End-to-end fine-grained encrypted traffic classification method based on open set semi-supervised learning

Abstract

The invention belongs to the technical field of malicious encrypted traffic detection, and discloses an end-to-end fine-grained encrypted traffic classification method based on open set semi-supervised learning, and the method comprises the steps: processing original traffic PACP data, and extracting traffic detail discrimination information through employing a double-branch feature extraction module; through a known / unknown classification method based on an energy model, learning an energy boundary to distinguish known category flow and unknown category flow, and classifying the known category flow; further performing fine-grained division on the flow of the unknown category through a self-adaptive deep clustering method; and through an end-to-end joint training strategy, alternately and iteratively training the known / unknown classification module and the unknown adaptive clustering module based on the energy model to obtain a final end-to-end fine-grained encrypted traffic classification model. According to the method, the classification problem of known and unknown types of encrypted traffic in an open world scene can be more reliably solved, and the robustness and generalization of encrypted traffic detection are improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of malicious encrypted traffic detection, and specifically relates to an end-to-end fine-grained encrypted traffic classification method based on open set semi-supervised learning. BACKGROUND

[0002] With the increasing progress of network technology, traffic classification has become a core technology for improving network management efficiency, optimizing service quality (QoS), and ensuring network security (such as malware identification and intrusion detection). However, with the increasing awareness of user privacy protection and the continuous progress of encryption technology, the proportion of encrypted traffic has risen sharply. Although encryption technology effectively protects user privacy, it also poses unprecedented challenges to network security regulation. Traditional methods of traffic analysis and detection based on plaintext gradually lose effectiveness because they cannot directly analyze the content of network packets. More and more malware and network attacks use encrypted channels such as SSL / TLS to evade detection, making it difficult for intrusion detection systems (IDS) and firewalls to discover threats in a timely manner. According to the latest report, current network threats are initiated via encrypted channels, further highlighting the urgency of network encrypted traffic analysis and management.

[0003] In recent years, with the rapid development of machine learning and deep learning technologies, significant progress has been made in the task of encrypted traffic classification based on these methods. However, most existing methods are based on the closed world assumption, which assumes that the test data classes are known in the training phase, so they can only classify test data into a limited number of predefined classes. In real network environments, traffic types are highly dynamic and open, with new traffic types and attack methods emerging constantly, leading to the possibility of encountering never-before-seen traffic classes in the test phase.

[0004] Traditional closed-world classification models perform poorly when facing unseen traffic classes and are difficult to effectively identify unknown threats. Compared with the closed-world setting, the open-world scenario is more complex and needs to cope with the challenges brought by unknown new classes of traffic: one challenge is to require the traffic classification model to have open set recognition capability, that is, to identify new unknown traffic while performing fine-grained classification on known classes. Currently, there are some studies that use the confidence of the classifier to detect unknown classes, but this method is not reliable and is prone to misclassification of unknown samples with high confidence. In addition, there are also studies that propose a phased detection strategy, mainly using class-conditional autoencoders and reconstruction error to identify unknown attacks, but this method needs to train each stage separately, increasing the complexity of the training process, and error propagation between stages can reduce the overall detection performance. Another challenge is that the model needs to be able to efficiently estimate unknown new traffic classes, the purpose of which is to enable the model to learn new classes autonomously and provide threat analysis or expand the attack knowledge base for security management. Currently in the field of traffic classification, existing methods mainly rely on manual analysis or offline clustering, such as integrating multiple clustering algorithms by constructing an adjacency matrix, and using a cutting point to filter and a silhouette coefficient to evaluate the clustering results. But this method needs to rely too much on experience and needs to manually set algorithm parameters. SUMMARY

[0005] In order to solve the problem that the prior art cannot efficiently implement fine-grained detection of malicious encrypted traffic in an open-world scenario, the present application provides an end-to-end fine-grained encrypted traffic classification method, which can efficiently implement fine-grained detection of malicious encrypted traffic in an open-world scenario, maintain high robustness and high detection accuracy for encrypted malicious traffic in a real environment, and provide a more reliable solution for network security management, which has important guiding significance.

[0006] In order to achieve the above purpose, the present application is implemented by the following technical solutions:

[0007] The present application is an end-to-end fine-grained encrypted traffic classification method based on open set semi-supervised learning, comprising the following steps:

[0008] Step 1, extract the original traffic data in the network, the original traffic data includes multiple PCAP files, process the PCAP files, and use a double-branch feature extraction module to extract flow-level feature representations;

[0009] Step 2, in the training phase, learn an energy function using the input flow-level feature representations and the corresponding labels of the flow-level feature representations, output a global energy representation, and construct a boundary regularization loss based on the global energy representation based on the energy function, and combine the boundary regularization loss and the classification loss to obtain the total loss of the known and unknown classification modules for training In the inference stage, the energy values of the known flow level feature representations and the unknown flow level feature representations are calculated by using the learned energy function, and the energy boundaries of the known flow level feature representations and the unknown flow level feature representations are modeled by using the Weibull distribution, and the known class and the unknown class are identified by comparing with the energy threshold value;

[0010] Step 3, the identified unknown class traffic is divided in a fine-grained manner by an adaptive deep clustering method to obtain a multi-classification result of the unknown class traffic, that is, a clustering loss

[0011] Step 4, through an end-to-end joint training strategy, steps 2 and 3 are alternately iteratively trained to obtain a final end-to-end fine-grained encrypted traffic classification model, and data is trained by the end-to-end fine-grained encrypted traffic classification model to obtain a classification result.

