Traffic detection method, device, equipment and storage medium

Abstract

The application discloses a traffic detection method and device, equipment and storage medium, and relates to the technical field of network security. The method comprises the following steps: reconstructing an encrypted session traffic to be detected, obtaining a multi-dimensional traffic feature representation, and obtaining a load matrix and a direction length matrix from the multi-dimensional traffic feature representation; extracting a load time sequence feature of the encrypted session traffic to be detected from the load matrix, and extracting a transmission behavior time sequence feature of the encrypted session traffic to be detected from the direction length matrix; and generating a classification result of the encrypted session traffic to be detected based on the load time sequence feature and the transmission behavior time sequence feature. Since the application can jointly use the load space distribution and the transmission behavior time sequence feature of the encrypted session traffic to be detected to classify the encrypted session traffic to be detected, the technical problem that the existing traffic detection scheme based on single-mode data cannot effectively distinguish normal encrypted traffic from malicious variant attacks and has low detection accuracy is solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to traffic detection methods, devices, equipment and storage media. Background Technology

[0002] With the widespread adoption of network communication encryption technologies, while technologies such as transport layer security protocols and virtual private networks (VPNs) ensure data security, they also provide covert channels for various malicious network activities. Among these, advanced persistent threats (APTs), ransomware, and botnets increasingly tend to utilize encryption protocols to carry their attack payloads in order to circumvent traditional security detection mechanisms, thus posing a serious threat to critical information infrastructure and high-security environments such as national-level cyber ranges.

[0003] Currently, to address the threat detection needs in encrypted environments, deep learning-based intelligent traffic detection technology has gradually become a research hotspot. Existing intelligent traffic detection schemes can adopt an end-to-end learning model, using truncated raw payload byte streams as data input, with the model automatically extracting features and classifying traffic based on these features. However, since this type of scheme only uses payload modal data as model input, when attackers employ obfuscation techniques such as application-layer random padding and traffic shaping, the feature representation capability of the single-modal model significantly decreases, making it difficult for the model to effectively distinguish between normal encrypted traffic and malicious variant attacks, resulting in low detection accuracy. Summary of the Invention

[0004] The main purpose of this application is to provide a traffic detection method, apparatus, device and storage medium, which aims to solve the technical problem that existing traffic detection schemes based on single-modal data are unable to effectively distinguish between normal encrypted traffic and malicious variant attacks, and have low detection accuracy.

[0005] To achieve the above objectives, this application proposes a traffic flow detection method, the method comprising: In response to a traffic detection request, session reconstruction is performed on the encrypted session traffic to be detected to obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected. The payload timing features of the encrypted session traffic to be detected are extracted from the payload matrix, and the transmission behavior timing features of the encrypted session traffic to be detected are extracted from the direction length matrix. The classification result of the encrypted session traffic to be detected is generated based on the load timing characteristics and the transmission behavior timing characteristics.

[0006] In one embodiment, the step of extracting the payload timing features of the encrypted session traffic to be detected from the payload matrix includes: The load matrix is ​​input into a preset traffic classification model, which includes a hybrid convolutional projection module and a temporal coding module. The load time sequence is obtained by performing local spatial projection and serialization mapping on the load matrix through the hybrid convolutional projection module. The timing sequence of the payload is locally time-coded by the timing coding module to obtain the payload timing characteristics of the encrypted session traffic to be detected.

[0007] In one embodiment, the preset traffic classification model further includes a nonlinear embedding layer; the step of extracting the transmission behavior temporal features of the encrypted session traffic to be detected from the direction length matrix includes: The packet length information in the direction length matrix is ​​embedded and mapped by the nonlinear embedding layer to obtain the transmission length embedding feature. The transmission direction features are obtained by embedding and mapping the transmission direction identifier in the direction length matrix through the nonlinear embedding layer. The transmission behavior timing features of the encrypted session traffic to be detected are generated based on the transmission length embedding feature and the transmission direction feature.

[0008] In one embodiment, the step of generating the transmission behavior timing features of the encrypted session traffic to be detected based on the transmission length embedding feature and the transmission direction feature includes: A transmission behavior representation of the encrypted session traffic to be detected is generated based on the transmission length embedding feature and the transmission direction feature; The global environment constraint information of the encrypted session traffic to be detected is encoded to generate global context constraint features; The global context constraint features and the transmission behavior representation are fused to generate the transmission behavior temporal features of the encrypted session traffic to be detected.

[0009] In one embodiment, the multidimensional traffic feature representation further includes: a mask matrix; before the step of generating the classification result of the encrypted session traffic to be detected based on the load timing features and the transmission behavior timing features, it further includes: The mask matrix is ​​truncated by a threshold to generate a binary constraint mask. The binary constraint mask is used to identify the boundary between the payload region and the invalid padding region in the encrypted session traffic to be detected. The step of generating the classification result of the encrypted session traffic to be detected based on the load timing characteristics and the transmission behavior timing characteristics includes: The classification result of the encrypted session traffic to be detected is generated based on the load timing characteristics, the transmission behavior timing characteristics, and the binarized constraint mask.

[0010] In one embodiment, the preset traffic classification model further includes a global attention encoder; the step of generating the classification result of the encrypted session traffic to be detected based on the load timing features, the transmission behavior timing features, and the binarized constraint mask includes: The load timing characteristics and the transmission behavior timing characteristics are fused to obtain fused timing characteristics; A category aggregation token is concatenated at the beginning position of the sequence of the fused temporal features to obtain the target fused temporal features; The global attention encoder generates the classification result of the encrypted session traffic to be detected based on the target fusion temporal features and the binarized constraint mask.

[0011] In one embodiment, the step of generating the classification result of the encrypted session traffic to be detected based on the target fusion temporal features and the binarized constraint mask by the global attention encoder includes: The global attention encoder performs multi-head self-attention computation based on the target fusion temporal features; During the calculation process, the binarized constraint mask is injected into the source key filling mask slot of the global attention encoder to output the updated sequence; Extract the target category aggregation token corresponding to the updated sequence, and generate the classification result of the encrypted session traffic to be detected based on the target category aggregation token.

[0012] Furthermore, to achieve the above objectives, this application also proposes a flow detection device, the device comprising: The session reconstruction module is used to respond to the traffic detection request, reconstruct the encrypted session traffic to be detected, and obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected. The feature extraction module is used to extract the payload timing features of the encrypted session traffic to be detected from the payload matrix, and to extract the transmission behavior timing features of the encrypted session traffic to be detected from the direction length matrix. The traffic classification module is used to generate classification results for the encrypted session traffic to be detected based on the load timing characteristics and the transmission behavior timing characteristics.

[0013] In addition, to achieve the above objectives, this application also proposes a flow detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the flow detection method as described above.

[0014] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the traffic detection method described above.

