Multi-feature anonymous network traffic identification method and device based on convolution-attention hybrid architecture

Abstract

The invention discloses a multi-feature anonymous network traffic identification method and device based on a convolution-attention hybrid architecture, and relates to the technical field of network information security. The method comprises the following steps: acquiring original data of anonymous network traffic to be identified, preprocessing the original data, dividing a continuous data packet into a plurality of burst streams, and generating a structured traffic sequence; extracting a plurality of key features from the traffic sequence, and inputting the key features into a preprocessing convolution block for grouping convolution, feature fusion and dimension reduction to obtain structured multichannel traffic features; inputting the multi-channel traffic characteristics into a trained traffic identification model to obtain a category identification result of the anonymous network traffic; wherein the traffic recognition model is obtained by performing iterative training on the convolution-attention mixed architecture by adopting a pseudo-label mechanism. According to the method, the multi-dimensional features of the traffic can be comprehensively utilized, so that the accuracy of traffic identification is improved, and the generalization ability and scene adaptability of the model are remarkably enhanced.

Description

Technical Field

[0001] This invention relates to a method and apparatus for identifying multi-feature anonymized network traffic based on a convolutional-attention hybrid architecture, belonging to the field of network information security technology. Background Technology

[0002] With the widespread application of anonymous network traffic, the challenges it poses to network security are becoming increasingly prominent. Anonymous network traffic identification technology is widely used in various fields such as website identification, application identification, IoT device identification, and intrusion detection. However, in traffic identification tasks, traditional methods typically extract features based on only a single dimension such as packet time and size, failing to fully integrate the multi-dimensional features of traffic, resulting in significant room for improvement in identification accuracy. Furthermore, anonymous network identification remains insufficiently adaptable to complex scenarios and multi-device environments, exhibiting certain limitations. Currently, although deep learning technology has been applied to anonymous network identification, it relies on a large amount of labeled data to achieve high accuracy, which is often difficult to meet in real-world scenarios. Therefore, existing methods still have significant shortcomings in addressing the current needs of anonymous network traffic identification and urgently require further optimization and breakthroughs. Summary of the Invention

[0003] The purpose of this invention is to provide a method and apparatus for identifying multi-feature anonymized network traffic based on a convolutional-attention hybrid architecture. By extracting multi-dimensional features from the anonymized network traffic and inputting them into a traffic identification model obtained by training a convolutional-attention hybrid architecture based on pseudo-labels, high-precision anonymized network traffic identification can be achieved.

[0004] To achieve the above objectives, the present invention is implemented using the following technical solution.

[0005] On one hand, this invention provides a multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture, comprising:

[0006] The raw data of the anonymous network traffic to be identified is obtained, the raw data is preprocessed, and continuous data packets are divided into multiple bursts to generate a structured traffic sequence.

[0007] Multiple key features are extracted from the traffic sequence and input into a preprocessing convolutional block for grouped convolution, feature fusion and dimensionality reduction to obtain structured multi-channel traffic features;

[0008] The multi-channel traffic features are input into the trained traffic identification model to obtain the category identification results of anonymous network traffic;

[0009] The traffic identification model is obtained through self-training, and its training process includes:

[0010] The initial model is obtained by training the convolutional-attention hybrid architecture using labeled traffic data;

[0011] The initial model is used to predict unlabeled traffic data, and pseudo-labeled data is generated based on the confidence level of the prediction results.

[0012] The pseudo-labeled data and labeled traffic data are used together to iteratively optimize the model.

[0013] Optionally, preprocessing is performed only on downstream traffic from the service node to the client, including:

[0014] In the case of Tor protocol traffic in anonymous networks, the protocol control signaling is identified based on the TCP payload size of the traffic data packets;

[0015] Calculate the arrival time interval between adjacent data packets after excluding the influence of control signaling.

[0016] Based on the arrival time interval, a time threshold is dynamically calculated, and arrival time intervals exceeding the time threshold are determined as split points. Accordingly, continuous data packets are divided into multiple independent burst flows, forming a structured traffic sequence.

