Lightweight encrypted traffic classification method and system based on time anchor diagram representation

Abstract

The invention discloses a lightweight encrypted traffic classification method and system based on time anchor diagram representation, and belongs to the technical field of network data security. Original traffic packets are preprocessed, and only head and load data are reserved; constructing a head graph and a load graph, dividing the fixed-length byte sequence into a plurality of time intervals, introducing corresponding anchor nodes, connecting the byte nodes in the intervals with anchor points, and injecting absolute / relative position information into the head graph and the load graph to obtain the head graph and the load graph after the time anchor points are enhanced; and on the head graph and the load graph after the time anchor point enhancement, coding the constructed time anchor point byte graph by adopting small-scale GraphSAGE to obtain a packet level vector, completing encryption traffic category judgment through a very simple classification head, and realizing a flow level decision through multi-packet aggregation. According to the method, the accuracy and robustness of encrypted traffic classification can be effectively improved while light weight and deployability are kept.

Description

Technical Field

[0001] This invention belongs to the field of network data security technology, specifically relating to a lightweight encrypted traffic classification method and system based on time anchor graph representation. Background Technology

[0002] With the rapid construction and application of data element carrier networks, encrypted traffic is gradually becoming the mainstream form of network transmission. In high-value scenarios such as finance, government affairs, and healthcare, the payload of the vast majority of data packets is protected by encryption. Traditional traffic classification methods that rely on port numbers, protocol characteristics, or plaintext fields are ineffective, leading to a significant decrease in network efficiency in service identification and scheduling.

[0003] Existing research often employs deep convolutional or sequence models to extract features from encrypted traffic. While these methods can improve classification performance to some extent, they are large in scale and computationally expensive, making real-time deployment difficult in resource-constrained environments such as edge nodes of data element carrier networks. Furthermore, these models tend to focus on the statistical distribution of bytes, lacking characterization of the temporal location information of data packets during transmission. This results in lightweight models having insufficient feature discrimination capabilities and a significant decrease in classification accuracy.

[0004] Therefore, effectively compensating for the lack of location information in encrypted scenarios while maintaining model lightweightness is a key technical challenge currently faced by data element carrier networks in the traffic classification stage. The lightweight encrypted traffic classification method based on time-anchor graph representation proposed in this invention is designed to address this challenge. By introducing time-anchor nodes into a byte-level graph structure, a fixed-length sequence is divided into a start interval, a middle interval, and a termination interval. Anchor connections are then used to assign location signals to the nodes, thereby enhancing the discriminative power and stability of the lightweight graph neural network. Summary of the Invention

[0005] Purpose of the Invention: In data element carrier networks, encrypted traffic has become the primary transmission form. Due to the encryption of its payload, traditional classification methods relying on plaintext fields or port numbers are ineffective. While existing deep learning methods can extract statistical features, lightweight models often struggle to effectively distinguish different application traffic when location information is lacking, leading to decreased classification accuracy. To address this issue, this invention proposes a lightweight encrypted traffic classification method based on time-anchored graph representation.

[0006] Technical solution: To achieve the above objectives, the technical solution adopted by this invention is as follows:

[0007] A lightweight encrypted traffic classification method based on time anchor graph representation includes the following steps:

[0008] Step 1, Data Preprocessing: Preprocess the raw traffic packets, retaining only the header and payload data and standardizing them into fixed-length inputs to form standardized data packets.

[0009] Step 2, Header and Load Graph Construction: Map the actual byte values ​​in the header and payload of the standardized data packet to nodes and assign them learnable embeddings. Calculate the PMI based on co-occurrence within the same packet to establish candidate edges, and apply Top-k sparsity and global upper bounds, as well as edge weight normalization, to obtain the header and load graphs while preserving their position indices.

[0010] Step 3, Time Anchor Insertion and Edge Connection Rules: Divide the fixed-length byte sequence into several time intervals, introduce corresponding anchor nodes, and connect the byte nodes within the intervals to the anchors. Inject absolute / relative position information into the header and load graphs to obtain the header and load graphs enhanced with time anchors.

[0011] Step 4, Lightweight Graph Encoding and Classification Decision: On the header and load graphs enhanced with time anchors, a small-scale GraphSAGE is used to encode the constructed time anchor byte graph to obtain packet-level vectors. Encrypted traffic category determination is completed through a simplified classification header, and flow-level decision can be achieved through multi-packet aggregation.

[0012] Preferred method: Step 1 includes the following steps: First, the collected raw network traffic packets are cleaned and normalized. Specifically, this includes removing fields that are invalid for classification and may leak user domain information, retaining only the packets containing the header and payload as subsequent input. For packet payloads of different lengths, truncation or zero-padding is used to uniformly adjust them to a fixed length, resulting in standardized data packets.

[0013] Preferred method: Step 2 includes: structuring the fixed-length byte sequence of standardized data packets into a lightweight sparse graph as input to the encrypted traffic model. First, each byte value in the standardized data packets is mapped to a node, with each byte value corresponding to a unique node. The initial features of the nodes are mapped from sparse one-hot vectors to learnable low-dimensional dense vectors through an embedding layer, and optionally, the frequency of occurrence and average relative position of the byte in the message are fused. Based on this, a sliding window is set on the fixed-length sequence to statistically analyze the co-occurrence frequency of byte pairs within the window, and the point mutual information (PMI) is calculated as a semantic relevance measure. When PMI > 0, undirected edges are established between corresponding nodes with PMI as the edge weight. Only the top-k edges with the highest PMI weights are retained for each node, and an edge count limit E_max is applied across the entire graph, thus obtaining a lightweight sparse byte graph that balances information preservation and computational efficiency.

[0014] Preferred method: Step 3 includes introducing a time anchor mechanism to explicitly inject temporal information into the graph structure. The fixed-length byte sequence is divided into several intervals sequentially, and an anchor node is added to each interval to represent its temporal position. Subsequently, weak connections are established between the byte nodes within each interval and their corresponding anchor nodes. The weights of these anchor edges are set to a fixed small constant or decrease linearly with the distance from the byte position to the center of the interval. Anchor nodes can be added independently in both the header and load graphs, forming a composite structure of content-related edges and time-position edges.

[0015] Preferred: Step 3 includes the following steps:

[0016] Step S301: Divide the load and header into time intervals.

[0017] Step S302: Set anchor nodes and feature representations for the load and header of the divided intervals.

[0018] Step S3021: Add a new set of anchor points for each interval. , . This represents the set of anchor points on the load side, used to represent the representative nodes of each interval after the fixed-length load sequence has been divided. This represents the anchor node of the Mth interval on the load side. This indicates the number of segments into which the load is divided. This represents the set of head-side anchor points. Indicates the side of the head Anchor nodes for each interval, This indicates the number of segments the header is divided into.

