Network flow self-enhancement reasoning method based on multi-view semantic decoupling and dual consistency verification

Abstract

The network flow self-enhancement reasoning method based on multi-view semantic decoupling and dual consistency verification comprises the following steps: reconstructing original one-dimensional flow data into a multi-semantic view to form an original data set; original data are extracted and input into the non-reasoning large model, reasoning chains and answers of questions constructed by the original data are generated, and a prompt set is formed; constructing training samples based on the residual original data and the prompt set, generating a reasoning chain and a prediction answer by using the reasoning large model of the round, screening the training samples which are reasoned correctly, and constructing a confusion matrix; screening high-confusion samples from the training samples inferred wrongly based on the confusion matrix, generating reverse reasoning samples, and screening reverse reasoning correct samples; performing dual consistency verification on the correct sample to obtain a correct data set; and performing fine tuning training on the initial reasoning large model by using the correct data set, performing fine tuning on the model to serve as a next round of reasoning large model, and repeatedly performing iterative optimization to update the initial reasoning large model until convergence.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to a network traffic self-enhancing reasoning method based on multi-view semantic decoupling and dual consistency verification. Background Technology

[0002] In the field of cybersecurity, network traffic analysis is a key technology for threat detection, abnormal behavior identification, and network management, and its effectiveness is directly related to the ability to adapt to dynamic network environments. With the increasing diversification of network attack methods and the homogenization of application services (such as streaming media and social applications distributed via CDN), the demand for efficient, accurate, and interpretable traffic analysis tools is becoming increasingly urgent.

[0003] With the continuous evolution of network applications, more and more applications are adopting encrypted communication methods, especially HTTPS, based on TLS, which has become the mainstream transmission method. Different applications reuse the same ports and protocols at the network and transport layers, resulting in highly homogenized network traffic characteristics at the surface level. Traditional analysis methods relying on port numbers, plaintext payloads, or simple statistical features are gradually becoming ineffective in practical applications. While reasoning-based large language models have certain advantages in complex pattern modeling, their application in network traffic analysis tasks typically relies on high-quality inference datasets to ensure the reliability of inference results. Furthermore, network traffic analysis has a very high professional threshold; constructing a high-quality dataset covering tens of thousands of "input-inference-label" data points requires significant expert human resources. Although Self-Taught Reasoner (STaR) can automatically construct inference datasets to some extent by combining a small number of inference examples with a large amount of non-inference data, it still does not meet the needs of complex network traffic analysis scenarios.

[0004] Self-enhancing inference methods are not designed for the structural characteristics of network traffic data, lack specific handling for input structure, inference logic reliability, and obfuscated traffic scenarios. Directly applying them to network traffic analysis tasks mainly leads to the following three problems:

[0005] Flattened input leads to attention diffusion: Existing methods typically use network traffic data (such as JSON or hexadecimal text) parsed by packet capture tools directly as flattened text input to the model. Since network traffic itself has a clear protocol hierarchy, features at different levels differ significantly in semantics and importance. Flattening causes a large number of irrelevant or random features to mix with key discriminative features, making it difficult for the model to focus on effective information when processing long sequence inputs, thereby reducing inference accuracy.

[0006] Insufficient differentiation capability in encrypted and obfuscated traffic scenarios: In encrypted communication scenarios, different applications often use the same transmission protocols and port numbers. Traditional forward reasoning methods tend to rely on common features for judgment, making it difficult to differentiate based on fine-grained differences. Existing large-scale traffic analysis methods mainly adopt "forward reasoning" logic (i.e., "because of feature A, it is category B"). When faced with obfuscated traffic with highly similar header features, existing methods tend to over-rely on highly common features such as port numbers during the reasoning process, leading to misjudgments in scenarios where different applications reuse the same port. The lack of ability to utilize micro-level side-channel features (such as packet length distribution and throughput patterns) for exclusive verification results in an extremely high misjudgment rate for obfuscated categories.

[0007] Unreliable inference results and difficulty in obtaining high-quality inference data: Large models inherently carry the risk of "illusions." In traffic analysis, this manifests as "factual illusions" (fabricating payload fingerprints that do not exist in the original data packets) and "logical pseudo-correlation" (guessing the correct label based on incorrect features), meaning the model may reference features that do not exist in the original data or draw correct conclusions based on non-causal relationships. Summary of the Invention

[0008] To address the problems of mismatch between input structure and traffic semantics, insufficient ability to distinguish encrypted and obfuscated traffic, and lack of verifiability in the reasoning process in existing self-learning reasoning methods in network traffic analysis scenarios, the purpose of this invention is to provide a network traffic self-enhancing reasoning method based on multi-view semantic decoupling and dual consistency verification.

[0009] This invention provides a network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification, comprising:

[0010] Step 1: Employ multi-view semantic decoupling to reconstruct the original one-dimensional traffic data into a logically orthogonal header semantic view, statistical semantic view, and load semantic view, thereby forming the original dataset through multiple semantic views;

[0011] Step 2: Extract p raw data points and input them into the non-reasoning large model to generate the reasoning chain and answer to the question constructed from the raw data, forming a hint set;

[0012] Step 3: Construct training samples based on the remaining original data and the hint set, use the reasoning model of this round to generate reasoning chains and predicted answers, filter training samples with correct reasoning, and construct a confusion matrix based on the frequency of the real answer being predicted as the corresponding answer;

[0013] Step 4: Based on the confusion matrix, select highly confused samples from the training samples with inference errors and generate reverse inference samples. Select correctable training samples from the reverse inference samples as correct reverse inference samples.

[0014] Step 5: Perform double consistency checks on the training samples with correct inference and the samples with correct reverse inference to obtain the correct dataset for this round;

[0015] Step 6: Use the correct dataset from this round to fine-tune the initial inference model. Use the fine-tuned model as the inference model for the next round. Repeat steps 3-6 to iteratively optimize and update the initial inference model until convergence.