[0015] This application provides a traffic detection method. In response to a traffic detection request, the method reconstructs the encrypted session traffic to be detected to obtain a multi-dimensional traffic feature representation. This multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix characterizes the spatial distribution of the payload of the encrypted session traffic to be detected, and the direction length matrix characterizes the temporal logic of the transmission behavior of the encrypted session traffic to be detected. The method extracts the temporal features of the payload of the encrypted session traffic to be detected from the payload matrix and extracts the temporal features of the transmission behavior of the encrypted session traffic to be detected from the direction length matrix. Based on the temporal features of the payload and the temporal features of the transmission behavior, a classification result for the encrypted session traffic to be detected is generated. Because this application can classify the encrypted session traffic to be detected based on the spatial distribution of the payload and the temporal features of the transmission behavior, even if an attacker performs obfuscation and mutation on the traffic in the payload modality, the anomaly in the temporal behavior modality can still be perceived. This solves the technical problem that existing traffic detection schemes based on single-modal data are unable to effectively distinguish between normal encrypted traffic and malicious variant attacks, resulting in low detection accuracy. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an embodiment of the traffic detection method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the traffic detection method of this application; Figure 3 This is a schematic diagram of the hybrid convolutional projection module in the flow detection method of this application; Figure 4 This is a schematic diagram of the timing coding module in the traffic detection method of this application; Figure 5 This is a schematic diagram of the nonlinear embedding layer in the flow detection method of this application; Figure 6 This is a flowchart illustrating Embodiment 3 of the traffic detection method of this application; Figure 7 This is a schematic diagram of the structure of the preset traffic classification model in the traffic detection method of this application; Figure 8 This is a schematic diagram of the module structure of the flow detection device according to an embodiment of this application; Figure 9 This is a schematic diagram of the device structure of the hardware operating environment involved in the flow detection method in this application embodiment.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution of this application embodiment is as follows: In response to a traffic detection request, session reconstruction is performed on the encrypted session traffic to be detected to obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected. The payload timing features of the encrypted session traffic to be detected are extracted from the payload matrix, and the transmission behavior timing features of the encrypted session traffic to be detected are extracted from the direction length matrix. The classification result of the encrypted session traffic to be detected is generated based on the payload timing features and the transmission behavior timing features.

[0023] Because existing deep learning-based traffic detection schemes only use payload modal data as model input, when attackers use obfuscation techniques such as application-layer random padding and traffic shaping, the feature representation capability of the single-modal model is significantly reduced, making it difficult to effectively distinguish between normal encrypted traffic and malicious variant attacks, resulting in low detection accuracy.

[0024] This application provides a solution that can classify the encrypted session traffic to be detected based on the spatial distribution of the payload and the temporal characteristics of the transmission behavior. This allows the attacker to detect anomalies in the temporal behavior modality even if the attacker has obfuscated and mutated the traffic in the payload modality. This solves the technical problem that existing traffic detection schemes based on single-modal data are unable to effectively distinguish between normal encrypted traffic and malicious variant attacks, resulting in low detection accuracy.

[0025] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or traffic detection device capable of performing the above functions. The following description uses a traffic detection device (hereinafter referred to as the device) as an example to illustrate this embodiment and the subsequent embodiments.

[0026] Based on this, embodiments of this application provide a traffic detection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the traffic detection method of this application.

[0027] In this embodiment, the flow detection method includes steps S10 to S30: Step S10: In response to the traffic detection request, perform session reconstruction on the encrypted session traffic to be detected to obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected.

[0028] It should be understood that a traffic detection request can be an external call instruction or an internal system event that triggers the encrypted traffic detection process. In this embodiment, the traffic detection request can be initiated actively by the upper-layer application, for example, when the network security monitoring system receives a new network data stream; it can also be automatically triggered according to a preset period, for example, the device automatically performs a traffic detection task every preset time interval. This embodiment does not limit the triggering method of the traffic detection request.

[0029] It should also be understood that the encrypted session traffic to be detected can be one or more data packet sequences belonging to the same communication session that are protected by encryption protocols in network communication. For example, all data packets in a complete communication session transmitted based on transport layer security protocols (such as TLS or SSL), or encrypted data streams transmitted based on a Virtual Private Network (VPN), etc. This embodiment does not impose any limitations on this. In this embodiment, the encrypted session traffic to be detected can be captured in real time from the physical link or network interface, or it can be obtained by reading historically saved traffic data files from a storage medium.

[0030] It should be noted that session reconstruction can be the process of aggregating and sorting discrete network data packets according to session affiliation to recover a complete communication session sequence. In practical applications, the device can extract the five-tuple information (including source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, and transport layer protocol type) from each data packet in the encrypted session traffic to be detected, and group data packets with the same five-tuple into the same session. Subsequently, the device can sort the aggregated data packets according to the timestamp order of each data packet to form a session-level data packet sequence with a clear temporal relationship, thereby achieving session reconstruction. In addition, if data packets in the same session are collected from multiple network interfaces or data sources, the device can also perform deduplication to remove redundant data packets that have been captured repeatedly.

[0031] It should also be noted that the multidimensional traffic feature representation can be a set of features used to describe the session characteristics of the encrypted session traffic to be detected from different dimensions. In practical applications, the multidimensional traffic feature representation differs from the raw byte stream input of a single modality. It can use a structured matrix form to represent the multidimensional information of the session traffic in parallel. For example, the multidimensional traffic feature representation in this embodiment can include at least a payload matrix and a direction length matrix to provide a complementary description of the encrypted session to be detected from different information dimensions, providing richer constraint information or timing information.

[0032] It should be noted that the payload matrix can be a two-dimensional array structure used to organize the payload byte content of each data packet in the encrypted session to be detected. In this embodiment, the device can treat each data packet in the reconstructed session data packet sequence as a basic unit and extract the payload bytes (i.e., application layer data after removing the link layer header, network layer header, and transport layer header) from each data packet. Subsequently, the device can sequentially map the payloads of multiple data packets to corresponding positions in the two-dimensional grid according to a preset spatial arrangement rule. For example, for a data packet containing... For a single data packet session, the device can set the grid side length. Then the first The payload of the first data packet is filled into the grid. line, number The column corresponds to the position of the image block, and each image block has a preset height. and width The final size is The two-dimensional load matrix. In this embodiment, the load matrix can be specifically represented as:

[0033] In the formula, Represents the load matrix, This represents the index sequence of data packets within the current encrypted session, with values ​​ranging from 1 to 2. , This indicates the total number of data packets contained in the current encrypted session. This represents the side length of a two-dimensional grid. This represents the height of each image patch, i.e., the number of pixel rows occupied by each data packet payload in the payload matrix. This represents the width of each image patch, i.e., the number of pixel columns occupied by each data packet payload in the payload matrix. Indicates the first The payload bytes of each data packet, that is, the size formed after preprocessing (such as truncation or padding), are... Two-dimensional image blocks.

[0034] It should also be noted that the payload spatial distribution can be the arrangement pattern and texture characteristics of the payload bytes of each data packet in the encrypted session to be detected in a two-dimensional space, such as the statistical distribution pattern of byte values, the repetition pattern of byte sequences, and the occurrence position of specific byte patterns. In this embodiment, since the payload matrix can arrange the payload bytes of multiple consecutive data packets adjacently on a two-dimensional plane in chronological order, the spatial proximity relationship between bytes can reflect the byte-level contextual association within and between data packets.