[0019] Step S3022: Introduce segmentation based on importance weights. Perform outgoing edge normalization for each node: , Define the importance weight for each position j: . This represents the normalized edge weights. Represents a byte node. Represents the original edge weights, the edge weights before normalization. Represents a node The neighborhood group, Indicates from Go to any neighbor The original edge weights, Indicates from arrive The original edge weights, express Co-occurrence correlation measure This represents the importance weight of position j. Represents the set of edges of a graph. This represents the normalized edge weights.

[0020] Will Normalize and calculate prefix sum , Let the sum represent the importance weight of position t. Divide into M equal parts: , This represents the cumulative importance scale value of the target. This represents the k-th target's equally divided scale. Indicates the number of intervals divided. This represents the sum of cumulative importance. Each dividing point Obtain the segment boundary The split point is on the position index axis j, and the sequence is divided into M segments according to the principle of "cumulative importance" balance.

[0021] Step S3023: Anchor nodes and connection domains, add an anchor node for each segment k. Its connection field covers all byte nodes within the segment. .

[0022] Step S3024: Anchor point feature construction. The feature vector of each anchor point node is uniformly represented as a concatenated form:

[0023]

[0024] in, This represents the feature vector of the k-th anchor node. It is a learnable codebase. These are geometric position parameters. For statistical summary, For identification code, It is a geometric quantity. =1 indicates a statistical summary.

[0025] Definition: Take the set of edges induced by this segment. Corresponding to non-negative weights Record the total intensity. and to Sort in descending order Set a small ratio. ,make .

[0026]

[0027] in, This represents the co-occurrence sharpness index of the k-th segment. This indicates the number of header edges involved in the SCSI calculation.

[0028] Step S3025: Anchor point feature initialization and normalization. . Directly constructed from geometric quantities and then normalized to Calculate and normalize offline during graph construction. We obtain the result through a linear + PReLU layer. , and then with splicing to avoid inconsistent dimensions:

[0029]

[0030] in, This represents the feature vector of the k-th anchor node. The identifier code representing the anchor point. Indicates a Gaussian distribution. This represents the standard deviation of the Gaussian initialization. Represents the identity matrix. This represents a vector of geometric position parameters of the anchor point. SCSI(k) represents the statistical summary of the anchor point.

[0031] Step S303: Design anchor point connections and weights based on the anchor point node set and feature representation.

[0032] Preferred step S303, which designs anchor point connections and weights based on the anchor point node set and feature representation, includes:

[0033] Step S3031: Connect bytes to anchor points. For the anchor point of the k-th segment... Its connection domain Establish an edge for each byte node within: , This represents the set of anchor points to bytes in the k-th segment. This represents the connection domain of the k-th segment.

[0034] The edge weights are designed using a separable formula that combines segment strength gating, relative position attenuation, and local importance.

[0035] Among them, segment strength gating The influence of anchor points on this segment is adaptively adjusted based on anchor point characteristics. . , Represents the parameter vector transpose, This represents the bias term, which is the relative position decay. Normalized coordinates of segment center Half-width segment Byte relative distance Take the Gaussian kernel. . Normalized coordinates representing byte positions Represents bytes Original position index in a fixed-length sequence express The steepness coefficient, This indicates the relative distance from the byte to the center of the segment.

[0036] Local importance The structural strength at a given location is represented by the sum of unnormalized edge weights before candidate graph generation, using a monotonically increasing compression function: ,in, This represents the scaling factor of the compression function. , This is the upper bound of the intra-dataset quantiles. Inputs indicating local importance.

[0037] Step S3032: Connect anchor points with edges. To establish an ordered "before → after" relationship between encoded segments, construct an anchor point sequence chain: .

[0038] Step S3033: Edge weight normalization and mixing. Source node row normalization is used: , Representing an edge Normalized weights Representing an edge The original weights, Let u be the set of its neighboring nodes. This represents a small positive number during normalization to prevent the denominator from being zero. (For byte nodes) Its final adjacency set consists of two parts: PMI sparse neighbors and anchor points. A node-level mixing coefficient is introduced. :

[0039] ,

[0040]

[0041] in, Representation function Mapping real numbers to , Indicates the gating steepness coefficient. This represents the statistical summary of the k-th segment in SCSI. The threshold representing the statistical summary, This represents the k-th time interval. Indicates the segment number to which position j belongs, and returns a given k. Represents a byte node The final adjacency set, Represents a byte node The sparse neighbor set of the PMI Represents the node-level mixing coefficient. This represents the time anchor node corresponding to the k-th segment.

[0042] Actual aggregate weights after mixing:

[0043]

[0044]

[0045] in, This represents the actual aggregate weights after mixing. This represents the j-th byte node. express A certain adjacent node, This represents the node-level mixing coefficient, which controls the quota of information from both the PMI neighbor and anchor points. This represents the row-normalized weights of the edge weights in the PMI branch. Indicates after mixing With its anchor point The actual aggregation weights This represents the k-th time anchor node. Represents the node-level mixing coefficient. This represents the normalized weight of the anchor branch.

[0046] Preferred method: Step 4 includes encoding the header graph and load graph containing time anchors using GraphSAGE with no more than three layers. In each layer of message passing, two types of neighbors are distinguished: content neighbors built based on point mutual information and time-series neighbors formed by anchor nodes. These are then aggregated and adjusted according to an adjustable coefficient. The system employs a fusion approach to inject location signals explicitly and controllably while maintaining sparse efficiency. After obtaining the header / carrier vectors through global readout, complementary filtering is performed at the graph level via cross-gated fusion. Anchor point statistical features are introduced as adjustment factors in the gating weight calculation, allowing the fusion ratio to adaptively adjust based on the "pre- / middle / post" location information. Finally, the generated packet-level vectors are input into a minimal classification head to complete packet-level discrimination. When flow-level decision-making is required, anchor point weighted fusion is applied to the prediction results of multiple packets within the same flow to enhance robustness in short-flow and truncated flow scenarios.

[0047] Preferred: Step 4 includes the following steps:

[0048] S401: Input and Layer Settings.

[0049] Input image:

[0050] Lightweight configuration: number of layers Hidden Dimensions Each layer uses BN + PReLU + Dropout (0.1–0.2).

[0051] S402: Lightweight graph representation learning. For node u (byte or anchor), layer l:

[0052]

[0053] in, To normalize border rights, It also includes PMI neighbors and time anchors, and is softly mixed between "statistical correlation vs. location prior" by gating by 𝛼.

[0054] S403: Packet-level read. For the set of anchor points. Perform gated weighting ,in .final: .

[0055] S404: Multi-task, multi-level classification head. Assume the category set includes application categories and security attributes. Merge the two packet vectors: .

[0056] Fuse uses gated fusion. , .

