Communication flow fine classification method based on attention mechanism and terminal

Abstract

The invention discloses a communication flow fine classification method based on an attention mechanism and a terminal, and the method comprises the steps: collecting original communication data, generating a packet-level sequence after processing, and fusing historical fingerprints to generate a prototype vector; inputting the packet-level sequence into a semantic reconstructor, and generating a semantic sequence through three-layer processing; mapping the semantic segments to a semantic space, constructing an offset graph, and aggregating and paying attention; constructing a conflict matrix, executing attention operation after decoupling conflicts, and generating residual representation; fusing the enhanced representation and the residual representation, executing prototype alignment, and outputting a preliminary result; and constructing a multi-layer time sequence diagram, spreading space and time attention, and outputting a final classification result. According to the method, through combination of communication flow semantic reconstruction, a causal attention mechanism and time sequence diagram correction, high-precision, stable and explainable refined classification of encrypted complex flow is realized.

Description

Technical Field

[0001] This invention relates to the field of intelligent analysis technology for communication networks, and in particular to a method and terminal for refined classification of communication traffic based on an attention mechanism. Background Technology

[0002] In modern communication networks, with the expansion of business scale and the continuous updating of application forms, network traffic structures are becoming increasingly complex, including a growing number of types such as encrypted traffic, spoofed traffic, multi-server mixed traffic, and highly dynamic application interaction flows. Traditional communication traffic identification methods mostly rely on port numbers, protocol fields, shallow statistical features, or fixed pattern matching. These methods could meet basic classification needs in relatively simple network environments in the past, but they are gradually becoming ineffective in today's highly encrypted, highly dynamic, and highly concurrent network scenarios. In particular, the widely adopted TLS / QUIC encryption protocol makes the payload content invisible, rendering traditional traffic classification techniques based on deep packet inspection ineffective. The contradiction between the need for refined identification of communication flows and the capabilities of existing technologies is becoming increasingly prominent.

[0003] In recent years, deep learning-based traffic classification methods have gradually emerged, utilizing convolutional networks, recurrent networks, or self-attention models to model packet sequences and extract deep traffic features. However, these techniques generally treat communication flows as single packet-level sequences, lacking the semantic expression ability of communication behavior itself and failing to convert behavioral patterns into structured semantic information. Existing deep models typically rely only on surface correlations for classification, lacking causal discrimination mechanisms, making it difficult to distinguish between key semantic segments that truly influence the category and irrelevant noise segments. They generally treat traffic as independent individuals for inference, failing to utilize cross-time slice, cross-session, and cross-terminal correlations for result calibration, leading to classification instability and poor stability under changing business scenarios.

[0004] In summary, existing communication traffic classification methods suffer from several shortcomings when dealing with encrypted traffic, spoofed traffic, and complex business scenarios. These include weak fine-grained classification capabilities, insensitivity of models to business changes, uninterpretable results, severe semantic deficiencies, lack of causal discrimination mechanisms, and inability to utilize temporal correlations for recalibration. Consequently, they fail to meet the demands for high-precision, high-stability, and highly interpretable traffic classification in real-world network environments.

[0005] Therefore, how to provide a refined classification method and terminal for communication traffic based on attention mechanism is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a refined classification method and terminal for communication traffic based on an attention mechanism. This invention fully utilizes communication flow semantic reconstruction technology, multi-level prototype causal attention mechanism, and time sequence graph attention calibration technology. By semantically generating communication flows, identifying causality, and recalibrating time consistency, it constructs a classification process that can characterize deep behavioral semantics and adapt to complex business scenarios. It effectively overcomes the existing technical bottlenecks such as unparseable encrypted traffic, difficulty in identifying spoofed traffic, and unstable classification under dynamic business modes. It has the advantages of strong refined recognition capability, high stability of classification results, good interpretability, and good adaptability to changes in the business environment.

[0007] The attention-based fine-grained classification method for communication traffic according to embodiments of the present invention includes: Raw traffic data from the communication network is collected, processed to obtain packet-level raw sequences, and generated category prototype vectors based on the semantic fingerprint statistical fusion of historical communication flows. The packet-level raw sequence is input into the communication flow semantic reconstructor, which includes a dynamic behavior kernel layer, a semantic fingerprint mapping layer, and a self-guided comparison annotation layer to perform semantic topological evolution processing and generate a semantic sequence. Taking a semantic sequence as input, semantic fragments are mapped to a multi-path semantic pointing vector space, a semantic bias graph structure is constructed, parallel attention computation is performed on different semantic pointing paths, and the results of parallel attention computation are aggregated to obtain an enhanced semantic representation. A cross-prototype semantic conflict matrix is ​​constructed using category prototype vectors as input. A semantic conflict decoupling vector is generated based on the semantic sequence. Attention calculation is performed on the semantic fragments through a multi-dimensional prototype conflict decoupling attention mechanism to generate suppressed residual representations. Semantic reconstruction attention operations are performed based on enhanced semantic representation and suppressed residual representation to obtain causal semantic reconstruction representation, which is then aligned with the category prototype vector to form preliminary refined category results of the communication flow; Construct a multi-layered temporal flow graph including flow nodes, session nodes, and terminal nodes. Build a graph structure by connecting flow nodes of different time slices through temporal and spatial association edges. Perform spatial attention propagation and temporal consistency attention propagation to generate a recalibrated flow-level representation and output the final refined classification result of the communication flow.

[0008] Optionally, the raw traffic data includes a packet length sequence, a packet timestamp sequence, a packet direction identifier, a transport layer protocol flag, cryptographic handshake metadata, and a payload entropy value.

[0009] Optionally, the processing of the raw traffic data includes time alignment, noise packet removal, abnormal packet filtering, data packet header field normalization, and packet sequence length unification.

