Encrypted malicious traffic detection method based on uncertainty perception multi-view learning

Abstract

The invention relates to the technical field of network security, in particular to an encrypted malicious traffic detection method based on uncertainty perception multi-view learning, and aims to effectively identify malicious behaviors in an encrypted network by introducing a graph neural network, long-range information propagation, semantic-based structure enhancement, view interaction, uncertainty quantization and other mechanisms. The encrypted traffic is constructed into a host interaction graph, and semantic embedding of nodes is obtained through diffusion type long-range propagation; then, post-propagation structure completion is carried out by using cosine similarity, and a repaired topology is generated; mapping each view into Dirichlet distribution by adopting evidence deep learning, and calculating belief quality and uncertainty of each view; through the improved Dempster-Shafer combination rule, uncertainty perception fusion is carried out on all views, malicious traffic prediction and credibility are output, detection precision and robustness are improved, and the method is used for scenes of network security monitoring, malicious software detection, industrial control system protection and the like.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for detecting encrypted malicious traffic based on uncertainty-aware multi-view learning. Background Technology

[0002] With the widespread application of network encryption protocols, network communication security has been significantly improved, but this has also brought enormous challenges to malicious traffic detection. While encryption protocols protect user privacy and data security, they also provide network attackers with avenues for covert malicious activities, rendering traditional detection methods based on plaintext payload analysis ineffective. This shift in the security landscape makes Encrypted Malicious Traffic Detection (EMTD) a critical issue in modern network security.

[0003] Deep learning techniques, especially graph-based methods, have demonstrated powerful capabilities in detecting encrypted malicious traffic. Graph Neural Networks (GNNs) can effectively utilize the structural relationships in encrypted communication, significantly improving detection accuracy. However, the success of GNNs in detecting encrypted malicious traffic largely depends on the integrity and reliability of the input graph data. In real-world encrypted network traffic scenarios, this assumption is often difficult to meet. The gap between the ideal complete data and the actual operating environment gives rise to what this technical solution calls the Weak Information problem.

[0004] The problem of weak information stems from three interconnected challenges: at the structural level, network-level disruptions (such as packet loss) lead to connection fragmentation, while identity confusion caused by Network Address Translation (NAT) and Virtual Private Networks (VPNs) results in broken graph topologies; at the semantic level, protocol-level ambiguity (such as port sharing and traffic multiplexing) dilutes the semantics of flows, leading to inconsistent node characteristics; and at the practical level, the high cost and complexity of expert annotation of cryptographic threats result in scarce labeled data. These real-world factors collectively produce ambiguous host interactions and diluted semantic features, manifested as broken graph structures, incomplete node features, and limited labeled data, thereby weakening the reliability of detection models.

[0005] This pervasive information sparsity severely impairs the ability of GNNs to perform effective message propagation and representation learning, ultimately weakening detection performance. While existing methods have introduced feature generation and edge completion techniques to address information scarcity, several fundamental limitations remain. First, existing feature generation methods attempt to reconstruct incomplete node features by utilizing available feature information and neighborhood structure. To mitigate the infamous oversmoothing effect, these techniques primarily employ short-range propagation mechanisms, failing to capture crucial long-range dependencies. When shorter edges are missing, current models struggle to facilitate effective information exchange between nodes, leading to suboptimal feature generation. Second, current edge completion methods employ a pre-propagation paradigm, where edge enhancement precedes message passing. In scenarios with incomplete node features, this reliance on partial feature information often results in erroneous edge generation or failure to identify legitimate connections. Furthermore, existing methods typically address aspects of information scarcity in isolation, ignoring the interdependent nature of feature and structural incompleteness that coexists in real-world scenarios.

[0006] In summary, current methods for detecting encrypted malicious traffic suffer from limitations in information dissemination, inaccurate graph structure reconstruction, lack of a unified framework for handling multi-dimensional information sparsity, and lack of uncertainty quantification mechanisms. These issues result in insufficient performance when dealing with weak information scenarios and significant deficiencies in assessing the credibility of detection results. Summary of the Invention

[0007] The purpose of this invention is to address the shortcomings of existing encrypted malicious traffic detection methods, such as insufficient weak information processing capabilities, lack of uncertainty quantification, and imperfect view fusion strategies. It proposes an innovative encrypted malicious traffic detection method based on uncertainty-aware multi-view fusion. By introducing a long-distance propagation mechanism, enhanced post-propagation structure, and an uncertainty-aware view fusion strategy, this method can effectively identify malicious behavior in encrypted network traffic, improving the accuracy and reliability of detection.

