Encrypted traffic classification method and system based on state space modeling and cross-dimensional scanning
By employing state-space modeling and cross-dimensional scanning, the problems of easily lost fine-grained discrimination clues and model capacity redundancy in small-sized encrypted traffic grayscale images are solved, thereby improving the stability and accuracy of encrypted traffic classification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANDONG UNIV OF SCI & TECH
- Filing Date
- 2026-04-28
- Publication Date
- 2026-07-03
AI Technical Summary
In the process of feature extraction from small-sized encrypted traffic grayscale images, existing technologies are prone to losing fine-grained discrimination clues, have redundant model capacity, and are difficult to effectively utilize spatial-channel cross-dimensional coupling, resulting in unstable recognition and category bias.
By employing state-space modeling and cross-dimensional scanning methods, including stream level partitioning, preprocessing, category-conditional adaptive sliding window resampling, small-size grayscale image feature enhancement, spatial-channel selective cross-scanning, and dual-branch cross-gated fusion, the tail category supervision density is improved, head category redundancy is suppressed, and inter-category learning imbalance is mitigated.
Without compromising stream independence, it improves the discrimination accuracy and stability in scenarios with small input size and long-tail categories, alleviates the problem of losing fine-grained clues, and enhances the ability to utilize global context.
Smart Images
Figure SMS_62
Abstract
Description
Technical Field
[0001] This invention belongs to the field of traffic data processing, specifically relating to an encrypted traffic classification method and system based on state space modeling and cross-dimensional scanning. Background Technology
[0002] With the large-scale deployment of encrypted communication on the Internet, the business semantics of network traffic are hidden by encryption mechanisms, significantly reducing the applicability of traditional identification methods that rely on plaintext content parsing. However, in network security protection, operation and maintenance management, and situational awareness scenarios, it is still necessary to identify the type of communication traffic without decryption to support key capabilities such as anomaly detection, threat hunting, access control, and resource scheduling. Therefore, encrypted traffic classification technology is gradually shifting from "relying on deep parsing of visible content" to "relying on statistical and pattern modeling of observable signals."
[0003] Unlike natural images, encrypted traffic grayscale images are typically constructed with small representations such as 28×28 or 40×40, and the payload information is often sparsely distributed. Furthermore, real-world data often exhibits significant long-tail imbalance, making local evidence of minority class dependencies more easily diluted during feature extraction and global aggregation, leading to recognition instability and class bias. At the model level, while convolutional neural networks can capture local texture details, their ability to integrate cross-regional dependencies is limited. Transformers possess global modeling capabilities, but the secondary complexity of self-attention introduces high computational overhead and may dilute the sparse discriminative clues needed for tail classes during global mixing. Existing structured state-space models, such as the SSM / Mamba system, were initially geared towards the sequence domain, and their unidirectional causal scanning makes it difficult to utilize unscanned context. Even with the introduction of VMamba planar cross-scanning to enhance spatial dependency modeling, the channel dimension still struggles to explicitly characterize the spatial-channel cross-dimensional coupling at the scanning mechanism level.
[0004] Therefore, under the conditions of small input size, sparse information and long-tailed distribution of encrypted traffic grayscale map, the defects of the above cross-dimensional interaction are significantly amplified, thus becoming a key bottleneck affecting model performance, stability and reproducibility. Summary of the Invention
[0005] The purpose of this invention is to provide a method for classifying encrypted traffic based on state space modeling and cross-dimensional scanning, so as to solve the problems of easy loss of fine-grained discrimination clues and redundant model capacity in the feature extraction process of existing small-sized encrypted traffic grayscale images.
[0006] To achieve the above objectives, the technical solution of the present invention is as follows:
[0007] This invention provides a method for classifying encrypted traffic based on state-space modeling and cross-dimensional scanning, comprising the following steps:
[0008] The original encrypted traffic data is sequentially divided into stream levels and preprocessed. In the sequence domain, the time-series segments of the data packets are segmented and classified and labeled, and mapped to the initial samples in the image domain. The initial samples in the image domain are then subjected to class-conditional adaptive sliding window resampling to obtain class-balanced image domain sample data.
[0009] The image domain sample data is downsampled to obtain small-size grayscale image features; gated detail enhancement is performed on the small-size grayscale image features, and the residuals of the small-size grayscale image features are aggregated to obtain the first gated detail enhancement features;
[0010] The first gated detail enhancement feature is linearly mapped and smoothed to obtain the gated signal. The first gated detail enhancement feature is linearly mapped, deep convolutional and smoothed to obtain the content enhancement signal. The content enhancement signal and the gated signal are then subjected to spatial-channel selective cross-scanning to obtain the enhancement coupling feature.
[0011] The spatial-channel selective cross-scan processing involves the following steps:
[0012] The content enhancement signal is subjected to bidirectional cross-scanning in a specified spatial dimension to obtain long-distance spatial dependencies and output spatial structure features.
[0013] The gating signal is multiplied element-wise with the spatial structure features to filter out redundancy and output the gating feature.
[0014] Perform a bidirectional cross-scan on the spatial structure features in two parallel branches, height-channel and width-channel, to obtain the channel coupling features.
[0015] The gated features and channel coupling features are modulated and residuals are aggregated, and then enhanced coupling features are obtained by layer normalization and linear projection.
[0016] The enhanced coupling features are sequentially normalized, convolved, and channel mapped to obtain intermediate features. The intermediate features are then subjected to scanning context conditional modulation to obtain complementary local structural features. Finally, a two-branch cross-gated fusion is performed to obtain local structural enhancement features.