[0010] Optionally, generating the category prototype vector includes: The semantic fingerprints, dynamic behavioral kernel features, and self-guided comparison labels of historical communication flows are archived and stored. The archived data is mapped to a unified semantic prototype space, and multi-source feature fusion operations are performed to obtain a fused semantic feature set. Density clustering is performed on the fused semantic feature set; for each cluster obtained, a weighted average of all feature vectors within the cluster is calculated according to the density weight of the semantic feature points, and the resulting weighted average vector is used as the category prototype vector of the cluster.

[0011] Optionally, generating the semantic sequence includes: Initialize the processing context of the communication flow semantic reconstructor, and set the kernel candidate rules of the dynamic behavior kernel layer, the fingerprint field set of the semantic fingerprint mapping layer, and the comparison constraints of the self-guided comparison annotation layer. In the dynamic behavior kernel layer, candidate boundaries for behavior kernels are generated based on packet direction flipping events, burst rate change points, round-trip delay mutation points, encrypted handshake boundaries, and idle interval interruption points. Candidate boundaries near the same location are merged and filtered to determine the kernel center and coverage area. The original packet-level sequence is divided into several behavior kernel intervals and a set of target behavior segments is extracted. A unique kernel identifier is assigned to each target behavior segment. In the semantic fingerprint mapping layer, time morphological features, protocol behavior features and entropy structure features are calculated for each target behavior segment. The features are encoded into a composite semantic fingerprint. Conflict detection is performed on all composite semantic fingerprints. For composite semantic fingerprints that have conflicts, the kernel identifier field and local order field are introduced to expand them until each target behavior segment corresponds to a unique composite semantic fingerprint. In the self-guided comparison annotation layer, based on the terminal identifier, session identifier, and server identifier, target behavior segments with consistent or high similarity in composite semantic fingerprints are classified as self-guided comparison positive samples, and target behavior segments with mutually exclusive composite semantic fingerprints and inconsistent service modes are classified as self-guided comparison negative samples. The historical semantic annotation records and category prototype vectors are compared and matched to determine a single semantic label for each target behavior segment. Based on the temporal order of the target behavior segments in the original stream, the target behavior segments with kernel identifiers, composite semantic fingerprints and semantic labels are sorted. Adjacent target behavior segments with consistent semantic labels and time intervals not exceeding a preset threshold are merged to generate a semantic sequence.

[0012] Optionally, obtaining the enhanced semantic representation includes: For each semantic segment in the semantic sequence, multi-vector mapping is performed according to the preset number of paths, mapping the same semantic segment into several semantic pointing paths. Each semantic pointing path retains the segment embedding vector, kernel identifier, semantic label, and local position information of the path in the segment. Construct a semantic bias graph structure using category prototype vectors as prototype nodes and semantic pointing paths as path nodes: A directed bias edge is established between each path node and the connected prototype node, and three types of biases are written: the historical semantic label consistency score is used as the prototype consistency bias, the reciprocal of the semantic fingerprint occurrence frequency is used as the semantic sparseness bias, and the reciprocal of the occurrence interval variance within the same terminal is used as the time stability bias. Establish cross-prototype suppression edges between different prototype nodes, and write the conflict strength according to the mutual exclusion degree of semantic labels; For each path node, calculate the proportion of the number of covered packets to the total number of fragment packets and the fragment embedding entropy. The two indicators are weighted to obtain the path effectiveness score, which is written into the semantic bias graph structure as the path weight. Parallel attention computation is performed independently on each semantic pointing path in the semantic bias graph structure. The prototype-path attention weight is determined based on the path weight and the three types of biases connecting the prototype nodes. Prototype-path pairs with attention weights below the threshold are pruned. The remaining attention weights are reduced based on the conflict intensity of cross-prototype suppression edges to obtain the path-level augmented representation. All path-level augmented representations of the same semantic segment are aggregated, and the path-level augmented representations are weighted and summed according to the path validity score. The connectivity factor of the path nodes in the semantic bias graph is considered, and the aggregation result is normalized to obtain the augmented semantic representation of the semantic segment.

[0013] Optionally, the generation of the suppressed residual representation includes: Using the generated category prototype vectors as objects, the conflict intensity between prototypes is calculated pairwise based on four indicators: mutual exclusion relationship of historical semantic labels, sample-level misjudgment confusion statistics, frequency of alternating occurrence of categories in the same session, and confidence interval of semantic fingerprint co-occurrence. The conflict intensity is then processed by interval pruning and normalization to obtain a symmetric cross-prototype semantic conflict matrix with zero diagonal elements. Obtain the enhanced semantic representation, and calculate the normalized similarity score between each semantic segment in the enhanced semantic representation and the prototype vectors of all categories to form a prototype similarity vector for the semantic segment; Based on the cross-prototype semantic conflict matrix, the prototype similarity vector is decoupled from the similarity of each type of prototype. The interference component of other prototypes with conflicting relationships is deducted from the similarity of each type of prototype to obtain the semantic conflict decoupling vector. Then, exponential normalization is performed to obtain the conflict weight vector. Four attention channels are established for each category prototype: time dimension, orientation pattern dimension, entropy structure dimension, and protocol behavior dimension. The conflict weight vector, the channel weight of the prototype in the corresponding dimension, and the channel feature of the semantic segment in the corresponding dimension are used as inputs. Attention weights are independently assigned to channels and weighted aggregation is performed within the channels. The four channels are weighted and merged according to the channel importance coefficient to generate a suppression aggregation vector. Based on the enhanced semantic representation, the suppressed aggregation vector is subtracted to obtain the suppressed residual representation of the semantic segment.

