Cryptographic malicious traffic detection method and system based on prior knowledge constraint

Abstract

The present application belongs to the technical field of secure communication, and particularly relates to an encryption malicious traffic detection method and system based on prior knowledge constraint. The encryption malicious traffic sample is mapped into a load gray scale image, a message header prior feature and a time sequence statistical sequence feature. The global spatial feature of the gray scale image is extracted, the message header feature is mapped into a header unit and injected into an image unit to obtain an image branch; and a time sequence branch is obtained through a causal expansion time sequence convolution. The double-branch features are weighted and fused according to a preset weight, and the sample difficulty is jointly measured in combination with a classification interval, a prediction uncertainty and a historical stability to screen difficult samples. The fusion weight is optimized through iterative search, and the fusion weight of the easily confused categories is corrected and modified through low-rank directional rectification. Relying on the prior feature constraint, adaptive adjustment of the difficult samples and accurate rectification of the easily confused categories are realized.

Description

Technical Field

[0001] This invention belongs to the field of malicious traffic detection technology, specifically relating to an encrypted malicious traffic detection method and system based on prior knowledge constraints. Background Technology

[0002] As the digitalization and interconnectivity of critical infrastructure such as power and industrial internet continue to improve, network-side business traffic is showing a trend towards end-to-end encryption, protocol diversification, and covert behavior. While encrypted communication protects user privacy in the business data domain, it also naturally provides a covert channel for malicious software communication, control command issuance, and attack chain coordination, making traditional detection methods that rely on plaintext content parsing ineffective. On the other hand, black-box models that rely solely on static rule matching or a few fixed features are prone to decreased accuracy and conceptual drift in the face of different network scenarios, different data distributions, and new attack variants.

[0003] Meanwhile, encrypted traffic in real network environments is characterized by multi-scale, multi-modal, and strong noise: on the one hand, the byte sequence of the message payload contains fine-grained structural information; on the other hand, the message header fields, timing arrival patterns, and packet length variations reflect the prior rules of business behavior and interaction processes. However, existing methods often fail to make sufficient use of prior knowledge, making it difficult to simultaneously take into account spatial texture and temporal dynamics, and have limited ability to distinguish between difficult samples and malicious obfuscation families, thus affecting the reliability and robustness of the detection system in high-concurrency, cross-scenario deployments.

[0004] Therefore, there is an urgent need for an encrypted malicious traffic detection method and system that can integrate multi-source prior information, adaptively adjust decisions for difficult samples, and effectively correct easily confused categories without decryption, so as to improve the real-time detection and classification capabilities in complex threat scenarios. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for detecting encrypted malicious traffic based on prior knowledge constraints, so as to solve the problems of low accuracy, poor ability to identify difficult samples and poor robustness in cross-scenario generalization of existing encrypted malicious traffic detection.

[0006] To achieve the above objectives, this invention provides a method for detecting encrypted malicious traffic based on prior knowledge constraints, comprising the following steps: Encrypted malicious traffic data is collected, flow-level samples are formed and preprocessed; the preprocessed data is represented in a multimodal manner to obtain the load grayscale image, packet header prior features and time-series statistical sequence features corresponding to each flow-level sample; Local and global spatial features are extracted sequentially from the load grayscale image, and the prior feature vector of the message header is mapped to a header unit of the same dimension as the load grayscale image unit. The header unit is then injected into the grayscale image unit to obtain image features. The temporal statistical sequence is dynamically evolved using causal dilated temporal convolution to obtain temporal evolution features, which are then dimensionally aligned with the image features. Image features and temporal evolution features are weighted and fused according to preset fusion weights, and the sample classification loss, sample classification margin, prediction uncertainty and historical stability are obtained through a classifier. The sample difficulty is determined by the joint measurement of sample classification margin, prediction uncertainty and historical stability, and difficult samples are selected based on the sample difficulty score. By jointly optimizing the classification loss of all samples and the difficulty-weighted classification loss of hard samples, the average classification loss of the entire dataset is used as the first objective function, and the difficulty-weighted loss of the hard sample set is used as the second objective function. The optimal fusion weight is obtained by iteratively updating through a non-dominated genetic algorithm. The image features and temporal evolution features are then weighted and fused according to the optimal fusion weight to obtain the fused features and classify them. If there are easily confused categories in the classification results, the fusion weight correction stage is entered for reclassification. For categories identified as easily confused by the classification results, the fusion weights are corrected using low-rank orientation correction. The image features and temporal evolution features corresponding to the easily confused categories are then weighted and fused using the corrected fusion weights to obtain the corrected classification results.