[0017] The local structural enhancement features are downsampled and then gated to obtain the second gated detail enhancement features. After replacing the first gated detail enhancement features, spatial-channel selective cross-scanning and local structural enhancement are performed to obtain shallow features.
[0018] The shallow feature map is obtained by downsampling the extracted features and then performing spatial-channel selective cross-scanning and local structure enhancement.
[0019] Global average pooling and class probability mapping are performed on the deep feature maps for classification.
[0020] Scan context conditional modulation includes the following operations:
[0021] The coupling enhancement features are subjected to full-pool average pooling to obtain context summary information, and the context summary information is subjected to lightweight conditional mapping to obtain conditional vectors.
[0022] Based on conditional vectors, the intermediate features are subjected to adaptive modulation enhancement at the sample and channel levels. The enhanced sample and channel features are then subjected to depthwise convolution with different convolution configurations to obtain complementary local structural features.
[0023] Dual-branch cross-gating fusion includes the following operations:
[0024] Complementary local structural features are mapped and convolved based on conditional vectors to obtain cross-gated weights.
[0025] By using cross-gated weights to perform element-wise addition, weighted summation, channel concatenation, and convolutional projection, complementary local structural features are fused.
[0026] Channel projection is performed on the fused local structural features to obtain local structural enhancement features.
[0027] Enhanced gating details include the following:
[0028] The small-sized grayscale image features are normalized and the dimensions are adjusted by channel mapping. Then, parallel multi-scale deep convolution is performed to obtain multi-scale detail aggregation features. The aggregation features are divided equally along the channel dimension. The channel response is adaptively scaled and channel projected by the gated output features to obtain the first gated detail enhancement features.
[0029] The process of converting sequence domain data into image sample data includes the following operations:
[0030] In the sequence domain, a fixed-length sliding window is used to sample the sequence of streaming data packets. The sampled data is truncated and padded with zeros to obtain time-series samples of equal length. The time-series samples are then mapped to grayscale images of fixed size.
[0031] Count the number of grayscale image samples in each category, and then classify and label the samples.
[0032] In the image domain, a category-conditional adaptive sliding window is used to generate image domain samples and inherit the original labels, resulting in category-balanced image domain sample data.
[0033] Bidirectional cross-scanning in spatial dimensions includes the following operations:
[0034] The content enhancement signal is fed into a spatial dimension scan, where the spatial dimension includes height and channel dimensions, width and channel dimensions, or height and width dimensions.
[0035] Category-based adaptive conditions include the following operations:
[0036] The image domain sliding window step size is automatically adjusted based on the number of samples in each category, with a larger step size for categories with a large number of categories and a smaller step size for categories with a small number of categories.
[0037] Parallel multi-scale depthwise convolution includes the following operations:
[0038] Different receptive fields are used to simultaneously capture the correlation between fine-grained local textures and larger-scale structures; the parallel branch outputs are aggregated by the fusion unit to obtain multi-scale detail representations.
[0039] An encrypted traffic classification system based on state-space modeling and cross-dimensional scanning includes the following modules:
[0040] Data acquisition and sample construction module: The original encrypted traffic data is sequentially divided into stream levels and preprocessed. In the sequence domain, the time-series segments of data packets are segmented and classified and labeled, and mapped to the initial samples in the image domain. The initial samples in the image domain are resampled by class-conditional adaptive sliding window to obtain image domain sample data with class balance.
[0041] Gated detail enhancement module: The image domain sample data is downsampled to obtain small-size grayscale image features; then gated detail enhancement is performed, and the residual of the small-size grayscale image features is aggregated to obtain the first gated detail enhancement feature;
[0042] Spatial-channel selective cross-scan module: The first gated detail enhancement feature is linearly mapped and smoothed to obtain the gated signal; the first gated detail enhancement feature is linearly mapped, deep convolutional and smoothed to obtain the content enhancement signal; the content enhancement signal and the gated signal are processed by spatial-channel selective cross-scan to obtain the enhanced coupling feature;
[0043] The spatial-channel selective cross-scan processing involves the following steps:
[0044] The content enhancement signal is subjected to bidirectional cross-scanning in a specified spatial dimension to output spatial structure features.
[0045] The gating signal is multiplied element-wise with the spatial structure features to filter out redundancy and output the gating feature.
[0046] Perform a bidirectional cross-scan on the spatial structure features in two parallel branches, height-channel and width-channel, to obtain the channel coupling features.
[0047] The gated features and channel coupling features are modulated and residuals are aggregated, and then enhanced coupling features are obtained by layer normalization and linear projection.
[0048] Local structure enhancement module: The enhanced coupling features are sequentially subjected to residual fusion, layer normalization, convolution and channel mapping to obtain intermediate features, then scan context conditional modulation is performed to obtain complementary local structure features, and finally bi-branch cross-gated fusion is performed to obtain local structure enhancement features;
[0049] Shallow feature extraction module: The local structure enhancement features are downsampled, and then gated detail enhancement is performed to obtain the second gated detail enhancement features. After replacing the first gated detail enhancement features, spatial-channel selective cross-scanning and local structure enhancement modules are executed to obtain shallow features.
[0050] Deep feature extraction module: The shallow feature extraction features are downsampled, and after replacing the first gated detail enhancement features, the spatial-channel selective cross-scanning and local structure enhancement modules are executed to obtain the depth feature map;
[0051] Classification output module: Performs global average pooling and class probability mapping on the deep feature map to perform classification.