[0017] Optionally, the plurality of key features include at least:

[0018] The product of timestamp and direction, regularized timestamp, running rate, cumulative load size within the regularized time interval, regularized cumulative load, and burst boundary.

[0019] Optionally, the preprocessed convolutional block includes, in sequence:

[0020] One-dimensional convolutional layers are grouped, with the number of groups being the same as the number of channels in the input feature data. These layers are used to perform one-dimensional convolution, batch normalization, and non-linear activation on each feature channel independently to obtain high-dimensional intermediate features.

[0021] Flattening layer is used to flatten high-dimensional intermediate features into one-dimensional feature vectors;

[0022] The fully connected layer is used to perform linear transformation on the one-dimensional feature vector, realize feature fusion and dimensionality reduction, and output structured multi-channel flow features.

[0023] Optionally, the traffic identification model includes a feature processing module and a classification module connected in sequence;

[0024] The feature processing module includes multiple cascaded sub-modules with the same architecture. Each sub-module includes two cascaded transformer layers and a convolutional block connected to it.

[0025] The classification module includes a flattening layer, a fully connected layer, and a linear projection layer connected in sequence.

[0026] Optionally, the converter layer performs the following operations in sequence:

[0027] Layer normalization and multi-head attention calculation are performed on the input traffic features, and the calculation results are fused with the input traffic features using residual fusion to obtain the first fusion result;

[0028] The first fusion result is subjected to layer normalization and feedforward neural network calculation to obtain the second fusion result. The second fusion result is then residually fused with the first fusion result and output.

[0029] The feedforward neural network described therein uses the GELU activation function.

[0030] Optionally, the convolutional block includes, in sequence:

[0031] Extended convolutional layers are used to perform high-dimensional mapping of the output features of the transformer layers;

[0032] The projective convolutional layer, connected after the extended convolutional layer, is used to compress the high-dimensional mapped features to the input dimension of the convolutional block;

[0033] The max pooling layer, connected after the projective convolutional layer, is used to spatially downsample and output the compressed features;

[0034] Both the extended convolutional layer and the projected convolutional layer include a one-dimensional convolutional layer, a batch normalization layer, and a GELU activation function.

[0035] Optionally, the linear projection layer in the classification module is further connected to a probability normalization layer, which is used to apply a Softmax function to the classification logic value output by the linear projection layer to generate a predicted probability distribution of anonymous network traffic belonging to each preset category.

[0036] Optionally, the model training optimizes parameters by minimizing a loss function, which is the cross-entropy between the predicted probability distribution and the true label, and is defined as follows:

[0037] ;

[0038] Where B is the sample size of the training batch, and C is the number of target classes. Let i be the true label of the i-th sample in the c-th category. This represents the probability predicted by the model that the i-th sample belongs to the c-th category.

[0039] In a second aspect, the present invention provides a computer device, comprising:

[0040] Memory, used to store computer programs;

[0041] A processor for executing the computer program to implement the multi-feature anonymized network traffic identification method based on the convolution-attention hybrid architecture described in any one of the first aspects.

[0042] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0043] This invention extracts multidimensional features from traffic data and uses a pre-trained anonymous network traffic recognition model based on a convolutional-attention hybrid architecture to obtain the classification results of anonymous traffic. This comprehensively utilizes the multidimensional features of traffic, thereby improving the accuracy of traffic recognition. Furthermore, it incorporates a pseudo-label training mechanism to alleviate the difficulty of collecting labeled data. Through semi-supervised model training, combining labeled data and continuously learning from unlabeled data, it continuously enhances the model's generalization ability and scenario adaptability, providing a stable and reliable solution for anonymous network traffic recognition in dynamic network environments. Attached Figure Description

[0044] Figure 1 This is a flowchart illustrating the multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture provided in an embodiment of the present invention.

