A lightweight encrypted traffic classification method based on convolutional position encoding and efficient multi-scale attention

Abstract

The application provides a lightweight encrypted traffic classification method based on convolution position coding and efficient multi-scale attention, comprising the following steps: performing data preprocessing on original encrypted traffic data and converting the original encrypted traffic data into a two-dimensional gray image; constructing a CEMA-Net encrypted traffic classification network, wherein the CEMA-Net encrypted traffic classification network comprises: a feature mapping layer, which is used for converting the two-dimensional gray image into a one-dimensional sequence; a backbone network based on convolution position coding and efficient multi-scale attention, which is used for taking the one-dimensional sequence as input and extracting traffic features in layers; and a classification output layer, which is used for mapping the traffic features to traffic categories; and inputting the two-dimensional gray image into a pre-trained EMLA-Net encrypted traffic classification network to obtain a classification result of encrypted traffic. The application can effectively model the complex cross-scale dependence relationship in encrypted traffic with extremely low computing overhead.

Description

Technical Field

[0001] This invention relates to the technical field of network traffic classification, and more particularly to a lightweight encrypted traffic classification method. Background Technology

[0002] Network traffic classification plays a fundamental role in network security and management, providing crucial support for bandwidth allocation, Quality of Service (QoS) assurance, user experience optimization, and threat detection. With the rapid adoption of emerging technologies such as 5G, the Internet of Things (IoT), edge computing, and cloud computing, network traffic is becoming increasingly diverse, large-scale, and dynamic. Therefore, accurate and efficient traffic classification is indispensable for achieving intelligent network operation and maintenance and ensuring system reliability.

[0003] However, the widespread adoption of encryption protocols such as Transport Layer Security (TLS), Secure Sockets Layer (SSL), and Quick UDP Internet Connection (QUIC) has fundamentally challenged traditional traffic classification methods. Since packet payloads are inaccessible, traditional methods such as Deep Packet Inspection (DPI) and port-based classification have largely become ineffective. Furthermore, the highly dynamic and heterogeneous nature of modern network environments demands that classification models possess strong generalization capabilities across diverse scenarios. Simultaneously, the real-time requirements of edge computing and IoT systems impose strict constraints on computational complexity, memory usage, and inference latency, making it difficult to efficiently deploy traditional deep learning models with their large parameter sets.

[0004] Existing traffic classification methods can be broadly categorized into three types: traditional methods, machine learning-based methods, and deep learning-based methods. Traditional techniques rely on predefined rules or payload detection, but they perform poorly in encrypted environments and often raise privacy concerns. Machine learning-based methods improve flexibility by utilizing the statistical characteristics of traffic flows; however, these methods typically rely on manually designed feature engineering, resulting in limited generalization capabilities in complex and evolving network scenarios. In recent years, deep learning methods, including Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), and Transformer-based architectures, have demonstrated superior performance by automatically learning high-level feature representations from raw traffic data. Nevertheless, these models often have high computational costs and a large number of parameters, limiting their application in environments with high real-time requirements and limited resources. Summary of the Invention

[0005] To address the technical challenges of high computational cost and large parameter count in existing deep learning-based traffic classification methods, this invention proposes a lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention, named CEMA-Net (Convolutional Positional Encoding and Efficient Multi-Scale Attention Network). This invention constructs a lightweight architecture combining convolutional positional encoding and efficient multi-scale attention mechanisms, which can efficiently model local and global dependencies in traffic data. It can effectively capture complex traffic patterns while balancing classification accuracy and computational efficiency. Experimental results show that, compared with the current state-of-the-art methods, this model achieves superior classification performance while significantly reducing computational costs.

[0006] To achieve the above objectives, the technical solution of the present invention is implemented as follows:

[0007] A lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention includes the following steps:

[0008] S1: Preprocess the raw encrypted traffic data and convert it into a two-dimensional grayscale image;

[0009] S2: Construct a CEMA-Net encrypted traffic classification network, which includes: a feature mapping layer for converting a two-dimensional grayscale image into a one-dimensional sequence; a backbone network based on convolutional positional encoding and efficient multi-scale attention for extracting traffic features hierarchically using the one-dimensional sequence as input; and a classification output layer for mapping the traffic features into traffic categories.

[0010] S3: Input the two-dimensional grayscale image obtained in step S1 into the pre-trained CEMA-Nett encrypted traffic classification network to obtain the classification result of encrypted traffic.

[0011] Furthermore, the raw encrypted traffic data undergoes data preprocessing, specifically including:

[0012] S11. Divide the original network traffic into multiple network flows according to the standard five-tuple, wherein the five-tuple includes source IP address, destination IP address, source port, destination port and protocol type;

[0013] S12. Delete duplicate data packets, empty data packets, and information that is not related to traffic classification;

[0014] S13. Extract fixed-size byte segments starting from the initial bytes of the packet header. The fixed-size byte segments include the header and payload. Form a unified one-dimensional byte sequence from the multiple fixed-size byte segments extracted from each network flow according to the order of the data packets.

[0015] S14. Normalize each byte value in the one-dimensional byte sequence;

[0016] S15. Reshape the normalized one-dimensional byte sequence into a two-dimensional grayscale image matrix.

[0017] Furthermore, the feature mapping layer sequentially transforms the two-dimensional grayscale image into one-dimensional sequence features through a first 2D convolutional layer, a second 2D convolutional layer, a Flatten layer, and a first linear layer.