[0052] The local structure enhancement module includes the following modules:
[0053] The scanning context-conditional modulation module performs global average pooling on the coupled enhancement features to obtain context summary information. It then performs lightweight conditional mapping on the context summary information to obtain a conditional vector. Based on the conditional vector, it performs sample-level and channel-level adaptive modulation enhancement on the intermediate features. Finally, it performs depthwise convolution with different convolution configurations on the modulated and enhanced sample and channel features to obtain complementary local structural features.
[0054] Compared with the prior art, the technical solution provided by this invention has the following advantages:
[0055] Without compromising stream independence, this method utilizes dual-domain sample data from the sequence domain to the image domain to improve tail category supervision density, suppress head category redundancy, and mitigate inter-class learning imbalance, thus laying a high-quality foundation from the source of sample data.
[0056] It effectively alleviates the problem of fine-grained cue loss for small-sized inputs. For the small-sized and sparse-payload features of encrypted traffic grayscale images, it avoids the excessive compression of fine-grained cue in the early stage. It enhances the details of the downsampled features through residual fusion, multi-scale deep convolution and channel response adaptive scaling, suppressing noise response and strengthening local structural features without significantly increasing computational complexity, thereby improving the discriminative stability and separability of shallow features.
[0057] By coupling spatial structural features and channel features across dimensions and employing spatial-channel selective cross-scanning processing, the problem of information not being visible in unidirectional scanning is avoided, the ability to utilize global context is enhanced, feature correlations in different dimensions are captured, and the discrimination accuracy and stability in small-sized input and long-tail category scenarios are significantly improved. Detailed Implementation
[0058] To further understand the content of this invention, the invention will be described in detail with reference to the embodiments.
[0059] This invention provides a method for classifying encrypted traffic based on state-space modeling and cross-dimensional scanning, the method comprising the following steps:
[0060] S1. Perform flow-level division and preprocessing on the original encrypted traffic data in sequence. In the sequence domain, segment and classify the time-series segments of the data packets and map them to the initial samples in the image domain. Perform class-condition adaptive sliding window resampling on the initial samples in the image domain to obtain class-balanced image domain sample data.
[0061] Obtain the raw encrypted traffic data file to be analyzed as the input data source. The computer device parses the raw traffic and performs the following processing:
[0062] (1) Split the original encrypted traffic data into several streams according to the quintuple;
[0063] (2) Remove non-IP traffic such as Address Resolution Protocol and Dynamic Host Configuration Protocol from the flow, and retain only IP traffic related to service behavior;
[0064] (3) Based on hash-based deduplication of stream samples and removal of identifiable fields, avoid learning shortcut features that are irrelevant to the category;
[0065] (4) Normalize the packet sequence length of each data stream. If it is less than the minimum threshold, discard it; if it is greater than the maximum limit, truncate it and keep the first part of the data.
[0066] (5) Perform fixed-length trimming / padding on each data packet.
[0067] The specific process for obtaining image domain sample data is as follows:
[0068] In the sequence domain, a fixed-length sliding window is used to sample the sequence of streaming data packets. The sampled data is truncated and padded with zeros to obtain time-series samples of equal length. The time-series samples are then mapped to grayscale images of fixed size.
[0069] Count the number of grayscale image samples in each category, and then classify and label the samples.
[0070] In the image domain, a category-conditional adaptive sliding window is used to generate image domain samples and inherit the original labels, resulting in category-balanced image domain sample data.
[0071] Specifically, the data stream is divided into training, validation, and test sets to ensure that the data streams in different subsets do not overlap, and sequence-domain sliding window sampling is performed. Within each subset, the computer device performs sliding window sampling on the data packet sequence as a unit of data stream: a fixed window length and sliding step size are set, and the sampling starts from the first data packet of the data stream and slides backward according to the step size until the end, generating multiple window-level samples in sequence.
[0072] The obtained window-level samples are converted into fixed-size grayscale images, where the grayscale image size can be a small initial sample of the image domain, such as 28×28 or 40×40.
[0073] Category-based adaptive conditions include the following operations:
[0074] The image domain sliding window step size is automatically adjusted based on the number of samples in each category, with a larger step size for categories with a large number of categories and a smaller step size for categories with a small number of categories.
[0075] First, the initial image domain samples are divided into buckets according to the sample size of each category. Then, different image domain sampling strides are set for different buckets. Subsequently, fixed-size local blocks are slidably cropped on the grayscale 2D plane according to the stride corresponding to the category as image domain samples, inheriting the original labels, and summarizing to form an image domain resampling training set. By performing category adaptive sampling on the initial image domain samples, class-balanced image domain sample data is obtained, realizing reproducible grayscale sample generation and long-tail category rebalancing, laying a high-quality foundation from the source of sample data.
[0076] The generation method of sequence domain samples does not have to be limited to sliding sampling with a fixed starting point and a fixed step size. Random starting point sampling, segmented sampling, multi-scale window sampling, or adaptive sampling according to the stream length can also be used to improve the supervision density and enhance the training stability.
[0077] Image domain class-aware resampling is not limited to image domain sliding window cropping and class conditional step size. It can also use class reweighting loss, hard example mining loss, setting sampling probability according to class frequency, or data augmentation for tail classes to improve the effective supervision of tail classes, suppress redundancy of head classes, and improve class learning imbalance.