[0008] This invention is achieved through the following technical solution: a method for detecting encrypted malicious traffic based on uncertainty-aware multi-view learning, comprising the following steps: S1. Construct the initial network flow graph: Abstract the hosts in the network as nodes, and the network flows between hosts as edges, and construct the initial adjacency matrix; extract the network flow statistical features of the hosts and construct the initial feature matrix; S2. Constructing a long-distance propagation view: Based on the initial feature matrix and the initial adjacency matrix, multiple iterations are performed through a diffusion propagation mechanism that introduces a restart term to obtain long-distance node representations containing long-distance semantic information, thus forming a long-distance propagation view; S3. Constructing an enhanced structural view: Based on the long-distance node representation obtained in step S2, calculate the semantic similarity between nodes, and add new edges to node pairs that meet the conditions according to the adaptive threshold strategy to generate an enhanced adjacency matrix and form an enhanced structural view. S4. Constructing the interactive view: Perform a diffusion propagation on the enhanced adjacency matrix obtained in step S3 to obtain intermediate features, and then concatenate them with the long-distance node representation to form the interactive view. S5. Uncertainty Quantification and View Opinion Generation: Construct evidence networks for the long-distance propagation view, the structure-enhanced view, and the view interaction view respectively; For each view, process the corresponding node representation through its evidence network and output the evidence vector; Parameterize the Dirichlet distribution based on the evidence vector, and calculate the belief quality of each category and the overall uncertainty quality under the view to form the subjective opinion of the view; S6. Uncertainty-perceived view fusion: Based on the Dempster-Shafer combination rule, the subjective opinions of the three views obtained in step S5 are fused to obtain the belief quality and uncertainty quality of the fused view. S7. Training and Malicious Traffic Detection: Construct a multi-task loss function, which includes at least the loss terms corresponding to the long-distance propagation view, the structure-enhanced view, the view interaction view, and the fused view; train the model using labeled data by optimizing the multi-task loss function; for traffic to be detected, calculate the anomaly score or prediction probability of the node based on the belief quality and uncertainty quality of the fused view obtained in step S6, and identify malicious traffic based on the anomaly score or prediction probability.

[0009] Furthermore, in step S2, the formula for the diffusion and propagation mechanism of the introduced restart term is: , in It is the initial embedding after random projection. The adjacency matrix is ​​row-normalized. For the probability of restarting, The feature matrix is ​​obtained through multiple iterations to determine the propagation steps. .

[0010] Furthermore, in step S2, an enhanced adjacency matrix is ​​constructed using cosine similarity and an adaptive threshold. Step S2 includes the following sub-steps: S21. Compute node pairs Cosine similarity: ; S22. Determine the similarity threshold based on the size of a node's neighbors, and denote it as... For nodes Its first The similarity between the most similar neighbors, among which If satisfied Then it is a node pair Add edges to the enhanced adjacency matrix; S23. Construct an enhanced adjacency matrix Its definition is: , in This represents the value of the original adjacency matrix.

[0011] Furthermore, step S5 includes the following sub-steps: S51. Train the evidence network for each view and output the evidence vector. And define the Dirichlet parameter. , for the The class's belief quality and overall uncertainty quality are calculated as follows: , S52. Construct the loss function for the view, and jointly optimize the evidence network using cross-entropy and Kullback–Leibler divergence: , in For the Digamma function, Replace the parameter corresponding to the real label with 1. For trade-off constants; S53. The Dempster-Shafer combination rule integrates the subjective opinions of the different views mentioned above, if any two of the views respectively have belief and uncertainty. and The resulting beliefs and uncertainties are: , The resulting fusion perspective It reflects the evidentiary information from different views while also preserving uncertainty.