[0012] Further improvements of the present application are that step 1 specifically comprises the following steps:

[0013] Step 1.1, each PCAP file is cut into independent bi-flows according to the session, m consecutive data packets are selected from each flow, and the header and payload of each data packet are processed respectively to obtain a flow header matrix and a flow payload matrix of a fixed size;

[0014] Step 1.2, the flow header matrix and the flow payload matrix are input into a convolution-enhanced Vision Transformer (ViT) to obtain a flow level feature representation of the flow header matrix and a flow level feature representation of the flow payload matrix, and the flow level feature representation of the flow header matrix and the flow level feature representation of the flow payload matrix are spliced to obtain a final flow level byte feature representation;

[0015] Step 1.3, each independent bi-flow is constructed into a flow interaction graph (FIG), data packets in the bi-flow are selected as nodes, and edges are constructed between the data packets;

[0016] Step 1.4, the flow interaction graph (FIG) constructed in step 1.3 is input into a GNN composed of a Topology Adaptive Graph Convolutional Networks (TAGCN) layer and a Readout layer to obtain a graph level representation of the bi-flow, that is, a flow interaction feature representation;

[0017] Step 1.5, the flow level byte feature representation obtained in step 1.2 and the flow interaction feature representation obtained in step 1.4 are spliced into a rich and comprehensive flow level feature representation h.

[0018] Further improvements of the present application are that step 1.1 specifically comprises the following steps:

[0019] Step 1.1.1, each PCAP file is cut into independent bi-flows according to the session, and for the data packets in the bi-flow, the Ethernet header is discarded and the IP address and port number are anonymized;

[0020] Step 1.1.2, from the flow obtained after anonymization in step 1.1.1, select continuous M data packets, and each data packet is divided into a head byte sequence and a payload byte sequence, and the two are processed respectively, and the head byte sequence of each data packet in the selected m data packets is reshaped into a matrix with a size of , and the size is unified by zero padding, then the head matrix of m data packets in each flow is spliced along the sequence dimension of the data packets to form a fixed-size flow head matrix satisfying wherein r represents the row, c represents the column, respectively represent the two dimensions of the head byte sequence matrix;

[0021] Step 1.1.3, the payload byte sequence of each data packet is reshaped into a matrix with a size of , and the size is unified by zero padding, then the flow payload matrix of m data packets in each flow is spliced along the sequence dimension of the data packets to form a fixed-size flow payload matrix satisfying wherein respectively represent the two dimensions of the payload byte sequence matrix, and p represents the payload.

[0022] Further improvement of the present application is that step 1.2 specifically comprises the following steps:

[0023] Step 1.2.1, for the flow head matrix, the flow head matrix x h is divided into a plurality of blocks with a size of P x P wherein N h is the total number of blocks;

[0024] Step 1.2.2, apply convolution operation to each block to extract local features of the block, and add position embedding based on the local features to retain position information, obtain embedded features, and input the obtained embedded features into a Transformer encoder composed of multi-head attention (MHA) and feed-forward network (FFN);

[0025] Step 1.2.3, for the flow payload matrix, the flow payload matrix x p is divided into a plurality of blocks with a size of P x P wherein N p is the total number of blocks;

[0026] Step 1.2.4, applying a convolution operation to each block extracts the local features of the block, while adding position embedding on the basis of the local features to retain position information, to obtain embedded features, and inputting the obtained embedded features into a Transformer encoder composed of multi-head attention (MHA) and a feed-forward network (FFN);

[0027] Step 1.2.5, for the flow header matrix and the flow load matrix, respectively passing through a global pooling operation to obtain a flow-level feature representation z h and a flow-level feature representation z p of the flow load matrix, respectively. h p Concatenating to obtain the final flow-level byte feature representation h b h p .

[0028] The further improvement of the present application is that step 1.3 specifically comprises the following steps:

[0029] Step 1.3.1, extracting visible attribute features of the data packet from multiple dimensions as node embedding, the attribute features including direction, length, timestamp, total number of data packets within a burst, total byte number of data packets within a burst, quantity ratio and total byte number ratio between adjacent data packets within a burst of the data packet;

[0030] Step 1.3.2, the data packet sequence in a flow is divided into multiple data packets within a burst according to a preset burst threshold, and a data packet node is connected by a directed edge:

[0031] For nodes within the same data packet within a burst, an intra-burst edge is constructed, that is, edges are sequentially added between nodes according to the timestamp order;

[0032] For nodes of adjacent data packets within a burst, an inter-burst edge is constructed, that is, the first node and the last node in each data packet within a burst are respectively connected to the corresponding first node and the last node in the previous data packet within a burst.

