Robustness semi-supervised encrypted traffic classification method and system

Abstract

The invention discloses a robustness semi-supervised encrypted traffic classification method and system, and the method comprises the steps: constructing a byte-level graph structure based on point mutual information, and carrying out the modeling of a topological relation between bytes in traffic; capturing a local context dependency relationship between bytes by adopting a GNN-based flow graph encoder; an automatic feature selection algorithm based on an NSGA-II evolutionary algorithm is designed, artificial feature engineering is replaced, and a feature matrix with high discriminant power is generated; constructing a multi-scale parallel convolutional neural network module, and extracting data packet level features to obtain rich sequence information; a collaborative training mechanism is designed, interactive optimization of a graph encoder and a CNN module is realized by generating a pseudo tag and screening a high-confidence sample, and the ability of a model to learn from a heterogeneous view is enhanced by adopting a triple loss optimization strategy. According to the method, the byte-level graph structure and the data packet-level features can be effectively fused, so that the problem that the classification performance is limited due to the fact that the data packet-level features are ignored in a traditional method under the conditions that the encrypted traffic data labeling cost is high and labeled data are scarce is solved.

Description

Technical Field

[0001] This invention relates to the fields of software engineering and artificial intelligence, specifically to a robust semi-supervised encrypted traffic classification method and system. Background Technology

[0002] Traffic classification is a crucial task in network security maintenance and management, aiming to categorize different types of network traffic into corresponding classes. Understanding traffic content enables network operators to respond quickly to support various business objectives, improve service quality, and enhance user experience. Driven by security and privacy protection needs, network communication encryption has become an unstoppable trend. While this ensures user privacy and anonymity, it complicates the task of network traffic analysis and classification. Therefore, extracting useful information from complex encrypted traffic data and performing accurate detection and identification presents a significant challenge.

[0003] To address the dual challenges of privacy protection and classification accuracy in encrypted traffic analysis, researchers are continuously exploring more advanced technological solutions. Early identification methods based on business characteristics (such as protocol type and port number) are no longer adequate for today's highly dynamic and encrypted network environment. Traditional machine learning methods (such as SVM and random forests) achieve classification by manually designing statistical features (such as packet length distribution and transmission intervals), but their performance is limited by the generalization ability of feature engineering and they struggle to capture deep patterns in encrypted traffic. In contrast, the end-to-end training mechanism of deep learning can automatically extract multi-level traffic representations, significantly improving classification accuracy while preserving privacy information.

[0004] However, current encrypted traffic classification methods have the following drawbacks: (1) It is difficult to obtain labeled data, which further limits the performance of small sample classification. (2) Existing methods only construct traffic representation from the single perspective of raw byte data and fail to effectively integrate the rich feature information of the packet layer. (3) The training strategy is singular and lacks a cross-perspective collaborative optimization mechanism.

[0005] In summary, although there has been significant progress in encrypted traffic classification methods in recent years, existing schemes still have shortcomings in deep feature extraction and small-sample classification, limiting the improvement of classification performance. Therefore, this invention proposes a robust semi-supervised encrypted traffic classification method and system to address these issues. Summary of the Invention

[0006] The purpose of this invention is to propose a robust semi-supervised encrypted traffic classification method and system that can effectively extract the features of traffic in depth and complete the classification task in an encrypted manner.

[0007] To achieve the above-mentioned technical objectives, the technical solution adopted by the present invention is as follows:

[0008] In a first aspect, this invention discloses a robust semi-supervised encrypted traffic classification method, the method comprising the following steps:

[0009] Construct a byte-level graph structure based on point mutual information to model the topological relationships between bytes in the traffic:

[0010] A GNN-based flow graph encoder is used to capture local contextual dependencies between bytes;

[0011] An automatic feature selection algorithm based on NSGA-II evolutionary algorithm is designed to replace manual feature engineering and generate a feature matrix with high discriminative power.

[0012] A multi-scale parallel convolutional neural network module is constructed to extract data packet-level features to obtain rich temporal information;

[0013] A collaborative training mechanism is designed to achieve interactive optimization between the graph encoder and the CNN module by generating pseudo-labels and filtering high-confidence samples. A triple loss optimization strategy is adopted to enhance the model's ability to learn from heterogeneous views.