[0016] The network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification of the present invention has the following beneficial effects:

[0017] This invention addresses the problem of existing methods directly using network traffic parsing results as flattened text input and ignoring protocol layers and semantic differences. Based on the concept of self-enhancing inference, it proposes a multi-view semantic decoupling mechanism for network traffic analysis scenarios. This mechanism reconstructs the original one-dimensional network traffic data into logically orthogonal multi-semantic view representations such as a header semantic view, a statistical semantic view, and a payload semantic view. Through this approach, traffic fields with different protocol layers and functional attributes are explicitly assigned to corresponding semantic views. This enables the inference model to distinguish the semantic roles and importance of features at different levels under complex traffic input conditions, thereby effectively improving the stability and accuracy of inference in long-sequence input scenarios.

[0018] To address the issue of high homogeneity and potential for misclassification among different applications at the transport and network layers in encrypted communication scenarios, this invention introduces a confusion matrix-driven reverse inference sample generation mechanism into the self-enhancing inference process. By statistically analyzing the frequency of true labels being incorrectly predicted as other categories, a confusion matrix between categories is constructed. Based on this matrix, highly confused samples are selected to generate reverse inference samples. This allows the model to distinguish similar application traffic from an exclusive perspective during the self-enhancing inference process, thereby reducing the misclassification rate in encrypted and confused traffic scenarios.

[0019] To address the issues of reasoning illusions and logical pseudo-correlation that commonly arise in general self-reinforcing reasoning methods in specialized fields, this invention further incorporates the structural characteristics of network traffic data and designs a dual consistency verification mechanism. This mechanism filters the reasoning process from both factual consistency and causal consistency perspectives, thereby preventing unreliable reasoning samples from entering the model's self-reinforcing training process and improving the credibility and interpretability of the reasoning data.

[0020] With the combined effect of the above-mentioned improvement mechanisms, this invention can automatically construct a high-quality "input-reasoning process-label" training sample set suitable for network traffic analysis scenarios with only a small number of initial inference examples. This significantly reduces the dependence on human experts to annotate inference data, enabling large inference models to achieve stable and autonomous inference capabilities in the highly specialized field of network security. Attached Figure Description

[0021] Figure 1 This is a flowchart of the network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification of the present invention;

[0022] Figure 2 This is a comparison chart of the accuracy iteration results for different models. Detailed Implementation

[0023] To address the issues of inference failure, attention distraction, and ineffective computation caused by the mismatch between the input structure and the inherent hierarchical semantics of network traffic when directly processing raw network traffic data in reasoning-oriented large language models, this invention first proposes a multi-view semantic decoupling technique for the reasoning process. Based on the objective fact that network traffic data follows the OSI hierarchical model and possesses highly structured characteristics, this scheme reconstructs the original one-dimensional traffic data into a multi-view input representation that conforms to the evidence organization and attention allocation logic of the inference model through pre-defined semantic decoupling rules. This provides an inference-aligned input foundation for subsequent inference generation and prediction.

[0024] like Figure 1 As shown, the network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification of the present invention includes:

[0025] Step 1: Employing multi-view semantic decoupling, the original one-dimensional traffic data is reconstructed into logically orthogonal header semantic views, statistical semantic views, and load semantic views. The original dataset is then constructed using these multiple semantic views. Specifically:

[0026] Step 1.1: Extract, name uniformly, and standardize the format of the raw one-dimensional traffic data samples from different data acquisition tools or protocol parsing results according to predefined field normalization rules, and clarify the semantic source of each field. The field normalization rules are used to describe the correspondence between semantically equivalent fields in the parsing results of different data acquisition tools or protocols. They are predefined in the form of mapping tables or rule configurations and remain consistent throughout the self-enhancing inference process.

[0027] Step 1.2: After completing the field normalization process, the system uniquely assigns each field to one of the following semantic views: header semantic view, statistical semantic view, or payload semantic view, based on the field's protocol level, generation stage, and semantic function attributes, in order to avoid field overlap and semantic ambiguity between different semantic views.

[0028]

[0029] Where x is the original one-dimensional flow data sample, For the header semantic view, For statistical semantic views, This is a semantic view of the load.

[0030] Specifically, the header semantic view mentioned in step 1.2 is used to describe the protocol identity and connection negotiation attributes of the traffic, and its construction follows the following rules:

[0031] (1) Field selection rules: Only fields directly related to connection identity, protocol type, and handshake negotiation are retained, and the field set is limited to:

[0032] Network layer and transport layer protocol types, source port numbers and destination port numbers; connection state identifiers and TCP flag summary information; negotiation metadata generated during the encryption protocol handshake phase, including the protocol version number of TLS or QUIC, server name indication, application layer protocol negotiation results and client fingerprint identifier.

[0033] (2) High-Volatility Field Removal Rules: To avoid introducing fields that are strongly bound to specific communication instances and are highly unstable between different sessions, the following types of fields are explicitly removed in the header semantic view:

[0034] Status fields that change dynamically with data packet interaction during connection establishment include source IP address, destination IP address, sequence number, and acknowledgment number.

[0035] Random fields that are dynamically generated by the protocol implementation or the session process and do not have stable semantics include random numbers, session identifiers, and original timestamp values.

[0036] (3) Standardization and default filling rules: string fields are case-consistent and length is truncated; missing fields are filled with predefined placeholders to ensure the stability of the view structure.

[0037] The header semantic view constructed through this implementation method can stably represent the protocol form and connection identity characteristics of communication, providing low-noise and highly stable semantic clues for the inference model, so that it can still maintain discrimination consistency in port reuse or address drift scenarios.

[0038] Specifically, in step 1.2, the statistical view is used to describe the behavioral side-channel characteristics of traffic within a given time window; the behavioral side-channel characteristics refer to the statistical characteristics reflected only by the external behavioral patterns of data packet arrival time, data size, and interaction direction without parsing the communication content or protocol semantics; the time window is the start and end time of a single traffic session.

[0039] The statistical feature extraction rule is as follows: calculate the following statistical fields within the time window.

[0040] Traffic duration, uplink and downlink byte counts and their ratio; mean, variance, quantiles and extreme values ​​of packet length; statistical characteristics of the arrival time interval between adjacent data packets; average throughput and peak throughput; sequence shape discretization results, wherein the sequence shape discretization is a bucket quantization of the length sequence.

