An ssh behavior fine-grained identification method and device against behavior mixed interference

Abstract

The application discloses an SSH behavior fine-grained identification method and device resisting mixed interference of behaviors, in the training stage, taking single-class SSH flow as a target flow, taking other-class SSH flow as an interference flow, constructing a transition anchor point packet through cross-flow feature splicing, generating a training sample with a controllable mixed ratio and a soft label; the length of the data packet, the arrival time interval and the transmission direction features are extracted, and the global hidden representation is extracted through the adaptive fusion input sequence encoder; the Gaussian prototype mean of each behavior category is constructed, the scaled posterior probability of the representation with a margin is calculated, and the joint loss function optimization model parameters are constructed accordingly; an adaptive course scheduling mechanism based on gain is introduced, and the mixed interference ratio is gradually increased to promote the training; in the reasoning stage, the to-be-tested flow is input into the model, and the maximum a posteriori probability category is taken as the prediction result. The application realizes the robust identification of SSH fine-grained behavior categories in the interference environment.

Description

Technical Field

[0001] This invention relates to the field of network security and intelligent analysis of encrypted traffic, specifically to a fine-grained method and apparatus for SSH behavior identification that resists mixed behavioral interference. Background Technology

[0002] With the rapid development of network encryption technology, encrypted tunnels have become an important component of modern network infrastructure. Virtual Private Networks (VPNs), Secure Shell (SSH) tunnels, Transport Layer Security (TLS)-based proxies, and multi-hop relay systems, among other tunneling mechanisms, provide confidentiality for data transmission through multi-layered encryption and encapsulation technologies, playing a crucial role in remote access, privacy protection, and cross-network secure communication. However, this technical characteristic, designed to protect compliant communications, also provides natural cover for malicious network activities such as Advanced Persistent Threats (APTs), Command and Control (C2) attacks, and data breaches. Attackers often exploit the legitimate traffic appearance of encrypted tunnels to establish long-term and stable encrypted connections, hiding malicious command interactions and sensitive data transmissions within, rendering traditional network security monitoring methods that rely on plaintext parsing severely ineffective. Existing security devices often only identify the existence of the tunnel protocol but struggle to discern the true semantics of communication behavior within the tunnel, failing to meet the practical needs of refined security management.

[0003] Among the many application protocols obscured by tunneling technology, SSH exhibits particularly prominent security risks due to its unique characteristics. The SSH protocol is not only a fundamental tool for legitimate remote system management and automated operation and maintenance, but its high interactivity, powerful data manipulation capabilities, and inherent end-to-end encryption support also make it a frequent target for attackers, used as a vehicle for remote control, information gathering, and illegal data transfer. The SSH protocol is not a single functional carrier; its actual fine-grained behavioral patterns are significantly diverse, encompassing various operation types from lightweight system status queries, continuous command output and system monitoring, to large-scale file transfers. These behaviors differ significantly in their operational purposes and potential security risks. However, existing traffic analysis techniques and security systems typically employ coarse-grained identification strategies, treating SSH traffic within a tunnel as a single application category, ignoring the semantic differences at the fine-grained behavioral level. This simplistic approach has significant limitations when facing complex security scenarios: an SSH connection within the scope of security policies can be maliciously exploited to execute unauthorized sensitive data transmissions or conduct long-term monitoring. The defender urgently needs a technical means to determine the specific behavior type of the connection through traffic side-channel characteristics, rather than just the protocol type.

[0004] In real-world network environments, attackers typically deploy automated post-exploitation frameworks or chained command sequences after establishing an encrypted tunnel. These sequences execute multiple attack phases (e.g., system reconnaissance, data manipulation, and persistent monitoring) with short intervals, rather than relying on manual, step-by-step interactions. Due to these brief intervals, the observation window captured by the traffic analyzer at the tunnel observation point often contains packets from multiple different SSH behavior phases simultaneously. The packets from different behaviors highly overlap in time series, leading to severe interleaving and aliasing of underlying side-channel characteristics. Existing classifiers struggle to accurately extract the true fine-grained SSH behavioral semantics from this strongly structured, perturbed mixed packet sequence. This behavioral aliasing problem, caused by both attack rhythm and tunnel observation limitations, becomes even more severe after further processing by obfuscation mechanisms such as time regularization and packet padding, posing a core technical challenge to fine-grained SSH behavior identification within encrypted tunnels.

[0005] Currently, research on encrypted tunnel traffic mainly focuses on tunnel protocol identification, encrypted application classification, and mixed traffic analysis. Existing methods mostly employ machine learning or deep learning techniques, relying on statistical characteristics such as packet length distribution, arrival time intervals, and handshake patterns to classify encrypted traffic without decryption. However, these methods generally suffer from the following limitations: First, existing methods primarily focus on coarse-grained classification at the application or protocol level, with limited ability to model the semantic-level fine-grained behavior of SSH within the tunnel, failing to distinguish the security risks corresponding to different operation types. Second, when SSH traffic is further encapsulated in complex scenarios such as HTTPS proxies, gRPC tunnels, or multi-hop relay systems, its fine-grained behavioral characteristics are significantly weakened during multi-layer encryption and encapsulation, making it difficult for existing methods to maintain stable identification performance. Third, existing methods lack targeted modeling for mixed traffic problems caused by the coexistence of multiple behaviors within the tunnel; when multiple types of network behavior packet characteristics intertwine within the observation window, classification performance significantly degrades. Therefore, how to overcome the interference of feature interleaving when carrying multiple types of network behaviors in encrypted tunnels, and accurately identify fine-grained behavioral semantics of SSH without relying on payload decryption, is an important technical problem that urgently needs to be solved in the current network security field. Summary of the Invention