[0078] S2. Downsample the image domain sample data to obtain small-size grayscale image features; perform gated detail enhancement on the small-size grayscale image features, and aggregate with the residuals of the small-size grayscale image features to obtain the first gated detail enhancement feature.
[0079] The overall downsampling rate is adjusted to half of the original to make the feature resolution of small grayscale images decrease more gradually (e.g., from more aggressive hierarchical compression to more moderate hierarchical compression), so as to retain sparse but critical structured discrimination patterns at a more sufficient spatial granularity. The network stacking depth and channel width at each stage are also appropriately reduced to match the depth and width with the task difficulty and the amount of input information.
[0080] Enhanced gating details include the following:
[0081] The small-sized grayscale image features are normalized and the dimensions are adjusted by channel mapping. Then, parallel multi-scale deep convolution is performed to obtain multi-scale detail aggregation features. The aggregation features are divided equally along the channel dimension. The channel response is adaptively scaled and channel projected by the gated output features to obtain the first gated detail enhancement features.
[0082] After downsampling, gated detail enhancement is performed, and a residual approach is used to fuse with the small-sized grayscale image features. This residual design ensures the continuity of feature information transmission, allowing the enhancement branch to compensate for key responses without disrupting stable propagation. Let the small-sized grayscale image features after downsampling be used as input features. The output gated detail enhancement feature Represented as:
[0083]
[0084] Inside the gated detail enhancement GDE, normalization, channel transformation, parallel multi-scale depth convolution (multi-scale detail compensation), lightweight gated nonlinear interaction, and channel response adaptive scaling are performed in sequence. Finally, output alignment and residual injection are completed through channel projection.
[0085] Specifically, the input features are first normalized and channel mapping is performed to obtain intermediate representations. :
[0086]
[0087] Multi-scale depthwise convolution includes the following operations:
[0088] Different receptive fields are used to simultaneously capture the correlation between fine-grained local textures and larger-scale structures; the parallel branch outputs are aggregated by the fusion unit to obtain multi-scale detail representations.
[0089] Parallel multi-scale depthwise convolution uses a multi-scale depthwise convolution module (MS-DWConv) to process the intermediate representation. Multi-scale local modeling is performed. MS-DWConv consists of multiple parallel deep convolutional branches, each employing a different receptive field (e.g., different kernel sizes or dilation rates) to simultaneously capture fine-grained local textures and larger-scale structural associations. The outputs of the parallel branches are aggregated by a fusion unit to obtain multi-scale detailed aggregated features. This fusion unit can be constructed by splicing channels together. This can be achieved through convolutional compression, or by using a lightweight weighted generator network to perform a weighted summation of the outputs of each branch. The unified representation is as follows:
[0090]
[0091] The gating operation is defined as SimpleGate, which is a feature aggregation operation based on multi-scale details. Divided into two parts along the channel dimension Gated features are obtained by performing element-wise multiplication. :
[0092]
[0093] in This indicates element-wise multiplication. This gating mechanism suppresses noise and enhances the effective response through mutual multiplication, while introducing necessary nonlinearity without significantly increasing overhead.
[0094] Spatial Channel Attention (SCA) is then introduced to adaptively scale the channel responses, resulting in attention features. :
[0095]
[0096] in The channel weights (which can be obtained from the features after global pooling through a lightweight multilayer perceptron) are channel weights. This step involves transforming the weights to match the feature dimensions. It highlights key channels and weakens less important ones, making the shallowly enhanced representation more focused on category-specific response patterns.
[0097] Attention characteristics Channel projection is performed to obtain small-sized grayscale image features enhanced with gated detail. :
[0098]
[0099] Through the above multi-scale detail compensation design, GDE can simultaneously enhance fine-grained texture cues and structural association information over a wider range in shallow layers, thereby reducing the sensitivity of small-sized inputs to local features at a single scale and improving the stability and separability of shallow features.
[0100] Adjusting the downsampling rhythm does not have to be limited to halving the overall downsampling rate. It can also be achieved by reducing the number of downsampling operations, delaying the downsampling position, using a gentler resolution reduction method, or introducing a shallow feature extraction structure that maintains resolution, as long as it can achieve the goal of preserving fine-grained discrimination clues and improving feature stability.
[0101] It is not necessary to limit it to a fixed combination of network depth or channel width. It can also be adjusted according to the input size, number of categories, sample size and device computing power to achieve the purpose of matching capacity with task difficulty, reducing redundant computing and improving deployment adaptability.
[0102] The location of gating detail enhancement does not need to be limited to just after shallow downsampling. It can also be placed before downsampling or between multiple stages, as long as it can achieve the purpose of compensating for the loss of detail information caused by downsampling and improving the discriminativeness of shallow features. The gating and attention implementation does not need to be limited to SimpleGate + spatial channel attention. It can be replaced by other lightweight gating structures, channel attention, spatial attention, or a combination of the two, as long as it can achieve the purpose of suppressing noise response, highlighting key local features, and improving the stability of feature representation.
[0103] S3. Perform linear mapping and smooth activation on the first gated detail enhancement feature to obtain the gated signal; perform linear mapping, depth convolution and smooth activation on the first gated detail enhancement feature to obtain the content enhancement signal; perform spatial-channel selective cross-scanning on the content enhancement signal and the gated signal to obtain the enhancement coupling feature;
[0104] The spatial-channel selective cross-scan processing involves the following steps:
[0105] The content enhancement signal is subjected to bidirectional cross-scanning in a specified spatial dimension to obtain long-distance spatial dependencies and output spatial structure features.