[0041] Specifically, step 1.2, the payload semantic view, is used to describe interpretable content-layer semantic cues in the traffic, and its construction follows strict noise reduction principles:

[0042] (1) Protocol awareness rule: Determine whether the traffic type contains a parsable plaintext application layer protocol.

[0043] If it is a plaintext application layer protocol, only a limited set of application layer fields directly related to the request type and service identifier are extracted. These fields do not contain request parameters or specific business content. If it is an encrypted protocol, the encrypted application data content is not introduced. Only the interpretable structural features defined by the protocol specification and presented in a clearly defined format in the handshake or record layer are retained.

[0044] (2) High-entropy load suppression rule: For binary load data that is highly random and lacks a stable semantic structure, its original byte representation is not directly introduced. Instead, it is represented by structural markers or placeholders to avoid introducing uninterpretable information and inducing the model to generate fictitious semantics in the subsequent reasoning process.

[0045] (3) Desensitization and truncation rules: For the extracted string content, this invention desensitizes the parts that may contain user identifiers, session identifiers or other unique information, and truncates the string length to prevent the introduction of privacy-related information and noise amplification effect caused by content redundancy.

[0046] The payload semantic view constructed according to the above rules is used to provide auxiliary semantic clues at the content level to the inference model, while avoiding invalid analysis or factual illusions by the model for encrypted garbled text.

[0047] Step 1.3: The unified naming results of the above fields and their corresponding semantic view affiliations are organized into an indexable field mapping structure to record the field name, semantic source and the semantic view to which it belongs, and serve as the basis for feature localization and verification in the subsequent inference generation and consistency verification stages.

[0048] Step 2: Extract p original data points and input them into the non-reasoning large model to generate the reasoning chain and answer to the problem constructed from the original data, forming a hint set.

[0049] Step 3: Construct training samples based on the remaining original data and the hint set. Use the large-scale reasoning model of this round to generate reasoning chains and predicted answers. Filter the training samples with correct reasoning and construct a confusion matrix based on the frequency of the actual answer being predicted as the corresponding answer. Specifically:

[0050] Step 3.1: Set the hints The problem constructed with the remaining original data Piecing together to obtain a training book Where D is the size of the original dataset. Constituting the first A sample prompt, This is an example question. This is an example inference chain. This is the example answer.

[0051] Hint set It contains p hint samples, which are used to prompt the inference model to prioritize the generation of inference chains and then generate predicted answers by using the inference patterns in the hint set. This allows the model to prioritize the use of the inference patterns in the hint set during the inference process.

[0052] Step 3.2: Input the training samples into the large-scale inference model for this round. The large-scale inference model for this round uses the inference patterns in the prompt set to prioritize the generation of the current question. The reasoning chain and the predicted answer.

[0053] The remaining raw data input in each iteration of inference generation is exactly the same. Except for the first iteration which uses the initial large model M0, the inference model used for inference generation in each iteration is the model M after fine-tuning in the previous round. n-1 .

[0054] Step 3.3: If This indicates the training sample If the predicted answer is correct, that is, if the reasoning is correct, then... This indicates the training sample The predicted answer is incorrect, i.e., the reasoning is flawed; For the question The predicted answer, For the question The real answer.

[0055] Step 3.4: Construct a two-dimensional confusion matrix The row index represents the true answer of the training sample, the column index represents the predicted answer output by the large inference model, and the matrix element represents the frequency with which the true answer is predicted as the corresponding answer.

[0056]

[0057] in, In the question The real answer is Under the given conditions, the predicted answer is The probability; K is the total number of answers; The true answer is The predicted answer is The number of input samples; Represents the confusion matrix of the first... The total number of training samples in the row.

[0058] During each round of inference generation, the confusion matrix is ​​statistically analyzed and updated based on the prediction results output by the large inference model, thereby limiting the possibility of obtaining confusing inference results on similar inputs. In each iterative inference generation phase, the system statistically analyzes and constructs a new confusion matrix based on the current round's inference output results to replace the previous round's confusion matrix, rather than accumulating historical statistics. This ensures that the confusion matrix reflects the latest confusion relationships of the current inference model across application categories in real time, providing an accurate basis for ambiguity-driven reverse inference.

[0059] Step 4: Based on the confusion matrix, select highly confused samples from the training samples with inference errors and generate reverse inference samples. Select correctable training samples from the reverse inference samples as correct reverse inference samples.

[0060] This step aims to address the common inference failure problem in the network traffic domain, characterized by "reused encryption protocols and consistent ports with only slight differences in application behavior." It constructs an ambiguity-driven comparative reverse inference mechanism. By prompting the correct labels of erroneous inference samples and their easily confused inputs, it corrects the erroneous inference paths of the large language model in highly similar traffic scenarios, thereby enhancing its domain discrimination ability and improving data utilization. If the inference generates a result... Then, a reverse reasoning process relying on the confusion matrix is ​​needed to prompt the correct answer and easily confused labels to regenerate the answer, and the results generated by the reverse reasoning need to be filtered. Specifically:

[0061] Step 4.1: Identify the off-diagonal elements in the confusion matrix that exceed a preset threshold T. This off-diagonal element The corresponding real answer and predicted answers Defined as a high-frequency ambiguous answer pair ,in The settings are dynamically adjusted based on the dataset size, and the recognition results are stored in list format. i The construction method is as follows:

[0062]

[0063] Step 4.2: Define training samples that can form high-frequency ambiguous answer pairs between real and predicted answers as high-confusion samples.

[0064] Step 4.3: Based on the confusion matrix, add hints for the correct and confused answers to questions in highly confused samples to generate reverse reasoning samples; among them, for pairs of answers with the same high frequency of ambiguity... Highly confused samples generate the same reverse inference samples.

[0065] In practice, the reverse reasoning samples are presented in the form of a structured template, as follows:

[0066] [Example 1 of the hint set (QRA)]

[0067] [Example 2 of the hint set (QRA)] ...

