Encryption traffic classification method and system based on spatio-temporal feature fusion large language model
By using a large language model architecture that integrates spatiotemporal features, the problem of capturing global spatiotemporal dependencies in encrypted traffic classification is solved, and efficient and accurate encrypted traffic classification is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- WUHAN UNIV
- Filing Date
- 2026-06-15
- Publication Date
- 2026-07-14
AI Technical Summary
Existing methods for classifying encrypted traffic struggle to effectively capture global spatiotemporal interaction dependencies when dealing with encrypted traffic. Spatiotemporal feature processing is isolated and shallowly integrated, and directly applying large language models incurs high computational costs, resulting in low classification accuracy and efficiency.
We adopt a large language model architecture based on spatiotemporal feature fusion, extract features through a dual-channel approach of spatial topology and temporal dynamic evolution, and combine a cross-gating fusion mechanism and a hierarchical differential freezing strategy to achieve global semantic alignment and classification.
It improves the accuracy and efficiency of encrypted traffic classification, reduces computational overhead, and can efficiently capture the global spatiotemporal dependencies of complex encrypted traffic, achieving high-precision classification.
Smart Images
Figure CN122394975A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method and system for classifying encrypted traffic based on a spatiotemporal feature fusion large language model. Background Technology
[0002] In the field of network security, while the widespread use of encryption technologies (such as VPNs and Tor) protects user privacy, it is also frequently exploited by cybercriminals to conceal illegal operations. Traditional traffic classification methods (such as Deep Packet Inspection (DPI) and port-based mapping) are gradually becoming ineffective when faced with encrypted traffic and port randomization techniques because they cannot parse the payload content. Therefore, automatically and accurately extracting complex latent feature patterns from encrypted traffic has become a core challenge in current network measurement.
[0003] Existing deep learning-based methods for classifying encrypted traffic (such as those using CNN, RNN, or GNN) have reduced the reliance on manual feature engineering to some extent, but still face the following significant limitations: (1) Limited ability to model global spatiotemporal context: Existing GNNs and attention-based models mainly focus on capturing local dependencies, making it difficult to model global spatiotemporal interaction dependencies in the entire client-server data flow. This makes the model susceptible to local noise and difficult to accurately distinguish highly obfuscated encryption behaviors.
[0004] (2) Spatiotemporal feature processing is isolated and shallowly fused: Current methods usually treat spatial topology and temporal dynamics as independent feature types and combine them through simple vector concatenation. This shallow fusion cannot capture the deep intrinsic interaction between the two modalities and loses the key semantic information in their correlation.
[0005] (3) Large models have computational and alignment bottlenecks when applied directly: Large language models have great potential in long sequence modeling, but applying them directly to the field of network traffic faces extremely high computational overhead. Furthermore, the semantic structures of natural language and network traffic are different, which can easily lead to feature misalignment.
[0006] Therefore, there is an urgent need for a new architecture that can deeply integrate spatiotemporal features and efficiently utilize the global dependency capture capabilities of large language models to address the challenges posed by the lack of global semantic information in the classification of complex encrypted traffic. Summary of the Invention
[0007] This invention provides a method and system for classifying encrypted traffic based on a spatiotemporal feature fusion large language model, which addresses the shortcomings of existing technologies. It decomposes the complex problem of encrypted traffic sequence modeling into two orthogonal perspectives: "spatial topology" and "temporal dynamic evolution," and extracts them jointly. By leveraging the powerful long sequence processing capabilities of the large language model, it completes global semantic alignment and classification, thereby achieving accurate classification of network encryption processes.
[0008] In a first aspect, the present invention provides a method for classifying encrypted traffic based on a spatiotemporal feature fusion large language model, comprising: Obtain raw network traffic data, and derive the payload byte sequence and packet header byte sequence from the raw network traffic data; Spatial feature extraction is performed on the payload byte sequence to obtain a spatial feature vector, and temporal feature extraction is performed on the data packet header byte sequence to obtain a temporal feature vector; Cross-gated spatiotemporal fusion is performed on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature; After superimposing the location encoding of the global spatiotemporal fusion features, the input is fed into the hierarchical differential frozen large language model for forward propagation, and the deep global representation features are output. The deep global representation features are input into a classifier composed of fully connected layers to obtain the encrypted traffic classification results.