[0018] Furthermore, the backbone network based on convolutional positional encoding and efficient multi-scale attention extracts enhanced encrypted traffic sequence features by fusing convolutional positional encoding and efficient multi-scale attention through multiple stacked CEMA modules.

[0019] Furthermore, the classification output layer maps the enhanced encrypted traffic sequence features into traffic category probabilities through global average pooling, layer normalization, a second linear layer, and the sofmax function.

[0020] Furthermore, the processing procedures in each CEMA module include:

[0021] S21. For each CEMA module's input sequence feature X, perform a first one-dimensional convolutional position encoding and then perform a residual connection with the input sequence feature X to obtain the first fused feature. ;

[0022] S22, regarding the first fusion feature Perform layer normalization to obtain normalized features. ;

[0023] S23, By normalizing the features After feature splitting, a two-branch feature enhancement operation based on efficient multi-scale attention and gated modulation is performed to obtain the two-branch enhanced features. ;

[0024] S24, Enhancement features for dual branches After random depth regularization, it is fused with the first feature Perform residual connections to obtain the second fusion feature. ;

[0025] S25. Employ a second one-dimensional convolutional position encoding to process the second fused feature. After processing, it is combined with the second fusion feature Perform residual connections to obtain enhanced features. ;

[0026] S26. Employ a feedforward network to enhance the features. After performing channel feature transformation and enhancing features Perform residual connections to obtain the enhanced encrypted traffic sequence characteristics output by the CEMA module. .

[0027] Furthermore, in step S23, after feature splitting, a dual-branch feature enhancement operation based on efficient multi-scale attention and gated modulation is performed to obtain dual-branch enhanced features. Specifically, it includes:

[0028] a. The normalized features Perform linear transformation projections separately to obtain the main branch input features. and gated branch features ;

[0029] b. Apply local contextual convolution to the main branch input features. Perform local feature enhancement to obtain local enhanced features. :

[0030] c. The local enhancement features are processed via the EMAAdapter module. Perform multi-scale attention calculations to obtain attention features.

[0031] d. Regarding the gated branch features Nonlinear activation is performed to obtain the gating signal. ;

[0032] e. Using gating signals Attention features of the output of the EMAAdapter module Element-wise multiplication modulation is performed, and the modulated features are projected back to the original feature space through linear projection to obtain the dual-branch enhanced features. .

[0033] Furthermore, in step c, the local enhancement features are processed through the EMAAdapter module. Perform multi-scale attention computation, including:

[0034] c1. Local enhancement features of the input through reshaping operations Perform a sequence-to-pseudo-2D transformation to obtain a pseudo-2D feature map. ;

[0035] c2. Regarding the pseudo-two-dimensional feature map We perform horizontal pooling along the width dimension, vertical pooling along the height dimension, and local convolution to obtain horizontal pooling features. Vertical pooling features and local convolution features ;

[0036] c3. Horizontal pooling features Vertical pooling features and local convolution features After concatenation, a fused feature B is obtained through lightweight mapping. The fused feature B is then reweighted using the Softmax function to obtain new weights. These new weights are then compared with the pseudo-two-dimensional feature map. Element-wise multiplication yields the weighted aggregated features. ;

[0037] c4. Apply lightweight cross-dimensional interaction functions to the weighted aggregated features. Processing is performed to achieve cross-dimensional interaction in pseudo-two-dimensional space, resulting in refined features. :

[0038] c5. Refining features through reshaping operations Perform a pseudo-2D to sequence transformation to obtain attention features. .

[0039] Furthermore, the first one-dimensional convolutional position encoding in step S21 and the second one-dimensional convolutional position encoding in step S25 both employ depthwise separable convolution.

[0040] The local context convolution in step b is implemented using depthwise separable convolution and the SiLU activation function;

[0041] The nonlinear activation in step d is implemented using the SiLU activation function;

[0042] The nonlinear activation function in the feedforward network in step S26 is the GELU activation function.

[0043] Furthermore, the lightweight mapping described in step c3 employs a 1×1 pointwise convolution;

[0044] The lightweight cross-dimensional interaction function in step c4 employs EMA attention.

[0045] The beneficial effects of this invention are as follows:

[0046] By designing an efficient multi-scale attention adapter (EMAAdapter), the efficient multi-scale attention (EMA) mechanism was successfully transferred to the traffic classification task. This adapter reconstructs a one-dimensional traffic sequence into a pseudo-two-dimensional spatial representation, which can capture multi-scale dependencies in both horizontal and vertical dimensions, thereby significantly improving feature extraction efficiency.

[0047] A novel, efficient multi-scale attention module (CEMABlock) is designed, employing a sandwich structure that embeds deep convolutional positional encoding (CPE) at both the ingress and egress stages. This structure injects local spatial inductive bias into the Transformer-like architecture, effectively compensating for the inherent limitations of pure attention mechanisms in modeling fine-grained, short-term packet dependencies.

[0048] By leveraging directional pooling and cross-dimensional feature reweighting, the method of this invention achieves feature representation capabilities comparable to deep two-dimensional CNNs (such as ResNet-101), while incurring only a fraction of the computational overhead, making it well-suited for real-time deployment in resource-constrained environments.

[0049] Experimental results on three public datasets demonstrate that the proposed method has only 0.66M parameters, achieving superior classification performance compared to mainstream vision-based models such as ResNet101, while significantly reducing computational costs. The experimental results validate the effectiveness of combining convolutional positional encoding with a multi-scale attention mechanism, providing an efficient solution for encrypted traffic classification in resource-constrained environments. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a diagram of the lightweight encrypted traffic classification network structure based on convolutional positional encoding and efficient multi-scale attention of the present invention.