[0012] Further, in step S5, The loss terms from the long-distance view, structural view, interactive view, and fused view are combined to form the overall training objective: , Gradient descent is used to optimize model parameters. After training, the quality of beliefs in the fused viewpoints is considered. and uncertain mass Define anomaly score: , in and Using the weighted coefficients, abnormal nodes or malicious traffic can be identified by sorting the abnormal scores in descending order.

[0013] Furthermore, the fusion based on the Dempster-Shafer combination rule specifically involves: for any two view opinions to be fused, the quality of belief and the quality of uncertainty after fusion are calculated by the combination rule, which explicitly handles conflicting evidence between views.

[0014] The beneficial effects of this invention are as follows: 1. By using long-distance propagation view (View-L) to achieve deep information diffusion across the graph, and combining it with a restart term to prevent oversmoothing, it can effectively recover and utilize graph structure information under weak information conditions such as network topology breaks, incomplete features, or scarce labels, and significantly improve the model's adaptability to information loss.

[0015] 2. The Post-Propagation Structure Enhancement View (View-S) adaptively completes missing edges based on semantic similarity, while avoiding the introduction of spurious connections. This enhances the integrity of the graph structure and reduces noise interference, providing a more reliable structural foundation for subsequent detection.

[0016] 3. By quantifying the uncertainty of each view prediction through the evidence learning framework and using the Dempster-Shafer theory to fuse multi-view evidence, it is possible to dynamically identify and reduce the weight of high-conflict or low-confidence views, so that the final detection results have both high accuracy and interpretable confidence assessment.

[0017] 4. Experiments show that even in extremely weak information scenarios with less than 2% training data and label noise as high as 50%, the system can still significantly outperform existing benchmark models. In particular, on real datasets such as TONIoT and DoHBrw, key indicators such as AUC are significantly improved, demonstrating strong generalization and anti-interference capabilities. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the encrypted malicious traffic detection method based on uncertainty-aware multi-view fusion according to the present invention; Figure 2 This is a flowchart of the uncertainty quantification and multi-view fusion process of the present invention, showing how to generate subjective opinions from single-view evidence and obtain a fused view through evidence fusion rules. Detailed Implementation

[0019] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1

[0022] like Figure 1-2 As shown: This invention proposes an encrypted malicious traffic detection method based on uncertainty-aware multi-view fusion, which includes: The Long Distance Propagation View module (View-L) handles the long-distance information propagation process in graph data. Its goal is to achieve comprehensive information flow across the graph through a diffusion mechanism, thereby enabling robust feature reconstruction in scenarios with weak information. By introducing a restart term to prevent over-smoothing, this module can achieve deep information propagation while maintaining node distinctiveness.

[0023] The Post-Propagation Structure Enhancement View Module (View-S) enriches structural information based on enhanced node semantics learned from long-distance propagation views. This module operates within the post-propagation paradigm through semantic similarity analysis, ensuring more reliable edge completion. Unlike traditional pre-propagation methods, this module utilizes enhanced node representations to infer missing connections, thereby reducing the generation of erroneous edges.

[0024] The View Interaction Module (View-P) is used to model the dynamic interaction between feature enhancement and structural refinement. This module is a lightweight pseudo-view that captures the synergy between views by modeling how enhanced edges in View-S influence information propagation patterns in View-L.

[0025] The Uncertainty Quantification module quantifies the uncertainty of each view's prediction. Based on an evidence-based learning framework, this module conceptualizes the output of each view as evidence forming a perceived opinion about the uncertainty of the final prediction. By implementing a parameterized Dirichlet distribution, this module systematically captures the uncertainty associated with each view's prediction.

[0026] The View-F module integrates uncertainties perceived from multiple views to make a final decision. This module employs Dempster-Shafer theory to provide a rigorous mathematical framework for integrating these uncertainties, achieving robust view fusion.

