A network traffic classification method and system based on double position encoding and hybrid mask mechanism

Abstract

The application belongs to the field of network traffic classification, and discloses a network traffic classification method and system based on double position encoding and a hybrid mask mechanism, which comprises the following steps: input network traffic is divided according to time segments, and structured traffic representation is generated based on source address, destination address, source port, destination port and transmission protocol; double position encoded flow data is input into a coding model based on a Transformer, and a hybrid mask mechanism is introduced in the attention calculation process to balance the dependence relationship between bytes in the packet and between packets; the classification result output by the coding model is obtained, and a preset confidence threshold is used for judgment; if the confidence of the classification result is within the preset confidence interval, flow caching and reconstruction processing are performed, otherwise, the classification result is directly output. The application can effectively improve the accuracy and robustness of encrypted traffic classification and attack detection, and is suitable for Internet of Things traffic, mobile traffic and complex network environments across platforms.

Description

Technical Field

[0001] This invention relates to the field of network traffic classification, and in particular to a network traffic classification method and system based on dual location coding and hybrid masking mechanism. Background Technology

[0002] With the rapid development of internet and mobile communication technologies, the scale and complexity of network traffic have grown exponentially. Especially in recent years, the widespread adoption of various encrypted communication protocols (such as TLS, QUIC, and HTTPS) has led to a gradual shift from plaintext to encrypted data content in network transmission. Traditional traffic classification techniques that rely on plaintext characteristics for identification are thus becoming increasingly ineffective. Simultaneously, the proliferation of Internet of Things (IoT) devices has further exacerbated the complexity of the network environment: the numerous device types and diverse application scenarios result in significant differences in network traffic distribution and frequent dynamic changes, placing higher demands on existing traffic identification methods.

[0003] Currently, to achieve network traffic classification, the industry and academia mainly adopt the following technical solutions:

[0004] (1) Deep Packet Inspection (DPI) method: DPI technology identifies traffic by parsing plaintext features or protocol header fields in data packets. However, with end-to-end encryption becoming mainstream, DPI cannot parse the payload, and encrypted traffic can hardly be correctly identified. In addition, DPI requires continuous maintenance of the feature library, which is costly to update, and it performs poorly in cross-platform and cross-protocol scenarios.

[0005] (2) Machine learning methods based on handcrafted features: Researchers have attempted to use statistical features of traffic (such as packet size distribution, directionality, latency features, etc.) in combination with machine learning classifiers (such as SVM, random forest, etc.) for identification. This type of method can achieve certain results in small-scale, single-scenario situations, but it relies on manually designed features and is difficult to cope with complex, dynamic and diverse traffic patterns, and its generalization ability is limited.

[0006] (3) End-to-end methods based on deep learning: With the development of deep learning, convolutional neural networks (CNN), recurrent neural networks (RNN), and Transformer models have been gradually applied to traffic classification tasks. Among them, the Transformer model, with its self-attention mechanism, can model the relationship between byte sequences globally and has become a current research hotspot. However, this type of method still has obvious shortcomings:

[0007] ① Byte position misalignment problem: Existing solutions usually concatenate data packets into the model byte by byte. This processing method will destroy the relative positions of bytes within the data packet and introduce unnecessary offsets between packets, resulting in inconsistency between position encoding and actual semantics.

[0008] ② Interference from intra-packet and inter-packet relationships: Traditional single-position encoding methods cannot distinguish between "dependencies within the same data packet" and "sequential relationships across packets." In attention mechanisms, the model is prone to confusing intra-packet and inter-packet dependencies, thereby introducing noise and reducing classification accuracy.

[0009] ③ Lack of processing mechanism for low confidence results: Most existing models directly output the category after obtaining the prediction result without considering the prediction confidence. When the model lacks sufficient basis for judgment on certain traffic, it is easy to output incorrect labels, resulting in a decrease in the overall robustness of the system.

[0010] Furthermore, existing technologies still suffer from efficiency bottlenecks in high-concurrency, large-scale data scenarios. Some methods have high computational complexity, making them inefficient to run on edge devices or in real-time environments, thus limiting their application value in practical systems.

[0011] In summary, existing network traffic classification methods cannot simultaneously meet the requirements for identifying encrypted traffic, accurately modeling complex dependencies, and effectively utilizing the confidence level of classification results. Therefore, a new technical solution is urgently needed to address these issues. Summary of the Invention

[0012] The purpose of this invention is to disclose a network traffic classification method and system based on dual position coding and hybrid masking mechanism, so as to solve the technical problems mentioned in the background art.