[0014] Furthermore, the process of constructing a byte-level graph structure based on point mutual information to model the topological relationships between bytes in the traffic includes the following steps:

[0015] First, extract byte data from a raw string. Then convert it to decimal form. Then extract the header portion of each data packet. The mathematical description is as follows:

[0016]

[0017] To capture the co-occurrence relationships of local contexts in a byte sequence, a sliding window of fixed length w (step size = 1) is first used to traverse the byte sequence, thereby generating a context window set {W1, ..., W...}. n-w+1 If the sequence length n ≤ w, then the entire sequence is treated as a single window.

[0018] For a single byte 'a', count the number of times it appears in all windows #W(a). Simultaneously, traverse each sliding window, enumerate all possible unordered byte pairs, and count the number of times each byte pair (a, b) co-occurs in all windows #W(a, b).

[0019] To quantify the semantic association between bytes, point mutual information (PMI) is introduced as an indicator for edge weight calculation. For any pair of bytes (a, b), the corresponding PMI value is calculated based on the ratio of their co-occurrence probability to their respective edge probabilities. The formula is as follows:

[0020]

[0021] Treat bytes as nodes in the graph, retain all byte pairs with positive PMI weights, and map them to the edge set of the graph.

[0022] Furthermore, the process of capturing local contextual dependencies between bytes using a GNN-based flow graph encoder includes the following steps:

[0023] To encode each flow graph as a feature vector, a flow graph encoder is designed using the stacked GraphSAGE. Formally, the message computation and aggregation of GraphSAGE can be described as follows:

[0024]

[0025] Where |N(v)| is the number of neighbors of node v. These are the parameters of the l-th layer, where CONCAT(·) represents the concatenation operation and σ(·) represents the activation function. Finally, the updated feature vector is processed by batch normalization (BN). Normalize.

[0026] Due to the oversmoothing problem in deep GNN models, we only stack GraphSAGE to 3 layers and concatenate the output feature vectors of each layer to apply to each node v to alleviate this problem.

[0027]

[0028] in This is the final feature vector of node v. Finally, mean pooling is applied to all nodes to obtain the graph feature vector X1:

[0029]

[0030] in This represents element-wise addition. Finally, the node feature vectors of X1 are read to obtain the representation of each flow. Then, X1 is input into an LSTM and L2 normalized to obtain the final representation of each flow.

[0031] X1 = L2Norm(LSTM(X1))

[0032] Furthermore, an automatic feature selection algorithm based on the NSGA-II evolutionary algorithm was designed to replace manual feature engineering. The process of generating a high-discrimination feature matrix includes the following steps:

[0033] After processing, the input features are characterized by high dimensionality, noise, and redundancy. Directly using the complete feature set of encrypted traffic for classification will lead to a decrease in the performance of the classification model. Therefore, the goal of feature selection is to extract the optimal subset from the original feature set. Thus, an automatic feature selection algorithm for encrypted traffic based on NSGA-II is designed, comprising four steps: random initial population generation, fitness evaluation, non-dominated sorting, and population update.

[0034] An initial population P0 is randomly generated, containing N individuals, each representing a possible feature selection scheme. Let each individual in the population be x = [x1, x2, ..., xn]. N ], where x i ∈{0,1} indicates whether feature i is selected. The mathematical expression for initializing the population is:

[0035]

[0036] The population size N is a preset constant, and the feature selection scheme for individuals is initialized by a randomly generated binary vector.

[0037] For each individual in the population, its fitness value on the target needs to be calculated. The optimization objectives in this paper include maximizing classification accuracy and minimizing the number of selected features, corresponding to objective functions f1(x) and f2(x), respectively. Their mathematical definitions are:

[0038] f1(x) = 1 - Accuracy(x)

[0039]

[0040] Where Accuracy(x) represents the classification accuracy after training the downstream classification model based on the features selected by individual x. This represents the number of selected features. By considering each individual x... j ∈P0 calculate (f1(x) j f2(x) j Complete the fitness assessment of the population.

[0041] To determine the best solutions in the population, a non-dominated sort is performed. The solutions in the population are divided into multiple non-dominated levels F1, F2, ..., F3 based on their dominance relationships. k F1 represents the first Pareto front, which includes all solutions not dominated by other solutions.

[0042] The generation of the next generation population involves three operations: selection, crossover, and mutation. The selection operation uses a tournament mechanism, randomly selecting two solutions and comparing their non-dominated levels and crowding distances, prioritizing solutions with lower non-dominated levels (e.g., F1 < F2) and larger crowding distances. Then, the crossover operation is performed. For the two "parent" solutions... and The "offspring" solution is generated using a single-point crossover or uniform crossover strategy. Mutation operations randomly flip certain genes in an individual, introducing randomness to prevent the algorithm from getting trapped in local optima. The mathematical description of mutation operations is:

[0043]

[0044] The algorithm iterates through multiple generations until a stopping condition is met (such as reaching the maximum number of iterations or Pareto front convergence). Finally, it outputs the Pareto front solution set for the entire population.