[0035] It should be noted that the direction length matrix can be a two-dimensional array structure used to record the transmission length and transmission direction information of each data packet in the encrypted session to be detected. In practical applications, the device can map the transmission length value and transmission direction identifier of each data packet to the corresponding position in the two-dimensional grid according to the same spatial arrangement rules as the payload matrix. Then, the transmission length value and transmission direction identifier are stretched and filled into isomorphic two-dimensional matrix blocks according to a preset image block size, ultimately forming a direction length matrix with the same size as the payload matrix. For the transmission length, the device can extract the byte length of the data packet during network transmission (e.g., obtained from the Internet Protocol header or Ethernet header of the data packet). For the transmission direction, the device can determine it based on the position of the source Internet Protocol address and destination Internet Protocol address of the data packet relative to the detection device. For example, if the source address of the data packet is a local address and the destination address is an external address, it is determined to be an uplink direction; if the source address is an external address and the destination address is a local address, it is determined to be a downlink direction. In this embodiment, the direction length matrix can be specifically represented as:

[0036] In the formula, Represents the direction length matrix. Indicates the first The direction length feature block corresponding to each data packet has a size of [size missing]. This feature block is formed by stretching and filling the data packet's transmission length scalar and transmission direction identifier.

[0037] It should also be noted that the timing logic of transmission behavior can be the length change pattern and directional interaction pattern of each data packet in the encrypted session to be detected, presented in chronological order. For example, the uplink or downlink direction sequence of data packets, the statistical distribution and trend of packet length sequence, and the joint timing pattern between direction and length. In practical applications, the length of data packets in normal communication sessions usually shows a gradual increase or a stable fluctuation, and the directional interaction pattern is characterized by alternating requests and responses. In malicious attack sessions, abnormal timing patterns such as abrupt changes in length (e.g., from a very small packet to a very large packet) or a single direction (e.g., only uplink without downlink) may occur.

[0038] In its implementation, upon receiving an externally triggered traffic detection request, the device can begin executing the encrypted traffic detection process. First, the device can capture the sequence of raw data packets flowing through the network interface in real time and extract the 5-tuple information from each data packet. Then, data packets with the same 5-tuple are grouped into the same session, and the data packets belonging to the same session are reassembled in chronological order into a complete session-level data packet sequence to achieve session reconstruction. After completing session reconstruction, the device can traverse each data packet in the reconstructed session data packet sequence, extract the payload bytes of each data packet, and set the grid side length. ,in The total number of packets contained in the current session, and the creation of a size of The zero matrix serves as the initial structure for the payload matrix. Then, the device can iterate through each packet index. (From 0 to ), calculate the starting position of the target row Target column start position , will the The payload bytes of each data packet are filled into the corresponding image block region of the payload matrix, ultimately forming a size of The device can simultaneously traverse each data packet in the reconstructed session data packet sequence, extract the transmission length value and transmission direction identifier of each data packet, and then stretch and fill the transmission length value and transmission direction identifier of each data packet into a two-dimensional matrix block with the same size as the load image block according to the same spatial arrangement rules as the load matrix, forming a direction length matrix with the same size as the load matrix.

[0039] Step S20: Extract the payload timing features of the encrypted session traffic to be detected from the payload matrix, and extract the transmission behavior timing features of the encrypted session traffic to be detected from the direction length matrix.

[0040] It should be understood that the payload temporal features can be a high-dimensional vector representation extracted from the payload matrix that reflects the changing patterns of payload content in the time series dimension. In this embodiment, the payload temporal features can characterize the temporal dependencies of content between image blocks (corresponding to different data packets) in the payload matrix. They can include byte-level spatial texture information within a single data packet, or contextual association information of payload content between multiple consecutive data packets.

[0041] It should also be understood that the temporal characteristics of transmission behavior can be a high-dimensional vector representation extracted from the direction length matrix, which can reflect the changing patterns of packet-level behavior in the time series dimension. In this embodiment, the temporal characteristics of transmission behavior can characterize the evolution of the transmission length and transmission direction of each data packet in the encrypted session traffic to be detected over time, such as the statistical characteristics of the length sequence (mean, variance, trend) and the pattern characteristics of the direction sequence (alternating frequency, continuous same-direction length), etc.

[0042] In its implementation, after constructing the multidimensional traffic feature representation, the device can perform local spatial projection on the payload matrix (aggregating local spatial features through convolutional layers in a neural network model and performing downsampling for dimensionality reduction), flattening the two-dimensional spatial features into one-dimensional sequence labels. Then, a linear complexity temporal coding model (such as a selective state-space model) is used to capture the local temporal dependencies between the sequence labels, thereby obtaining the payload temporal features of the encrypted session traffic to be detected. Simultaneously, the device can perform nonlinear embedding mapping on the packet length information and transmission direction identifier in the direction length matrix, fusing them into a transmission behavior representation to obtain the transmission behavior temporal features of the encrypted session traffic to be detected.

[0043] Step S30: Generate the classification result of the encrypted session traffic to be detected based on the payload timing characteristics and the transmission behavior timing characteristics.

[0044] Understandably, the classification result can be output information used to identify the category to which the encrypted session traffic to be detected belongs. In this embodiment, the classification result can be a category label, such as "normal traffic," "ransomware traffic," "botnet communication traffic," "APT attack traffic," etc. Alternatively, the classification result can also be a probability distribution vector, where each dimension represents the probability value of belonging to a certain category, and the device can take the category corresponding to the highest probability value as the judgment result. In addition, the classification result can also be a binary judgment result, such as "malicious" or "normal."

[0045] In practical applications, after obtaining the temporal features of the load and the temporal features of the transmission behavior, the device can fuse the temporal features of the load and the temporal features of the transmission behavior and input them into the global context modeling network. The multi-head self-attention mechanism is used to capture the long-range logical dependencies of the entire session, extract the global representation vector, and then map it into the probability distribution of each category through the classification head. Finally, the category corresponding to the maximum probability is taken as the final classification result.

[0046] This embodiment provides a traffic detection method. The method discloses that, in response to a traffic detection request, session reconstruction is performed on the encrypted session traffic to be detected to obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix characterizes the spatial distribution of the payload of the encrypted session traffic to be detected, and the direction length matrix characterizes the temporal logic of the transmission behavior of the encrypted session traffic to be detected. The method extracts the temporal features of the payload of the encrypted session traffic to be detected from the payload matrix and extracts the temporal features of the transmission behavior of the encrypted session traffic to be detected from the direction length matrix. A classification result for the encrypted session traffic to be detected is generated based on the temporal features of the payload and the transmission behavior. Because this embodiment can classify the encrypted session traffic to be detected based on the spatial distribution of the payload and the temporal features of the transmission behavior, even if an attacker performs obfuscation and mutation on the traffic in the payload modality, the anomaly in the temporal behavior modality can still be perceived. This solves the technical problem that existing traffic detection schemes based on single-modal data are unable to effectively distinguish between normal encrypted traffic and malicious variant attacks, resulting in low detection accuracy.

