Transform encrypted traffic classification method based on pre-training and structure optimization fine tuning

Abstract

The invention discloses an encrypted traffic classification method based on Transform, and belongs to the technical field of network security and encrypted traffic analysis. In order to solve the problems that load content in a novel encryption protocol (such as TLS 1.3 and VPN) is encrypted, structural disturbance is complex, category distribution is unbalanced and the like, the invention provides a dual-phase Transform framework (DPFT) with pre-training and structure optimization fine tuning. According to the framework, two self-supervision tasks of masked burst prediction (MBP) and burst structure discrimination (BSDT) are introduced in a pre-training stage, and deep data packet representation is learned from unlabeled traffic, so that the deep data packet representation is learned from the unlabeled traffic; in the fine tuning stage, dynamic weighting of word embedding and position embedding, multi-head attention pooling and Focus Loss are adopted, so that the modeling capability of the model on an encrypted traffic complex structure is enhanced, and the recognition sensitivity on minority class samples is improved. Experimental results show that the method disclosed by the invention is obviously superior to the existing method on various encrypted traffic data sets (including TLS 1.3, VPN, malicious traffic and the like), and achieves leading performance on classification accuracy and macro average F1 index.

Description

Technical Field

[0001] This invention proposes a Transformer encrypted traffic classification method based on pre-training and structural optimization fine-tuning. For traffic from new encrypted protocols such as TLS 1.3 and VPN, it constructs an efficient two-stage model framework to achieve high-accuracy classification of encrypted traffic. Background Technology

[0002] With the rapid expansion of internet communication and the increasing awareness of user privacy, the encryption level of network communication has significantly improved. New-generation encrypted communication protocols, such as Transport Layer Security (TLS) 1.3 and Virtual Private Network (VPN) protocols, have been widely deployed in various scenarios including web access, instant messaging, remote work, and cloud computing. These protocols greatly enhance the confidentiality and data security of communication processes by improving key negotiation mechanisms, adding encryption layers, and hiding handshake details. However, the widespread adoption of encryption technology also presents new technical challenges to tasks such as network management, traffic scheduling, and security auditing. Especially when data content cannot be directly parsed, effectively identifying different types of encrypted traffic has become a critical issue that urgently needs to be addressed in the field of network security.

[0003] In recent years, machine learning and deep learning technologies have been widely applied to the field of encrypted traffic classification. Researchers typically train classification models to identify different types of encrypted communication by extracting information such as time-series features, packet length distribution characteristics, and directional patterns from the traffic. While these methods have improved classification performance to some extent, they still have significant limitations: traditional methods rely on manually designed shallow features, which are insufficient to fully characterize the complex contextual relationships and semantic structures hidden within the traffic, resulting in limited generalization ability of the models across different datasets and complex network environments. Furthermore, with the widespread application of new encryption protocols, such as the encrypted handshake and dynamic record length mechanism introduced in TLS 1.3, traffic patterns are further hidden, making it difficult for traditional feature-based classification methods to capture effective discriminative information, thus affecting actual classification accuracy. At the same time, the distribution of different types of traffic in real network environments is highly unbalanced: mainstream application traffic accounts for the vast majority, while abnormal communication or covert tunnel samples are scarce. This class imbalance further limits the stability and robustness of model performance.

[0004] Therefore, designing a classification model that can effectively mine deep semantics, adapt to complex protocol structures, and be sensitive to minority classes has become a key problem that needs to be solved in the field of encrypted traffic analysis. Summary of the Invention

[0005] This invention proposes a Transformer-based encrypted traffic classification method, DPFT, based on pre-training and structure optimization fine-tuning, aiming to achieve high-accuracy identification of traffic from various encrypted communication protocols (such as TLS 1.3 and VPN). The method employs a two-stage design of "pre-training-structure optimization fine-tuning," comprising three key steps: data preprocessing, self-supervised pre-training, and structure optimization fine-tuning. In the pre-training stage, a self-supervised task guides the model to learn deep contextual features and temporal correlations of encrypted traffic. In the fine-tuning stage, dynamic embedding fusion, multi-head attention pooling, and class imbalance optimization mechanisms are combined to enhance the model's discriminative ability and stability. This method effectively improves the accuracy of encrypted traffic classification and its generalization performance across datasets.