[0045] Figure 2 This is a schematic diagram of the convolution-attention hybrid architecture provided in an embodiment of the present invention. Detailed Implementation

[0046] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0047] It should be noted that the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "Multiple" indicates that the objects being described are two or more.

[0048] Example 1

[0049] This embodiment introduces a multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture. The method flow is as follows: Figure 1 This embodiment uses the identification of specific hidden service traffic in the Tor anonymity network as its application scenario. The core lies in achieving high-precision target service identification through a convolutional-attention hybrid deep learning architecture, specifically including the following implementation process:

[0050] First, define the target set to be identified. , where k is the number of hidden services to be monitored. For each target Collect the raw network traffic data it generates (e.g., pcap format files), and assign category labels c to the collected traffic samples to form a labeled initial dataset.

[0051] S1. Obtain the raw data of the anonymous network traffic to be identified, preprocess the raw data, divide the continuous data packets into multiple bursts, and generate a structured traffic sequence, as follows:

[0052] After obtaining the raw data of the anonymous network traffic to be identified, the raw data is preprocessed. The core process is to dynamically divide the long, continuous data packet stream into multiple independent burst streams based on the data packet arrival time interval. Each burst stream is treated as a structured traffic sequence sample, specifically for Tor anonymous network traffic.

[0053] Identify protocol control commands based on the TCP payload size of downstream traffic data packets. Identify packets with specific payload lengths (e.g., 536 / 1050 bytes), which correspond to Tor protocol control elements, and exclude them, retaining only the data elements for subsequent analysis.

[0054] Burst Flow Processing: Calculate the arrival time interval between adjacent data packets after excluding the effects of control signaling. t represents the data packet time, and the time threshold is dynamically calculated based on this time interval. This is used to divide consecutive data packets into multiple bursts, satisfying... Consecutive data packets are divided into the same burst sequence. This hierarchical processing is a key preprocessing step to improve the recognition accuracy and generalization ability of subsequent models.

[0055] Default payload size analysis: Extract the payload size of each packet and record its transmission direction ("+1" indicates outbound and "-1" indicates inbound) sent from the monitored client. This is used to distinguish the upstream and downstream transmission of traffic.

[0056] Dynamic time threshold adjustment: To adapt the segmentation to changes in network state, the threshold is adjusted. Dynamically generated. For example: It can be dynamically calculated based on the mean and standard deviation of the time interval within a sliding window, avoiding unreasonable segmentation caused by time deviation due to routing differences.

[0057] After preprocessing, the traffic data is converted into structured sequences, such as packet-level feature vectors (e.g., dirs, times) or interval-level features (e.g., interval_dirs).

[0058] S2. Extract multiple key features from the traffic sequence and input them into a preprocessing convolutional block for grouped convolution, feature fusion, and dimensionality reduction to obtain structured multi-channel traffic features, as follows:

[0059] From each burst flow sequence, a set of predefined (6 categories) key features are extracted. These features integrate information such as time, direction, load, and rate to form a structured feature matrix, providing multi-dimensional input information for the model. The 6 categories of key features include:

[0060] The product of timestamp and direction (time_dirs): , Let i be the arrival timestamp of the i-th data packet. For the direction of the i-th data packet, The product of the timestamp and direction of the i-th data packet is used; this feature integrates timing and flow information.

[0061] Regularized timestamps (times_norm): , This is the average of all timestamps in the stream. This represents the standard deviation of the timestamps corresponding to all data packets, which facilitates subsequent model processing.

[0062] Running rates: , , To accumulate the load size, Let i be the payload size of the i-th data packet. The time difference for the arrival of the i-th data packet reflects the average transmission rate from the beginning to the current packet.

[0063] Cumulative load size within the regularization interval (interval_cumul_norm): ,, The load is the average value. The standard deviation of the load is used to aggregate short-term flow intensity characteristics.

[0064] Regularized cumulative load sum (cumul_norm): This reflects the overall flow volume.

