scale in the same modal to acquire intra-modal fusion features of different scales, and then multi-scale splicing is performed on the intra-modal fusion features of different scales to acquire intra-modal multi-scale fusion features.

[0088] The intra-modal multi-scale fusion features of different modalities are subjected to cross-modal fusion to acquire a multi-modal multi-scale fusion feature. An attention weight of a feature corresponding to each time step in the multi-modal multi-scale fusion feature is calculated. The specific algorithm of the attention weight is as follows:

[0089]

[0090]

[0091] wherein, indicates an attention score indicates a learnable parameter, indicates a nonlinear activation function, a weight matrix, indicates a bias vector indicates a feature corresponding to a time step, i indicates a time step, indicates an attention weight, indicates a total time step, j indicates a cycle index.

[0092] According to the attention weight, weighted summation is performed to acquire a global semantic representation vector. The specific algorithm of acquiring the global semantic representation vector is as follows:

[0093]

[0094] wherein, indicates a global semantic representation vector.

[0095] Step S05: Classification is performed according to the multi-modal multi-scale fusion feature to acquire a final classification result.

[0096] ​​​It should be noted that in the embodiment, the multi-modal multi-scale fusion features are input into the full connection layer, the unnormalized classification score vector is obtained through linear transformation, and the mobile application category prediction probability distribution of the unnormalized classification score vector is obtained according to the Softmax function.

[0097] According to the cross-entropy loss function, the classification loss is optimized, and then the reconstruction loss based on the automatic encoder is used to constrain the representative features, the weighted sum of the classification loss and the reconstruction loss is calculated, and the end-to-end model optimization is performed through the gradient descent algorithm.

[0098] In summary, according to the above-mentioned mobile traffic classification method based on a multi-scale pyramid token sliding window, the continuous numerical sequence is converted into a discrete semantic token sequence through tokenization processing, different scale sliding windows are designed based on the pyramid pooling principle, the token sequence is divided into multiple granularities, the distribution characteristics are better captured and embedded, then the multi-scale sliding window mechanism is used to convert the fragments into fixed-length vector representations, the effective fusion of multi-scale features is realized, and LSTM is used for deep feature extraction to capture the forward and backward time sequence dependency relationship in each sub-sequence fragment. In addition, the attention mechanism is introduced at each time step output to strengthen the feature representation of key features and difficult-to-classify and easily-confused categories. The present application solves the problems of fuzzy classification boundary and performance bottleneck caused by ignoring multi-scale information and lacking effective feature fusion strategy in the existing mobile traffic classification method, and improves the accuracy of classification. Specifically, mobile traffic data is obtained and preprocessed to obtain mobile traffic space-time sequences, the preprocessing is based on multi-modal space-time feature data, and the mobile traffic space-time sequences include packet length sequences and time interval sequences, which provide a basis for subsequent processing. Tokenization processing is performed on the mobile traffic space-time sequences to obtain mobile traffic token sequences, the tokenization processing includes packet length sequence tokenization processing and time interval sequence tokenization processing, which better captures the distribution characteristics and embedded representation. According to the multi-scale sliding window, the mobile traffic token sequence is extracted to obtain mobile traffic bidirectional time sequence features, the feature extraction is based on the sliding window of the pyramid incremental structure, which captures the forward and backward time sequence dependency relationship in each sub-sequence fragment. The mobile traffic bidirectional time sequence features are fused to obtain multi-modal multi-scale fusion features, the feature fusion is based on multi-scale splicing and cross-modal fusion, which strengthens the feature representation of key features and difficult-to-classify and easily-confused categories. The multi-modal multi-scale fusion features are classified to obtain the final classification result. The present application solves the problems of fuzzy classification boundary and performance bottleneck caused by ignoring multi-scale information and lacking effective feature fusion strategy in the existing mobile traffic classification method, and improves the accuracy of classification.