[0045]

[0046] Based on the single optimal solution selected, the best feature is obtained, and its corresponding eigenvalue is acquired, ultimately resulting in the feature matrix X∈R. n×d Where n represents the number of features, d 为 Feature dimension.

[0047] Furthermore, the process of constructing a multi-scale parallel convolutional neural network module to extract data packet-level features to obtain rich temporal information includes the following steps:

[0048] Observations revealed a clear temporal relationship between the packet-level features of encrypted traffic, indicating that single-scale convolutional kernels in CNNs cannot effectively extract these features. Therefore, as... Figure 2 As shown, a multi-scale parallel CNN is proposed for feature extraction. First, a 1×1 convolutional layer is used to increase the feature dimension. Second, a parallel convolutional block is designed to extract deeper temporal relationships in encrypted traffic statistics. The parallel convolutional block consists of three parallel branches, one of which is the identity mapping of X, which preserves the input. The other two branches consist of a shuffling operation and a 3×3 depth-dilation convolution. Subsequently, the output features XDD from the three parallel branches are summed through residual learning, which is expressed as:

[0049] X DD =X+DDConv 3×3 (X)+DDConv(shuffle(X))

[0050] Where X is the input of the parallel branch, and the subscript 3×3 indicates the kernel size. DDThe module employs a 1×1 DWConv architecture to fully fuse features and introduces residual connections to achieve feature reuse. The output feature X2 of this module can be expressed by the following formula:

[0051] X2 = avgpool(X DD +DWConv 1×1 (X DD ))

[0052] Finally, label prediction is performed using two non-shared parameter classification layers, consisting of a fully connected module and a softmax function:

[0053]

[0054] Furthermore, a collaborative training mechanism is designed to achieve interactive optimization between the graph encoder and the CNN module by generating pseudo-labels and selecting high-confidence samples. The process of enhancing the model's ability to learn from heterogeneous views by adopting a triple loss optimization strategy includes the following steps:

[0055] The goal of co-training is to teach two feature learning modules to infer different forms of input to the same sample from different perspectives and arrive at the same inference. and This represents a batch of labeled and unlabeled samples, where B l and B u These represent the number of labeled and unlabeled samples in a batch, respectively. It is x b The corresponding marker. Then the monitoring loss. It is expressed as follows:

[0056]

[0057] The ultimate supervisory loss is On the other hand, each feature learning module interacts with each other through pseudo-labels for unlabeled samples. Pseudo-labels are generated using a pseudo-labeling method, and then the cross-entropy loss between the predicted values ​​and the pseudo-labels is calculated to obtain the consistency loss. The formula is:

[0058]

[0059] in, Let represent the prediction of the i-th feature learning module, and Let represent the pseudo-label of the (3-i)th feature learning module, where i = 1, 2. The total consistency loss is...

[0060] Furthermore, to increase network diversity and force the two feature learning processes to infer from heterogeneous inputs, a difference loss Li is employed. disTo minimize the cosine similarity between features learned by the two feature learning modules, the difference loss between labeled and unlabeled samples is used. and It can be represented as:

[0061]

[0062] in and as well as and These represent the outputs after feature extraction from labeled and unlabeled samples, respectively. Therefore, the total difference loss is... Finally, combining the three types of losses mentioned above, the total loss can be expressed as:

[0063]

[0064] Secondly, this invention discloses a robust semi-supervised encrypted traffic classification method and system, the system comprising view construction, feature learning and collaborative training;

[0065] The view construction module models the topological relationships between bytes in the traffic based on a byte-level graph structure with point mutual information; it employs a GNN-based traffic graph encoder to capture local contextual dependencies between bytes. The feature learning module designs an automatic feature selection algorithm based on the NSGA-II evolutionary algorithm to replace manual feature engineering and generate a highly discriminative feature matrix; it constructs a multi-scale parallel convolutional neural network module to extract data packet-level features to obtain rich temporal information. The collaborative training module designs a collaborative training mechanism that achieves interactive optimization between the graph encoder and the CNN module by generating pseudo-labels and selecting high-confidence samples, and employs a triple loss optimization strategy to enhance the model's ability to learn from heterogeneous views.