[0106] The gating signal is multiplied element-wise with the spatial structure features to filter out redundancy and output the gating feature.
[0107] Perform a bidirectional cross-scan on the spatial structure features in two parallel branches, height-channel and width-channel, to obtain the channel coupling features.
[0108] The gated features and channel coupling features are modulated and residuals are aggregated, and then enhanced coupling features are obtained through layer normalization and linear projection.
[0109] Specifically, the first gated detail enhancement feature is first processed by residual aggregation to obtain the gated detail feature. The gated intermediate representation is obtained through linear mapping. :
[0110]
[0111] Then, two parallel information streams are constructed: the gated intermediate representation... Deep convolution and activation are used to introduce local responses, resulting in content enhancement signals. , gate intermediate representation Activate and generate gating signals :
[0112]
[0113] Two parallel signals are fed into the core SCS scanning mechanism and fused to obtain the fused feature. :
[0114]
[0115] The SCS scanning mechanism is a high-resolution scanning mechanism. ,width With channel The three dimensions are incorporated into a unified selective cross-dimensional scanning framework, including a spatial branch and two cross-dimensional branches, and stable fusion is achieved through shared gating. The specific implementation consists of four steps:
[0116] Bidirectional cross-scanning in spatial dimensions includes the following operations:
[0117] The content enhancement signal is fed into a spatial dimension scan, where the spatial dimension includes height and channel dimensions, width and channel dimensions, or height and width dimensions.
[0118] Send content enhancement signals into spatial dimensions (such as altitude) ,width (Scanning). The spatial dimensions also include height and channel dimensions, as well as width and channel dimensions.
[0119] (1) Spatial Branch: Performs bidirectional cross-scanning in the spatial plane. The content enhancement signal is sent into space (e.g., height). ,width Scanning mapping yields spatial dimensional features. :
[0120]
[0121] in This represents a composite mapping that performs bidirectional cross-scanning on a specified combination of dimensions, models it using Mamba units, and then fuses and rearranges it to restore the tensor shape. .
[0122] (2) Shared gating injection: Gating signal Explicit injection of spatial dimension features Obtain gating features :
[0123]
[0124] (3) Cross-dimensional branching: Perform bidirectional cross-scanning on two paths, one in the height dimension and the other in the channel dimension, and the other in the width dimension and the channel dimension, to obtain the height-channel coupling feature. Coupling features with width channel :
[0125]
[0126] (4) Fusion output: High channel coupling characteristics Coupling features with width channel Respectively with gating features Element-wise multiplication, with gated features Residual aggregation yields fusion features :
[0127]
[0128] This fusion method ensures that each branch contributes collaboratively within a unified representation space and maintains the stability of feature propagation in a concise residual manner.
[0129] Final fusion features Enhanced coupling features are obtained through normalization and linear projection. :
[0130]
[0131] Cross-dimensional interaction need not be limited to specific combinations of HW, HC, and WC dimensions or fixed scanning paths. It can also be achieved by grouping channels and then cross-linking them with spatial dimensions before fusion, or by organizing channel and spatial dimensions into joint sequences and performing bidirectional extraction, as long as it can achieve cross-dimensional information interaction and fusion between space and channels and improve the association of relevant features for category discrimination.
[0132] Bidirectional scanning need not be limited to a specific bidirectional cross-scanning implementation. It can be achieved by fusing features extracted in parallel with forward and backward scanning, or by fusing information streams that propagate in parallel in opposite directions. As long as it can achieve the purpose of jointly utilizing the forward and backward context, reducing feature blind spots, and enhancing the visibility of global information.
[0133] Feature fusion does not have to be limited to a fixed residual / gated combination. It can also use weighted summation, linear mapping after concatenation, attention fusion, or gated fusion, as long as it can achieve the purpose of multi-path information complementarity and effective aggregation while maintaining training stability.
[0134] S4. The enhanced coupling features are sequentially normalized, convolved, and channel mapped to obtain channel fusion intermediate features. The channel fusion intermediate features are then subjected to scanning context conditional modulation to obtain complementary local structural features. Finally, dual-branch cross-gated fusion is performed to obtain local structural enhancement features.
[0135] The enhanced coupling features are sequentially normalized layer by layer, and represented as fused normalized features. ,pass Convolution performs channel blending and mapping to obtain intermediate features fused from the channels. :
[0136]
[0137] Scan context conditional modulation includes the following operations:
[0138] The enhanced coupling features are subjected to global pooling to obtain context summary information, and the context summary information is then subjected to lightweight conditional mapping to obtain a conditional vector.
[0139] Based on the conditional vector, the intermediate features are subjected to adaptive modulation enhancement at both the sample and channel levels. The enhanced sample and channel features are then subjected to depthwise convolution with different convolution configurations to obtain complementary local structural features.
[0140] Scanning context-conditional modulation is applied to intermediate features of channel fusion. This enhances the coupling features. Extract contextual summary information and generate conditional parameters for modulating the feedforward branch. This enhances the coupling features. Global average pooling and lightweight mapping are used to obtain the condition vector. :
[0141]
[0142] in, Indicates global average pooling. Represents a lightweight conditional generation mapping (which can be derived from a linear mapping, (Convolutional or multilayer perceptron implementation) is used to convert context summaries into conditional vectors. .