[0006] Purpose of the invention: The purpose of this invention is to provide a method and apparatus for fine-grained identification of SSH behavior that resists mixed behavioral interference, so as to overcome the feature interleaving interference in mixed traffic and accurately identify the fine-grained behavioral semantics of SSH in encrypted tunnels without relying on payload decryption.

[0007] Technical solution: A fine-grained SSH behavior recognition method resistant to mixed behavioral interference, comprising the following steps:

[0008] Acquire encrypted tunnel traffic, use single-category SSH traffic as the target flow and other categories of SSH traffic as interference flows, construct transition anchor packets by splicing cross-flow features, and generate training samples with controllable mixing ratios and their corresponding soft labels.

[0009] Extract the packet length, arrival time interval, and transmission direction of a specified number of data packets from the training samples, and record the location of valid data packets; extract the latent representation vectors corresponding to each dimension of features and concatenate them along the feature dimensions to obtain a joint representation; adaptively adjust the feature channel weights of the joint representation through a channel-level gating mechanism to generate a fusion representation matrix for each data packet; combine the feature mask corresponding to the location of the valid data packet, input the fusion representation matrix into the sequence encoder, and extract the sequence-level global hidden representation;

[0010] A learnable Gaussian prototype mean is established for each behavior category; the distance metric between the sequence-level global hidden representation and each Gaussian prototype mean is calculated, and the margin-scaled posterior probability of the sequence-level global hidden representation on each behavior category is calculated using the distance metric; a discriminant margin loss is constructed using the margin-scaled posterior probability and the soft labels of the training samples, and a maximum likelihood regularization loss is constructed using the distance metric, and a joint loss function is constructed accordingly to optimize the model parameters and the Gaussian prototype mean; and a gain-based adaptive course scheduling mechanism is introduced to gradually increase the proportion of mixed interference to advance training.

[0011] During the inference phase, the traffic to be tested is input into the trained model, and the class with the highest posterior probability is taken as the prediction result of the fine-grained behavior class of SSH in the traffic to be tested.

[0012] Furthermore, by constructing transition anchor packets through cross-stream feature concatenation, training samples with controllable mixing ratios and their corresponding soft labels are generated, including:

[0013] Let the obtained encrypted tunnel traffic dataset be denoted as ,in A sequence of data packets. For the corresponding SSH behavior category label, let the target flow be... Interference flow is ,satisfy Based on the retention factor Determine the cutoff point of the target flow. and the intercept length of the interference flow Satisfying capacity constraints ,in Synthesize transition anchor packets for the specified maximum number of data packets. Its spatial features are taken from the first packet of the interfering flow, and its temporal features are inherited from the subsequent temporal context at the truncation point of the target flow; the hybrid flow and its soft label are defined as:

[0014]

[0015]

[0016] in To preserve the coefficient, representing the proportion of the target stream data packets in the mixed stream, This represents the proportion of interfering data packets.

[0017] Furthermore, for packet length, arrival time interval, and transmission direction, the latent representation vectors corresponding to each dimension of features are extracted and concatenated along the feature dimensions to obtain a joint representation, specifically including:

[0018] The data packet length is encoded using a learnable discretized index, as follows: For the data packet length... Discretize it into a vocabulary index ,in Maintain a learnable embedding matrix for the size of the vocabulary. ,by The row index is obtained by directly looking up the table. Dimensional length encoding ;

[0019] The transmission direction is vectorized and linearly projected as follows: For the transmission direction Encode it as a two-dimensional One-Hot vector Through learnable linear projection matrices Project to dimensional latent vector ;

[0020] The arrival time interval is subjected to distributed renormalization transformation and linear projection as follows: For the arrival time interval The following four composite transformations are performed sequentially: The first step compresses the unbounded interval into a bounded surrogate variable using the hyperbolic tangent function. : The second step involves using the trimming operator. Will The constraints are within the numerical stability range. As a stability constant, it is then mapped back to the unconstrained logarithmic probability space via the inverse hyperbolic tangent function. : The third step involves redistributing the time density using the Soft-Sigmoid function. ,in The curvature parameter; the fourth step is to use a linear projection matrix. scalar Project to dimensional latent vector : ;

[0021] Encode the data packet length Direction coding and arrival time interval encoding By concatenating along the feature dimensions, a joint representation is obtained. .

[0022] Furthermore, the weights of each feature channel in the joint representation are adaptively adjusted through a channel-level gating mechanism to generate a fusion representation matrix for each data packet. Combining this matrix with the feature mask corresponding to the effective data packet position, the fusion representation matrix is ​​input into the sequence encoder to extract the sequence-level global hidden representation, specifically including:

[0023] Based on joint characterization Generate learnable gated vectors from global context The fusion representation matrix is ​​obtained by element-wise multiplication. ,in Represents element-wise product. For the embedding dimension of packet fusion representation;

[0024] fusion representation matrix Input Transformer encoder Extract sequence-level global hidden representations: ,in The hidden layer feature dimension of the Transformer encoder. For the specified maximum number of data packets, These are the model parameters.