[0065] Burst edges: d represents the packet direction difference, which is used to identify traffic mutation characteristics by calculating the direction difference between adjacent packets (+2, -2, or 0).

[0066] This matrix is ​​then fed into a preprocessed convolutional block (STEM layer), which consists of the following:

[0067] Grouped one-dimensional convolutional layers, with the number of groups equal to the number of channels in the input feature data, are used to independently perform one-dimensional convolution on each feature channel, followed by batch normalization and non-linear activation processing to obtain high-dimensional intermediate features.

[0068] For the original anonymous network traffic, dirs = {+1, -1, 0} (packet direction sequence), the above 6 traffic features are extracted as the input to the model as follows:

[0069]

[0070]

[0071] The input is processed using grouped convolution. The formula for grouped convolution is as follows:

[0072] ;

[0073] ;

[0074] in For batch normalization, For one-dimensional convolution, For activation function, This is the weight matrix.

[0075] At this point, H can be understood as a higher-level feature embedding obtained after preliminary feature learning from the original traffic data. Each of these 324 feature maps corresponds to a local temporal pattern learned from a certain original feature channel. These 324 feature maps are the result of one-dimensional convolution, based on the input... It is determined by the weight matrix W.

[0076] Flattening layer is used to flatten high-dimensional intermediate features into one-dimensional feature vectors;

[0077] Fully connected layers are used to perform linear transformations on one-dimensional feature vectors, achieving feature fusion and dimensionality reduction, and outputting structured multi-channel flow features. This provides a structured, appropriately dimensional input for subsequent transformer layers (Transformer blocks) and convolutional blocks (CNN modules).

[0078] ;

[0079] in This is the weight matrix. It is the output of the stem layer. For flattening.

[0080] S3. Input the multi-channel traffic features into the trained traffic recognition model to obtain the category recognition results of anonymous network traffic, as follows:

[0081] The trained traffic recognition model includes a feature processing module and a classification module connected in sequence, with the specific architecture as follows: Figure 2 As shown.

[0082] The feature processing module consists of four sub-modules connected in series. Each sub-module includes two transformer layers connected in series and a convolutional block connected to the output of the last transformer layer.

[0083] Each transformer layer performs the following operations sequentially on the input multichannel traffic:

[0084] ;

[0085] ;

[0086] ;

[0087] Where Z is the output of the stem layer. For layer normalization, To input the regularization result, The layer represents the self-attention mechanism of the Transformer block, where Q, K, and V are the attention mechanism matrices. For activation function, This is the fully connected layer (i.e., the feedforward neural network) that has been passed through. The characteristic matrix, , This is the bias vector.

[0088] Layer normalization and multi-head attention calculation are performed on the input traffic features, and the calculation results are fused with the input traffic features using residual fusion to obtain the first fusion result;

[0089] The first fusion result is subjected to layer normalization and feedforward neural network calculation to obtain the second fusion result. The second fusion result is then residually fused with the first fusion result and output.

[0090] The feedforward neural network described therein uses the GELU activation function.

[0091] Convolution block operations:

[0092] ;

[0093] ;

[0094] ;

[0095] Where W is the feature matrix and Z is the input of this layer, To expand the output of the convolutional layer, This is the output of the projective convolutional layer. For one-dimensional convolution, For batch normalization, For activation function, For max pooling layer, For kernel size, is the stride of the convolution.

[0096] The convolutional blocks consist of the following in sequence:

[0097] Extended convolutional layers (corresponding) Figure 2 A first convolutional layer is used to perform high-dimensional mapping on the output features of the transformer layer;

[0098] Projected convolutional layer (corresponding) Figure 2 A secondary convolutional layer, connected after the extended convolutional layer, is used to compress the high-dimensional mapped features to the input dimension of the convolutional block;

[0099] The max pooling layer, connected after the projective convolutional layer, is used to spatially downsample and output the compressed features;

[0100] Both the extended convolutional layer and the projected convolutional layer include a one-dimensional convolutional layer, a batch normalization layer, and a GELU activation function.