[0047] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 , Figure 2 This is a flowchart illustrating Embodiment 2 of the traffic detection method of this application.

[0048] In this embodiment, step S20 further includes steps S21 to S23: Step S21: Input the load matrix into a preset traffic classification model, which includes a hybrid convolutional projection module and a temporal coding module.

[0049] It should be noted that the preset traffic classification model can be a deep learning network model used to classify encrypted session traffic. In this embodiment, the preset traffic classification model can undergo supervised learning using labeled encrypted session samples during the training phase, and the model parameters can be optimized through the backpropagation algorithm to enable it to distinguish between normal encrypted traffic and various malicious encrypted attack traffic. In the subsequent traffic detection phase, the preset traffic classification model can load the trained weight parameters, perform forward computation on the input encrypted session traffic to be detected, and thus output the classification result.

[0050] It should also be noted that the preset traffic classification model in this embodiment includes at least a hybrid convolutional projection module and a temporal coding module. The hybrid convolutional projection module can be a component in the preset traffic classification model used for spatial feature extraction and dimensional transformation of the payload matrix; the temporal coding module can be a component in the preset traffic classification model used for temporal dependency modeling of serialized features, and it can be specifically implemented based on the Selective StateSpace Model.

[0051] Step S22: The load matrix is ​​subjected to local spatial projection and serialization mapping through the hybrid convolutional projection module to obtain the load time sequence.

[0052] It should be noted that local spatial projection and serialization mapping can be operations that transform two-dimensional image patches in a payload matrix into one-dimensional sequence labels. Local spatial projection can be an operation that uses a convolutional neural network to extract features and compress spatial resolution from a two-dimensional feature map within a local receptive field; serialization mapping can be an operation that rearranges feature elements arranged in a two-dimensional space into a one-dimensional sequence form according to a specific order.

[0053] It should also be noted that the payload temporal sequence can be a set of one-dimensional sequence tags arranged according to the data packet order in the original encrypted session. In this embodiment, the dimension of the payload temporal sequence can be L×D, where L is the sequence length, determined by the number of tags after spatial downsampling; D is the tag dimension, i.e., the global implicit dimension, determined by the output dimension of the linear projection layer. For example, if the spatial size of the payload matrix is ​​(S·H)×(S·W), and the stride of the second-level convolution in the hybrid convolutional projection module is 4, then the size of the feature map after spatial downsampling is (S·H / 4)×(S·W / 4), the sequence length L=(S·H / 4)×(S·W / 4), and the dimension of each tag after flattening and linear projection is D.

[0054] In the specific implementation, refer to Figure 3 , Figure 3 This is a schematic diagram of the hybrid convolutional projection module in the flow detection method of this application. Figure 3As shown, the hybrid convolutional projection module can include stacked two-dimensional convolutional layers, Gaussian error linear unit activation functions, and cross-layer residual connections. This module can take each two-dimensional image patch in the payload matrix (each image patch corresponds to the payload of a data packet) as input, and use stacked two-dimensional convolutional layers to aggregate the spatial texture features of message bytes in the local receptive field. Then, by setting a specific convolutional stride and the number of output channels, spatial downsampling and smooth dimensionality reduction of the channel dimension are performed. At this time, the dimensionality-reduced features can be non-linearly mapped by the GELU activation function of the Gaussian error linear unit, and cross-layer residual connections are used to avoid information degradation of features when projected in shallow layers. Finally, the hybrid convolutional projection module can flatten the high-dimensional two-dimensional image patch and uniformly map it to the global hidden dimension D, outputting a one-dimensional sequence label in the form of L×D (L is the sequence length), which is the payload temporal sequence.

[0055] In this embodiment, the hybrid convolutional projection module can convert the payload byte distribution features in two-dimensional space into a one-dimensional sequence form suitable for time-series model processing, and project the image blocks corresponding to different data packets to a unified feature dimension space, thereby eliminating the problem of dimensional inconsistency between image blocks caused by differences in original size or padding.

[0056] Step S23: Perform local timing encoding on the payload timing sequence using the timing encoding module to obtain the payload timing characteristics of the encrypted session traffic to be detected.

[0057] It should be noted that local temporal coding can be a feature transformation process that models the local dependencies between elements in a load temporal sequence. In this embodiment, referring to... Figure 4 , Figure 4 This is a schematic diagram of the timing coding module in the traffic detection method of this application. Figure 4As shown, the temporal coding module can include a linear input projection layer, a one-dimensional deep convolutional layer, a selective state space model layer, and a gated aggregation layer. After receiving the payload temporal sequence processed by the hybrid convolutional projection module, the temporal coding module can input the payload temporal sequence into the one-dimensional deep convolutional layer. At this point, the one-dimensional deep convolutional layer can perform local feature aggregation on adjacent sequence markers through a sliding window, effectively capturing short-range local interaction dependencies and latency features between adjacent messages. Subsequently, the sequence after sliding feature aggregation is input into the selective state space model. After receiving the aggregated sequence, the selective state space model can map the input features to the state space dimension through the linear input projection layer, then generate time-varying parameters based on the input data through the one-dimensional deep convolutional layer. These time-varying parameters are then used to discretize the continuous state space model, obtaining a discrete state transition matrix and an input matrix. Finally, through recursive state calculation and the gated aggregation layer, a high-order representation fusing the local temporal context is output, which is the payload temporal feature of the encrypted session traffic to be detected. Its dimension is consistent with the input payload temporal sequence, both being L×D.

[0058] In this embodiment, the timing coding module can capture the long-range dependencies between elements in the sequence while maintaining linear time complexity (i.e., the computational load is proportional to the sequence length). At this time, each element in the obtained payload timing feature (corresponding to a data packet in the session) not only contains the payload spatial distribution information of the data packet itself, but also integrates the change pattern and timing dependency of the payload content of multiple adjacent data packets. This can effectively characterize the evolution pattern of the payload content in the encrypted session traffic to be detected over time, thereby providing rich timing dimension feature information for subsequent classification and discrimination.

[0059] Furthermore, to enable the payload content information and transmission behavior information of encrypted session traffic to be jointly expressed in the same feature space, providing a feature foundation with dimensional matching and complementary information for subsequent multimodal feature fusion, thereby improving the accuracy of traffic classification, the preset traffic classification model also includes a nonlinear embedding layer; the step of extracting the transmission behavior temporal features of the encrypted session traffic to be detected from the direction length matrix includes: Step S24: The packet length information in the direction length matrix is ​​embedded and mapped through the nonlinear embedding layer to obtain the transmission length embedding feature.

[0060] It should be noted that the nonlinear embedding layer can be a neural network component in a pre-defined traffic classification model used to map discrete or continuous low-dimensional scalar information to a high-dimensional continuous vector space. The nonlinear embedding layer in this embodiment differs from simple linear projection or lookup table embedding; it can achieve a nonlinear up-dimensional mapping from low-dimensional input to a high-dimensional feature space through a combination of embedding layers and activation functions, thereby enhancing the expressive power of the features. In this embodiment, the nonlinear embedding layer can include a first embedding branch and a second embedding branch. The first embedding branch can be used to process packet length information and is composed of a length embedding layer and a first activation layer connected in series; the second embedding branch can be used to process transmission direction identifiers and is composed of a direction embedding layer and a second activation layer connected in series.

