A semi-supervised encrypted traffic identification method and system based on path signatures

Abstract

The application discloses a kind of semi-supervised encrypted traffic identification method and system based on path signature, the method specifically includes: parsing original network traffic data, extracts packet length and uplink and downlink attribute to construct signed one-dimensional traffic path;Gaussian disturbance is applied to one-dimensional traffic path or / and packet loss simulation is applied to simulate real network environment;The one-dimensional traffic path after enhancement is decomposed into client direction sub-path and server direction sub-path, and cumulative feature dimension and time monotonic dimension are introduced, and mapped into multidimensional traffic path;The multidimensional traffic path is carried out truncated path signature calculation, and the traffic path is converted into fixed-length path signature feature vector;A large number of unlabeled data and very few labeled data are used to train complementary generative adversarial network model.The application effectively solves the problem of insufficient features and scarce labeled data in real network scenarios, significantly reduces the labeling cost, and realizes high-performance and strong generalization capability of encrypted traffic identification.

Description

Technical Field

[0001] This invention relates to the field of encrypted traffic identification in computer networks, and more particularly to a semi-supervised encrypted traffic identification method and system based on path signature. Background Technology

[0002] With the rapid development of internet technology and the increasing awareness of network security, encrypted communication technologies such as TLS / SSL, VPN, and Tor have been widely used in various network services. While protecting user privacy, encryption technology also conceals the payload content of traffic, rendering traditional traffic identification methods based on port matching or deep packet inspection (DPI) gradually ineffective. Therefore, how to accurately identify encrypted traffic without relying on decrypting the payload has become a key technical challenge in areas such as network management, malware detection, and Quality of Service (QoS).

[0003] Based on this, a new generation of statistical feature-based methods has emerged and is gradually becoming the mainstream method for encrypted traffic identification.

[0004] Early methods based on manually generated statistical features relied heavily on expert experience to design handcrafted features. For example, they used random forest algorithms combined with features such as packet length extremes and burst duration to detect covert tunnels; or they utilized TLS handshake metadata for malware identification. These methods had low computational overhead, but their feature design was often limited to shallow statistical properties (such as mean and variance), neglecting the fine-grained temporal logic implicit in encrypted traffic and the bidirectional interaction patterns between clients and servers. This resulted in insufficient feature discriminative power and robustness, leading to limited accuracy when facing complex applications or traffic obfuscation.

[0005] To capture richer structural information, researchers have turned to deep neural networks for automatic feature extraction. Recently, graph neural networks (GNNs) have been introduced to model the topology of flows, representing the internal relationships of flows by constructing flow graphs. However, constructing complex deep representations or graph structures incurs high computational costs and lacks robustness in feature extraction. Meanwhile, these deep supervised models heavily rely on large-scale, high-quality labeled data during training. In real-world scenarios where labels are scarce, these models are prone to overfitting, leading to a significant drop in generalization performance.

[0006] Based on this, existing encrypted traffic identification schemes based on machine learning (ML) or deep learning (DL) have the following two main problems:

[0007] First, the mining of traffic feature information is insufficient. In methods based on manually designed features, feature design and selection play a crucial role. Due to the limited feature information available for encrypted traffic, existing encrypted traffic identification methods do not fully mine this information and often lack distinctiveness and robustness, resulting in limited accuracy. Therefore, designing more effective encrypted traffic feature extraction methods based on limited encrypted traffic information to improve encrypted traffic identification performance is a key issue.

[0008] Second, there is a lack of labeled encrypted traffic training data. The supervised learning frameworks used in mainstream methods heavily rely on high-quality, large-scale labeled data. In real-world networks, manually labeling massive amounts of encrypted traffic data based on expert experience is too costly. Therefore, traffic data in real-world scenarios generally exhibits the characteristics of "scarce labeled data and abundant unlabeled data," making it difficult to meet the scalable requirements of model training. Insufficient labeled data severely limits the practical feasibility of purely supervised methods, easily leading to low generalization ability due to reliance on limited labeled samples, and difficulty adapting to new data distributions.

[0009] To address the issue of insufficient labeled data, researchers often employ semi-supervised learning. While semi-supervised learning has achieved great success in computer vision (e.g., FixMatch, MixMatch), directly transferring these methods to encrypted traffic recognition faces significant challenges, primarily due to the fundamental differences in data modalities. Image data exhibits high spatial correlation; therefore, semi-supervised methods in the image domain heavily rely on data augmentation that preserves the original meaning of the image, such as rotation, cropping, flipping, and color dithering. However, directly applying these augmentation methods to traffic data can easily disrupt its original semantic structure, causing the generated samples to lose physical meaning and rendering the semi-supervised methods ineffective. Therefore, designing a semi-supervised model suitable for encrypted traffic recognition that does not rely on meaning-preserving data augmentation is a challenge.

[0010] In summary, existing encrypted traffic identification technologies have significant shortcomings in terms of feature mining depth and robustness, as well as efficiency in utilizing unlabeled data. In practical applications, they face challenges such as insufficient traffic features and a scarcity of labeled samples. Summary of the Invention

[0011] The purpose of this invention is to provide a semi-supervised encrypted traffic identification method and system based on path signature. Based on the full mining of flow sequence information and GAN semi-supervised learning that is highly adapted to flow data, it effectively solves the problems of insufficient features and scarce label data in real network scenarios, significantly reduces the labeling cost, and achieves high-performance encrypted traffic identification with strong generalization ability, thereby solving at least one of the above-mentioned problems in the prior art.

[0012] In a first aspect, the present invention provides a semi-supervised encrypted traffic identification method based on path signature, the method specifically comprising:

[0013] Parse raw network traffic data to extract packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path;

[0014] Gaussian perturbation and / or packet loss simulation are applied to the one-dimensional traffic path to simulate the real network environment, thereby obtaining an enhanced one-dimensional traffic path.

[0015] The enhanced one-dimensional traffic path is decomposed into client-side and server-side sub-paths, and the cumulative feature dimension and time monotonic dimension are introduced to map it into a multi-dimensional traffic path.

[0016] Rough path theory is used to calculate truncated path signatures for multidimensional traffic paths, transforming the traffic paths into fixed-length path signature feature vectors.

[0017] A complementary generative adversarial network model containing a complementary generator and a discriminator is established. The model is trained using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and the discriminator.