[0027] The aforementioned encrypted malicious traffic detection system based on uncertainty-aware multi-view fusion employs a diffusion-based propagation mechanism in its long-distance propagation view module, which balances long-distance information propagation and node feature preservation by introducing a restart term. The post-propagation structure enhancement view module calculates the semantic similarity between nodes based on cosine similarity and uses an adaptive threshold strategy to determine whether to add edges. The view interaction module captures the interaction between views through a single diffusion propagation iteration and feature stitching; the uncertainty quantification module maps the belief quality of the category and the overall uncertainty to the parameters of the Dirichlet distribution through variational Dirichlet distribution parameterization; and the view fusion module uses a simplified Dempster-Shafer combination rule to fuse the evidence representations of different views.

[0028] Specifically, the following steps are included: S1, Constructing the initial representation of graph data. Network traffic consists of data packets transmitted between host devices. This technical solution focuses on flow-level analysis, where a flow is defined as a sequence of data packets sharing a common 4-tuple identifier (source IP address, destination IP address, source port, destination port). The graph-based encrypted malicious traffic detection method models the network as a graph. ,in It is a set of nodes, each node Represents a unique host identified by its IP address; It is a set of edges, if the host and host If there is a direct network flow between them, then there is an edge. ; It is an adjacency matrix, where Represents a node and There exists an edge, otherwise , Feature matrix, where each row represents the host's Statistical eigenvectors of 3D network flow.

[0029] S2, Constructing the Long-Distance Propagation View (View-L). To achieve sufficient information exchange in scenarios with weak information, this technical solution designs a GNN module with a long-distance propagation mechanism. This module realizes cross-node information propagation through a diffusion mechanism, providing a long-distance view. Deep propagation may blur node identities; therefore, this technical solution uses weights at each step... The restart term is re-injected into the original feature matrix. This anchors each node and prevents over-smoothing. The technical solution employs a diffusion-based propagation mechanism, formulated as follows: , in It is the first The representation after the next propagation step (at initialization) ), It's the restart probability. From The derived row-normalized adjacency matrix. The first term aggregates information from direct neighbors, and the second term preserves discriminative features while stabilizing long-distance flows.

[0030] pass After several propagation iterations, this technical solution obtains the final feature matrix. (Right now It encodes the damaged map. A comprehensive long-distance view. By employing a greater depth of propagation ( =12 20).

[0031] Compute node pairs Cosine similarity: ; The similarity threshold is determined based on the size of a node's neighbors, and is denoted as... For nodes Its first The similarity between the most similar neighbors, among which If satisfied Then it is a node pair Add edges to the enhanced adjacency matrix.

[0032] The method of this technical solution enables nodes to aggregate information beyond their direct neighbors, thereby solving the problem of missing edges in damaged graphs.

[0033] S3, constructing the post-propagation structure enhanced view (View-S). Node connectivity plays a crucial role in encrypted traffic detection, as behavioral patterns during connection establishment and data transmission are key indicators of malicious activity. However, weak information scenarios present significant challenges due to missing connections. Furthermore, isolated nodes in a compromised graph cannot exchange information with other nodes, severely hindering effective information propagation.

[0034] To address this challenge, this technical solution proposes a backpropagation structure enhancement method, which learns the update node semantics from View-L. Constructing an enhanced graph. Utilizing these rich representations instead of incomplete initial features reduces both the chance of missing key edges and the risk of adding spurious edges. Intuitively, this technique connects two nodes when their View-L embeddings are sufficiently similar to indicate true relationships that the original graph might have missed. Therefore, the View-S provides a more reliable structure recovery with minimal noise. Enhanced adjacency matrix. Defined as: , in It is the original adjacency matrix. Function compute nodes and Cosine similarity between nodes. , Is it and The Middle Cosine similarity of the most similar nodes Similarly defined as Threshold Select as ,in and yes and The size of the neighborhood in the original graph.

[0035] S4, Construct the View-Interaction View (View-P). View-S is derived from View-L through structural enhancement; however, this unidirectional information flow ignores the potential impact of the enhanced edges in View-S on the propagation dynamics in View-L. To address this limitation, this technical solution introduces a lightweight pseudo-view (View-P) through a computationally efficient two-step process. First, this technical solution applies a single diffusion-based information propagation iteration to View-S (using the formula in View-L). Then, this technical solution uses the feature matrix of View-L (i.e., This is then concatenated with the resulting feature matrix of the diffused View-S. This design effectively captures the complex interactions between views while minimizing trainable parameters and avoiding problematic recursive dependencies.