[0007] Preferably, the multimodal representation includes the following operations: A specific number of data packets are selected from the flow level samples and arranged in chronological order; the data packet payloads are length-aligned and rearranged, mapped into two-dimensional grayscale blocks, and then gridded to obtain a grayscale image. The byte values ​​are then linearly normalized to obtain the payload image corresponding to each flow level sample. The header information of each data packet in the flow-level sample is parsed, the header prior features are extracted from the flow-level sample, the numerical fields are normalized, the discrete fields are encoded, and the header prior features are concatenated. Low-dimensional time-series feature vectors are extracted from the flow-level samples, stacked along the time axis, truncated or padded with zeros to standardize the sample length, and then standardized to obtain time-series statistical sequence features.

[0008] Preferably, the sample difficulty includes the following operations: For a single flow level sample, the sample classification margin is first obtained by the difference between the true class prediction probability and the highest prediction probability of other classes. The sample classification margin difficulty is obtained by truncation and inverse normalization. Then, the prediction uncertainty difficulty is obtained by normalizing the Shannon information entropy of the predicted probability distribution; At the same time, the percentage of times the prediction category in the K rounds is inconsistent with that in the last round is used to obtain the difficulty of historical stability; Finally, the sample difficulty is obtained by weighting and summing the three difficulties: sample classification interval difficulty, prediction uncertainty difficulty, and historical stability difficulty.

[0009] Preferably, the modification of the fusion weights includes the following operations: By maintaining the class prototypes of each sample in the fusion feature space of temporal features and image features, and combining the classification loss and dual margin loss to represent the loss function, the class prototypes are updated and optimized by exponential smoothing through the momentum coefficient, and the fusion features are adaptively corrected based on the class margin between the fusion features and the class prototypes.

[0010] Preferably, difficult samples include the following operations: The prediction results for each sample are statistically analyzed, sorted from high to low according to the sample difficulty score, and a certain proportion of samples are selected as the difficult sample set.

[0011] Preferred, easily confused categories include the following operations: When the confidence difference between the first two classes output by the classifier is less than a preset threshold, it is determined to be an easily confused class.

[0012] Preferably, low-rank orientation correction includes the following operations: For easily confused class pairs, a discriminant axis is set. When the confidence difference between the two classes of samples output by the classifier is less than a preset threshold, directional residual correction is performed along the discriminant axis.

[0013] A system for detecting encrypted malicious traffic based on prior knowledge constraints, comprising: The data acquisition and preprocessing module collects encrypted malicious traffic data, forms flow-level samples, and performs preprocessing; it then performs multimodal representation on the preprocessed data to obtain the load grayscale image, packet header prior features, and time-series statistical sequence features corresponding to each flow-level sample. The multimodal construction module extracts local and global spatial features sequentially from the load grayscale image, maps the prior feature vector of the message header to a header unit of the same dimension as the load grayscale image unit, and injects the header unit into the grayscale image unit to obtain image features; it also performs dynamic evolution on the temporal statistical sequence using causal dilated temporal convolution to obtain temporal evolution features, and aligns them with the image features in terms of dimension. The feature extraction and sample selection module performs weighted fusion of image features and temporal evolution features according to preset fusion weights, and obtains sample classification loss, sample classification margin, prediction uncertainty and historical stability through a classifier. The sample difficulty is determined by the joint measure of sample classification margin, prediction uncertainty and historical stability, and difficult samples are selected based on the sample difficulty score. The multi-objective fusion weight optimization module jointly optimizes the classification loss of all samples and the difficulty-weighted classification loss of difficult samples. It uses the average classification loss of the entire dataset as the first objective function and the difficulty-weighted loss of the difficult sample set as the second objective function. It iteratively updates the optimal fusion weights through a non-dominated genetic algorithm and then performs weighted fusion of image features and temporal evolution features based on the optimal fusion weights to obtain fused features and classify them. If there are easily confused categories in the classification results, the confusion correction and output module is executed. The confusion correction and output module determines that the classification result belongs to an easily confused category and corrects the fused features through low-rank directional correction; then, it reclassifies based on the corrected fused features.

[0014] Preferably, the feature extraction and sample screening module includes: The sample difficulty module is used to obtain the sample classification interval for a single flow level sample by first using the difference between the true class prediction probability and the highest prediction probability of other classes, and then obtaining the sample classification interval difficulty by truncating and inverse normalization. Then, the prediction uncertainty difficulty is obtained by normalizing the Shannon information entropy of the predicted probability distribution; At the same time, the percentage of times the prediction category in the K rounds is inconsistent with that in the last round is used to obtain the difficulty of historical stability; Finally, the sample difficulty is obtained by weighting and summing the three difficulties: sample classification interval difficulty, prediction uncertainty difficulty, and historical stability difficulty.