[0018] After training, a discriminator is used to classify and identify the target encrypted traffic.

[0019] Secondly, this invention provides a semi-supervised encrypted traffic identification system based on path signature, the system specifically comprising:

[0020] The path construction module is used to parse raw network traffic data, extract packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path;

[0021] The path enhancement module is used to apply Gaussian perturbation and / or packet loss simulation to a one-dimensional traffic path to simulate a real network environment and obtain an enhanced one-dimensional traffic path.

[0022] The path dimension enhancement module is used to decompose the enhanced one-dimensional traffic path into client-side sub-paths and server-side sub-paths, and introduce cumulative feature dimension and time monotonic dimension to map it into a multi-dimensional traffic path.

[0023] The signature feature extraction module is used to perform truncated path signature calculation on multidimensional traffic paths using coarse path theory, and to transform the traffic paths into fixed-length path signature feature vectors.

[0024] The semi-supervised training module is used to build a complementary generative adversarial network model that includes a complementary generator and a discriminator. The complementary generative adversarial network model is trained using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and the discriminator.

[0025] The encrypted traffic identification module is used to classify and identify target encrypted traffic after training, using a discriminator.

[0026] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, and a computer program stored in the memory, wherein when the computer program is executed on the processor, it implements the semi-supervised encrypted traffic identification method based on path signature as described in any of the above methods.

[0027] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the semi-supervised encrypted traffic identification method based on path signature as described in any of the above methods.

[0028] Compared with the prior art, the present invention has at least one of the following technical effects:

[0029] 1. Based on the full mining of flow sequence information and the GAN semi-supervised learning that is highly adapted to flow data, this invention effectively solves the problems of insufficient features and scarce label data in real network scenarios, significantly reduces the labeling cost, and achieves high-performance, high-generalization encrypted traffic identification.

[0030] 2. This invention can fully mine traffic feature information and has a feature representation mechanism with high discriminative power and strong robustness.

[0031] 3. This invention can break the limitations of full supervision and make full use of the training framework of massive unlabeled data distribution information.

[0032] 4. This invention can still achieve high-precision recognition under a few label conditions, and the model is lightweight, efficient, and has generalization ability.

[0033] 5. This invention introduces path signatures from coarse path theory as a feature extraction tool to effectively capture the fine-grained logic and high-order features hidden in encrypted traffic sequences. At the same time, it combines complementary generative adversarial networks (GANs) to construct a semi-supervised learning framework, and uses low-density complementary samples generated by the generator to optimize the decision boundary of the discriminator, thus achieving high-precision recognition in scenarios where labels are scarce.

[0034] 6. This invention significantly improves the robustness and discriminative power of traffic features: It introduces path signatures from coarse path theory as a feature extraction method. Compared to traditional simple statistical features, path signatures not only capture high-order nonlinear interaction information in data packet sequences but also possess key mathematical properties such as reparameterization invariance, uniqueness, and fixed order. Combined with a path enhancement strategy using Gaussian perturbation and packet loss simulation, the extracted features maintain high stability even when facing common packet loss and adversarial interference in real-world network environments. In summary, this invention effectively solves the problem of insufficient feature mining in existing technologies.

[0035] 7. This invention achieves high-precision recognition in label-scarce scenarios: This invention proposes a semi-supervised adversarial training framework based on a complementary generation strategy. By generating complementary samples located in low-density regions between real class clusters, the decision boundary of the discriminator is forced to shrink towards high-density data regions, thus achieving effective utilization of massive amounts of unlabeled data. This method is fully adaptable to encrypted traffic recognition. Based on path signature features, it can still achieve excellent classification performance using only a very small number of labeled samples, significantly reducing the data labeling cost in practical deployments.

[0036] 8. The model of this invention is lightweight and efficient, with real-time deployment potential: Thanks to the efficient expressive power of path signature features themselves, this invention only needs to use a lightweight multilayer perceptron (MLP) as the basic classifier to achieve extremely high recognition accuracy, avoiding the high computational overhead of using complex recurrent neural networks (RNNs) or convolutional neural networks (CNNs). This allows the method to maintain high performance while having extremely low inference latency, making it very suitable for deployment on network security devices or edge computing nodes with high real-time requirements.

[0037] 9. By organically combining robust mathematical feature extraction with a semi-supervised learning framework, this invention not only overcomes the technical challenge of concealing encrypted traffic features, but also effectively solves the pain point of scarce labeled data in real-world scenarios, while achieving high-precision recognition results with extremely low model complexity.

[0038] 10. This invention demonstrates excellent performance in key indicators such as accuracy, robustness, generalization ability, and deployment efficiency, providing strong technical support for encrypted traffic monitoring and security defense in various complex network environments. It has significant practical value and broad application prospects. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating a semi-supervised encrypted traffic identification method based on path signature provided in an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the system architecture of a semi-supervised encrypted traffic identification method based on path signature provided in an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of the structure of a semi-supervised encrypted traffic identification system based on path signature provided in an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0044] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0045] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0046] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0047] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0048] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0049] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0050] In this application embodiment, the entity executing the process includes a terminal device. This terminal device includes, but is not limited to, devices capable of executing the methods disclosed in this application, such as servers, computers, smartphones, and tablets. Figure 1 A flowchart illustrating a path signature-based semi-supervised encrypted traffic identification method according to an embodiment of the present invention is shown below:

[0051] S101, parse the raw network traffic data, extract the packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path;

[0052] S102, apply Gaussian perturbation and / or packet loss simulation to the one-dimensional traffic path to simulate the real network environment and obtain the enhanced one-dimensional traffic path;

[0053] S103 decomposes the enhanced one-dimensional traffic path into client-side sub-paths and server-side sub-paths, and introduces cumulative feature dimension and time monotonic dimension to map it into a multi-dimensional traffic path.

[0054] S104 uses rough path theory to perform truncated path signature calculation on multidimensional traffic paths, transforming the traffic paths into fixed-length path signature feature vectors.

[0055] S105, Establish a complementary generative adversarial network model that includes a complementary generator and a discriminator. Train the complementary generative adversarial network model using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and the discriminator.

[0056] S106 After training, the discriminator is used to classify and identify the target encrypted traffic.