[0036] S5, Uncertainty Quantification. After generating multiple views, this technical solution needs to quantify the uncertainty of each view's prediction. This solution introduces an evidence-based framework for uncertainty measurement, which goes beyond predicting a single probability vector. Following subjective logic, this technical solution maps the belief quality of categories and overall uncertainty to a Dirichlet distribution. The parameters allow for explicit modeling of evidence for each category along with its associated confidence level. Specifically, this technical solution will... Modeled as a Dirichlet distribution, with the conjugate prior of the multinomial: , in Denotes the prior parameters of the evidence, for , , Indicates category The accumulated evidence. Based on this formula, the distribution... The probability density function is defined as: , in Indicates all that satisfy and of of( ( ) dimensional unit simplex. This represents a multi-function Beta.

[0037] Intuitively speaking, each Dirichlet parameter It can be seen as... The evidence injection of the unit Each category of bucket, total evidence This parameterization controls how much probability quality is left for uncertainty. It enables the model to capture the belief quality for each category. and overall uncertainty quality Given Dirichlet distributions, they are computed as: , , in It is the number of categories. This is the main evidence.

[0038] Opinion fusion learning. A two-component training paradigm for opinion fusion learning integrates two key mechanisms: (i) evidence amplification to reinforce observed patterns; and (ii) evidence attenuation in response to prediction errors. The first component serves as a data fitting mechanism for the evidence model, while the second introduces priors to suppress false evidence and maintain an appropriate level of uncertainty.

[0039] (i) Maximize model fit. For a given sample ,make This represents the output evidence vector, where This represents the network parameters. The corresponding Dirichlet distribution is... Parameterization. After parameter calculation, the class probability estimate is obtained from the expected value of the Dirichlet distribution, expressed as... ,in This represents the Dirichlet intensity. Let... express The true label. This technical solution uses the cross-entropy loss function to measure the prediction-to-truth difference: , in This represents the Digamma function.

[0040] (ii) Minimizing erroneous evidence. While minimizing the aforementioned loss function optimizes model fitting, this alone is insufficient for effectively handling prediction uncertainty. To address this limitation, this approach introduces a mechanism to penalize incorrect predictions by reducing their relevant evidence. Specifically, when the model misclassifies traffic, this approach eliminates all evidence, as a Dirichlet distribution with zero evidence corresponds to maximum uncertainty (…). This is achieved through the Kullback-Leibler (KL) divergence term in the loss function: , in Indicated as The true label component is replaced with 1. This term is a regularizer for the predicted distribution, penalizing the deviation from the maximum uncertainty.

[0041] Loss function for each view Combining two components: evidence maximization and regularization: , in It is a hyperparameter that controls the trade-off between classification loss and KL divergence. Through this unified objective, the model pursues two complementary goals: maximizing prediction accuracy with sufficient evidence while maintaining an appropriate level of uncertainty.

[0042] S6, Uncertainty-Aware View Fusion. After quantifying the uncertainty of each view, this technical solution employs a simplified Dempster-Shafer (DS) combination rule to fuse different views. This fusion mechanism is designed to be both robust and efficient; it dynamically weights each view according to its uncertainty level, explicitly separating belief from uncertainty to handle inter-view conflicts, while maintaining lower computational complexity than traditional fusion methods.

[0043] For each view, this technical solution derives its evidentiary representation using the uncertainty quantification method detailed in Section S5. View-L View-S and View-P The merging follows the combination rules to generate a merged view (View-F), which is formulated as follows: , The merging of any two views (by...) and The calculation is as follows (represented): , , in View conflicts are quantified by aggregating the product of the quality of beliefs assigned to different categories.

[0044] S7, Training and Malicious Traffic Detection. We implement a multi-task learning framework to optimize the subjective opinion formation for all views. The overall loss function is formulated as follows: , in , , and These represent the loss functions for View-L, View-S, View-P, and View-F, respectively, each calculated according to the loss function formulas described above.

[0045] Based on merged view This technical solution calculates the final prediction probability and uncertainty for each node. For each node... The malicious traffic detection results are obtained through the expected probability of the fused view: , in and From the merged view The derived Dirichlet parameters and total evidence. The anomaly score of a node can be determined by the uncertainty of its prediction. and prediction Rate The calculation is based on a combination of factors.