[0033] The further improvement of the present application is that step 1.4 specifically comprises the following steps:

[0034] Step 1.4.1, in the flow interaction graph (FIG), the initial feature of each node has D attribute features, where i = 1, 2,..., N v , and N v is the number of nodes in the flow interaction graph, which constitutes a feature matrix of all nodes where the dthdimensional feature is represented as a vector ​​​The feature matrix of all nodes and the adjacency matrix A of the flow interaction graph as the initial input of the TAGCN, and the feature matrix of all nodes is convoluted by a set of graph filters in different dimensions to extract output feature maps, and the obtained output feature maps are spliced to obtain updated node features

[0035] After obtaining the updated node features , the graph-level representation h of the flow is generated by the Readout layer g , that is, the flow interaction feature representation.

[0036] A further improvement of the present application is that the step 2 specifically comprises the following steps:

[0037] Step 2.1, aggregating the overall energy value E(h) of the flow-level feature representation h by using the Helmholtz free energy formula, and inputting the overall energy value E(h) into a discriminative classifier g(h) with C k +1 categories, wherein the first C k categories correspond to known categories, and the additional one category represents all unknown categories, and the discriminative classifier maps h into C k +1 logits values;

[0038] Step 2.2, comprehensively considering C k +1 categories by using the Gibbs distribution, re-representing the energy function, and outputting the global energy representation;

[0039] Step 2.3, based on the energy function, constructing a boundary regularization loss based on the global energy representation:

[0040]

[0041] wherein, represents the training distribution of the known category flow in the latent space, represents the training distribution of the unknown category flow in the latent space, m k is the energy boundary of the known flow-level feature representation, m u is the energy boundary of the unknown flow-level feature representation, and is the average value of the cross-entropy loss square of the sample, and y is the category of a certain sample;

[0042] Step 2.4, constructing a total loss for training the known and unknown classification modules by combining the boundary regularization loss and the classification loss

[0043]

[0044] wherein, represents the distribution of training data in latent space, λ is a hyperparameter for balancing the two loss functions; is the probability distribution of the class;

[0045] Step 2.5, in the inference stage, the known flow level feature representation energy value and the unknown flow level feature representation energy value are calculated by using the learned energy function, and the Weibull distribution is used to model the energy boundary of the known flow level feature representation and the energy boundary of the unknown flow level feature representation, and the known class and the unknown class are identified by comparing with the energy threshold value:

[0046]

[0047] wherein, E(h; g) represents the energy function, U represents the unknown class, represents the known class, when E(h; g) is less than the threshold value τ, the sample is classified into the known class with the minimum energy value; otherwise, the sample is determined as the unknown class.

[0048] Further improvement of the present application is that step 3 specifically comprises the following steps:

[0049] Step 3.1, for the sample identified as the unknown class, the sample is subjected to the double-branch flow feature extraction channel to obtain the feature representation, and the convolutional neural network is used for feature enhancement processing to obtain the enhanced feature x u ;

[0050] Step 3.2, in the initialization stage, the enhanced feature x u is subjected to preliminary clustering by using the clustering algorithm, and the corresponding initial pseudo label y

[0051] Step 3.3, according to the initial pseudo label y , a sample library is constructed for storing the unknown class features and the initial pseudo labels, and a clustering center library is constructed for saving the features of the current each clustering center;

[0052] Step 3.4, the unknown class features are updated by continuously updating the network, after the update, the unknown class features in the sample library are updated in the manner of momentum update, and the unknown class samples are re-assigned the pseudo labels according to the enhanced feature x u and the nearest neighbor clustering center

[0053] Step 3.5, a clustering loss L is constructed for training:

[0054]

[0055] wherein, l(·) is a cross-entropy loss function, ψ θ (·) represents a feature extraction network, and g'(·) represents a classifier.

[0056] The further improvement of the present application is that in step 4, the joint loss formula of the joint training strategy is:

[0057]

[0058] wherein, is a loss function for known / unknown classification tasks, including cross-entropy loss and energy-based boundary regularization loss, and is an unknown class clustering loss, and a is a hyperparameter, controlling the proper balance of the total loss and the clustering loss. In the training process, the relative importance is to achieve a proper balance between the two.

[0059] The further improvement of the present application is that the end-to-end fine-grained encrypted traffic classification model comprises a double-branch feature extraction module, a known and unknown classification module based on an energy model, and an adaptive unknown classification module,

[0060] The double-branch feature extraction module splices the byte feature representation and the flow interaction feature representation of the flow into a flow-level feature representation.

[0061] The known and unknown classification module based on the energy model is used for classifying known traffic and unknown traffic.

[0062] The adaptive unknown classification module adjusts the characteristics of feature extraction and unknown traffic classification by combining an adaptive deep clustering method, so as to realize the classification of unknown class traffic.