[0066] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0067] The present invention provides a robust semi-supervised encrypted traffic classification method and system, which effectively achieves deep extraction of message features through message preprocessing, view construction, feature learning, and loss function, and improves the performance of encrypted traffic classification in the case of small sample size through a collaborative training method. Attached Figure Description

[0068] Figure 1 A flowchart of a robust semi-supervised encrypted traffic classification method and system;

[0069] Figure 2 This is a schematic diagram of the principle framework;

[0070] Figure 3 This is a graph from a small sample experiment. Detailed Implementation

[0071] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0072] like Figure 1 As shown, this invention discloses a robust semi-supervised encrypted traffic classification method, including view construction, feature learning, and collaborative training. First, this invention constructs a byte-level graph structure based on point mutual information to model the topological relationships between bytes in the traffic; it employs a GNN-based traffic graph encoder to capture local contextual dependencies between bytes; it designs an automatic feature selection algorithm based on the NSGA-II evolutionary algorithm to replace manual feature engineering and generate a highly discriminative feature matrix; it constructs a multi-scale parallel convolutional neural network module to extract packet-level features to obtain rich sequence information; and it designs a collaborative training mechanism to achieve interactive optimization between the graph encoder and the CNN module by generating pseudo-labels and filtering high-confidence samples, employing a triple loss optimization strategy to enhance the model's ability to learn from heterogeneous views.

[0073] like Figure 2 The diagram shown illustrates the system architecture of a robust semi-supervised encrypted traffic classification method according to the present invention, including a traffic preprocessing module, a view construction module, a feature learning module, and a collaborative training module.

[0074] S1, encrypted traffic data preprocessing.

[0075] Network traffic is known to be encoded in pcap format, a standard format widely used for raw data packets. Typically, a single pcap file contains a mix of multiple traffic sessions (i.e., data exchanges between a pair of endpoints).

[0076] After obtaining the captured pcap traffic file, the preprocessing operations can be summarized as follows: Extracting flow data. The SplitCap tool is used to split the packets into flows. A large pcap file is divided into multiple pcap files based on 5-tuples, with each pcap file storing a new flow. These newly generated pcap files containing multiple packets are the samples used in the experiment. Removing packets irrelevant to the classification task. Packets used for service protocols (DNS, ICMP, ARP, etc.), bad TCP packets, TCP handshake packets, retransmission packets, and packets without a payload (i.e., a payload of 0 bytes) need to be removed. For packets without a payload, the corresponding graph cannot be constructed.

[0077] S2, Traffic Byte Graph Construction

[0078] First, extract byte data B′ = {b′1, b′2, b′3, ..., b′} from a raw string. q} and convert it to decimal form. Then extract the header portion of each data packet. The mathematical description is as follows:

[0079]

[0080] To capture the co-occurrence relationships of local contexts in a byte sequence, a sliding window of fixed length w (step size = 1) is first used to traverse the byte sequence, thereby generating a context window set {W1, ..., W...}. n-w+1 If the sequence length n ≤ w, then the entire sequence is treated as a single window.

[0081] For a single byte 'a', count the number of times it appears in all windows #W(a). Simultaneously, traverse each sliding window, enumerate all possible unordered byte pairs, and count the number of times each byte pair (a, b) co-occurs in all windows #W(a, b).

[0082] To quantify the semantic association between bytes, point mutual information (PMI) is introduced as an indicator for edge weight calculation. For any pair of bytes (a, b), the corresponding PMI value is calculated based on the ratio of their co-occurrence probability to their respective edge probabilities. The formula is as follows:

[0083]

[0084] Treat bytes as nodes in the graph, retain all byte pairs with positive PMI weights, and map them to the edge set of the graph.

[0085] S3, Feature matrix generation.

[0086] After processing, the input features are characterized by high dimensionality, noise, and redundancy. Directly using the complete feature set of encrypted traffic for classification will lead to a decrease in the performance of the classification model. Therefore, the goal of feature selection is to extract the optimal subset from the original feature set. Thus, an automatic feature selection algorithm for encrypted traffic based on NSGA-II is designed, comprising four steps: random initial population generation, fitness evaluation, non-dominated sorting, and population update.

[0087] An initial population P0 is randomly generated, containing N individuals, each representing a possible feature selection scheme. Let each individual in the population be x = [x1, x2, ..., xn]. N ], where x i ∈{0,1} indicates whether feature i is selected. The mathematical expression for initializing the population is:

[0088]

[0089] The population size N is a preset constant, and the feature selection scheme for individuals is initialized by a randomly generated binary vector.