[0013] To achieve the above objectives, the present invention provides the following technical solution:

[0014] On the one hand, this invention provides a network traffic classification method based on dual location coding and hybrid masking mechanism, including:

[0015] The input network traffic is segmented according to time segments, and a structured traffic representation is generated based on the source address, destination address, source port, destination port and transport protocol.

[0016] Perform dual location encoding on the data packets in the structured traffic representation, the dual location encoding including:

[0017] a) Intra-packet position encoding, used to represent the relative position of a byte within its data packet;

[0018] b) Packet position encoding, used to indicate the order of data packets in the overall network traffic;

[0019] The stream data with dual positional encoding is input into the Transformer-based encoding model, and a hybrid masking mechanism is introduced during the attention calculation process to balance the byte dependencies within and between packets.

[0020] Obtain the classification result output by the encoding model and make a judgment based on the preset confidence threshold. If the confidence of the classification result is within the preset confidence interval, perform stream caching and reconstruction processing; otherwise, output the classification result directly.

[0021] Optionally, dual positional encoding is constructed using a rotation matrix.

[0022] Optionally, the hybrid masking mechanism achieves a dynamic balance between intra-packet and inter-packet attention allocation by randomly masking some inter-packet byte dependencies in the attention matrix.

[0023] Optionally, the confidence interval includes an upper threshold and a lower threshold;

[0024] If the confidence level is greater than or equal to the upper threshold, the classification result is output directly;

[0025] If the confidence level is greater than the lower threshold and less than the upper threshold, the network traffic is cached and reconstructed and reclassified in conjunction with subsequent network traffic.

[0026] If the confidence level is less than or equal to the lower threshold, the classification result will be labeled as another category.

[0027] On the other hand, the present invention provides a network traffic classification system based on dual positional coding and hybrid masking mechanism, including:

[0028] The input module is used to segment the input network traffic according to time segments and generate a structured traffic representation based on the source address, destination address, source port, destination port and transport protocol;

[0029] An encoding module is configured to perform dual location encoding on data packets in the structured traffic representation, the dual location encoding comprising:

[0030] a) Intra-packet position encoding, used to represent the relative position of a byte within its data packet;

[0031] b) Packet position encoding, used to indicate the order of data packets in the overall network traffic;

[0032] The Transformer model module is used to input dual positionally encoded streaming data into a Transformer-based encoding model. It introduces a hybrid masking mechanism during attention calculation to balance intra-packet and inter-packet byte dependencies.

[0033] The judgment module is used to obtain the classification results output by the coding model and make a judgment based on the preset confidence threshold.

[0034] The reconstruction module is used to cache and reconstruct network traffic with confidence levels within the confidence range, and then re-input it into the Transformer model module.

[0035] Optionally, the encoding module uses a two-byte word segmentation method for traffic data preprocessing.

[0036] Optionally, the determination module is used to call the reconstruction module to perform traffic splicing and reclassification based on the determination result.

[0037] Beneficial effects:

[0038] Compared with existing technologies, this invention can effectively improve the accuracy and robustness of encrypted traffic classification and attack detection, and is applicable to IoT traffic, mobile traffic and complex cross-platform network environments. Attached Figure Description

[0039] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of the network traffic classification method of the present invention.

[0041] Figure 2 This is a schematic diagram of the network traffic classification system of the present invention.

[0042] Figure 3 A comparative diagram is shown, illustrating the difference between traditional positional coding and the dual positional coding proposed in this paper.

[0043] Figure 4 A geometric interpretation of the two-position encoding is presented.

[0044] Figure 5 This is a schematic diagram of a hybrid attention mask matrix. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] The Transformer model is widely used in fields such as Natural Language Processing (NLP) and cybersecurity due to its self-attention mechanism and powerful long-range modeling capabilities. However, while there are clear semantic boundaries and contextual structures between words in NLP, the byte sequences between data packets in network traffic lack similar semantic patterns.

[0047] Specifically, the current Transformer has the following two structural problems in traffic classification:

[0048] Location encoding mismatch problem:

[0049] The position encoding after data packet concatenation can no longer reflect the position information of bytes within their original packets. For example, the first byte of the first data packet and the first byte of the second data packet may both semantically belong to the "protocol header", but because they are encoded as position 0 and L (packet length) respectively, it creates a misleading position signal input model.