[0057] Category Header: Probability Distribution of Application Categories Probability distribution of security attributes .

[0058] Loss function: ,in It is a lightweight regularization.

[0059] S405: Stream aggregation and online determination.

[0060] After obtaining the packet-level representation, perform flow-level aggregation on multiple packets of the same session: Let the packet-level vector of the flow be... Then the average value can be taken. Online scenario optimization index sliding recursion Real-time updates are achieved with constant memory.

[0061] Ultimately Input a classification header consistent with the package level to obtain the application category distribution and security attribute distribution.

[0062] Another objective of this invention is to provide a lightweight encrypted traffic classification system based on time-anchor graph representation, comprising a data preprocessing unit, a graph construction unit, a time-anchor insertion and edge-connection unit, and a graph encoding and classification decision unit, wherein:

[0063] The data preprocessing unit is used to preprocess the raw traffic packets, retaining only the header and payload data and unifying them into a fixed-length input to form standardized data packets.

[0064] The graph construction unit is used to map the actual byte values ​​in the header and payload of the standardized data packet to nodes and assign them learnable embeddings. Candidate edges are established based on the PMI calculated according to the co-occurrence within the same packet, and sparsification and edge weight normalization are applied by Top-k and global upper bound to obtain the header graph and payload graph, while retaining the position index.

[0065] The time anchor insertion and connection unit is used to divide the fixed-length byte sequence into several time intervals, introduce corresponding anchor nodes, and connect the byte nodes in the intervals to the anchors, injecting absolute / relative position information into the header and load graphs to obtain the time anchor enhanced header and load graphs.

[0066] The graph encoding and classification decision unit is used to encode the constructed time-anchor byte graph on the header and load graphs after time-anchor enhancement using a small-scale GraphSAGE to obtain packet-level vectors. The encrypted traffic category is determined by a simplified classification header, and flow-level decision can be achieved through multi-packet aggregation.

[0067] Another object of the present invention is to provide a non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the lightweight encrypted traffic classification method based on time-anchor graph representation.

[0068] Compared with the prior art, the present invention has the following advantages:

[0069] This invention introduces time anchor nodes into the byte-level graph and explicitly injects position signals of the pre-, mid-, and post-intervals of data packets, thereby enhancing the timing awareness capability of the model while maintaining its lightweight nature, thus improving the accuracy and stability of encrypted traffic classification. Attached Figure Description

[0070] Figure 1 This is a schematic diagram of the overall system architecture of the present invention.

[0071] Figure 2 This is a flowchart of the method of the present invention.

[0072] Figure 3 A schematic diagram of time anchor point segmentation and connection domain.

[0073] Figure 4 Flowchart for determining adaptive segmentation boundaries.

[0074] Figure 5 This diagram illustrates the calculation of SCSI statistical summaries and the splicing of anchor point features. Detailed Implementation

[0075] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that these examples are for illustrative purposes only and are not intended to limit the scope of the invention. After reading this invention, any modifications of the invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0076] Example

[0077] In data element carrier networks, encrypted traffic has become the primary transmission form. Due to the encryption of its payload, traditional classification methods relying on plaintext fields or port numbers are ineffective. While existing deep learning methods can extract statistical features, lightweight models often struggle to effectively distinguish different application traffic when lacking location information modeling, leading to decreased classification accuracy. To address this issue, this embodiment proposes a lightweight encrypted traffic classification method based on time-anchor graph representation. The overall framework includes four core steps: data preprocessing, header and payload graph construction, time anchor injection, and lightweight graph neural network encoding and classification decision. First, the original traffic is parsed and anonymized, retaining the effective header and payload, and the payload is fixed-length. Then, the actual byte values ​​are mapped to nodes and embedded. Edges are constructed using PMI calculation on a sliding window within the same packet, and sparsity is achieved using Top-k and global upper bounds to obtain lightweight header / payload graphs. Next, time anchors are added in equal-length or adaptive intervals, and the interval bytes are connected to the corresponding anchors (which may include relative position attenuation and segment gating) to explicitly inject location information such as "pre-middle-post". Finally, a small-scale GraphSAGE algorithm is used for encoding and reading. Packet-level vectors are fused, output through a simplified classification header, and used for application and security determination. When necessary, the average or recursive aggregation of multiple packet vectors from the same session is performed to obtain the stream-level result, such as... Figure 1 As shown, it includes the following steps:

[0078] Step 1, Data Preprocessing: Preprocess the raw traffic packets, retaining only the header and payload data and standardizing them into fixed-length inputs to form standardized data packets.

[0079] Step 1 includes the following steps: First, the collected raw network traffic packets are cleaned and normalized to reduce input redundancy and avoid privacy leaks. Specifically, this includes: removing fields that are invalid for classification and may leak user domain information, retaining only the packets containing the header and payload as subsequent input. For payloads of different lengths, truncation or zero-padding is used to uniformly adjust them to a fixed length (e.g., 1024 bytes or 1500 bytes) to obtain standardized data packets, ensuring consistency of input samples in terms of dimensions. The captured network traffic packets are structurally parsed to remove information that does not carry valid semantics, while avoiding the leakage of sensitive fields related to user identity. Subsequently, byte sequences of different lengths are normalized to a fixed length, for example, uniformly 1,500 bytes, to ensure the consistency and comparability of subsequent inputs. By preprocessing the raw traffic packets, irrelevant or sensitive fields are removed, retaining only the header and payload data, and uniformly standardizing them as fixed-length inputs to ensure data consistency and privacy security. This preprocessing operation can reduce the model's reliance on redundant features, improve the stability of training and inference, and at the same time compress the input size from the source, laying the foundation for subsequent lightweight modeling.

[0080] The goal of this step is to parse and normalize the raw data packets to obtain standardized inputs for constructing the header and load graphs. This includes the following steps:

[0081] Step S101: Packet parsing. The collected raw traffic data is parsed packet by packet. Let a single packet be represented as:

[0082]

[0083] in, Indicates the Ethernet header. Indicates the IP header, This represents the transport layer header, such as TCP / UDP. Indicates the data payload.

[0084] Step S102: Head retention and desensitization.

[0085] Remove Ethernet header Because their content is fixed and lacks categorization significance, sensitive fields (such as source / destination IP addresses and port numbers) are removed or masked in the IP and transport layer headers. The remaining fields, such as protocol numbers, flags, sequence numbers, and TTL, are retained to capture communication behavior characteristics. The retained portion is collectively referred to as the "valid header." Its byte sequence will be used as input to the header graph.

[0086] The processed packet can be represented as:

[0087] Step S103: Payload Retention and Structuring. This involves processing the payload in the data packets. Perform length standardization. Let the original load length be L, and the target length be... Common settings The processing method is as follows:

[0088]

[0089] Step S104: Output the results. Finally, each data packet is organized as follows:

[0090]

[0091] in, Indicates the valid bytes in the header. This represents the payload bytes. The former is used to build the header graph, and the latter is used to build the payload graph, laying the foundation for subsequent graph modeling.