[0015] Preferably, the obfuscation correction and output module includes: The fusion weight correction module is used to maintain the class prototype of each sample in the fusion feature space of temporal features and image features. It combines the classification loss and dual margin loss to form a loss function. The class prototype is updated and optimized by exponential smoothing through the momentum coefficient. Based on the class margin between the fusion features and the class prototype, the fusion features are adaptively corrected.

[0016] Compared with the prior art, the technical solution provided by this invention has the following advantages: (1) By performing flow-level aggregation and preprocessing on the encrypted communication data collected from the network link side, and mapping it into three modal inputs: load grayscale image, message header prior features and time-series statistical sequence, the complementarity of different information sources can be fully utilized without decryption, thereby improving the stability and applicability of encrypted malicious traffic detection.

[0017] (2) By injecting the prior knowledge extracted from the message header fields into the image branch in the form of constraints, the efficient collaboration between image and temporal features is achieved, and different encrypted traffic is distinguished in fine granularity. This significantly enhances the robustness to complex network environments and protocol diversity, and reduces the risk of accuracy degradation caused by scene migration.

[0018] (3) By constructing a sample difficulty measure that combines sample classification interval, sample uncertainty and historical stability, and using a non-dominated genetic algorithm to search for multi-objective fusion weights, the fusion weights of image branches and sequence branches can be adaptively adjusted according to sample difficulty, which effectively improves the identification ability of difficult samples and the overall decision stability of the model, and reduces the dependence on fixed weight fusion strategies.

[0019] (4) By introducing a directional residual correction mechanism based on the real category and the discrimination axis, the fusion characteristics of easily confused malicious families in the ambiguous region are directionally corrected. The aim is to improve the separability and classification accuracy of confused classes without significantly interfering with the judgment of other categories, thereby enhancing the ability of the encrypted malicious traffic detection system to distinguish highly similar attack families and its practical value. Detailed Implementation

[0020] To further understand the content of this invention, the invention will be described in detail with reference to the embodiments.

[0021] A method for detecting encrypted malicious traffic based on prior knowledge constraints mainly includes: S1. Collect encrypted malicious traffic data, form flow-level samples and preprocess them; perform multimodal representation on the preprocessed data to obtain the load grayscale image, packet header prior features and time-series statistical sequence features corresponding to each flow-level sample.

[0022] By collecting network communication data packets at network egress points, switch mirror ports, bypass probes, or gateway devices, the header information of each data packet is obtained. , payload byte sequence and arrival time And represent a single data packet as .

[0023] Furthermore, the data packets are aggregated based on the five-tuple (source IP, destination IP, source port, destination port, transport layer protocol) and a preset time window, and a data structure of length is constructed according to the arrival time order. Stream-level samples And combine the sample labels to build a stream-level dataset.

[0024] The streaming dataset is preprocessed as follows: (1) Length alignment based on flow-level samples: Set the maximum data length to... When the data length of the stream-level sample When the data length is... The excess portion is truncated to obtain a stream-level sample sequence of consistent length.

[0025] (2) Abnormal and redundant sample processing: Identify and remove duplicate samples, incomplete samples or obviously abnormal samples in the stream-level dataset, and reduce the impact of noisy data on classification decisions.

[0026] (3) Feature normalization / standardization: The data used for feature extraction is normalized or standardized, preferably by mapping the original values ​​to an interval. Alternatively, zero-mean unit variance standardization can be performed to improve the accuracy and consistency of feature extraction.

[0027] The multimodal representation includes the following operations: A specific number of data packets are selected from the flow level samples and arranged in chronological order; the data packet payloads are length-aligned and rearranged, mapped into two-dimensional grayscale blocks, and then gridded to obtain a grayscale image. The byte values ​​are then linearly normalized to obtain the payload image corresponding to each flow level sample. The header information of each data packet in the flow-level sample is parsed, the header prior features are extracted from the flow-level sample, the numerical fields are normalized, the discrete fields are encoded, and the header prior features are concatenated. Low-dimensional time-series feature vectors are extracted from the flow-level samples, stacked along the time axis, truncated or padded with zeros to standardize the sample length, and then standardized to obtain time-series statistical sequence features.

[0028] To fully characterize the grayscale features of the payload, prior features of the header, and temporal dynamic features of encrypted communication without decryption, this embodiment constructs a multimodal input representation for the preprocessed stream-level dataset, specifically including the following steps: (1) Constructing a load grayscale image input Based on flow level samples Payload byte sequence of each data packet The payload bytes are length aligned, and the byte values ​​are mapped to grayscale images according to a preset mapping rule and then normalized; preferably, the intra-stream... Each data packet is mapped to... grayscale tiles and according to Grid stitching A single-channel load grayscale image is denoted as: , in, This represents an 84×84×1 three-dimensional tensor composed of real numbers.