[0101] In this embodiment, the classification module includes a flattening layer, a fully connected layer, a linear projection layer, and a probability normalization layer connected in sequence:

[0102] The features output by the convolutional block are finally converted into a one-dimensional vector by a flattening layer.

[0103] The vector is input into a fully connected layer for nonlinear transformation and feature enhancement.

[0104] The enhanced features are mapped by a linear projection layer to classification logistic values ​​equal to the number of categories.

[0105] The probability normalization layer applies a Softmax function to the classification logic value to generate a predicted probability distribution of the anonymous network traffic belonging to each preset category.

[0106] The model employs a self-training strategy, making full use of a small amount of labeled data and a large amount of unlabeled data to perform the following operations:

[0107] The initial model is trained using the collected labeled data to obtain an initial recognition model;

[0108] The initial identification model is used to predict unlabeled traffic data. Highly reliable samples with prediction confidence higher than a preset threshold (such as 0.95) are selected and their predicted labels are regarded as "pseudo-labels".

[0109] The generated pseudo-labeled data is merged with the original labeled data to jointly train and optimize the initial recognition model in the next round. This process can be repeated iteratively to fully utilize unlabeled data to improve model performance and obtain the final recognition model.

[0110] During model training, optimization is performed by minimizing the comprehensive loss function. The essence of the training loss is the cross-entropy loss function defined as follows:

[0111] ;

[0112] Where B is the sample size of the training batch, and C is the number of target classes. Let i be the true label of the i-th sample in the c-th category. This represents the probability predicted by the model that the i-th sample belongs to the c-th category.

[0113] In the self-training strategy adopted in this embodiment, the loss function is further specified into two parts:

[0114] Initial loss: for labeled samples For its sudden reconstruction samples, calculate the sum of cross-entropy losses:

[0115] ;

[0116] The cross-entropy loss function of the original sample sequence is... is the cross-entropy loss function for the reconstructed sequence.

[0117] Pseudo-label loss: for unlabeled data If the model's prediction confidence is higher than the threshold (like =0.95), generate pseudo-tags. And calculate the loss:

[0118] ;

[0119] Among them BR( This represents the sequence of unknown labels after a sudden reconstruction. The packet sequence is reconstructed by simulating the block segmentation process of anonymous traffic records. The cross-entropy loss function is the pseudo-label sample sequence. This is the cross-entropy loss function for the reconstructed pseudo-label sample sequence.

[0120] Total loss: The model is trained by minimizing the total loss through backpropagation and the AdamW optimizer. The learning rate can be achieved using a cosine annealing strategy. During pseudo-label training, perturbation enhancement or enhanced Gaussian noise can be combined to improve the model's generalization ability.

[0121] Finally, the model's classification module outputs the predicted probability distribution of the traffic belonging to each target category, and takes the category with the highest probability as the final identification result, thereby achieving the deanonymization of the anonymous network traffic.

[0122] Example 2

[0123] Based on the same inventive concept as Example 1, this example specifically applies the multi-feature anonymized network traffic identification method based on the convolution-attention hybrid architecture mentioned in Example 1. The experimental dataset is divided into two main categories: anonymized traffic classification and traffic identification involving user privacy. Anonymized traffic classification is further divided into the following three categories:

[0124] Website Activity Anonymous Traffic Dataset (UAV): Contains five different activities, each lasting 1 to 3 hours. Traffic records are divided into 5-second time windows.

[0125] The Internet of Things (IoT) Device Anonymous Traffic Dataset (IDI) contains 27 different types of IoT devices, with approximately 20 traffic records for each device type. All traffic records are generated during the device setup process.

[0126] Intrusion Detection Anonymous Traffic Dataset (ISD): Also known as the ETF IoT Botnet Dataset, it includes both normal and malware traffic. Normal traffic is logged on a personal computer for several hours, while malware traffic is captured on a Raspberry Pi device.