[0025] Furthermore, the distance metric is specifically adopted as the negative squared Euclidean distance;

[0026] The posterior probability with margin scaling is calculated as follows:

[0027] For each behavior category Maintain the learnable Gaussian prototype mean , The total number of behavior categories, representing the target flow categories participating in the mixing of the mixed samples. and interference flow category Apply margin scaling factor The posterior probability is defined as:

[0028]

[0029] in , For indicator functions, It is a sequence-level global hidden representation.

[0030] Furthermore, the joint loss function is constructed as follows:

[0031] Discriminant margin loss based on soft label Defined as weighted soft cross-entropy:

[0032]

[0033] Maximum likelihood regularization loss transforms sequence-level global hidden representations Geometric anchoring is at a convex combination of the means of two Gaussian prototypes:

[0034]

[0035] The total loss of optimization is ,in For linear annealing weights, For training rounds, Scaling factor This is the retention coefficient when generating mixed samples.

[0036] Furthermore, the gain-based adaptive course scheduling mechanism is specifically defined as follows:

[0037] Based on the monotonically decreasing retention coefficient sequence Progressing in stages, the gain at each stage is defined as follows: ,in This represents the loss value for the initial round of the current difficulty level. Let be the minimum loss value recorded so far within the current difficulty level; For the preset gain threshold, when And the number of training rounds is no less than At that time, the trigger phase advances to reduce Until the preset maximum difficulty level is reached. And the gain satisfies the termination condition, so the model parameters are saved. and the mean of Gaussian prototypes of each category .

[0038] A fine-grained SSH behavior recognition device resistant to mixed behavioral interference includes:

[0039] The hybrid sample generation module is used to acquire encrypted tunnel traffic, using single-class SSH traffic as the target flow and other classes of SSH traffic as interference flows; it constructs transition anchor packets by splicing cross-flow features to generate training samples with controllable mixing ratios and their corresponding soft labels.

[0040] The feature extraction module is used to extract the data packet length, arrival time interval, and transmission direction of a specified number of data packets in the training samples, and record the location of valid data packets; extract the latent representation vectors corresponding to each dimension of features and concatenate them along the feature dimensions to obtain a joint representation; adaptively adjust the weights of each feature channel of the joint representation through a channel-level gating mechanism to generate a fusion representation matrix for each data packet; combine the feature mask corresponding to the location of the valid data packet, input the fusion representation matrix into the sequence encoder, and extract the sequence-level global hidden representation;

[0041] The model training module is used to establish a learnable Gaussian prototype mean for each behavior category; calculate the distance metric between the sequence-level global hidden representation and each Gaussian prototype mean, and use the distance metric to calculate the margin-scaled posterior probability of the sequence-level global hidden representation for each behavior category; construct a discrimination margin loss using the margin-scaled posterior probability and the soft labels of the training samples, construct a maximum likelihood regularization loss using the distance metric, and construct a joint loss function accordingly to optimize the model parameters and the Gaussian prototype mean; and introduce a gain-based adaptive course scheduling mechanism to gradually increase the proportion of mixed interference to advance training.

[0042] The prediction module is used during the inference phase to input the traffic to be tested into the trained model and take the class with the highest posterior probability as the prediction result of the fine-grained behavior class of the SSH in the traffic to be tested.

[0043] The present invention also provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the fine-grained SSH behavior recognition method against mixed behavioral interference as described above.

[0044] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the SSH behavior fine-grained identification method as described above, which is resistant to mixed behavioral interference.

[0045] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the SSH behavior fine-grained identification method as described above, which is resistant to mixed behavioral interference.

[0046] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0047] (1) To address the difficulty in identifying multiple network behavior features intertwined in encrypted tunnels, this invention proposes a sequence-aware structure interpolation strategy. Transition anchor packets are constructed by splicing cross-stream features, synthesizing training samples with a controllable mixing ratio while maintaining temporal continuity. This strategy avoids the defect of traditional Mixup methods that disrupt the temporal causality of data packet sequences, providing the model with a structurally continuous and semantically controllable mixed training distribution.

[0048] (2) Existing methods treat SSH traffic within a tunnel as a single application category, failing to distinguish its fine-grained behavioral semantics. This invention models the potential feature distribution of each SSH behavior category as a Gaussian prototype through sequence-aware structure interpolation and Gaussian prototype constraints, jointly optimizing the discrimination margin loss and maximum likelihood regularization loss. This achieves fine-grained identification of SSH behavior under mixed interference conditions, advancing the analysis granularity from the protocol level to the semantic behavior level. Mathematical derivation proves that the optimal solution of the regularization loss strictly corresponds to the interpolation coefficients of the mixed soft labels, establishing provable geometric consistency between the feature manifold and the label space. This effectively alleviates feature interference caused by traffic confusion, enhances the intra-class compactness and inter-class separability of mixed samples, and improves the robustness of identifying real SSH fine-grained behavior categories.