[0029] If the valid data packets in the stream are insufficient in length If the missing position is filled with zeros, then if the length exceeds the limit... Then the length extracted in chronological order is Alternatively, a preset sampling strategy can be used to select a length of [length]. The data packets are used to construct the load grayscale image.

[0030] (2) Extract the prior features of the message header and construct the header prior vector. Header information of each data packet in the convection-level sample. The process involves parsing, extracting structured field features related to protocol behavior, and then encoding and concatenating them to form a header prior vector. : , in, For the prior feature dimension, The first sample extracted from the flow level sample f represents the... The header has prior features; preferably, numerical fields (such as header fields) are normalized, and discrete fields (such as fields without metric meaning) are one-hot encoded or embedded encoded to ensure that different types of fields are in the same vector space.

[0031] (3) Constructing time series statistical sequences And standardize. Extract time-series statistical feature vectors from data packets in channel c according to their arrival time order. Preferably, the time series statistical sequence is constructed by including packet length, adjacent arrival times (low-dimensional) and their derived statistics. : , in, This represents the upper limit of the time series sequence length. This refers to the number of time-series feature channels; when the actual length is insufficient... Fill with zeros when the time exceeds the limit. Time truncation. The time series is standardized by channel, as follows: , in, and The first The mean and standard deviation of each channel. This is a standardized time-series statistical sequence.

[0032] S2. Extract local and global spatial features sequentially from the load grayscale image, and map the prior feature vector of the message header to a header unit of the same dimension as the load grayscale image unit. Inject the header unit into the grayscale image unit to obtain image features. Perform dynamic evolution on the temporal statistical sequence using causal dilated temporal convolution to obtain temporal evolution features, and align them with the image features in dimension.

[0033] The constructed load grayscale image Head prior vector and standardized time series statistical sequences Image branch and temporal branch feature extraction networks, constrained by prior knowledge, are used to extract spatial and temporal dynamic features of the image, respectively. The image branch network extracts spatial features from the grayscale image and injects the head prior vector into the image branch as a prior constraint. The temporal branch network models the dynamic evolution of the temporal statistical sequence and outputs temporal branch features. Details are as follows: (1) Image branch feature extraction and prior constraint injection Load grayscale image The input image is processed by a branch network for feature extraction. The image branch network is preferably a lightweight visual Transformer structure, which converts the image into an image token sequence through convolutional embedding and block encoding, and then extracts global spatial features through a multi-layer self-attention encoder.

[0034] At the same time, the head prior vector Prior tokens are obtained through linear mapping : , in and These are the weight matrix and bias term of the linear mapping, respectively.

[0035] The prior token is fused with the image branch output, preferably by vector-level superposition or concatenation followed by mapping, to obtain image features. : , in The nonlinear mapping function representing the image branching network, Represents the fusion operator, This represents the pooling operation; it obtains image features by encoding the joint information of the payload spatial features and the head prior features. .

[0036] (2) Temporal branch feature extraction Standardized time series statistical sequences Inputting a causal dilated convolutional network, extracting dynamically evolving features, its first... The convolution of a layer is calculated as follows: , in, The kernel size is [size]. Indicates the first One convolutional kernel, Let be the expansion rate of the nth layer, and let be the expansion rate. , For convolution weights, For bias terms; This represents the input features of the nth layer. This represents the output characteristics of the nth layer at time t.

[0037] The receptive field is expanded by stacking multiple layers of dilated convolutions to capture long-range temporal dependencies, and the result of the last time step or global pooling is taken as the temporal feature. : , in, The nonlinear mapping function representing a temporal branching network. This indicates a feature selection operation.

[0038] (3) Branch feature alignment To facilitate subsequent fusion and classification, image features were analyzed separately. With time series characteristics Perform dimension alignment, preferably mapping to the same dimension. (For example This yields the initial branch representation after alignment, which is used for subsequent weight optimization.

[0039] S3. Image features and temporal evolution features are weighted and fused according to preset fusion weights, and the sample classification loss, sample classification margin, prediction uncertainty and historical stability are obtained through a classifier. The sample difficulty is determined by the joint measurement of sample classification margin, prediction uncertainty and historical stability, and difficult samples are selected based on the sample difficulty score.