[0006] 1. Data Preprocessing

[0007] In encrypted traffic analysis, data preprocessing is fundamental for high-quality feature extraction. This method first divides the raw traffic dataset into multiple sessions (Flows). Each session (Flow) is defined by a 5-tuple, including source IP, destination IP, source port, destination port, and transport protocol, containing all data packets transmitted bidirectionally. Each session (Flow) is further decomposed into several burst sequences, defined as a time-continuous sequence of data packets in a single flow (request or response). Let the packet capture sequence be... Each session stream By standard quintuple (IP) src ,PORT src IP dst ,PORT dst If the protocol is used as a identifier, then the burst sequence is formalized as follows:

[0008]

[0009] Where m and n represent the number of data packets transmitted in one direction, respectively. The burst sequence abstraction can reflect semantically consistent communication segments, such as encrypted request-response transactions or single content transmission cycles.

[0010] In terms of feature representation, this method performs a bigram transformation on each data packet, combining two consecutive bytes into a four-digit hexadecimal string. For example, the data packet 4504008bd0 is transformed into the sequence: 4504,0400,008b,8bd0. Subsequently, the Byte Pair Encoding (BPE) algorithm is used to construct a vocabulary, with a maximum size of 65535 tokens. The BPE algorithm first splits each "word" in the training corpus into individual characters and gradually merges the most frequent character pairs until the corpus reaches a preset size. Applying BPE to bigrams generates finer-grained sub-word features, with sub-words containing as little as a single hexadecimal digit, much smaller than the typical length of most protocol fields, thereby enhancing the model's ability to perceive fine-grained structural information. In addition, the corpus contains several special markers:

[0011] (1) [CLS]: Sequence-level representation used for classification tasks;

[0012] (2) [SEP]: Sequence separator, used to identify the boundaries between different sequences;

[0013] (3) [PAD]: Sequence padding marker, used to standardize input length;

[0014] (4) [MASK]: Mask marker, used for mask reconstruction in self-supervised pre-training tasks;

[0015] (5) [UNK]: Unknown tokens that do not appear in the corpus.

[0016] Through the above preprocessing methods, the original traffic data is effectively transformed into discrete sequence inputs suitable for the Transformer model, providing a reliable basic feature representation for subsequent pre-training and fine-tuning stages.

[0017] 2. Pre-training phase

[0018] To address the challenge of learning general features using only limited labeled samples, this invention proposes two self-supervised pre-training methods to acquire deep feature representations with transferability and protocol independence under unlabeled conditions. These methods comprise two complementary self-supervised tasks: Masked Burst Prediction (MBP) and Burst Structural Discrimination Task (BSDT). The former, by randomly masking local segments in a burst sequence, prompts the model to learn the contextual dependencies within bursts, thereby enhancing its local semantic modeling capabilities. The latter, by learning to constrain the semantic consistency between different bursts, improves the model's ability to identify global patterns and communication behavior features. The two tasks work synergistically, enabling the model to simultaneously capture the semantic continuity and structural invariance of encrypted traffic during self-supervised training, providing a solid representational foundation for refined classification in subsequent fine-tuning stages.

[0019] MBP (Masked Burst Prediction) aims to guide models to autonomously learn the contextual dependencies and structural evolution patterns within encrypted traffic. In encrypted communication, data distribution at different stages exhibits a distinctly non-uniform information density: data packets during the handshake, key negotiation, and content initialization phases typically contain higher structural and behavioral discriminative power, while data during transmission is relatively stable. To fully leverage this characteristic, MBP randomly selects 20% of the tokens in the input sequence as prediction targets, of which 80% are replaced with a special marker [MASK], 10% are replaced with random tokens, and the remaining 10% remain unchanged. The model infers the original token at the masked location through contextual reasoning and is trained with a negative log-likelihood loss, thereby effectively capturing the deep semantics and structural patterns of the traffic sequence.

[0020] L BMPT = -logP(MASK i =token i |X;θ) (2)

[0021] Where X is the masked sequence of input tokens; MASK i It is the position of the i-th masked element; token i It is the i-th token in the original sequence; P(·|X;θ) is the predicted probability output by the Transformer encoder; it is modeled by the parameter θ, where θ is a trainable parameter of the model.

[0022] The core idea of ​​BSDT is to guide the model to maintain both "consistency of homologous bursts" and "separability of heterologous bursts" in the representation space through structural discriminant constraints. Specifically, burst sequences generated at different stages or from different perspectives within the same session stream should exhibit high similarity in their structural features in the latent semantic space; while bursts from different applications or sessions should maintain a distinct distribution.

