Network traffic classification method, system, device and storage medium with multi-feature fusion

Abstract

The application provides a multi-feature fusion network traffic classification method, system, device and storage medium, the method comprising: obtaining target traffic, the target traffic comprising multiple different types of traffic; inputting the target traffic into a network traffic classification model to obtain the traffic type in the target traffic; wherein the network traffic classification model comprises a multi-core convolutional neural network, a bidirectional long short-term memory network and a Transformer model, the multi-core convolutional neural network is used for extracting local features of the target traffic, the bidirectional long short-term memory network is used for extracting time sequence dynamic features according to the local features, and the Transformer model is used for obtaining attention features according to the time sequence dynamic features. The network traffic classification method in the embodiment of the application can effectively distinguish similar types of traffic, is effective in encrypted and obfuscated traffic classification, and has application potential in enhancing a network security system.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, system, device, and storage medium for network traffic classification based on multi-feature fusion. Background Technology

[0002] Driven by the widespread adoption of cloud computing services, mobile applications, and IoT devices, internet traffic has experienced explosive growth, with significant increases in the scale, variety, and speed of network data. In modern networks, the increasingly complex traffic environment and diversified network applications make accurate traffic classification a critical task for ensuring network security, optimizing traffic management, and guaranteeing service quality. However, traditional classification techniques such as port-based identification and deep packet inspection are gradually becoming ineffective due to multiple factors, including the widespread adoption of encryption protocols such as HTTPS (Hypertext Transfer Protocol Secure), VPN (Virtual Private Network), and QUIC (Quick UDP Internet Connections), dynamic port allocation and reuse, and the frequent use of private or obfuscated communication modes. These traditional methods often struggle to achieve accurate classification, especially in encrypted traffic or zero-day attack scenarios.

[0003] To address these limitations, machine learning-based methods have emerged as a promising alternative. These models leverage statistics extracted from traffic and behavioral features such as packet length, packet arrival intervals, and flow duration to achieve content-independent traffic classification without directly examining packet payloads, thus balancing user privacy protection with system scalability.

[0004] In recent years, deep learning has become a powerful tool for network traffic classification, capable of automatically learning hierarchical and abstract feature representations from raw or low-processing data. Compared with traditional machine learning methods, deep learning models—especially those employing recurrent architectures such as convolutional neural networks and long short-term memory networks—have demonstrated superior performance in capturing the spatial and temporal characteristics of traffic patterns. These models can effectively model complex dependencies, nonlinear interactions, and underlying structural relationships in data.

[0005] However, the relevant technologies still face several challenges. Existing methods often struggle to distinguish similar traffic, and the classification accuracy is low when the traffic similarity is high. Summary of the Invention

[0006] This invention provides a network traffic classification method, system, device, and storage medium based on multi-feature fusion, with the main objective of improving the classification accuracy and precision of similar traffic.

[0007] In a first aspect, embodiments of the present invention provide a network traffic classification method based on multi-feature fusion, comprising:

[0008] Acquire target traffic, which includes various different types of traffic;

[0009] The target traffic is input into a network traffic classification model to obtain the traffic type in the target traffic;

[0010] The network traffic classification model includes a multi-kernel convolutional neural network, a bidirectional long short-term memory network, and a Transformer model. The multi-kernel convolutional neural network is used to extract local features of the target traffic, the bidirectional long short-term memory network is used to extract temporal dynamic features based on the local features, and the Transformer model is used to obtain attention features based on the temporal dynamic features.

[0011] The network traffic classification model is trained using different types of traffic samples and their corresponding type labels.

[0012] Further, the step of inputting the target traffic into a network traffic classification model to obtain the traffic type in the target traffic includes:

[0013] The target traffic is input into the multi-kernel convolutional neural network to capture features at different scales and obtain the local features;

[0014] The local features are input into the bidirectional long short-term memory network to extract contextual information and obtain the temporal dynamic features;

[0015] The temporal dynamic features are input into the Transformer model, and the global dependencies are captured and the feature representation ability is enhanced through the self-attention mechanism to obtain the attention features;

[0016] The attention features are input into the pooling layer to obtain the traffic type of the target traffic.

[0017] Furthermore, the multi-kernel convolutional neural network includes three parallel convolutional branches, which use convolutional kernels of sizes 3, 5, and 7, respectively.

[0018] Furthermore, the bidirectional long short-term memory network includes two parallel long short-term memory networks that process data information from different directions.

[0019] Furthermore, by employing a multi-head attention mechanism, the Transformer model focuses on information from different representation subspaces.