[0040] The two branches' features are weighted and fused based on preset fusion weights to obtain the fused features of sample f. : , in, Represents the weights of the image branches. Indicates the time-series branch weights. This represents the image branch feature corresponding to the f-th sample. This represents the temporal branch feature corresponding to the f-th sample.

[0041] The sample difficulty includes the following operations: For a single flow level sample, the sample classification margin is first obtained by the difference between the true class prediction probability and the highest prediction probability of other classes. The sample classification margin difficulty is obtained by truncation and inverse normalization. Then, the prediction uncertainty difficulty is obtained by normalizing the Shannon information entropy of the predicted probability distribution; At the same time, the percentage of times the prediction category in the K rounds is inconsistent with that in the last round is used to obtain the difficulty of historical stability; Finally, the sample difficulty is obtained by weighting and summing the three difficulties: sample classification interval difficulty, prediction uncertainty difficulty, and historical stability difficulty.

[0042] Fusion features Input the data into the classifier to obtain the predicted probability vector. With sample classification loss .

[0043] Calculate the sample difficulty and construct a set of difficult samples. For a single flow level sample, the true class prediction probability is represented as the confidence probability of the labeled sample after classification, corresponding to its true label.

[0044] First, the classification margin is obtained by finding the difference between the predicted probability of the true class and the highest predicted probability of the other classes. Then, the classification margin difficulty is obtained by truncating and inversely normalizing. : , in, Represents the true category of a single stream-level encrypted traffic sample f. The prediction for sample f is The probability of traffic type, Represents the classification margin, predicting probabilities based on the true class. Highest predicted probability compared to other categories The difference is worth it. This represents the cutoff function, which restricts the classification margin to between 0 and 1.

[0045] Shannon information entropy by predicting probability distribution Normalization yields prediction uncertainty and difficulty : , Simultaneously, the percentage of times the prediction category differed from the last prediction category in the K-round forecast was analyzed to determine the historical stability difficulty. : , in, Indicates the category of the last round of predictions. Indicates the first Round prediction category.

[0046] The classification margin, uncertainty, and historical stability are jointly measured as the sample difficulty. Specifically: , in, The difficulty weight of the classification interval sample is represented. This indicates the difficulty weight for predicting uncertain samples. The weight representing the difficulty of historical stability samples.

[0047] The difficult samples include the following operations: The prediction results for each sample are statistically analyzed, sorted from high to low according to the sample difficulty score, and a certain proportion of samples are selected as the difficult sample set.

[0048] Specifically, select Located in front The samples constitute a difficult sample set .

[0049] S4. By jointly optimizing the classification loss of all samples and the difficulty-weighted classification loss of difficult samples, the average classification loss of the entire dataset is used as the first objective function, and the difficulty-weighted loss of the difficult sample set is used as the second objective function. The optimal fusion weight is obtained by iteratively updating through a non-dominated genetic algorithm. The image features and temporal evolution features are then weighted and fused according to the optimal fusion weight to obtain the fused features and classify them. If there are easily confused categories in the classification results, then S5 is executed.

[0050] Specifically, in the feasible region The fusion weight population is initialized randomly within the internal system.

[0051] Average classification loss across the entire dataset As the first objective function, it is expressed as: , in This represents the total sample size of the data. This indicates that the fusion weight is In this case, the model is for a single flow level sample The prediction category; ( Indicates sample Classification loss.

[0052] Difficulty-weighted loss based on the difficulty of the difficult sample set As the second objective function, it is expressed as: , in Indicates the sample size of the difficult data; ( Indicates sample The difficulty of weighted classification loss.

[0053] The fusion weight population is iteratively updated using a non-dominated genetic algorithm, such as non-dominated sorting, selection, simulated binary crossover, and polynomial mutation, to approximate the Pareto front. The optimal fusion weights are then selected from the Pareto solution set based on the validation set performance, and finally, the optimal fusion weights are determined based on the image branch. Optimal fusion weights with time-series branches The final fusion features of sample f are obtained. : .

[0054] S5. If the classification result is determined to be a category that is easily confused, the fused features are corrected by low-rank directional correction; the fused features are then reclassified based on the corrected fused features.

[0055] The easily confused categories include the following operations: When the confidence difference between the first two classes output by the classifier is less than a preset threshold, it is determined to be an easily confused class.

[0056] The low-rank orientation correction includes the following operations: For easily confused class pairs, a discriminant axis is set. When the confidence difference between the two classes of samples output by the classifier is less than a preset threshold, directional residual correction is performed along the discriminant axis.