[0061] It should be understood that the packet length information can be the actual byte length of each data packet in the encrypted session traffic to be detected during network transmission. It can be a scalar value, such as 64 bytes, 128 bytes, 256 bytes, 1448 bytes, etc. In this embodiment, the packet length information can be extracted from the Internet Protocol header or Ethernet header of each data packet in the encrypted session traffic to be detected. It typically includes the overall length of the data packet, such as the total number of bytes covering the link layer header, network layer header, transport layer header, and application layer payload.

[0062] It should also be understood that the transmission length embedding feature can be a high-dimensional vector representation obtained by mapping packet length information through a nonlinear embedding layer, that is, a dense vector formed by projecting packet length information into a high-dimensional space. In this embodiment, the transmission length embedding feature can express the similarity or difference relationship between different packet length values ​​in the vector space. For example, samples with similar packet length values ​​have similar vector representations in the embedding space, while samples with large differences in packet length values ​​have a large vector distance in the embedding space.

[0063] Step S25: The transmission direction identifier in the direction length matrix is ​​embedded and mapped through the nonlinear embedding layer to obtain the transmission direction feature.

[0064] Understandably, the transmission direction identifier can be a marker used to indicate the direction of data packets in the encrypted session traffic being detected in network communication. It can be determined based on the location of the source Internet Protocol address and destination Internet Protocol address of the data packet relative to the detection device. For example, if the source address of the data packet matches the detection device's own address and the destination address is an external address, the transmission direction is determined to be uplink, which can be represented by a first identifier value (such as +1); if the source address of the data packet is an external address and the destination address matches the detection device's own address, the transmission direction is determined to be downlink, which can be represented by a second identifier value (such as -1).

[0065] It is also understandable that the transmission direction feature can be a high-dimensional vector representation obtained by mapping the transmission direction identifier through a non-linear embedding layer. It can express the semantic relationship between different transmission directions in the vector space, so that the model can learn the appropriate representation of the uplink and downlink directions in the feature space.

[0066] Step S26: Generate the transmission behavior timing features of the encrypted session traffic to be detected based on the transmission length embedding feature and the transmission direction feature.

[0067] In the specific implementation, refer to Figure 5 , Figure 5 This is a schematic diagram of the nonlinear embedding layer in the flow detection method of this application. (See attached diagram.) Figure 5 As shown, after constructing the multidimensional traffic feature representation and obtaining the direction length matrix, the device can traverse each data packet in the session according to the timestamp order of the data packets, sequentially obtaining the packet length information corresponding to each data packet. Then, it performs an embedding mapping operation on the packet length information of each data packet through the nonlinear embedding layer set in the preset traffic classification model. Specifically, the nonlinear embedding layer has an embedding table. The device can use the packet length value of each data packet as an index to find the row vector corresponding to that index in the embedding table, and use that row vector as the transmission length embedding feature corresponding to the data packet. In addition, the nonlinear embedding layer can also have a linear projection layer and a Gaussian error linear unit activation function. The device can input the packet length value of each data packet into the linear projection layer to map the packet length value into an intermediate vector of dimension D. Then, the intermediate vector is input into the Gaussian error linear unit activation function for nonlinear transformation to obtain the transmission length embedding feature of dimension D. Simultaneously, the device can extract the transmission direction identifier from the direction length matrix and perform an embedding mapping operation on the transmission direction identifier of each data packet through the nonlinear embedding layer set in the preset traffic classification model. Specifically, the nonlinear embedding layer can be configured with a transmission direction embedding matrix. The device can use the transmission direction identifier of each data packet as an index to find the row vector corresponding to that index in the transmission direction embedding matrix, and use that row vector as the transmission direction feature of the data packet. After obtaining the transmission length embedding feature and transmission direction feature corresponding to each data packet, the device can fuse the transmission length embedding feature and transmission direction feature by element-wise summing to generate a transmission behavior representation for each data packet.

[0068] Furthermore, in order to overcome the technical defects of existing encrypted traffic detection technologies that separate packet-level local behavioral features from session-level global context information, and to achieve deep integration of transmission behavior representation and global semantic constraints, thereby improving the model's ability to capture macroscopic behavioral patterns of encrypted sessions, step S26 includes: generating a transmission behavior representation of the encrypted session traffic to be detected based on the transmission length embedding feature and the transmission direction feature; encoding the global environment constraint information of the encrypted session traffic to be detected to generate global context constraint features; and fusing the global context constraint features and the transmission behavior representation to generate a transmission behavior temporal feature of the encrypted session traffic to be detected.

[0069] It should be understood that the transmission behavior representation can be a high-dimensional vector representation that reflects the behavioral attributes of a data packet, obtained by fusing the transmission length embedding feature and transmission direction feature of a single data packet in the encrypted session traffic to be detected. In this embodiment, the transmission behavior representation can be used to describe the behavioral attributes of a single data packet as an independent communication unit in the encrypted session, such as "an uplink data packet of size 256 bytes" or "a downlink data packet of size 64 bytes".

[0070] Understandably, global environment constraint information can be a structured set of information describing the overall communication environment and external context attributes of the encrypted session traffic to be detected. Examples include the session's 5-tuple information, the session's start timestamp, the session's end timestamp, the total transmission duration of the session, the total number of data packets in the session, and the total number of bytes transmitted in the session. This embodiment does not impose any limitations on this. In this embodiment, global environment constraint information can be obtained during the session reconstruction process. For example, the total transmission duration can be obtained by calculating the timestamp difference between the first and last data packets in the session, and the total number of bytes transmitted can be obtained by summing the byte lengths of all data packets in the session.

[0071] It is also understood that global context constraint features can be high-dimensional vector representations obtained by mapping global environment constraint information through a preset encoding network. In this embodiment, global context constraint features can be used to inject the macroscopic attributes of the entire session into the transmission behavior representation of each data packet in the form of feature vectors, thereby providing session-level context constraints and global semantic supplements for the transmission behavior representation.

[0072] In its implementation, after obtaining the transmission length embedding feature and transmission direction feature of each data packet through a nonlinear embedding layer, the device can sequentially fuse the transmission length embedding feature and transmission direction feature of each data packet according to the timestamp order of the data packets in the session, using an element-wise summation method to generate the transmission behavior representation corresponding to each data packet. Subsequently, the device can acquire the global environment constraint information of the encrypted session traffic to be detected, and normalize the numerical features (such as total transmission time, total number of transmitted bytes, average packet length, etc.) in the global environment constraint information to eliminate the influence of differences in the units of measurement between different features. Then, the preprocessed features are concatenated to form a global environment feature vector. Afterward, the device can encode the global environment feature vector using a preset global feature encoder to generate global context constraint features, and then perform weighted fusion of the transmission behavior representation sequence of each data packet and the global context constraint features to finally generate the transmission behavior temporal features of the encrypted session traffic to be detected.