[0009] According to the present invention, an encrypted traffic classification method based on a spatiotemporal feature fusion large language model is provided, which obtains raw network traffic data and derives a payload byte sequence and a data packet header byte sequence from the raw network traffic data, including: The raw network traffic data is divided into bidirectional data streams according to timestamps; The underlying protocol fields of the bidirectional data stream are stripped away, and the source IP address and destination IP address are removed to obtain the processed bidirectional data stream; Extract the payload byte sequence and the data packet header byte sequence from the processed bidirectional data stream.
[0010] According to the encryption traffic classification method based on a spatiotemporal feature fusion large language model provided by the present invention, spatial feature extraction is performed on the payload byte sequence to obtain a spatial feature vector, including: The unique payload byte is mapped to a graph node. The co-occurrence probability between payload bytes is evaluated based on the point mutual information rule. The co-occurrence probability is used as the edge weight. A byte-level topology graph is constructed based on the graph node and the edge weight. The byte-level topology graph is input into a multi-layer GraphSAGE graph neural network. Spatial correlation is implicitly learned through neighbor sampling and message aggregation, and spatial feature vectors are generated through mean pooling.
[0011] According to the encryption traffic classification method based on spatiotemporal feature fusion large language model provided by the present invention, the temporal feature vector is obtained by extracting temporal features from the header byte sequence of the data packet, including: The data packet header byte sequence is input into a two-layer bidirectional long short-term memory network. The hidden states of the forward long short-term memory network and the reverse long short-term memory network in the first layer are concatenated and then input into the second layer network for deep abstraction. Through linear layer projection, the temporal feature vector containing the global temporal dynamic evolution context is output.
[0012] According to the present invention, an encrypted traffic classification method based on a spatiotemporal feature fusion large language model performs cross-gated spatiotemporal fusion on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature, including: The spatial feature vector is input into a nonlinear spatial filter and normalized by an activation function to generate a spatial gated vector. The time-series feature vector is input into a nonlinear time filter and normalized by an activation function to generate a time-gated vector. The spatial feature vector is filtered element-by-element using the time-gated vector to obtain the filtered spatial feature vector. The spatial gating vector is used to filter the temporal feature vector element by element to obtain the filtered temporal feature vector. The filtered spatial feature vector and the filtered temporal feature vector are concatenated along the channel dimension to obtain the global spatiotemporal fusion feature.
[0013] According to the present invention, an encrypted traffic classification method based on a spatiotemporal feature fusion large language model is provided. The global spatiotemporal fusion features are superimposed with positional encoding and then input into a hierarchical differential freezing large language model for forward propagation. The output is a deep global representation feature, including: The hierarchical differentiated frozen large language model includes a cascaded M-layer freezing layer and a U-layer fine-tuning layer, wherein the M-layer freezing layer is the general knowledge preservation stage, and the U-layer fine-tuning layer is the task adaptation optimization stage; The global spatiotemporal fusion features are superimposed with position encoding to obtain any layer representation of the feedforward neural network output. In the M-layer frozen layer, after performing layer normalization and multi-head attention calculation on any layer representation after the output of the feedforward neural network, it is added to any layer representation after the output of the feedforward neural network to obtain any intermediate representation of the frozen multi-head attention layer. After performing layer normalization and multi-head attention calculation on any layer, it is added to any intermediate representation of the frozen multi-head attention layer to obtain the next layer representation after the output of the frozen feedforward neural network, which is used as the output representation of the M-layer. In the U-layer fine-tuning layer, after performing layer normalization and multi-head attention calculation on the output representation of the M-layer in sequence, it is added to the output representation of the M-layer to obtain the intermediate representation of any layer of the fine-tuned multi-head attention. After performing layer normalization and multi-head attention calculation in sequence, it is added to the intermediate representation of any layer of the fine-tuned multi-head attention to obtain the next layer representation after the output of any layer of the fine-tuned feedforward neural network, which serves as the deep global representation feature.