[0057] In this embodiment, the specific steps include: traffic path construction: parsing the original network traffic data, extracting packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path; traffic path enhancement: applying Gaussian perturbation and / or packet loss simulation to the one-dimensional traffic path to simulate a real network environment; path dimension-enhancing mapping: decomposing the enhanced one-dimensional traffic path into client-side sub-paths and server-side sub-paths, and introducing cumulative feature dimension and time monotonic dimension to map the one-dimensional path into a multi-dimensional traffic path; truncated path signature feature extraction: using coarse path theory, performing truncated path signature calculation on the multi-dimensional traffic path, transforming the traffic path into a fixed-length path signature feature vector as a robust statistical feature of the traffic; complementary generative adversarial network construction: constructing a complementary generative adversarial network model containing a complementary generator (G) and a discriminator (D); semi-supervised adversarial training: using a small number of labeled samples and a large number of unlabeled samples, optimizing the generator and discriminator through adversarial training; encrypted traffic identification: after training, using the discriminator to classify and identify target encrypted traffic.

[0058] As an explanation of the system architecture for the above steps S101 to S106, Figure 2 The typical deployment architecture and data flow of the method of this invention are illustrated, specifically including:

[0059] (1) System composition:

[0060] The system of this invention mainly comprises three core parts: a data preprocessing module, a feature extraction module, and a semi-supervised encrypted traffic identification module.

[0061] The data preprocessing module performs the cleaning and standardization of raw network traffic for the system. It is responsible for receiving raw network packet capture files and performing stream reconstruction and parsing on the mixed traffic based on the standard five-tuple information (source IP, destination IP, source port, destination port, transport layer protocol) to generate independent raw data stream objects that can be processed later.

[0062] The feature extraction module is the core feature engine of this system, responsible for mining deep, robust features from the raw data stream. This module first extracts basic packet length and direction attributes from the data stream to construct a one-dimensional path. Then, it enhances the path by introducing Gaussian perturbations and packet loss simulation, and further increases the path dimensionality by constructing bidirectional interactive paths and cumulative feature paths. Finally, it calculates the truncated path signature of the multi-dimensional path, generating a fixed-length path signature feature vector.

[0063] The semi-supervised encrypted traffic identification module is fully responsible for both model training and traffic identification tasks. This module incorporates a semi-supervised learning framework based on complementary generative adversarial networks (GANs), including a lightweight base classifier (discriminator) and a complementary generator. It can simultaneously utilize a small number of labeled samples and a massive amount of unlabeled samples for adversarial training, optimizing the classifier's decision boundary and ultimately outputting the encrypted application category label for the target traffic.

[0064] (2) System workflow:

[0065] During system operation, the data preprocessing module first reads and parses the PCAP (PacketCapture) file of the raw network traffic, reassembling the discrete data packets into a continuous sequence of raw data streams using 5-tuples. Subsequently, the data stream enters the feature extraction module. The system first extracts the length and direction information of each data packet in the stream to establish an initial one-dimensional traffic path. To improve the adaptability of features to network fluctuations, the system applies random Gaussian noise perturbations and simulates packet loss to the paths. Next, the system performs dimensionality-enhancing mapping on the enhanced paths, decomposing the unidirectional interaction paths between the client and server and their accumulated features, and integrating the monotonic time dimension to construct a five-dimensional traffic path rich in structural information. Based on this, the module calculates the multi-order truncated path signature of the path and outputs a robust feature vector. Finally, the feature vectors are fed into the semi-supervised encrypted traffic identification module. During the training phase, the module utilizes the feature vectors... The generator and discriminator are iteratively optimized; during the inference phase, the trained base classifier (discriminator) directly receives the feature vector. Through lightweight forward computation, it can quickly output the encrypted application category or specific service type to which the traffic belongs, thereby achieving efficient and accurate encrypted traffic identification.

[0066] The core idea of ​​this invention is to utilize path signatures from coarse path theory as a feature extraction tool to transform network traffic sequences into mathematically robust fixed-length feature vectors. This is combined with a semi-supervised adversarial learning framework based on a complementary generation strategy to achieve effective utilization of massive amounts of unlabeled data. This invention requires only a small number of labels to achieve high-precision recognition.

[0067] In some embodiments, step S101 above, which involves parsing the original network traffic data and extracting the packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path, specifically includes:

[0068] Establish a connection between the client and the server, and interact by sending requests and transferring resources based on the connection between the client and the server;

[0069] Based on the uplink and downlink messages that are transmitted alternately during the interaction, a message sequence with protocol characteristics is formed;

[0070] Model the network traffic behavior in the message sequence, collect the length information of each data packet, and generate the original sequence;

[0071] A one-dimensional traffic path is constructed by taking packets whose packet length values ​​in the original sequence are negative as uplink packets sent by the client and packets whose packet length values ​​in the original sequence are positive as downlink packets sent by the client.

[0072] This embodiment describes in detail how to construct paths for raw network traffic. The specific method for constructing traffic paths is as follows:

[0073] When a client and server establish a connection, they interact by sending requests and transmitting resources. Uplink messages (sent by the client) and downlink messages (responded by the server) are transmitted alternately, and the resulting message sequences typically exhibit clear protocol characteristics. Modeling this network traffic behavior and collecting the lengths of the traffic messages generates the original sequence. , This represents the data packets from the 1st to the nth data blocks, where Indicates uplink data packets. This indicates a downlink data packet.

[0074] In some embodiments, step S102 above, which involves applying Gaussian perturbation and / or packet loss simulation to the one-dimensional traffic path to simulate a real network environment and obtain an enhanced one-dimensional traffic path, specifically includes:

[0075] Based on a one-dimensional traffic path, obtain the length value and corresponding direction sign of each data packet;

[0076] Keeping the direction sign unchanged, add independently sampled Gaussian noise terms to the absolute value of the length of each data packet to form the perturbed path;

[0077] Randomly determine the starting position and window size on the one-dimensional traffic path, remove the length value of the corresponding data packet in the current window, shift the subsequent data forward, and pad the end of the data packet length sequence of the one-dimensional traffic path with zeros to form a path after simulated packet loss.