[0069] [Example of a hint set p (QRA)]

[0070] Given the flow input x: [insert multi-view structured input V(x)]; and the known real-world application category as [real answer y]; please generate the inference process and complete the following extended task:

[0071] (1) List the key feature evidence that supports the answer [true answer y], prioritizing from the statistical semantic view V. stat and Head Semantic View V head Extract from;

[0072] (2) For the confused answer [confusing answer ŷ], clearly point out the differential feature basis for rejecting it, and explain why these features do not support [confusing answer ŷ] but support [true answer y]; Output format: inference chain r + final predicted answer.

[0073] The content of [True Answer y] should be filled in according to the specific highly confusing sample; in extended task (2), [Confusion Label ŷ] is a list. i The results are obtained by iterating through the loop; extended tasks (1) and (2) are prompt texts.

[0074] Step 4.4: Input the reverse reasoning sample into the large-scale reasoning model of this round to perform reverse reasoning and obtain a new reasoning chain. and predicted answers .

[0075] Step 4.5: If Then the reverse inference sample is considered a correctable training sample; if The reverse reasoning sample is then considered uncorrectable and discarded.

[0076] Step 4.6: Remove the suggestive text from the correctable training sample questions, generate correct reverse reasoning samples, and preserve their reasoning chains. .

[0077] Step 5: Perform double consistency checks on the training samples with correct inference and the samples with correct reverse inference to obtain the correct dataset for this round.

[0078] This step serves as a quality control checkpoint for the entire process, further screening the correct samples in the reasoning generation and reverse reasoning stages. It ensures that the data entering the model fine-tuning stage simultaneously satisfies the correctness of the reasoning conclusions, the authenticity of the reasoning basis, and the causal validity of the reasoning logic, thereby preventing the model from learning false facts or pseudo-related reasoning paths in subsequent iterations.

[0079] In practice, a dual consistency check is performed on both the correctly reasoned training samples and the correctly reasoned reverse samples. This includes two sequentially executed check steps: semantic consistency backtracking check and causal consistency ablation check. Only when a sample passes both checks simultaneously is it considered a valid reasoning sample and added to the correct dataset for this round. Specifically:

[0080] Step 5.1: Collect the training samples with correct reasoning and the samples with correct reverse reasoning as the correct samples. Perform text parsing on the reasoning chain of the correct samples to automatically extract a set of verifiable feature assertions F:

[0081]

[0082] Each feature assertion Represented in structured form as triples:

[0083]

[0084] in, Indicates the name of the traffic feature field that is explicitly referenced in the inference chain. This indicates the judgment relationship made by the large-scale inference model in this round regarding the traffic characteristic fields; The assertion value represents the specific value or range of values ​​given by the current inference model for the traffic feature field.

[0085] The feature assertion extraction process follows these constraints:

[0086] (1) Field constraint rules:

[0087] The Only field mapping structures formed during the multi-view semantic decoupling process in step 1 are allowed to be selected, ensuring that each feature assertion can be uniquely located to an explicit field in the head semantic view, statistical semantic view, or payload semantic view.

[0088] (2) Relationship constraint rules:

[0089] The Take a predefined set of relations, including equal to, not equal to, greater than, less than, range inclusion, and category matching relations, to ensure the standardization and verifiability of the assertion form.

[0090] (3) Value normalization rules:

[0091] The The format is standardized according to the data type of the corresponding field, where numeric fields are represented by numbers or ranges, and enumeration or string fields are represented by standardized identifiers.

[0092] The feature assertion set F extracted in the above manner constitutes the smallest inference evidence unit that can be verified item by item in the subsequent semantic consistency backtracking verification.

[0093] Step 5.2: Based on the preset field mapping structure, perform a deterministic view positioning operation for each feature assertion.

[0094] First, let's look at the traffic characteristic field names. As an index, the corresponding semantic view attribution is queried in the field mapping structure to obtain a unique target view. :

[0095]

[0096] The field mapping structure explicitly records the unified name, semantic source, and semantic view to which each field belongs, and each field is only allowed to belong to one semantic view to ensure the uniqueness of the mapping result; based on this, the feature assertion... Mapping to the corresponding multi-view input data to form assertion-view pairs:

[0097]

[0098] By using the backtracking mapping method based on the field mapping structure described above, view determination based on semantic inference or human experience is avoided, thereby ensuring the determinism, reproducibility, and consistency of the assertion mapping process in different implementation environments.

[0099] Step 5.3: Assert for each feature that has completed the mapping. Perform the following semantic consistency backtracking check.

[0100] Field existence check: If the assertion does not exist in the target semantic view or there is no corresponding record in the field mapping structure, the assertion is determined to be inconsistent.

[0101] Value consistency verification: For numerical assertions, compare the assertion value with the original view feature value. If the deviation exceeds the preset tolerance threshold, it is determined to be inconsistent. The tolerance threshold is preset according to the data type, statistical scale or normalization method of the field and recorded in the field mapping structure.

[0102] For enumeration or string assertions, the assertion value must exactly match the original view feature value.

[0103] Assertion coverage verification: Calculate the ratio of the number of consistent assertions in the correct sample to the total number of assertions. If the ratio is not lower than a preset threshold, the correct sample passes the semantic consistency backtracking verification; otherwise, the semantic consistency verification of the correct sample fails and the correct sample is directly removed.

[0104] Semantic consistency backtracking verification is used to detect whether the reasoning process generated by the inference model is strictly based on the real feature information in the input traffic data, and to prevent the model from generating factual illusions during the reasoning process.

[0105] Step 5.4: Assert for any feature Based on the field mapping structure, the set of key causal views corresponding to the feature assertion set of the current inference chain is obtained. :

[0106]

[0107] The key causal view set This indicates that all semantic view types used by the model to support its prediction conclusions in the current inference chain serve as the basis for constructing view-level counterfactuals in subsequent causal ablation verification. If no key semantic view is explicitly specified in the inference chain, K is assumed to be an empty set, and the correct sample is marked as a weakly causal correct sample and fails the verification.

[0108] Step 5.5: For the identified key semantic view set K, construct the corresponding counterfactual input question x′ for the questions in the correct samples; specifically, perform the following semantic invalidation operation on each semantic view in K.