[0057] The predicted sample probabilities are sorted from high to low to obtain the two predicted categories with the highest probabilities. ,when If the confidence difference is less than a preset threshold, the sample is determined to be located in a locally ambiguous region and is considered a easily confused category. Are easily confused category pairs The discrimination axis is represented as: , This represents the class prototype of the easily confused category i. This represents the class prototype of the easily confused category j.

[0058] Normalize the final fused features to obtain the normalized fused features. : .

[0059] Based on the normalized fusion features and the final fusion features of sample f, directional low-rank residual correction is performed along the corresponding discriminant axis to obtain the corrected fusion features. : , in Adjust the scaling factor for the residuals, and based on Re-categorize and output the data.

[0060] The modification of the fusion features includes: By maintaining the class prototypes of each sample in the fusion feature space of temporal features and image features, and combining the classification loss and dual margin loss to represent the loss function, the class prototypes are updated and optimized by exponential smoothing through the momentum coefficient, and the fusion features are adaptively corrected based on the class margin between the fusion features and the class prototypes.

[0061] Maintain a class prototype for each category in the fused feature space. And for the current small batch of categories Average fusion features of samples Updated using exponential moving average: , in, It is obtained by averaging the fused features of all samples after correction. The momentum coefficient is updated for the class prototype to control the update amplitude of the class prototype. The exponential moving average is used to achieve smooth memory of historical class features, suppress prototype fluctuations caused by noise from small batch samples, and enable the class center to gradually adapt to changes in sample distribution while maintaining the stability of historical features, thereby improving the discriminative reliability of the feature space.

[0062] Specifically, a loss function is designed to guide the low-rank orientation correction process. The basic classification loss and the pairwise constraint loss for easily confused categories are weighted and fused to construct an overall optimization objective. The goal is to enable the classifier to learn general traffic classification capabilities while focusing on strengthening its ability to distinguish easily confused malicious traffic categories, and a dual-margin loss is constructed. : , in, For preset intervals, Represents the inner product, measuring the sample and Feature class interval, sign function ,when ,express and If they are of the same type, the feature distance will decrease; when ,express and Being an outlier increases the feature distance; when This indicates that the value is invalid and will not be included in the calculation.

[0063] Overall loss target Dual gap loss Average classification loss across the entire dataset Accumulation: , in The weighting coefficients are used to balance the two losses.

[0064] To verify the feasibility and effectiveness of each module of this invention, experimental verification was conducted. Three publicly available encrypted malicious traffic datasets were used: Dataset 1 (2016 Network Traffic Classification Dataset from the University of Science and Technology of China), Dataset 2 (2017 Intrusion Detection System Dataset from the Canadian Cybersecurity Institute), and Dataset 3 (13-Scenario Network Dataset from the Czech Technical University). Each dataset was divided into training and testing sets in a 7:3 ratio. Each traffic sample underwent uniform preprocessing. The experimental platform was Ubuntu 20.04, implemented using PyTorch, and training and testing were completed under an Intel i5-14600KF processor and NVIDIA RTX 5060 GPU environment. The accuracy results are shown in Table 1, demonstrating that this invention exhibits superior detection performance and more stable false positive control capabilities across multiple datasets.

[0065] Specifically, this invention considers using image and temporal branches, constructing a difficult sample dataset, weighting the sample difficulty for fusion, and considering low-rank orientation correction for easily confused categories to improve discrimination accuracy. As comparative algorithms, in Table 1, Method 1 uses only the image branch for feature extraction and classification; Method 2 uses both image and temporal branches for feature extraction and classification, but does not introduce weighted fusion of difficult samples or low-rank orientation correction; Method 3 uses both image and temporal branches, and considers weighted fusion of difficult samples, but does not consider low-rank orientation correction for easily confused categories.

[0066] Table 1. Recognition accuracy of the present invention on different datasets (unit: %)

[0067] An encrypted malicious traffic detection system based on prior knowledge constraints includes the following modules: The data acquisition and preprocessing module collects encrypted malicious traffic data, forms flow-level samples, and performs preprocessing; it then performs multimodal representation on the preprocessed data to obtain the load grayscale image, packet header prior features, and time-series statistical sequence features corresponding to each flow-level sample. The multimodal construction module extracts local and global spatial features sequentially from the load grayscale image, maps the prior feature vector of the message header to a header unit of the same dimension as the load grayscale image unit, and injects the header unit into the grayscale image unit to obtain image features; it also performs dynamic evolution on the temporal statistical sequence using causal dilated temporal convolution to obtain temporal evolution features, and aligns them with the image features in terms of dimension. The feature extraction and sample selection module performs weighted fusion of image features and temporal evolution features according to preset fusion weights, and obtains sample classification loss, sample classification margin, prediction uncertainty and historical stability through a classifier. The sample difficulty is determined by the joint measure of sample classification margin, prediction uncertainty and historical stability, and difficult samples are selected based on the sample difficulty score. The multi-objective fusion weight optimization module jointly optimizes the classification loss of all samples and the difficulty-weighted classification loss of difficult samples. It uses the average classification loss of the entire dataset as the first objective function and the difficulty-weighted loss of the difficult sample set as the second objective function. It iteratively updates the optimal fusion weights through a non-dominated genetic algorithm and then performs weighted fusion of image features and temporal evolution features based on the optimal fusion weights to obtain fused features and classify them. If there are easily confused categories in the classification results, the confusion correction and output module is executed. The confusion correction and output module determines that the classification result belongs to an easily confused category and corrects the fused features through low-rank directional correction; then, it reclassifies based on the corrected fused features.