[0023] Suppose there exists a set of burst sequences in the encrypted traffic. Each of the sudden B i It consists of multiple data packet subsequences. For any pair of subbursts (b i ,b j Define its structural similarity label y. ij :

[0024]

[0025] The model uses a shared encoder f θ (·) Map each subburst to a latent representation Subsequently, the structural similarity probability between the two is calculated using the structural discriminant function g(·) (bilinear similarity function):

[0026]

[0027] Where σ(·) is the Sigmoid function, used to compress the output to the interval [0,1].

[0028] The optimization objective of the task is defined as the binary cross-entropy loss:

[0029]

[0030] To further enhance the separability between samples with different structures in the latent space, a structural difference enhancement term is introduced into the similarity function g(·), defined as:

[0031]

[0032] Where δ is the interval threshold, used to force the minimum structural distance between non-homologous samples. The final BSDT optimization objective can be written as:

[0033]

[0034] Where λ is the balance coefficient.

[0035] This design expands the semantic scope of traditional self-supervised tasks from the perspective of discriminative learning, enabling the model to explicitly learn hierarchical relationships between bursts under unlabeled conditions.

[0036] During the joint optimization phase, the model simultaneously performs forward propagation and backward gradient update for both tasks on the same encoder. The overall pre-training objective is defined as:

[0037]

[0038] Here, α is the weight balancing coefficient, used to achieve a balance between local reconstruction accuracy and global structural consistency.

[0039] This joint optimization strategy enables the encoder to simultaneously focus on the high-density semantic features within local bursts and the macroscopic structural relationships between bursts, thereby learning encrypted traffic representations that are both discriminative and generalizable.

[0040] 3. Fine-tuning phase

[0041] After completing self-supervised pre-training, the fine-tuning stage introduces various structural enhancement modules to address the complexities of encryption handshakes and dynamically changing record lengths in encryption protocols such as TLS 1.3 and VPNs. This enhances the model's contextual understanding and class discrimination capabilities for encrypted traffic, achieving high-accuracy classification of complex encryption protocols. The fine-tuning stage first employs a dynamic weighted fusion mechanism (DW) combining word embeddings and positional embeddings. By adaptively adjusting the contribution weights of semantic and positional information, it achieves fine-grained feature encoding of burst sequences. Subsequently, multi-head attention pooling (MHAP) is introduced to aggregate burst representations at the global level, highlighting key features and suppressing redundant information, thus enhancing the model's ability to capture complex patterns. To further alleviate class imbalance, Focal Loss is introduced into the classification loss during the fine-tuning stage. By reducing the weights of easily classified samples and focusing on difficult-to-classify samples, it achieves more accurate discrimination of minority class traffic.

[0042] (1). Dynamic Weighted Fusion Mechanism (DW)

[0043] In encrypted traffic analysis tasks, the semantic and temporal location information of each burst in the traffic sequence is extremely unevenly distributed. Encryption protocols (such as TLS 1.3 and VPN) impose complex perturbations on the handshake phase, record fragmentation, and data encryption process, making it difficult for simply relying on fixed-weight word embeddings or positional embeddings to fully capture the key information in the burst sequence. To address this, a dynamic weighting mechanism for word embeddings and positional embeddings is introduced in the fine-tuning stage. By adaptively adjusting the contribution weights of the two types of embeddings, the model can flexibly balance the influence of semantic and temporal features at different burst stages.

[0044] Obtain word embeddings respectively With position embedding After the vector. Unlike direct addition, this invention employs a dynamic weighted fusion mechanism strategy to make the final representation Satisfy the following formula:

[0045]

[0046] Where α tok With α pos There are two dynamic weighting coefficients that satisfy α tok +α pos =1, used to control the contribution of the two types of embedding information to the final representation. To achieve dynamic weight generation, this invention designs an attention-aware fusion module, the core idea of ​​which is to use the global semantic features of the input sequence as a query to generate attention weights. First, this invention averages the two embedding types along the channel dimension to obtain the semantic representation before fusion, thus obtaining the semantic summary representation of the sequence.

