Multi-modal traffic encryption web service identification method and apparatus
By constructing a multimodal encrypted traffic identification model, the problem of poor performance in identifying encrypted network traffic attacks in existing technologies is solved, and efficient encrypted traffic identification and classification are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- COMP NETWORK INFORMATION CENT CHINESE ACADEMY OF SCI
- Filing Date
- 2025-01-13
- Publication Date
- 2026-07-14
AI Technical Summary
Existing port number-based classification methods are ineffective when faced with dynamic port allocation and port obfuscation, while deep packet inspection methods cannot examine the content of encrypted traffic data packets, resulting in poor performance in identifying encrypted network traffic attacks.
A multimodal traffic encryption web service identification method is adopted. By preprocessing web page traffic data, an encryption traffic identification model is constructed, which includes a deep fingerprint recognition (DF) modality layer and a residual network (ResNet) modality layer. The model is then combined with a merging layer and a shared representation layer for classification estimation, and multimodal information is used to improve the identification accuracy.
It improves the granularity of dark web encrypted traffic identification and classification accuracy, significantly reduces training time, and enhances the model's classification performance.
Smart Images
Figure CN122394819A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of Internet data analysis technology, specifically to a method and apparatus for identifying multimodal traffic-encrypted Web services. Background Technology
[0002] With the continuous development of Internet data analysis technology, in today's information age, the ways of accessing network services using encryption technology are increasing. At present, network traffic encryption has become a common phenomenon, and dark web attacks are also increasing. Therefore, the identification of encrypted network traffic attacks is particularly important.
[0003] Currently, there are two main approaches to identifying encrypted network traffic attacks. One approach is based on port number classification, but dynamic port allocation and port obfuscation techniques have resulted in poor performance and ineffective port number identification. Another approach is based on Deep Packet Inspection (DPI), but DPI cannot view the payload content in encrypted traffic packets, thus failing to effectively identify attacks and resulting in poor performance. Summary of the Invention
[0004] The purpose of this invention is to solve the problems existing in the prior art and to provide a method and apparatus for identifying multimodal traffic-encrypted web services.
[0005] The multimodal encrypted web service identification method provided by this invention is implemented through the following technical solutions: preprocessing web page traffic data, including data segmentation, data standardization, data denoising, and data labeling; constructing an encrypted traffic identification model, which includes a deep fingerprinting (DF) modal layer, a residual network (ResNet) modal layer, a merging layer, a shared representation layer, and an output layer, wherein the DF modal layer is used to process sequence data, and the ResNet modal layer is used to process image data; classifying and estimating the web page traffic data using the encrypted traffic identification model, and outputting the identification result corresponding to the encrypted traffic.
[0006] Furthermore, the DF modality layer sequentially comprises: 4 convolutional block groups, 2 fully connected block groups, and 1 prediction layer; wherein, the construction of each convolutional block group is sequentially: convolutional layer, normalization layer, nonlinear activation function layer, convolutional layer, normalization layer, nonlinear activation function layer, max pooling layer, and dropout layer; the construction of each fully connected block group is sequentially: fully connected layer, normalization layer, nonlinear activation function layer, and dropout layer.
[0007] Furthermore, the ResNet modal layer is composed of residual blocks, which include convolutional layers, normalization layers, nonlinear activation function layers, and shortcut connections; wherein, the shortcut connections are used to sum the data that has undergone convolution and nonlinear transformation with the data that has not undergone convolution and nonlinear transformation.
[0008] Furthermore, the method also includes: training the encrypted traffic identification model; the training of the encrypted traffic identification model includes: independently pre-training the DF modal layer, the ResNet modal layer and the merging layer respectively; freezing the low-level parameters of each layer obtained by independent pre-training, and optimizing and adjusting the high-level parameters of the encrypted traffic identification model to obtain the trained encrypted traffic identification model.
[0009] Furthermore, the preprocessing of the webpage traffic data includes: segmenting the webpage traffic data to obtain multiple data packets; standardizing the segmented data, including data truncation or zero-padding, to obtain data of a preset fixed length; denoising the standardized data to remove background noise; tagging the denoised data to label the corresponding generated webpages; and adding traffic direction information to the tagged data.