[0078] This embodiment describes in detail how to perform two enhancement processes on the constructed one-dimensional traffic path: Gaussian perturbation and packet loss simulation. The specific methods for path enhancement are as follows:

[0079] The Gaussian perturbation specifically preserves the original direction sign. Without changing the absolute value of the packet length, add an independently sampled noise term. ,in, This represents the noise term added to the absolute value of the length of the i-th data packet, where N represents a normal distribution. This parameter represents the magnitude of the variance used to adjust for noise. The variance, representing the packet length, reflects the degree of variation in packet length; packet loss simulation specifically involves randomly selecting a starting point. and window size Remove the contents of this window The length of each data packet is calculated, and subsequent data is shifted forward and padded with zeros at the end. A Gaussian perturbation and / or packet loss simulation are applied to the one-dimensional traffic path, and the enhanced traffic path is denoted as... .

[0080] In some embodiments, in step S103 above, decomposing the enhanced one-dimensional traffic path into client-side sub-paths and server-side sub-paths, and introducing cumulative feature dimensions and time monotonicity dimensions to map it into a multi-dimensional traffic path, specifically includes:

[0081] Based on the enhanced one-dimensional traffic path, the transmission direction is distinguished according to the direction sign corresponding to the length value of each data packet.

[0082] The length of uplink data packets with negative direction signs is retained, and the length of downlink data packets with positive direction signs is set to zero to generate client-side subpaths;

[0083] The length of downlink data packets with positive direction signs is retained, and the length of uplink data packets with negative direction signs is set to zero, thus generating a server-side direction subpath;

[0084] Prefix summation is performed on the client-side and server-side sub-paths respectively to generate the corresponding client-side cumulative feature sub-paths and server-side cumulative feature sub-paths;

[0085] By introducing a monotonically increasing time coordinate parameter, the client-side directional sub-path, the server-side directional sub-path, the client-side cumulative feature sub-path, the server-side cumulative feature sub-path, and the time coordinate parameter are combined and mapped into a multi-dimensional traffic path.

[0086] This embodiment describes in detail how to perform dimensionality augmentation on the enhanced path. The specific method for path dimensionality augmentation mapping includes the following two steps:

[0087] (1) Constructing client-side unidirectional sub-paths server-side one-way sub-path Based on the enhanced traffic path By assigning a value of zero to the size of data packets transmitted in the opposite direction, the unique traffic characteristics inherent in each direction are emphasized:

[0088] ;

[0089] in For elements in a client-side one-way subpath, This is an element of a one-way sub-path on the server side. This is the enhanced traffic path element.

[0090] (2) Construct client-side cumulative feature sub-path server-side accumulated feature sub-path For the client-side unidirectional sub-path server-side one-way sub-path Prefix summation is performed separately to reveal the accumulation pattern of the flow load:

[0091] ;

[0092] in, Indicates the client's cumulative feature subpath The m-th element is the cumulative sum of all feature values ​​up to the m-th point on the client path. Indicates the server-side accumulated feature sub-path The m-th element is the cumulative sum of all feature values ​​up to the m-th point on the server path. Represents all values ​​from i=1 to i=m. Summing the values ​​of , Represents all values ​​from i=1 to i=m. The values ​​are summed.

[0093] The final generated five-dimensional flow path is represented as follows: ,in The time coordinate parameter is monotonically increasing.

[0094] In some embodiments, step S104 above, which involves using rough path theory to perform truncated path signature calculation on multidimensional traffic paths and transforming the traffic paths into fixed-length path signature feature vectors, specifically includes:

[0095] Obtain the integral interval corresponding to the multi-dimensional traffic path;

[0096] Based on rough path theory, iterative integral calculations are performed on each dimension of the multidimensional flow path within the integral interval to generate k-order signature items from first order to a preset order k.

[0097] The constant 1 is used as the 0th order signature item, and it is combined with the first to kth order signature items in order of order to form a signature item sequence containing all signature items;

[0098] The signature sequence is output as a fixed-length path signature feature vector, which serves as a feature vector characterizing the robust statistical features of the traffic path.

[0099] This embodiment describes in detail how the method utilizes a five-dimensional traffic path for signature feature extraction. The specific method for extracting signature features using a truncated path is as follows:

[0100] For five-dimensional flow paths ,That The signature terms are obtained by iteratively integrating each dimension over the interval: Final extracted feature vector From order 0 to the th The sequence of all signature entries of the order is composed of, i.e. A truncated path signature of order 0, where the 0th-order signature term is a constant 1. Represents a five-dimensional flow path k-th order signature item, Indicates the start and end points of integration, used within the path interval [ Integrating the points on the [top], This represents a specific combination of dimensions in five-dimensional space. This represents the differential element in the iterative integral, i.e., in time... arrive Upper dimension arrive Traffic path value, The symbol for multiple integrals indicates nested integration over a time interval, with the order of integration from the innermost to the outermost interval being: arrive This step enhances the robustness and discriminativeness of traffic features through the uniqueness of path signatures and the invariance of repetitive parameters.

[0101] In some embodiments, step S105 above, which involves establishing a complementary generative adversarial network model including a complementary generator and a discriminator, specifically includes:

[0102] A complementary generator is configured to map low-dimensional random noise vectors to a high-dimensional feature space to generate pseudo-samples. The complementary generator is structured as a neural network consisting of multiple fully connected layers stacked together, with a batch normalization layer and a Softplus activation function connected after each fully connected layer.

[0103] Configure a discriminator to perform both real sample classification and generated sample discrimination tasks simultaneously, and set the discriminator's structure to a lightweight multilayer perceptron;

[0104] A complementary generative adversarial network model is constructed by using an adversarial structure between complementary generators and discriminators.

[0105] In this embodiment, the design of the complementary generative network is described in detail, and the specific method for constructing the complementary adversarial generative network is as follows:

[0106] The complementary generator G is configured to map low-dimensional random noise vectors to a high-dimensional feature space to generate pseudo samples. It consists of multiple stacked fully connected layers, each followed by a batch normalization layer and a softplus activation function. The discriminator D is configured as a K+1 classification neural network, which undertakes both real / fake discrimination and classification tasks. It adopts a lightweight multilayer perceptron (MLP) structure, containing four hidden layers, with the number of neurons in each hidden layer decreasing progressively, configured as 512, 256, 128, and 64 respectively.

[0107] In some embodiments, in step S106 above, the complementary generative adversarial network model is trained using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and the discriminator:

[0108] By receiving a random noise vector through a complementary generator, generated samples are generated and distributed in low-density regions among real clusters.