[0090] For each individual in the population, its fitness value on the target needs to be calculated. The optimization objectives in this paper include maximizing classification accuracy and minimizing the number of selected features, corresponding to objective functions f1(x) and f2(x), respectively. Their mathematical definitions are:

[0091] f1(x) = 1 - Accuracy(x)

[0092]

[0093] Where Accuracy(x) represents the classification accuracy after training the downstream classification model based on the features selected by individual x. This represents the number of selected features. By considering each individual x... j ∈P0 calculate (f1(x) j f2(x) j Complete the fitness assessment of the population.

[0094] To determine the best solutions in the population, a non-dominated sort is performed. The solutions in the population are divided into multiple non-dominated levels F1, F2, ..., F6 based on their dominance relationships. k F1 represents the first Pareto front, which includes all solutions not dominated by other solutions.

[0095] The generation of the next generation population involves three operations: selection, crossover, and mutation. The selection operation uses a tournament mechanism, randomly selecting two solutions and comparing their non-dominated levels and crowding distances, prioritizing solutions with lower non-dominated levels (e.g., F1 < F2) and larger crowding distances. Then, the crossover operation is performed. For the two "parent" solutions... and The "offspring" solution is generated using a single-point crossover or uniform crossover strategy. Mutation operations randomly flip certain genes in an individual, introducing randomness to prevent the algorithm from getting trapped in local optima. The mathematical description of mutation operations is:

[0096]

[0097] The algorithm iterates through multiple generations until a stopping condition is met (such as reaching the maximum number of iterations or Pareto front convergence). Finally, it outputs the Pareto front solution set for the entire population.

[0098]

[0099] Based on the single optimal solution selected, the best feature is obtained, and its corresponding eigenvalue is acquired, ultimately resulting in the feature matrix X∈R. n×d Where n represents the number of features and d is the feature dimension.

[0100] S4, the flow graph encoder, captures contextual dependencies.

[0101] To encode each flow graph as a feature vector, a flow graph encoder is designed using the stacked GraphSAGE. Formally, the message computation and aggregation of GraphSAGE can be described as follows:

[0102]

[0103] Where |N(v)| is the node v The number of neighbors, These are the parameters of the l-th layer. Due to the oversmoothing problem in deep GNN models, we only stack GraphSAGE to 3 layers and concatenate the output feature vectors of each layer for each node v to alleviate this problem.

[0104]

[0105] in This is the final feature vector of node v. Finally, mean pooling is applied to all nodes to obtain the graph feature vector X1:

[0106]

[0107] in This represents element-wise addition. Finally, the node feature vectors of X1 are read to obtain the representation of each flow. Then, X1 is input into an LSTM and L2 normalized to obtain the final representation of each flow.

[0108] X1 = L2Norm(LSTM(X1))

[0109] S5, Multi-scale Parallel CNN Extraction of Temporal Information

[0110] Observations revealed a clear temporal relationship between packet-level features in encrypted traffic, indicating that single-scale convolutional kernels in CNNs cannot effectively extract these features. Therefore, as... Figure 2 As shown, a multi-scale parallel CNN is proposed for feature extraction. First, a 1×1 convolutional layer is used to increase the feature dimension. Second, a parallel convolutional block is designed to extract deeper temporal relationships in encrypted traffic statistics. The parallel convolutional block consists of three parallel branches, one of which is the identity mapping of X, preserving the input. The other two branches consist of a shuffling operation and a 3×3 depth-dilation convolution. Subsequently, the output features XDD from the three parallel branches are summed through residual learning, which is represented as...

[0111] X DD =X+DDConv 3×3 (X)+DDConv(shuffle(X))

[0112] Where X is the input of the parallel branch, and the subscript 3×3 indicates the kernel size. DD The module employs a 1×1 DWConv architecture to fully fuse features and introduces residual connections to achieve feature reuse. The output feature X2 of this module can be expressed by the following formula:

[0113] X2 = avgpool(X DD +DWConv 1×1 (X DD ))

[0114] Finally, label prediction is performed using two non-shared parameter classification layers, consisting of a fully connected module and a softmax function:

[0115]

[0116] S6, Loss Function

[0117] The goal of co-training is to teach two feature learning modules to infer different forms of input to the same sample from different perspectives and arrive at the same inference. and This represents a batch of labeled and unlabeled samples, where B l and B u These represent the number of labeled and unlabeled samples in a batch, respectively. It is x b The corresponding marker. Then the monitoring loss. It is expressed as follows:

[0118]

[0119] The ultimate supervisory loss is On the other hand, each feature learning module interacts with each other through pseudo-labels for unlabeled samples. Pseudo-labels are generated using a pseudo-labeling method, and then the cross-entropy loss between the predicted values ​​and the pseudo-labels is calculated to obtain the consistency loss. The formula is:

[0120]

[0121] in, Let represent the prediction of the i-th feature learning module, and Let represent the pseudo-label of the (3-i)th feature learning module, where i = 1, 2. The total consistency loss is...