[0020] Furthermore, the network traffic classification model is trained using different types of traffic samples and their corresponding type labels, including:

[0021] During training, synthetic minority class oversampling technique is used to enhance traffic samples with a number less than a preset threshold in order to solve the problem of imbalance in the number of samples of different traffic types.

[0022] To improve training stability and prevent overfitting, an early stopping mechanism with a tolerance of 5 epochs, a plateau learning rate decay strategy with a decay factor of 0.5, and model checkpoints are introduced to preserve the best-performing model.

[0023] All input data is converted into a fixed-length time series through a sliding window of size 10, enabling the network traffic classification model to effectively learn sequence patterns.

[0024] Furthermore, the traffic samples are obtained in the following manner:

[0025] Load the USTC-TK2016 dataset. After the data is loaded, all samples in each traffic sample file are uniformly assigned corresponding labels.

[0026] In the feature selection stage, non-informative fields in the traffic samples are removed. These non-informative fields include "flow identifier", "source IP address", "destination IP address" and "timestamp".

[0027] Identify and exclude features in the traffic samples that could cause tag leakage;

[0028] Delete traffic sample files where the proportion of abnormal data exceeds a preset threshold, and obtain traffic samples and their corresponding labels for training.

[0029] Secondly, embodiments of the present invention provide a network traffic classification system based on multi-feature fusion, comprising:

[0030] The acquisition module is used to acquire target traffic, which includes various different types of traffic.

[0031] The classification module is used to input the target traffic into the network traffic classification model to obtain the traffic type in the target traffic;

[0032] The network traffic classification model includes a multi-kernel convolutional neural network, a bidirectional long short-term memory network, and a Transformer model. The multi-kernel convolutional neural network is used to extract local features of the target traffic, the bidirectional long short-term memory network is used to extract temporal dynamic features based on the local features, and the Transformer model is used to obtain attention features based on the temporal dynamic features.

[0033] The network traffic classification model is trained using different types of traffic samples and their corresponding type labels.

[0034] Thirdly, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described multi-feature fusion network traffic classification method.

[0035] Fourthly, embodiments of the present invention provide a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned multi-feature fusion network traffic classification method.

[0036] This invention proposes a multi-feature fusion network traffic classification method, system, device, and storage medium. It provides a network traffic classification model with a unified deep learning architecture that directly processes raw traffic sequences. This model integrates a multi-kernel one-dimensional convolutional neural network to extract multi-scale spatial features, employs a bidirectional long short-term memory network for bidirectional temporal modeling, and introduces a Transformer-based self-attention mechanism to dynamically focus on key features. Evaluation on the USTC-TK2016 dataset shows that the model achieves stable convergence within 50 training epochs and reaches near-perfect classification accuracy, with precision, recall, and F1 score all exceeding 90% in most traffic categories.

[0037] The network traffic classification model performs well in traffic categories such as BitTorrent, FTP, and Gmail, while recall decreases for categories like SMB and Zeus due to feature overlap and limited sample size. Confusion matrix analysis shows that misclassification is mainly concentrated between similar traffic types. These results validate the effectiveness of the network traffic classification model in classifying encrypted and obfuscated traffic, demonstrating its application potential in enhancing network security systems. Attached Figure Description

[0038] Figure 1 A flowchart of a network traffic classification method based on multi-feature fusion provided in an embodiment of the present invention;

[0039] Figure 2 This is a traffic type graph of the USTC-TK2016 dataset in this embodiment of the invention;

[0040] Figure 3 This is a schematic diagram illustrating the relationship between loss and training rounds during the training process of the network traffic classification model in this embodiment of the invention.

[0041] Figure 4This is a schematic diagram illustrating the relationship between accuracy and training rounds during the training process of the network traffic classification model in this embodiment of the invention.

[0042] Figure 5 This is a bar chart showing the performance evaluation results of the network traffic classification model in a multi-category network traffic classification task in this embodiment of the invention.

[0043] Figure 6 This is a confusion matrix diagram of the network traffic classification model in this embodiment of the invention;

[0044] Figure 7 This is a schematic diagram of the structure of a network traffic classification system with multi-feature fusion provided in an embodiment of the present invention.

[0045] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0046] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0047] Existing methods often fail to fully exploit the inherent multi-scale spatial characteristics of traffic statistics, nor do they effectively model the long-range temporal dependencies crucial for identifying session-based or burst-type traffic. Some solutions attempt to circumvent these limitations by converting traffic time-series data into an image-like format, thereby applying standard two-dimensional convolutional neural networks. However, this approach may incur significant computational overhead, reduce model interpretability, and disrupt the inherent temporal continuity of traffic sequences.