[0109] The labeled samples from the labeled sample set, the unlabeled samples from the unlabeled sample set, and the generated samples are all input into the discriminator.

[0110] Set the loss function for the complementary generator, which includes an entropy regularization term, a quality constraint term, and a feature matching term;

[0111] The loss function of the discriminator is set, which includes a supervised learning term, a realism discrimination term, a generated sample detection term, and an unlabeled data utilization term;

[0112] With the parameters of the complementary generator fixed, the parameters of the discriminator are updated based on the discriminator's loss function.

[0113] With the parameters of the discriminator fixed, the parameters of the complementary generator are updated based on the loss function of the complementary generator.

[0114] The parameters of the complementary generator and discriminator are repeatedly and alternately optimized until the preset model convergence condition is met, thus completing the training of the complementary generative adversarial network model.

[0115] This embodiment describes in detail the semi-supervised adversarial training objective and process of complementary adversarial generative networks. The specific method of semi-supervised adversarial training is as follows:

[0116] A complementary generation strategy based on the low-density separation assumption is adopted. During the training phase, the generator G receives a random noise vector that conforms to a standard normal distribution. As input, samples are generated through a multi-layer neural network. By utilizing the distribution of unlabeled samples, complementary samples are generated in low-density regions distributed among the real clusters. The discriminator D receives labeled samples, unlabeled samples, and generated samples, and optimizes the loss function to simultaneously achieve correct classification of labeled samples and identification of generated samples as the first... The three objectives are classified and labeled with real targets for unlabeled data, and the decision boundary is narrowed by using complementary samples.

[0117] The semi-supervised adversarial training employs an alternating optimization strategy combined with a stability guarantee mechanism, specifically including:

[0118] (1) Execute the alternating update process: including the discriminator update stage and the generator update stage. In the discriminator update stage, the generator parameters are fixed, and the discriminator loss function is optimized using mini-batch gradient descent, so that the discriminator can simultaneously process labeled samples, unlabeled samples and generated samples through multi-task learning; in the generator update stage, the discriminator parameters are fixed, the generator loss function is optimized, and the quality of generated samples is improved through adversarial training so that its statistical characteristics are close to the real data.

[0119] (2) Implement stability guarantee measures: use spectral normalization to constrain the Lipschitz constant of the discriminator; adopt a gradual learning rate decay strategy to adjust the optimization process; introduce a gradient penalty term to prevent gradient vanishing or exploding; and use the exponential moving average (EMA) method to update the generator parameters;

[0120] (3) Determine the convergence condition of the model: Training shall be stopped when any one or a combination of the following conditions are met. The classification accuracy of the discriminator on the validation set remains stable within a preset number of epochs (e.g., 20 epochs); the generator loss and the discriminator loss reach a dynamic balance; and the quality evaluation index of the generated samples tends to be stable.

[0121] Furthermore, the loss function of the complementary generator is a weighted sum of the entropy regularization term, the quality constraint term, and the feature matching term;

[0122] The entropy regularization term is used to maximize the uncertainty of the generated samples by calculating the negative entropy of the complementary generator output distribution, so as to encourage the generated samples to cover the low-density regions between real clusters.

[0123] The quality constraint term is used to calculate the probability of the discriminator judging the generated sample and to filter high-confidence samples based on a preset confidence threshold, so as to ensure the quality of the generated sample and guide the generation process to move closer to the high-density real area recognized by the discriminator.

[0124] The feature matching term is used to constrain the statistical properties of the generated samples to approximate the distribution of the real unlabeled data by calculating the norm distance between the distribution difference between the generated samples and the real samples from the unlabeled sample set in the feature space.

[0125] In this embodiment, a tag sample set is provided. The unlabeled sample set is The sample categories are , Indicates the number of labeled samples. This represents the i-th sample. This represents the i-th label. Indicates the number of unlabeled samples. Let the j-th sample be the loss function of the generator. It includes an entropy regularization term, a quality constraint term, and a feature matching term, and the formula is as follows:

[0126] ;

[0127] ;

[0128] The specific definitions and functions of each term in the generator loss function are as follows:

[0129] (1) Entropy regularization term: the term This is used to maximize the entropy of the generator output distribution, preventing the generator from collapsing into a few patterns when only matching first-order moments, and ensuring coverage of the gap regions between manifolds; among which, This represents the distribution of samples generated by the generator. Indicates the generator output distribution The entropy is used to measure the uncertainty or diversity of generated samples;

[0130] (2) Quality constraint item: the item Used to ensure the quality of generated samples; where the indicator function By preset threshold The generated samples whose discriminant confidence is higher than the threshold are filtered out, and constraints are only imposed on high-density region samples that the discriminant determines to be real. It is the expectation of the sample x generated by the generator, used to represent the statistical average of the generated samples; This represents the probability that the discriminator will judge sample x. This represents the probability that the discriminator will judge sample x. Greater than the preset threshold When the condition is met, the function value is 1; otherwise, it is 0.

[0131] (3) Feature matching item: the item This is used to minimize the distribution difference between generated samples and unlabeled real samples in the feature space. Represents the feature extraction function. To balance the weights, this constraint ensures that the generated samples learn the statistical properties of unlabeled real data; Used to map sample x to the feature space; This represents the expectation for unlabeled real samples.

[0132] Furthermore, the loss function of the discriminator is a weighted sum of the supervised learning term, the authenticity discrimination term, the generated sample detection term, and the unlabeled data utilization term;

[0133] The supervised learning term is used to optimize the classification accuracy of the discriminator for labeled samples by calculating the expected log probability of the discriminator correctly classifying labeled samples, using the form of cross-entropy loss.

[0134] The authenticity discrimination term is used to enhance the discriminator's ability to identify the distribution of real unlabeled samples by calculating the log expectation of the total probability that the unlabeled sample belongs to the top K real categories.

[0135] The generated sample detection term is used to improve the discriminator's ability to identify generated samples by calculating the expected log probability of the generated sample being identified as the K+1th fake category by the discriminator.

[0136] The unlabeled data utilization term is used to calculate the negative expectation of the predictive probability entropy of the unlabeled sample in each true category by the discriminator, and to introduce a balanced weight parameter to minimize the uncertainty of the unlabeled sample prediction.