[0049] (3) This invention proposes a gain-based adaptive course scheduling mechanism, which uses the mixing ratio as a controllable course variable and automatically advances the training difficulty based on the loss gain of the current training stage. This mechanism enables the model to start from interference-free samples and gradually adapt to different levels of feature aliasing scenarios, avoiding the problem that the fixed mixing ratio training strategy cannot simultaneously take into account interference-free accuracy and interference robustness. It can maintain stable recognition performance in real tunnel network scenarios and achieve dynamic matching between training difficulty and model representation ability. Attached Figure Description

[0050] Figure 1 The overall workflow of a fine-grained SSH behavior recognition method that resists mixed behavioral interference;

[0051] Figure 2 A schematic diagram of hybrid tunnel flow generation in a sequence-aware structure interpolation strategy;

[0052] Figure 3 This serves as the framework for model training. Detailed Implementation

[0053] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention, and should not be used to limit the scope of protection of the present invention.

[0054] To address the problem of inaccurate identification of fine-grained SSH behavior semantics within mixed traffic due to the interleaving and overlapping of various behavioral data packets within the encrypted tunnel observation window, this invention proposes a fine-grained SSH behavior identification method resistant to behavioral mixing interference. (Refer to...) Figure 1 The method includes the following steps:

[0055] Step S1: Collect encrypted tunnel traffic and build a training dataset. Generate a mixed tunnel flow with a controllable mixing ratio through a cross-flow feature splicing strategy.

[0056] Collect encrypted tunnel traffic and build a training dataset. ,in A sequence of data packets. This corresponds to the SSH behavior category label. Let the target flow be... Interference flow is ,satisfy ,in These are tunnel flow data packet sequences, These are the SSH behavior category labels corresponding to the tunnel flow. (See reference...) Figure 2 Based on the retention factor Determine the cutoff point of the target flow. and the intercept length of the interference flow Satisfying capacity constraints ,in The specified maximum number of data packets. Synthesize transition anchor packets. Its spatial characteristics (data packet length) and direction (Taken from the first packet of the interference stream, time characteristics (arrival time interval)) The subsequent temporal context inherited from the truncation point of the target stream is used to eliminate temporal abrupt changes at the splice point. The hybrid stream and its soft tag are defined as follows:

[0057]

[0058]

[0059] in To preserve the coefficient, representing the proportion of the target stream data packets in the mixed stream, This represents the proportion of interfering data packets.

[0060] Step S2: Extract the three-dimensional side-channel features of data packet length, arrival time interval, and transmission direction, and perform heterogeneous feature encoding respectively.

[0061] Extract the length of a specified number of data packets from each tunnel stream. Arrival time interval and transmission direction Three-dimensional side-channel features, for insufficient The tunnel stream of each data packet is sequence-aligned and padded (in this embodiment, zeros are added to the end of the sequence to the specified length). ), and record the validity mask for each location. For packet length Discretize it into a vocabulary index ,in To maintain a learnable embedding matrix of length vocabulary size. ,by The row index is obtained by directly looking up the table. Dimensional length encoding The embedding matrix is ​​jointly trained with the model parameters, enabling different length values ​​to learn discriminative dense representations in the latent space. For the transmission direction... Encode it as a two-dimensional One-Hot vector Through learnable linear projection matrices Project to dimensional latent vector For arrival time interval Because it follows a heavy-tailed distribution, linear normalization will compress the change information on a short time scale. Therefore, the following four-step composite transformation is performed in sequence:

[0062]

[0063]

[0064]

[0065]

[0066] The first step is to use the hyperbolic tangent function to define the unbounded interval. Compressed into bounded proxy variables To suppress the heavy-tailed effect; the second step is to use the pruning operator. Will The constraints are within the numerical stability range, where As a stability constant, it is then mapped back to the unconstrained logarithmic probability space via the inverse hyperbolic tangent function. The third step involves correcting the distribution geometry; the soft-sigmoid function is then used. reallocation time density, where The curvature parameter controls the transformation slope, ensuring the model remains sensitive in both high-frequency bursts and long-period idle intervals; the fourth step uses a linear projection matrix. scalar Project to dimensional latent vector .

[0067] Step S3: Concatenate the potential representation vectors, generate a data packet fusion representation matrix through a channel-level gating fusion mechanism, and input it into the sequence encoder to extract the sequence-level global hidden representation.

[0068] In this embodiment of the invention, the sequence encoder is a Transformer encoder. The data packet length is encoded. Arrival time interval encoding and direction encoding By concatenating along the feature dimensions, a joint representation is obtained. : .based on Generate learnable gated vectors from global context ,in The embedding dimension of the data packet fusion representation is obtained by adaptively adjusting the contribution weights of each feature channel through element-wise multiplication.

[0069]

[0070] in Represents element-wise multiplication, gated vector As a semantic selector, it amplifies information-rich structural feature channels while suppressing redundant features irrelevant to the current context. (Refer to...) Figure 3 , will fuse the representation matrix Input Transformer encoder ,in For the hidden layer feature dimension of the Transformer encoder, a multi-head self-attention mechanism is used to capture long-range dependencies in the data packet sequence and extract sequence-level global hidden representations:

[0071]

[0072] Finally, a feature mask is applied to the padding positions, causing the encoder to ignore the positions corresponding to the padding data packets when calculating attention weights, thus obtaining a sequence-level global hidden representation. In the following text, sequence-level global hidden representation will be referred to simply as hidden representation.