[0014] Optionally, the preliminary refined classification results forming the communication flow include: The enhanced semantic representation and the suppressed residual representation are received and denoted as the enhanced representation vector and the residual representation vector, respectively. The two are then aligned in the same dimension and scaled. Construct a reconstruction gate coefficient, and generate a gate weight sequence between zero and one based on the dimension-wise combination features of the enhanced representation vector and the residual representation vector, semantic labels and kernel identifiers, which is used to control the fusion ratio of enhanced information and residual information in each dimension; Perform semantic reconstruction attention computation, and perform attention aggregation on the gated enhanced component and the gated residual component within the segment and between adjacent segments respectively. The attention within the segment is based on the segment's own temporal position and local order, and the attention between segments is based on the same semantic label or the same kernel identifier, to obtain the causal semantic reconstruction representation of the semantic segment. The causal semantic reconstruction representation is aligned with the category prototype vector set to obtain the similarity score of each category and the corresponding prototype matching index. A preset number of candidate categories are selected based on the similarity score ranking, and preliminary refined category results are generated.

[0015] Optionally, the final refined classification result of the output communication stream includes: Construct a multi-layered temporal flow graph, establish three types of nodes within a continuous time slice: flow nodes, session nodes, and terminal nodes. Establish spatial association edges according to the relationship between the same session, the same terminal, and the same server. Establish temporal association edges according to the temporal adjacency relationship between the same terminal or the same session. Use causal semantic reconstruction representation as the initial feature of flow nodes, and use session statistics and terminal statistics as the initial features of corresponding nodes. Spatial attention propagation is performed. For each flow node, the features of adjacent nodes are aggregated according to the session-related edges and terminal-related edges within the same time slice. Attention weights are determined based on edge type, edge weight and feature similarity. Attention weights below the threshold are pruned to obtain the spatial aggregation representation. For each flow node, the features of historical and future neighboring nodes are aggregated according to the temporal association edges within adjacent time slices. The temporal attention weight is determined based on the time interval, category candidate consistency, and behavioral pattern continuity. The temporal attention weights that have undergone category candidate mutations and do not meet the behavioral continuity are attenuated to obtain the temporal aggregated representation. The spatial aggregation representation and the temporal aggregation representation are weighted and fused according to the channel coefficient, which is determined by the proportion of edge types and the connectivity of nodes in the graph. The fusion result is normalized and stability measures are calculated to obtain the recalibrated flow level representation. Based on the recalibrated flow level representation and category prototype vector, the final prototype alignment and decision output are performed to generate the final refined classification results, confidence scores, temporal consistency scores and anomalous mutation markers of the communication flow, and the final refined classification results are output.

[0016] A terminal for fine-grained classification of communication traffic based on an attention mechanism, comprising: Memory, used to store programs; A processor for executing the program stored in the memory.

[0017] The beneficial effects of this invention are: This invention introduces a communication flow semantic reconstructor, which transforms the original packet-level sequence from a simple statistical feature or shallow format for classification. Instead, it dynamically kernels, semantically fingerprints, and performs self-guided comparative annotation, thereby forming a semantic sequence expression capable of characterizing real business behavior. This semantic modeling approach effectively overcomes the limitations of encrypted traffic content being invisible, masquerading traffic lacking representation, and traditional methods struggling to extract high-level behavioral patterns, enabling communication traffic to possess a clear behavioral semantic structure before entering the classification stage.

[0018] This invention further achieves causal discrimination of semantic segments and enhanced processing of key segments through a multi-path prototype bias attention mechanism and a multi-dimensional prototype conflict decoupling attention mechanism. By constructing a semantic bias graph structure and a cross-prototype semantic conflict matrix, this invention can identify semantic differences and mutual exclusion relationships between different categories, so that the classification process no longer relies on the surface correlation of segments, but makes judgments based on the deep semantic logic of category prototypes. This causal attention mechanism significantly improves the discrimination accuracy in complex business environments and reduces classification bias caused by misidentification and false associations.

[0019] This invention constructs a multi-layered temporal flow graph comprising flow nodes, session nodes, and terminal nodes, and combines spatial attention propagation with temporally consistent attention propagation to achieve cross-time slice, cross-session, and cross-terminal association correction capabilities. This effectively improves the stability and robustness of classification results, enabling the system to maintain high-reliability output under dynamic scenarios such as service switching, access mode changes, and network fluctuations. This invention ensures high accuracy while also providing interpretability and stability, enhancing the practical application value of refined communication traffic classification. Attached Figure Description

[0020] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of the communication traffic fine-grained classification method based on attention mechanism proposed in this invention; Figure 2 This is a schematic diagram of the communication flow semantic reconstructor of the communication flow fine-grained classification method based on the attention mechanism proposed in this invention. Detailed Implementation

[0021] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0022] refer to Figure 1 and Figure 2 Fine-grained classification methods for communication traffic based on attention mechanisms include: Raw traffic data from the communication network is collected, processed to obtain packet-level raw sequences, and generated category prototype vectors based on the semantic fingerprint statistical fusion of historical communication flows. The packet-level raw sequence is input into the communication flow semantic reconstructor, which includes a dynamic behavior kernel layer, a semantic fingerprint mapping layer, and a self-guided comparison annotation layer to perform semantic topological evolution processing and generate a semantic sequence. Taking a semantic sequence as input, semantic fragments are mapped to a multi-path semantic pointing vector space, a semantic bias graph structure is constructed, parallel attention computation is performed on different semantic pointing paths, and the results of parallel attention computation are aggregated to obtain an enhanced semantic representation. A cross-prototype semantic conflict matrix is ​​constructed using category prototype vectors as input. A semantic conflict decoupling vector is generated based on the semantic sequence. Attention calculation is performed on the semantic fragments through a multi-dimensional prototype conflict decoupling attention mechanism to generate suppressed residual representations. Semantic reconstruction attention operations are performed based on enhanced semantic representation and suppressed residual representation to obtain causal semantic reconstruction representation, which is then aligned with the category prototype vector to form preliminary refined category results of the communication flow; Construct a multi-layered temporal flow graph including flow nodes, session nodes, and terminal nodes. Build a graph structure by connecting flow nodes of different time slices through temporal and spatial association edges. Perform spatial attention propagation and temporal consistency attention propagation to generate a recalibrated flow-level representation and output the final refined classification result of the communication flow.