[0050] The problem of confusion regarding the relationship between packages / between packages:

[0051] The self-attention mechanism itself does not distinguish whether bytes come from the same data packet or different data packets, which may cause the model to generate incorrect strong dependencies between packets, affecting the accuracy of semantic modeling.

[0052] To address the aforementioned issues, this invention proposes an innovative Transformer architecture that combines dual positional encoding (PS-Pos) with a mixed masking mechanism, and encapsulates it within the complete classification framework Sorter.

[0053] 1. Dual Position Encoding (PS-Pos):

[0054] To capture the intra-packet position information of a byte and its order information within the entire stream, this invention represents the position of each byte as a two-dimensional vector (m, n), where:

[0055] m represents the offset of the byte within its data packet;

[0056] n represents the global order of the data packet in network traffic.

[0057] The specific location encoding method is as follows:

[0058] Define the rotation position encoding matrix as follows:

[0059]

[0060] in For a two-dimensional rotating block diagonal matrix that repeats along a dimension, Similarly, x represents the relative position index of a byte within its data packet, y represents the global order index of the data packet in the stream, r is the amplitude coefficient, and θ is the set of frequency parameters. This matrix undergoes rotation transformations in both intra-packet and inter-packet dimensions to achieve joint modeling of local and global positional information.

[0061] The byte position vector encoding is then:

[0062]

[0063]

[0064] in This represents the query vector at position (m,n). This represents the key vector at position (p, q), where d is the encoding dimension and θ is taken from the standard frequency settings in Transformer.

[0065]

[0066] This encoding method satisfies the following five key attributes:

[0067] ① Relative positional consistency: The encoding result is only related to (pm, qn);

[0068] ② Dimensional independence: Intra-package positions and inter-package positions are encoded independently;

[0069] ③ Translation invariance: Sliding to different positions does not affect the representation;

[0070] ④ Distance sensitivity: It can distinguish between local relationships and long-distance dependencies;

[0071] ⑤ Computational efficiency: Supports encoding computation with linear time complexity O(n).

[0072] 2. Mixed Masking Mechanism:

[0073] To avoid the model focusing excessively on weak dependencies between packages, this invention proposes a hybrid masking strategy:

[0074] In the self-attention matrix QKT, the main diagonal block (i.e., attention between bytes within the packet) is preserved.

[0075] Apply random occlusion to off-diagonal blocks (i.e., room attention), with occlusion probability α∈[0,1];

[0076] First, define the rules for generating the hybrid mask matrix:

[0077]

[0078] The corresponding attention score matrix can be represented as:

[0079]

[0080] Where 𝑖 and 𝑗 are the row and column indices of the attention matrix, corresponding to the 𝑖-th and j-th positions in the input stream byte sequence, respectively; if they belong to the same data packet, they are considered to have an intra-packet dependency relationship, let M ij =0; if they belong to different data packets, they will be randomly masked according to a set ratio, let 𝑀 ij =−∞, thereby weakening cross-package dependencies during attention computation.

[0081] This mechanism can significantly improve the model's ability to model salient features within packets, such as protocol headers.

[0082] III. Sorter System Architecture:

[0083] The Sorter framework consists of five functional subsystems:

[0084] (1) InfeedSystem: Slices the raw traffic into five-tuples (source / destination IP, port, protocol) and reassembles it into an ordered flow according to time windows;

[0085] (2) ScanningSystem: Performs double-byte segmentation, PS-Pos encoding, mask control, and Transformer inference;

[0086] (3) DecisionSystem: Based on the prediction confidence threshold, the results are divided into three categories: “reliable”, “unreliable”, and “to be reconstructed”;

[0087] (4) RebuildSystem: Caches low-confidence streams and re-deploys the model after replenishing more data packets;

[0088] (5) OutfeedSystem: Records high-confidence prediction results for subsequent comparison, and low-confidence data enters the manual review process.

[0089] Example 1:

[0090] refer to Figure 1 This invention provides a network traffic classification method based on dual location coding and hybrid masking mechanism, including:

[0091] The input network traffic is segmented according to time segments, and a structured traffic representation is generated based on the source address, destination address, source port, destination port, and transport protocol.

[0092] Specifically, the traffic is first divided into multiple independent flows based on the five-tuple information (source IP, destination IP, source port, destination port, and transport layer protocol). Then, each flow is sliced ​​according to a fixed time window to form segmented traffic units that maintain time sequence.

[0093] Perform dual location encoding on the data packets in the structured traffic representation, the dual location encoding including:

[0094] a) Intra-packet position encoding, used to represent the relative position of a byte within its data packet;

[0095] b) Packet position encoding, used to indicate the order of data packets in the entire network traffic.