[0063] The beneficial effects of the present application are:

[0064] The present application can effectively cope with the known and unknown traffic classification in the open world scenario, the known and unknown traffic classification, and the unknown traffic clustering problem, has high robustness, and provides a solution for network security management.

[0065] The present application fully excavates the flow detail discrimination information through the double-branch feature extraction module, and introduces a constraint based on an energy model, realizes accurate distinction of known and unknown traffic, ensures reliable classification of known traffic, and improves the accuracy of model detection.

[0066] The present application realizes adaptive classification of unknown new class traffic by a kind of adaptive clustering method, corrects pseudo label generated by clustering with the help of feature learning, and realizes adaptive classification of unknown new class traffic through continuous iteration. BRIEF DESCRIPTION OF DRAWINGS

[0067] Figure 1 is a flow diagram of the present application.

[0068] Figure 2 is an end-to-end fine-grained encrypted traffic classification model diagram of the present application. DETAILED DESCRIPTION

[0069] The embodiments of the present application will be further described below with reference to the accompanying drawings.

[0070] The present application is an end-to-end fine-grained encrypted traffic classification method based on open set semi-supervised learning, which is realized through an end-to-end fine-grained encrypted traffic classification model, as shown in the figure, which includes a double-branch feature extraction module, a known and unknown classification module based on an energy model, and an adaptive unknown classification module. Figure 2 The double-branch feature extraction module splices the flow byte feature representation and the flow interaction feature representation into the flow-level feature representation; the known and unknown classification module based on the energy model is used for classifying known traffic and unknown traffic; the adaptive unknown classification module adjusts the adaptive deep clustering method in combination with the characteristics of feature extraction and unknown traffic classification to realize the classification of unknown class traffic.

[0071] The present application can effectively deal with the known and unknown traffic classification in the open world scenario, the known traffic classification, and the unknown traffic clustering problem through the use of double-branch feature extraction, known / unknown classification based on an energy model, and adaptive deep clustering, and has generalization and robustness.

[0072] Specifically, as shown in the figure, the present application is an end-to-end fine-grained encrypted traffic classification method based on open set semi-supervised learning, which specifically includes the following steps: Figure 1

[0073] Step 1, extract the original traffic data in the network, the original traffic data includes multiple PCAP files, process the PCAP files, use a double-branch feature extraction module to extract the flow-level feature representation. Specifically includes the following steps:

[0074] Step 1.1, cut each PCAP file into independent bi-flows according to the session, select m consecutive data packets from each flow, process the header and payload of each data packet respectively to obtain a flow header matrix and a flow payload matrix of a fixed size. Specifically:

[0075] Step 1.1.1, cut each PCAP file into independent bi-flows according to the session, for the data packets in the bi-flows, discard the Ethernet header and anonymize the IP address and port number, i.e. partial mask blurring; ​

[0076] Step 1.1.2, from the stream obtained after anonymization processing in step 1.1.1, select consecutive M data packets, each data packet is divided into a header byte sequence and a payload byte sequence, and the two parts are processed respectively, and the header byte sequence of each data packet in the selected m data packets is reshaped into a matrix with a size of and the size is unified by zero padding, then the header matrices of the m data packets in each stream are spliced along the sequence dimension of the data packets to form a fixed-size stream header matrix satisfies where r represents the row and c represents the column, respectively represent the two dimensions of the header byte sequence matrix.

[0077] Step 1.1.3, the payload byte sequence of each data packet is reshaped into a matrix with a size of and the size is unified by zero padding, then the stream payload matrices of the m data packets in each stream are spliced along the sequence dimension of the data packets to form a fixed-size stream payload matrix satisfies where respectively represent the two dimensions of the payload byte sequence matrix, and p represents the payload.

[0078] The application reshapes the byte matrix through a series of operations, maintains the consistency of the flow data, extracts the original byte information, retains the fine-grained content information, and better reflects the inherent characteristics of the stream.

[0079] Step 1.2, the stream header matrix and the stream payload matrix are subjected to convolution-enhanced Vision Transformer (ViT) to obtain stream-level feature representations of the header matrix and the stream-level feature representations of the stream payload matrix. The stream-level feature representations of the header matrix and the stream-level feature representations of the stream payload matrix are spliced to obtain the final stream-level byte feature representation, which includes the following steps:

[0080] Step 1.2.1, for the stream header matrix, the stream header matrix x h is divided into a plurality of blocks with a size of P x P where N h is the total number of blocks;

[0081] Step 1.2.2, apply a convolution operation to each block to extract the local features of the block, and add position embedding based on the local features to retain the position information, obtain embedded features, and input the obtained embedded features into a Transformer encoder composed of multi-head attention (MHA) and feedforward network (FFN);

[0082] Step 1.2.3, for the stream payload matrix, the stream payload matrix x pDivided into several blocks of size P x P

[0083] Step 1.2.4, applying a convolution operation to each block extracts the local features of the block, while adding position embedding on the basis of local features to retain position information, obtaining embedded features, and inputting the obtained embedded features into a Transformer encoder composed of multi-head attention (MHA) and feed-forward network (FFN);

[0084] Step 1.2.5, for the flow header matrix and the flow load matrix, respectively, through a global pooling operation to obtain the flow level feature representation z h and the flow level feature representation z p of the flow load matrix, respectively. h p Splicing obtains the final flow level byte feature representation h b = [z h , z p ].