[0052] Figure 2 This is a schematic diagram of encrypted traffic data preprocessing according to the present invention.

[0053] Figure 3 This is a schematic diagram of the CEMA module of the present invention.

[0054] Figure 4 This is a schematic diagram of the EMAAdapter module of the present invention.

[0055] Figure 5 The results are from the ablation experiments of this invention.

[0056] Figure 6 The training and validation loss and accuracy curves for the cross-platform Android system of this invention are shown.

[0057] Figure 7The training and validation loss and accuracy curves of this invention on the ISCXVPN2016 dataset are shown. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] A lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention, such as... Figure 1 As shown, the steps include:

[0060] S1: Perform data preprocessing on the original encrypted traffic data and convert it into a two-dimensional grayscale image.

[0061] This invention adopts the approach of converting raw network traffic stored in PCAP format into an image-based representation. This conversion enables the model to effectively capture the structural and statistical characteristics of encrypted traffic.

[0062] Specifically, such as Figure 2 As shown, the processing steps in step S1 include:

[0063] Flow segmentation: The original network traffic is grouped according to the standard 5-tuple. Data packets with the same 5-tuple are grouped into the same network flow. The 5-tuple includes the source IP address, destination IP address, source port, destination port, and protocol type.

[0064] Data cleaning and noise reduction: Remove redundant and duplicate data packets and empty data packets, and remove information that is not related to traffic classification, such as link layer metadata (e.g., MAC addresses), to reduce noise and improve data quality.

[0065] Byte Extraction and Sequence Construction: For each data packet in each cleaned and denoised network stream, a fixed-size byte segment is extracted starting from the initial byte of the packet header. This fixed-size byte segment includes the header and payload. The multiple fixed-size byte segments extracted from each network stream are then arranged in chronological order to form a unified one-dimensional byte sequence.

[0066] (1)

[0067] in, Represents the first in the sequence bytes, The total number of bytes is represented by 1. This representation integrates byte-level, packet-level, and flow-level information, thereby preserving semantic continuity and capturing fine-grained flow patterns. As defined in Equation (1), the constructed sequence provides a unified expression for the flow. Compared with traditional segmentation strategies, this method reduces information loss and mitigates the bias caused by arbitrary segmentation.

[0068] Normalization: To eliminate scale variations caused by different data packet lengths, min-max normalization is applied to each byte value in a one-dimensional byte sequence. This normalization operation maps the data to a uniform interval, improves numerical stability, and helps to accelerate model convergence.

[0069] Grayscale image conversion: Reconstructing a normalized sequence into a two-dimensional grayscale image matrix. Each element corresponds to a pixel grayscale value. The resulting grayscale image preserves the structural relationships within the traffic data and serves as input to the subsequent feature extraction network. This implementation converts raw traffic data stored in Pacp format into image format.

[0070] S2: Construct a CEMA-Net encrypted traffic classification network, which includes: a feature mapping layer for converting a two-dimensional grayscale image into a one-dimensional sequence; a backbone network based on convolutional positional encoding and efficient multi-scale attention for extracting traffic features hierarchically using the one-dimensional sequence as input; and a classification output layer for mapping the traffic features into traffic categories.

[0071] Specifically, such as Figure 1 As shown, the feature mapping layer sequentially transforms the two-dimensional grayscale image into one-dimensional sequence features through a first 2D convolutional layer, a second 2D convolutional layer, a Flatten layer, and a first Linear layer.

[0072] In this embodiment, the feature mapping layer first compresses the input 40×40 grayscale image (shape [B,1,40,40], where B represents the batch size) into a 1D sequence (shape [B,40,64]) of length 40 through two 2D convolutional layers with a stride of 2 and subsequent flattening and linear projection operations. Specifically, the first 2D convolutional layer (1 to 16 channels, kernel size 3×3, stride 2) reduces the spatial resolution of the input 2D grayscale image from 40×40 to 20×20. Then, after batch normalization and SiLU activation, the feature map output by the first 2D convolutional layer is obtained. The second 2D convolutional layer (16 to 64 channels, stride 2) further reduces the spatial resolution of the feature map output by the first 2D convolutional layer to 10×10. After batch normalization and SiLU activation again, the 10×10 spatial dimensions are merged into 100 through a flattening operation. Finally, the linear layer maps the 100 dimensions to 40 dimensions, adapting to the feature extraction requirements of the backbone network. This process extracts local features through convolution, reduces computational cost, and converts 2D images into 1D sequences.

[0073] Specifically, such as Figure 1 As shown, the backbone network based on convolutional positional encoding (CPE) and efficient multi-scale attention (EMA) extracts enhanced encrypted traffic sequence features by fusing multiple stacked CEMA modules to one-dimensional sequence features. The combination of CPE and EMA effectively models both local and global features, enhancing representational power while maintaining low computational complexity. By stacking multiple CEMA modules, the model alternates between local feature aggregation and global dependency modeling, achieving effective interaction between spatial context and long-range semantic information. This hierarchical design enables the model to learn discriminative representations from flattened image inputs, which the classification head then utilizes.

[0074] Specifically, the classification output layer maps the enhanced encrypted traffic sequence features into traffic category probabilities through global average pooling, layer normalization, a second linear layer, and the sofmax function.