[0010] The multimodal encrypted web service identification device provided by this invention is implemented through the following technical solutions: a preprocessing module for preprocessing web page traffic data, including data segmentation, data standardization, data denoising, and data labeling; a model building module for constructing an encrypted traffic identification model, which includes a deep fingerprinting (DF) modality layer, a residual network (ResNet) modality layer, a merging layer, a shared representation layer, and an output layer, wherein the DF modality layer is used to process sequence data, and the ResNet modality layer is used to process image data; and an identification module for classifying and estimating the web page traffic data using the encrypted traffic identification model and outputting the identification result corresponding to the encrypted traffic.
[0011] Furthermore, the DF modal layer constructed by the model construction module sequentially includes: 4 convolutional block groups, 2 fully connected block groups, and 1 prediction layer; wherein, the construction of each convolutional block group is sequentially: convolutional layer, normalization layer, nonlinear activation function layer, convolutional layer, normalization layer, nonlinear activation function layer, max pooling layer, and output layer; the construction of each fully connected block group is sequentially: fully connected layer, normalization layer, nonlinear activation function layer, and output layer.
[0012] Furthermore, the ResNet modal layer constructed by the model building module is composed of residual blocks, which include convolutional layers, normalization layers, nonlinear activation function layers, and shortcut connections; wherein, the shortcut connections are used to sum the data that has undergone convolution and nonlinear transformation with the data that has not undergone convolution and nonlinear transformation.
[0013] Furthermore, the device further includes: a model training module for training the encrypted traffic identification model; the model training module includes: a pre-training sub-module for independently pre-training the DF modal layer, the ResNet modal layer, and the merging layer; and an optimization sub-module for freezing the low-level parameters of each layer obtained from the independent pre-training and optimizing and adjusting the high-level parameters of the encrypted traffic identification model to obtain the trained encrypted traffic identification model.
[0014] Furthermore, the preprocessing module includes: a segmentation submodule, used to segment the webpage traffic data to obtain multiple data packets; a standardization submodule, used to standardize the segmented data, the standardization process including data truncation or zero-padding to obtain data of a preset fixed length; a denoising submodule, used to denoise the standardized data to remove background noise; a tagging submodule, used to tag the denoised data to label the corresponding generated webpage; and a traffic direction submodule, used to add traffic direction information to the tagged data.
[0015] Compared with the prior art, the beneficial effects of the present invention include:
[0016] 1. This invention can process multimodal data simultaneously. It processes sequence data through the DF modality layer and image data through the ResNet modality layer, comprehensively utilizing information from multiple modalities. It can effectively utilize the heterogeneity of traffic data from different perspectives, capture intramodal and intermodal dependencies, improve the identification granularity of dark web encrypted traffic, and enhance the accuracy of classification and identification, thereby improving classification performance.
[0017] 2. By constructing a merging layer and a shared representation layer, the model can effectively integrate features from different modalities, which can improve the accuracy and performance of fingerprint attacks, ensure the integrity of features from each modality, and further extract and optimize features, enabling the model to better capture complex traffic patterns and features.
[0018] 3. During model training, this invention utilizes a two-stage training strategy of pre-training and fine-tuning optimization, which can effectively utilize computing resources, achieve rapid convergence of the loss function, and significantly reduce the training time. Attached Figure Description
[0019] Figure 1 This is a schematic diagram of the multimodal traffic encryption web service identification method in this specific embodiment;
[0020] Figure 2 This is another flowchart illustrating the multimodal traffic encryption web service identification method in this specific embodiment;
[0021] Figure 3 This is a schematic diagram of the framework of the traffic encryption web service identification model in this specific implementation;
[0022] Figure 4 This is a schematic diagram of the DF mode layer in this specific embodiment;
[0023] Figure 5 This is a schematic diagram of the Conv Layer structure in this specific embodiment;
[0024] Figure 6 This is a schematic diagram of the structure of the multimodal traffic encryption Web service identification device in this specific embodiment;
[0025] Figure 7 This is a schematic diagram of the model training module in this specific embodiment;
[0026] Figure 8 This is a schematic diagram of the preprocessing module in this specific embodiment. Detailed Implementation
[0027] The present invention will now be described in further detail with reference to the accompanying drawings:
[0028] refer to Figure 1 As shown in the figure, the multimodal traffic encryption web service identification method in this specific embodiment includes:
[0029] 101. Preprocess webpage traffic data, including: data segmentation, data standardization, data denoising, and data tagging.