[0096] This positional encoding method simultaneously identifies the local position of each byte within the data packet (such as the offset in the packet header) and its sequential position within the entire stream (such as which data packet it is). For example... Figure 3 and Figure 4 As shown, dual-position coding achieves unified modeling of the positional relationships within and between packets by constructing a rotation matrix in two-dimensional coordinates.

[0097] The stream data, which is encoded in a dual position, is input into a Transformer-based encoding model. A hybrid masking mechanism is introduced during the attention calculation process to balance the byte dependencies within and between packets.

[0098] In the model, such as Figure 5 The hybrid masking attention mechanism shown divides the attention matrix into blocks, allowing the attention distribution among bytes within a packet to retain dominance while shielding interference between bytes in different packets to achieve a balance in information attention.

[0099] Obtain the classification result output by the encoding model and make a judgment based on the preset confidence threshold. If the confidence of the classification result is within the preset confidence interval, perform stream caching and reconstruction processing; otherwise, output the classification result directly.

[0100] Optionally, the confidence interval includes an upper threshold and a lower threshold;

[0101] If the confidence level is greater than or equal to the upper threshold, the classification result is output directly;

[0102] If the confidence level is greater than the lower threshold and less than the upper threshold, the network traffic is cached and reconstructed and reclassified in conjunction with subsequent network traffic.

[0103] If the confidence level is less than or equal to the lower threshold, the classification result will be labeled as another category.

[0104] For network traffic with insufficient confidence, the system temporarily stores the traffic and waits for subsequent slices of the same quintuple to arrive. These slices are then concatenated and reconstructed before being fed back into the model for a second round of inference. This mechanism improves the model's accuracy and stability in scenarios with incomplete traffic segments or missing features.

[0105] Through the above steps, the method provided in this embodiment can achieve unified feature modeling of plaintext and encrypted traffic, and support accurate identification of various complex communication behaviors such as attack traffic, abnormal traffic, and mobile communication traffic.

[0106] Optionally, the dual position encoding is constructed using a rotation matrix to satisfy the requirements of relative position consistency, translation invariance, and computational efficiency.

[0107] Optionally, the hybrid masking mechanism achieves a dynamic balance between intra-packet and inter-packet attention allocation by randomly masking some inter-packet byte dependencies in the attention matrix.

[0108] Example 2:

[0109] refer to Figure 2 This invention provides a network traffic classification system based on dual location coding and hybrid masking mechanism, comprising:

[0110] The input module is used to segment the input network traffic according to time segments and generate a structured traffic representation based on the source address, destination address, source port, destination port and transport protocol.

[0111] The input module, as the pre-processing module of the entire classification system, mainly includes the following functions:

[0112] Time slicing and flow classification: The raw network traffic is sliced ​​according to time windows and divided into structured time-sliced ​​flows.

[0113] Five-tuple splitting: Logically split the original traffic based on the five-tuple (source / destination IP, source / destination port, transport protocol) to obtain a single communication session;

[0114] Time sorting: The data packets in each quintuple are sorted in ascending order according to their timestamps to restore the true transmission sequence;

[0115] Text structure construction: The sorted data packet content is concatenated into a byte sequence at the byte level, and special identifiers are inserted, such as [CLS] to indicate the start and [SEP] to indicate the delimiter of the data packet;

[0116] Word segmentation and encoding preparation: After outputting structured text, it is handed over to subsequent modules for double-byte tokenization and positional encoding processing.

[0117] The design of the input module ensures the integrity and temporal consistency of the traffic structure, laying the foundation for subsequent feature extraction and attention modeling.

[0118] An encoding module is configured to perform dual location encoding on data packets in the structured traffic representation, the dual location encoding comprising:

[0119] a) Intra-packet position encoding, used to represent the relative position of a byte within its data packet;

[0120] b) Packet position encoding, used to indicate the order of data packets in the entire network traffic.

[0121] The encoding module includes:

[0122] The double-byte tokenization module divides the input byte sequence into groups of two bytes and maps them to tokens using a 256×256 vocabulary to construct a sparse and discrete representation.

[0123] Embedding layer: maps discrete tokens to dense vectors, which are then used as model input;

[0124] The dual position encoding (PS-Pos) module injects a two-dimensional position representation into each token, corresponding to the byte position within the packet and the order relationship between packets, respectively.