[0023] In this embodiment, the raw traffic data includes a data packet length sequence, a data packet timestamp sequence, a data packet direction identifier, a transport layer protocol flag, encrypted handshake metadata, and a payload entropy value.

[0024] In this embodiment, the processing of the raw traffic data includes time alignment, noise packet removal, abnormal packet filtering, data packet header field normalization, and packet sequence length unification.

[0025] In this embodiment, generating the category prototype vector includes: The semantic fingerprints, dynamic behavioral kernel features, and self-guided comparison labels of historical communication flows are archived and stored. The archived data is mapped to a unified semantic prototype space, and multi-source feature fusion operations are performed to obtain a fused semantic feature set. Density clustering is performed on the fused semantic feature set; for each cluster obtained, a weighted average of all feature vectors within the cluster is calculated according to the density weight of the semantic feature points, and the resulting weighted average vector is used as the category prototype vector of the cluster.

[0026] In this embodiment, generating the semantic sequence includes: Initialize the processing context of the communication flow semantic reconstructor, and set the kernel candidate rules of the dynamic behavior kernel layer, the fingerprint field set of the semantic fingerprint mapping layer, and the comparison constraints of the self-guided comparison annotation layer. In the dynamic behavior kernel layer, candidate boundaries for behavior kernels are generated based on packet direction flipping events, burst rate change points, round-trip delay mutation points, encrypted handshake boundaries, and idle interval interruption points. Candidate boundaries near the same location are merged and filtered to determine the kernel center and coverage area. The original packet-level sequence is divided into several behavior kernel intervals and a set of target behavior segments is extracted. A unique kernel identifier is assigned to each target behavior segment. In the semantic fingerprint mapping layer, temporal morphological features, protocol behavior features, and entropy structure features are calculated for each target behavior segment. These features are encoded into a composite semantic fingerprint. Conflict detection is performed on all composite semantic fingerprints. For composite semantic fingerprints that conflict, expansion is achieved by introducing a kernel identifier field and a local order field until each target behavior segment corresponds to a unique composite semantic fingerprint. The calculated temporal morphological features, protocol behavior features, and entropy structure features include: Calculation of temporal morphological features: According to the arrival order of data packets within the target behavior segment, extract the time interval sequence between packets, calculate the average interval, maximum interval, minimum interval and standard deviation, record the duration of consecutive segments in the same direction and the overall duration of the segment, and combine the statistical values ​​to form temporal morphological features. Protocol behavior feature calculation: Traverse all data packets of the target behavior segment, accumulate the number of times the protocol flag appears, count the number of uplink and downlink packets, the number of direction switching, the number of protocol handshakes, and the application layer handshake type identifier, and combine the counts and handshake types to form protocol behavior features; Entropy structure feature calculation: For the payload byte sequence of the target behavior segment, calculate the payload entropy mean, entropy variance, entropy kurtosis and entropy skewness, and at the same time count the percentage of high entropy packets and low entropy packets, and combine the entropy statistical indicators into entropy structure features; In the self-guided comparison annotation layer, based on the terminal identifier, session identifier, and server identifier, target behavior segments with consistent or high similarity in composite semantic fingerprints are classified as self-guided comparison positive samples, and target behavior segments with mutually exclusive composite semantic fingerprints and inconsistent service modes are classified as self-guided comparison negative samples. The historical semantic annotation records and category prototype vectors are compared and matched to determine a single semantic label for each target behavior segment. Based on the temporal order of the target behavior segments in the original stream, the target behavior segments with kernel identifiers, composite semantic fingerprints and semantic labels are sorted. Adjacent target behavior segments with consistent semantic labels and time intervals not exceeding a preset threshold are merged to generate a semantic sequence.

[0027] In this embodiment, obtaining the enhanced semantic representation includes: For each semantic segment in the semantic sequence, multi-vector mapping is performed according to a preset number of paths, mapping the same semantic segment into several semantic pointing paths. Each semantic pointing path retains the segment embedding vector, kernel identifier, semantic label, and local position information of the path within the segment. The preset number of paths is three, corresponding to the temporal morphology path, protocol behavior path, and entropy structure path, respectively. The specific steps of mapping the same semantic segment into several semantic pointing paths are as follows: Temporal morphology path mapping: Read the temporal morphology features of semantic segments, concatenate them bitwise with the segment embedding vector, and then feed them into a dedicated temporal morphology projection network to generate a temporal morphology path vector, and attach the corresponding kernel identifier, semantic label, and segment start and end time position information. Protocol behavior path mapping: Read the protocol behavior features of the semantic segment, concatenate them bit by bit with the segment embedding vector, and then feed them into the protocol behavior dedicated projection network to generate the protocol behavior path vector, and attach the corresponding kernel identifier, semantic label and the position information of the segment in the uplink or downlink direction. Entropy structure path mapping: Read the entropy structure features of the semantic segment, concatenate them with the segment embedding vector bit by bit, and then feed them into the entropy structure dedicated projection network to generate the entropy structure path vector, and attach the corresponding kernel identifier, semantic label and the order position information of the segment in the segment sequence. Construct a semantic bias graph structure using category prototype vectors as prototype nodes and semantic pointing paths as path nodes: A directed bias edge is established between each path node and the connected prototype node, and three types of biases are written: the historical semantic label consistency score is used as the prototype consistency bias, the reciprocal of the semantic fingerprint occurrence frequency is used as the semantic sparseness bias, and the reciprocal of the occurrence interval variance within the same terminal is used as the time stability bias. Establish cross-prototype suppression edges between different prototype nodes, and write the conflict strength according to the mutual exclusion degree of semantic labels; For each path node, calculate the proportion of the number of covered packets to the total number of fragment packets and the fragment embedding entropy. The two indicators are weighted to obtain the path effectiveness score, which is written into the semantic bias graph structure as the path weight. Parallel attention computation is performed independently on each semantic pointing path in the semantic bias graph structure. The prototype-path attention weight is determined based on the path weight and the three types of biases connecting the prototype nodes. Prototype-path pairs with attention weights below the threshold are pruned. The remaining attention weights are reduced based on the conflict intensity of cross-prototype suppression edges to obtain the path-level augmented representation. All path-level augmented representations of the same semantic segment are aggregated, and the path-level augmented representations are weighted and summed according to the path effectiveness score. The connectivity factor of the path nodes in the semantic bias graph is considered, and the aggregation result is normalized to obtain the augmented semantic representation of the semantic segment, where: The path validity score is: The coverage factor is obtained by calculating the proportion of data packets covered by the statistical path to the total number of data packets in the semantic segment. Calculate the entropy value of the path embedding vector. The higher the entropy value, the richer the information content. Convert the entropy value into an information content factor. The coverage factor and information factor are linearly weighted and summed according to preset weights to obtain the path effectiveness score. Connectivity factor: The connectivity factor of a path node is determined by counting the number of valid edges between the path node and all prototype nodes and other path nodes in the semantic bias graph, summing the edges according to their weights, and then normalizing the result by dividing it by the maximum weighted number of edges between nodes in the same layer. The result is a value between zero and one.