[0109] For each view identified as a key view Perform view-level semantic ablation while leaving non-critical views unchanged. The counterfactual input problem is formally represented as follows:

[0110]

[0111] Here, Ablate(·) is a predefined view-level semantic invalidation function, the specific implementation of which includes:

[0112] Header semantic view ablation: Replace protocol type, port number, negotiation fields, etc. with neutral placeholders or uniform default values ​​to eliminate their distinguishing ability.

[0113] Statistical semantic view ablation: Randomly rearrange, mean-normalize, or disturb the statistical feature vectors to make them lose their stable discrimination patterns.

[0114] Payload semantic view ablation: Masks or truncates content structure features, retaining only format placeholder information.

[0115] The ablation operation described above selectively destroys key information that the model claims to have a causal role, while maintaining the consistency of the overall input structure, thereby constructing counterfactual input samples that change only in the "causal evidence".

[0116] Step 5.6: Input counterfactual information into question x′ and the hint set. The inference chain is then regenerated by concatenating the inference data and inputting it into the larger inference model for this round, resulting in a new predicted answer.

[0117] Step 5.7: If the new predicted answer is inconsistent with the true answer, and the key view identified in the original inference process has a real causal contribution to the prediction result, then the correct sample passes the causal consistency ablation test; otherwise, if the model still outputs the same prediction result and the inference process remains stable when the key view is ablated, then the original inference is determined to depend on non-causal pseudo-correlation features, and the correct sample is determined to be a causal inconsistent sample and is removed.

[0118] Step 6: Use the correct dataset from this round to fine-tune the initial inference model. Use the fine-tuned model as the inference model for the next round. Repeat steps 3-6 to iteratively optimize and update the initial inference model until convergence.

[0119] In practice, the initial inference model is fine-tuned using the correct dataset from this round. A multi-task loss function is employed for fine-tuning, as shown in the following formula:

[0120]

[0121] in, To predict the answer, The cross-entropy loss generated for the inference chain uses sequence-level cross-entropy loss to constrain the model input. Under the condition of generating the inference chain The probability of is expressed by the following formula:

[0122]

[0123] in, Indicating the first inference path One generating unit, The total length of the reasoning path is the length of the generated reasoning chain; Indicates the first inference path generated Before each generation unit, the preceding content of all generated inference paths;

[0124] To apply the label prediction cross-entropy loss, standard cross-entropy loss is used to optimize the model's prediction of the answer. To ensure classification accuracy and guarantee that the endpoint of the reasoning chain points to the correct judgment result, the formula uses the form of cross-entropy:

[0125]

[0126] in, For the predefined total number of answers, For indicator functions, These are weighting parameters used to balance two different loss terms in the multi-task loss function;

[0127] The termination condition is as follows: if the inference classification accuracy improvement is less than a set threshold A1 and the inference rule compliance rate is greater than A2 in two consecutive iterations, the iteration is considered converged, and the self-reinforcing inference process is terminated; otherwise, the inference model fine-tuned in this round is used as the inference model generated in the next round of inference for the next iteration. Final output: After iteration termination, the final comprehensive training dataset is output. With Enhanced Reasoning Model .

[0128] Example

[0129] This invention uses the APP-53 dataset as the traffic data source. The training set of this dataset contains 100,000 network traffic data points, representing 53 different app types with even distribution. The foundation model is TrafficLLM, a non-inference-based large language model specifically for network traffic (this model has achieved over 93% accuracy on the APP-53 dataset). Hints are added to the traffic data in APP-53, carrying the correct answer, prompting TrafficLLM to perform the inference process and output the results. This ultimately yields a set of 1000 hints (approximately 1% of the total APP-53 dataset) with complete inference logic, covering all application tags. This hint set requires minimal manual verification but no large-scale manual annotation.

[0130] Each sample in the hint set is uniformly formatted as "example question - example inference chain - example answer". To ensure the consistency of example questions obtained in the inference generation step of the DC-STaR method of this invention, the original data corresponding to the example questions is in the form of a multi-semantic view obtained after multi-view semantic decoupling processing of the APP-53 dataset. Since TrafficLLM has a small number of parameters, its generated inference chain is not subject to double consistency verification.

[0131] Any open-source inference language model can be used as the initial inference model for subsequent iterative inference enhancement. In this embodiment, the DeepSeek-R1-Distill-Qwen-7B model is used as the initial inference model. This model is a Transformer model based on the Qwen2.5 architecture, with 7 billion parameters, and is distilled from the DeepSeek-R1 model. This model is optimized for language understanding, inference, and text generation use cases, and outperforms many open-source chat models on common industry benchmarks.

[0132] During model fine-tuning training, α=0.7 (this value was chosen based on experimental optimization to prioritize enhancing the quality of inference generation; experiments show that α=0.7 improves the inference rule compliance rate by approximately 5%). Training parameters are set according to model size and hardware resources, and a gradually decaying learning rate adjustment strategy is adopted to ensure the stability of the training process. In this experiment, the initial learning rate is 1e-5 (gradual decay strategy: decaying by 10% after each epoch, minimum learning rate 1e-7). Gradient clipping is enabled (clipping threshold = 1.0) to prevent gradient explosion. If, in two consecutive iterations, the inference classification accuracy improves by ≤0.5% and the inference rule compliance rate is ≥95%, the iteration is considered converged, and the self-enhancing inference process is terminated. The above parameter values ​​are only one experimental implementation example and do not constitute a limitation on the technical solution of this invention.

[0133] Finally, the output is a comprehensive training dataset. It contains 90,000 APP-53 traffic samples with high-quality inference chains, and the inference step completeness is 99%; the output enhanced inference model The model achieves a classification accuracy significantly higher than the baseline model on the test dataset and outputs an enhanced reasoning big language model adapted to the network traffic domain. This model can generate traceable, verifiable reasoning processes with causal constraints for encrypted network traffic samples, indicating that the general reasoning big language model has been successfully adapted to the network traffic analysis domain.

[0134] Using the App-53 dataset as input, this paper compares the proposed DC-STaR method with the TrafficLLM baseline model, the self-enhancing inference method (STaR), the STaR+CAV method which only introduces double consistency verification, and the STaR+DCORE method which only introduces confusion matrix to drive backward inference. Figure 2 The results show the classification accuracy of different methods as a function of iteration rounds in the self-enhancing iterative process.