[0143] Based on condition vectors The modulation coefficients of the two local enhancement branches are generated respectively. and and the intermediate features of channel fusion Perform adaptive modulation to obtain the modulated features. and :
[0144]
[0145] in, Represents element-wise multiplication; modulation coefficient , It can be a scalar or a channel vector, used to implement sample-level or channel-level adaptive enhancement intensity control.
[0146] Modulated features and Two depthwise convolutional branches are input separately for local structure modeling:
[0147]
[0148] in, and It is a local structural feature of the branch. and These are two depthwise convolutional local enhancement operators that can employ the same or different convolutional configurations (e.g., different kernel sizes, different dilation rates, or different grouping strategies) to form complementary local structural features.
[0149] Dual-branch cross-gating includes the following operations:
[0150] Complementary local structural features are mapped and convolved based on conditional vectors to obtain cross-gated weights.
[0151] By using cross-gated weights to perform element-wise addition, weighted summation, channel concatenation, and convolutional projection, complementary local structural features are fused.
[0152] Channel projection is performed on the fused local structural features to obtain local structural enhancement features.
[0153] To avoid noise superposition and redundant activation introduced by the fixed addition of the two branches, the present invention introduces cross-gating between the two branches. That is, the output of one branch generates the gating weight to modulate the output of the other branch, so that the two branches can filter and suppress each other's noise.
[0154] Specifically, it begins with local structural features. Generate local structural features Cross-gating weights :
[0155]
[0156] Based on local structural features Generate local structural features Cross-gating weights :
[0157]
[0158] in, , A lightweight gated mapping function, which can be derived from linear mappings, Convolution or combinations thereof are implemented; gating mappings allow the introduction of conditional vectors. As a bias or modulation term, to make the gating behavior adapt to the context; This represents the Sigmoid mapping function; and It can be a scalar, channel vector, or spatial weight graph, used to implement gating modulation at different granularities.
[0159] Complementary local structural features are obtained by element-wise multiplication of cross-gated weights with local features. and , is represented as:
[0160] ,
[0161] After completing the cross-gating, the outputs of the two gating channels are fused to obtain the fused local structural features. :
[0162]
[0163] in, The fusion operator can be represented by element-wise addition, weighted summation, or channel concatenation followed by... It is implemented using convolutional projection to merge two complementary information streams into a unified representation.
[0164] Finally, regarding local structural features Through the second Convolution is used for channel projection to obtain local structure enhancement features. :
[0165]
[0166] in, For channel blending and mapping, two deep convolutional branches are used to enhance the local spatial response with low overhead; scanning context conditional modulation enables the enhancement intensity to adapt to the sample and context; dual-branch cross-gating enables the two local responses to mutually filter and suppress noise within the block, reducing redundant activation and noise superposition, thereby improving the stability and discriminativeness of feature enhancement while maintaining high efficiency.
[0167] Local structural feature enhancement need not be limited to a specific number of convolutional branches or a specific convolutional form. It can be replaced by other feature enhancement structures (such as bottleneck structures with local enhancements, feature enhancement structures with depthwise separable convolutions, etc.), as long as it can achieve the purpose of enhancing nonlinear expressive power and supplementing local feature refinement with lower computational overhead.
[0168] S5. Downsample the local structural enhancement features, and obtain the second gated detail enhancement feature through gated detail enhancement. Replace the first gated detail enhancement feature, and then execute S3 and S4 to obtain the shallow features.
[0169] Gated detail enhancement and spatial-channel selective cross-scanning are performed again. Gated detail enhancement is used to compensate for fine-grained discriminative cues after shallow downsampling, reducing feature loss caused by excessive compression of small inputs in the early stages. Subsequently, spatial-channel selective cross-scanning is used to further enhance the features, forming a more robust shallow semantic representation.
[0170] The purpose of this step is twofold: firstly, to preserve sparse but crucial local evidence in small-sized grayscale images; and secondly, to couple spatial and channel-dimensional features at a shallow level, laying a stable representational foundation for subsequent deep semantic aggregation.
[0171] S6. After downsampling the shallow feature extraction features and replacing the first gated detail enhancement features, execute S3 and S4 to obtain the depth feature map.
[0172] The sampled shallow features are then subjected to S3-S4 operations again. Downsampling is performed to progressively expand the receptive field, improve the level of feature abstraction, and compress redundant information. Performing S3-S4 steps again allows for continuous multi-dimensional feature capture and association in a deeper semantic space, enabling global discriminative information to be stably propagated and fused at different scales.
[0173] The purpose of this step is to gradually form deep semantic features for category discrimination while keeping computational costs under control, and to avoid the problem of insufficient context utilization caused by relying on a single spatial path or unidirectional information flow at a deep level.
[0174] S7. Perform global average pooling and class probability mapping on the deep feature map to perform classification.
[0175] Global average pooling is performed on the deep feature map to obtain feature vectors, and the feature vectors are input into the multilayer perceptron classification head to generate prediction scores for each category. Then, the prediction scores are mapped to the category probability distribution between 0 and 1, and the category with the highest probability is output as the prediction label.
[0176] The purpose of this step is to map the deep representation after multi-scale fusion into encrypted traffic classification results, realize end-to-end classification decision output, and keep the classification head lightweight to facilitate deployment.
[0177] The aggregation method of the output features does not have to be limited to global average pooling; global max pooling, hybrid pooling, or attention aggregation can also be used. The classifier does not have to be limited to a multilayer perceptron; it can also be a linear classifier or other lightweight classification structure, as long as it can output the predicted score / probability of each category and give the predicted category.