[0068] Preferably, the feature extraction and sample screening module includes: The sample difficulty module is used to obtain the sample classification interval for a single flow level sample by first using the difference between the true class prediction probability and the highest prediction probability of other classes, and then obtaining the sample classification interval difficulty by truncating and inverse normalization. Then, the prediction uncertainty difficulty is obtained by normalizing the Shannon information entropy of the predicted probability distribution; At the same time, the percentage of times the prediction category in the K rounds is inconsistent with that in the last round is used to obtain the difficulty of historical stability; Finally, the sample difficulty is obtained by weighting and summing the three difficulties: sample classification interval difficulty, prediction uncertainty difficulty, and historical stability difficulty.

[0069] Preferably, the obfuscation correction and output module includes: The fusion weight correction module is used to maintain the class prototype of each sample in the fusion feature space of temporal features and image features. It combines the classification loss and dual margin loss to form a loss function. The class prototype is updated and optimized by exponential smoothing through the momentum coefficient. Based on the class margin between the fusion features and the class prototype, the fusion features are adaptively corrected.

Claims

1. A method for detecting encrypted malicious traffic based on prior knowledge constraints, characterized in that, Includes the following steps: S1. Collect encrypted malicious traffic data, form stream-level samples, and perform preprocessing; The preprocessed data is represented in a multimodal manner to obtain the load grayscale image, message header prior features, and time-series statistical sequence features corresponding to each flow level sample. S2. Extract local features and global spatial features from the load grayscale image in sequence, and map the prior feature vector of the message header to a header unit of the same dimension as the load grayscale image unit. Inject the header unit into the grayscale image unit to obtain image features. The temporal statistical sequence is dynamically evolved using causal dilated temporal convolution to obtain temporal evolution features, which are then dimensionally aligned with image features. S3. Image features and temporal evolution features are weighted and fused according to preset fusion weights, and the sample classification loss, sample classification margin, prediction uncertainty and historical stability are obtained through a classifier. The sample difficulty is determined by the joint measurement of sample classification margin, prediction uncertainty and historical stability, and difficult samples are selected based on the sample difficulty score. S4. By jointly optimizing the classification loss of all samples and the difficulty-weighted classification loss of difficult samples, the average classification loss of the entire dataset is used as the first objective function, and the difficulty-weighted loss of the difficult sample set is used as the second objective function. The optimal fusion weight is obtained by iteratively updating through a non-dominated genetic algorithm. The image features and temporal evolution features are then weighted and fused according to the optimal fusion weight to obtain the fused features and classify them. If there are easily confused categories in the classification results, then proceed to S5. S5. If the classification result is determined to be a category that is easily confused, the fused features are corrected by low-rank directional correction; the fused features are then reclassified based on the corrected fused features.

2. The encrypted malicious traffic detection method according to claim 1, characterized in that... The multimodal representation in S1 is specifically operated as follows: A specific number of data packets are selected from the flow level samples and arranged in chronological order; the data packet payloads are length-aligned and rearranged, mapped into two-dimensional grayscale blocks, and then gridded to obtain a grayscale image. The byte values ​​are then linearly normalized to obtain the payload image corresponding to each flow level sample. The header information of each data packet in the flow-level sample is parsed, the header prior features are extracted from the flow-level sample, the numerical fields are normalized, the discrete fields are encoded, and the header prior features are concatenated. Low-dimensional time-series feature vectors are extracted from the flow-level samples, stacked along the time axis, truncated or padded with zeros to standardize the sample length, and then standardized to obtain time-series statistical sequence features.