[0085] The application uses a convolution-enhanced Vision Transformer, combines the local feature extraction of convolution and the global modeling capability of ViT, overcomes the defects of the classic ViT lacking local and translation invariance prior inductive bias, and efficiently extracts multi-level feature information from the original byte matrix.

[0086] Step 1.3, constructing each independent bidirectional flow into a flow interaction graph (FIG), selecting data packets in the bidirectional flow as nodes, and introducing intra-burst data packets between the data packets to construct edges, specifically including the following steps:

[0087] Step 1.3.1, extracting important attribute features visible in the data packet from multiple dimensions as node embedding, the attribute features including the direction, length, timestamp of the data packet, the total number of intra-burst data packets, the total byte number of intra-burst data packets, the quantity ratio and total byte number ratio between adjacent intra-burst data packets;

[0088] Step 1.3.2, the data packet sequence in a flow is divided into multiple intra-burst data packets according to a preset burst threshold, so based on the relationship between bursts, the data packet nodes are connected by undirected edges:

[0089] For the nodes in the same intra-burst data packet, the intra-burst edges are constructed to be connected, that is, the edges are sequentially added between the nodes according to the timestamp order;

[0090] The application captures attribute information that significantly reflects the interaction mode between hosts by constructing a flow interaction graph, which is crucial for effectively identifying and distinguishing normal and malicious behaviors. ​

[0091] For the nodes of adjacent intra-burst data packets, an inter-burst edge is constructed, that is, the first and last nodes in each intra-burst data packet are connected to the corresponding first and last nodes in the previous intra-burst data packet.

[0092] The application utilizes the inter-burst relationship to divide the flow in time and represent the association between data packets in the flow.

[0093] Step 1.4, input the flow interaction graph (FIG) constructed in step 1.3 into a GNN composed of a Topology Adaptive Graph Convolutional Networks (TAGCN) layer and a Readout layer to obtain a graph-level representation of bidirectional flow, that is, a flow interaction feature representation.

[0094] Step 1.4 specifically includes the following steps:

[0095] Step 1.4.1, in the flow interaction graph (FIG), the initial feature of each node has D attribute features, where i = 1, 2, …, N v , and N v is the number of nodes in the flow interaction graph, thereby forming a feature matrix of all nodes where the dthdimensional feature is represented as a vector The feature matrix of all nodes and the adjacency matrix A of the flow interaction graph are taken as the initial input of TAGCN, and a set of graph filters is used to perform convolution operations on different dimensions of the feature matrix of all nodes to extract output feature maps. The obtained output feature maps are spliced to obtain updated node features

[0096] Step 1.4.2, after obtaining the updated node features , the graph-level representation h g of the flow, that is, the flow interaction feature representation, is generated by the Readout layer.

[0097] The application adopts multi-order convolution operations through TAGCN, and the model can aggregate multi-order neighborhood information of nodes to obtain richer node representations.

[0098] Step 1.5, splice the flow-level byte feature representation obtained in step 1.2 and the flow interaction feature representation obtained in step 1.4 to obtain a comprehensive flow-level feature representation h.

[0099] The application extracts flow features from two angles of byte-level features and flow interaction features by adopting a double-branch flow feature extraction, so as to obtain a more comprehensive flow feature representation and make the flow representation more rich.

[0100] Step 2, in the training phase, an energy function is learned using the input stream-level feature representation and the stream-level feature representation corresponding label, and a global energy representation is output. A boundary regularization loss based on the global energy representation is constructed based on the energy function, and the boundary regularization loss is combined with the classification loss to obtain the total loss of the known and unknown classification modules for training In the inference phase, the energy values of the known stream-level feature representation and the unknown stream-level feature representation are calculated using the learned energy function, and the energy boundaries of the known stream-level feature representation and the unknown stream-level feature representation are modeled using Weibull distribution. The known class and the unknown class are identified by comparing with the energy threshold.

[0101] The application adopts an energy-based model to distinguish known and unknown class traffic by evaluating the matching degree between input features and class labels, and has high robustness when facing unknown traffic.

[0102] The step 2 specifically includes the following steps:

[0103] Step 2.1, the overall energy value E(h) of the stream-level feature representation h is aggregated using the Helmholtz free energy formula, and the overall energy value E(h) is input to a discriminative classifier g(h) with C k +1 categories, where the first C k categories correspond to known categories, and the additional one category represents all unknown categories. The discriminative classifier maps h to C k +1 logits values.

[0104] Step 2.2, the Gibbs distribution is used to comprehensively consider C k +1 categories, and the energy function is re-expressed to output a global energy representation.

[0105] The application adopts the global energy representation output by the re-expressed free energy function, which comprehensively considers all categories. Compared with Softmax which only depends on the relative size of the logit value, the energy model effectively avoids the error high confidence prediction caused by the high logit value through global modeling.