[0178] An encrypted traffic classification system based on state-space modeling and cross-dimensional scanning includes the following modules:
[0179] Data acquisition and sample construction module: The original encrypted traffic data is sequentially divided into stream levels and preprocessed. In the sequence domain, the time-series segments of data packets are segmented and classified and labeled, and mapped to the initial samples in the image domain. The initial samples in the image domain are resampled by class-conditional adaptive sliding window to obtain image domain sample data with class balance.
[0180] Gated detail enhancement module: The image domain sample data is downsampled, and then the small-size grayscale image features are gated for detail enhancement. The residual of the small-size grayscale image features is aggregated to obtain the first gated detail enhancement feature.
[0181] Spatial-channel selective cross-scan module: The first gated detail enhancement feature is linearly mapped and smoothed to obtain the gated signal; the first gated detail enhancement feature is linearly mapped, deep convolutional and smoothed to obtain the content enhancement signal; the content enhancement signal and the gated signal are processed by spatial-channel selective cross-scan to obtain the enhanced coupling feature;
[0182] The spatial-channel selective cross-scan processing involves the following steps:
[0183] The content enhancement signal is subjected to bidirectional cross-scanning in a specified spatial dimension to output spatial structure features.
[0184] The gating signal is multiplied element-wise with the spatial structure features to filter out redundancy and output the gating feature.
[0185] Perform a bidirectional cross-scan on the spatial structure features in two parallel branches, height-channel and width-channel, to obtain the channel coupling features.
[0186] The gated features and channel coupling features are modulated and residuals are aggregated, and then enhanced coupling features are obtained by layer normalization and linear projection.
[0187] Local structure enhancement module: The enhanced coupling features are sequentially normalized, convolved and channel mapped to obtain intermediate features, then scan context conditional modulation is performed to obtain complementary local structure features, and then dual-branch cross-gated fusion is performed to obtain local structure enhancement features;
[0188] Shallow feature extraction module: The local structure enhancement features are downsampled, and then gated detail enhancement is performed to obtain the second gated detail enhancement features. After replacing the first gated detail enhancement features, the spatial-channel selective cross-scanning module and the local structure enhancement module are executed to obtain shallow features.
[0189] Deep feature extraction module: The shallow feature extraction features are downsampled, and the first gated detail enhancement features are replaced. Then, the spatial-channel selective cross-scan module and the local structure enhancement module are executed again to obtain the depth feature map.
[0190] Classification output module: Performs global average pooling and class probability mapping on the deep feature map to perform classification.
[0191] The scanning context-conditional modulation module performs global average pooling on the coupled enhancement features to obtain context summary information. It then performs lightweight conditional mapping on the context summary information to obtain a conditional vector. Based on the conditional vector, it performs sample-level and channel-level adaptive modulation enhancement on the intermediate features. Finally, it performs depthwise convolution with different convolution configurations on the modulated and enhanced sample and channel features to obtain complementary local structural features.
Claims
1. A method for classifying encrypted traffic based on state-space modeling and cross-dimensional scanning, characterized in that, Includes the following steps: S1. Perform flow-level division and preprocessing on the original encrypted traffic data in sequence. In the sequence domain, segment and classify the time-series segments of the data packets and map them to the initial samples in the image domain. Perform category-condition adaptive sliding window resampling on the initial samples in the image domain to obtain the image domain sample data. S2. Downsample the image domain sample data to obtain small-size grayscale image features, then perform gated detail enhancement, and aggregate with the residual of the small-size grayscale image features to obtain the first gated detail enhancement feature; S3. Perform linear mapping and smooth activation on the first gated detail enhancement feature to obtain the gated signal; perform linear mapping, depth convolution and smooth activation on the first gated detail enhancement feature to obtain the content enhancement signal; perform spatial-channel selective cross-scanning on the content enhancement signal and the gated signal to obtain the enhancement coupling feature; The spatial-channel selective cross-scan processing involves the following steps: The content enhancement signal is subjected to bidirectional cross-scanning in a specified spatial dimension to output spatial structure features. The gating signal is multiplied element-wise with the spatial structure features to filter out redundancy and output the gating feature. Perform a bidirectional cross-scan on the spatial structure features in two parallel branches, height-channel and width-channel, to obtain the channel coupling features. The gated features and channel coupling features are modulated and residuals are aggregated, and then enhanced coupling features are obtained by layer normalization and linear projection. S4. The enhanced coupling features are sequentially normalized, convolved, and channel mapped to obtain intermediate features. Then, the scanning context conditional modulation is performed to obtain complementary local structural features. Finally, dual-branch cross-gated fusion is performed to obtain local structural enhancement features. S5. Downsample the local structural enhancement features, and obtain the second gated detail enhancement feature through gated detail enhancement. Replace the first gated detail enhancement feature, and then execute S3 and S4 to obtain the shallow features. S6. After downsampling the shallow feature extraction features and replacing the first gated detail enhancement features, execute S3 and S4 to obtain the depth feature map. S7. Perform global average pooling and class probability mapping on the deep feature map to perform classification.
2. The method of claim 1, wherein, S4 scan context conditional modulation includes the following operations: Global average pooling is performed on the coupling enhancement features to obtain context summary information, and lightweight conditional mapping is performed on the context summary information to obtain conditional vectors. Based on conditional vectors, the intermediate features are subjected to adaptive modulation enhancement at the sample and channel levels. The enhanced sample and channel features are then subjected to depthwise convolution with different convolution configurations to obtain complementary local structural features.