[0048] Despite the significant progress made in deep learning, current research still faces two major challenges: First, most models rely on a single convolutional kernel to extract spatial information, which limits their ability to capture multi-scale spatial features, which is crucial for adapting to the complexity and diversity of traffic patterns; second, some methods convert traffic data into image formats to apply two-dimensional CNNs (Convolutional Neural Networks), which not only increases computational overhead but may also destroy the original temporal structure, weakening the model's ability to capture temporal dependencies.

[0049] To overcome these limitations, this invention proposes a unified deep learning architecture that directly processes the original traffic sequence, achieving joint modeling of multi-dimensional features while maintaining temporal continuity. The network traffic classification model proposed in this invention integrates three key components: (1) a one-dimensional convolutional neural network with multiple convolutional kernels to extract multi-scale spatial features under different receptive fields; (2) a bidirectional long short-term memory network to capture bidirectional temporal dependencies; and (3) a Transformer-based self-attention mechanism to achieve dynamic weighting and focusing of key traffic features.

[0050] Figure 1 A flowchart of a network traffic classification method based on multi-feature fusion provided in an embodiment of the present invention is shown below. Figure 1 As shown, the method includes:

[0051] S110, Obtain target traffic, wherein the target traffic includes multiple different types of traffic;

[0052] S120, Input the target traffic into the network traffic classification model to obtain the traffic type in the target traffic;

[0053] The network traffic classification model includes a multi-kernel convolutional neural network, a bidirectional long short-term memory network, and a Transformer model. The multi-kernel convolutional neural network is used to extract local features of the target traffic, the bidirectional long short-term memory network is used to extract temporal dynamic features based on the local features, and the Transformer model is used to obtain attention features based on the temporal dynamic features.

[0054] The network traffic classification model is trained using different types of traffic samples and their corresponding type labels.

[0055] The embodiments of the present invention first acquire target traffic, which includes traffic samples of various types, such as the nine normal types: BitTorrent, FTP, Gmail, MySQL, Outlook, Skype, SMB, Weibo, and WorldOfWarcraft, and the ten malicious types: Cridex, Geodo, Htbot, Miuref, Neris, Nsis-ay, Shifu, Tinba, Virut, and Zeus. The target traffic may include any one or more of these types.

[0056] To effectively capture local patterns and long-range dependencies in complex sequence data, this study proposes a network traffic classification model with a unified classification architecture integrating multi-kernel convolutional neural networks, bidirectional long short-term memory networks, and Transformer models.

[0057] By inputting the target traffic into the network traffic classification model, the types of traffic contained in the target traffic can be obtained.

[0058] The multi-kernel convolutional neural network first extracts diverse local features using multiple filters with convolutional kernels of different sizes, enabling the model to recognize patterns at different granular levels. These local representations are then processed by a bidirectional long short-term memory network, which captures forward and backward temporal dependencies to obtain temporal dynamic features, enhancing the model's ability to understand cross-temporal contextual relationships. Finally, the Transformer model uses a self-attention mechanism to model global dependencies and optimizes feature representations by dynamically weighting the correlations of different sequence elements, resulting in attention features.

[0059] By integrating the advantages of these three architectures into a unified framework, the proposed network traffic classification model achieves robust and comprehensive feature learning, making it particularly suitable for high-precision classification tasks in the domain of serialized and structured data.

[0060] As one implementation method, the step of inputting the target traffic into a network traffic classification model to obtain the traffic type in the target traffic includes:

[0061] The target traffic is input into the multi-kernel convolutional neural network to capture features at different scales and obtain the local features;

[0062] The local features are input into the bidirectional long short-term memory network to extract contextual information and obtain the temporal dynamic features;

[0063] The temporal dynamic features are input into the Transformer model, and the global dependencies are captured and the feature representation ability is enhanced through the self-attention mechanism to obtain the attention features;

[0064] The attention features are input into the pooling layer to obtain the traffic type of the target traffic.

[0065] In this embodiment of the invention, a multi-kernel convolutional neural network aims to extract rich and diverse local features from the input sequence. The network traffic classification model employs three parallel convolutional branches, using convolutional kernels of sizes 3, 5, and 7, respectively. The 3-kernel focuses on capturing fine-grained short-range dependencies, the 5-kernel strikes a balance between local detail and a slightly broader context, while the 7-kernel is better suited for recognizing longer-range and more abstract patterns. Local features are obtained through feature extraction using convolutional kernels of different sizes.