[0073] In this embodiment, a method is disclosed to input the payload matrix into a preset traffic classification model, which includes a hybrid convolutional projection module and a temporal coding module. The hybrid convolutional projection module performs local spatial projection and serialization mapping on the payload matrix to obtain a payload temporal sequence. The temporal coding module performs local temporal coding on the payload temporal sequence to obtain the payload temporal features of the encrypted session traffic to be detected. This allows the two-dimensional image blocks in the payload matrix to be converted into a one-dimensional payload temporal sequence of a unified dimension. Based on the temporal coding module, the local dependencies between the sequence elements in the payload temporal sequence are efficiently captured, thereby significantly reducing the consumption of computing resources while ensuring modeling accuracy, and thus reducing the computational complexity of subsequent traffic classification.

[0074] Based on the first and / or second embodiments of this application, in the third embodiment of this application, the content that is the same as or similar to the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 6 , Figure 6 This is a flowchart illustrating Embodiment 3 of the traffic detection method of this application.

[0075] In this embodiment, the multidimensional traffic feature representation further includes: a mask matrix; before step S30, the method further includes step S31: Step S31: Perform threshold truncation on the mask matrix to generate a binarized constraint mask. The binarized constraint mask is used to identify the boundary between the payload region and the invalid padding region in the encrypted session traffic to be detected.

[0076] It should be noted that the mask matrix can be a two-dimensional array structure used to identify the spatial locations of the payload region and the invalid padding region in the encrypted session traffic to be detected. The value of each pixel position can be used to indicate whether the corresponding position in the payload matrix is ​​a payload region or an invalid padding region. For example, the mask matrix can be stored in the form of a single-channel grayscale image, where the first value (such as 255 or 1) indicates that the corresponding position belongs to the payload region, and the second value (such as 0) indicates that the corresponding position belongs to the invalid padding region.

[0077] It should also be noted that the mask matrix and the payload matrix have the same spatial topology, meaning they have the same number of rows, columns, and the same image block division method. In practical applications, the mask matrix can be constructed by reading a mask image with specific identifiers, or it can be generated synchronously during the construction of the payload matrix. That is, whenever the payload bytes of a data packet are filled into a certain position in the payload matrix, the corresponding position in the mask matrix is ​​marked as a valid region, and the remaining unfilled positions are marked as invalid regions. In this embodiment, the mask matrix can be specifically represented as follows:

[0078] In the formula, Represents the mask matrix, Indicates the first The mask identifier block corresponding to each data packet has a size of [size missing]. The value of each pixel position indicates whether the corresponding load position is a valid area (e.g., a value of 1) or an invalid padding area (e.g., a value of 0).

[0079] It should be noted that threshold truncation can be a process of performing a nonlinear transformation on continuous values ​​in the mask matrix, converting them into a Boolean tensor containing only two discrete values.

[0080] It should be understood that the binarized constraint mask can be a Boolean tensor containing only valid region identifiers and invalid region identifiers. Each element can take the value 0 or 1 (or True / False). The first identifier value (such as 1 or True) indicates that the corresponding position belongs to the valid payload region and should be retained and participate normally in the subsequent attention calculation. The second identifier value (such as 0 or False) indicates that the corresponding position belongs to the invalid fill region and should be masked and ignored in the subsequent attention calculation.

[0081] It should also be understood that the payload region can be a set of spatial locations in the encrypted session traffic to be detected that belong to the actual payload bytes, which typically corresponds to the pixel locations in the payload matrix that are actually filled with the payload content of the data packet. Correspondingly, the invalid padding region boundary can be the dividing line between the spatial locations of meaningless padding data (such as zero-value padding) in the encrypted session traffic to be detected and the payload region. For example, when the payload length of the data packet is insufficient to fill the size of a preset image block, the area in the corresponding image block of the payload matrix that is not filled by the actual payload bytes is the invalid padding region.

[0082] Understandably, this embodiment generates a binary constraint mask, enabling the subsequent model to actively shield invalid regions during attention calculation, avoiding the model from allocating attention weights on these meaningless filler data, thereby improving the purity of feature extraction and reducing the waste of computing resources.

[0083] In practical applications, the device can first input the mask matrix into a large receptive field spatial downsampling convolutional layer (Conv2D). A convolutional layer with a large receptive field and a custom large stride (e.g., a 2D convolutional layer with a kernel size of 4 and a stride of 4) performs overlapping sliding window downsampling on the mask matrix in local space, reducing the spatial resolution of the mask matrix to a preset proportion of its original size (e.g., 1 / 4), aligning it with the spatial coordinates of the feature sequence targeted by subsequent attention calculations. After completing the downsampling mapping, a continuous feature mask with floating-point feature values ​​can be output. Subsequently, the device can set values ​​greater than or equal to a preset minimum threshold (e.g., 0.5) to a first logical value (e.g., 1 or True), and force values ​​less than the preset minimum threshold to a second logical value (e.g., 0 or False), finally outputting a pure Boolean tensor, i.e., a binarized constraint mask.

[0084] Step S30 includes: Step S32: Generate the classification result of the encrypted session traffic to be detected based on the payload timing features, the transmission behavior timing features, and the binarized constraint mask.

[0085] Furthermore, in order to accurately focus on effective features from the entire session and generate attack category judgment results that can accurately reflect the global macro-semantics of the encrypted session, the preset traffic classification model also includes a global attention encoder; step S32 includes: Step S321: Fuse the load timing features and the transmission behavior timing features to obtain fused timing features.

[0086] Understandably, fused temporal features can be a high-dimensional feature representation obtained by merging load temporal features and transmission behavior temporal features in terms of feature dimensions. In this embodiment, the model can concatenate load temporal features and transmission behavior temporal features to generate fused temporal features.

[0087] Step S322: Concatenate a category aggregation token at the beginning position of the sequence of the fused temporal features to obtain the target fused temporal features.

[0088] It should be understood that the category aggregation token can be a learnable, global macro-feature used to aggregate the entire cryptographic session during global attention encoding. In this embodiment, the category aggregation token can be created during model initialization by declaring a learnable parameter (e.g., using nn.Parameter in a neural network framework), whose dimension is consistent with the dimension of each element in the fused temporal features. Furthermore, the category aggregation token does not depend on any specific input data but is continuously optimized and updated during model training via backpropagation.

[0089] It should also be understood that the category aggregation token can fairly exchange features with all other valid tokens in the sequence (i.e., the fused features corresponding to each data packet), collecting useful information from the features of each data packet, and ultimately forming a comprehensive representation of the entire encrypted session. This embodiment, by introducing the category aggregation token, avoids the bias problem caused by arbitrarily selecting the features of a single data packet in the sequence as the session representation.

[0090] Understandably, the target fusion time-series feature can be an extended sequence formed by concatenating the category aggregation token to the starting position of the fusion time-series feature sequence.

[0091] Step S323: Generate the classification result of the encrypted session traffic to be detected based on the target fusion temporal features and the binarized constraint mask using the global attention encoder.

[0092] It should be noted that the global attention encoder can be a neural network component in a pre-defined traffic classification model used to perform global context modeling of sequence features. Specifically, it can be a deep network structure composed of multiple layers of stacked Transformer encoder modules.