[0014] According to the encrypted traffic classification method based on spatiotemporal feature fusion large language model provided by the present invention, the weight matrices of the multi-head attention calculation and the feedforward network calculation in the M-layer frozen layer are both fixed and frozen, and the scaling parameters and translation parameters in the layer normalization calculation are adaptively adjusted. In the multi-head attention module of the U-layer fine-tuning layer, the query projection matrix, key projection matrix, and value projection matrix are in a trainable state, and the global attention weight allocation is adaptively adjusted by the global spatiotemporal fusion feature.
[0015] According to the present invention, an encrypted traffic classification method based on a spatiotemporal feature fusion large language model is provided, wherein the deep global representation features are input into a classifier composed of fully connected layers to obtain encrypted traffic classification results, including: After the deep global representation features are input into the first fully connected layer for linear projection, the modified linear unit activation function is applied sequentially for regularization to obtain the first layer processed features. The features processed by the first layer are input into the second fully connected layer for linear projection to generate classification logical values; The classification logic value is mapped to the probability distribution of each category using a normalized exponential function, the cross-entropy target loss function is calculated, and the trainable parameters in the model are updated using the Adam optimizer through the backpropagation algorithm. Fine-grained classification is performed on multiple datasets to be identified to obtain the encrypted traffic classification results.
[0016] Secondly, the present invention also provides an encrypted traffic classification system based on a spatiotemporal feature fusion large language model, comprising: The preprocessing module is used to acquire raw network traffic data and obtain the payload byte sequence and data packet header byte sequence from the raw network traffic data; The extraction module is used to extract spatial features from the payload byte sequence to obtain a spatial feature vector, and to extract temporal features from the data packet header byte sequence to obtain a temporal feature vector. The fusion module is used to perform cross-gated spatiotemporal fusion on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature; The training module is used to superimpose the location encoding of the global spatiotemporal fusion features and input them into the hierarchical differential frozen large language model for forward propagation, and output deep global representation features. The classification module is used to input the deep global representation features into a classifier composed of fully connected layers to obtain the encrypted traffic classification result.
[0017] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the encrypted traffic classification method based on a spatiotemporal feature fusion large language model as described above.
[0018] The encrypted traffic classification method and system based on a spatiotemporal feature fusion large language model provided by this invention have the following beneficial effects: (1) Innovative dual-channel feature extraction architecture: The traffic feature extraction is decomposed into spatial and temporal dual channels. The spatial channel constructs a byte-level payload graph through point-wise mutual information (PMI) and extracts local topological features using GraphSAGE; the temporal channel accurately captures the global temporal evolution law at the data flow level through a bidirectional long short-term memory network.
[0019] (2) Deep cross-gating fusion mechanism: An innovative cross-gating fusion module was designed. This mechanism achieves mutual filtering and dynamic aggregation of spatial and temporal features by adaptively generating temporal and spatial gating vectors, effectively removing semantic redundancy and forming a highly unified spatiotemporal representation.
[0020] (3) Novel hierarchical differential freezing strategy: To address the problem of high fine-tuning costs for large models, a hierarchical differential freezing LLM is proposed by constructing a hierarchical differential freezing model through deep expansion and selective fine-tuning. This strategy freezes the bottom-level modules to retain the general knowledge of pre-training, while selectively unfreezing the top-level multi-head attention parameters, enabling the model to efficiently and accurately capture the global spatiotemporal dependencies unique to encrypted traffic, achieving the best balance between high accuracy and low computational overhead. Attached Figure Description
[0021] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0022] Figure 1 This is a flowchart illustrating the encrypted traffic classification method based on a spatiotemporal feature fusion large language model provided by the present invention. Figure 2 This is the overall data flow and architecture diagram provided by the present invention; Figure 3 This is a detailed structural diagram of the layered differential freezing strategy of the Transformer Block inside the large model provided by the present invention; Figure 4 This is an experimental diagram of parameter analysis provided by the present invention; Figure 5 This is a schematic diagram of the structure of the encrypted traffic classification system based on a spatiotemporal feature fusion large language model provided by the present invention; Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0024] Example 1 Figure 1 This is a flowchart illustrating the encrypted traffic classification method based on a spatiotemporal feature fusion large language model provided in this embodiment of the invention. Figure 1 As shown, it includes: Step 100: Obtain raw network traffic data, and obtain the payload byte sequence and packet header byte sequence from the raw network traffic data; Step 200: Extract spatial features from the payload byte sequence to obtain a spatial feature vector; extract temporal features from the data packet header byte sequence to obtain a temporal feature vector. Step 300: Perform cross-gated spatiotemporal fusion on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature; Step 400: After overlaying the global spatiotemporal fusion features with positional encoding, input them into the hierarchical differential frozen large language model for forward propagation, and output deep global representation features; Step 500: Input the deep global representation features into a classifier composed of fully connected layers to obtain the encrypted traffic classification result.