[0047]

[0048] Then a linear transformation is used to map q to two fusion fractions:

[0049]

[0050] in, It is a learnable weight matrix. This is the bias term. Next, the fusion weights are calculated using the temperature-controlled Softmax function:

[0051]

[0052] Here, τ > 0 is a temperature coefficient used to control the smoothness of the weight distribution. Lower τ values ​​make the distribution more biased towards "hard selection," while higher τ values ​​result in a smoother distribution. Finally, this invention stacks the two embedding tensors into a four-dimensional tensor by their last dimension. Then, they are fused using an attention-weighted approach:

[0053]

[0054] The fused result E will be used as input to the Transformer Encoder for subsequent feature modeling and classification tasks.

[0055] (2). Multi-head attention pooling mechanism (MHAP)

[0056] Given that encrypted traffic may exhibit varying feature contributions over time, some key features may be concentrated at specific time steps, leading to an imbalance in the distribution of information within the sequence. Therefore, this invention constructs an attention-based pooling strategy during the sequence representation stage. This strategy models the importance of different temporal positions through learnable weight allocation, thereby achieving adaptive aggregation and enhancement of information.

[0057] Given an input feature sequence Where B represents the batch size, L represents the sequence length, and d is the hidden state dimension, MHAP first generates three sets of vectors—Query, Key, and Value—through linear mapping:

[0058] Q = XW Q K = XW K V = XW V (12)

[0059] in These are the learnable parameters. Subsequently, each vector is split into h subspaces using a multi-head method, with each head having a dimension of d. h =d / h. The attention score for each head is calculated using scaled dot product attention:

[0060]

[0061] in The output of each attention head is then concatenated and linearly transformed along the feature dimension to obtain the overall sequence representation.

[0062] O = Concat(O1,...,O) h )·W O ,O∈R B×L×d (14)

[0063] Then, an importance score for each time step is calculated using a single-layer perceptron, as follows:

[0064]

[0065] in w is the representation of the i-th time step. attn ∈R d Weights are assigned to learnable attention. The above operations yield the normalized weights α. i Used for weighted aggregation:

[0066]

[0067] Finally, a fixed-length global representation vector z∈R is obtained. B×dThis represents the important semantic information of all time steps in the sequence under weighted fusion.

[0068] To improve information retention and training stability, residual connections and layer normalization mechanisms are introduced after the aggregated representation. Specifically, the attention-pooled representation is residually connected to the feature at the first position of the input sequence.

[0069] z final =LayerNorm(z+X) [:,0,:] (17)

[0070] Let be the d-dimensional feature vector of the first token in each sample of the batch. This design not only preserves the structural prior of the original sequence, but also helps the gradient propagate more stably in the network.

[0071] (3). Focal Loss Function

[0072] In encrypted traffic classification tasks, severe class imbalance often leads to overfitting of the model to majority class samples while under-identifying minority class samples, ultimately affecting overall classification performance. To address this issue, the FocalLoss loss function is introduced during the fine-tuning phase, and its flexibility is enhanced through dataset-adaptive hyperparameter optimization. Specifically, for each benchmark dataset, a grid search strategy is used to fine-tune the key parameters α and γ, enabling the loss function to dynamically adjust weight allocation based on the degree of class imbalance. This improves the model's sensitivity to difficult-to-classify and low-frequency samples, achieving a more balanced and robust classification effect.

[0073] The formal definition of Focal Loss is as follows:

[0074]

[0075] Where, p y α represents the predicted probability of the true class y. y γ is the class balance coefficient, used to compensate for the bias caused by uneven label distribution, and γ is the focusing parameter, used to control the degree of weight decay for easily classified samples. Through this adaptive weighting mechanism, the model can pay more attention to difficult-to-classify and minority class samples, thereby improving the overall classification performance on imbalanced data. Attached Figure Description

[0076] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the following figures are provided for illustration:

[0077] Figure 1 This is a framework diagram of DPFT.

[0078] Figure 2This study compares the accuracy and training loss of different embedding methods using a dynamic weighting mechanism.

[0079] Figure 3 Compare the accuracy of multi-head attention pooling mechanism and different pooling methods on different datasets.

[0080] Figure 4 The two-dimensional distribution of features extracted from the validation set by DPFT in the ablation experiment after dimensionality reduction by t-distributed random neighborhood embedding (t-SNE). Detailed Implementation

[0081] (1) Public datasets

[0082] 1. CSTNET-TLS1.3: This dataset was collected by the Institute of Information Engineering, Chinese Academy of Sciences, from March to July 2021 on CSTNET. Covering 120 applications and employing the latest encryption protocols, this dataset offers a wider variety of applications and is more up-to-date compared to other datasets. This facilitates a comprehensive evaluation of the model's recognition capabilities.