[0073] Step S4: Build a learnable Gaussian prototype for each SSH behavior category, calculate the distance metric between the global hidden representation and the mean of each SSH prototype, and use this to calculate the posterior probability with margin scaling.

[0074] For each behavior category Maintain the learnable Gaussian prototype mean In a preferred embodiment, its covariance matrix can be fixed as the identity matrix. (i.e., isotropic distribution), where The total number of SSH behavior categories. For category indexing. For the two categories involved in the mixing of samples. and Apply margin scaling factor The posterior probability is defined as:

[0075]

[0076] in This is the margin scaling factor. For indicator functions, The total number of behavior categories. The enhancement of the item's appeal to the target category prototype makes the hidden representation more attractive. Compared to other categories, the prototypes are more tightly clustered. and This enhances intra-class compactness and strengthens decision boundaries by placing them near the target area.

[0077] Step S5: Optimize the discrimination margin loss and the maximum likelihood regularization loss by jointly optimizing the model parameters through linear annealing weights.

[0078] Discriminant margin loss based on soft label Defined as weighted soft cross-entropy:

[0079]

[0080] Maximum likelihood regularization loss anchors the hidden representation geometry at a convex combination of the two Gaussian prototypes:

[0081]

[0082] The total loss of the optimization is:

[0083]

[0084]

[0085] in For linear annealing weights, This refers to the training rounds within the current phase. This is the scaling factor. At the beginning of each course phase... , Starting from zero and increasing linearly with each training epoch, the model uses discrimination margin loss in the early stages. Prioritize establishing category differentiation capabilities, and then gradually increase the regularization loss. The weights are used to progressively anchor the hidden representations to the vicinity of the Gaussian prototype.

[0086] Step S6 introduces a gain-based adaptive course scheduling mechanism, which automatically advances the training difficulty based on the loss gain of the current training stage, so that the model can gradually adapt to different proportions of feature aliasing scenarios from interference-free samples.

[0087] Course scheduling is based on a monotonically decreasing sequence of retention coefficients. Progressing in stages, among which This corresponds to a no-interference condition. The gain for each stage is defined as follows:

[0088]

[0089] in This represents the loss value for the initial round of the current difficulty level. This is the smallest loss value recorded so far within the current difficulty level; when And the current training rounds are no less than At that time, refer to Figure 3 The scheduler triggers the advancement of the phase, reducing... To generate training samples with stronger structural perturbations. This is the course gain threshold, used to determine whether the model has adequately adapted to the current level of interference; This is the minimum number of training epochs for each course stage, ensuring the model has undergone sufficient optimization iterations before advancing to the next difficulty stage due to insufficient training epochs. When the course scheduling reaches the preset maximum difficulty stage... That is, the sequence of retained coefficients The last stage Training completed and gain satisfied When the training process terminates, the model parameters at that point are saved. and the mean of Gaussian prototypes of each category This yields the final SSH behavior recognition model.

[0090] Step S7: In the inference phase, the traffic to be tested is input into the model, the global hidden representation is extracted sequentially and the posterior probability is calculated, and the class with the highest probability is taken as the prediction result.

[0091] The model parameters obtained in step S6 and the mean of Gaussian prototypes of each category For the flow under test, steps S2 to S4 are executed sequentially to extract the sequence-level global hidden representation. Then, calculate its mean with respect to the Gaussian prototypes of each category. The distance metric between them (in this embodiment, the squared Euclidean distance is calculated, and its negative value is used as the input to the exponential function) is used to obtain the posterior probability of each class through a Softmax function with margin scaling. The category with the highest posterior probability is taken as the SSH fine-grained behavior category prediction result for this tunnel flow:

[0092]

[0093] in For the final predicted category, This represents the total number of SSH behavior categories. The inference process relies on converged model parameters and the Gaussian prototype mean, and can be directly deployed at tunnel observation points for online inference of real-time captured encrypted tunnel traffic.

[0094] In practical implementation, this invention constructs a consistency constraint between the feature space and the label space through maximum likelihood regularization loss. Its specific mechanism and derivation process are as follows:

[0095] At the feature representation level, this is used to constrain hidden representations. Regarding the location distribution, this invention introduces a maximum likelihood regularization loss:

[0096]

[0097] Given that the squared Euclidean distance is used as the metric, in order to find the optimal feature location that minimizes the regularization loss, the hidden representation is... Find the gradient and set it to zero:

[0098]

[0099] After simplification, the optimal solution corresponding to the optimization objective is:

[0100]

[0101] The above derivation shows that, Guided Hidden Representations To category prototype and The convex combinations converge. The interpolation coefficients of its optimal solution... and With the mixed sample soft label in this invention The coefficients are set consistently. By setting this regularization loss, the geometric position of the mixed samples in the feature representation space corresponds to its set proportion in the label space. This constrains the model to extract anti-interference feature representations based on the soft label proportion when facing feature aliasing, thereby improving the performance of fine-grained behavior recognition for SSH.