[0092] By analyzing the structure of captured network traffic packets, information without valid semantics is removed, while sensitive fields related to user identity are avoided from being leaked. Subsequently, byte sequences of different lengths are normalized to a fixed length, such as 1,500 bytes, through truncation or zero padding, thereby ensuring the consistency and comparability of subsequent inputs.

[0093] Step 2, Header and Load Graph Construction: Map the actual byte values ​​in the header and payload of the standardized data packet to nodes and assign them learnable embeddings. Calculate the PMI based on co-occurrence within the same packet to establish candidate edges, and apply Top-k sparsity and global upper bounds, as well as edge weight normalization, to obtain the header and load graphs while preserving their position indices.

[0094] Step 2 involves structuring the fixed-length byte sequence of standardized data packets into a lightweight sparse graph as input to the encrypted traffic model. First, each byte value (a subset of 0–255) appearing in the data packet is mapped to a node, with each byte value corresponding to a unique node, thus ensuring that the node set formed by a single packet does not exceed 256. To reduce dimensionality and improve expressiveness, the initial node features are mapped from sparse one-hot vectors to learnable low-dimensional dense vectors (e.g., 16 or 24 dimensions) through an embedding layer. Optionally, statistics such as the frequency of occurrence of the byte in the message and its average relative position are fused to enhance discriminative power with minimal overhead. Based on this, the system sets a sliding window on the fixed-length sequence to statistically analyze the co-occurrence frequency of byte pairs within the window and calculates Point Mutual Information (PMI) as a semantic relevance measure. When PMI > 0, undirected edges are established between corresponding nodes with PMI as the edge weight. To avoid excessively dense graph structures, only the top-k edges with the highest PMI weights are retained for each node, and an edge count limit E_max is applied to the entire graph (with row normalization of edge weights if necessary). This results in a lightweight sparse byte graph that balances information preservation and computational efficiency, providing standardized input for subsequent time anchor injection and graph encoding.

[0095] The goal of this step is to transform the valid header and payload byte sequence obtained in step one into a graph structure representation, perform sparsity processing during the construction process, and preserve positional information for subsequent introduction of time anchors. Specifically, this includes the following steps:

[0096] Step S201: Node definition.

[0097] Step S2011: Header Graph Node Set: ,in This represents the i-th header byte. This indicates the index of the byte's position in the header sequence.

[0098] Step S2022: Load graph node set: ,in This represents the j-th header byte. This indicates its position in a fixed-length sequence.

[0099] Step S2023: Assign a learnable embedding vector to each node. , as the initial features of the graph neural network.

[0100] Step S202: Edge construction strategy.

[0101] Step S2021: Use Pointed Mutual Information (PMI) to measure the correlation between byte pairs: ,when At the node Establish an edge between them.

[0102] Step S2022: Sparsity constraint. For each node, only the top k neighbors with the highest PMI value are retained, and a global edge limit of 𝐸𝑚𝑎𝑥 is set to avoid an overly dense graph structure.

[0103] Step S203: When constructing the edge set, in addition to saving the PMI weights between nodes, the sequence position (pos) of each node is also retained. This information will be used for interval partitioning and anchor point connection in subsequent steps and will not participate in the current edge weight calculation.

[0104] Step S204: Construct the header graph and load graph.

[0105] Step S2041: Obtain the header image using the above rules: .in This is the set of edges after PMI and sparsification. Embed the matrix for the node. This is a set of location indexes.

[0106] Step S2042: Obtain the load diagram using the above rules: .in Capture statistical co-occurrence patterns between bytes. This is a set of location indices to ensure that the interval can be quickly located when inserting subsequent anchor points.

[0107] By treating the byte value space as a candidate set of nodes, modeling only the subset of bytes actually appearing in the data packet reduces the graph size. Each node is assigned a learnable low-dimensional embedding vector to replace the high-dimensional one-hot representation, improving storage and computation efficiency. Based on this, relevance is calculated according to the co-occurrence relationships of bytes within the same data packet. Point mutual information (PMI) is used to determine edge strength, retaining only valid edges with a PMI greater than a threshold. Redundant edges are then pruned and sparsified by combining the Top-k values ​​of each node and the global edge count limit, thus constructing a lightweight byte graph with concentrated information and controllable size.

[0108] Step 3, Time Anchor Insertion and Edge Connection Rules: Divide the fixed-length byte sequence into several time intervals, introduce corresponding anchor nodes, and connect the byte nodes within the intervals to the anchors. Inject absolute / relative position information into the header and load graphs to obtain the header and load graphs enhanced with time anchors.

[0109] Step 3 involves introducing a temporal anchor mechanism after constructing the header and load graphs to explicitly inject temporal information into the graph structure. Specifically, a fixed-length byte sequence is divided into several intervals, such as four segments (pre-, mid-pre-, mid-late-, and late-), and an anchor node is added to each interval to represent its temporal position. Weak connections are then established between the byte nodes within each interval and their corresponding anchor nodes. The weights of these anchor edges are set to a fixed small constant or decrease linearly with the distance from the byte position to the center of the interval, ensuring that the anchor only transmits positional information and does not dominate the byte semantics. Anchor nodes can be added independently in both the header and load graphs, forming a composite structure of "content-related edges + temporal position edges." In this way, even in encrypted environments where plaintext temporal features cannot be directly obtained, the model can still perceive the "pre- / mid / late" positional information with minimal overhead, significantly improving the discriminative power and robustness of the lightweight graph neural network. This design differs from existing methods that rely on sequential fully connected layers or additional temporal networks, achieving temporal enhancement with lower complexity. By dividing a fixed-length byte sequence into several time intervals, introducing anchor nodes and connecting them to byte nodes within the intervals, location information can be introduced in a low-cost manner.

[0110] This step, without introducing an expensive temporal model, uses anchor nodes as carriers to inject absolute / relative positional information into the header and load graphs. This allows the GNN to obtain the prior knowledge of "the segment where the byte is located and its relative position" in a single message pass, thereby improving the recognizability of the sequence structure within the packet and maintaining overall lightweight design. The specific steps include:

[0111] Step S301: Divide the load and header into time intervals.

[0112] S3011: Load range division. Assume a fixed load length of... Given the number of time intervals M, here M is set to 3, we first perform normalization. Let the interval numbering mapping function... .

[0113] S3012: Header Section Division. Since the header is relatively short, the IP segment and the transport layer segment can be treated as two separate functional segments, resulting in... .

[0114] Step S302: Set anchor nodes and feature representations for the load and header of the divided intervals.