[0135] Experimental results show that the TrafficLLM baseline model achieves a classification accuracy of approximately 93.25% on the App-53 dataset (light blue horizontal line). In contrast, the STaR method gradually improves model performance during self-boosting training, ultimately resulting in an accuracy improvement of about 1 percentage point compared to the baseline model. However, its convergence speed is relatively slow, reaching a stable state after approximately 16 iterations.

[0136] After introducing a dual consistency check mechanism (STaR+CAV) into the STaR framework, the model can achieve higher classification accuracy in fewer iterations, with the final accuracy stabilizing at about 96%, and the overall convergence speed is significantly faster than the STaR method.

[0137] Furthermore, the model employing the ambiguity-driven contrastive inverse reasoning mechanism (STaR+DCORE) shows a faster performance improvement trend in the early iteration stages and achieves an accuracy level comparable to or even higher than STaR+CAV in fewer iterations.

[0138] Ultimately, the DC-STaR method, which integrates DCORE and CAV, consistently achieved the best performance throughout the self-enhancing training process. Its classification accuracy tended to stabilize after the 8th–10th iteration, ultimately improving by about 3–5 percentage points compared to the TrafficLLM baseline model, and remained stable in subsequent iterations, indicating that the model had fully converged.

[0139] Table 1

[0140]

[0141] Table 1 presents the classification performance comparison results of different methods under the same experimental conditions on the App-53 dataset, including accuracy, recall, F1 score, and the proportion of effective data used during training.

[0142] As shown in the table, the TrafficLLM baseline model achieves a classification accuracy of 93.25% without introducing the self-enhancing inference mechanism, serving as a benchmark for subsequent methods. After introducing the self-enhancing inference mechanism, the STaR method improves the classification accuracy to 94.26% using approximately 87.1% of the training data, while also improving Recall and F1 scores.

[0143] After further introducing the dual consistency verification mechanism (STaR+CAV) into the STaR framework, the classification accuracy of the model increased to 95.53% when the proportion of data used was reduced to 85.2%, indicating that screening high-quality inference samples through consistency verification helps to improve the overall classification performance while reducing the scale of training data.

[0144] The model that only introduces the confusion matrix-driven reverse inference mechanism (STaR+DCORE) achieves further improvement in classification performance, with its accuracy, recall and F1 scores reaching 96.14%, 95.67% and 95.44% respectively, showing that the method has a stronger ability to distinguish between similar application traffic.

[0145] Ultimately, the DC-STaR method, which integrates DCORE and CAV, achieved the best results across all metrics, with a classification accuracy of 97.32%, and recall and F1 scores improved to 96.84% and 96.60%, respectively. Furthermore, DC-STaR achieves these performance levels using approximately 90.2% of the training data, demonstrating that the proposed method improves classification accuracy while also achieving higher data utilization efficiency.

[0146] As can be seen from the experimental results in Table 1, the DC-STaR method proposed in this invention can simultaneously improve classification performance and reduce the proportion of effective training data without the need for additional manual annotation, thus verifying the effectiveness and stability of the method in complex encrypted network traffic analysis scenarios.

[0147] The above description is only a preferred embodiment of the present invention and is not intended to limit the ideas of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A network traffic self-enhancing reasoning method based on multi-view semantic decoupling and dual consistency verification, characterized in that, include: Step 1: Employ multi-view semantic decoupling to reconstruct the original one-dimensional traffic data into a logically orthogonal header semantic view, statistical semantic view, and load semantic view, thereby forming the original dataset through multiple semantic views; Step 2: Extract p raw data points and input them into the non-reasoning large model to generate the reasoning chain and answer to the question constructed from the raw data, forming a hint set; Step 3: Construct training samples based on the remaining original data and the hint set, use the reasoning model of this round to generate reasoning chains and predicted answers, filter training samples with correct reasoning, and construct a confusion matrix based on the frequency of the real answer being predicted as the corresponding answer; Step 4: Based on the confusion matrix, select highly confused samples from the training samples with inference errors and generate reverse inference samples. Select correctable training samples from the reverse inference samples as correct reverse inference samples. Step 5: Perform double consistency checks on the training samples with correct inference and the samples with correct reverse inference to obtain the correct dataset for this round; Step 6: Use the correct dataset from this round to fine-tune the initial inference model. Use the fine-tuned model as the inference model for the next round. Repeat steps 3 to 6 to iteratively optimize and update the initial inference model until the termination condition is met.

2. The network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification according to claim 1, characterized in that, Step 1 specifically involves: Step 1.1: Extract, name uniformly and standardize the format of the original one-dimensional traffic data samples from different acquisition tools or protocol parsing results according to predefined field normalization rules, and clarify the semantic source of each field; the field normalization rules are used to describe the correspondence between semantically equivalent fields in different acquisition tools or protocol parsing results, and are predefined in the form of mapping tables or rule configurations, and are kept consistent throughout the self-enhancing inference process; Step 1.2: After completing the field normalization process, the system uniquely assigns each field to one of the following semantic views: header semantic view, statistical semantic view, or payload semantic view, based on the field's protocol level, generation stage, and semantic function attributes, in order to avoid field overlap and semantic ambiguity between different semantic views. Where x is the original one-dimensional flow data sample, For the header semantic view, For statistical semantic views, For the load semantic view; Step 1.3: The unified naming results of the above fields and their corresponding semantic view affiliations are organized into an indexable field mapping structure to record the field name, semantic source and the semantic view to which it belongs, and serve as the basis for feature localization and verification in the subsequent inference generation and consistency verification stages.