[0127] User privacy traffic identification is divided into the following two categories:

[0128] Shadowsocks Website Anonymous Traffic Fingerprint (SWF): Shadowsocks is an internet proxy protocol based on the Socks5 protocol. This dataset includes 23 monitored websites from Alexa's top websites and over 3,300 open-world websites, with each monitored website accessed 120 times, resulting in 120 traffic records.

[0129] Keyword Search Anonymous Traffic (KWS): This dataset was generated by searching keywords using the Baidu search application on an Android emulator. There are 50 keywords, each searched 100 times, resulting in 100 HTTPS-encrypted access records.

[0130] For the datasets above, the method mentioned in this paper shows a significant improvement over existing superior methods on the experimental set data. The experimental data comparison is shown in Table 1:

[0131] Table 1 Experimental Data

[0132]

[0133] Among the existing superior methods for each dataset:

[0134] K-Means + RF: A combination of unsupervised clustering and ensemble learning for feature preprocessing and classification.

[0135] RF + LCS: A combination of sequence similarity features and random forest, suitable for traffic pattern matching.

[0136] PSC + ET: A combination of package statistical features and extreme random trees to improve classification robustness.

[0137] RF: The classic random forest is directly applied to feature classification.

[0138] CR-ELM: A combination of feature representation optimization and fast neural networks, suitable for scenarios with high real-time requirements.

[0139] As can be seen, the experimental model adopts a convolution-attention hybrid architecture, which achieves good results on five datasets compared with the state-of-the-art related methods mentioned above. The improvement is most obvious on the IDI and ISD datasets. The model also maintains a stable improvement in the other three datasets, indicating that it has strong generalization ability and is suitable for various anonymous traffic identification scenarios.

[0140] For both anonymous traffic identification and intrusion detection scenarios involving IoT devices, the IDI dataset contains 27 device classes, making it difficult for traditional random forests to capture subtle differences between devices. Our proposed model extracts local features through convolutional layers and strengthens key traffic identifiers using an attention mechanism, significantly improving device type differentiation. The IDI dataset has a low proportion of malicious traffic with hidden features. Our model effectively reduces the false negative rate by weighting minority class features through an attention mechanism. Furthermore, the convolutional structure's ability to model the spatiotemporal features of traffic sequences outperforms traditional feature engineering methods.

[0141] For identifying user privacy traffic, the model is sensitive to temporal patterns in encrypted traffic on the SWF and KWS datasets. For example, Shadowsocks traffic exhibits a fixed interaction pattern, and the attention mechanism achieves more accurate website fingerprinting by enhancing the weights of key packet sequences.

[0142] In summary, the proposed convolution-attention hybrid model demonstrates superior performance in all five types of anonymous traffic identification tasks, with significant improvements, especially in complex scenarios and multi-device environments.

[0143] Example 3

[0144] This embodiment provides a computer device, including:

[0145] Memory, used to store computer programs;

[0146] A processor is configured to execute the computer program to implement the multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture as described in Embodiment 1 or Embodiment 2.

[0147] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0148] This invention extracts multidimensional features from traffic data and uses a pre-trained anonymous network traffic recognition model based on a convolutional-attention hybrid architecture to obtain the recognition category results of anonymous traffic. This comprehensively utilizes the multidimensional features of traffic, thereby improving the accuracy of traffic recognition. Furthermore, the invention incorporates a pseudo-label training mechanism to alleviate the difficulty of collecting labeled data. Through semi-supervised learning from unlabeled data, the model's generalization ability and scene adaptability are continuously enhanced, providing a stable and reliable solution for anonymous network traffic recognition in dynamic network environments.