[0066] By combining these convolutional operations, this multi-kernel convolutional neural network achieves multi-scale feature extraction, enabling it to effectively capture temporal patterns at different resolutions. The feature maps generated by all three branches are concatenated to form a unified and comprehensive representation, which is then input into subsequent bidirectional long short-term memory networks and Transformer models for deeper temporal and semantic modeling. This multi-kernel convolutional neural network structure lays a solid foundation for hierarchical representation learning in the hybrid framework of the entire network traffic classification model.

[0067] Following multi-kernel convolutional neural networks, a bidirectional long short-term memory (LSTM) network layer is employed to capture temporal dependencies and contextual information in the input sequence. Unlike traditional unidirectional LSM networks, the bidirectional LSM network consists of two parallel LSM layers: one processes the sequence forward (from past to future), and the other processes it backward (from future to past). This bidirectional structure allows the model to simultaneously integrate information from both forward and backward elements in the sequence, thereby achieving a more comprehensive understanding of the context.

[0068] This bidirectional long short-term memory (LSTM) network is particularly effective for sequence tasks—such as time series analysis or natural language processing—because the meaning of a particular element in these tasks often depends on its context. By learning long-range dependencies bidirectionally, the LSM network enhances the temporal dynamics of features extracted by multi-kernel convolutional neural networks, resulting in temporally dynamic features. This allows the architecture to capture not only local patterns but also sequence patterns spanning time. The output of the LSM network is then fed into the Transformer module for global feature optimization.

[0069] The Transformer model is integrated into the final stage of a unified classification architecture, capturing global dependencies and enhancing feature representation capabilities through a self-attention mechanism. Unlike recurrent networks, the Transformer model can process the entire sequence simultaneously, thus modeling long-range associations more efficiently. Its self-attention mechanism dynamically evaluates the importance of each element in the sequence relative to other elements, allowing the Transformer model to focus on the most relevant parts of the input when making predictions.

[0070] By employing a multi-head attention mechanism, the Transformer model can focus on information from different representation subspaces, further enriching the feature context. This global perspective complements the local and sequence features extracted by the aforementioned multi-kernel convolutional neural networks and bidirectional long short-term memory networks. Ultimately, the Transformer model refines the learned features, capturing complex patterns and dependencies across the entire sequence. This comprehensive modeling approach improves overall classification performance, especially when dealing with complex structured data.

[0071] As one implementation method, the network traffic classification model is trained using different types of traffic samples and corresponding type labels for the traffic samples, including:

[0072] During training, synthetic minority class oversampling technique is used to enhance traffic samples with a number less than a preset threshold in order to solve the problem of imbalance in the number of samples of different traffic types.

[0073] To improve training stability and prevent overfitting, an early stopping mechanism with a tolerance of 5 epochs, a plateau learning rate decay strategy with a decay factor of 0.5, and model checkpoints are introduced to preserve the best-performing model.

[0074] All input data is converted into a fixed-length time series through a sliding window of size 10, enabling the network traffic classification model to effectively learn sequence patterns.

[0075] The traffic samples are obtained in the following way:

[0076] Load the USTC-TK2016 dataset. After the data is loaded, all samples in each traffic sample file are uniformly assigned corresponding labels.

[0077] In the feature selection stage, non-informative fields in the traffic samples are removed. These non-informative fields include "flow identifier", "source IP address", "destination IP address" and "timestamp".

[0078] Identify and exclude features in the traffic samples that could cause tag leakage;

[0079] Delete traffic sample files where the proportion of abnormal data exceeds a preset threshold, and obtain traffic samples and their corresponding labels for training.

[0080] This invention utilizes the USTC-TK2016 dataset (https: / / stratosphereips.org / category / dataset.html), publicly available from the University of Science and Technology of China. As a comprehensive and publicly accessible network traffic dataset, it covers a wide range of network flow types, including normal traffic and various malicious activities, thus serving as an ideal benchmark for evaluating intrusion detection systems. Figure 2 This is a traffic type graph of the USTC-TK2016 dataset in this embodiment of the invention, such as... Figure 2As shown, this dataset contains multiple traffic categories with a relatively balanced distribution, with each category generally accounting for between 1% and 17.6%. The major traffic categories include FTP (17.6%), MySQL (14.8%), Cridex (10.8%), Geodo (8.8%), and Neris (8.9%). Other significant categories include Skype (7%), SMB (6.7%), Weibo (6.9%), and relatively smaller categories such as BitTorrent (1.3%), Gmail (1.5%), and Outlook (1.3%).

[0081] During dataset processing, the open-source tool CIC-Meterflow was used to convert the raw network traffic data in .pcap format into structured .csv files to support subsequent analysis and modeling. After the data was loaded, all samples in each file were uniformly assigned corresponding labels.