[0106] Step 2.3, based on the energy function, a boundary regularization loss based on the global energy representation is constructed:

[0107]

[0108] Where, represents the training distribution of known class traffic in the latent space, represents the training distribution of unknown class traffic in the latent space, m kis the energy boundary of the known flow level feature representation, m u is the energy boundary of the unknown flow level feature representation, and is the average of the cross-entropy loss square of the samples, y is the class of a certain sample;

[0109] Step 2.4, constructing the total loss of the known and unknown classification modules for training by combining the boundary regularization loss and the classification loss

[0110]

[0111] wherein, represents the distribution of the training data in the latent space, and λ is a hyperparameter for balancing the two loss functions; is the probability distribution of the class.

[0112] The present application adds a boundary regularization loss to the classification loss, and through the learning of the energy boundary, the known samples and the unknown samples form an obvious difference in the energy space. The first term of the boundary regularization loss aims to reduce the energy value of the known class samples, and the second term aims to increase the energy value of the unknown class samples.

[0113] Step 2.5, in the inference stage, the energy values of the known flow level feature representation and the unknown flow level feature representation are calculated by using the learned energy function, and the Weibull distribution is used to model the energy boundary of the known flow level feature representation and the energy boundary of the unknown flow level feature representation, and the known class and the unknown class are identified by comparing with the energy threshold value:

[0114]

[0115] wherein, E(h; g) represents the energy function, U represents the unknown class, represents the known class, when E(h; g) is less than the threshold value τ, the sample is classified into the known class with the minimum energy value; otherwise, the sample is determined as the unknown class. -E(h; g) is used in order to follow the conventional definition that the positive samples have higher values. In the inference stage, the present application uses the Weibull distribution to model the energy boundary of the known / unknown samples, and sets a suitable threshold value so that the known and unknown classes can be identified.

[0116] Step 3, the identified unknown class traffic is finely divided by an adaptive deep clustering method to obtain a multi-class conclusion of the unknown class traffic.

[0117] Step 3 specifically includes the following steps:

[0118] Step 3.1, for the samples identified as unknown categories, pass them through the double-branch flow feature extraction channel to obtain feature representations, and use a convolutional neural network to perform feature enhancement processing to obtain enhanced features x u ;

[0119] Step 3.2, in the initialization stage, use a clustering algorithm such as k-means to preliminarily cluster the enhanced features x u and assign them corresponding initial pseudo-labels

[0120] Step 3.3, according to the initial pseudo-labels construct a sample library to store unknown category features and initial pseudo-labels, and construct a cluster center library to save the features of each current cluster center; the present application realizes adaptive clustering of unknown category traffic by combining deep feature extraction and clustering technology.

[0121] Step 3.4, update the unknown category features by continuously updating the network, after updating, update the unknown category features in the sample library in a momentum update manner, and the unknown category samples are re-assigned pseudo-labels according to the enhanced features x u by the nearest neighbor cluster center

[0122] The present application continuously updates the feature representations and pseudo-labels of the sample library, and with the continuous iteration of the network, the sample feature representations and pseudo-label assignments become more accurate, and the original error features and labels are gradually eliminated.

[0123] Step 3.5, construct a clustering loss for training:

[0124]

[0125] where l(·) is a cross-entropy loss function, ψ θ (·) represents a feature extraction network, and g'(·) represents a classifier, and the initial number of classifications is predefined to be a large value, greater than the number of potential real categories.

[0126] The present application continuously minimizes the clustering loss to gradually excavate the real fine-grained categories in the unknown traffic.

[0127] Step 4, through an end-to-end joint training strategy, steps 2 and 3 are alternately iteratively trained to obtain a final end-to-end fine-grained encrypted traffic classification model, and data is trained through the end-to-end fine-grained encrypted traffic classification model to obtain a classification result.

[0128] In step 4, the joint loss formula of the joint training strategy is:

[0129]

[0130] wherein, is a loss function for known / unknown classification tasks, including cross-entropy loss and energy-based boundary regularization loss, while is an unknown class clustering loss, and α is a hyper-parameter, controlling the relative importance of the total loss and the clustering loss in the training process, to achieve a proper balance between the two.

[0131] The present application enables the model to continuously optimize the two modules during training through joint alternating training, gradually achieving the differentiation of known / unknown classes, the accurate classification of known classes, and the effective clustering of unknown classes, thereby achieving the multi-task learning goal.

[0132] The end-to-end fine-grained encrypted traffic classification method based on open set semi-supervised learning provided by the present application can effectively deal with the problems of known and unknown traffic class differentiation, known class traffic classification, and unknown traffic clustering in traffic classification under the open world scenario, providing a new solution for network security management.

[0133] The above only describes the preferred embodiments of the present application, and it should be noted that for those skilled in the art, without departing from the principles of the present application, several improvements and refinements can be made, and these improvements and refinements should also be considered within the scope of protection of the present application.