[0115] Step S3021: Add a new set of anchor points for each interval. , . This represents the set of anchor points on the load side, used to represent the representative nodes of each interval after the fixed-length load sequence has been divided. This represents the anchor node of the Mth interval on the load side. This indicates the number of segments into which the load is divided. This represents the set of head-side anchor points. Indicates the side of the head Anchor nodes for each interval, This indicates the number of segments the header is divided into.

[0116] Step S3022: To avoid the problem of "equal-length segments but uneven information distribution," segmentation based on importance weights is introduced. To prevent certain highly connected nodes from dominating aggregation, outgoing edge normalization is typically performed on each node: , Define the importance weight for each position j: . This represents the normalized edge weights. Represents a byte node. Represents the original edge weights, the edge weights before normalization. Represents a node The neighborhood group, Indicates from Go to any neighbor The original edge weights, Indicates from arrive The original edge weights, express Co-occurrence correlation measure This represents the importance weight of position j. Represents the set of edges of a graph. This represents the normalized edge weights.

[0117] Will Normalize and calculate prefix sum , Let the sum represent the importance weight of position t. Divide into M equal parts: , This represents the cumulative importance scale value of the target. This represents the k-th target's equally divided scale. Indicates the number of intervals divided. This represents the cumulative importance sum. Each dividing point... Obtain the segment boundary The split point is on the position index axis j, and the sequence is divided into M segments according to the principle of "cumulative importance". The "graph structure information" carried by each segment should be as similar as possible, rather than simply being cut into segments of equal length.

[0118] Step S3023: Anchor nodes and connection domains, add an anchor node for each segment k. Its connection field covers all byte nodes within the segment. .

[0119] Step S3024: Anchor point feature construction. The feature vector of each anchor point node is uniformly represented as a concatenated form:

[0120]

[0121] in, This represents the feature vector of the k-th anchor node. It is a learnable base code, used to allow the model to learn a fixed "identity code" for different intervals. These are geometric position parameters. For statistical summary, This is the identification code, which mainly provides learnable "segment tags" and is set to 16. Let be a geometric quantity, and take the value 2. =1 indicates a statistical summary.

[0122] This invention provides a lightweight and highly discriminative summary: SCSI (Segmental Co-occurrence Sharpness Index), used to measure the concentration of PMI co-occurrence weights within a segment, i.e., whether a minority of strong co-occurrences dominate.

[0123] Definition: Take the set of edges induced by this segment. Corresponding to non-negative weights Record the total intensity. and to Sort in descending order Set a small ratio. ,make .

[0124]

[0125] in, This represents the co-occurrence sharpness index of the k-th segment. Indicates the number of header edges involved in the SCSI calculation.

[0126] If a few strong edges can cover most of the co-occurrence intensity of a segment, then SCSI is large, indicating that the segment exhibits high sharpness / patterning (such as the inertial byte combinations of a specific application / protocol). Conversely, if the co-occurrence is scattered, then SCSI is small.

[0127] Step S3025: Anchor point feature initialization and normalization. , Smaller (e.g., 0.02). Directly constructed from geometric quantities and then normalized to Calculate and normalize offline during graph construction. We obtain the result through a linear + PReLU layer. , and then with splicing to avoid inconsistent dimensions:

[0128]

[0129] in, This represents the feature vector of the k-th anchor node. The identifier code representing the anchor point. Indicates a Gaussian distribution. This represents the standard deviation of the Gaussian initialization. Represents the identity matrix. This represents a vector of geometric position parameters of the anchor point. SCSI(k) represents the statistical summary of the anchor point.

[0130] Step S303: Design anchor point connections and weights based on the anchor point node set and feature representation.

[0131] The design of anchor point connections and weights based on the anchor point node set and feature representation includes:

[0132] Step S3031: Connect bytes to anchor points. For the anchor point of the k-th segment... Its connection domain Establish an edge for each byte node within: , This represents the set of anchor points to bytes in the k-th segment. This represents the connection domain of the k-th segment.

[0133] To enhance robustness and separability, the edge weights employ a separable design based on segment strength gating × relative position attenuation × local importance:

[0134] Among them, segment strength gating Based on anchor point characteristics (especially statistical summaries) The influence of the anchor point on this section is adaptively adjusted. . , Represents the parameter vector transpose, This represents the bias term, which is the relative position decay. Normalized coordinates of segment center Half-width segment Byte relative distance Take the Gaussian kernel. . Normalized coordinates representing byte positions Represents bytes Original position index in a fixed-length sequence express The steepness coefficient, This indicates the relative distance from the byte to the center of the segment.

[0135] Local importance The structural strength at a given location is represented by the sum of unnormalized edge weights before candidate graph generation, using a monotonically increasing compression function: ,in, This represents the scaling factor of the compression function. , This is the upper bound of the intra-dataset quantiles. Inputs indicating local importance.

[0136] Step S3032: Connect anchor points with edges. To establish an ordered "before → after" relationship between encoded segments, construct an anchor point sequence chain: .

[0137] Step S3033: Edge weight normalization and mixing. To avoid high-connectivity nodes dominating propagation, source node row normalization is used: , Representing an edge Normalized weights Representing an edge The original weights, Represents a node The set of neighboring nodes, This represents a small positive number during normalization to prevent the denominator from being zero. (For byte nodes) Its final adjacency set consists of two parts: PMI sparse neighbors and anchors. To balance the contributions of the two, a node-level mixing coefficient is introduced. :

[0138] ,

[0139]

[0140] in, Representation function Mapping real numbers to , Indicates the gating steepness coefficient. This represents the statistical summary of the k-th segment in SCSI. The threshold representing the statistical summary, This represents the k-th time interval. Indicates the segment number to which position j belongs, and returns a given k. Represents a byte node The final adjacency set, Represents a byte node The sparse neighbor set of the PMI Represents the node-level mixing coefficient. This represents the time anchor node corresponding to the k-th segment.

[0141] When a certain segment becomes more "formulaic" ( big), If the value is too high, the weight of location information increases. Conversely, if it is too low, the PMI structure will drive the market.

[0142] Actual aggregate weights after mixing:

[0143]

[0144]

[0145] in, This represents the actual aggregate weights after mixing. This represents the j-th byte node. express A certain adjacent node, This represents the node-level mixing coefficient, which controls the quota of information from both the PMI neighbor and anchor points. This represents the row-normalized weights of the edge weights in the PMI branch. Indicates after mixing With its anchor point The actual aggregation weights This represents the k-th time anchor node. Represents the node-level mixing coefficient. This represents the normalized weight of the anchor branch.

[0146] By dividing a fixed-length byte sequence into multiple time intervals, such as segments in the order of beginning, middle, and end, and introducing anchor nodes in each interval, the anchor node is connected to the byte nodes of its corresponding interval, thus providing the model with temporal position information. This mechanism enables the model to distinguish the contribution of bytes at different positions to the classification results without relying on complex temporal models.