[0093] In its implementation, the device first fuses the payload temporal feature sequence and the transmission behavior temporal feature sequence using a feature concatenation method to obtain a fused temporal feature sequence. Then, a category aggregation token is concatenated at the beginning of the fused temporal feature sequence to obtain the target fused temporal feature. Subsequently, the device inputs the target fused temporal feature sequence into a global attention encoder, which generates the classification result of the encrypted session traffic to be detected based on the target fused temporal feature and a binarized constraint mask.

[0094] Furthermore, in order to enable the model to accurately focus on effective feature regions and aggregate the macro-semantics of the entire session, generating high-accuracy detection results for encrypted traffic attack categories, step S323 includes: performing multi-head self-attention calculation based on the target fusion temporal features through the global attention encoder; during the calculation process, injecting the binarized constraint mask into the source key filling mask slot of the global attention encoder to output an updated sequence; extracting the target category aggregation token corresponding to the updated sequence, and generating the classification result of the encrypted session traffic to be detected based on the target category aggregation token.

[0095] It should be noted that the source key padding mask slot can be a parameter interface reserved in the multi-head self-attention computation function of the global attention encoder, which can be used to receive a mask tensor that identifies invalid padding position information in the input sequence.

[0096] Understandably, the updated sequence can be a new feature sequence output after the target fused temporal features are processed by a multi-layer encoding module of a global attention encoder. In this embodiment, each positional element in the updated sequence is typically a weighted aggregation of all positional information in the input sequence, where each output token incorporates the contextual information of all other tokens in the entire sequence.

[0097] It is also understandable that the target category aggregation token can be the output token located at the beginning of the updated sequence, that is, the category aggregation token processed by the global attention encoder. Compared with the original category aggregation token at input, the target category aggregation token has exchanged information multiple times with all valid packet features in the sequence through a multi-head self-attention mechanism, which gathers key information selectively collected from each packet feature.

[0098] In practical applications, the device can fuse payload temporal features and transmission behavior temporal features using feature concatenation to obtain fused temporal features. A category aggregation token is then concatenated at the beginning of the fused feature sequence to obtain the target fused temporal features. Subsequently, the device can input the fused feature dimensions and a binarized constraint mask into a global attention encoder for multi-head self-attention computation. During computation, the device can forcibly inject the binarized constraint mask into the source key filling mask slots for attention computation. Specifically, after performing self-attention computation, calculating the attention score matrix, and before performing Softmax normalization, the device can modify the attention score corresponding to the position with a value of 0 in the binarized constraint mask to a very small negative value (e.g., -1e9). After this modification, when performing the Softmax operation on these attention scores, the attention weight at the position corresponding to the very small negative value will approach 0. This forces the model to cut off the weight allocation and line-of-sight perception of invalid filling regions from the algorithm operator's underlying layer, allowing the model to focus only on the feature positions corresponding to the effective payload region when capturing long-range logical dependency features of multiple data packets across the entire session time span. Subsequently, the global attention encoder can perform deep context mapping on the input sequence and output an updated sequence. The device can then extract the target category aggregation token located at the starting position from the updated sequence, i.e., the updated category aggregation token, and input the target category aggregation token into the classification network. The classification network then performs a linear transformation and non-linear activation on the target category aggregation token, outputting a probability distribution vector with a dimension equal to the number of categories. The device can then determine the final classification result based on the probability distribution vector, for example, selecting the category corresponding to the highest probability value as the judgment category, and finally outputting "normal traffic" or a specific malicious attack type (such as "ransomware traffic", "botnet communication traffic", etc.).

[0099] In the specific implementation, refer to Figure 7 , Figure 7 This is a schematic diagram of the structure of the preset traffic classification model in the traffic detection method of this application. For example... Figure 7As shown, after receiving a traffic detection request, the device first performs session reconstruction on the encrypted session traffic to be detected, constructing a payload matrix, a direction length matrix, and a mask matrix. Then, the device inputs the payload matrix into a local slicing reconstruction module to segment the payload matrix into image blocks, dividing the payload of each data packet into independent two-dimensional image blocks. Subsequently, the device inputs the segmented image blocks into a hybrid convolutional projection module, which performs local spatial projection and serialization mapping on the payload matrix, converting the two-dimensional image blocks into one-dimensional sequence markers to obtain the payload temporal sequence. Afterward, the device inputs the payload temporal sequence into a temporal coding module, which performs local temporal coding on the payload temporal sequence based on a selective state-space model, capturing short-range dependencies between the payload features of adjacent data packets, and finally outputting the payload temporal features. Simultaneously, the device can input the direction length matrix into the length direction and session information encoding module. The nonlinear embedding layer in this module embeds and maps the packet length information in the direction length matrix to obtain transmission length embedding features, and embeds and maps the transmission direction identifier to obtain transmission direction features. These two features are then fused to generate a transmission behavior representation. Furthermore, session-level global environment constraint information is introduced for encoding to generate global context constraint features. Finally, these features are fused to output the transmission behavior temporal features. In addition, the device can input the mask matrix into the privacy mask constraint module. This module performs downsampling and threshold truncation on the mask matrix to generate a binarized constraint mask. Then, the device can fuse the payload temporal features with the transmission behavior temporal features to obtain fused temporal features. A learnable category aggregation token is then concatenated at the beginning of the fused temporal feature sequence to obtain the target fused temporal feature. Subsequently, the target fused temporal feature and a binarized constraint mask are input into a global attention encoder. This global attention encoder uses a multi-head self-attention mechanism to model the global context of the target fused temporal feature. During the computation, the binarized constraint mask is injected into the source key filling mask slot of the global attention encoder, masking the attention weights of invalid filling regions from the operator's underlying layer. Finally, the updated sequence is output. Finally, the device can extract the target category aggregation token (i.e., [missing information]) located at the beginning of the sequence from the updated sequence output by the global attention encoder. Figure 7 The target category aggregation token is input into the classification network to enable the classification network to output a classification vector that characterizes the attack category to which the encrypted session traffic to be detected belongs.

[0100] In this embodiment, a threshold truncation process is disclosed to generate a binarized constraint mask. The binarized constraint mask is used to identify the boundary between the effective payload region and the invalid padding region in the encrypted session traffic to be detected. Based on the payload temporal features, transmission behavior temporal features, and the binarized constraint mask, the classification result of the encrypted session traffic to be detected is generated. This allows the invalid padding region to be forcibly identified and isolated during the global attention encoding process through the binarized constraint mask. This enables the model to extract features only from the effective payload region and perform fusion and classification, thereby cutting off the interference of invalid noise on the attention weights from the underlying algorithm and improving the purity of feature extraction and classification accuracy.

[0101] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the traffic detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0102] This application also provides a flow detection device, please refer to... Figure 8 The flow detection device includes: The session reconstruction module 10 is used to respond to the traffic detection request, perform session reconstruction on the encrypted session traffic to be detected, and obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected. The feature extraction module 20 is used to extract the load timing features of the encrypted session traffic to be detected from the load matrix, and to extract the transmission behavior timing features of the encrypted session traffic to be detected from the direction length matrix. Traffic classification module 30 is used to generate classification results of the encrypted session traffic to be detected based on the load timing characteristics and the transmission behavior timing characteristics.