[0102] In one embodiment, taking a hybrid SSH traffic encapsulated by a tunnel as an example, the sample can be generated during the training phase using the anchor packet mechanism described in step S1. Let the target tunnel flow be SSH file system enumeration behavior, and the interfering flow be SSH data leakage behavior. A retention coefficient is set according to the current course stage. The generated mixed stream contains a total of 64 packets, of which the first 48 packets are obtained by truncating the target stream (truncation position). The 49th packet is the synthesized transition anchor packet, and the following 15 packets are obtained by intercepting interference streams (intercept length). When the traffic is captured at the tunnel observation point, the payload content is fully encrypted, and the analysis system can only obtain the three-dimensional side-channel characteristics of the data packet length, arrival time interval, and transmission direction.

[0103] According to the method described in step S2, the arrival time intervals of the 64 data packets in the mixed tunnel stream are extracted respectively. Data packet length and transmission direction Three-dimensional features. Taking a data packet in the file system enumeration phase as an example, its original arrival time interval is small, 0.012s. After a four-step composite transformation, it is mapped to a probability value of approximately 0.472. And through a linear projection matrix Mapped to 3D vector, to obtain time encoding During the data leakage phase, the original arrival time interval of a certain data packet was relatively large, approximately 0.380 seconds. After the same transformation, it was mapped to a probability value of approximately 0.631. Meanwhile, the data packet length... Learnable embedding matrix Index encoding yields length encoding Transmission direction After One-Hot encoding, the forward data packet is encoded as [1, 0], and the reverse data packet is encoded as [0, 1]. Then, it is processed by a linear projection matrix. Mapping yields directional encoding .

[0104] According to the method described in step S3, the three-dimensional encoding results of the 64 data packets are first concatenated along the feature dimension to obtain the joint representation matrix. Through learnable gating vectors The gating mechanism adaptively adjusts the weights of each feature channel. Since file system enumeration behavior and data leakage behavior differ most significantly in packet length distribution, the gating mechanism adaptively assigns higher weights to the length encoding channel, effectively amplifying the feature dimension most discriminative in distinguishing the two behaviors, and generating a fused representation matrix. Then Input Transformer encoder Set its hidden dimensions The attention head has 4 elements. Feature masks are applied to possible padding positions at the end to extract sequence-level global hidden representations. The multi-head self-attention mechanism simultaneously captures the short-term request-response pattern of the file system enumeration phase and the continuous unidirectional transmission pattern of the data leakage phase, and integrates the temporal structure of the two behaviors into a unified representation space.

[0105] Based on the methods described in steps S4 and S5, the Gaussian prototype mean of each SSH behavior category is used. Calculate hidden representations centered on [the target]. The posterior probability with margin scaling. Utilizing hybrid soft labels. (Among them, the percentage of cases involving unauthorized actions is 0.75%, and the percentage of cases involving leaks is 0.25%). Calculate the discriminant margin loss separately. With maximum likelihood regularization loss The two loss functions are combined to optimize the model parameters and the Gaussian prototype mean.

[0106] According to the method described in step S6, the generation and training of this mixed sample follow an adaptive course scheduling mechanism. This varies with the loss gain at the current stage. Once convergence falls below the threshold of 0.01, the scheduler will automatically reduce the retention factor. A higher proportion of interference flow is introduced until the training reaches the maximum difficulty stage, at which point the training is terminated and the model parameters and the Gaussian prototype mean of each category are saved.

[0107] Following the method described in step S7, the model parameters and Gaussian prototype mean saved in step S6 are deployed at the tunnel observation points. For the flow to be measured, only forward inference needs to be performed, and the category with the highest posterior probability is taken as the SSH fine-grained behavior category prediction result for the tunnel flow. .

[0108] To verify the effectiveness of the method of this invention in a real network environment, a comparative experiment was conducted with existing encrypted traffic analysis methods. The comparative methods included TikTok (a method for website fingerprinting attacks using burst-level temporal features of data packets), RF (a website fingerprinting attack method based on robust traffic convergence matrix and CNN), GraphDApp (a method for identifying decentralized applications using graph neural networks and traffic interaction graphs), and FS-Net (a method for end-to-end feature learning and classification of raw flow sequences using recurrent neural networks). The test evaluation used a mixed encrypted tunnel traffic dataset actually collected in a real network environment. The experiments evaluated each method using four metrics: accuracy, precision, recall, and F1 score. The results are shown in Table 1.

[0109] Table 1. Comparison of accuracy, precision, recall, and F1 score with existing encrypted traffic analysis methods.

[0110]

[0111] As shown in Table 1, when facing real test traffic with unknown mixing ratios, the method of this invention shows improvements in accuracy, precision, recall, and F1 score. Specifically, the accuracy of the method reaches 88.62%, an improvement of 2.23 percentage points compared to FS-Net; the precision reaches 87.63%, an improvement of 4.84 percentage points compared to FS-Net; and the F1 score reaches 85.84%, an improvement of 5.19 percentage points compared to FS-Net. These objective data demonstrate that the adaptive course scheduling and Gaussian prototype constraint mechanism of this invention can effectively adapt to real encrypted tunnel environments lacking prior mixing ratios, maintaining the accuracy of fine-grained behavior category identification for SSH.