[0147] Step 4, Lightweight Graph Encoding and Classification Decision: On the header and load graphs enhanced with time anchors, a small-scale GraphSAGE is used to encode the constructed time anchor byte graph to obtain packet-level vectors. Encrypted traffic category determination is completed through a simplified classification header, and flow-level decision can be achieved through multi-packet aggregation.

[0148] The header and load graphs containing time anchors are encoded using GraphSAGE (mean aggregation) at no more than three layers. In each layer of message passing, two types of neighbors are distinguished: content neighbors built based on point mutual information and time-series neighbors formed by anchor nodes. These are aggregated separately and then processed using adjustable coefficients. The system employs a fusion process to inject location signals explicitly and controllably while maintaining sparse efficiency. After obtaining the header / carrier vectors through global readout, the system performs complementary filtering at the graph level via cross-gated fusion. Anchor point statistical features are introduced as adjustment factors in the gating weight calculation, allowing the fusion ratio to adaptively adjust based on the "front / middle / back" location information. Finally, the generated packet-level vectors are input into a minimal classification head (single-layer fully connected + softmax) to complete packet-level discrimination. When flow-level decision-making is required, anchor point weighted fusion (with slightly higher weights for the front-end packets) is applied to the prediction results of multiple packets within the same flow to enhance robustness in short-flow and truncated flow scenarios.

[0149] On the header and load graphs enhanced with time anchors, a small-scale GraphSAGE is used to learn packet-level representations, and packet-level categories are output through a minimal classification header. When needed, multiple packet representations of the same stream are aggregated to achieve stream-level determination, specifically including:

[0150] S401: Input and Layer Settings. Since the payload is encrypted, the discrimination clues mainly come from byte distribution / co-occurrence structure and temporal positional patterns. Time anchors provide "before / middle / after" (or adaptive segmentation) relational positional information, enabling the model to distinguish the intra-packet morphological differences of different applications / malicious patterns without decryption.

[0151] Input image:

[0152] Lightweight configuration: number of layers Hidden Dimensions Each layer uses BN + PReLU + Dropout (0.1–0.2).

[0153] S402: Lightweight graph representation learning. For node u (byte or anchor), layer l:

[0154]

[0155] in, To normalize border rights, It also includes PMI neighbors and time anchors, and is softly mixed between "statistical correlation vs. location prior" by gating by 𝛼.

[0156] S403: Packet-level read. For the set of anchor points. Perform gated weighting ,in .final: This highlights the contribution of segments with significant location information (such as handshake / certificate exchange / early application bursts) to the identification of encrypted traffic.

[0157] S404: Multi-task, multi-level classification header. The category set includes application categories (e.g., video / voice / file transfer / webpage / game / tunneling…) and security attributes (malicious / benign, or malicious family). The two packet vectors are fused: .

[0158] Fuse uses gated fusion. , .

[0159] Classification Head (Lightweight MLP 1–2 Layers): Uses the probability distribution of categories Probability distribution of security attributes .

[0160] Loss function (for parallel multitasking): ,in It is a lightweight regularization.

[0161] S405: Stream aggregation and online determination.

[0162] To improve the stability of encrypted traffic discrimination, after obtaining the packet-level representation, flow-level aggregation is performed on multiple packets from the same session: Let the packet-level vector of the flow be... Then the average value can be taken. Online scenario optimization index sliding recursion Real-time updates are achieved with constant memory.

[0163] Ultimately Inputting a classification header consistent with the packet-level input yields the application category distribution and security attribute distribution. When resources are limited, time averaging or majority voting can be used to obtain stream-level labels from the packet-level probabilities. The above process does not rely on plaintext, and the computational and storage complexity increases linearly with stream length.

[0164] By encoding the constructed temporal anchor byte graph using a small-scale GraphSAGE network, information about nodes and their neighbors is aggregated to obtain an overall packet-level representation vector. This vector is then used to determine the category using a lightweight classification head. In stream-level scenarios, multiple packet-level vectors from the same stream can be aggregated, for example, using averaging or weighted methods, to form stable stream-level classification results.

[0165] S406: Deployment and Lightweight Strategy.

[0166] To meet the demands of edge and high-throughput deployments, this invention employs batch normalization folding and static graph derivation during the inference phase, combined with operator fusion and fixed-point quantization to reduce latency and memory access. The sparse byte graph is stored using compressed structures such as CSR, and batch processing is performed in buckets based on packet length and segment configuration to improve parallelism and cache hit rate. Message passing maintains row normalization and applies a low-proportion random deactivation to anchor edges to suppress overfitting. In online scenarios, only segment gating coefficients and mixing coefficients are softly adaptively updated without altering the backbone parameters, thus maintaining stable performance under distribution drift. These strategies ensure that computational and storage complexity is linearly controlled with the number of layers and hidden dimensions, meeting the real-time requirements of edge devices and NFV.

[0167] In another embodiment, a lightweight encrypted traffic classification system based on time-anchor graph representation is provided, including a data preprocessing unit, a graph construction unit, a time-anchor insertion and edge-connection unit, and a graph encoding and classification decision unit, wherein:

[0168] The data preprocessing unit is used to preprocess the raw traffic packets, retaining only the header and payload data and unifying them into a fixed-length input to form standardized data packets.

[0169] The graph construction unit is used to map the actual byte values ​​in the header and payload of the standardized data packet to nodes and assign them learnable embeddings. Candidate edges are established based on the PMI calculated according to the co-occurrence within the same packet, and sparsification and edge weight normalization are applied by Top-k and global upper bound to obtain the header graph and payload graph, while retaining the position index.

[0170] The time anchor insertion and connection unit is used to divide the fixed-length byte sequence into several time intervals, introduce corresponding anchor nodes, and connect the byte nodes in the intervals to the anchors, injecting absolute / relative position information into the header and load graphs to obtain the time anchor enhanced header and load graphs.

[0171] The graph encoding and classification decision unit is used to encode the constructed time-anchor byte graph on the header and load graphs after time-anchor enhancement using a small-scale GraphSAGE to obtain packet-level vectors. The encrypted traffic category is determined by a simplified classification header, and flow-level decision can be achieved through multi-packet aggregation.

[0172] In another embodiment, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the lightweight encrypted traffic classification method based on time-anchor graph representation.