[0099] Please refer to Figure 2As shown in the structural schematic diagram of the mobile traffic classification system based on the multi-scale pyramid token sliding window according to the second embodiment of the present application, the system comprises:

[0100] A preprocessing module 10 is configured to acquire mobile traffic data and perform preprocessing to obtain a mobile traffic spatio-temporal sequence, wherein the preprocessing is based on multi-modal spatio-temporal feature data, and the mobile traffic spatio-temporal sequence comprises a packet length sequence and a time interval sequence;

[0101] A tokenization processing module 20 is configured to perform tokenization processing on the mobile traffic spatio-temporal sequence to obtain a mobile traffic token sequence, wherein the tokenization processing comprises packet length sequence tokenization processing and time interval sequence tokenization processing;

[0102] A feature extraction module 30 is configured to perform feature extraction on the mobile traffic token sequence according to a multi-scale sliding window to obtain mobile traffic bidirectional time series features, wherein the feature extraction is based on a sliding window of a pyramid incremental structure;

[0103] A feature fusion module 40 is configured to perform feature fusion on the mobile traffic bidirectional time series features to obtain multi-modal multi-scale fusion features, wherein the feature fusion is based on multi-scale splicing and cross-modal fusion;

[0104] A classification module 50 is configured to perform classification according to the multi-modal multi-scale fusion features to obtain a final classification result.

[0105] The present application further provides a computer storage medium having one or more programs stored thereon, which programs, when executed by a processor, implement the mobile traffic classification method based on the multi-scale pyramid token sliding window.

[0106] The present application further provides a computer device comprising a memory and a processor, wherein the memory is configured to store a computer program, and the processor is configured to execute the computer program stored in the memory to implement the mobile traffic classification method based on the multi-scale pyramid token sliding window.

[0107] Those skilled in the art can understand that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logical functions, which can be embodied in any computer readable medium for use by or in conjunction with an instruction execution system, apparatus or device, such as a computer-based system, a system including a processor or other system that can fetch and execute instructions from an instruction execution system, apparatus or device. For the present specification, the "computer readable medium" can be any device that can contain, store, communicate, propagate or transport programs for use by or in conjunction with an instruction execution system, apparatus or device, or in conjunction with these instruction execution systems, apparatus or devices.

[0108] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can also be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via an optical scanner, then compiled, interpreted, or otherwise processed, and stored in a computer memory in a form that is then employable by a computer. In some embodiments, the example computer-readable storage medium can be non-transitory. For example, in some embodiments, the example computer-readable storage medium can be a non-transitory medium.

[0109] It should be understood that aspects of the application can be implemented in hardware, software, firmware, or combinations thereof. In the embodiments described above, various steps or methods can be implemented, for example, by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and in another embodiment, any of the following techniques can be used to implement the hardware: discrete logic circuits having logic gates for implementing logic functions upon data signals, application specific integrated circuits having logic gates for implementing logic functions upon data signals, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0110] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in one or more embodiments or examples.

[0111] The above-described embodiments are merely some embodiments of the present application, and the description is more specific and detailed, but should not be construed as limiting the scope of the present application. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, and these are within the scope of the present application. Therefore, the scope of the present application should be determined by the appended claims.

Claims

1. A mobile traffic classification method based on a multi-scale pyramid token sliding window, characterized in that, include: Mobile traffic data is acquired and preprocessed to obtain a mobile traffic spatiotemporal sequence. The preprocessing is based on multimodal spatiotemporal feature data, and the mobile traffic spatiotemporal sequence includes a packet length sequence and a spatiotemporal interval sequence. The mobile traffic spatiotemporal sequence is tokenized to obtain a mobile traffic token sequence. The tokenization process includes packet length sequence tokenization and time interval sequence tokenization. The mobile traffic token sequence is feature extracted using a multi-scale sliding window to obtain bidirectional temporal features of mobile traffic. The feature extraction is based on a sliding window with a pyramid-incrementing structure. The step of extracting features from the mobile traffic token sequence based on a multi-scale sliding window to obtain bidirectional temporal features of mobile traffic specifically includes: Feature extraction of mobile traffic token sequences is performed based on multi-scale sliding windows, wherein the multi-scale sliding window is a set of sliding windows of different scales, and the size of the sliding windows in the set is ordered in an ascending pyramid structure. The mobile traffic token sequence is segmented at multiple scales to obtain multiple mobile traffic token subsequence fragments. The multi-scale sequence segmentation is performed by sliding segmentation through each sliding window in the set. The mobile traffic token subsequence fragments at each scale are input into a bidirectional long short-term memory network for feature encoding. The final hidden states of the forward and backward passes in the bidirectional long short-term memory network are then concatenated to obtain the hidden state features. The specific algorithm for feature encoding is as follows: ， ， ， ， in, This represents the positive temporal feature encoding of the packet length modality. This represents the backward temporal feature encoding of the packet length modality. This represents the positive temporal feature encoding of the time interval mode. This represents the backward temporal feature encoding of the time interval mode. This represents a bidirectional long short-term memory network. Indicates scale. Indicates the packet length mode, Indicates time interval mode, Indicates the time step index. Indicates window size. This represents a fragment of the mobile traffic token subsequence representing the packet length modality. A fragment of a mobile traffic token sequence representing a time interval mode. This represents the number of hidden units in a single direction of a bidirectional long short-term memory network. Represents the hidden state features of the packet-length modality. Represents the hidden state features of the time interval mode; Based on the hidden state features, obtain the bidirectional temporal features of mobile traffic; The bidirectional temporal features of the mobile traffic are fused to obtain multimodal and multiscale fused features, wherein the feature fusion is based on multiscale splicing and cross-modal fusion. The step of fusing the bidirectional temporal features of the mobile traffic to obtain multimodal, multi-scale fused features specifically includes: Intramodal multi-scale stitching is performed on the packet length mode and time interval mode features in the bidirectional time series features of mobile traffic. The intramodal multi-scale stitching fuses all features of the same scale within the same mode to obtain intramodal fused features of different scales. Then, the intramodal fused features of different scales are stitched together at multiple scales to obtain intramodal multi-scale fused features. Cross-modal fusion is performed on intramodal multi-scale fusion features of different modalities to obtain multimodal multi-scale fusion features; Classification is performed based on the multimodal and multiscale fusion features to obtain the final classification result.