[0028] In this embodiment, the generation of suppressed residual representation includes: Using the generated category prototype vectors as objects, the conflict intensity between prototypes is calculated pairwise based on four indicators: mutual exclusion of historical semantic labels, sample-level misjudgment and confusion statistics, frequency of alternating occurrence of categories within the same session, and co-occurrence confidence interval of semantic fingerprints. Interval pruning and normalization are then performed on the conflict intensity to obtain a symmetric cross-prototype semantic conflict matrix with zero diagonal elements, where: Semantic fingerprint co-occurrence confidence interval: Traverse all communication streams in historical data, record the number of times the semantic fingerprints corresponding to any two class prototypes co-occur in the same session and the total number of sessions, calculate the observed co-occurrence ratio, and based on the binomial distribution hypothesis, use the observation ratio as the center and the Wilson interval with a 95% confidence level to estimate the upper and lower bounds, and use the obtained upper and lower bounds as the co-occurrence confidence intervals for prototype semantic fingerprints. The specific steps for calculating the conflict intensity between prototypes pairwise are as follows: For any two category prototypes, obtain the semantic label mutual exclusion rate, sample-level misjudgment confusion rate, alternating frequency and upper limit of the confidence interval for co-occurrence of semantic fingerprints respectively, and linearly normalize the four indicators to the interval of 0 to 1 according to their respective historical extreme value ranges. Based on the importance of the business, four normalized indicators are assigned preset weights so that the sum of the four weights is 1. The four normalized values ​​are then weighted and summed according to their corresponding weights to obtain the original conflict score of the prototype. The original conflict score is compared with the set conflict threshold. Scores below the threshold are set to 0, and scores above the threshold are linearly remapped to the 0 to 1 range based on the current maximum value. The mapped value is the conflict intensity against the category prototype. Obtain the enhanced semantic representation, and calculate a normalized similarity score for each semantic segment in the enhanced semantic representation with the prototype vectors of all categories to form a prototype similarity vector for the semantic segment. The calculation of the normalized similarity score is specifically as follows: The original similarity score is obtained by performing a vector dot product between the embedding vector of the semantic segment and the prototype vector of each category. Divide the original similarity score by the product of the semantic fragment vector and the magnitude of the corresponding prototype vector to limit the resulting value to the interval between -1 and 1. The normalized values ​​are shifted as a whole and stretched linearly by a ratio of 0.5 so that the final similarity score falls into the range of 0 to 1, forming the prototype similarity vector of the semantic segment. Based on the cross-prototype semantic conflict matrix, the prototype similarity vector is decoupled from the similarity of each type of prototype. The interference component of other prototypes with conflicting relationships is deducted from the similarity of each type of prototype to obtain the semantic conflict decoupling vector. Then, exponential normalization is performed to obtain the conflict weight vector. Four attention channels are established for each category prototype: time dimension, orientation pattern dimension, entropy structure dimension, and protocol behavior dimension. The conflict weight vector, the channel weight of the prototype in the corresponding dimension, and the channel feature of the semantic segment in the corresponding dimension are used as inputs. Attention weights are independently assigned to channels and weighted aggregation is performed within the channels. The four channels are weighted and merged according to the channel importance coefficient to generate a suppression aggregation vector. Based on the enhanced semantic representation, the suppressed aggregation vector is subtracted to obtain the suppressed residual representation of the semantic segment.

[0029] In this embodiment, the preliminary refined classification results of the communication flow include: The enhanced semantic representation and the suppressed residual representation are received and denoted as the enhanced representation vector and the residual representation vector, respectively. The two are then aligned in the same dimension and scaled. Construct a reconstruction gate coefficient, and generate a gate weight sequence between zero and one based on the dimension-wise combination features of the enhanced representation vector and the residual representation vector, semantic labels and kernel identifiers, which is used to control the fusion ratio of enhanced information and residual information in each dimension; Perform semantic reconstruction attention computation, and perform attention aggregation on the gated enhanced component and the gated residual component within the segment and between adjacent segments respectively. The attention within the segment is based on the segment's own temporal position and local order, and the attention between segments is based on the same semantic label or the same kernel identifier, to obtain the causal semantic reconstruction representation of the semantic segment. The causal semantic reconstruction representation is aligned with the category prototype vector set to obtain the similarity score of each category and the corresponding prototype matching index. A preset number of candidate categories are selected based on the similarity score ranking, and preliminary refined category results are generated.