[0173] In the context of data element bearer networks, high throughput, low latency, and privacy compliance coexist. However, encrypted traffic makes traditional lightweight models based solely on byte co-occurrence (PMI) lack explicit location information, resulting in insufficient discriminative power without decryption. To address this single critical issue, this invention proposes a lightweight byte graph encrypted traffic classification method enhanced with time anchors. Fixed-length intervals are mapped to time anchor nodes, and bytes within the interval are linked to anchors one by one using "connection domains." Ordered anchor-anchor edges are set to explicitly encode temporal priors such as "pre-middle-post." A relational weight design is introduced at the edge weight layer, with segment strength gating and relative position attenuation softly fused with the PMI sparse graph through a mixing coefficient, thereby simultaneously acquiring "statistical correlation + location prior" within a single message pass. This mechanism only linearly increases a small number of nodes and edges, maintaining controllable computational and storage overhead, and adapting to the deterministic forwarding and edge deployment constraints of the bearer network. Packet / flow-level determination can be completed using a small-scale GraphSAGE and a simplified classification header. Empirical evidence shows that, without compromising encryption or introducing re-timing modules, this invention can effectively fill the gap in location information, significantly improve the accuracy and robustness of encrypted traffic identification, and meet the engineering requirements of data element carrier networks for high throughput and low latency.

[0174] This invention is applicable to the intelligent identification and classification of encrypted service traffic in a data element carrier network environment. While maintaining lightweight and deployability, it can effectively improve the accuracy and robustness of encrypted traffic classification, meeting the data element carrier network's requirements for real-time, secure, and low-power service identification.

[0175] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A lightweight encrypted traffic classification method based on time anchor graph representation, characterized in that, Includes the following steps: Step 1, Data Preprocessing: Preprocess the raw traffic packets, retaining only the header and payload data and standardizing them into fixed-length inputs to form standardized data packets; Step 2, Header and Load Graph Construction: Map the actual byte values ​​in the header and payload of the standardized data packet to nodes and assign them learnable embeddings; calculate PMI based on co-occurrence within the same packet to establish candidate edges, and apply Top-k and global upper limit sparsification and edge weight normalization to obtain the header and load graphs while retaining the position index; Step 3, Time Anchor Insertion and Edge Connection Rules: Divide the fixed-length byte sequence into several time intervals, introduce corresponding anchor nodes, and connect the byte nodes within the intervals to the anchors to inject absolute / relative position information into the header and load graphs, thus obtaining the header and load graphs enhanced by time anchors. Step 4, Lightweight Graph Encoding and Classification Decision: On the header and load graphs enhanced with time anchors, a small-scale GraphSAGE is used to encode the constructed time anchor byte graph to obtain packet-level vectors. Encrypted traffic category determination is completed through a simplified classification header, and flow-level decision can be achieved through multi-packet aggregation.

2. The lightweight encrypted traffic classification method based on time anchor graph representation according to claim 1, characterized in that: Step 1 includes the following steps: First, the collected raw network traffic packets are cleaned and normalized. Specifically, this includes: removing fields that are invalid for classification and may leak user domain information, and retaining only the packets containing the header and payload as subsequent input; for packet payloads of different lengths, truncation or zero padding is used to uniformly adjust them to a fixed length to obtain standardized data packets.

3. The lightweight encrypted traffic classification method based on time anchor graph representation according to claim 1, characterized in that: Step 2 includes: structuring the fixed-length byte sequence of standardized data packets into a lightweight sparse graph as input to the encrypted traffic model. First, each byte value in the standardized data packets is mapped to a node, with each byte value corresponding to a unique node. The initial features of the nodes are mapped from sparse one-hot vectors to learnable low-dimensional dense vectors through an embedding layer, and optionally, the frequency of occurrence of the byte in the message and its average relative position are fused. Based on this, a sliding window is set on the fixed-length sequence to statistically analyze the co-occurrence frequency of byte pairs within the window, and the point mutual information (PMI) is calculated as a semantic relevance measure. When PMI > 0, undirected edges are established between the corresponding nodes with PMI as the edge weight. Only the top-k edges with the highest PMI weights are retained for each node, and an edge count limit E_max is applied to the entire graph, thus obtaining a lightweight sparse byte graph that balances information preservation and computational efficiency.

4. The lightweight encrypted traffic classification method based on time anchor graph representation according to claim 1, characterized in that: Step 3 includes: introducing a time anchor mechanism to explicitly inject timing information into the graph structure; dividing the fixed-length byte sequence into several intervals in sequence, and adding an anchor node to each interval to represent the time position of that interval; then establishing weak connections between the byte nodes in the interval and the corresponding anchor nodes, with the weight of these anchor edges set to a fixed small constant or decreasing linearly with the distance from the byte position to the center of the interval; anchor nodes can be added independently in both the header graph and the load graph to form a composite structure of content-related edges + time position edges.

5. The lightweight encrypted traffic classification method based on time anchor graph representation according to claim 1, characterized in that: Step 3 includes the following steps: Step S301: Divide the load and header into time intervals; Step S302: Set anchor nodes and feature representations for the divided load and header; Step S3021: Add a new set of anchor points for each interval; , ; This represents the set of anchor points on the load side, used to represent the representative nodes of each interval after the fixed-length load sequence has been divided. This represents the anchor node of the Mth interval on the load side. This indicates the number of segments into which the load is divided. This represents the set of head-side anchor points. Indicates the side of the head Anchor nodes for each interval, This indicates the number of segments the header is divided into. Step S3022: Introduce segmentation based on importance weights; perform outgoing edge normalization for each node: , Define the importance weight for each position j: ; This represents the normalized edge weights. Represents a byte node. Represents the original edge weights, the edge weights before normalization. Represents a node The neighborhood group, Indicates from Go to any neighbor The original edge weights, Indicates from arrive The original edge weights, express Co-occurrence correlation measure This represents the importance weight of position j. Represents the set of edges of a graph. Represents the normalized edge weights; Will Normalize and calculate prefix sum , Let the sum of the importance weights of position t be denoted by t. Divide into M equal parts: , This represents the cumulative importance scale value of the target. This represents the k-th target's equally divided scale. Indicates the number of intervals divided. This represents the sum of cumulative importance. Each dividing point Obtain the segment boundary The split point is on the position index axis j, and the sequence is divided into M segments according to the principle of "cumulative importance" balance. Step S3023: Anchor nodes and connection domains, add an anchor node for each segment k. Its connection field covers all byte nodes within the segment. ; Step S3024: Anchor point feature construction; the feature vector of each anchor point node is uniformly represented as a concatenated form: in, This represents the feature vector of the k-th anchor node. It is a learnable codebase. These are geometric position parameters. For statistical summary, For identification code, It is a geometric quantity; =1 indicates a statistical summary; Definition: Take the set of edges induced by this segment. Corresponding to non-negative weights Record the total intensity and to Sort in descending order Set a small ratio ,make ; in, This represents the co-occurrence sharpness index of the k-th segment. Indicates the number of header edges involved in the SCSI calculation; Step S3025: Anchor point feature initialization and normalization; ; Directly constructed from geometric quantities and then normalized to Offline computation and standardization are performed during graph construction; We obtain the result through a linear + PReLU layer. , and then with splicing to avoid inconsistent dimensions: in, This represents the feature vector of the k-th anchor node. The identifier code representing the anchor point. Indicates a Gaussian distribution. This represents the standard deviation of the Gaussian initialization. Represents the identity matrix. This represents a vector of geometric position parameters of the anchor point. SCSI(k) represents the statistical summary of the anchor point; Step S303: Design anchor point connections and weights based on the anchor point node set and feature representation.