2. The mobile traffic classification method based on a multi-scale pyramid token sliding window according to claim 1, characterized in that, The step of acquiring mobile traffic data and preprocessing it to obtain a spatiotemporal sequence of mobile traffic specifically includes: Mobile traffic data is acquired and raw traffic session streams are extracted to obtain multiple raw traffic session streams, each of which includes data from a single complete application layer communication process. The packet length value of each original traffic session stream is extracted according to the arrival order of the packets to obtain the original packet length sequence. Then, the original packet length sequence is truncated and zero-padding is performed to obtain the packet length sequence, which is a normalized packet length numerical sequence with a fixed length value. Calculate the arrival time interval between adjacent data packets to obtain the original time interval sequence, and then perform truncation and zero-padding on the original time interval sequence to obtain the time interval sequence, which is a normalized time interval numerical sequence of fixed length values. The packet length sequence and the time interval sequence are normalized.

3. The mobile traffic classification method based on a multi-scale pyramid token sliding window according to claim 1, characterized in that, The step of tokenizing the spatiotemporal sequence of mobile traffic to obtain a mobile traffic token sequence specifically includes: The spatiotemporal sequence of mobile traffic is tokenized according to the equal-frequency binning algorithm; The tokenization process includes packet-length sequence tokenization and time interval sequence tokenization; The packet length sequence tokenization process includes: determining the packet length bin boundaries, dividing the continuous packet length values ​​in the packet length sequence into different intervals, each interval having a unique corresponding token ID, and converting the packet length values ​​in the packet length sequence into the corresponding token IDs according to the intervals to obtain the packet length token sequence; The time interval sequence tokenization process includes: determining the time interval bin boundaries, mapping continuous time interval values ​​in the time interval sequence to discrete token sequences to obtain a time interval token sequence, wherein each token ID in the time interval token sequence has a unique corresponding time interval value; Each token ID in the packet length token sequence and the time interval token sequence is passed through a trainable embedding layer, which maps the token ID to a dense vector representation to obtain a packet length embedding matrix and a time interval embedding matrix, and a mobile traffic token sequence is obtained based on the packet length embedding matrix and the time interval embedding matrix.

4. The mobile traffic classification method based on a multi-scale pyramid token sliding window according to claim 1, characterized in that, The step of performing cross-modal fusion of intra-modal multi-scale fusion features of different modalities to obtain multi-modal multi-scale fusion features further includes: The attention weights for each time step in the multimodal, multi-scale fused features are calculated using the following algorithm: ， ， in, Indicates attention score, Indicates learnable parameters, Represents a non-linear activation function. Represents the weight matrix. This represents the bias vector. Indicates the features corresponding to the time steps. i Indicates a time step. Indicates attention weights. Indicates the total time steps. j Indicates a circular index; The global semantic representation vector is obtained by weighted summation based on the attention weights. The specific algorithm for obtaining the global semantic representation vector is as follows: ， in, This represents the global semantic representation vector.