[0137] In this embodiment, the loss function of the discriminator It includes supervised learning terms, authenticity criteria terms, generated sample detection terms, and unlabeled data utilization terms, as shown in the following formula:

[0138] ;

[0139] The specific definitions and functions of each term in the discriminator loss function are as follows:

[0140] (1) Supervised learning item: the item mentioned Cross-entropy loss is employed to maximize the probability of correctly classifying labeled data, ensuring the discriminator's accuracy in classifying samples with known labels; where, Indicates the label sample set Samples in Expectations This means that given input x and conditions Below, the discriminator predicts the label as The logarithmic probability;

[0141] (2) Authenticity judgment item: the item This is used to maximize the total probability that an unlabeled real sample is classified into one of the top K real categories, thereby enhancing the discriminator's ability to identify the distribution of real samples; where, This indicates the unlabeled sample set The expectation of sample x, This means that, given input x, the discriminator predicts the label belongs to the top [the first three categories]. Log probabilities of each true class;

[0142] (3) Generate sample detection items: the items This is used to maximize the probability that the generated sample is correctly identified as the (K+1)th fake category, thereby improving the discriminator's ability to distinguish between real and fake samples; among which, This represents the log probability that the discriminator predicts the label to be of class K+1 (i.e., the fake class) given a generated sample x.

[0143] (4) Unlabeled data utilization item: the item This is used to minimize the prediction entropy of unlabeled data across K true classes, encouraging the discriminator to output high-confidence classification predictions for unlabeled samples, thus fully exploiting the information value of unlabeled data. The parameters are... Used to balance the weight of this term in the total loss. This represents the summation part in the unlabeled data utilization section, which calculates the logarithmic autoinformation of the probability that the discriminator outputs for each true class k for an unlabeled sample x. This represents summing over all categories from 1 to K, where k represents the index of a category from 1 to K. This represents the probability that, given an unlabeled sample x, the discriminator predicts that the sample belongs to the k-th true class. Represents the probability of prediction for the discriminator. Take the logarithm.

[0144] Test example:

[0145] To verify the effectiveness and significant effects of the method of the present invention, the following comparative experiments were conducted:

[0146] Experimental setup:

[0147] Dataset Selection: To comprehensively evaluate the effectiveness of the path signature-based semi-supervised encrypted traffic identification method, four representative traffic datasets were selected for the experiment. These datasets cover various application scenarios, including IoT device identification, botnet detection, and encrypted malicious traffic classification. They include both private data collected in real network environments and publicly available benchmark datasets widely used in academia, which can fully verify the generalization ability of the method. The specific descriptions of the datasets are as follows:

[0148] (1) The IOT13 dataset is a private dataset collected in a real network environment, designed to verify the performance of the model in a real deployment environment. The data was collected from a smart home network environment in China and covers 13 different types of Internet of Things (IoT) devices, including common devices such as smart speakers, smart cameras, and smart sockets from different brands, capturing more than 16 million data packets;

[0149] (2) The TMC12 dataset comes from a publicly available dataset released by the University of New South Wales (UNSW). This dataset is one of the widely used benchmark datasets in the field of IoT traffic analysis. The authors used 28 IoT devices to instrumentate a live laboratory to simulate a smart environment, and collected and integrated data in this environment for 6 months. Some of the data has been made available to the research community. This experiment selected traffic data from 12 typical IoT devices.

[0150] (3) The MedBIoT dataset is a public dataset focused on detecting IoT botnet attacks. This dataset includes traffic from three botnet attack types: Mirai, Bashlite, and Torii. The total size is 8.14GB and contains three PCAP files.

[0151] (4) The USTC-TFC2016 dataset is specifically designed for anomaly detection. It contains 10 types of public website malicious traffic and 10 types of benign traffic, covering various application scenarios such as web browsing, video streaming, and file transfer. Malicious traffic includes botnets, banking Trojans, ransomware, etc., making it of significant value in network security and intrusion detection research. This dataset is relatively small, with a total size of 3.71GB, and contains 24 PCAP files.

[0152] Comparison Methods: To effectively evaluate the effectiveness of this invention, the experimental comparison methods include currently mainstream and advanced encrypted traffic identification methods, namely optimized deep learning methods (FS-Net, Length Matters, WF-Transformer), pre-trained methods based on limited labeled data, semi-supervised methods (MT-FlowFormer, NetMamba), and graph construction-based methods (GraphIoT, GraphDApp). Testing Metrics: Accuracy (Acc) and F1 score were used to evaluate the performance of the methods. The F1 score employed a macro-averaging method to reduce bias caused by class imbalance.

[0153] Table 1 Performance comparison on four datasets with different label ratios

[0154]

[0155] Table 1 shows the performance comparison between the method of this invention and seven existing state-of-the-art methods on four real-world datasets. Experimental results show that as the proportion of labeled data decreases from 10% to 1%, although the performance of all models declines to varying degrees, the method of this invention still maintains the top position in almost all metrics, and its leading advantage becomes more significant in scenarios with extremely scarce labels (1%).

[0156] In the most challenging scenario of 1% labeled data, the method of this invention exhibits overwhelming stability. For example, on the MedBIoT dataset, even with only 1% labels, the method of this invention still maintains an accuracy of 94.0% and an F1 score of 93.8%. In contrast, traditional deep learning methods such as FS-Net see their F1 scores plummet to 56.6% and 72.9% respectively in this setting, demonstrating that purely supervised learning models struggle to achieve good performance when data is scarce. Although semi-supervised methods such as NetMamba and MT-FlowFormer also utilize unlabeled data, their generalization ability fluctuates significantly across different datasets. For example, while NetMamba performs relatively well with a 10% label ratio on USTC-TFC, its F1 score is only 63.3% on a 1% label ratio on TMC12, far lower than the 85.7% of the method of this invention. These data strongly demonstrate that the semi-supervised framework based on complementary generative adversarial networks can fully exploit the distribution information of unlabeled data, filling low-density regions by generating complementary samples, assisting the classifier in establishing accurate decision boundaries, and improving recognition accuracy.

[0157] Graph-based methods such as GraphIoT and GraphDApp attempt to capture traffic features through complex topological structures, but their performance deteriorates significantly with low label ratios. This may be because complex graph structures struggle to converge effectively with weak supervision signals when labels are scarce. Similarly, semi-supervised methods such as NetMamba and MT-FlowFormer also underperform the method of this invention at 10% label ratios, indicating that their extraction of traffic feature information needs improvement. In contrast, the method of this invention combines a lightweight MLP with multi-scale path feature fusion, providing more discriminative and robust input representations for semi-supervised learning, and showing greater advantages in scenarios with few samples.