[0122] Furthermore, to increase network diversity and force the two feature learning processes to infer from heterogeneous inputs, a difference loss Li is employed. disTo minimize the cosine similarity between features learned by the two feature learning modules, the difference loss between labeled and unlabeled samples is used. and It can be represented as:

[0123]

[0124] in and as well as and These represent the outputs after feature extraction from labeled and unlabeled samples, respectively. Therefore, the total difference loss is... Finally, combining the three types of losses mentioned above, the total loss can be expressed as:

[0125]

[0126] At this point, the training and optimization process of this invention has been completed. The model of this invention was implemented using the PyTorch framework on a server equipped with an NVIDIA RTX 3050 GPU. To evaluate this invention, four different datasets were downloaded, including ISCX-VPN, ISCX-TOR, USTC-TFC2016, and CICIoT2022. Comparisons were made with several benchmark methods, including ET-BERT, PEAN, Flow Pic, GraphDApp, and TFE-GNN.

[0127] (1) Performance comparison experiment. The comparison results on the four datasets are shown in Table 1. Based on Table 1, the following conclusions can be drawn: On the four public datasets, compared with several baselines, the method achieves the best performance on most datasets, further proving the effectiveness of the method.

[0128] Table 1: Experimental Results of Encrypted Traffic Classification Performance Comparison

[0129]

[0130] (2) Small-sample experiments. To verify the robustness of the model in several scenarios, the proportion of labeled data was set to 20%, 50%, and 100%, and the results were compared with baselines and state-of-the-art methods using supervised learning on four datasets, using F1 as the metric. Experimental results are as follows: Figure 3 As shown in the figure. Experiments show that this model outperforms other supervised methods when dealing with small sample sizes. By employing heterogeneous inputs, multi-perspective complementarity, pseudo-label cross-validation, and consistency regularization, unlabeled data is transformed into implicit supervised samples, thereby significantly reducing the need for labeled samples.

[0131] In summary, this invention proposes a novel robust semi-supervised encrypted traffic classification method. First, it utilizes PMI to construct a byte-level traffic graph representation. Simultaneously, it employs the NSGA-II evolutionary algorithm to automatically optimize and select packet-level features, effectively overcoming the limitations of traditional manual feature engineering. For feature extraction, a GNN-based graph encoder captures the topological features of data packets, combined with a multi-scale parallel CNN network to extract temporal pattern features, fully leveraging the complementary advantages of different perspectives. To further improve model performance, a triple optimization objective is designed, incorporating supervised loss, cross-consistency loss, and dissimilarity loss. Comparative experiments on multiple standard datasets validate the correctness of the proposed method.

[0132] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0133] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0134] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0135] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0136] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A robust semi-supervised encrypted traffic classification method, characterized in that, The method includes the following steps: Construct a byte-level graph structure based on point mutual information to model the topological relationships between bytes in the traffic; A GNN-based flow graph encoder is used to capture local contextual dependencies between bytes; An automatic feature selection algorithm based on NSGA-II evolutionary algorithm is designed to replace manual feature engineering and generate a feature matrix with high discriminative power. A multi-scale parallel convolutional neural network module is constructed to extract data packet-level features to obtain rich temporal information; A collaborative training mechanism is designed to achieve interactive optimization between the graph encoder and the CNN module by generating pseudo-labels and filtering high-confidence samples. A triple loss optimization strategy is adopted to enhance the model's ability to learn from heterogeneous views.