6. The lightweight encrypted traffic classification method based on time anchor graph representation according to claim 5, characterized in that: Step S303, based on the anchor node set and feature representation, designs anchor point connections and weights, including: Step S3031: Connect bytes to anchor points; connect the anchor points of the k-th segment. Its connection domain Establish an edge for each byte node within: , This represents the set of anchor points to bytes in the k-th segment. Indicates the connection domain of the k-th segment; The edge weights are designed using a separable formula that combines segment strength gating, relative position attenuation, and local importance. Among them, segment strength gating The influence of anchor points on this segment is adaptively adjusted based on anchor point characteristics; ; , Represents the parameter vector transpose, This represents the bias term, which is the relative position decay. Normalized coordinates of segment center Half-width segment Byte relative distance Take the Gaussian kernel ; Normalized coordinates representing byte positions Represents bytes Original position index in a fixed-length sequence express The steepness coefficient, Indicates the relative distance from the byte to the center of the segment; Local importance The structural strength at a given location is represented by the sum of unnormalized edge weights before candidate graph generation, using a monotonically increasing compression function: ,in, This represents the scaling factor of the compression function. , This is the upper bound of the intra-dataset quantiles. Inputs indicating local importance; Step S3032: Connect anchor points with edges; construct an anchor point sequence chain to establish an ordered "before → after" relationship between encoded segments: ; Step S3033: Edge weight normalization and mixing; using source node row normalization: , Representing an edge Normalized weights Representing an edge The original weights, Represents a node The set of neighboring nodes, To represent tiny positive numbers during normalization, preventing the denominator from being zero; for byte nodes Its final adjacency set consists of two parts: PMI sparse neighbors and anchor points; a node-level mixing coefficient is introduced. : ， in, Representation function Mapping real numbers to , Indicates the gating steepness coefficient. This represents the statistical summary of the k-th segment in SCSI. The threshold representing the statistical summary, This represents the k-th time interval. Indicates the segment number to which position j belongs, and returns a given k. Represents a byte node The final adjacency set, Represents a byte node The sparse neighbor set of the PMI Represents the node-level mixing coefficient. This represents the time anchor node corresponding to the k-th segment; Actual aggregate weights after mixing: in, This represents the actual aggregate weights after mixing. This represents the j-th byte node. express A certain adjacent node, This represents the node-level mixing coefficient, which controls the quota of information from both the PMI neighbor and anchor points. This represents the row-normalized weights of the edge weights in the PMI branch. Indicates after mixing With its anchor point The actual aggregation weights This represents the k-th time anchor node. Represents the node-level mixing coefficient. This represents the normalized weight of the anchor branch.

7. The lightweight encrypted traffic classification method based on time anchor graph representation according to claim 1, characterized in that: Step 4 includes: encoding the header graph and load graph containing time anchors using GraphSAGE with no more than three layers; distinguishing two types of neighbors in each layer of message passing: content neighbors built based on point mutual information and time-series neighbors formed by anchor nodes, aggregating them separately and then adjusting the parameters according to an adjustable coefficient. The system integrates location signals to inject them explicitly and controllably while maintaining sparse efficiency. After obtaining the header / carrier vectors through global readout, it performs complementary filtering at the graph level through cross-gated fusion. Anchor point statistical features are introduced as adjustment factors in the gating weight calculation to adaptively adjust the fusion ratio according to the "front / middle / back" location information. Finally, the generated packet-level vectors are input into the minimal classification head to complete packet-level discrimination. When flow-level decision-making is required, anchor point weighted fusion is performed on the prediction results of multiple packets in the same flow to enhance robustness in short-flow and truncated flow scenarios.

8. The lightweight encrypted traffic classification method based on time anchor graph representation according to claim 1, characterized in that: Step 4 includes the following steps: S401: Input and Layer Settings; Input image: Lightweight configuration: number of layers Hidden Dimensions Each layer uses BN + PReLU + Dropout (0.1–0.2); S402: Lightweight graph representation learning; for node u (byte or anchor), layer l: in, To normalize border rights, It also includes PMI neighbors and time anchors, and is softly mixed between "statistical correlation vs. location prior" with gating by α; S403: Packet-level readout; for anchor point set Perform gated weighting ,in ;final: ; S404: Multi-task, multi-level classification head; the category set includes application categories and security attributes; the two packet vectors are fused: ; Fuse uses gated fusion. , ; Category Header: Probability Distribution of Application Categories Probability distribution of security attributes ; Loss function: ,in Lightweight regularization; S405: Stream aggregation and online determination; After obtaining the packet-level representation, perform flow-level aggregation on multiple packets of the same session: Let the packet-level vector of the flow be... Then the average value can be taken. Online scenario optimization index sliding recursion Real-time updates are achieved with constant memory. Ultimately Input a classification header consistent with the package level to obtain the application category distribution and security attribute distribution.

9. A classification system based on the lightweight encrypted traffic classification method based on time anchor graph representation as described in claim 1, characterized in that: It includes a data preprocessing unit, a graph construction unit, a time anchor insertion and edge connection unit, and a graph coding and classification decision unit, wherein: The data preprocessing unit is used to preprocess the raw traffic packets, retaining only the header and payload data and unifying them into a fixed-length input to form a standardized data packet; The graph construction unit is used to map the actual byte values ​​in the header and payload of the standardized data packet to nodes and assign them learnable embeddings; it calculates PMI based on co-occurrence within the same packet to establish candidate edges, and applies Top-k and global upper limit sparsification and edge weight normalization to obtain the header graph and payload graph while retaining the position index; The time anchor insertion and connection unit is used to divide the fixed-length byte sequence into several time intervals, introduce corresponding anchor nodes, and connect the byte nodes in the intervals to the anchors, injecting absolute / relative position information into the header and load graphs to obtain the header and load graphs enhanced by time anchors. The graph encoding and classification decision unit is used to encode the constructed time-anchor byte graph on the header and load graphs after time-anchor enhancement using a small-scale GraphSAGE to obtain packet-level vectors. The encrypted traffic category is determined by a simplified classification header, and flow-level decision can be achieved through multi-packet aggregation.

10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute the lightweight encrypted traffic classification method based on time-anchor graph representation as described in any one of claims 1 to 8.

Images