[0030] In this embodiment of the invention, the dataset includes web traffic data from different sources, all generated by real users. Data segmentation divides the captured web traffic data into multiple discrete units; data standardization ensures consistent lengths for different input data; data denoising removes background traffic from the captured web traffic; and data labeling correctly identifies each traffic segment as the webpage that generated it.
[0031] In this embodiment of the invention, two modalities of flow direction information can be generated. One is to use the flow direction as a one-dimensional vector to form sequential data, such as +1, -1 and 0. The other is to combine the flow direction into a two-dimensional form, such as the flow direction can map the three data of +1, -1 and 0 to three pixel values of 255, 0 and 127, thereby forming a two-dimensional image format.
[0032] 102. Construct an encrypted traffic identification model, which includes a deep fingerprinting (DF) modal layer, a residual network (ResNet) modal layer, a merging layer, a shared representation layer, and an output layer. The DF modal layer is used to process sequence data, and the ResNet modal layer is used to process image data.
[0033] In this embodiment of the invention, based on the constructed ResNet modal layer DF modal layer architecture, through layer stacking and different operations, feature extraction can be performed stepwise on the input data, ultimately completing the task of fingerprint attack identification. The residual blocks introduced by the constructed ResNet modal layer can alleviate the gradient vanishing and degradation problems, avoiding direct fitting of the output, and fitting only the residual between the input and output. The merging layer can concatenate the feature vectors extracted from different modalities, ensuring the integrity of each modal feature. The shared representation layer Dense Layer captures the dependencies between modalities, enabling further feature extraction and optimization, so that the model can better capture complex traffic patterns and features. The Softmax output layer can select the category with the highest probability as the final classification result.
[0034] 103. Classify and estimate the webpage traffic data using the encrypted traffic identification model, and output the identification result corresponding to the encrypted traffic.
[0035] Compared with existing technologies, the embodiments of the present invention can process multimodal data simultaneously. It processes sequence data through the DF modality layer and image data through the ResNet modality layer, comprehensively utilizing information from multiple modalities. It can effectively utilize the heterogeneity of traffic data from different perspectives, capture intramodal and intermodal dependencies, improve the identification granularity of dark web encrypted traffic, and enhance the accuracy of classification and identification, thereby improving classification performance.
[0036] refer to Figure 2 As shown, another multimodal traffic encryption web service identification method in this specific embodiment includes:
[0037] 201. The webpage traffic data is segmented to obtain multiple data packets.
[0038] In this embodiment of the invention, the dataset includes web traffic data from different sources, which are generated by real users. Data segmentation refers to dividing the captured web traffic data into multiple discrete units, and assigning a label to each segmented unit based on the encrypted traffic inflow / outflow direction. For example, the encrypted traffic inflow / outflow direction label can be +1 or -1.
[0039] 202. Standardize the segmented data, including data truncation or zero padding, to obtain data of a preset fixed length.
[0040] In this embodiment of the invention, the input data is standardized, i.e., formatted, to ensure that the length of different input data is consistent. Specifically, data exceeding a preset fixed length can be truncated, and data shorter than the preset fixed length can be padded with zeros to ensure data format consistency.
[0041] 203. Perform noise reduction processing on the standardized data to remove background noise data.
[0042] In this embodiment of the invention, removing background traffic from the captured webpage traffic ensures that the dataset contains only traffic data from the foreground application, thereby improving the accuracy of subsequent classification processing by the deep learning model. Specifically, background traffic can be removed during the traffic capture session using a system call tracing method.
[0043] 204. Tag the data after noise reduction and label the corresponding generated web pages.