[0125] The Transformer model module is used to input dual-positionally encoded streaming data into a Transformer-based encoding model. It introduces a hybrid masking mechanism during attention calculation to balance intra-packet and inter-packet byte dependencies.

[0126] The Transformer model module includes:

[0127] Hybrid masking multi-head attention mechanism: Performs self-attention calculation, focuses on bytes within the packet in the main diagonal part, and cross-packet dependencies in the off-diagonal part, and controls the masking through random masking;

[0128] Feedforward Neural Networks (FFN) and Normalization Layers: Used for feature transformation and nonlinear modeling to improve classification capabilities;

[0129] Output layer: The confidence level is output through a linear layer and the Softmax function.

[0130] The output is the category prediction result and confidence score for each time slice stream.

[0131] The decision module is used to obtain the classification results output by the coding model and make a decision based on a preset confidence threshold.

[0132] If the confidence level is greater than or equal to the upper threshold ε_upper, the classification result is considered reliable and is output directly.

[0133] If the confidence level is less than or equal to the lower threshold ε_lower, the result is marked as "Others", that is, it is marked as other categories and treated as a low-confidence sample.

[0134] When the confidence level is between two thresholds, the slice is passed to the reconstruction system cache for reclassification in conjunction with subsequent context.

[0135] This mechanism forms a dynamic classification quality control strategy, effectively reducing false alarms and false negatives.

[0136] The reconstruction module is used to cache and reconstruct network traffic with confidence levels within the confidence range, and then re-input it into the Transformer model module.

[0137] The reconstruction module is responsible for handling slices with insufficient confidence, and its operation process is as follows:

[0138] Cache processing: Store the current time slice stream to be classified into the cache area, and wait for the arrival of subsequent data segments with the same 5-tuple;

[0139] Concatenation and reconstruction: When the next slice arrives, the system automatically detects whether it belongs to the same quintuple. If it does, it is concatenated into a new, longer context sequence.

[0140] Re-enter the scanning system: After the splicing is completed, the fragment is re-entered into the scanning system for a second round of reasoning;

[0141] Reconstruction timeout policy: If a piece of data that can be spliced ​​is not obtained within the time limit, the system will mark the traffic as "Others".

[0142] This mechanism significantly improves the model's ability to make judgments in cases where the context is incomplete or the beginning and end information is missing.

[0143] Optionally, the network traffic classification system may also include an output module;

[0144] The output module is used to record and manage the final classification results. Its responsibilities include:

[0145] Record classification information: Record the five-tuple and predicted label of traffic segments with confidence greater than the upper threshold, and establish a high-confidence flow label table;

[0146] Accelerate subsequent classification: When subsequent data with the same quintuple arrives, existing prediction results can be directly referenced, reducing redundant calculations;

[0147] Anomaly handling: Manually review and label “Others” samples with low confidence levels or conduct subsequent model re-examination.

[0148] Optionally, the encoding module uses a two-byte word segmentation method to preprocess traffic data, thereby reducing computational complexity and improving expressive power.

[0149] Optionally, the determination module is used to call the reconstruction module to perform traffic splicing and reclassification based on the determination result.

[0150] Optionally, the geometric representation and algorithm implementation of two-position coding (PS-Pos) are as follows:

[0151] This embodiment provides a network traffic classification method based on dual positional encoding (PS-Pos), aiming to overcome the problem of improper handling of intra-packet and inter-packet byte relationships in traditional positional encoding methods. The dual positional encoding method combines intra-packet and inter-packet positional encoding, maintaining relative consistency, distance sensitivity, and computational efficiency, thus greatly improving the model's classification ability in complex traffic environments. The following is a detailed explanation... Figure 3 , Figure 4 This section details the geometric representation and calculation method of two-position coding (PS-Pos).

[0152] 1. Basic principle of dual position coding (PS-Pos):

[0153] like Figure 3 As shown, the dual-position encoding method encodes the position of each byte within the data packet separately from the position of the data packet in the stream, using intra-packet position encoding and inter-packet position encoding respectively.

[0154] Intra-packet position encoding: the relative position of each byte within a single data packet. For example, the positions of fields in the TCP / IP header within a packet have fixed meanings, therefore it is necessary to accurately represent the position of that byte within the packet.

[0155] Inter-packet position encoding: the sequential position of each data packet within the entire stream. Since the relative positions of different packets determine the structured semantics of the stream, inter-packet position encoding needs to accurately represent the sequential relationship of data packets within the stream.