[0082] In the feature selection stage, this embodiment of the invention removes non-informative fields such as "flow identifier," "source IP address," "destination IP address," "timestamp," and the tag column itself. Simultaneously, features that could potentially lead to tag leakage—such as fields containing "tag" or "category" in their names—are identified and excluded to ensure data integrity and security. Numerical features are converted to 32-bit floating-point format and undergo rigorous data quality checks. The vast majority of files do not contain missing values ​​or infinity values. A small number of files contain an extremely low proportion of anomalous data (e.g., infinity values ​​are as low as 2.45 × 10⁻⁻⁻⁴). 7 This figure is far below the acceptable threshold of 5%. To address this, embodiments of the present invention remove samples containing outliers to ensure data quality and the stability of model training.

[0083] It should be noted that the network traffic classification model proposed in this embodiment integrates multi-scale one-dimensional convolutional layers (Conv1D with kernel sizes of 3, 5, 7, and 9), a compressed activation module, a bidirectional long short-term memory network layer, and a multi-head self-attention mechanism to effectively capture spatial and temporal features. The network traffic classification model uses batch normalization for feature standardization and employs Dropout layers with dropout rates of 0.3 and 0.2 to suppress overfitting.

[0084] In addition, L2 regularization with a coefficient of 0.1 is applied to control model complexity and improve generalization ability. The network traffic classification model is trained using the Adam optimizer (initial learning rate 3×10⁻⁻⁻⁶). 4 And sparse classification cross-entropy is used as the loss function.

[0085] The network traffic classification model is trained using a mini-batch size of 128, with a maximum of 50 iterations. To improve training stability and prevent overfitting, an early stopping mechanism (tolerance epochs = 5), a plateau learning rate decay strategy (tolerance epochs = 3, decay factor = 0.5), and a model checkpoint to save the best-performing model are introduced.

[0086] To address the class imbalance problem, the training set employs a synthetic minority class oversampling technique to augment minority class samples. All input data is converted into fixed-length time series through a sliding window of size 10, enabling the model to effectively learn sequence patterns.

[0087] The dataset is divided into a training and validation set (which is further split into two parts in an 8:2 ratio) and an independent test set, with 20% of the data used as the independent test set for the final performance evaluation.

[0088] To comprehensively evaluate the performance of the proposed multi-class classification model, this embodiment of the invention employs a set of widely accepted evaluation metrics, including accuracy, precision, recall, and F1 score. These metrics are calculated separately for each class to obtain fine-grained performance data, and then aggregated through macro-averaging to ensure balanced evaluation across all classes (especially in scenarios with class imbalance). This method ensures that each class contributes equally to the overall evaluation, avoiding the undue influence of the dominant class on the results.

[0089] Accuracy measures the overall correctness of predictions and is defined as the proportion of correctly classified samples out of the total number of samples. While intuitive and simple, this metric can be misleading in imbalanced datasets—high accuracy may simply stem from correct predictions of the majority class. Precision reflects the proportion of true positives among all positive predictions, demonstrating its ability to reduce false positives. Recall (i.e., sensitivity) quantifies the model's ability to correctly identify positive instances from all true positives, thus highlighting its robustness in avoiding false negatives. The F1 score, as the harmonic mean of precision and recall, provides a single balanced metric that considers both false positives and false negatives, making it particularly suitable for performance evaluation in imbalanced real-world scenarios.

[0090] In addition to the aforementioned scalar metrics, this study also employs a confusion matrix to visualize the distribution of correct and incorrect predictions across all categories. This matrix-based approach reveals the model's classification behavior in detail, showing which categories are frequently misclassified and helping to identify confusion patterns between similar traffic types. In summary, these evaluation tools provide a comprehensive and interpretable performance evaluation framework for the model's effectiveness in multi-classification tasks.

[0091] This study provides a systematic and in-depth analysis of the training process of the proposed network traffic classification model in order to comprehensively evaluate its learning dynamics and overall performance. Figure 3This is a schematic diagram illustrating the relationship between the loss and the number of training epochs during the training process of the network traffic classification model in this embodiment of the invention. Figure 4 This diagram illustrates the relationship between accuracy and training epochs during the training of the network traffic classification model in this embodiment of the invention. In the diagram, Epochs represents the training epochs, Loss represents the loss, Loss Over Epochs represents the loss over the training epochs, Accuracy represents accuracy, Accuracy Over Epochs represents the accuracy over the training epochs, Training Loss represents the training loss, and Validation Loss represents the validation loss. Figure 3 and Figure 4 As shown, after 50 training rounds, the network traffic classification model exhibits good convergence and training stability.