[0044] In this embodiment of the invention, during each traffic capture session, the user executes only one application in the foreground to ensure that each traffic fragment can be correctly labeled as the webpage that generated it. In this embodiment of the invention, by labeling the dataset with the webpage that generated the network traffic, it is possible to ensure that each traffic data has the correct category label.
[0045] 205. Add traffic direction information to the tagged data.
[0046] In this embodiment of the invention, two modalities of flow direction information can be generated. One is to use the flow direction as a one-dimensional vector to form sequential data, such as +1, -1 and 0. The other is to combine the flow direction into a two-dimensional form, such as the flow direction can map the three data of +1, -1 and 0 to three pixel values of 255, 0 and 127, thereby forming a two-dimensional image format.
[0047] 206. Construct an encrypted traffic identification model, which includes a deep fingerprinting (DF) modal layer, a residual network (ResNet) modal layer, a merging layer, a shared representation layer, and an output layer. The DF modal layer is used to process sequence data, and the ResNet modal layer is used to process image data.
[0048] refer to Figure 3 As shown, the framework of the traffic encryption Web service identification model constructed in this embodiment of the invention includes, in sequence: a DF (Deep Fingerprinting) modal layer for processing one-dimensional column data (Sequential data) and extracting feature vector Fa; a ResNet (Residual Network) modal layer for processing two-dimensional image data and extracting feature vector Fb; a merging layer for merging the processing results Fa from the DF modal layer and Fb from the ResNet modal layer, which can concatenate the two to form a larger feature vector, ensuring the integrity of each modal feature; a shared representation layer (Dense Layer) for capturing the dependencies between modalities, further performing feature extraction and feature optimization, enabling the model to better capture complex traffic patterns and features; and a Softmax output layer for outputting classification results, which can estimate the probability of each category and select the category with the highest probability as the final classification result.
[0049] In this embodiment of the invention, the DF modality layer sequentially includes: 4 convolutional block groups, 2 fully connected block groups, and 1 prediction layer; wherein, the construction of each convolutional block group is sequentially: a convolutional layer, a normalization layer, a nonlinear activation function layer, a convolutional layer, a normalization layer, a nonlinear activation function layer, a max pooling layer, and a dropout layer; the construction of each fully connected block group is sequentially: a fully connected layer, a normalization layer, a nonlinear activation function layer, and a dropout layer.
[0050] refer to Figure 4As shown, the DF modality layer constructed in this embodiment of the invention includes four convolutional block groups (left side of the figure), two fully connected block groups (right side of the figure), and one prediction layer. The left side of the figure includes a stack of multiple convolutional layers (Conv Layer), normalization layers (BN), non-linear activation function layers (ReLU), max pooling layers (Max Pooling), and dropout layers. This stacking structure is repeated four times, enabling the progressive extraction of high-level features from the input image. The right side of the figure shows that after feature extraction, the data passes through two fully connected layers, each followed by a normalization layer (BN), a non-linear activation function layer (ReLU), and a dropout layer. The prediction layer can be a softmax layer, capable of outputting the final probability distribution or predicted value based on the specific task. The DF modality layer architecture in the figure, through layer stacking and different operations, can progressively extract features from the input data, ultimately completing the task of fingerprint attack identification.
[0051] Specifically, such as Figure 4 As shown, the construction of each convolutional block group specifically includes: Conv Layer: The convolutional layer is the core component of CNN, used to extract local features of the input data through convolution operations. Convolution operations can perform sliding window operations on the input data through multiple filters to generate feature maps; Batch Normalization (BN): Batch normalization is performed on the activation values of each layer, stabilizing and accelerating the network training process by adjusting and scaling; ReLU: Non-linear activation function layer: ReLU is used to enable the model to learn more complex functions and avoid the gradient vanishing problem; Max Pooling: Max Pooling is used to downsample by extracting the maximum value of a local region in the input feature map, which can reduce the feature map size while retaining important features; Dropout: Dropout is used to randomly drop some neurons during training, so that the network is trained with a different subset of neurons in each iteration, which can prevent overfitting and thus improve the model's generalization ability.