[0083] 2. ISCXVPN (2016): This dataset was created and maintained by the Information Systems Security Laboratory at Dalhousie University, Canada. It contains labeled data on Virtual Private Network (VPN) and non-VPN traffic. In this study, only the VPN portion was used, which was further subdivided into the ISCX-VPN-Service dataset containing 12 categories and the ISCX-VPN-App dataset covering 17 applications for experimental testing.

[0084] 3. USTC-TFC2016: This dataset contains encrypted traffic data from both malicious and benign applications, including ten types of benign traffic and ten types of malicious traffic. The malicious traffic data was collected by CTU researchers from real-world network environments between 2011 and 2015, while the benign traffic data consists of ten types of normal traffic simulated by IXIABPS.

[0085] (2). Evaluation indicators

[0086] To evaluate the performance of DPFT, this invention uses four metrics: accuracy, macro-F1 score, macro-recall, and macro-precision. These metrics can be expressed by the following formulas, where TP (True Positive) represents the number of samples correctly predicted as positive by the model; TN (True Negative) represents the number of samples correctly predicted as negative by the model; FP (False Positive) represents the number of negative samples incorrectly predicted as positive by the model; and FN (False Negative) represents the number of positive samples incorrectly predicted as negative by the model.

[0087]

[0088] (3) Validation of the dynamic weighted embedding mechanism

[0089] To evaluate the actual effect of the dynamic weighted embedding mechanism in encrypted traffic representation learning, this invention constructs four embedding strategies for comparative experiments while maintaining the consistency of the model structure: (1) word embedding: only word embedding is used; (2) fixed ratio hybrid embedding: word embedding and position embedding are fused at a fixed ratio of 1:1; (3) additive embedding: the two types of embedding are directly added together; (4) dynamic weighted embedding mechanism: the fusion weight of word embedding and position embedding is adaptively adjusted through learnable parameters, so as to achieve more flexible feature expression in different context scenarios.

[0090] like Figure 2 As shown, the four embedding strategies exhibit significant differences in evaluation accuracy (left) and training loss (right). The dynamic weighting mechanism performs best throughout the training process, achieving a validation accuracy of 91.92%, significantly higher than the other strategies, demonstrating stronger feature modeling capabilities. Furthermore, its training loss decreases faster and converges more stably, indicating that the dynamic weighting mechanism helps to learn the structural information of the input sequence more efficiently.

[0091] (4) Validation of the effectiveness of the multi-head attention pooling mechanism

[0092] To further evaluate the practical effectiveness of multi-head attention pooling in encrypted traffic representation learning, this paper compares the classification performance of multi-head attention pooling, average pooling, and max pooling on four sub-tasks (CSTNET-TLS1.3, VPN_APP, VPN_Service, and USTC-TFC) under a consistent model structure. Experimental results are as follows: Figure 3 As shown.

[0093] The multi-head attention pooling mechanism significantly outperforms the other two methods on the CSTNET-TLS1.3 dataset, achieving an accuracy of 0.9301, which is 4.37% higher than average pooling and max pooling, respectively. This result demonstrates that when handling complex, highly encrypted traffic such as TLS1.3, the multi-head attention pooling mechanism can more effectively capture key feature information and improve the model's classification ability. On the VPN_APP and VPN_Service datasets, the performance of the three pooling methods is relatively similar, with the multi-head attention pooling mechanism still showing a slight advantage. On the USTC-TFC dataset, the multi-head attention pooling mechanism also achieved the highest accuracy (0.9887), improving upon average pooling (0.9568) and max pooling (0.9563) by 3.19% and 3.24%, respectively. Experimental results show that the multi-head attention pooling mechanism can stably exert its advantages in various encrypted traffic scenarios, possessing good generalization and feature representation capabilities.