[0092] Specifically, both training and validation losses decrease rapidly in the initial rounds, stabilize around the 10th round, and eventually remain at a low level. This indicates that the network traffic classification model can efficiently extract features from the input data and quickly transition from random initialization to effective pattern recognition.

[0093] like Figure 3 As shown, both training and validation losses exhibit a synchronous decreasing trend throughout the training process, with the validation loss remaining at a low level without significant fluctuations or rebounds. This indicates that the network traffic classification model achieves a good balance between fitting the training data and maintaining generalization ability, effectively avoiding the common overfitting problem.

[0094] same, Figure 4 The training and validation accuracies both steadily improved over time. As the number of training epochs increased, the two curves gradually approached 1.0 and almost completely overlapped in the later stages of training, demonstrating the superior performance of the network traffic classification model in multi-classification tasks. The small and stable difference between training and validation accuracies further indicates that no significant overfitting occurred during training. Furthermore, this consistency demonstrates the network traffic classification model's strong robustness and generalization ability when handling unseen data.

[0095] Figure 5 This is a bar chart showing the performance evaluation results of the network traffic classification model in a multi-category network traffic classification task in this embodiment of the invention. Figure 5 As shown, the focus is on three key metrics: precision, recall, and F1 score. Overall, the network traffic classification model performs excellently in most categories, with scores exceeding 90% for the vast majority of categories, indicating robust positive sample identification capabilities and high classification reliability.

[0096] It is worth noting that the network traffic classification model performs particularly well in identifying traffic from protocols and applications such as BitTorrent, FTP, and Gmail, with precision, recall, and F1 score all approaching or reaching 1.0, demonstrating its efficiency and accuracy in these areas. However, the recall rate for some categories (such as SMB) is slightly below 90%, indicating that there are still challenges in comprehensively capturing positive samples for certain specific traffic types.

[0097] In-depth analysis reveals significant differences in the detection performance of network traffic classification models across different traffic categories. Standardized network protocols (such as BitTorrent, FTP, and MySQL) demonstrate superior accuracy (generally exceeding 92%) due to their stable traffic patterns, confirming the robustness and practical applicability of network traffic classification models.

[0098] In contrast, while enterprise applications (such as Outlook and SMB) maintained high precision, their recall rates decreased by approximately 18% to 22%, primarily due to the obfuscation of encrypted traffic from Gmail, Skype, and other services, highlighting the inherent challenges of decryption and accurate identification of encrypted payloads. Security threat categories (such as Zeus, Miner, and Tinba) generally exhibited low recall rates, with Zeus showing a significantly higher false negative rate due to traffic obfuscation techniques, posing a substantial security risk.

[0099] In addition, niche systems (such as Cridex and Neris) and emerging applications (such as Shifu and Virut) have large fluctuations in their F1 scores due to limited training samples, revealing that the network traffic classification model still has limitations in its ability to generalize to uncommon traffic types.

[0100] Figure 6 This is a confusion matrix diagram of the network traffic classification model in an embodiment of the present invention, such as... Figure 6 As shown, the value in each cell of the confusion matrix represents the percentage of samples that are associated with a specific actual category and the predicted category. The rows of the matrix represent the actual traffic categories, and the columns correspond to the predicted labels. Most categories show high classification accuracy. The bold values ​​on the main diagonal represent correctly classified samples, with values ​​mostly close to or exceeding 99%, demonstrating the strong discriminative power of the network traffic classification model. The off-diagonal values ​​represent misclassifications, generally below 0.8%, indicating that the network traffic classification model has good generalization and reliability.

[0101] In terms of benign traffic classification, the network traffic classification model demonstrated excellent performance: Skype classification accuracy reached 100% with no misclassifications; the accuracy for BitTorrent, Gmail, MySQL, and WorldOfWarcraft traffic also exceeded 99.8%. However, some categories still exhibited confusion: for example, 1.14% of Outlook traffic was misclassified as Gmail, possibly due to the similarity in protocol layer characteristics caused by both using HTTPS; another 1.07% of FTP traffic was misclassified as SMB, possibly stemming from overlapping characteristics in file transfer behavior. The most significant confusion occurred between SMB and Weibo: 12.01% of SMB traffic was misclassified as Weibo, suggesting similarities in traffic characteristics such as port usage patterns and packet size distribution.

[0102] The network traffic classification model also performs exceptionally well against malicious traffic: the classification accuracy for categories such as Geodo, Htbot, Nsis-ay, Shifu, Tinba, and Virut all exceed 99.5%. However, some categories still exhibit confusion: 3.4% of Neris traffic was misclassified as other botnet types (including Virut and Zeus); meanwhile, 1.3% of Zeus traffic was misclassified as Virut, which may stem from characteristics shared by banking trojans, such as accessing financial domains or simulating user behavior.