[0075] Specifically, such as Figure 3 As shown, the processing procedures in each CEMA module include:

[0076] First, for each CEMA module's input sequence feature X, with shape [B, L, C], where L represents the sequence length and C is the feature dimension, local positional information is injected through a first one-dimensional convolutional positional encoding (CPE1) with residual connections. This one-dimensional convolutional positional encoding employs depthwise separable convolution to obtain the first fused feature. :

[0077] ;

[0078] in, This represents depthwise separable convolution. The above operation introduces a local spatial inductive bias, which means that the model's structural design assumes a stronger correlation between adjacent positions, thus prioritizing feature relationships within the local neighborhood. Convolution operations are computed only within a local receptive field (e.g., 3×3), naturally modeling neighborhood relationships, thereby achieving the introduction of the local spatial inductive bias. By injecting local positional information, it compensates for the lack of local features during attention while preserving the original feature information.

[0079] Furthermore, regarding the first fusion feature Perform layer normalization to stabilize the feature distribution and obtain normalized features. : ;

[0080] in, Presentation layer normalization operation;

[0081] Furthermore, by normalizing the features... After feature splitting, a two-branch feature enhancement operation based on efficient multi-scale attention and gated modulation is performed to obtain the two-branch enhanced features. ;

[0082] Furthermore, a second fusion feature is obtained through random depth regularization and residual connection. :

[0083] .

[0084] Furthermore, to further enhance local inductive bias and improve spatial feature interaction, a second one-dimensional convolutional positional encoding (CPE2) is employed to optimize the second fused feature. Process and merge with the second feature Perform residual connections to obtain enhanced features. :

[0085] ;

[0086] Furthermore, a feedforward network is used to enhance the features. By performing channel feature transformation and residual concatenation, the enhanced encrypted traffic sequence features output by the CEMA module are obtained:

[0087] ;

[0088] in, For layer normalization operation, It is a multilayer perceptron. For random depth regularization operation, For activation function, and These represent the first fully connected layer and the second fully connected layer, respectively. As a non-linear activation function, GELU exhibits a smoother non-linear transition compared to traditional activation functions like ReLU. This residual structure facilitates gradient propagation, improves training stability, and mitigates overfitting through stochastic depth regularization. The Feedforward Network (FFN) module maintains a lightweight structure while possessing powerful non-linear modeling capabilities. By enhancing feature transformations at each location, it complements an efficient multi-scale attention mechanism, thereby improving the model's ability to learn deep semantic representations in encrypted traffic sequences.

[0089] Specifically, after feature splitting, a two-branch feature enhancement operation based on efficient multi-scale attention and gated modulation is performed to obtain two-branch enhanced features. ,include:

[0090] a. The normalized features Perform linear transformation projections separately to obtain the main branch input features. and gated branch features :

[0091] ;

[0092] ;

[0093] in, , As weight;

[0094] b. Apply local contextual convolution to the main branch input features. Local feature enhancement is performed, and the local context convolution is achieved through depthwise convolution and nonlinear activation to obtain enhanced local features. :

[0095] ;

[0096] in, This represents depthwise separable convolution. This represents a nonlinear activation function; the SiLU activation function is used here.

[0097] c. The local enhancement features are processed via the EMAAdapter module. Perform multi-scale attention computation to capture long-range dependencies and obtain attention features. :

[0098] ;

[0099] in, This represents a multi-scale attention operation mapping function based on EMA;

[0100] d. Regarding the gated branch features Nonlinear activation is performed to obtain the gating signal. :

[0101] ;

[0102] in, For nonlinear activation functions, the SiLU activation function is used here;

[0103] e. Using gating signals Attention features of the output of the EMAAdapter module Element-wise multiplication modulation is performed, and the modulated features are projected back to the original feature space via linear projection. This gated interaction enables adaptive feature selection and improves representation quality, resulting in bi-branch enhanced features. :

[0104] ;

[0105] in, For linear projection operations, This is element-wise multiplication.

[0106] Specifically, the EMAAdapter module is the core component of the proposed CEMA-Net, designed for efficient modeling of long-range dependencies in sequence representations. Unlike traditional self-attention mechanisms that rely on explicit query-key-value (QKV) computation, this module employs a lightweight design based on sequence-to-pseudo-2D reshaping and multi-scale spatial feature aggregation, significantly reducing computational complexity. Figure 4 As shown, the processing methods in the EMAAdapter module include:

[0107] First, for the input local enhancement feature (which is a sequence feature), a sequence-to-pseudo-2D transformation is performed to obtain a pseudo-2D feature map. :

[0108] ;

[0109] in, For reshaping operation, The convolution kernel is Convolution operations;

[0110] Furthermore, the pseudo-two-dimensional feature map is processed through three parallel branches. To capture multi-scale spatial information. Specifically, this includes:

[0111] For the pseudo-two-dimensional feature map We perform horizontal pooling along the width dimension, vertical pooling along the height dimension, and 3×3 local convolution to obtain horizontal pooling features. Vertical pooling features and local convolution features The formula is as follows:

[0112] ;

[0113] ;

[0114] ;

[0115] in, For along the width Horizontal pooling operation of dimensions, For height Vertical pooling operations of dimensions, The convolution kernel is The convolution operation.

[0116] Furthermore, regarding the characteristics of horizontal pooling... Vertical pooling features and local convolution features After concatenation, a fused feature B is obtained through lightweight mapping. The fused feature B is then reweighted using the Softmax function to obtain new weights. These new weights are then compared with the pseudo-two-dimensional feature map. Element-wise multiplication yields the weighted aggregated features:

[0117] ;

[0118] in, The fusion function is used to fuse the outputs of the three branches, employing a concatenation followed by lightweight mapping. The lightweight mapping can specifically be: 1×1 pointwise convolution (Pointwise Conv), depthwise separable 1×1 convolution (DW-PW), group convolution (Group Conv), or adaptive average pooling + 1×1 convolution. In this embodiment, 1×1 pointwise convolution is preferred, as it is the most lightweight, stable, and best suited for Softmax reweighting.