3. The encrypted traffic classification method based on state-space modeling and cross-dimensional scanning according to claim 1, characterized in that, The dual-branch cross-gated fusion in S4 includes the following operations: Complementary local structural features are mapped and convolved based on conditional vectors to obtain cross-gated weights. By using cross-gated weights to perform element-wise addition, weighted summation, channel concatenation, and convolutional projection, complementary local structural features are fused. Channel projection is performed on the fused local structural features to obtain local structural enhancement features.
4. The encrypted traffic classification method based on state-space modeling and cross-dimensional scanning according to claim 1, characterized in that, The enhanced gating details in S2 include the following: The small-sized grayscale image features are normalized and the dimensions are adjusted by channel mapping. Then, parallel multi-scale deep convolution is performed to obtain multi-scale detail aggregation features. The aggregation features are divided equally along the channel dimension. The channel response is adaptively scaled and channel projected by the gated output features to obtain the first gated detail enhancement features.
5. The encrypted traffic classification method based on state-space modeling and cross-dimensional scanning according to claim 1, characterized in that, The following operations are included in S1 for converting sequence domain data into image sample data: In the sequence domain, a fixed-length sliding window is used to sample the sequence of streaming data packets. The sampled data is truncated and padded with zeros to obtain time-series samples of equal length. The time-series samples are then mapped to grayscale images of fixed size. Count the number of grayscale image samples in each category, and then classify and label the samples. In the image domain, a category-conditional adaptive sliding window is used to generate image domain samples and inherit the original labels, resulting in category-balanced image domain sample data.
6. The encrypted traffic classification method based on state-space modeling and cross-dimensional scanning according to claim 1, characterized in that, The bidirectional cross-scan of spatial dimensions in S3 includes the following operations: The content enhancement signal is fed into a spatial dimension scan, where the spatial dimension includes height and channel dimensions, width and channel dimensions, or height and width dimensions.
7. The encrypted traffic classification method based on state-space modeling and cross-dimensional scanning according to claim 1, characterized in that, The adaptive category conditions in S1 include the following operations: The image domain sliding window step size is automatically adjusted based on the number of category samples.
8. The encrypted traffic classification method based on state-space modeling and cross-dimensional scanning according to claim 4, characterized in that, Parallel multi-scale depthwise convolution includes the following operations: Different receptive fields are used to simultaneously capture the correlation between fine-grained local textures and larger-scale structures; parallel branch outputs are aggregated by fusion units to obtain multi-scale detail representations.
9. A cryptographic traffic classification system based on state-space modeling and cross-dimensional scanning, characterized in that... Includes the following modules: Data acquisition and sample construction module: The original encrypted traffic data is sequentially divided into stream levels and preprocessed. In the sequence domain, the time-series segments of data packets are segmented and classified and labeled, and mapped to the initial samples in the image domain. The initial samples in the image domain are resampled by class-conditional adaptive sliding window to obtain image domain sample data with class balance. Gated detail enhancement module: Downsamples the image domain sample data to obtain small-size grayscale image features; performs gated detail enhancement on the small-size grayscale image features, and aggregates the residuals of the small-size grayscale image features to obtain the first gated detail enhancement feature; Spatial-channel selective cross-scan module: The first gated detail enhancement feature is linearly mapped and smoothed to obtain the gated signal; the first gated detail enhancement feature is linearly mapped, deep convolutional and smoothed to obtain the content enhancement signal; the content enhancement signal and the gated signal are processed by spatial-channel selective cross-scan to obtain the enhanced coupling feature; The spatial-channel selective cross-scan processing involves the following steps: The content enhancement signal is subjected to bidirectional cross-scanning in a specified spatial dimension to output spatial structure features. The gating signal is multiplied element-wise with the spatial structure features to filter out redundancy and output the gating feature. Perform a bidirectional cross-scan on the spatial structure features in two parallel branches, height-channel and width-channel, to obtain the channel coupling features. The gated features and channel coupling features are modulated and residuals are aggregated, and then enhanced coupling features are obtained by layer normalization and linear projection. Local structure enhancement module: The enhanced coupling features are sequentially normalized, convolved and channel mapped to obtain intermediate features, then scan context conditional modulation is performed to obtain complementary local structure features, and then dual-branch cross-gated fusion is performed to obtain local structure enhancement features; Shallow feature extraction module: The local structure enhancement features are downsampled, and then gated detail enhancement is performed to obtain the second gated detail enhancement features. After replacing the first gated detail enhancement features, spatial-channel selective cross-scanning and local structure enhancement modules are executed to obtain shallow features. Deep feature extraction module: The shallow feature extraction features are downsampled, and after replacing the first gated detail enhancement features, the spatial-channel selective cross-scanning and local structure enhancement modules are executed to obtain the depth feature map; Classification output module: Performs global average pooling and class probability mapping on the deep feature map to perform classification.
10. The encrypted traffic classification system based on state-space modeling and cross-dimensional scanning according to claim 9, characterized in that, The local structure enhancement module includes a scanning context conditional modulation module, which performs global average pooling on the coupled enhancement features to obtain context summary information, and performs lightweight conditional mapping on the context summary information to obtain a conditional vector. Based on conditional vectors, the intermediate features are subjected to adaptive modulation enhancement at the sample and channel levels. The enhanced sample and channel features are then subjected to depthwise convolution with different convolution configurations to obtain complementary local structural features.