[0112] Based on the same technical concept as the method embodiments, the present invention also provides a fine-grained SSH behavior recognition device resistant to behavioral hybrid interference, comprising:

[0113] The hybrid sample generation module is used to acquire encrypted tunnel traffic, using single-class SSH traffic as the target flow and other classes of SSH traffic as interference flows; it constructs transition anchor packets by splicing cross-flow features to generate training samples with controllable mixing ratios and their corresponding soft labels.

[0114] The feature extraction module is used to extract the data packet length, arrival time interval, and transmission direction of a specified number of data packets in the training samples, and record the location of valid data packets; extract the latent representation vectors corresponding to each dimension of features and concatenate them along the feature dimensions to obtain a joint representation; adaptively adjust the weights of each feature channel of the joint representation through a channel-level gating mechanism to generate a fusion representation matrix for each data packet; combine the feature mask corresponding to the location of the valid data packet, input the fusion representation matrix into the sequence encoder, and extract the sequence-level global hidden representation;

[0115] The model training module is used to establish a learnable Gaussian prototype mean for each behavior category; calculate the distance metric between the sequence-level global hidden representation and each Gaussian prototype mean, and use the distance metric to calculate the margin-scaled posterior probability of the sequence-level global hidden representation for each behavior category; construct a discrimination margin loss using the margin-scaled posterior probability and the soft labels of the training samples, construct a maximum likelihood regularization loss using the distance metric, and construct a joint loss function accordingly to optimize the model parameters and the Gaussian prototype mean; and introduce a gain-based adaptive course scheduling mechanism to gradually increase the proportion of mixed interference to advance training.

[0116] The prediction module is used during the inference phase to input the traffic to be tested into the trained model and take the class with the highest posterior probability as the prediction result of the fine-grained behavior class of the SSH in the traffic to be tested.

[0117] It should be understood that the SSH behavior fine-grained identification device for resisting mixed behavioral interference in the embodiments of the present invention can implement all the technical solutions in the above method embodiments. The functions of each functional module can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above embodiments, which will not be repeated here.

[0118] The present invention also provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the fine-grained SSH behavior recognition method against mixed behavioral interference as described above.

[0119] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the SSH behavior fine-grained identification method as described above, which is resistant to mixed behavioral interference.

Claims

1. A fine-grained SSH behavior recognition method resistant to mixed behavioral interference, characterized in that, Includes the following steps: Acquire encrypted tunnel traffic, use single-category SSH traffic as the target flow and other categories of SSH traffic as interference flows, construct transition anchor packets by splicing cross-flow features, and generate training samples with controllable mixing ratios and their corresponding soft labels. Extract the packet length, arrival time interval, and transmission direction of a specified number of data packets from the training samples, and record the location of valid data packets; extract the latent representation vectors corresponding to each dimension of features and concatenate them along the feature dimensions to obtain a joint representation; adaptively adjust the feature channel weights of the joint representation through a channel-level gating mechanism to generate a fusion representation matrix for each data packet; combine the feature mask corresponding to the location of the valid data packet, input the fusion representation matrix into the sequence encoder, and extract the sequence-level global hidden representation; Develop a learnable Gaussian prototype mean for each behavior category; Calculate the distance metric between the sequence-level global hidden representation and the mean of each Gaussian prototype, and use the distance metric to calculate the margin-scaled posterior probability of the sequence-level global hidden representation for each behavior category. We construct a discrimination margin loss using the margin-scaled posterior probability and the soft labels of the training samples, construct a maximum likelihood regularization loss using distance metrics, and construct a joint loss function based on these to optimize the model parameters and Gaussian prototype mean. Furthermore, a gain-based adaptive course scheduling mechanism is introduced to gradually increase the proportion of mixed interference to advance training. During the inference phase, the traffic to be tested is input into the trained model, and the class with the highest posterior probability is taken as the prediction result of the fine-grained behavior class of SSH in the traffic to be tested.

2. The method according to claim 1, characterized in that, Transition anchor packets are constructed by concatenating cross-stream features to generate training samples with controllable mixing ratios and their corresponding soft labels, including: Let the obtained encrypted tunnel traffic dataset be denoted as ,in A sequence of data packets. For the corresponding SSH behavior category label, let the target flow be... Interference flow is ,satisfy Based on the retention factor Determine the cutoff point of the target flow. and the intercept length of the interference flow Satisfying capacity constraints ,in Synthesize transition anchor packets for the specified maximum number of data packets. Its spatial features are taken from the first packet of the interfering flow, and its temporal features are inherited from the subsequent temporal context at the truncation point of the target flow; the hybrid flow and its soft label are defined as follows: in To preserve the coefficient, representing the proportion of the target flow data packets in the mixed flow, This represents the proportion of interfering data packets.