[0103] Despite the high overall accuracy, several local misclassifications warrant attention. These errors typically stem from protocol-layer similarities or shared behavioral patterns, indicating that the network traffic classification model still has room for improvement in distinguishing traffic types with overlapping features (e.g., between SMB and Weibo, or between different botnet-related categories). This points the way for further improvements to the network traffic classification model.

[0104] While current network traffic classification models exhibit good performance, several areas for improvement remain. Significant misclassifications observed between traffic categories with similar protocol characteristics (e.g., SMB vs. Weibo, or Neris vs. Zeus botnet malware families) indicate that network traffic classification models need to improve their ability to capture subtle differences in complex traffic patterns. Future work could focus on integrating more refined feature extraction techniques (such as deep packet inspection or temporal behavior analysis) to better distinguish traffic with overlapping attributes.

[0105] Furthermore, employing more advanced attention mechanisms or graph-based neural networks may help to more effectively model inter-category relationships. Expanding datasets to encompass more diverse and up-to-date traffic samples will also enhance the robustness of network traffic classification models to evolving threats. Finally, exploring methods that fuse network flow features with multimodal data based on host or application layer signals could provide a more comprehensive perspective for accurate classification. These research directions aim to reduce residual confusion and further improve the generalization ability and reliability of network traffic classification systems.

[0106] This invention proposes a hybrid deep learning model—a network traffic classification model—integrating multi-core CNN, bidirectional LSTM, and Transformer architectures for multi-class network traffic classification, and systematically evaluates its performance. Experiments were conducted using the publicly available USTC-TK2016 dataset. After comprehensive data preprocessing, the network traffic classification model was evaluated under controlled experimental conditions using multiple performance metrics. During 50 training rounds, the network traffic classification model exhibited a stable convergence trend: the training loss approached zero, and the validation loss remained consistently low, indicating that the model achieved effective fitting without overfitting. The accuracy on both the training and validation sets steadily improved to nearly 1.0, with minimal difference between the two.

[0107] The network traffic classification model performed well across most traffic categories, with precision, recall, and F1 scores generally exceeding 90%. BitTorrent, FTP, and Gmail traffic achieved near-perfect classification accuracy. However, some categories (such as SMB) exhibited lower recall due to feature overlap caused by encryption; threat categories like Zeus, Miner, and Tinba saw reduced recall due to traffic obfuscation techniques. Insufficient training samples also led to significant performance fluctuations for rare traffic types, reflecting limitations in the generalization ability of the network traffic classification model in this scenario.

[0108] Confusion matrix analysis further confirmed the model's overall high accuracy: the vast majority of diagonal elements approached or exceeded 99%, highlighting its strong discriminative ability. However, local misclassification still occurred between similar traffic types (such as SMB and Weibo) and botnet-related families (such as Cridex and Neris), mainly due to the overlap between protocol layer features and behavioral patterns.

[0109] To address these challenges, future research should focus on improving the fine-grainedness of feature extraction and incorporating advanced architectures such as attention mechanisms and graph neural networks, taking into account the temporal and structural dynamics of traffic. Furthermore, expanding and enriching datasets and exploring multimodal data fusion across network, host, and application layers can enhance the robustness of models to dynamically evolving traffic patterns. These improvements aim to reduce residual misclassifications and further improve the generalization ability and reliability of network traffic classification models in real-world network environments.

[0110] Figure 7 This is a schematic diagram of the structure of a multi-feature fusion network traffic classification system provided in an embodiment of the present invention, as shown below. Figure 7 As shown, the system includes:

[0111] Acquisition module 710 is used to acquire target traffic, which includes multiple different types of traffic;

[0112] The classification module 720 is used to input the target traffic into the network traffic classification model to obtain the traffic type in the target traffic;

[0113] The network traffic classification model includes a multi-kernel convolutional neural network, a bidirectional long short-term memory network, and a Transformer model. The multi-kernel convolutional neural network is used to extract local features of the target traffic, the bidirectional long short-term memory network is used to extract temporal dynamic features based on the local features, and the Transformer model is used to obtain attention features based on the temporal dynamic features.

[0114] The network traffic classification model is trained using different types of traffic samples and their corresponding type labels.

[0115] This embodiment is a system embodiment corresponding to the above method embodiment. Its specific implementation process is the same as that of the above method embodiment. For details, please refer to the above method embodiment. This system embodiment will not repeat the details.

[0116] Each module in the aforementioned multi-feature fusion network traffic classification system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the computer device's memory as software, so that the processor can call and execute the corresponding operations of each module.