[0119] Furthermore, a lightweight cross-dimensional interaction function is used to process the weighted aggregated features. The process involves fully integrating and interacting information across the height, width, and channel dimensions within a pseudo-two-dimensional space to achieve cross-dimensional interaction and obtain refined features.

[0120] ;

[0121] in, A lightweight, cross-dimensional interaction function. , , These represent height, width, and channel, respectively. Lightweight cross-dimensional interaction functions include: channel attention (SE (Squeeze-and-Excitation) and ECA (EfficientChannel Attention); spatial + channel attention (CBAM); and advanced lightweight cross-dimensional attention (CoordinateAttention (CA) and EMA (Efficient Multi-scale Attention). In this embodiment, EMA is preferred.

[0122] Furthermore, the refined features are transformed back into sequence form through a pseudo-two-dimensional to sequence operation:

[0123] ;

[0124] in, For reshaping operations.

[0125] The EMAAdapter module is designed to maintain spatial structure awareness of flattened image sequences while jointly modeling horizontal, vertical, and local dependencies. Compared to standard self-attention, multi-scale spatial attention avoids explicit pairwise similarity calculations, thus mitigating the complexity that quadratically increases with sequence length L. The combination of pseudo-2D reshaping, multi-directional pooling, local convolution, and cross-dimensional interaction enables efficient multi-scale modeling of global and local dependencies. Furthermore, this module can be seamlessly integrated into the CEMA Block, working collaboratively with Convolutional Position Encoding (CPE) and Feedforward Networks (MLP). Multi-scale spatial attention captures global contextual relationships across different directions and scales, while CPE injects fine-grained positional information, enabling the model to better understand the spatial structure in the flattened image sequence. This collaborative design significantly enhances the network's feature representation capabilities while maintaining computational efficiency. Moreover, the modular design allows for flexible adaptation to different sequence lengths and feature dimensions by adjusting the channel expansion ratio and convolutional kernel structure. Figure 4 As shown, this makes the proposed method particularly suitable for image-based sequence classification tasks in large-scale and resource-constrained scenarios.

[0126] This invention introduces Convolutional Position Encoding (CPE) to enhance spatial location information in sequence data, addressing the inherent limitations of attention mechanisms in modeling local dependencies. Local context awareness is introduced through depthwise separable convolutions at both the input and output stages of each backbone module. This design effectively improves the model's ability to capture the relationships between adjacent positions in the sequence. Both the first and second one-dimensional convolutional position encodings are implemented using one-dimensional depthwise separable convolutions with a kernel size of 3, padding of 1, and the number of groups set to the channel dimension d. The kernel size of 3 combined with padding of 1 ensures that the sequence length remains unchanged after convolution. Simultaneously, setting the number of groups to d enables channel-by-channel independent convolution, significantly reducing computational complexity compared to standard convolutions while maintaining channel independence. To incorporate positional information without disrupting the original feature distribution, this invention employs residual connections. This residual structure effectively fuses local positional information while preserving the original features. Furthermore, this structure improves gradient propagation, alleviates the vanishing gradient problem, and ensures stable training in deeper network architectures. Compared to traditional positional encoding methods such as sinusoidal positional encoding and Rotated Positional Encoding (RoPE) in Transformers, Convolutional Positional Encoding (CPE) offers several advantages. CPE does not rely on fixed mathematical formulas but instead uses learnable convolutional kernels to adaptively capture positional information. This allows the model to better adapt to diverse sequence characteristics in different tasks, performing particularly well in image-based sequence classification scenarios with complex and highly variable spatial relationships. Furthermore, the use of depthwise separable convolutions significantly reduces computational overhead, enabling CPE to improve model performance without sacrificing efficiency. Simultaneously, CPE works collaboratively with other components in the backbone network. Specifically, the EMAAdapter is responsible for capturing global and multi-scale dependencies, the Feedforward Network (FFN) (i.e., the Multilayer Perceptron (MLP) sublayer in the standard Transformer architecture) enhances feature representation through nonlinear transformations, and CPE provides fine-grained local positional information. These components together form a complementary framework, enabling the model to effectively model local and global structural patterns in sequence data.

[0127] S3: Input the two-dimensional grayscale image obtained in step S1 into the pre-trained CEMA-Net encrypted traffic classification network to obtain the classification result of encrypted traffic.

[0128] First, experimental setup:

[0129] All experiments were conducted under identical conditions, using the following hardware configuration: AMD® Epyc 7302 16-core processor × 64; NVIDIA GeForce RTX 3090 graphics card; Ubuntu 22.04.5 LTS operating system.

[0130] The experiments were conducted on three publicly available datasets: the Cross Platform dataset, the USTC-TFC2016 dataset, and the ISCX-VPN dataset. All data were divided into training, validation, and test sets in an 8:1:1 ratio. Specifically, the Cross Platform dataset contains user-generated traffic from 215 Android applications and 196 iOS applications. The USTC-TFC2016 dataset mixes normal and malicious traffic, while the ISCX-VPN dataset contains regular and VPN sessions of seven different traffic types. See Table 1 for details.