[0094] (5). Comparison of DPFT and advanced models

[0095] To comprehensively evaluate the applicability and robustness of the proposed method in various network environments, experiments were conducted on four representative datasets: CSTNET-TLS1.3, ISCX-VPN-App, ISCX-VPN-Service, and USTC-TFC. The comparison methods covered traditional machine learning models AppScanner and BIND, as well as current mainstream deep learning methods, including DF, FS-Net, GraphDApp, DeepPacket, PEAN, PERT, YaTC, TrafficFormer, and ET-BERT (Packet). These methods cover the neural network structures and research approaches widely used in current encrypted traffic classification tasks, providing a comprehensive and sufficient basis for comparison in this study. The comparative experimental results are shown in the table below:

[0096] 1) Classification of encrypted traffic under TLS 1.3 protocol

[0097] Table 1 shows the comparison results on the CSTNET-TLS1.3 dataset.

[0098]

[0099] 2) VPN Traffic Classification

[0100] Table 2 shows the comparison results on the ISCX-VPN-App dataset.

[0101]

[0102] Table 3 shows the comparison results on the ISCX-VPN-Service dataset.

[0103]

[0104] 3) Malicious Traffic Classification

[0105] Table 4 shows the comparison results on the USTC-TFC dataset.

[0106]

[0107] Extensive experiments conducted on four encrypted traffic datasets—CSTNET-TLS1.3, ISCX-VPN-App, ISCX-VPN-Service, and USTC-TFC—as shown in Tables 1 to 4 demonstrate that the method of this invention outperforms state-of-the-art baseline models in terms of F1 score, precision, recall, and accuracy, validating its superior discriminative ability and robustness.

[0108] 4) Comparison of reasoning speed

[0109] To verify the practical deployment capability of the proposed DPFT model, this invention compared the average classification time of several mainstream models with a batch size of 16 traffic samples. The experimental results are shown in Table 5:

[0110] Table 5 Comparison of Model Efficiency and Complexity

[0111]

[0112] The DPFT model has an average inference time of 14.03ms with a batch size of 16, ranking second among all compared methods. It is only slightly better than the lightweight ET-BERT (Packet) (85.66M, 12.86ms). In comparison, DPFT has 25.22M parameters, achieving near-optimal inference speed while maintaining low model complexity, and significantly outperforming other methods such as FS-Net (18.67ms), YaTC (19.17ms), PEAN (39.12ms), and GraphDApp (58.49ms).

[0113] 5) Ablation test

[0114] To systematically evaluate the impact of each module on model performance, this invention conducts ablation experiments on four datasets: CSTNET-TLS1.3, ISCX-VPN-App, ISCX-VPN-Service, and USTC-TFC. Using F1... Macro Using accuracy as the evaluation metric, we conduct an in-depth analysis of the contribution and synergistic effect of each module on the performance of encrypted traffic classification.

[0115] Table 6. Ablation Experiment Results of CSTNET-TLS1.3 and USTC-TFC

[0116]

[0117] Note: w / o is short for without. Table 7 Ablation Test Results of ISCX-VPN-App and ISCX-VPN-Service

[0118]

[0119] Note: w / o is short for without.

[0120] Overall, all modules have a positive impact on the final performance, but the strength of their effect varies slightly across different datasets. The dynamic weighting mechanism has the most significant effect on improving the model's generalization ability. Taking CSTNET-TLS 1.3 as an example, after removing DW, F1Macro decreased from 0.9310 to 0.8870, and Accuracy decreased by approximately 2.6%. On ISCX-VPN-App, where the differences in features between applications are more subtle, the impact of this module is even greater, with F1Macro decreasing by 6.2%. These results indicate that dynamically fusing word embeddings and positional embeddings can enhance the model's ability to represent features of temporally encrypted traffic and improve the accuracy of classifying data.

[0121] The Multi-Head Attention Pooling (MHAP) module plays a crucial role in modeling long-term dependencies and global semantic information. On the CSTNET-TLS1.3 dataset, removing MHAP reduced F1Macro from 0.9310 to 0.8633; on the USTC-TFC dataset, the metric also decreased from 0.9887 to 0.9487; and on the ISCX-VPN-App and ISCX-VPN-Service datasets, F1Macro dropped to 0.9030 and 0.9301 respectively, demonstrating significant performance degradation and further validating the module's universal effectiveness in various encrypted traffic scenarios.

[0122] The Focal Loss function significantly improves performance on imbalanced datasets. Particularly in the ISCX-VPN-App dataset, where the amount of data varies considerably across different application categories, Focal Loss enhances the model's focus on minority class samples. Removing this loss function significantly reduced the F1 Macro from 0.9792 to 0.9031; however, the impact on performance was smaller on the relatively balanced USTC-TFC dataset. This demonstrates that Focal Loss is an effective method for addressing imbalanced data.