[0117] This invention provides a computer device, which may be a server. The computer device includes a processor, a memory, a network interface, and a database connected via a system bus. The processor provides computing and control capabilities. The memory includes a computer storage medium and internal memory. The computer storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the computer storage medium. The database stores data generated or acquired during the execution of a multi-feature fusion network traffic classification method. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a multi-feature fusion network traffic classification method.

[0118] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of a multi-feature fusion network traffic classification method as described in the above embodiment. Alternatively, when the processor executes the computer program, it implements the functions of each module / unit in this embodiment of a multi-feature fusion network traffic classification system.

[0119] In one embodiment, a computer storage medium is provided, on which a computer program is stored. When executed by a processor, the computer program implements the steps of the multi-feature fusion network traffic classification method described in the above embodiment. Alternatively, when executed by a processor, the computer program implements the functions of each module / unit in the above embodiment of the multi-feature fusion network traffic classification system.

[0120] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0121] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0122] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A network traffic classification method based on multi-feature fusion, characterized in that, include: Acquire target traffic, which includes various different types of traffic; The target traffic is input into a network traffic classification model to obtain the traffic type in the target traffic; The network traffic classification model includes a multi-kernel convolutional neural network, a bidirectional long short-term memory network, and a Transformer model. The multi-kernel convolutional neural network is used to extract local features of the target traffic, the bidirectional long short-term memory network is used to extract temporal dynamic features based on the local features, and the Transformer model is used to obtain attention features based on the temporal dynamic features. The network traffic classification model is trained using different types of traffic samples and their corresponding type labels.

2. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The step of inputting the target traffic into a network traffic classification model to obtain the traffic type in the target traffic includes: The target traffic is input into the multi-kernel convolutional neural network to capture features at different scales and obtain the local features; The local features are input into the bidirectional long short-term memory network to extract contextual information and obtain the temporal dynamic features; The temporal dynamic features are input into the Transformer model, and the global dependencies are captured and the feature representation ability is enhanced through the self-attention mechanism to obtain the attention features; The attention features are input into the pooling layer to obtain the traffic type of the target traffic.

3. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The multi-kernel convolutional neural network includes three parallel convolutional branches, which use convolutional kernels of sizes 3, 5, and 7, respectively.

4. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The bidirectional long short-term memory network comprises two parallel long short-term memory networks that process data information from different directions.

5. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, By employing a multi-head attention mechanism, the Transformer model focuses on information from different representation subspaces.

6. The network traffic classification method based on multi-feature fusion according to claim 1, characterized in that, The network traffic classification model is trained using different types of traffic samples and their corresponding type labels, including: During training, synthetic minority class oversampling technique is used to enhance traffic samples with a number less than a preset threshold in order to solve the problem of imbalance in the number of samples of different traffic types. To improve training stability and prevent overfitting, an early stopping mechanism with a tolerance of 5 epochs, a plateau learning rate decay strategy with a decay factor of 0.5, and model checkpoints are introduced to preserve the best-performing model. All input data is converted into a fixed-length time series through a sliding window of size 10, enabling the network traffic classification model to effectively learn sequence patterns.

7. The network traffic classification method based on multi-feature fusion according to claim 6, characterized in that, The traffic samples were obtained in the following way: Load the USTC-TK2016 dataset. After the data is loaded, all samples in each traffic sample file are uniformly assigned corresponding labels. In the feature selection stage, non-informative fields in the traffic samples are removed. These non-informative fields include "flow identifier", "source IP address", "destination IP address" and "timestamp". Identify and exclude features in the traffic samples that could cause tag leakage; Delete traffic sample files where the proportion of abnormal data exceeds a preset threshold, and obtain traffic samples and their corresponding labels for training.

8. A network traffic classification system based on multi-feature fusion, characterized in that, include: The acquisition module is used to acquire target traffic, which includes various different types of traffic. The classification module is used to input the target traffic into the network traffic classification model to obtain the traffic type in the target traffic; The network traffic classification model includes a multi-kernel convolutional neural network, a bidirectional long short-term memory network, and a Transformer model. The multi-kernel convolutional neural network is used to extract local features of the target traffic, the bidirectional long short-term memory network is used to extract temporal dynamic features based on the local features, and the Transformer model is used to obtain attention features based on the temporal dynamic features. The network traffic classification model is trained using different types of traffic samples and their corresponding type labels.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the network traffic classification method with multi-feature fusion as described in any one of claims 1 to 7.

10. A computer storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the network traffic classification method with multi-feature fusion as described in any one of claims 1 to 7.

Images