[0046] , in and Using the weighted coefficients, abnormal nodes or malicious traffic can be identified by sorting the abnormal scores in descending order.

[0047] The terminology is explained as follows: Weak Information: In encrypted network traffic detection, degraded observations due to infrastructure and protocol-level limitations. This includes interruptions in flow continuity due to packet loss in transit and the resulting incomplete or erroneous edge construction; obfuscation of host identities and fragmentation of the underlying communication topology caused by NAT translation, VPN tunneling, and dynamic IP reassignment; inconsistencies in flow semantics introduced by port sharing and traffic multiplexing; and the scarcity of labeled traffic that significantly limits the ability to train reliable classifiers. These conditions collectively create weak information scenarios, hindering effective graph information extraction for encrypted malicious traffic detection.

[0048] Evidential Learning: A framework for quantifying the uncertainty of predictions made by deep learning models. It works by mapping the quality of belief in each category and the overall uncertainty to the parameters of a Dirichlet distribution, allowing evidence for each category to be explicitly modeled along with the associated confidence level. Evidential Learning enables models to capture the quality of belief in each category and the quality of overall uncertainty, thus providing more reliable and interpretable predictions.

[0049] Dirichlet distribution: The conjugate prior of a multinomial distribution, used to model class probability distributions. In evidence learning, the parameters of the Dirichlet distribution... Indicates the strength of evidence for each category, where , It is a category The accumulated evidence. Total evidence. Controlling the probabilistic quality left by uncertainty.

[0050] Dempster-Shafer theory: a mathematical framework for combining beliefs from multiple independent sources of evidence. In this invention, it is used to fuse opinions perceived from different views. The theory addresses inter-view conflicts by explicitly separating beliefs and uncertainties, providing a robust and efficient fusion mechanism.

[0051] Long-Range Propagation: An information propagation mechanism in graph neural networks that enables nodes to aggregate information beyond their immediate neighborhood through multiple iterations (typically 12-20 steps). To prevent oversmoothing, this method re-injects the original node features in each iteration through a restart term, thereby achieving deep information propagation while maintaining node distinctiveness.

[0052] Experimental results 1. Experimental setup 1.1 Dataset To verify the experimental performance of this invention on various datasets, three real-world datasets were used for comprehensive evaluation: TONIoT, an IoT traffic dataset containing 796,380 normal instances and 21,542,641 malicious instances, with 10 attack types and 39 features; DoHBrw, a DNSover HTTPS traffic dataset containing 19,807 normal instances and 354,996 malicious instances, with 28 features; and CICIDS, a network traffic dataset containing 931,873 normal instances and 18,028 malicious instances, with 70 features. The selection of these datasets allows this invention to comprehensively test its performance under various abnormal scenarios and demonstrates its broad applicability in real-world applications.

[0053] 1.2 Measurement Standards To comprehensively evaluate the performance of this invention, the technical solution uses accuracy (ACC), precision (PR), recall (RC), F1 score (F1), and AUC (Area Under the Curve) as evaluation metrics. AUC is a standard metric used to measure model performance in binary classification problems, reflecting the model's detection effectiveness at different classification thresholds. Specifically, AUC is calculated by plotting the ROC curve based on the relationship between the false positive rate (FPR) and the true positive rate (TPR), and then calculating the area under the curve. The AUC value ranges from 0 to 1; a value closer to 1 indicates a stronger anomaly detection capability and a better ability to distinguish between normal and abnormal nodes.

[0054] 1.3 Baseline Model To evaluate the performance of this invention (TrustWI), it was compared with several state-of-the-art models, which can be divided into three groups: a) Traditional GNN models: This group includes basic graph neural network models such as GCN (Graph Convolutional Network), GAT (Graph Attention Network), and PPNP (Personalized PageRank Neural Propagation). These models mainly rely on graph structure information for node classification, but their performance is limited in scenarios with weak information.