[0030] In this embodiment, the final refined classification result of the output communication stream includes: Construct a multi-layered temporal flow graph, establish three types of nodes within a continuous time slice: flow nodes, session nodes, and terminal nodes. Establish spatial association edges according to the relationship between the same session, the same terminal, and the same server. Establish temporal association edges according to the temporal adjacency relationship between the same terminal or the same session. Use causal semantic reconstruction representation as the initial feature of flow nodes, and use session statistics and terminal statistics as the initial features of corresponding nodes. Spatial attention propagation is performed. For each flow node, the features of adjacent nodes are aggregated according to the session-related edges and terminal-related edges within the same time slice. Attention weights are determined based on edge type, edge weight and feature similarity. Attention weights below the threshold are pruned to obtain the spatial aggregation representation. For each flow node, the features of historical and future neighboring nodes are aggregated according to the temporal association edges within adjacent time slices. The temporal attention weight is determined based on the time interval, category candidate consistency, and behavioral pattern continuity. The temporal attention weights that have undergone category candidate mutations and do not meet the behavioral continuity are attenuated to obtain the temporal aggregated representation. The spatial aggregation representation and the temporal aggregation representation are weighted and fused according to the channel coefficient, which is determined by the proportion of edge types and the connectivity of nodes in the graph. The fusion result is normalized and stability measures are calculated to obtain the recalibrated flow level representation. Based on the recalibrated flow level representation and category prototype vector, the final prototype alignment and decision output are performed to generate the final refined classification results, confidence scores, temporal consistency scores and anomalous mutation markers of the communication flow, and the final refined classification results are output.

[0031] A terminal for fine-grained classification of communication traffic based on an attention mechanism, comprising: Memory, used to store programs; A processor for executing the program stored in the memory.

[0032] Example 1: To verify the feasibility of this invention in practice, it was applied to an online education platform covering three major business modules: K-12, adult self-study, and vocational training. During peak hours, over 850,000 users are online simultaneously daily. Inter-system access includes requests for course videos, homework grading, live interactive data packets, acceleration requests from content delivery network nodes, and business synchronization with the backend teaching management system. As the platform's user base continues to expand, more and more communication links are using encryption protocols such as TLS 1.3 and QUIC. This makes traditional methods based on packet length statistics, five-tuple clustering, and rule matching inadequate for complex traffic structures, especially under high-encryption and high-concurrency business scenarios where recognition accuracy drops sharply. The platform's original traffic classification model achieves less than 80% accuracy during peak periods and is prone to confusing CDN video streams, live interactive streams, and backend management streams, even exhibiting obvious misclassification of spoofed streams, severely impacting the execution of the intelligent scheduling module and bandwidth allocation strategies.

[0033] After the method of this invention is deployed, raw traffic data is first collected in real time at the egress splitter of the platform's main data center, and packet-level raw sequences are generated according to 5-tuples. This sequence is then sent to the communication flow semantic reconstructor, and undergoes semantic generative processing through the dynamic behavior kernel layer, semantic fingerprint mapping layer, and self-guided comparison annotation layer in sequence. Taking typical live classroom traffic as an example, its packet sequence contains a mixture of periodic encrypted heartbeats, live interactive commands, and short-term retransmission behaviors. In the dynamic behavior kernel layer, 4 to 6 kernel intervals can be automatically generated, and the mixed interactive behaviors can be accurately segmented into independent semantic fragments. In the semantic fingerprint mapping layer, each fragment is assigned a composite semantic fingerprint such as "stable periodic heartbeat", "interactive command fragment", and "retransmission recovery segment". The self-guided comparison annotation layer uses historical semantic labels and category prototype vectors to generate a single semantic label for it, so that the behavioral structure of the live stream can be clearly presented.

[0034] After semantic generation, this invention generates enhanced semantic representations for each semantic segment through a multi-path prototype bias attention mechanism. For example, in a course video request stream, video segment request segments, buffer heartbeat segments, and CDN scheduling segments inherently have different traffic patterns. Traditional models tend to treat them as different types of services. However, this invention generates multiple semantic pointing paths when constructing the semantic bias graph structure and assigns them three types of bias information: prototype consistency bias, semantic sparseness bias, and time stability bias. This enables the model to recognize that these three types of behaviors are different stages in the same application behavior chain, thereby achieving unified recognition across stages.

[0035] When implementing a cross-prototype conflict decoupling attention mechanism, this invention can identify conflict semantics between different business processes. For example, a teacher's handout system contains a large number of short interactive behaviors, which are similar in representation to live interactive behaviors on the user's end, easily leading to confusion. This invention automatically identifies the conflict relationship between live interactive segments and handout interactive segments by constructing a cross-prototype semantic conflict matrix, and reduces the influence of conflict categories during attention calculation, making the classification results more accurate and reliable.

[0036] This invention constructs a multi-layered time-series flow graph including flow nodes, session nodes, and terminal nodes, and corrects each flow across time slices. For example, some large-class live courses may experience regional latency, causing the live stream to exhibit abnormal patterns within a short period. Traditional methods would misjudge such fluctuations as CDN bandwidth scheduling failures, while this invention uses time-consistency attention propagation to correct the classification results by leveraging the continuity of traffic across time slices, thus keeping the live stream type stable and avoiding mis-triggered scheduling strategies.

[0037] Table 1 Comparison of Traffic Classification Effects for Typical Businesses of Online Education Platforms

[0038] As shown in Table 1, this invention significantly improves the accuracy of traffic classification in highly encrypted, high-concurrency online education platform environments. The accuracy rate for live classroom services increased from 78.9% to 97.1%, an improvement of 18.2%, demonstrating that the semantic reconstruction and multi-path attention mechanism of this invention can effectively capture key semantic segments in live scenarios, especially complex behaviors such as periodic heartbeats, interactive commands, and temporary retransmissions, making the identification of encrypted live streams more stable and reliable. In video course CDN distribution services, the accuracy rate improved by 12.2%, further proving that this invention can distinguish between large packet burst downloads, cached origin pulls, and scheduling behaviors, and successfully identify the semantic relationships at each stage of the video distribution process.