3. The encrypted malicious traffic detection method according to claim 1, characterized in that... The sample difficulty in S3 is determined as follows: For a single flow level sample, the sample classification margin is first obtained by the difference between the true class prediction probability and the highest prediction probability of other classes. The sample classification margin difficulty is obtained by truncation and inverse normalization. Then, the prediction uncertainty difficulty is obtained by normalizing the Shannon information entropy of the predicted probability distribution; At the same time, the percentage of times the prediction category in the K rounds is inconsistent with that in the last round is used to obtain the difficulty of historical stability; Finally, the sample difficulty is obtained by weighting and summing the three difficulties: sample classification interval difficulty, prediction uncertainty difficulty, and historical stability difficulty.

4. The encrypted malicious traffic detection method according to claim 1, characterized in that... In S5, the fusion weights are adjusted, and the specific steps are as follows: By maintaining the class prototypes of each sample in the fusion feature space of temporal features and image features, and combining the classification loss and dual margin loss to represent the loss function, the class prototypes are updated and optimized by exponential smoothing through the momentum coefficient, and the fusion features are adaptively corrected based on the class margin between the fusion features and the class prototypes.

5. The encrypted malicious traffic detection method according to claim 1, characterized in that... The specific operation for difficult samples in S3 is as follows: The prediction results for each sample are statistically analyzed, sorted from high to low according to the sample difficulty score, and a certain proportion of samples are selected as the difficult sample set.

6. The encrypted malicious traffic detection method according to claim 1, characterized in that... The specific steps for handling easily confused categories in S5 are as follows: When the confidence difference between the first two classes output by the classifier is less than a preset threshold, it is determined to be an easily confused class.

7. The encrypted malicious traffic detection method according to claim 1, characterized in that... The specific operation of low-rank orientation correction in S5 is as follows: For easily confused class pairs, a discriminant axis is set. When the confidence difference between the two classes of samples output by the classifier is less than a preset threshold, directional residual correction is performed along the discriminant axis.

8. A system for detecting encrypted malicious traffic based on prior knowledge constraints, characterized in that, Includes the following modules: The data acquisition and preprocessing module collects encrypted malicious traffic data, forms stream-level samples, and performs preprocessing. The preprocessed data is represented in a multimodal manner to obtain the load grayscale image, message header prior features, and time-series statistical sequence features corresponding to each flow level sample. The multimodal construction module extracts local and global spatial features sequentially from the load grayscale image, maps the prior feature vector of the message header to a header unit of the same dimension as the load grayscale image unit, and injects the header unit into the grayscale image unit to obtain image features. The temporal statistical sequence is dynamically evolved using causal dilated temporal convolution to obtain temporal evolution features, which are then dimensionally aligned with image features. The feature extraction and sample selection module performs weighted fusion of image features and temporal evolution features according to preset fusion weights, and obtains sample classification loss, sample classification margin, prediction uncertainty and historical stability through a classifier. The sample difficulty is determined by the joint measure of sample classification margin, prediction uncertainty and historical stability, and difficult samples are selected based on the sample difficulty score. The multi-objective fusion weight optimization module jointly optimizes the classification loss of all samples and the difficulty-weighted classification loss of difficult samples. It uses the average classification loss of the entire dataset as the first objective function and the difficulty-weighted loss of the difficult sample set as the second objective function. It iteratively updates the optimal fusion weights through a non-dominated genetic algorithm, and then performs weighted fusion of image features and temporal evolution features based on the optimal fusion weights to obtain fused features and classify them. If there are easily confused categories in the classification results, the confusion correction and output module is executed. The confusion correction and output module determines that the classification result belongs to an easily confused category and corrects the fused features through low-rank directional correction; then, it reclassifies based on the corrected fused features.

9. The encrypted malicious traffic detection system according to claim 8, characterized in that, The feature extraction and sample selection module includes: The sample difficulty module is used to obtain the sample classification interval for a single flow level sample by first using the difference between the true class prediction probability and the highest prediction probability of other classes, and then obtaining the sample classification interval difficulty by truncating and inverse normalization. Then, the prediction uncertainty difficulty is obtained by normalizing the Shannon information entropy of the predicted probability distribution; At the same time, the percentage of times the prediction category in the K rounds is inconsistent with that in the last round is used to obtain the difficulty of historical stability; Finally, the sample difficulty is obtained by weighting and summing the three difficulties: sample classification interval difficulty, prediction uncertainty difficulty, and historical stability difficulty.

10. The encrypted malicious traffic detection system according to claim 8, characterized in that, The obfuscation correction and output modules include: The fusion weight correction module is used to maintain the class prototype of each sample in the fusion feature space of temporal features and image features. It combines the classification loss and dual margin loss to form a loss function. The class prototype is updated and optimized by exponential smoothing through the momentum coefficient. Based on the class margin between the fusion features and the class prototype, the fusion features are adaptively corrected.

Images