[0103] The traffic detection device provided in this application, employing the traffic detection method described in the above embodiments, can solve the technical problem that existing traffic detection schemes based on single-modal data are unable to effectively distinguish between normal encrypted traffic and malicious variant attacks, resulting in low detection accuracy. Compared with the prior art, the beneficial effects of the traffic detection device provided in this application are the same as those of the traffic detection method provided in the above embodiments, and other technical features in the traffic detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0104] This application provides a flow detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the flow detection method in Embodiment 1 above.

[0105] The following is for reference. Figure 9 The diagram illustrates a structural schematic of a traffic detection device suitable for implementing embodiments of this application. The traffic detection device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (PADs), portable media players (PMPs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 9 The flow detection device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0106] like Figure 9 As shown, the flow detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the flow detection device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the flow detection device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows flow detection devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0107] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0108] The flow detection device provided in this application, employing the flow detection method described in the above embodiments, can solve the technical problem of flow detection. Compared with the prior art, the beneficial effects of the flow detection device provided in this application are the same as those of the flow detection method provided in the above embodiments, and other technical features of this flow detection device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0109] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0110] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0111] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the traffic detection method in the above embodiments.

[0112] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, radio frequency (RF), etc., or any suitable combination thereof.

[0113] The aforementioned computer-readable storage medium may be included in the flow detection device; or it may exist independently and not be assembled into the flow detection device.

[0114] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the traffic detection device, the traffic detection device: in response to a traffic detection request, performs session reconstruction on the encrypted session traffic to be detected, and obtains a multi-dimensional traffic feature representation, which includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected; extracts the payload timing features of the encrypted session traffic to be detected from the payload matrix, and extracts the transmission behavior timing features of the encrypted session traffic to be detected from the direction length matrix; and generates a classification result of the encrypted session traffic to be detected based on the payload timing features and the transmission behavior timing features.

[0115] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0116] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0117] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0118] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described traffic detection method. This solves the technical problem that existing traffic detection schemes based on single-modal data struggle to effectively distinguish between normal encrypted traffic and malicious variant attacks, resulting in low detection accuracy. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the traffic detection method provided in the above embodiments, and will not be elaborated upon here.

[0119] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A flow rate detection method, characterized in that, The method includes: In response to a traffic detection request, session reconstruction is performed on the encrypted session traffic to be detected to obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected. The payload timing features of the encrypted session traffic to be detected are extracted from the payload matrix, and the transmission behavior timing features of the encrypted session traffic to be detected are extracted from the direction length matrix. The classification result of the encrypted session traffic to be detected is generated based on the load timing characteristics and the transmission behavior timing characteristics.

2. The method as described in claim 1, characterized in that, The step of extracting the payload timing features of the encrypted session traffic to be detected from the payload matrix includes: The load matrix is ​​input into a preset traffic classification model, which includes a hybrid convolutional projection module and a temporal coding module. The load time sequence is obtained by performing local spatial projection and serialization mapping on the load matrix through the hybrid convolutional projection module. The timing sequence of the payload is locally time-coded by the timing coding module to obtain the payload timing characteristics of the encrypted session traffic to be detected.

3. The method as described in claim 2, characterized in that, The preset traffic classification model also includes a nonlinear embedding layer; The step of extracting the transmission behavior timing features of the encrypted session traffic to be detected from the direction length matrix includes: The packet length information in the direction length matrix is ​​embedded and mapped by the nonlinear embedding layer to obtain the transmission length embedding feature. The transmission direction features are obtained by embedding and mapping the transmission direction identifier in the direction length matrix through the nonlinear embedding layer. The transmission behavior timing features of the encrypted session traffic to be detected are generated based on the transmission length embedding feature and the transmission direction feature.

4. The method as described in claim 3, characterized in that, The step of generating the transmission behavior timing features of the encrypted session traffic to be detected based on the transmission length embedding feature and the transmission direction feature includes: A transmission behavior representation of the encrypted session traffic to be detected is generated based on the transmission length embedding feature and the transmission direction feature; The global environment constraint information of the encrypted session traffic to be detected is encoded to generate global context constraint features; The global context constraint features and the transmission behavior representation are fused to generate the transmission behavior temporal features of the encrypted session traffic to be detected.

5. The method according to any one of claims 2 to 4, characterized in that, The multidimensional traffic feature representation further includes: a mask matrix; before the step of generating the classification result of the encrypted session traffic to be detected based on the load timing features and the transmission behavior timing features, it further includes: The mask matrix is ​​truncated by a threshold to generate a binary constraint mask. The binary constraint mask is used to identify the boundary between the payload region and the invalid padding region in the encrypted session traffic to be detected. The step of generating the classification result of the encrypted session traffic to be detected based on the load timing characteristics and the transmission behavior timing characteristics includes: The classification result of the encrypted session traffic to be detected is generated based on the load timing characteristics, the transmission behavior timing characteristics, and the binarized constraint mask.

6. The method as described in claim 5, characterized in that, The preset traffic classification model also includes a global attention encoder; The step of generating the classification result of the encrypted session traffic to be detected based on the load timing features, the transmission behavior timing features, and the binarized constraint mask includes: The load timing characteristics and the transmission behavior timing characteristics are fused to obtain fused timing characteristics; A category aggregation token is concatenated at the beginning position of the sequence of the fused temporal features to obtain the target fused temporal features; The global attention encoder generates the classification result of the encrypted session traffic to be detected based on the target fusion temporal features and the binarized constraint mask.

7. The method as described in claim 6, characterized in that, The step of generating the classification result of the encrypted session traffic to be detected based on the target fusion temporal features and the binarized constraint mask using the global attention encoder includes: The global attention encoder performs multi-head self-attention computation based on the target fusion temporal features; During the calculation process, the binarized constraint mask is injected into the source key filling mask slot of the global attention encoder to output the updated sequence; Extract the target category aggregation token corresponding to the updated sequence, and generate the classification result of the encrypted session traffic to be detected based on the target category aggregation token.

8. A flow detection device, characterized in that, The device includes: The session reconstruction module is used to respond to the traffic detection request, reconstruct the encrypted session traffic to be detected, and obtain a multi-dimensional traffic feature representation. The multi-dimensional traffic feature representation includes a payload matrix and a direction length matrix. The payload matrix is ​​used to characterize the payload spatial distribution of the encrypted session traffic to be detected, and the direction length matrix is ​​used to characterize the transmission behavior timing logic of the encrypted session traffic to be detected. The feature extraction module is used to extract the payload timing features of the encrypted session traffic to be detected from the payload matrix, and to extract the transmission behavior timing features of the encrypted session traffic to be detected from the direction length matrix. The traffic classification module is used to generate classification results for the encrypted session traffic to be detected based on the load timing characteristics and the transmission behavior timing characteristics.

9. A flow detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the flow detection method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the flow detection method as described in any one of claims 1 to 7.

Images