[0158] As can be seen from the above embodiments and test cases, by combining the strong representational ability of path signature features with the boundary optimization ability of complementary generative adversarial networks, the method of the present invention not only solves the problem of insufficient mining of encrypted traffic features, but also effectively overcomes the challenge of scarce labeled data in real-world scenarios, demonstrating excellent generalization and practical value in various benchmark tests.

[0159] Reference Figure 3 An embodiment of the present invention provides a semi-supervised encrypted traffic identification system 3 based on path signature, wherein the system 3 specifically includes:

[0160] The path construction module 301 is used to parse the raw network traffic data, extract the packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path.

[0161] The path enhancement module 302 is used to apply Gaussian perturbation and / or packet loss simulation to a one-dimensional traffic path to simulate a real network environment and obtain an enhanced one-dimensional traffic path.

[0162] The path dimension enhancement module 303 is used to decompose the enhanced one-dimensional traffic path into client-side sub-paths and server-side sub-paths, and introduce cumulative feature dimension and time monotonic dimension to map it into a multi-dimensional traffic path.

[0163] The signature feature extraction module 304 is used to perform truncated path signature calculation on multidimensional traffic paths using coarse path theory, and to transform the traffic paths into fixed-length path signature feature vectors.

[0164] The semi-supervised training module 305 is used to build a complementary generative adversarial network model that includes a complementary generator and a discriminator. The complementary generative adversarial network model is trained using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and the discriminator.

[0165] The encrypted traffic identification module 306 is used to classify and identify target encrypted traffic using a discriminator after training.

[0166] It is understandable that, such as Figure 1 The content of the path signature-based semi-supervised encrypted traffic identification method embodiments shown herein is applicable to the path signature-based semi-supervised encrypted traffic identification system embodiments. The specific functions implemented by the path signature-based semi-supervised encrypted traffic identification system embodiments are the same as those shown below. Figure 1 The illustrated implementation of the semi-supervised encrypted traffic identification method based on path signature is the same as that shown, and achieves the same beneficial effects. Figure 1 The beneficial effects achieved by the illustrated embodiment of the semi-supervised encrypted traffic identification method based on path signature are also the same.

[0167] It should be noted that the information interaction and execution process between the above systems are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0168] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0169] Reference Figure 4 The present invention also provides a computer device 4, including: a memory 402 and a processor 401, and a computer program 403 stored on the memory 402. When the computer program 403 is executed on the processor 401, it implements the semi-supervised encrypted traffic identification method based on path signature as described in any of the above methods.

[0170] The computer device 4 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device 4 may include, but is not limited to, a processor 401 and a memory 402. Those skilled in the art will understand that... Figure 4The computer device 4 is merely an example and does not constitute a limitation on the computer device 4. It may include more or fewer components than shown, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0171] The processor 401 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0172] In some embodiments, the memory 402 may be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 402 may be an external storage device of the computer device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 4. Furthermore, the memory 402 may include both internal and external storage units of the computer device 4. The memory 402 is used to store the operating system, applications, boot loader, data, and other programs, such as the program code of the computer program. The memory 402 can also be used to temporarily store data that has been output or will be output.

[0173] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the semi-supervised encrypted traffic identification method based on path signature as described in any of the above methods.

[0174] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0175] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0176] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0177] In the embodiments disclosed in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0178] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. A semi-supervised encrypted traffic identification method based on path signature, characterized in that, The method specifically includes: Parse raw network traffic data to extract packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path; Gaussian perturbation and / or packet loss simulation are applied to the one-dimensional traffic path to simulate the real network environment, thereby obtaining an enhanced one-dimensional traffic path. The enhanced one-dimensional traffic path is decomposed into client-side and server-side sub-paths, and the cumulative feature dimension and time monotonic dimension are introduced to map it into a multi-dimensional traffic path. Rough path theory is used to calculate truncated path signatures for multidimensional traffic paths, transforming the traffic paths into fixed-length path signature feature vectors. A complementary generative adversarial network model containing a complementary generator and a discriminator is established. The model is trained using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and the discriminator. After training, the discriminator is used to classify and identify the target encrypted traffic; The method of using rough path theory to perform truncated path signature calculation on multidimensional traffic paths, transforming the traffic paths into fixed-length path signature feature vectors, specifically includes: Obtain the integral interval corresponding to the multi-dimensional traffic path; Based on rough path theory, iterative integral calculations are performed on each dimension of the multidimensional flow path within the integral interval to generate k-order signature items from first order to a preset order k. The constant 1 is used as the 0th order signature item, and it is combined with the first to kth order signature items in order of order to form a signature item sequence containing all signature items; The signature sequence is output as a fixed-length path signature feature vector, which serves as a feature vector characterizing the robust statistical features of the traffic path.

2. The method according to claim 1, characterized in that, The process of parsing raw network traffic data and extracting packet lengths and uplink / downlink attributes to construct a signed one-dimensional traffic path specifically includes: Establish a connection between the client and the server, and interact by sending requests and transferring resources based on the connection between the client and the server; Based on the uplink and downlink messages that are transmitted alternately during the interaction, a message sequence with protocol characteristics is formed; Model the network traffic behavior in the message sequence, collect the length information of each data packet, and generate the original sequence; A one-dimensional traffic path is constructed by taking packets whose packet length values ​​in the original sequence are negative as uplink packets sent by the client and packets whose packet length values ​​in the original sequence are positive as downlink packets sent by the client.

3. The method according to claim 1, characterized in that, The process of applying Gaussian perturbation and / or packet loss simulation to the one-dimensional traffic path to simulate a real network environment and obtain an enhanced one-dimensional traffic path specifically includes: Based on a one-dimensional traffic path, obtain the length value and corresponding direction sign of each data packet; Keeping the direction sign unchanged, add independently sampled Gaussian noise terms to the absolute value of the length of each data packet to form the perturbed path; Randomly determine the starting position and window size on the one-dimensional traffic path, remove the length value of the corresponding data packet in the current window, shift the subsequent data forward, and pad the end of the data packet length sequence of the one-dimensional traffic path with zeros to form a path after simulated packet loss.