3. The network traffic self-enhancing reasoning method based on multi-view semantic decoupling and dual consistency verification according to claim 2, characterized in that, The header semantic view mentioned in step 1.2 is used to describe the protocol identity and connection negotiation attributes of the traffic, and its construction follows the following rules: (1) Field selection rules: Only fields directly related to connection identity, protocol type, and handshake negotiation are retained, and the field set is limited to: Network layer and transport layer protocol types, source port numbers, and destination port numbers; connection state identifiers and TCP flag summary information; negotiation metadata generated during the encryption protocol handshake phase, including the protocol version number of TLS or QUIC, server name indication, application layer protocol negotiation results, and client fingerprint identifier; (2) High-Volatility Field Removal Rules: To avoid introducing fields that are strongly bound to specific communication instances and are highly unstable between different sessions, the following types of fields are explicitly removed in the header semantic view: Status fields that change dynamically with the exchange of data packets during the connection establishment process include source IP address, destination IP address, sequence number, and acknowledgment number; Random fields that are dynamically generated by the protocol implementation or the session process and do not have stable semantics include random numbers, session identifiers and original timestamp values; (3) Normalization and default filling rules: Standardize the case and truncate the length of string fields; Missing fields are filled with predefined placeholders to ensure the stability of the view structure.

4. The network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification according to claim 2, characterized in that, In step 1.2, the statistical view is used to describe the behavioral side-channel characteristics of traffic within a given time window; the behavioral side-channel characteristics refer to the statistical characteristics reflected only by the external behavioral patterns of data packet arrival time, data size, and interaction direction without parsing the communication content or protocol semantics. The time window is the start and end time of a single traffic session; The statistical feature extraction rule is as follows: Calculate the following statistical fields within the time window: Traffic duration, uplink and downlink byte counts and their ratio; mean, variance, quantiles and extreme values ​​of packet length; statistical characteristics of the arrival time interval between adjacent data packets; average throughput and peak throughput; sequence shape discretization results, wherein the sequence shape discretization is a bucket quantization of the length sequence.

5. The network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification according to claim 2, characterized in that, Step 1.2, the payload semantic view, is used to describe interpretable content-layer semantic cues in the traffic, and its construction follows strict noise reduction principles: (1) Protocol awareness rules: Determine whether the traffic contains a parsable plaintext application layer protocol based on the traffic type; If it is a plaintext application layer protocol, only a limited set of application layer fields directly related to the request type and service identifier are extracted. These fields do not contain request parameters or specific business content. If it is an encrypted protocol, the encrypted application data content is not introduced. Only the interpretable structural features defined by the protocol specification and presented in a clearly defined format in the handshake or record layer are retained. (2) High-entropy load suppression rule: For binary load data that exhibits high randomness and lacks stable semantic structure, its original byte representation is not directly introduced. Instead, it is represented by structural markers or placeholders to avoid introducing uninterpretable information and inducing the model to generate fictitious semantics in subsequent reasoning. (3) Desensitization and truncation rules: For the extracted string content, this invention desensitizes the parts that may contain user identifiers, session identifiers or other unique information, and truncates the string length to prevent the introduction of privacy-related information and noise amplification effect caused by content redundancy.

6. The network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification according to claim 1, characterized in that, Step 3 specifically involves: Step 3.1: Set the hints Problems with the remaining original data Training samples are obtained by splicing. Where D is the size of the original dataset. Constituting the first A sample prompt, This is an example question. This is an example inference chain. This is the example answer; Step 3.2: Input the training samples into the large-scale inference model for this round. The large-scale inference model for this round uses the inference patterns in the prompt set to prioritize the generation of the current question. The reasoning chain and predicted answer; Step 3.3: If This indicates the training sample If the predicted answer is correct, that is, if the reasoning is correct, then... This indicates the training sample The predicted answer is incorrect, i.e., the reasoning is flawed; For the question The predicted answer, For the question The real answer; Step 3.4: Construct a two-dimensional confusion matrix The row index represents the true answer of the training sample, the column index represents the predicted answer output by the large inference model, and the matrix element represents the frequency with which the true answer is predicted as the corresponding answer. in, In the question The real answer is Under the given conditions, the predicted answer is The probability; K is the total number of answers; The true answer is The predicted answer is The number of input samples; Represents the confusion matrix of the first... The total number of training samples in the row.

7. The network traffic self-enhancing reasoning method based on multi-view semantic decoupling and dual consistency verification according to claim 6, characterized in that, Step 4 specifically involves: Step 4.1: Identify the off-diagonal elements in the confusion matrix that exceed a preset threshold T. This off-diagonal element The corresponding real answer and predicted answers Defined as a high-frequency ambiguous answer pair ,in The settings are dynamically adjusted based on the dataset size, and the recognition results are stored in list format. i The construction method is as follows: Step 4.2: Define training samples in which the true answers and predicted answers can form high-frequency ambiguous answer pairs as high-confusion samples; Step 4.3: Based on the confusion matrix, add hints for the correct and confused answers to questions in highly confused samples to generate reverse reasoning samples; among them, for pairs of answers with the same high frequency of ambiguity... Highly confusing samples generate the same reverse inference samples; Step 4.4: Input the reverse reasoning sample into the large-scale reasoning model of this round to perform reverse reasoning and obtain a new reasoning chain. and predicted answers ; Step 4.5: If Then the reverse inference sample is considered a correctable training sample; if The reverse reasoning sample is then considered uncorrectable and discarded. Step 4.6: Remove the suggestive text from the correctable training sample questions, generate correct reverse reasoning samples, and preserve their reasoning chains. .

8. The network traffic self-enhancing inference method based on multi-view semantic decoupling and dual consistency verification according to claim 7, characterized in that, The reverse reasoning sample in step 4.3 adopts a structured template, and the specific structured template is as follows: [Example 1 of the hint set (QRA)] [Example 2 of the hint set (QRA)] ... [Example of a hint set p (QRA)] Given the flow input x: [insert multi-view structured input V(x)]; and the known real-world application category as [real answer y]; please generate the inference process and complete the following extended task: (1) List the key feature evidence that supports the answer [true answer y], prioritizing from the statistical semantic view V. stat and Head Semantic View V head Extract from; (2) For the confusing answer [confusing answer ŷ], clearly point out the differential feature basis for rejecting it, and explain why these features do not support [confusing answer ŷ] but support [true answer y]; Output format: inference chain r + final predicted answer”; The content of [True Answer y] should be filled in according to the specific highly confusing sample; in extended task (2), [Confusion Label ŷ] is a list. i The results are obtained by iterating through the loop; extended tasks (1) and (2) are prompt texts.