[0149] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0150] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0151] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0152] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0153] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture, characterized in that, include: The raw data of the anonymous network traffic to be identified is obtained, the raw data is preprocessed, and continuous data packets are divided into multiple bursts to generate a structured traffic sequence. Multiple key features are extracted from the traffic sequence and input into a preprocessing convolutional block for grouped convolution, feature fusion and dimensionality reduction to obtain structured multi-channel traffic features; The multi-channel traffic features are input into the trained traffic identification model to obtain the category identification results of anonymous network traffic; The traffic identification model is obtained through self-training, and its training process includes: The initial model is obtained by training the convolutional-attention hybrid architecture using labeled traffic data; The initial model is used to predict unlabeled traffic data, and pseudo-labeled data is generated based on the confidence level of the prediction results. The pseudo-labeled data and labeled traffic data are used together to iteratively optimize the model.

2. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 1, characterized in that, Preprocessing is performed only on downstream traffic from the service node to the client, including: In the case of Tor protocol traffic in anonymous networks, the protocol control signaling is identified based on the TCP payload size of the traffic data packets; Calculate the arrival time interval between adjacent data packets after excluding the influence of control signaling. Based on the arrival time interval, a time threshold is dynamically calculated, and arrival time intervals exceeding the time threshold are determined as split points. Accordingly, continuous data packets are divided into multiple independent burst flows, forming a structured traffic sequence.

3. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 1, characterized in that, The multiple key features include at least: The product of timestamp and direction, regularized timestamp, running rate, cumulative load size within the regularized time interval, regularized cumulative load, and burst boundary.

4. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 1, characterized in that, The preprocessed convolutional block includes, in sequence: One-dimensional convolutional layers are grouped, with the number of groups being the same as the number of channels in the input feature data. These layers are used to perform one-dimensional convolution, batch normalization, and non-linear activation on each feature channel independently to obtain high-dimensional intermediate features. Flattening layer is used to flatten high-dimensional intermediate features into one-dimensional feature vectors; The fully connected layer is used to perform linear transformation on the one-dimensional feature vector, realize feature fusion and dimensionality reduction, and output structured multi-channel flow features.

5. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 1, characterized in that, The traffic identification model includes a feature processing module and a classification module connected in sequence; The feature processing module includes multiple cascaded sub-modules with the same architecture. Each sub-module includes two cascaded transformer layers and a convolutional block connected to it. The classification module includes a flattening layer, a fully connected layer, and a linear projection layer connected in sequence.

6. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 5, characterized in that, The converter layer performs the following operations in sequence: Layer normalization and multi-head attention calculation are performed on the input traffic features, and the calculation results are fused with the input traffic features using residual fusion to obtain the first fusion result; The first fusion result is subjected to layer normalization and feedforward neural network calculation to obtain the second fusion result. The second fusion result is then residually fused with the first fusion result and output. The feedforward neural network described therein uses the GELU activation function.

7. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 6, characterized in that, The convolutional block includes, in sequence: Extended convolutional layers are used to perform high-dimensional mapping of the output features of the transformer layers; The projective convolutional layer, connected after the extended convolutional layer, is used to compress the high-dimensional mapped features to the input dimension of the convolutional block; The max pooling layer, connected after the projective convolutional layer, is used to spatially downsample and output the compressed features; Both the extended convolutional layer and the projected convolutional layer include a one-dimensional convolutional layer, a batch normalization layer, and a GELU activation function.

8. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 7, characterized in that, The classification module is further connected to a probability normalization layer after the linear projection layer, which is used to apply a Softmax function to the classification logic value output by the linear projection layer to generate a predicted probability distribution of anonymous network traffic belonging to each preset category.

9. The multi-feature anonymized network traffic identification method based on a convolutional-attention hybrid architecture according to claim 1, characterized in that, The model is trained by optimizing the parameters by minimizing a loss function, which is the cross-entropy between the predicted probability distribution and the true label, and is defined as follows: ； Where B is the sample size of the training batch, and C is the number of target classes. Let i be the true label of the i-th sample in the c-th category. This represents the probability predicted by the model that the i-th sample belongs to the c-th category.

10. A computer device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the multi-feature anonymized network traffic identification method based on a convolution-attention hybrid architecture as described in any one of claims 1 to 9.

Images