[0025] Specifically, this embodiment of the invention constructs a dual-channel architecture to decompose traffic feature extraction into "spatial dimension" and "temporal dimension" for joint modeling: the spatial channel focuses on extracting the local spatial distribution features of encrypted traffic, while the temporal channel is dedicated to capturing the temporal evolution features of long-sequence data streams; further, a cross-gating fusion mechanism is introduced to achieve the alignment and unified representation of spatiotemporal features, and a hierarchical differentiated freezing strategy is adopted to selectively fine-tune the large language model, thereby accurately capturing global spatiotemporal dependencies and achieving efficient representation and accurate classification of complex encrypted traffic patterns.
[0026] Example 2 by Figure 2 The overall data flow and architecture diagram are used to illustrate the specific implementation scheme of the embodiments of the present invention, with the goal of performing end-to-end accurate classification of raw encrypted network traffic data (such as datasets containing VPN tunnels and Tor obfuscated traffic).
[0027] The first step is to preprocess the raw network traffic and construct bidirectional flows: The raw network traffic data is divided into bidirectional data streams based on timestamps. For each data stream, low-level protocol fields such as network layer and data link layer are stripped, and source and destination IP addresses are removed to prevent model overfitting. Subsequently, the payload and header byte sequences of each data stream are extracted, such as... Figure 2 The diagram shows header 1, payload 1, header 2, and payload 2, etc.
[0028] It should be noted that, Figure 2 Examples such as 60 02 45 0a in the payload byte sequence are hexadecimal byte sequences of the original network traffic, while examples such as 45 00 in the packet header byte sequence are usually the standard start bytes of the IPv4 protocol header.
[0029] The second step involves independent extraction of spatiotemporal features from both channels, including a spatial graph encoder module and a temporal sequence encoder module: The spatial graph encoder module replaces traditional pixel-level / byte-level one-dimensional convolution, aiming to capture the complex topological relationships within the payload using a graph structure. First, each unique payload byte is mapped to a graph node, and edge weights are established based on the PMI (Point Mutual Information) rule. ,in For bytes and The probability of simultaneous occurrence within the sliding window. and Bytes and The probability when Connections are established, nodes are mapped to high-dimensional vectors through an embedding layer, and then fed into a multi-layer GraphSAGE network, typically a two-layer GraphSAGE network. In each layer of the network... In the middle, node The update process is modeled as follows: ,in For the first Learnable parameters of the layer This indicates a splicing operation. For parameterized corrected linear unit (PReLU). Represents a node In the The feature embedding vector of the layer, Represents a node In the The feature embedding vector of the layer, Indicates in Layers, nodes The message vector is obtained by averaging the features of all neighboring nodes. This represents the batch normalization operation. It utilizes the PReLU activation function. This enhances the expressive power of the feature space. Finally, the final features from all nodes are integrated and averaged. Here, JKN-like Concat refers to a feature concatenation mechanism similar to Jumping Knowledge Networks (JKNs), outputting a spatial feature vector. .
[0030] The time series encoder module is responsible for handling long-range dependencies in the time dimension of traffic, serializing the traffic packet header information to obtain the time-series data of adjacent moments. The inputs are processed through two Bi-LSTM layers. The hidden states of the first layer's forward and backward LSTM layers are concatenated and then input into the second layer for deeper abstraction. Finally, through projection onto a linear layer, the output is a temporal feature vector containing the global temporal evolution context. .