2. The robust semi-supervised encrypted traffic classification method according to claim 1, characterized in that, The process of constructing a byte-level graph structure based on point mutual information to model the topological relationships between bytes in traffic includes the following steps: First, extract byte data from a raw string. Then convert it to decimal form. Then extract the header portion of each data packet. The mathematical description is as follows: To capture the co-occurrence relationships of local contexts in a byte sequence, a sliding window of fixed length w (step size = 1) is first used to traverse the byte sequence, thereby generating a context window set {W1, ..., W...}. n-w+1 If the sequence length n ≤ w, then the entire sequence is treated as a single window. For a single byte 'a', count the number of times it appears in all windows, #W(a). Simultaneously, iterate through each sliding window, enumerating all possible unordered byte pairs, and count the number of times each pair of bytes co-occurs in all windows, #W(a, b). To quantify the semantic association between bytes, point mutual information (PMI) is introduced as an indicator for edge weight calculation. For any pair of bytes (a, b), calculate the corresponding PMI value based on the ratio of their co-occurrence probability to their respective edge probabilities. The formula is as follows: Treat bytes as nodes in the graph, retain all byte pairs with positive PMI weights, and map them to the edge set of the graph.

3. The robust semi-supervised encrypted traffic classification method according to claim 1, characterized in that, The process of capturing local contextual dependencies between bytes using a GNN-based flow graph encoder includes the following steps: To encode each flow graph as a feature vector, a flow graph encoder is designed using the stacked GraphSAGE. Formally, the message computation and aggregation of GraphSAGE can be described as follows: Where |N(v)| is the number of neighbors of node v. These are the parameters of the l-th layer. Due to the oversmoothing problem in deep GNN models, we only stack GraphSAGE to 3 layers and concatenate the output feature vectors of each layer for each node v to alleviate this problem. in This is the final feature vector of node v. Finally, mean pooling is applied to all nodes to obtain the graph feature vector X1: in This represents element-wise addition. Finally, the node feature vectors of X1 are read to obtain the representation of each flow. Then, X1 is input into an LSTM and L2 normalized to obtain the final representation of each flow. X1 = L2 Norm(LSTM(X1)) 4. The robust semi-supervised encrypted traffic classification method according to claim 1, characterized in that, An automatic feature selection algorithm based on the NSGA-II evolutionary algorithm is designed to replace manual feature engineering. The process of generating a high-discrimination feature matrix includes the following steps: After processing, the input features are characterized by high dimensionality, noise, and redundancy. Directly using the complete feature set of encrypted traffic for classification leads to a decrease in the performance of the classification model. Therefore, the goal of feature selection is to extract the optimal subset from the original feature set, ensuring the classification performance of the model while reducing the number of features, thereby achieving accurate identification of encrypted traffic categories. Therefore, an automatic feature selection algorithm for encrypted traffic based on NSGA-II is designed, comprising four steps: random initial population generation, fitness evaluation, non-dominated sorting, and population update. An initial population P0 is randomly generated, containing N individuals, each representing a possible feature selection scheme. Let each individual in the population be x = [x1, x2, ..., xn]. N ], where x i ∈{0,1} indicates whether feature i is selected. The mathematical expression for initializing the population is: The population size N is a preset constant, and the feature selection scheme for individuals is initialized by a randomly generated binary vector. For each individual in the population, its fitness value on the target needs to be calculated. The optimization objectives in this paper include maximizing classification accuracy and minimizing the number of selected features, corresponding to objective functions f1(x) and f2(x), respectively. Their mathematical definitions are: f1(x) = 1 - Accuracy(x) Where Accuracy(x) represents the classification accuracy after training the downstream classification model based on the features selected by individual x. This represents the number of selected features. By considering each individual x... j ∈P0 calculate (f1(x) j f2(x) j Complete the fitness assessment of the population. To determine the best solutions in the population, a non-dominated sort is performed. The solutions in the population are divided into multiple non-dominated levels F1, F2, ..., F3 based on their dominance relationships. k F1 represents the first Pareto front, which includes all solutions not dominated by other solutions. The generation of the next generation population involves three operations: selection, crossover, and mutation. The selection operation uses a tournament mechanism, randomly selecting two solutions and comparing their non-dominated levels and crowding distances, prioritizing solutions with lower non-dominated levels (e.g., F1 < F2) and larger crowding distances. Then, the crossover operation is performed. For the two "parent" solutions... and Use single-point crossover or uniform crossover strategies to generate "offspring" solutions. Mutation operations randomly flip certain genes in an individual, introducing randomness to prevent the algorithm from getting trapped in local optima. The mathematical description of mutation operations is: The algorithm iterates through multiple generations until a stopping condition is met (such as reaching the maximum number of iterations or Pareto front convergence). Finally, it outputs the Pareto front solution set for the entire population. Based on the single optimal solution selected, the best feature is obtained, and its corresponding eigenvalue is acquired, ultimately resulting in the feature matrix X∈R. n×d Where n represents the number of features and d is the feature dimension.