[0052] Specifically, such as Figure 4 As shown, the construction of each fully connected block group specifically includes: a fully connected layer (FC) to connect all neurons in the previous layer to each neuron in this layer, which can be obtained through weighted summation and activation functions; a batch normalization layer (BN) to perform batch normalization on the activation values of each layer, stabilizing and accelerating the network training process through adjustment and scaling; a non-linear activation function layer (ReLU) to enable the model to learn more complex functions and avoid the gradient vanishing problem; and a dropout layer to randomly drop some neurons during training, allowing the network to use a different subset of neurons for training in each iteration, which can prevent overfitting and thus improve the model's generalization ability.
[0053] In this embodiment of the invention, the ResNet modal layer is composed of residual blocks, which include convolutional layers, normalization layers, nonlinear activation function layers, and shortcut connections; wherein, the shortcut connections are used to sum the data that has undergone convolution and nonlinear transformation with the data that has not undergone convolution and nonlinear transformation.
[0054] refer to Figure 5 As shown, the ResNet modal layer constructed in this embodiment of the invention includes a residual block comprising: a ConvLayer convolutional layer, a BN normalization layer, and a ReLU nonlinear activation function layer. The right side of the figure shows a shortcut connection (or skip connection), which does not involve convolution or nonlinear transformation. The plus circle at the bottom of the figure represents a summation operation, adding the output x of the shortcut connection (i.e., the input of the residual block) to the output F(x) of the two convolutional modules (i.e., the residual after convolution), resulting in the output H(x) = F(x) + x of the residual block.
[0055] In this embodiment of the invention, ResNet is a deep convolutional neural network (CNN) architecture used for image recognition tasks. Generally, as the number of network layers increases, gradients may gradually vanish or explode during backpropagation, leading to difficulties in model training. Therefore, this embodiment of the invention alleviates the vanishing and degradation problems by introducing residual blocks. It avoids directly fitting the output and simplifies the model optimization problem by fitting only the residual between the input and output, thereby improving the overall training efficiency of the model.
[0056] 207. Perform independent pre-training on the DF modal layer, the ResNet modal layer, and the merged layer respectively.
[0057] For the embodiments of the present invention, the independent pre-training process involved in step 207 may specifically include: (1) initializing all parameters of the single-modal chain, including the weights and biases of the parameters in the DF modal layer and the ResNet modal layer; (2) adding a temporary Softmax layer at the top of each single-modal chain for classification tasks, and each single-modal chain can perform independent classification based on this; (3) using the cross-entropy loss function to measure the difference between the predicted result and the true label; (4) training each single-modal chain independently, using the ADAM optimizer to prevent overfitting; (5) after the aforementioned training process is completed, saving the pre-training parameters of each single-modal chain.
[0058] In this embodiment of the invention, by independently pre-training each single-modal chain, the classification loss function of that modality chain can be minimized, thereby enhancing the ability of that modality to solve classification tasks independently.
[0059] 208. Freeze the low-level parameters of each layer obtained from independent pre-training, and optimize and adjust the high-level parameters of the encrypted traffic identification model to obtain the trained encrypted traffic identification model.
[0060] For the embodiments of the present invention, the optimization and adjustment process of high-level parameters involved in step 208 may specifically include: (1) initializing the parameters of the shared representation layer and the final Softmax layer, and loading the parameters of the single-modal chain saved in the pre-training stage; (2) freezing the low-level parameters (e.g., the parameters of the convolutional layer) optimized in the pre-training stage, and only optimizing the high-level parameters (e.g., the parameters of the fully connected layer and the shared representation layer).
[0061] In this embodiment of the invention, through the above training process, the model can effectively extract features from multimodal data and capture the dependencies between modalities by merging and sharing representation layers. This allows the model to classify and identify encrypted traffic website access behavior using the multimodal features of encrypted traffic, thereby improving the overall classification performance of the model and significantly reducing the model training time.
[0062] 209. Classify and estimate the webpage traffic data using the encrypted traffic identification model, and output the identification result corresponding to the encrypted traffic.
[0063] Compared with existing technologies, the embodiments of the present invention can process multimodal data simultaneously. It processes sequence data through the DF modality layer and image data through the ResNet modality layer, comprehensively utilizing information from multiple modalities. It can effectively utilize the heterogeneity of traffic data from different perspectives, capture intramodal and intermodal dependencies, improve the identification granularity of dark web encrypted traffic, and enhance the accuracy of classification and identification, thereby improving classification performance.