[0123] The pre-training strategy significantly improved model performance across all datasets. On the CSTNET-TLS1.3 dataset, removing pre-training reduced the F1 Macro from 0.9310 to 0.8311, a decrease of over 10%. Similar trends were observed on the USTC-TFC and ISCX-VPN-Service datasets. This indicates that in cybersecurity scenarios lacking large-scale labeled data, a self-supervised learning-based pre-training strategy can provide the model with a better initial state, enhancing its expressive power and generalization performance on the target task.

[0124] Figure 4 The feature distribution of the ablation experiments on the validation set was visualized using t-distributed random neighborhood embeddings (t-SNE) to assess the impact of each component on the model's representational ability. Figure 4 As shown in (a), the complete model exhibits excellent inter-class separability and intra-class compactness on the ISCX-VPN-Service dataset, reflecting its powerful feature discrimination ability. This is mainly due to the synergistic effect of the MHAP module and the DW mechanism, which together enhance the structured representation ability of the learned representations.

[0125] In comparison, Figure 4 (b) shows that removing the DW module leads to a looser intra-class structure and increased dispersion, indicating that this module plays a crucial role in maintaining semantic consistency between lexical embeddings and positional embeddings. Similarly, Figure 4 (c) shows that removing the MHAP module weakens inter-class boundaries, especially with significant overlap between visually similar categories, highlighting the importance of the module in aggregating discriminative patterns across multiple subspaces.

[0126] also, Figure 4 (d) shows that although the untrained model can still form a certain representation structure, there are significant inter-class overlap and boundary ambiguity problems, indicating that the pre-training process plays an important role in providing good semantic initialization and promoting the organization of features and class separation in the embedding space.

[0127] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any transformations or substitutions that can be conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of the present invention.

Claims

1. A Transformer-based encrypted traffic classification method based on pre-training and structure optimization fine-tuning, belonging to the field of network intelligent analysis and encrypted communication identification, characterized in that... This method combines pre-training and fine-tuning to construct an integrated classification method to address issues such as semantic missingness, structural ambiguity, and class imbalance in encrypted traffic. During the pre-training phase, unsupervised traffic representations are jointly learned through a Masked Burst Prediction (MBP) task and a Burst Structural Discrimination Task (BSDT) to model the contextual dependencies within bursts and the structural consistency between bursts. The fine-tuning stage employs a dynamic weighting mechanism of word embedding and position embedding, a multi-head attention pooling (MHAP) mechanism, and a focal loss function optimization strategy to improve the model's semantic modeling ability, global feature expressiveness, and class balance performance, thereby achieving high-accuracy identification and robust generalization of multi-protocol encrypted traffic.

2. The two self-supervised pre-training methods according to claim 1, characterized in that, The specific scheme is as follows: MBP aims to guide the model to autonomously learn the contextual dependencies and structural evolution patterns within encrypted traffic by randomly masking and reconstructing fragments in burst sequences. In encrypted communication, the data distribution at different stages exhibits obvious non-uniform information density characteristics: handshake Data packets during the key negotiation and content initialization phases typically contain higher structural and behavioral discriminative power, while data during the transmission phase is relatively stable. Specifically, 20% of the tokens in the input sequence are randomly selected as prediction targets, of which 80% are replaced with a special marker [MASK], 10% are replaced with random tokens, and the remaining 10% remain unchanged. The model infers the original token at the occluded location through context and is trained with a negative log-likelihood loss. L BMPT =-logP(MASK i =token i ∣X;θ) (1) Where X is the masked sequence of input tokens; MASK i It is the position of the i-th masked element; token i It is the i-th token in the original sequence; P(·|X;θ) is the predicted probability output by the Transformer encoder; it is modeled by the parameter θ, where θ is a trainable parameter of the model. The core idea of ​​BSDT is to guide the model to maintain both "consistency of homologous bursts" and "separability of heterologous bursts" in the representation space through structural discriminant constraints. Specifically, burst sequences generated at different stages or from different perspectives within the same session flow should exhibit high similarity in their structural features in the latent semantic space; while bursts from different applications or sessions should maintain a distinct distribution. Suppose there exists a set of burst sequences in the encrypted traffic. Each of the sudden B i It consists of multiple data packet subsequences. For any pair of subbursts (b i ,b j Define its structural similarity label y. ij : The model uses a shared encoder f θ (·) Map each subburst to a latent representation Subsequently, the structural similarity probability between the two is calculated using the structural discriminant function g(·,·) (bilinear similarity function): P(y ij =1|b i ,b j )=σ(g(z i ,With j )), (3) Where σ(·) is the Sigmoid function. The optimization objective of the task is defined as the binary cross-entropy loss: To further enhance the discriminative power of the structural space, this invention introduces a structural difference enhancement term in g(·,·), defined as: Where δ is the interval threshold, used to force the minimum structural distance between non-homologous samples. The final BSDT optimization objective can be written as: Where λ is the balance coefficient. During the joint optimization phase, the model simultaneously performs forward propagation and backward gradient update for both tasks on the same encoder. The overall pre-training objective is defined as: Here, α is the weight balancing coefficient, used to achieve a balance between local reconstruction accuracy and global structural consistency.