[0055] b) Traffic Detection Models: This group includes methods specifically designed for malicious traffic detection, such as Kitsune, ST-Graph, MTSecurity, and ContraMTD. These models not only consider the connectivity between nodes but also utilize node attribute information to detect anomalies.

[0056] c) Weak Information Processing Methods: This group includes several methods specifically designed for handling weak information scenarios, such as Pro-GNN, MI-GNN, and RAPIER. These methods utilize graph neural network models to extract features from graph structures for anomaly detection through unsupervised or semi-supervised learning.

[0057] 2. Experimental Results To verify the effectiveness of this invention (TrustWI), the model in the embodiments was compared with several baseline methods. The table below lists the accuracy (ACC), precision (PR), recall (RC), F1 score, and AUC of each method on three datasets under the same weak information scenario (randomly removing 50% of edges and 50% of features), where the best results are indicated in bold.

[0058] TONIoT dataset results:

[0059] Results from the DoHBrw dataset:

[0060] CICIDS dataset results:

[0061] As shown in the table, the method of this invention achieves optimal or near-optimal overall performance on all three datasets: In weak information scenarios, the method achieves an AUC of 93.72% on the TONIoT dataset; an accuracy of 97.44% and an AUC of 87.75% on the DoHBrw dataset; and an accuracy of 91.64% and an AUC of 97.37% on the CICIDS dataset. These results demonstrate that the method of this invention can maintain strong discriminative ability and stability even when structural breaks and feature loss coexist.

[0062] Furthermore, to verify the robustness of the method of this invention in dealing with various missing information, this embodiment also examines the performance of each model under extremely low annotation ratios. The table below lists the AUC values ​​of each method at different annotation ratios (0.5%, 1.0%, 5.0%) under the condition of randomly deleting 50% of the structure and features. It can be seen that TrustWI still maintains the highest detection performance when labeled samples are extremely scarce.

[0063]

[0064] This result further demonstrates that the present invention still possesses leading robustness and generalization ability in extremely weakly labeled environments. Especially when the labeling rate is only 0.5%, the AUC still reaches 82.35%, significantly outperforming the baseline model. This indicates that the uncertainty-aware multi-view fusion strategy of this embodiment is not only applicable to weak information scenarios but also effectively improves detection accuracy when labeling resources are extremely limited.

[0065] In summary, the experimental results fully verify the effectiveness and superiority of the proposed encryption malicious traffic detection system based on uncertain multi-view learning. It provides an efficient and scalable solution to the problem of weak information in real-world network environments, characterized by structural breaks, missing features, and scarce annotations. This invention not only significantly improves detection performance and surpasses many baseline methods, but more importantly, it maintains robust detection results even with extremely low or no annotations, demonstrating strong practical value and broad application prospects.

[0066] This method, within the framework of graph neural networks, introduces innovative designs such as long-distance propagation view, structure enhancement view, and view interaction view, enabling comprehensive utilization of graph data in weak information scenarios and providing reliable detection results through an uncertainty quantification mechanism.

[0067] In this embodiment, by integrating a multi-view learning mechanism into the encrypted malicious traffic detection task, three complementary views are constructed to recover and enrich signals under weak information: (i) a long-distance propagation view (View-L) that expands the information flow range through a diffusion mechanism; (ii) a post-propagation structure enhancement view (View-S) that repairs broken connections based on enhanced node semantics; and (iii) a view interaction view (View-P) that models the synergistic effects between views. Furthermore, an uncertainty-aware fusion mechanism based on evidence learning is developed to quantify prediction uncertainty at both the view and global levels, generating robust decision-making.