[0064] refer to Figure 6 As shown, the multimodal traffic encryption web service identification device of this specific embodiment includes:
[0065] The preprocessing module 31 is used to preprocess web page traffic data, including: data segmentation, data standardization, data denoising and data tagging.
[0066] The model building module 32 is used to build an encrypted traffic identification model, which includes a deep fingerprinting (DF) modal layer, a residual network (ResNet) modal layer, a merging layer, a shared representation layer, and an output layer. The DF modal layer is used to process sequence data, and the ResNet modal layer is used to process image data.
[0067] The identification module 33 is used to classify and estimate the webpage traffic data through the encrypted traffic identification model, and output the identification result corresponding to the encrypted traffic.
[0068] The DF modal layer constructed by the model construction module 32 sequentially includes: 4 convolutional block groups, 2 fully connected block groups, and 1 prediction layer; wherein, the construction of each convolutional block group is sequentially: convolutional layer, normalization layer, nonlinear activation function layer, convolutional layer, normalization layer, nonlinear activation function layer, max pooling layer, and output layer; the construction of each fully connected block group is sequentially: fully connected layer, normalization layer, nonlinear activation function layer, and output layer.
[0069] The ResNet modal layer constructed by the model building module 32 is composed of residual blocks, which include convolutional layers, normalization layers, nonlinear activation function layers, and shortcut connections; wherein, the shortcut connections are used to sum the data that has undergone convolution and nonlinear transformation with the data that has not undergone convolution and nonlinear transformation.
[0070] refer to Figure 7 As shown, the device further includes a model training module 41.
[0071] The model training module 41 is used to train the encrypted traffic identification model.
[0072] The model training module 41 includes: a pre-training sub-module 4101 and an optimization sub-module 4102.
[0073] The pre-training submodule 4101 is used to perform independent pre-training on the DF modality layer, the ResNet modality layer and the merging layer respectively.
[0074] The optimization submodule 4102 is used to freeze the low-level parameters of each layer obtained by independent pre-training, and optimize and adjust the high-level parameters of the encrypted traffic identification model to obtain the trained encrypted traffic identification model.
[0075] refer to Figure 8 As shown, the preprocessing module 31 further includes:
[0076] The segmentation submodule 3101 is used to segment the webpage traffic data to obtain multiple data packets;
[0077] The standardization submodule 3102 is used to standardize the segmented data. The standardization process includes data truncation or zero padding to obtain data of a preset fixed length.
[0078] The noise reduction submodule 3103 is used to perform noise reduction processing on the standardized data to remove background noise data from the data.
[0079] The tagging submodule 3104 is used to tag the data after noise reduction and to annotate the generated web pages corresponding to the data.
[0080] The flow direction submodule 3105 is used to add flow direction information to the tagged data.
[0081] The multimodal traffic encryption Web service identification device provided in this specific embodiment can implement the method implementation method described above. For specific functional implementation, please refer to the description in the method embodiment, which will not be repeated here.
[0082] The above technical solution is only one embodiment of the present invention. For those skilled in the art, based on the principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the technical solutions described in the specific embodiments of the present invention. Therefore, the foregoing description is only a preferred option and is not restrictive.
Claims
1. A method for identifying multimodal traffic-encrypted web services, characterized in that, include: Preprocessing of web traffic data includes: data segmentation, data standardization, data denoising, and data tagging; An encrypted traffic identification model is constructed, which includes a deep fingerprinting (DF) modal layer, a residual network (ResNet) modal layer, a merging layer, a shared representation layer, and an output layer. The DF modal layer is used to process sequence data, and the ResNet modal layer is used to process image data. The encrypted traffic identification model is used to classify and estimate the webpage traffic data, and the identification results corresponding to the encrypted traffic are output.