3. The method for strengthening the structure in the fine-tuning stage according to claim 1, characterized in that, The specific implementation plan is as follows: The principle of Dynamic Weighted Fusion (DW) is to obtain word embeddings separately. With position embedding After the vector. Unlike direct addition, this invention employs a dynamic weighted fusion mechanism strategy to make the final representation Satisfy the following formula: E=a tok ·E (tok) +a pos ·E (pos) (8) Where α tok With α pos There are two dynamic weighting coefficients that satisfy α tok +α pos =1, used to control the contribution of the two types of embedding information to the final representation. To achieve dynamic weight generation, this invention designs an attention-aware fusion module, the core idea of ​​which is to use the global semantic features of the input sequence as a query to generate attention weights. First, this invention averages the two embedding types along the channel dimension to obtain the semantic representation before fusion, thus obtaining the semantic summary representation of the sequence. Then, a linear transformation is used to map q to two fusion fractions: in, It is a learnable weight matrix. This is the bias term. Next, the fusion weights are calculated using the temperature-controlled Softmax function: Here, τ > 0 is a temperature coefficient used to control the smoothness of the weight distribution. Lower τ values ​​make the distribution more biased towards "hard selection," while higher τ values ​​result in a smoother distribution. Finally, this invention stacks the two embedding tensors into a four-dimensional tensor by their last dimension. Then, they are fused using an attention-weighted approach: The fused result E will be used as input to the Transformer Encoder for subsequent feature modeling and classification tasks. Multi-head attention pooling (MHAP): Given an input feature sequence Where B represents the batch size, L represents the sequence length, and d is the hidden state dimension, MHAP first generates three sets of vectors—Query, Key, and Value—through linear mapping: Q=XW Q ,K=XW K ,V=XW V (11) in These are the learnable parameters. Subsequently, each vector is split into h subspaces using a multi-head method, with each head having a dimension of d. h =d / h. The attention score for each head is calculated using scaled dot product attention: in The output of each attention head is then concatenated and linearly transformed along the feature dimension to obtain the overall sequence representation. O=Concat(O1,...,O h )·W O ,O∈R B×L×d (13) Then, an importance score for each time step is calculated using a single-layer perceptron, as follows: in w is the representation of the i-th time step. attn ∈R d Weights are assigned to learnable attention. The above operations yield the normalized weights α. i Used for weighted aggregation: Finally, a fixed-length global representation vector z∈R is obtained. B×d This represents the important semantic information of all time steps in the sequence under weighted fusion. To improve information retention and training stability, residual connections and layer normalization mechanisms are introduced after the aggregated representation. Specifically, the attention-pooled representation is residually connected to the feature at the first position of the input sequence. z final =LayerNorm(z+X [:,0,:] ) (16) Let be the d-dimensional feature vector of the first token in each sample of the batch. This design not only preserves the structural prior of the original sequence, but also helps the gradient propagate more stably in the network. The formal definition of Focal Loss is as follows: Where, p y α represents the predicted probability of the true class y. y γ is the class balance coefficient, used to compensate for the bias caused by uneven label distribution, and γ is the focusing parameter, used to control the degree of weight decay for easily classified samples. Through this adaptive weighting mechanism, the model can pay more attention to difficult-to-classify and minority class samples, thereby improving the overall classification performance on imbalanced data.

Images