5. The robust semi-supervised encrypted traffic classification method according to claim 1, characterized in that, The process of constructing a multi-scale parallel convolutional neural network module to extract data packet-level features to obtain rich temporal information includes the following steps: A multi-scale parallel CNN is proposed for feature extraction. First, 1×1 convolutional layers are used to increase the feature dimension. Second, a parallel convolutional block is designed to extract deeper temporal relationships in encrypted traffic statistics. The parallel convolutional block consists of three parallel branches, one of which is the identity mapping of X, preserving the input. The other two branches consist of a shuffling operation and two 3×3 depth-dilated convolutions. Subsequently, the output features XDD from the three parallel branches are summed through residual learning, which is expressed as: X DD =X+DDConv 3×3 (X)+DDConv(shuffle(X)) Where X is the input of the parallel branch, and the subscript 3×3 indicates the kernel size. DD The above uses 1×1DWConv to fully integrate features and introduces residual connections to achieve feature reuse.

6. The robust semi-supervised encrypted traffic classification method according to claim 5, characterized in that, The process of enhancing network representation by rapidly capturing multi-scale features through parallel convolutions includes the following steps: Shuffling the feature channels promotes information exchange between different feature channels and enhances generalization ability, thus avoiding overfitting to a specific flow. Quantity mode. The output characteristic X2 of this module can be expressed by the following formula: X2=avgpool(X DD +DWConv 1×I (X DD )) Finally, label prediction is performed using two non-shared parameter classification layers, consisting of a fully connected module and a softmax function:

7. A robust semi-supervised encrypted traffic classification method according to claim 6, characterized in that, The design of a collaborative training mechanism, which achieves interactive optimization between the graph encoder and the CNN module by generating pseudo-labels and selecting high-confidence samples, and employs a triple loss optimization strategy to enhance the model's ability to learn from heterogeneous views, includes the following steps: The goal of co-training is to teach two feature learning modules to infer different forms of input to the same sample from different perspectives and arrive at the same inference. and This represents a batch of labeled and unlabeled samples, where B l and B u These represent the number of labeled and unlabeled samples in a batch, respectively. It is x b The corresponding marker. Then the monitoring loss. It is expressed as follows: The ultimate supervisory loss is On the other hand, each feature learning module interacts with each other through pseudo-labels for unlabeled samples. Pseudo-labels are generated using a pseudo-labeling method, and then the cross-entropy loss between the predicted values ​​and the pseudo-labels is calculated to obtain the consistency loss. Its formula is in, Let represent the prediction of the i-th feature learning module, and Let represent the pseudo-label of the (3-i)th feature learning module, where i = 1, 2. The total consistency loss is... Furthermore, to increase network diversity and force the two feature learning processes to infer from heterogeneous inputs, a difference loss Li is employed. dis To minimize the cosine similarity between features learned by the two feature learning modules, the difference loss between labeled and unlabeled samples is used. and It can be represented as: in and as well as and These represent the outputs after feature extraction from labeled and unlabeled samples, respectively. Therefore, the total difference loss is... Finally, combining the three types of losses mentioned above, the total loss can be expressed as:

8. A robust semi-supervised encrypted traffic classification method according to claims 1-6, characterized in that, The system includes a traffic preprocessing module, a view construction module, a feature learning module, and a collaborative training module. The traffic preprocessing module removes data packets related to service protocols, invalid packets, and packets without payload to construct samples suitable for classification tasks. The view construction module models the topological relationships between bytes in the traffic based on a byte-level graph structure with point mutual information; it employs a GNN-based traffic graph encoder to capture local contextual dependencies between bytes. The feature learning module designs an automatic feature selection algorithm based on the NSGA-II evolutionary algorithm to replace manual feature engineering and generate a high-discrimination feature matrix; it constructs a multi-scale parallel convolutional neural network module to extract data packet-level features to obtain rich temporal information. The collaborative training module designs a collaborative training mechanism that achieves interactive optimization between the graph encoder and the CNN module by generating pseudo-labels and selecting high-confidence samples, and employs a triple-loss optimization strategy to enhance the model's ability to learn from heterogeneous views.

9. A computer-readable storage medium for storing a computer program, characterized in that, The computer program causes the computer to execute a robust semi-supervised encrypted traffic classification method as described in any one of claims 1-7.

Images