[0039] In teaching management backends, homework grading, and user interaction, the accuracy improvement of this invention ranges from 12% to 17%, indicating its excellent ability to identify small-package, highly interactive, and instruction-based transactions. These types of transactions often result in misclassification in traditional models. This invention, by constructing a cross-prototype semantic conflict matrix and performing multi-dimensional conflict decoupling, enables the classification process to identify fine-grained differences between different transactions, avoiding being misled by superficial behavioral similarities, thereby significantly improving classification accuracy and transaction differentiation.

[0040] Overall, this invention improves the comprehensive service accuracy from 79.3% to 94.7%, maintaining high-performance output even with an average encryption rate as high as 90%, demonstrating excellent robustness and broad adaptability. Based on a joint strategy of semantic reconstruction, causal attention mechanism, and temporal graph correction, this invention maintains classification stability in dynamic network environments with multiple coexisting and rapidly switching service behaviors, providing a reliable data foundation for intelligent scheduling, bandwidth optimization, and service quality assurance.

[0041] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for fine-grained classification of communication traffic based on an attention mechanism, characterized in that, include: Raw traffic data from the communication network is collected, processed to obtain packet-level raw sequences, and generated category prototype vectors based on the semantic fingerprint statistical fusion of historical communication flows. The packet-level raw sequence is input into the communication flow semantic reconstructor, which includes a dynamic behavior kernel layer, a semantic fingerprint mapping layer, and a self-guided comparison annotation layer to perform semantic topological evolution processing and generate a semantic sequence. Taking a semantic sequence as input, semantic fragments are mapped to a multi-path semantic pointing vector space, a semantic bias graph structure is constructed, parallel attention computation is performed on different semantic pointing paths, and the results of parallel attention computation are aggregated to obtain an enhanced semantic representation. A cross-prototype semantic conflict matrix is ​​constructed using category prototype vectors as input. A semantic conflict decoupling vector is generated based on the semantic sequence. Attention calculation is performed on the semantic fragments through a multi-dimensional prototype conflict decoupling attention mechanism to generate suppressed residual representations. Semantic reconstruction attention operations are performed based on enhanced semantic representation and suppressed residual representation to obtain causal semantic reconstruction representation, which is then aligned with the category prototype vector to form preliminary refined category results of the communication flow; Construct a multi-layered temporal flow graph including flow nodes, session nodes, and terminal nodes. Build a graph structure by connecting flow nodes of different time slices through temporal and spatial association edges. Perform spatial attention propagation and temporal consistency attention propagation to generate a recalibrated flow-level representation and output the final refined classification result of the communication flow.

2. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The raw traffic data includes a packet length sequence, a packet timestamp sequence, a packet direction identifier, a transport layer protocol flag, cryptographic handshake metadata, and a payload entropy value.

3. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The processing of the raw traffic data includes time alignment, noise packet removal, abnormal packet filtering, data packet header field normalization, and packet sequence length unification.

4. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The generated category prototype vector includes: The semantic fingerprints, dynamic behavioral kernel features, and self-guided comparison labels of historical communication flows are archived and stored. The archived data is mapped to a unified semantic prototype space, and multi-source feature fusion operations are performed to obtain a fused semantic feature set. Density clustering is performed on the fused semantic feature set; for each cluster obtained, a weighted average of all feature vectors within the cluster is calculated according to the density weight of the semantic feature points, and the resulting weighted average vector is used as the category prototype vector of the cluster.

5. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The generation of semantic sequences includes: Initialize the processing context of the communication flow semantic reconstructor, and set the kernel candidate rules of the dynamic behavior kernel layer, the fingerprint field set of the semantic fingerprint mapping layer, and the comparison constraints of the self-guided comparison annotation layer. In the dynamic behavior kernel layer, candidate boundaries for behavior kernels are generated based on packet direction flipping events, burst rate change points, round-trip delay mutation points, encrypted handshake boundaries, and idle interval interruption points. Candidate boundaries near the same location are merged and filtered to determine the kernel center and coverage area. The original packet-level sequence is divided into several behavior kernel intervals and a set of target behavior segments is extracted. A unique kernel identifier is assigned to each target behavior segment. In the semantic fingerprint mapping layer, time morphological features, protocol behavior features and entropy structure features are calculated for each target behavior segment. The features are encoded into a composite semantic fingerprint. Conflict detection is performed on all composite semantic fingerprints. For composite semantic fingerprints that have conflicts, the kernel identifier field and local order field are introduced to expand them until each target behavior segment corresponds to a unique composite semantic fingerprint. In the self-guided comparison annotation layer, based on the terminal identifier, session identifier, and server identifier, target behavior segments with consistent or high similarity in composite semantic fingerprints are classified as self-guided comparison positive samples, and target behavior segments with mutually exclusive composite semantic fingerprints and inconsistent service modes are classified as self-guided comparison negative samples. The historical semantic annotation records and category prototype vectors are compared and matched to determine a single semantic label for each target behavior segment. Based on the temporal order of the target behavior segments in the original stream, the target behavior segments with kernel identifiers, composite semantic fingerprints and semantic labels are sorted. Adjacent target behavior segments with consistent semantic labels and time intervals not exceeding a preset threshold are merged to generate a semantic sequence.

6. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The obtained enhanced semantic representation includes: For each semantic segment in the semantic sequence, multi-vector mapping is performed according to the preset number of paths, mapping the same semantic segment into several semantic pointing paths. Each semantic pointing path retains the segment embedding vector, kernel identifier, semantic label, and local position information of the path in the segment. Construct a semantic bias graph structure using category prototype vectors as prototype nodes and semantic pointing paths as path nodes: A directed bias edge is established between each path node and the connected prototype node, and three types of biases are written: the historical semantic label consistency score is used as the prototype consistency bias, the reciprocal of the semantic fingerprint occurrence frequency is used as the semantic sparseness bias, and the reciprocal of the occurrence interval variance within the same terminal is used as the time stability bias. Establish cross-prototype suppression edges between different prototype nodes, and write the conflict strength according to the mutual exclusion degree of semantic labels; For each path node, calculate the proportion of the number of covered packets to the total number of fragment packets and the fragment embedding entropy. The two indicators are weighted to obtain the path effectiveness score, which is written into the semantic bias graph structure as the path weight. Parallel attention computation is performed independently on each semantic pointing path in the semantic bias graph structure. The prototype-path attention weight is determined based on the path weight and the three types of biases connecting the prototype nodes. Prototype-path pairs with attention weights below the threshold are pruned. The remaining attention weights are reduced based on the conflict intensity of cross-prototype suppression edges to obtain the path-level augmented representation. All path-level augmented representations of the same semantic segment are aggregated, and the path-level augmented representations are weighted and summed according to the path validity score. The connectivity factor of the path nodes in the semantic bias graph is considered, and the aggregation result is normalized to obtain the augmented semantic representation of the semantic segment.

7. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The generation of suppressed residual representations includes: Using the generated category prototype vectors as objects, the conflict intensity between prototypes is calculated pairwise based on four indicators: mutual exclusion relationship of historical semantic labels, sample-level misjudgment confusion statistics, frequency of alternating occurrence of categories in the same session, and confidence interval of semantic fingerprint co-occurrence. The conflict intensity is then processed by interval pruning and normalization to obtain a symmetric cross-prototype semantic conflict matrix with zero diagonal elements. Obtain the enhanced semantic representation, and calculate the normalized similarity score between each semantic segment in the enhanced semantic representation and the prototype vectors of all categories to form a prototype similarity vector for the semantic segment; Based on the cross-prototype semantic conflict matrix, the prototype similarity vector is decoupled from the similarity of each type of prototype. The interference component of other prototypes with conflicting relationships is deducted from the similarity of each type of prototype to obtain the semantic conflict decoupling vector. Then, exponential normalization is performed to obtain the conflict weight vector. Four attention channels are established for each category prototype: time dimension, orientation pattern dimension, entropy structure dimension, and protocol behavior dimension. The conflict weight vector, the channel weight of the prototype in the corresponding dimension, and the channel feature of the semantic segment in the corresponding dimension are used as inputs. Attention weights are independently assigned to channels and weighted aggregation is performed within the channels. The four channels are weighted and merged according to the channel importance coefficient to generate a suppression aggregation vector. Based on the enhanced semantic representation, the suppressed aggregation vector is subtracted to obtain the suppressed residual representation of the semantic segment.

8. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The preliminary refined classification results for forming the communication stream include: The enhanced semantic representation and the suppressed residual representation are received and denoted as the enhanced representation vector and the residual representation vector, respectively. The two are then aligned in the same dimension and scaled. Construct a reconstruction gate coefficient, and generate a gate weight sequence between zero and one based on the dimension-wise combination features of the enhanced representation vector and the residual representation vector, semantic labels and kernel identifiers, which is used to control the fusion ratio of enhanced information and residual information in each dimension; Perform semantic reconstruction attention computation, and perform attention aggregation on the gated enhanced component and the gated residual component within the segment and between adjacent segments respectively. The attention within the segment is based on the segment's own temporal position and local order, and the attention between segments is based on the same semantic label or the same kernel identifier, to obtain the causal semantic reconstruction representation of the semantic segment. The causal semantic reconstruction representation is aligned with the category prototype vector set to obtain the similarity score of each category and the corresponding prototype matching index. A preset number of candidate categories are selected based on the similarity score ranking, and preliminary refined category results are generated.

9. The method for fine-grained classification of communication traffic based on attention mechanism according to claim 1, characterized in that, The final refined classification result of the output communication stream includes: Construct a multi-layered temporal flow graph, establish three types of nodes within a continuous time slice: flow nodes, session nodes, and terminal nodes. Establish spatial association edges according to the relationship between the same session, the same terminal, and the same server. Establish temporal association edges according to the temporal adjacency relationship between the same terminal or the same session. Use causal semantic reconstruction representation as the initial feature of flow nodes, and use session statistics and terminal statistics as the initial features of corresponding nodes. Spatial attention propagation is performed. For each flow node, the features of adjacent nodes are aggregated according to the session-related edges and terminal-related edges within the same time slice. Attention weights are determined based on edge type, edge weight and feature similarity. Attention weights below the threshold are pruned to obtain the spatial aggregation representation. For each flow node, the features of historical and future neighboring nodes are aggregated according to the temporal association edges within adjacent time slices. The temporal attention weight is determined based on the time interval, category candidate consistency, and behavioral pattern continuity. The temporal attention weights that have undergone category candidate mutations and do not meet the behavioral continuity are attenuated to obtain the temporal aggregated representation. The spatial aggregation representation and the temporal aggregation representation are weighted and fused according to the channel coefficient, which is determined by the proportion of edge types and the connectivity of nodes in the graph. The fusion result is normalized and stability measures are calculated to obtain the recalibrated flow level representation. Based on the recalibrated flow level representation and category prototype vector, the final prototype alignment and decision output are performed to generate the final refined classification results, confidence scores, temporal consistency scores and anomalous mutation markers of the communication flow, and the final refined classification results are output.

10. A communication traffic fine-grained classification terminal based on an attention mechanism, characterized in that... ,include: Memory, used to store programs; A processor for executing the program stored in the memory, wherein when the program is executed, the processor is configured to perform the method as described in any one of claims 1-9.

Images