[0156] In dual-position coding, intra-packet position coding and inter-packet position coding are represented independently, and positional relationships are mapped through rotation matrices and coordinate system transformations.

[0157] 2. Geometric representation of two-position coding (PS-Pos):

[0158] like Figure 4 As shown, dual-position encoding is implemented by mapping positions to a two-dimensional space. The encoding of each byte comprises two independent parts, corresponding to its local position within the data packet and its global order within the stream. Specifically, the geometric representation of intra-packet and inter-packet positions in a two-dimensional polar coordinate system is as follows:

[0159] Intra-packet position encoding: The position of a byte in a data packet is represented by an angle (θ) in a polar coordinate system, and the radius (r) represents the relative importance or weight of the byte.

[0160] Box location encoding: The box location information is encoded into angle (θ) and radius (r) through a rotation matrix to ensure that the order information between different boxes is not confused.

[0161] By combining intra-packet and inter-packet positional encoding for each byte, the structure of bytes within a data packet and dependencies between packets can be effectively expressed. This encoding method has the following characteristics:

[0162] Relative positional consistency: For bytes that are at the same distance, whether they are intra-packet bytes or inter-packet bytes, the encoded values ​​maintain consistency.

[0163] Independence: The location information within and between packages is encoded independently in different dimensions, without interfering with each other.

[0164] Distance sensitivity: By varying the angle and radius, the encoding can accurately reflect the relative distance between bytes, enhancing the ability to model local and global dependencies.

[0165] 3. Calculation method for dual-position encoding:

[0166] To implement dual-position encoding, we use the following formula for encoding calculation. Assuming a byte in a data packet is at position (m, n), the encodings for its intra-packet position and inter-packet position are as follows:

[0167] Intra-packet location encoding:

[0168]

[0169] Private room location code:

[0170]

[0171] in, The rotation matrix is ​​used to encode the intra-packet and inter-packet positions by encoding the angles and radii at different intra-packet and inter-packet locations. Based on this, matrix multiplication is performed to obtain the final position information. The intra-packet and inter-packet positions of each byte are calculated independently and then combined using this method.

[0172] 4. Optimization and efficiency of dual-position encoding:

[0173] To improve the computational efficiency of two-position encoding, we accelerate the process through the following optimization measures:

[0174] Linear time computation: By optimizing the rotation matrix in a structured manner, the computation that requires O(n²) time complexity in traditional position coding is avoided, and the time complexity is reduced to O(n), making this method suitable for large-scale network traffic data.

[0175] Effective transfer of location information: By using rotation matrices and vector multiplication, intra- and inter-packet location information can be effectively transferred with low computational cost and its expressive power can be maintained in high-dimensional space.

[0176] 5. Practical applications of dual-position encoding:

[0177] In network traffic classification, dual-position encoding can effectively solve the problem of ambiguous dependencies between intra-packet and cross-packet bytes in traditional encoding methods. This method is particularly suitable for the following scenarios:

[0178] Encrypted traffic classification: Encrypted traffic is often difficult to classify effectively using traditional methods, while dual-position encoding can capture hidden dependencies in the traffic and improve the identification ability of encrypted traffic.

[0179] IoT traffic classification: Traffic generated by IoT devices is highly heterogeneous, and dual-location coding can enhance the ability to identify different communication modes and protocols.

[0180] Attack detection: By precisely encoding the dependencies between bytes, dual-position encoding can more accurately identify potential attack patterns, such as DDoS attacks or malware communications.

[0181] Optional applications and optimizations of the hybrid masking mechanism are as follows:

[0182] This embodiment provides a mixed masking mechanism in a network traffic classification method based on two-position coding (PS-Pos). The aim is to optimize the computation process of the attention mechanism, balancing the attention distribution of intra-packet and inter-packet bytes, thereby improving the accuracy and efficiency of traffic classification tasks. This method introduces a masking mechanism into the original Transformer model, employing different masking strategies for different importance levels of cross-packet bytes and intra-packet bytes to reduce model overfitting and computational burden. The following combines... Figure 5 Describe in detail the working principle of the hybrid masking mechanism and its optimization of model performance.

[0183] 1. The core idea of ​​the hybrid masking mechanism:

[0184] like Figure 5As shown, the hybrid masking mechanism implements different masking strategies between intra-packet bytes and cross-packet bytes by dividing the attention matrix into blocks. Specifically, the main diagonal of the attention matrix represents the relationships between intra-packet bytes, while the other parts represent the relationships between cross-packet bytes. Since the relationships between intra-packet bytes are usually relatively tight, while the relationships between cross-packet bytes are relatively loose, traditional global attention mechanisms may cause the model to compute too much irrelevant attention when dealing with cross-packet dependencies, thus affecting the classification performance.