9. The network traffic self-enhancing reasoning method based on multi-view semantic decoupling and dual consistency verification according to claim 2, characterized in that, Step 5 involves a dual consistency check on both the correctly inferred training samples and the correctly inferred reverse samples. This includes two sequentially executed checks: semantic consistency backtracking check and causal consistency ablation check. Only when a sample passes both checks simultaneously is it considered a valid inference sample and added to the correct dataset for this round. Specifically: Step 5.1: Collect the training samples with correct reasoning and the samples with correct reverse reasoning as the correct samples. Perform text parsing on the reasoning chain of the correct samples to automatically extract a set of verifiable feature assertions F: Each feature assertion Represented in structured form as triples: in, Indicates the name of the traffic feature field that is explicitly referenced in the inference chain. This indicates the judgment relationship made by the large-scale inference model in this round regarding the traffic characteristic fields; The assertion value represents the specific value or range of values ​​given by the current inference model for the traffic feature field. The feature assertion extraction process follows these constraints: (1) Field constraint rules: The Only field mapping structures formed during the multi-view semantic decoupling process in step 1 are allowed to be selected, ensuring that each feature assertion can be uniquely located to an explicit field in the head semantic view, statistical semantic view, or payload semantic view; (2) Relationship constraint rules: The Take a predefined set of relations, including equal to, not equal to, greater than, less than, range inclusion and category matching relations, to ensure the standardization and verifiability of the assertion form; (3) Value normalization rules: The The format is standardized according to the data type of the corresponding field, where numeric fields are represented by numbers or ranges, and enumeration or string fields are represented by standardized identifiers. The feature assertion set F extracted in the above manner constitutes the smallest inference evidence unit that can be verified item by item in the subsequent semantic consistency backtracking verification. Step 5.2: Based on the preset field mapping structure, perform a deterministic view location operation for each feature assertion: First, let's look at the traffic characteristic field names. As an index, the corresponding semantic view attribution is queried in the field mapping structure to obtain a unique target view. : The field mapping structure explicitly records the unified name, semantic source, and semantic view to which each field belongs, and each field is only allowed to belong to one semantic view to ensure the uniqueness of the mapping result; based on this, the feature assertion... Mapping to the corresponding multi-view input data to form assertion-view pairs: Step 5.3: Assert for each feature that has completed the mapping. Perform the following semantic consistency backtracking check: Field existence check: If the assertion does not exist in the target semantic view or there is no corresponding record in the field mapping structure, the assertion is determined to be inconsistent. Value consistency verification: For numerical assertions, compare the assertion value with the original view feature value. If the deviation exceeds the preset tolerance threshold, it is determined to be inconsistent. The tolerance threshold is preset according to the data type, statistical scale or normalization method of the field and recorded in the field mapping structure. For enumeration or string assertions, the assertion value must exactly match the feature value of the original view; Assertion coverage verification: Calculate the ratio of the number of consistent assertions in the correct sample to the total number of assertions. If the ratio is not lower than the preset threshold, the correct sample passes the semantic consistency backtracking verification; otherwise, the semantic consistency verification of the correct sample fails and the correct sample is directly removed. Step 5.4: Assert for any feature Based on the field mapping structure, the set of key causal views corresponding to the feature assertion set of the current inference chain is obtained. : The key causal view set This indicates that all semantic view types used by the model to support its prediction conclusions in the current inference chain serve as the basis for constructing view-level counterfactuals in subsequent causal ablation verification; if no key semantic view is explicitly specified in the inference chain, K is assumed to be an empty set, and the correct sample is marked as a weakly causal correct sample and fails the verification. Step 5.5: For the identified key semantic view set K, construct the corresponding counterfactual input question x′ for the questions in the correct samples; specifically, perform the following semantic invalidation operation on each semantic view in K: For each view identified as a key view Perform view-level semantic ablation while leaving non-critical views unchanged. The counterfactual input problem is formally represented as follows: Here, Ablate(·) is a predefined view-level semantic invalidation function, the specific implementation of which includes: Header semantic view ablation: Replace protocol type, port number, negotiation fields, etc. with neutral placeholders or uniform default values ​​to eliminate their distinguishing ability; Statistical semantic view ablation: Randomly rearrange, mean-normalize, or noise-perturb statistical feature vectors to make them lose their stable discrimination patterns; Load semantic view ablation: Masking or truncating content structural features, retaining only format placeholder information; Step 5.6: Input counterfactual information into question x′ and the hint set. The inference chain is regenerated by concatenating the inference data and inputting it into the large-scale inference model for this round, resulting in a new predicted answer. Step 5.7: If the new predicted answer is inconsistent with the true answer, the correct sample passes the causal consistency ablation test; otherwise, the correct sample is determined to be a causal inconsistency sample and is removed.

10. The network traffic self-enhancing reasoning method based on multi-view semantic decoupling and dual consistency verification according to claim 1, characterized in that, In step 6, the initial inference model is fine-tuned using the correct dataset from this round. A multi-task loss function is used for fine-tuning, as shown in the following formula: in, To predict the answer, The cross-entropy loss generated for the inference chain uses sequence-level cross-entropy loss to constrain the model input. Under the condition of generating the inference chain The probability of is expressed by the following formula: in, Indicating the first inference path One generating unit, The total length of the reasoning path is the length of the generated reasoning chain; Indicates the first inference path generated Before each generation unit, the preceding content of all generated inference paths; To apply the label prediction cross-entropy loss, standard cross-entropy loss is used to optimize the model's prediction of the answer. To ensure classification accuracy and guarantee that the endpoint of the reasoning chain points to the correct judgment result, the formula uses the form of cross-entropy: in, For the predefined total number of answers, For indicator functions, These are weighting parameters used to balance two different loss terms in the multi-task loss function; The termination condition is as follows: if the inference classification accuracy improvement is less than the set threshold A1 and the inference rule compliance rate is greater than A2 in two consecutive iterations, the iteration is determined to be converged and the self-enhancing inference process is terminated; otherwise, the inference model fine-tuned in this round is used as the inference model generated in the next round of inference and the next round of iteration is carried out. Final output: After the iteration terminates, output the comprehensive training dataset for the final round. With Enhanced Reasoning Model .

Images