[0068] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. This invention relates to a method for detecting encrypted malicious traffic based on uncertainty-aware multi-view learning, characterized in that, Includes the following steps: S1. Construct the initial network flow graph: Abstract the hosts in the network as nodes, and the network flows between hosts as edges, and construct the initial adjacency matrix; extract the network flow statistical features of the hosts and construct the initial feature matrix; S2. Constructing a long-distance propagation view: Based on the initial feature matrix and the initial adjacency matrix, multiple iterations are performed through a diffusion propagation mechanism that introduces a restart term to obtain long-distance node representations containing long-distance semantic information, thus forming a long-distance propagation view; S3. Constructing an enhanced structural view: Based on the long-distance node representation obtained in step S2, calculate the semantic similarity between nodes, and add new edges to node pairs that meet the conditions according to the adaptive threshold strategy to generate an enhanced adjacency matrix and form an enhanced structural view. S4. Constructing the interactive view: Perform a diffusion propagation on the enhanced adjacency matrix obtained in step S3 to obtain intermediate features, and then concatenate them with the long-distance node representation to form the interactive view. S5. Uncertainty Quantification and View Opinion Generation: Construct evidence networks for the long-distance propagation view, the structure-enhanced view, and the view interaction view, respectively; For each view, the corresponding node representation is processed through its evidence network to output an evidence vector; Based on the evidence vector parameterized Dirichlet distribution, the belief quality of each category and the overall uncertainty quality under this view are calculated to form the subjective opinion of this view; S6. Uncertainty-perceived view fusion: Based on the Dempster-Shafer combination rule, the subjective opinions of the three views obtained in step S5 are fused to obtain the belief quality and uncertainty quality of the fused view. S7. Training and Malicious Traffic Detection: Construct a multi-task loss function, which includes at least the loss terms corresponding to the long-distance propagation view, the structure enhancement view, the view interaction view, and the fusion view. Using labeled data, the model is trained by optimizing the multi-task loss function; for traffic to be detected, the anomaly score or prediction probability of the node is calculated based on the belief quality and uncertainty quality of the fused view obtained in step S6, and malicious traffic is identified based on the anomaly score or prediction probability.

2. The encrypted malicious traffic detection method based on uncertainty-aware multi-view learning according to claim 1, characterized in that, In step S2, the formula for the diffusion and propagation mechanism of the introduced restart term is: ， in It is the initial embedding after random projection. The adjacency matrix is ​​row-normalized. For the probability of restarting, The feature matrix is ​​obtained through multiple iterations to determine the propagation steps. .

3. The encrypted malicious traffic detection method based on uncertainty-aware multi-view learning according to claim 1, characterized in that, In step S2, an enhanced adjacency matrix is ​​constructed using cosine similarity and an adaptive threshold. Step S2 includes the following sub-steps: S21. Compute node pairs Cosine similarity: ; S22. Determine the similarity threshold based on the size of a node's neighbors, and denote it as... For nodes Its first The similarity between the most similar neighbors, among which If satisfied Then it is a node pair Add edges to the enhanced adjacency matrix; S23. Construct an enhanced adjacency matrix Its definition is: ， in This represents the value of the original adjacency matrix.

4. The encrypted malicious traffic detection method based on uncertainty-aware multi-view learning according to claim 1, characterized in that, Step S5 includes the following sub-steps: S51. Train the evidence network for each view and output the evidence vector. And define the Dirichlet parameter. , for the The class's belief quality and overall uncertainty quality are calculated as follows: ， S52. Construct the loss function for the view, and jointly optimize the evidence network using cross-entropy and Kullback–Leibler divergence: ， in For the Digamma function, Replace the parameter corresponding to the real label with 1. For trade-off constants; S53. The Dempster-Shafer combination rule integrates the subjective opinions of the different views mentioned above, if any two of the views have belief and uncertainty respectively. and The resulting beliefs and uncertainties are: ， The resulting fusion perspective It reflects the evidentiary information from different views while preserving uncertainty.

5. The encrypted malicious traffic detection method based on uncertainty-aware multi-view learning according to claim 4, characterized in that, In step S5, The loss terms from the long-distance view, structural view, interactive view, and fused view are combined to form the overall training objective: ， Gradient descent is used to optimize model parameters. After training, the quality of beliefs in the fused viewpoints is considered. and uncertain mass Define anomaly score: ， in and Using the weighted coefficients, abnormal nodes or malicious traffic can be identified by sorting the abnormal scores in descending order.

6. The method for detecting encrypted malicious traffic based on uncertainty-aware multi-view learning according to claim 1, characterized in that, The fusion based on the Dempster-Shafer combination rule specifically involves: for any two view opinions to be fused, the quality of belief and the quality of uncertainty after fusion are calculated by the combination rule, which explicitly handles conflicting evidence between views.

Images