[0185] To address this issue, this embodiment employs the following steps to implement the hybrid mask:

[0186] Step 1: Blocking by Intra-Band Dependency: When calculating attention, the attention matrix is ​​first divided into two parts: one part is the attention matrix between bytes within a packet, and the other part is the attention matrix between bytes between packets. For bytes within a packet, their calculation weights are retained; for bytes between packets, a masking strategy is applied.

[0187] Step 2: Apply a mask: Apply a random mask to the attention matrix of inter-packet bytes to block out some of the interference between cross-packet bytes. The mask ratio is set by a hyperparameter, usually adjusted between 0.3 and 0.7, to maintain the main dependencies between intra-packet bytes while reducing interference from cross-packet bytes.

[0188] Step 3: Weighted balancing: Weight the attention matrix after masking to ensure that bytes within a packet receive more attention, while adjusting the attention weights of bytes across packets based on the influence of bytes between packets.

[0189] 2. Mathematical expression for the hybrid masking mechanism:

[0190] In the hybrid masking mechanism, the computation of the attention matrix involves masking the product of the query (Q) and the key (K). Specifically, given the query matrix Q and the key matrix K, the masking operation when computing their self-attention matrix can be expressed by the following formula:

[0191]

[0192] Here, M is a mask matrix, indicating which attention weights need to be masked. For relationships between bytes within a packet, the mask matrix is ​​zero, indicating that these relationships are not interfered with. For relationships between bytes across packets, some positions in the mask matrix are assigned negative infinity values ​​to mask their attention calculations. For key dimension parameters.

[0193] 3. Advantages of the hybrid masking mechanism:

[0194] Reduce computational complexity: By shielding some attention calculations across packet bytes, the hybrid masking mechanism can significantly reduce computational complexity and unnecessary computation, especially when dealing with long sequences and large-scale data, thereby improving the inference speed of the model.

[0195] Improved accuracy and robustness: By paying more attention to the relationships between bytes within a packet and using appropriate cross-packet byte masks, the hybrid masking mechanism effectively reduces noise interference from cross-packet bytes, enabling the model to better learn key patterns in the traffic and improve classification accuracy.

[0196] Enhancing model interpretability: Masking strategies can more clearly explain the model's focus during the decision-making process. For example, by observing attention maps with different masking ratios, we can understand the model's dependencies on intra-packet and inter-packet bytes.

[0197] 4. Application examples of the hybrid masking mechanism:

[0198] In practical applications, the hybrid masking mechanism can be widely used in the following types of network traffic classification tasks:

[0199] Encrypted traffic detection: Encrypted traffic is often difficult to identify effectively using traditional feature extraction methods. By using a hybrid masking mechanism, the model can focus on the structured information in the encrypted traffic, improving the classification accuracy of encrypted traffic.

[0200] IoT device traffic identification: Traffic data generated by IoT devices has strong local dependencies and cross-device connections. Hybrid masking mechanisms can effectively distinguish traffic characteristics inside and outside the device, improving traffic identification capabilities in the IoT environment.

[0201] Malicious Traffic Detection: Malicious traffic (such as DDoS attacks) is typically characterized by its large scale and heterogeneity. Hybrid masking mechanisms enhance the detection capability of attack traffic by improving the accuracy of dependency modeling between bytes within a packet.

[0202] 5. Optimization and adjustment of the hybrid masking mechanism:

[0203] In the hybrid masking mechanism, the mask ratio is a key hyperparameter that needs to be adjusted according to different datasets and application scenarios. Experiments show that when the mask ratio is set between 0.4 and 0.6, the model performs most stably, effectively reducing cross-packet interference while preserving intra-packet dependencies. Furthermore, the hybrid masking effect can be further improved by combining it with other attention mechanisms (such as relative position encoding and convolutional layers) to enhance classification accuracy.

[0204] Technical effects:

[0205] Experiments have shown that the Sorter framework proposed in this invention significantly outperforms existing methods on multiple datasets, especially in terms of generalization ability and accuracy in high-complexity and high-encryption environments.