Claims

1. An end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning, characterized in that: The end-to-end fine-grained encrypted traffic classification method specifically includes the following steps: Step 1: Extract raw traffic data from the network. The raw traffic data includes multiple PCAP files. Process the PCAP files and use a dual-branch feature extraction module to extract flow-level feature representations. Step 2: During the training phase, an energy function is learned using the input stream-level feature representation and its corresponding label, outputting a global energy representation. Based on this energy function, a boundary regularization loss is constructed. This boundary regularization loss is combined with the classification loss to obtain the training loss for both known and unknown classification modules. During the inference phase, the energy values ​​represented by known flow level features and unknown flow level features are calculated using the learned energy function. The Weibull distribution is used to model the energy boundaries represented by known flow level features and unknown flow level features. Known and unknown categories are identified by comparing them with energy thresholds. Step 3: The identified unknown category traffic is further subdivided into fine-grained categories using an adaptive deep clustering method to obtain multi-classification results for the unknown category traffic; Step 4: Using an end-to-end joint training strategy, Steps 2 and 3 are iteratively trained alternately to obtain the final end-to-end fine-grained encrypted traffic classification model. The data is then trained using the end-to-end fine-grained encrypted traffic classification model to obtain the classification results.

2. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 1, characterized in that: Step 1 specifically includes the following steps: Step 1.1: Divide each PCAP file into independent bidirectional streams according to the session. Select m consecutive data packets from each stream and process the header and payload of each data packet separately to obtain a fixed-size stream header matrix and stream payload matrix. Step 1.2: Pass the stream header matrix and stream payload matrix through a convolution-enhanced Vision Transformer (ViT) to obtain the stream-level feature representation of the header matrix and the stream-level feature representation of the payload matrix. Concatenate the stream-level feature representation of the header matrix and the stream-level feature representation of the payload matrix to obtain the final stream-level byte feature representation. Step 1.3: Construct each independent bidirectional flow into a flow interaction graph, select data packets in the bidirectional flow as nodes, and introduce intra-burst data packets to construct edges between data packets; Step 1.4: Input the flow interaction graph constructed in Step 1.3 into a GNN consisting of a Topology Adaptive Graph Convolutional Networks (TAGCN) layer and a Readout layer to obtain a bidirectional flow graph-level representation, i.e., a flow interaction feature representation; Step 1.5: Concatenate the stream-level byte feature representation obtained in Step 1.2 and the stream interaction feature representation obtained in Step 1.4 to form the stream-level feature representation h.

3. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 2, characterized in that: Step 1.1 specifically includes the following steps: Step 1.1.1: Divide each PCAP file into independent bidirectional streams according to the session. For packets in the bidirectional stream, discard the Ethernet header and anonymize the IP address and port number. Step 1.1.2: From the stream obtained after anonymization in Step 1.1.1, select M consecutive data packets. Each data packet is divided into a header byte sequence and a payload byte sequence, and processed separately. For each of the selected m data packets, reshape the header byte sequence into a format of size M. The header matrix is ​​constructed by zero-padding to ensure uniform size, and then the header matrices of the m data packets in each stream are concatenated along the sequence dimension of the data packets to form a fixed-size stream header matrix. satisfy Where r represents the row and c represents the column. These represent the two dimensions of the header byte sequence matrix; Step 1.1.3: Reshape the payload byte sequence of each data packet into a format of size [size missing]. The matrix is ​​constructed by zero-padding to ensure uniform size, and then the flow payload matrices of m data packets in each flow are concatenated along the sequence dimension of the data packets to form a fixed-size flow payload matrix. satisfy in, These represent the two dimensions of the payload byte sequence matrix, where p represents the payload.

4. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 3, characterized in that: Step 1.2 specifically includes the following steps: Step 1.2.1: For the flow header matrix, convert the flow header matrix x... h Divide into several blocks of size P×P Where, N h This represents the total number of blocks. Step 1.2.2: Apply convolution operation to each block to extract local features of the block, and add position embedding on the basis of local features to preserve position information and obtain embedded features. Input the obtained embedded features into the Transformer encoder, which includes multi-head attention and feedforward network. Step 1.2.3: For the flow load matrix, convert the flow load matrix x... p Divide into several blocks of size P×P Step 1.2.4: Apply convolution operation to each block to extract local features of the block, and add position embedding on the local features to preserve position information and obtain embedded features. Input the obtained embedded features into the Transformer encoder, which consists of multi-head attention and feedforward network. Step 1.2.5: For the flow header matrix and flow payload matrix, respectively, global pooling operation is performed to obtain the flow-level feature representation z of the header matrix. h The characteristic representation of the flow load matrix and flow level z p The head matrix flow-level feature representation z h The flow-level characteristic representation of the flow load matrix z p The concatenation yields the final stream-level byte feature representation h. b =[z h ,z p ].

5. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 1, characterized in that: Step 1.3 specifically includes the following steps: Step 1.3.1: Extract visible attribute features from the data packets from multiple dimensions as node embeddings. The attribute features include the direction, length, timestamp, total number of data packets in a burst, total number of bytes in data packets in a burst, and the ratio of the number of data packets and the ratio of the total number of bytes between adjacent bursts. Step 1.3.2: A sequence of data packets in a stream is divided into multiple packets within a burst based on a preset burst threshold, and undirected edges are used to connect the packet nodes: For nodes within the same burst of data packets, construct intra-burst edges to connect them, that is, add edges between nodes sequentially according to timestamp order; For nodes in adjacent burst packets, construct inter-burst edges, that is, connect the first and last nodes in each burst packet to the corresponding first and last nodes in the previous burst packet, respectively.

6. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 1, characterized in that: Step 1.4 specifically includes the following steps: Step 1.4.1: Initial features of each node in the flow interaction graph (FIG). It has D attributes, where i = 1, 2, ..., N v And N v The number of nodes in the flow interaction graph constitutes the feature matrix of all nodes. The d-th dimension feature is represented as a vector. The feature matrix of all nodes The adjacency matrix A of the flow interaction graph is used as the initial input to TAGCN, and then passed through a set of graph filters to the feature matrix of all nodes. Convolution operations are performed on different dimensions to extract output feature maps. The obtained output feature maps are then concatenated to obtain the updated node features. Step 1.4.2: After obtaining the updated node features Then, a graph-level representation h of the stream is generated through the Readout layer. g That is, the representation of flow interaction features.

7. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 1, characterized in that: Step 2 specifically includes the following steps: Step 2.1: Use the Helmholtz free energy formula to express the overall energy value E(h) of the converging flow stage characteristics, and input the overall energy value E(h) into a system with C k A discriminative classifier g(h) with +1 categories, where the first C k Each category corresponds to a known category, and an additional category represents all unknown categories. This discriminative classifier maps h to C. k +1 logits value; Step 2.2: Utilize the Gibbs distribution to comprehensively consider C k Add 1 more categories, re-represent the energy function, and output the global energy representation; Step 2.3: Construct a boundary regularization loss based on the energy function and global energy representation. in, This represents the training distribution of known category traffic in the latent space. Let m represent the training distribution of unknown category traffic in the latent space. k Let m be the energy boundary represented by the known flow level characteristics. u The energy boundary is represented by the characteristics of the unknown flow level. and Let y be the average of the squared cross-entropy losses of the samples, and y be the class of a sample. Step 2.4: Construct the total loss for training, which combines boundary regularization loss and classification loss to obtain the known and unknown classification modules. in, λ represents the distribution of training data in the latent space, and λ is a hyperparameter used to balance the two loss functions; The probability distribution for each category; Step 2.5: In the inference phase, the learned energy function is used to calculate the energy values ​​of the known and unknown flow level feature representations. The Weibull distribution is then used to model the energy boundaries of the known and unknown flow level feature representations. Known and unknown categories are identified by comparing these values ​​with energy thresholds. Where E(h;g) represents the energy function, and U represents the unknown category. This indicates that a category has already been defined. When E(h;g) is less than the threshold τ, the sample is assigned to the known category with the smallest energy value; otherwise, the sample is determined to be an unknown category.

8. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 7, characterized in that: Step 3 specifically includes the following steps: Step 3.1: For samples identified as belonging to an unknown category, pass them through a dual-branch flow feature extraction channel to obtain feature representations. Then, use a convolutional neural network for feature enhancement to obtain the enhanced feature x. u ; Step 3.2: In the initialization phase, use a clustering algorithm to process the enhanced feature x. u Perform preliminary clustering and assign corresponding initial pseudo-labels. Step 3.3: Based on the initial pseudo-tags Construct a sample library to store features and initial pseudo-labels for unknown categories. At the same time, construct a cluster center library to save the features of each current cluster center. Step 3.4: Update the features of the unknown category by continuously updating the network. After the update, use momentum update to update the features of the unknown category in the sample library. At the same time, the samples of the unknown category are updated according to the enhanced features x. u Pseudo-labels are reassigned based on nearest neighbor cluster centers. Step 3.5: Construct a clustering loss. For training purposes: Where l(·) is the cross-entropy loss function, ψ θ (·) represents the feature extraction network, and g′(·) represents the classifier.

9. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 8, characterized in that: In step 4, the joint loss formula for the joint training strategy is: Where α is a hyperparameter that controls the training of known and unknown classification modules. Clustering loss The relative importance of the two in the training process should be considered to achieve an appropriate balance.

10. The end-to-end fine-grained encrypted traffic classification method based on open-set semi-supervised learning according to claim 1, characterized in that: The end-to-end fine-grained encrypted traffic classification model includes a dual-branch feature extraction module, an energy-based known and unknown classification module, and an adaptive unknown classification module. The dual-branch feature extraction module concatenates the byte feature representation and the stream interaction feature representation of the stream into a stream-level feature representation; The known and unknown classification module based on the energy model is used to classify known and unknown flows; The adaptive unknown classification module combines the adaptive deep clustering method with the characteristics of feature extraction and unknown traffic classification to achieve the classification of unknown traffic categories.

Images