[0131] Table 1 Dataset Information

[0132]

[0133] Second, evaluation metrics: This invention uses precision, recall, F1 score, and accuracy as evaluation criteria. The calculation formulas are as follows:

[0134] Third, experimental parameter settings: The training consisted of 100 epochs, with a batch size of 64. The optimizer used was AdamW, with an initial learning rate of 0.001, a weight decay coefficient of 1e-4, and a cosine annealing learning rate scheduling strategy. The loss function used was labeled smoothing (smoothing coefficient 0.1) cross-entropy loss. This experiment was implemented using the PyTorch deep learning framework and trained on a server with a single NVIDIA GeForce RTX 3090 graphics card. The experimental parameters are shown in Table 2.

[0135] Table 2 Experimental Parameter Settings

[0136]

[0137] Fourth, comparative experiment:

[0138] First, a comparison with existing encrypted traffic classification algorithms:

[0139] This invention compares and analyzes the proposed method with several commonly used methods in the field of network traffic classification, including FlowPrint, TFE-GNN, ET-BERT, and YaTC. FlowPrint is derived from the literature [Babaria R, Madanapalli S C, Kumar H, et al. Flowformers: Transformer-based models for real-time network flow classification[C] / / 2021 17th International Conference on Mobility, Sensing and Networking (MSN). IEEE, 2021: 231-238. doi:10.1109 / MSN53354.2021.00046], and TFE-GNN is derived from the literature [Zhang H, Yu L, Xiao X, et al. TFE-GNN: ATemporal Fusion Encoder Using Graph Neural Networks for Fine-Grained En-crypted Traffic Classification[C] / / Proceedings of the ACM Web Conference2023]. [2023: 2066-2075. doi:10.1145 / 3543507.3583227], ET-BERT comes from the paper [Lin X, Xiong G, Gou G, et al. ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification[C] / / Proceedings of the ACM Web Conference 2022. 2022: 633-642. doi:10.1145 / 3485447.3512217], and YaTC comes from the paper [Zhao R, Zhan M, Deng X, et al.].Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation[C] / / Proceedings of the AAAI Conference on Artificial Intelligence. 2023, 37(4): 5420-5427. doi:10.1609 / aaai.v37i4.25674.]. This model demonstrates excellent performance on several representative datasets, including USTC-TFC2016, ISCXVPN2016, ISCXTor2016, and CICIoT2022. According to the experimental results in the literature [Rachmawati SM, KimDS, Lee JM. Machine learning algorithm in network traffic classification[C] / / 2021 International Conference on Information and Communication Technology Convergence (ICTC). IEEE, 2021: 1010-1013. doi:10.1109 / ICTC52510.2021.9620746], the model significantly outperforms existing mainstream methods in key metrics such as accuracy (AC) and F1 score (F1), as shown in Table 3.

[0140] Table 3 Performance comparison of existing models on different datasets

[0141]

[0142] Specifically, on the USTC-TFC2016 dataset, CEMA-Net achieved an accuracy of 99.94% and an F1 score of 99.53%. Compared to the second-best performing model, YaTC (99.47% accuracy, 97.36% F1 score), it showed a significant advantage, with an F1 score improvement of 2.17 percentage points. On the ISCXVPN2016 dataset, CEMA-Net achieved an average accuracy of 98.19% and an F1 score of 97.48%. Although its F1 score was slightly lower than YaTC (98.19%), CEMA-Net required only 0.66M parameters, far fewer than YaTC's 2.3M, demonstrating a better performance-efficiency trade-off. On the CrossPlatform-Android dataset, CEMA-Net achieved an accuracy of 97.40% and an F1 score of 97.20%, outperforming other methods and demonstrating strong robustness in complex environments. Similarly, on the Cross Platform-iOS dataset, the model achieved an accuracy of 97.47% and an F1 score of 96.88%, surpassing ET-BERT (both metrics being 94.01%), highlighting its effectiveness in cross-platform encrypted traffic classification tasks. Overall, these results demonstrate that CEMA-Net continues to achieve competitive or even superior performance while maintaining high efficiency.

[0143] Further comparison with typical classification algorithms:

[0144] To verify the effectiveness of the proposed model in the encrypted traffic classification task, this invention conducted several comparative experiments with several typical deep learning models that perform well in image classification, including ResNet101, MobileNetV2, and CNN+LSTM. To ensure the fairness and reliability of the experiments, all models were evaluated under the same dataset settings, preprocessing procedures, and evaluation metrics. The experiments were conducted on four public datasets, using accuracy, precision, recall, and F1 score as evaluation metrics. As shown in Tables 4 and 5, the CEMA Net proposed in this invention achieved competitive or even better stable performance on different datasets.

[0145] Specifically, on the Cross Platform-Android dataset, CEMA Net achieved 97.40% accuracy, 97.26% precision, 97.30% recall, and 97.20% F1 score, outperforming all benchmark models. On the Cross Platform-iOS dataset, CEMA Net achieved 97.55% accuracy and 96.92% F1 score, demonstrating strong cross-platform generalization ability. On the ISCXVPN2016 dataset, CEMA Net achieved 98.19% accuracy and 97.48% F1 score, surpassing ResNet101 (98.04% accuracy, 96.98% F1 score) and other comparable models. Furthermore, on the more challenging USTC-TFC2016 dataset, CEMA-Net achieved 99.94% accuracy and 99.53% F1 score, surpassing all benchmark methods. The results show that CEMA Net maintains robust and stable classification performance on different datasets and platforms, verifying its effectiveness in processing complex high-dimensional encrypted traffic data.