[0206] The following F1 scores were achieved on datasets such as CIC-IoT, USTC-TFC, and ISCX-Tor:

[0207] CIC-IoT: 87.68%

[0208] USTC-TFC: 99.42%

[0209] ISCX-Tor: 95.49%

[0210] Compared to representative models such as ET-BERT and SAM, the method of this invention achieves an average improvement of over 9%. Furthermore, ablation experiments further demonstrate that:

[0211] Removing the dual-position encoding will result in a 12.85% decrease in accuracy;

[0212] Removing the blending mask reduces accuracy by 2.16%;

[0213] Timing slicing strategies and maximum packet limits in system design also have a positive impact on performance.

[0214] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network traffic classification method based on dual positional coding and hybrid masking mechanism, characterized in that, include: The input network traffic is segmented according to time segments, and a structured traffic representation is generated based on the source address, destination address, source port, destination port and transport protocol. Perform dual location encoding on the data packets in the structured traffic representation, the dual location encoding including: a) Intra-packet position encoding, used to represent the relative position of a byte within its data packet; b) Packet position encoding, used to indicate the order of data packets in the overall network traffic; The stream data with dual positional encoding is input into the Transformer-based encoding model, and a hybrid masking mechanism is introduced during the attention calculation process to balance the byte dependencies within and between packets. Obtain the classification result output by the encoding model and make a judgment based on the preset confidence threshold. If the confidence of the classification result is within the preset confidence interval, perform stream caching and reconstruction processing; otherwise, output the classification result directly. Hybrid masking mechanism: In the self-attention matrix QKT, the main diagonal block is retained; Apply random occlusion to off-diagonal blocks, with occlusion probability α∈[0,1]; First, define the rules for generating the hybrid mask matrix: The corresponding attention score matrix can be represented as: Where i and j are the row and column indices of the attention matrix, corresponding to the i-th and j-th positions in the input stream byte sequence, respectively; if they belong to the same data packet, they are considered to have an intra-packet dependency relationship, let If they belong to different data packets, they will be randomly masked according to a set ratio. This weakens cross-package dependencies during attention computation.

2. The network traffic classification method based on dual positional coding and hybrid masking mechanism according to claim 1, characterized in that, Dual positional encoding is constructed using a rotation matrix.

3. The network traffic classification method based on dual positional coding and hybrid masking mechanism according to claim 1, characterized in that, The hybrid masking mechanism achieves a dynamic balance between intra-packet and inter-packet attention allocation by randomly masking some inter-packet byte dependencies in the attention matrix.

4. The network traffic classification method based on dual positional coding and hybrid masking mechanism according to claim 1, characterized in that, The confidence interval includes an upper threshold and a lower threshold; If the confidence level is greater than or equal to the upper threshold, the classification result is output directly; If the confidence level is greater than the lower threshold and less than the upper threshold, the network traffic is cached and reconstructed and reclassified in conjunction with subsequent network traffic.

5. A network traffic classification system based on dual positional coding and hybrid masking mechanism, characterized in that, include: The input module is used to segment the input network traffic according to time segments and generate a structured traffic representation based on the source address, destination address, source port, destination port and transport protocol; An encoding module is configured to perform dual location encoding on data packets in the structured traffic representation, the dual location encoding comprising: a) Intra-packet position encoding, used to represent the relative position of a byte within its data packet; b) Packet position encoding, used to indicate the order of data packets in the overall network traffic; The Transformer model module is used to input dual positionally encoded streaming data into a Transformer-based encoding model. It introduces a hybrid masking mechanism during attention calculation to balance intra-packet and inter-packet byte dependencies. The judgment module is used to obtain the classification results output by the coding model and make a judgment based on the preset confidence threshold. The reconstruction module is used to cache and reconstruct network traffic with confidence levels within the confidence range, and then re-input it into the Transformer model module. Hybrid masking mechanism: In the self-attention matrix QKT, the main diagonal block is retained; Apply random occlusion to off-diagonal blocks, with occlusion probability α∈[0,1]; First, define the rules for generating the hybrid mask matrix: The corresponding attention score matrix can be represented as: Where i and j are the row and column indices of the attention matrix, corresponding to the i-th and j-th positions in the input stream byte sequence, respectively; if they belong to the same data packet, they are considered to have an intra-packet dependency relationship, let If they belong to different data packets, they will be randomly masked according to a set ratio. This weakens cross-package dependencies during attention computation.

6. The system according to claim 5, characterized in that, The encoding module uses a two-byte word segmentation method for traffic data preprocessing.

7. The system according to claim 5 or 6, characterized in that, The determination module is used to call the reconstruction module to perform traffic splicing and reclassification based on the determination result.

Images