3. The method according to claim 1, characterized in that, For packet length, arrival time interval, and transmission direction, the latent representation vectors corresponding to each dimension of features are extracted and concatenated along the feature dimensions to obtain a joint representation, specifically including: The data packet length is encoded using a learnable discretized index, as follows: For the data packet length... Discretize it into a vocabulary index ,in Maintain a learnable embedding matrix for the size of the vocabulary. ,by The row index is obtained by directly looking up the table. Dimensional length encoding ; The transmission direction is vectorized and linearly projected as follows: For the transmission direction Encode it as a two-dimensional One-Hot vector Through learnable linear projection matrices Project to dimensional latent vector ; The arrival time interval is subjected to distributed renormalization transformation and linear projection as follows: For the arrival time interval The following four composite transformations are performed sequentially: The first step compresses the unbounded interval into a bounded surrogate variable using the hyperbolic tangent function. : The second step involves using the trimming operator. Will Within the range of numerical stability, As a stability constant, it is then mapped back to the unconstrained logarithmic probability space via the inverse hyperbolic tangent function. : The third step involves redistributing the time density using the Soft-Sigmoid function. ,in The curvature parameter; the fourth step is through the linear projection matrix. scalar Project to dimensional latent vector : ; Encode the data packet length Direction coding and arrival time interval encoding By concatenating along the feature dimensions, a joint representation is obtained. .

4. The method according to claim 1, characterized in that, The weights of each feature channel in the joint representation are adaptively adjusted through a channel-level gating mechanism to generate a fusion representation matrix for each data packet. Combined with the feature mask corresponding to the effective data packet position, the fusion representation matrix is ​​input into the sequence encoder to extract the sequence-level global hidden representation, specifically including: Based on joint characterization Generate learnable gated vectors from global context The fusion representation matrix is ​​obtained by element-wise multiplication. ,in Represents element-wise product. For the embedding dimension of packet fusion representation; fusion representation matrix Input Transformer encoder Extract sequence-level global hidden representations: ,in The hidden layer feature dimension of the Transformer encoder. For the specified maximum number of data packets, These are the model parameters.

5. The method according to claim 1, characterized in that, The distance metric specifically uses negative squared Euclidean distance. The posterior probability with margin scaling is calculated as follows: For each behavior category Maintain the learnable Gaussian prototype mean , The total number of behavior categories, representing the target flow categories participating in the mixing of the mixed samples. and interference flow category Apply margin scaling factor The posterior probability is defined as: in , For indicator functions, It is a sequence-level global hidden representation.

6. The method according to claim 5, characterized in that, The joint loss function is constructed as follows: Discriminant margin loss based on soft label Defined as weighted soft cross-entropy: Maximum likelihood regularization loss transforms sequence-level global hidden representations Geometric anchoring is at a convex combination of the means of two Gaussian prototypes: The total loss of optimization is ,in For linear annealing weights, For training rounds, Scaling factor This is the retention coefficient when generating mixed samples.

7. The method according to claim 1, characterized in that, The gain-based adaptive course scheduling mechanism is specifically defined as follows: Based on the monotonically decreasing retention coefficient sequence Progressing in stages, the gain at each stage is defined as follows: ,in This represents the loss value for the initial round of the current difficulty level. Let be the minimum loss value recorded so far within the current difficulty level; For the preset gain threshold, when And the number of training rounds is no less than At that time, the trigger phase advances to reduce Until the preset maximum difficulty level is reached. And the gain satisfies the termination condition, so the model parameters are saved. and the mean of Gaussian prototypes of each category .

8. A fine-grained SSH behavior recognition device resistant to mixed behavioral interference, characterized in that, include: A hybrid sample generation module is used to acquire encrypted tunnel traffic, using a single type of SSH traffic as the target flow and other types of SSH traffic as interference flows; Transition anchor packages are constructed by splicing cross-stream features to generate training samples with controllable mixing ratios and their corresponding soft labels. The feature extraction module is used to extract the data packet length, arrival time interval, and transmission direction of a specified number of data packets in the training samples, and record the location of valid data packets; extract the latent representation vectors corresponding to each dimension of features and concatenate them along the feature dimensions to obtain a joint representation; adaptively adjust the weights of each feature channel of the joint representation through a channel-level gating mechanism to generate a fusion representation matrix for each data packet; combine the feature mask corresponding to the location of the valid data packet, input the fusion representation matrix into the sequence encoder, and extract the sequence-level global hidden representation; The model training module is used to build a learnable Gaussian prototype mean for each behavior category; Calculate the distance metric between the sequence-level global hidden representation and the mean of each Gaussian prototype, and use the distance metric to calculate the margin-scaled posterior probability of the sequence-level global hidden representation for each behavior category. We construct a discrimination margin loss using the margin-scaled posterior probability and the soft labels of the training samples, construct a maximum likelihood regularization loss using distance metrics, and construct a joint loss function based on these to optimize the model parameters and Gaussian prototype mean. Furthermore, a gain-based adaptive course scheduling mechanism is introduced to gradually increase the proportion of mixed interference to advance training. The prediction module is used during the inference phase to input the traffic to be tested into the trained model and take the class with the highest posterior probability as the prediction result of the fine-grained behavior class of the SSH in the traffic to be tested.

9. An electronic device, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the SSH behavior fine-grained identification method against behavioral mixing interference as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the SSH behavior fine-grained identification method against behavioral mixing interference as described in any one of claims 1-7.

Images