[0146] Table 4 Results of the Cross Platform-Android and Cross Platform-iOS datasets

[0147]

[0148] Table 5 Results of the ISCXVPN2016 and USTC-TFC2016 datasets

[0149]

[0150] Further ablation experiments:

[0151] This invention analyzes the performance of the benchmark model CEMA Net and its variants (No EMA, No MLP, and No CPE) on the CrossPlatform Android, CrossPlatform iOS, ISCXVPN2016, and USTC TFC2016 datasets. Ablation experiments were conducted to verify the contribution of each component to the overall performance. The benchmark model achieved accuracies and F1 scores of 97.40% / 97.20%, 97.55% / 96.92%, 98.19% / 97.48%, and 99.94% / 99.53% on the aforementioned datasets, demonstrating excellent classification capabilities. When the efficient multi-scale attention mechanism (No EMA) was removed, the performance decreased to 97.16% / 96.88%, 95.69% / 95.18%, 97.39% / 96.29%, and 99.86% / 99.91%, reflecting the important role of this module in the model's stability and effectiveness. The performance degradation was more pronounced after removing the MLP module (No MLP), with results dropping to 95.51% / 95.34%, 93.98% / 93.40%, 97.61% / 96.45%, and 99.87% / 99.42%, highlighting its crucial role in feature transformation. For the No CPE variant, the model achieved 96.56% / 96.21%, 95.52% / 95.08%, 97.47% / 96.57%, and 99.87% / 99.10%, respectively, indicating that CPE effectively improved the model's generalization ability and robustness. Overall, the above results demonstrate that each component contributes to the performance improvement, such as... Figure 5 As shown.

[0152] Further training convergence analysis:

[0153] To further evaluate the convergence characteristics and training stability of the proposed model, Figure 6 and Figure 7 The training / validation loss curves and accuracy curves of the model are shown on two representative datasets.

[0154] As shown in Figure 6, on the Cross Platform-Android dataset, the loss curve exhibits a smooth convergence trend, and the accuracy steadily improves throughout the training process, converging around the 85th epoch. This indicates that the optimization process of the proposed model is stable and the learning dynamics are reliable.

[0155] As shown in Figure 7, a similar trend can be observed on the ISCXVPN2016 dataset. The loss decreases steadily, the accuracy continues to improve, and convergence occurs at the 90th epoch. Compared to the Cross Platform dataset, its convergence process is more stable, indicating that the model has good adaptability across different data distributions. Overall, the experimental results show that CEMA Net achieves stable convergence, high accuracy, and strong generalization on multiple datasets.

[0156] Further model performance analysis:

[0157] Regarding model complexity (measured by the number of parameters), this study compared different methods on the ISCXVPN2016 dataset, as shown in Table 6. ResNet101 contains 47.25 million parameters and achieves an accuracy of 98.04%, but its computational cost is high, with FLOPs of 0.281 GMac. MobileNetV2 reduces the number of parameters to 2.23 million, lowering FLOPs to 0.083 GMac, and achieving an accuracy of 97.03%. The CNN+LSTM hybrid model further compresses the number of parameters to 1.96 million, with the lowest computational cost of only 0.034 GMacFLOPs and an accuracy of 97.32%. In contrast, the CEMA Net proposed in this invention exhibits excellent parameter efficiency, with only 660,000 parameters, far fewer than other comparative models, while achieving an accuracy of 98.19%, surpassing ResNet101. Furthermore, its computational cost remains low, with FLOPs of 0.037 GMac. These results demonstrate that CEMA Net achieves a good balance between accuracy and computational efficiency, making it suitable for resource-constrained applications.

[0158] Table 6 Comparison of parameters, accuracy, and floating-point computation for different models

[0159]

[0160] This invention proposes a lightweight classification model, CEMA Net, and validates its effectiveness on multiple datasets. Results show that this model achieves a good balance between model complexity and classification performance by replacing the Transformer architecture with an efficient multi-scale attention module and convolutional enhancement design. Compared to traditional models, CEMA Net significantly reduces the number of parameters while maintaining high accuracy, making it suitable for resource-constrained scenarios.

[0161] In terms of performance, CEMA Net achieves competitive or even superior results on both cross-platform and publicly available datasets. Particularly on the Cross Platform Android and Cross Platform iOS datasets, the model achieves F1 scores of 97.20% and 96.92%, respectively, with a significantly fewer parameter count than ResNet101. Similar trends are observed on the ISCXVPN2016 and USTCTFC2016 datasets, with F1 scores of 97.48% and 99.53%, respectively. These results demonstrate that the proposed architecture exhibits good generalization ability under different traffic scenarios and data distributions.

[0162] The effectiveness of CEMA Net stems from the complementary nature of its core modules. The EMA mechanism enhances the capture of multi-scale spatial dependencies, while convolutional positional encoding and depthwise separable convolution improve local feature extraction. This combination enables the model to effectively learn global and local patterns in encrypted traffic data.

[0163] In summary, this invention proposes a lightweight model, CEMA Net, which achieves excellent classification performance while significantly reducing computational complexity. This model has only 0.66M parameters, representing only 1.4%, 29.6%, and 33.7% of those of ResNet101, MobileNetV2, and CNN+LSTM, respectively, and maintains highly competitive accuracy on multiple datasets. These results validate the effectiveness of the proposed design in balancing efficiency and performance.