2. The multimodal traffic encryption web service identification method according to claim 1, characterized in that, The DF modality layer comprises, in sequence, four convolutional block groups, two fully connected block groups, and one prediction layer; wherein, each convolutional block group is constructed in sequence as follows: a convolutional layer, a normalization layer, a nonlinear activation function layer, a convolutional layer, a normalization layer, a nonlinear activation function layer, a max pooling layer, and a dropout layer; each fully connected block group is constructed in sequence as follows: a fully connected layer, a normalization layer, a nonlinear activation function layer, and a dropout layer.
3. The multimodal traffic encryption web service identification method according to claim 1, characterized in that, The ResNet modal layer is composed of residual blocks, which include convolutional layers, normalization layers, nonlinear activation function layers, and shortcut connections. The shortcut connections are used to sum the data that has undergone convolution and nonlinear transformation with the data that has not undergone convolution and nonlinear transformation.
4. The multimodal traffic encryption web service identification method according to claim 1, characterized in that, The method further includes: The encrypted traffic identification model is trained; Training the encrypted traffic identification model includes: The DF modal layer, the ResNet modal layer, and the merging layer are each pre-trained independently. The low-level parameters of each layer obtained from independent pre-training are frozen, and the high-level parameters of the encrypted traffic identification model are optimized and adjusted to obtain the trained encrypted traffic identification model.
5. The multimodal traffic encryption web service identification method according to claim 1, characterized in that, The preprocessing of webpage traffic data includes: The webpage traffic data is segmented to obtain multiple data packets; The segmented data is standardized, including data truncation or zero padding, to obtain data of a preset fixed length. Denoising is performed on the standardized data to remove background noise. The data after noise reduction is tagged, and the corresponding generated web pages are labeled. Add traffic direction information to the tagged data.
6. A multimodal traffic encryption web service identification device, characterized in that, include: The preprocessing module is used to preprocess web page traffic data, including: data segmentation, data standardization, data denoising, and data tagging; The model building module is used to build an encrypted traffic identification model, which includes a deep fingerprinting (DF) modal layer, a residual network (ResNet) modal layer, a merging layer, a shared representation layer, and an output layer. The DF modal layer is used to process sequence data, and the ResNet modal layer is used to process image data. The identification module is used to classify and estimate the webpage traffic data through the encrypted traffic identification model, and output the identification result corresponding to the encrypted traffic.
7. The multimodal traffic encryption Web service identification device according to claim 6, characterized in that, The DF modal layer constructed by the model construction module includes, in sequence, four convolutional block groups, two fully connected block groups, and one prediction layer. Each convolutional block group is constructed as follows: a convolutional layer, a normalization layer, a nonlinear activation function layer, another convolutional layer, a normalization layer, a nonlinear activation function layer, a max pooling layer, and an output layer. Each fully connected block group is constructed as follows: a fully connected layer, a normalization layer, a nonlinear activation function layer, and an output layer.
8. The multimodal traffic encryption Web service identification device according to claim 6, characterized in that, The ResNet modal layer constructed by the model building module consists of residual blocks, which include convolutional layers, normalization layers, nonlinear activation function layers, and shortcut connections. The shortcut connections are used to sum the data that has undergone convolution and nonlinear transformation with the data that has not undergone convolution and nonlinear transformation.
9. The multimodal traffic encryption Web service identification device according to claim 6, characterized in that, The device further includes: The model training module is used to train the encrypted traffic identification model; The model training module includes: The pre-training submodule is used to independently pre-train the DF modality layer, the ResNet modality layer, and the merging layer respectively; The optimization submodule is used to freeze the low-level parameters of each layer obtained from independent pre-training, and optimize and adjust the high-level parameters of the encrypted traffic identification model to obtain the trained encrypted traffic identification model.
10. The multimodal traffic encryption Web service identification device according to claim 6, characterized in that, The preprocessing module includes: The segmentation submodule is used to segment the webpage traffic data to obtain multiple data packets; The standardization submodule is used to standardize the segmented data. The standardization process includes data truncation or zero padding to obtain data of a preset fixed length. The noise reduction submodule is used to denoise the standardized data and remove background noise data from the data. The tagging submodule is used to tag the data after noise reduction and to annotate the generated web pages corresponding to the data. The traffic direction submodule is used to add traffic direction information to the tagged data.