4. The method according to claim 1, characterized in that, The enhanced one-dimensional traffic path is decomposed into client-side and server-side sub-paths, and cumulative feature dimensions and time monotonicity dimensions are introduced to map it into a multi-dimensional traffic path, specifically including: Based on the enhanced one-dimensional traffic path, the transmission direction is distinguished according to the direction sign corresponding to the length value of each data packet. The length of uplink data packets with negative direction signs is retained, and the length of downlink data packets with positive direction signs is set to zero to generate client-side subpaths; The length of downlink data packets with positive direction signs is retained, and the length of uplink data packets with negative direction signs is set to zero, thus generating a server-side direction subpath; Prefix summation is performed on the client-side and server-side sub-paths respectively to generate the corresponding client-side cumulative feature sub-paths and server-side cumulative feature sub-paths; By introducing a monotonically increasing time coordinate parameter, the client-side directional sub-path, the server-side directional sub-path, the client-side cumulative feature sub-path, the server-side cumulative feature sub-path, and the time coordinate parameter are combined and mapped into a multi-dimensional traffic path.

5. The method according to claim 1, characterized in that, The establishment of the complementary generative adversarial network model, which includes a complementary generator and a discriminator, specifically includes: A complementary generator is configured to map low-dimensional random noise vectors to a high-dimensional feature space to generate pseudo-samples. The complementary generator is structured as a neural network consisting of multiple fully connected layers stacked together, with a batch normalization layer and a Softplus activation function connected after each fully connected layer. Configure a discriminator to perform both real sample classification and generated sample discrimination tasks simultaneously, and set the discriminator's structure to a lightweight multilayer perceptron. A complementary generative adversarial network model is constructed by using an adversarial structure between complementary generators and discriminators.

6. The method according to claim 1, characterized in that, The process of training a complementary generative adversarial network model using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and discriminator specifically includes: By receiving a random noise vector through a complementary generator, generated samples are produced that are distributed in low-density regions among real clusters. The labeled samples from the labeled sample set, the unlabeled samples from the unlabeled sample set, and the generated samples are all input into the discriminator. Set the loss function for the complementary generator, which includes an entropy regularization term, a quality constraint term, and a feature matching term; Set the loss function of the discriminator, which includes a supervised learning term, a realism discrimination term, a generated sample detection term, and an unlabeled data utilization term; The parameters of the complementary generator are fixed, and the parameters of the discriminator are updated based on the discriminator's loss function. With the parameters of the discriminator fixed, the parameters of the complementary generator are updated based on the loss function of the complementary generator. The parameters of the complementary generator and discriminator are repeatedly and alternately optimized until the preset model convergence condition is met, thus completing the training of the complementary generative adversarial network model.

7. The method according to claim 6, characterized in that, The loss function of the complementary generator is a weighted sum of the entropy regularization term, the quality constraint term, and the feature matching term; The entropy regularization term is used to maximize the uncertainty of the generated samples by calculating the negative entropy of the complementary generator output distribution, so as to encourage the generated samples to cover the low-density regions between real clusters. The quality constraint term is used to calculate the discriminator's judgment probability of the generated sample and to filter high-confidence samples based on a preset confidence threshold, so as to ensure the quality of the generated sample and guide the generation process to move closer to the high-density real area recognized by the discriminator. The feature matching term is used to constrain the statistical properties of the generated samples to approximate the distribution of the real unlabeled data by calculating the norm distance between the distribution difference between the generated samples and the real samples from the unlabeled sample set in the feature space.

8. The method according to claim 6, characterized in that, The loss function of the discriminator is a weighted sum of the supervised learning term, the authenticity discrimination term, the generated sample detection term, and the unlabeled data utilization term; The supervised learning term is used to optimize the classification accuracy of the discriminator for labeled samples by calculating the expected log probability of the discriminator correctly classifying labeled samples, using the form of cross-entropy loss. The authenticity discrimination term is used to enhance the discriminator's ability to identify the distribution of real unlabeled samples by calculating the log expectation of the total probability that the unlabeled sample belongs to the top K real categories. The generated sample detection term is used to improve the discriminator's ability to identify generated samples by calculating the expected log probability of the generated sample being identified as the K+1th fake category by the discriminator. The unlabeled data utilization term is used to calculate the negative expectation of the predictive probability entropy of the unlabeled sample in each true category by the discriminator, and to introduce a balanced weight parameter to minimize the uncertainty of the unlabeled sample prediction.

9. A semi-supervised encrypted traffic identification system based on path signature, characterized in that, The system specifically includes: The path construction module is used to parse raw network traffic data, extract packet length and uplink / downlink attributes to construct a signed one-dimensional traffic path; The path enhancement module is used to apply Gaussian perturbation and / or packet loss simulation to a one-dimensional traffic path to simulate a real network environment and obtain an enhanced one-dimensional traffic path. The path dimension enhancement module is used to decompose the enhanced one-dimensional traffic path into client-side sub-paths and server-side sub-paths, and introduce cumulative feature dimension and time monotonic dimension to map it into a multi-dimensional traffic path. The signature feature extraction module is used to perform truncated path signature calculation on multidimensional traffic paths using coarse path theory, and to transform the traffic paths into fixed-length path signature feature vectors. The semi-supervised training module is used to build a complementary generative adversarial network model that includes a complementary generator and a discriminator. The complementary generative adversarial network model is trained using a large amount of unlabeled data and a very small amount of labeled data by alternately optimizing the loss functions of the generator and the discriminator. The encrypted traffic identification module is used to classify and identify target encrypted traffic using a discriminator after training. The method of using rough path theory to perform truncated path signature calculation on multidimensional traffic paths, transforming the traffic paths into fixed-length path signature feature vectors, specifically includes: Obtain the integral interval corresponding to the multi-dimensional traffic path; Based on rough path theory, iterative integral calculations are performed on each dimension of the multidimensional flow path within the integral interval to generate k-order signature items from first order to a preset order k. The constant 1 is used as the 0th order signature item, and it is combined with the first to kth order signature items in order of order to form a signature item sequence containing all signature items; The signature sequence is output as a fixed-length path signature feature vector, which serves as a feature vector characterizing the robust statistical features of the traffic path.

Images