5. The mobile traffic classification method based on a multi-scale pyramid token sliding window according to claim 1, characterized in that, The step of classifying based on the multimodal, multi-scale fusion features to obtain the final classification result specifically includes: Multimodal and multiscale fused features are input into a fully connected layer, and an unnormalized classification score vector is obtained through linear transformation. The mobile application category prediction probability distribution of the unnormalized classification score vector is obtained according to the Softmax function. The classification loss is optimized based on the cross-entropy loss function. Then, the reconstruction loss based on the autoencoder is used to constrain the representative features. The weighted sum of the classification loss and the reconstruction loss is calculated, and the end-to-end model is optimized using the gradient descent algorithm.

6. A mobile traffic classification system based on a multi-scale pyramid token sliding window, characterized in that, include: The preprocessing module is used to acquire mobile traffic data and perform preprocessing to obtain a mobile traffic spatiotemporal sequence. The preprocessing is based on multimodal spatiotemporal feature data, and the mobile traffic spatiotemporal sequence includes a packet length sequence and a spatiotemporal interval sequence. The tokenization processing module is used to perform tokenization processing on the spatiotemporal sequence of mobile traffic to obtain a mobile traffic token sequence. The tokenization processing includes packet length sequence tokenization processing and time interval sequence tokenization processing. The feature extraction module is used to extract features from the mobile traffic token sequence based on a multi-scale sliding window to obtain bidirectional temporal features of mobile traffic. The feature extraction is based on a sliding window with an increasing pyramid structure. The step of extracting features from the mobile traffic token sequence based on a multi-scale sliding window to obtain bidirectional temporal features of mobile traffic specifically includes: Feature extraction of mobile traffic token sequences is performed based on multi-scale sliding windows, wherein the multi-scale sliding window is a set of sliding windows of different scales, and the size of the sliding windows in the set is ordered in an ascending pyramid structure. The mobile traffic token sequence is segmented at multiple scales to obtain multiple mobile traffic token subsequence fragments. The multi-scale sequence segmentation is performed by sliding segmentation through each sliding window in the set. The mobile traffic token subsequence fragments at each scale are input into a bidirectional long short-term memory network for feature encoding. The final hidden states of the forward and backward passes in the bidirectional long short-term memory network are then concatenated to obtain the hidden state features. The specific algorithm for feature encoding is as follows: ， ， ， ， in, This represents the positive temporal feature encoding of the packet length modality. This represents the backward temporal feature encoding of the packet length modality. This represents the positive temporal feature encoding of the time interval mode. This represents the backward temporal feature encoding of the time interval mode. This represents a bidirectional long short-term memory network. Indicates scale. Indicates the packet length mode, Indicates time interval mode, Indicates the time step index. Indicates window size. This represents a fragment of the mobile traffic token subsequence representing the packet length modality. A fragment of a mobile traffic token sequence representing a time interval mode. This represents the number of hidden units in a single direction of a bidirectional long short-term memory network. Represents the hidden state features of the packet-length modality. Represents the hidden state features of the time interval mode; Based on the hidden state features, obtain the bidirectional temporal features of mobile traffic; The feature fusion module is used to perform feature fusion on the bidirectional temporal features of the mobile traffic to obtain multimodal and multiscale fused features. The feature fusion is based on multiscale splicing and cross-modal fusion. The step of fusing the bidirectional temporal features of the mobile traffic to obtain multimodal, multi-scale fused features specifically includes: Intramodal multi-scale stitching is performed on the packet length mode and time interval mode features in the bidirectional time series features of mobile traffic. The intramodal multi-scale stitching fuses all features of the same scale within the same mode to obtain intramodal fused features of different scales. Then, the intramodal fused features of different scales are stitched together at multiple scales to obtain intramodal multi-scale fused features. Cross-modal fusion is performed on intramodal multi-scale fusion features of different modalities to obtain multimodal multi-scale fusion features; The classification module is used to classify based on the multimodal and multiscale fusion features to obtain the final classification result.

7. A storage medium, characterized in that, The storage medium stores one or more programs that, when executed by a processor, implement the mobile traffic classification method based on a multi-scale pyramid token sliding window as described in any one of claims 1-5.

8. A computer device, characterized in that, The computer device includes a memory and a processor, wherein: The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the mobile traffic classification method based on a multi-scale pyramid token sliding window as described in any one of claims 1-5.

Images