[0164] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention, characterized in that, Including the following steps: S1: Preprocess the raw encrypted traffic data and convert it into a two-dimensional grayscale image; S2: Construct a CEMA-Net encrypted traffic classification network, which includes: a feature mapping layer for converting a two-dimensional grayscale image into a one-dimensional sequence; a backbone network based on convolutional positional encoding and efficient multi-scale attention for extracting traffic features hierarchically using the one-dimensional sequence as input; and a classification output layer for mapping the traffic features into traffic categories. S3: Input the two-dimensional grayscale image obtained in step S1 into the pre-trained CEMA-Net encrypted traffic classification network to obtain the classification result of encrypted traffic.

2. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 1, characterized in that, Data preprocessing is performed on the raw encrypted traffic data, specifically including: S11. Divide the original network traffic into multiple network flows according to the standard five-tuple, wherein the five-tuple includes source IP address, destination IP address, source port, destination port and protocol type; S12. Delete duplicate data packets, empty data packets, and information that is not related to traffic classification; S13. Extract fixed-size byte segments starting from the initial bytes of the packet header. The fixed-size byte segments include the header and payload. Form a unified one-dimensional byte sequence from the multiple fixed-size byte segments extracted from each network flow according to the order of the data packets. S14. Normalize each byte value in the one-dimensional byte sequence; S15. Reshape the normalized one-dimensional byte sequence into a two-dimensional grayscale image.

3. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 1 or 2, characterized in that, The feature mapping layer sequentially transforms the two-dimensional grayscale image into one-dimensional sequence features through a first 2D convolutional layer, a second 2D convolutional layer, a Flatten layer, and a first linear layer.

4. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 3, characterized in that, The backbone network based on convolutional positional encoding and efficient multi-scale attention extracts enhanced encrypted traffic sequence features by fusing convolutional positional encoding and efficient multi-scale attention into multiple stacked CEMA modules.

5. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 4, characterized in that, The classification output layer maps the enhanced encrypted traffic sequence features to traffic category probabilities through global average pooling, layer normalization, a second linear layer, and the sofmax function.

6. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 4 or 5, characterized in that, The processing procedures in each CEMA module include: S21. For each CEMA module's input sequence feature X, perform a first one-dimensional convolutional position encoding and then perform a residual connection with the input sequence feature X to obtain the first fused feature. ; S22, regarding the first fusion feature Perform layer normalization to obtain normalized features. ; S23, By normalizing the features After feature splitting, a two-branch feature enhancement operation based on efficient multi-scale attention and gated modulation is performed to obtain the two-branch enhanced features. ; S24, Enhancement features for dual branches After random depth regularization, it is fused with the first feature Perform residual connections to obtain the second fusion feature. ; S25. Employ a second one-dimensional convolutional position encoding to process the second fused feature. After processing, it is combined with the second fusion feature Perform residual connections to obtain enhanced features. ; S26. Employ a feedforward network to enhance the features. After performing channel feature transformation and enhancing features Perform residual connections to obtain the enhanced encrypted traffic sequence characteristics output by the CEMA module. .

7. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 6, characterized in that, In step S23, after feature splitting, a dual-branch feature enhancement operation based on efficient multi-scale attention and gated modulation is performed to obtain dual-branch enhanced features. Specifically, it includes: a. The normalized features Perform linear transformation projections separately to obtain the main branch input features. and gated branch features ; b. Apply local contextual convolution to the main branch input features. Perform local feature enhancement to obtain local enhanced features. ; c. The local enhancement features are processed via the EMAAdapter module. Perform multi-scale attention calculations to obtain attention features. ; d. Regarding the gated branch features Nonlinear activation is performed to obtain the gating signal. ; e. Using gating signals Attention features of the output of the EMAAdapter module Element-wise multiplication modulation is performed, and the modulated features are projected back to the original feature space through linear projection to obtain the dual-branch enhanced features. .

8. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 7, characterized in that, In step c, the local enhancement features are processed through the EMAAdapter module. Perform multi-scale attention computation, including: c1. Local enhancement features of the input through reshaping operations Perform a sequence-to-pseudo-2D transformation to obtain a pseudo-2D feature map. ; c2. Regarding the pseudo-two-dimensional feature map We perform horizontal pooling along the width dimension, vertical pooling along the height dimension, and local convolution to obtain horizontal pooling features. Vertical pooling features and local convolution features ; c3. Horizontal pooling features Vertical pooling features and local convolution features After concatenation, a fused feature B is obtained through lightweight mapping. The fused feature B is then reweighted using the Softmax function to obtain new weights. These new weights are then compared with the pseudo-two-dimensional feature map. Element-wise multiplication yields the weighted aggregated features. ; c4. Apply lightweight cross-dimensional interaction functions to the weighted aggregated features. Processing is performed to achieve cross-dimensional interaction in pseudo-two-dimensional space, resulting in refined features. ; c5. Refining features through reshaping operations Perform a pseudo-2D to sequence transformation to obtain attention features. .

9. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 8, characterized in that, The first one-dimensional convolutional position encoding in step S21 and the second one-dimensional convolutional position encoding in step S25 both employ depthwise separable convolution. The local context convolution in step b is implemented using depthwise separable convolution and the SiLU activation function; The nonlinear activation in step d is implemented using the SiLU activation function; The nonlinear activation function in the feedforward network in step S26 is the GELU activation function.

10. The lightweight encrypted traffic classification method based on convolutional positional encoding and efficient multi-scale attention as described in claim 9, characterized in that, The lightweight mapping described in step c3 uses 1×1 pointwise convolution; The lightweight cross-dimensional interaction function in step c4 employs EMA attention.

Images