[0031] The third step is cross-gated spatiotemporal feature fusion: To address the semantic isolation problem caused by simple spatiotemporal feature concatenation, this module introduces a cross-node information filtering mechanism to filter the extracted spatial feature vectors. and time series feature vectors The inputs are fed into filters that incorporate nonlinear transformations to generate adaptive spatial gating vectors. and time-gated vector . use right Perform element-by-element filtering and screening, using right Element-by-element filtering is performed. Finally, the two sets of filtered features are concatenated along the channel dimension to form a unified global spatiotemporal fusion feature. Specifically, this includes: nonlinear filters with independent parameters. as well as Process the spatiotemporal vectors separately, where This refers to the learnable weight matrices of the first and second linear layers in temporal feature processing. For spatial dimensions, In terms of time dimension, Represents the real number field. This indicates the transpose operation. In spatial feature processing, the learnable weight matrices of the first and second linear layers are used to perform dimensionality changes and feature reorganization on the input features. These are the learnable bias vectors for the first and second linear layers in temporal feature processing. These are the learnable bias vectors for the first and second linear layers in spatial feature processing, used to adjust the offset of the feature distribution. After normalization by the Sigmoid function, the temporal gating vector is obtained. and spatial gating vector , Used to measure the importance of information related to temporal dynamics in spatial features. Used to measure the importance of information related to spatial structure in temporal features. and These represent the outputs of the temporal and spatial feature vectors after passing through independent nonlinear filters (including linear transformations and PReLU activation functions), respectively. These are intermediate features before Sigmoid normalization. and These represent the features input to their respective filters, where Representing temporal characteristics, Represents spatial characteristics.
[0032] Then, cross-information migration is performed: as well as , and These refer to the original spatial feature vector and the temporal feature vector, respectively. Indicates that it has undergone timing gating The spatial features, after element-by-element filtering, retain structural information that matches the temporal dynamics within the spatial features. Indicates that it has passed through spatial gating. The element-wise filtered temporal features retain dynamic information that matches the spatial structure. This operation simulates the alignment and fusion of the attention mechanism, removing redundant noise and... and After splicing, a high-discrimination global spatiotemporal fusion feature is obtained. .
[0033] Step 4: LLM feature mapping based on a hierarchical differential freezing strategy: A Hierarchically Differentiated Frozen Large Language Model (HDF LLM) module is employed, built upon a pre-trained GPT-2 architecture. Given that encrypted network traffic is inherently sequential data with temporal logic and long-range dependencies, the autoregressive decoder architecture of GPT-2, through its unidirectional self-attention mechanism, naturally and efficiently adapts to the long-sequence evolutionary characteristics of traffic data, which extrapolate from the past to the future. Compared to traditional networks, this architecture effectively overcomes the modeling bottleneck of typical long-range dependencies, significantly enhancing the model's ability to map and recognize global features of hidden and complex encryption patterns. Specifically, the forward propagation of this model consists of the following two cascaded stages: Fusion features After overlaying the positional encoding, input to the containing The layered differentiation freezes the large language model for forward propagation, i.e. Figure 2 The Transformer module in , here and The value is usually 3, in the Transformer module. The specific structure is as follows Figure 3 As shown.
[0034] The first M layers (frozen layers): for the input ( Figure 3 The input is the first layer. The value is 1, that is (The plus sign in the circle represents an addition operation), its multi-head attention calculation and feedforward network computation The weight matrices in the matrix are all fixed, among which The first output after MHA The middle layer indicates, and The first output after FFN Layer and first Layer representation. The model only adaptively adjusts the scaling and translation parameters of the layer normalization (LN). The first M layers, the general knowledge preservation stage, fine-tunes only the layer normalization parameters to adapt to the distribution of traffic data by freezing the multi-head attention (MHA) mechanism and feedforward neural network weights in the Transformer block.
[0035] Post-U layer (fine-tuning layer): In this stage, the Query, Key, and Value projection matrices of the multi-head attention module are set to a trainable state, allowing the network to adjust the input from the cross-gated fusion module. Features adaptively adjust the global attention weight allocation to achieve deep complementarity and alignment between pre-trained knowledge and specific network measurement tasks. In the post-U layer, the task adaptation optimization stage, the parameters of MHA are fine-tuned and updated by unfreezing them, so that they focus on capturing the global spatiotemporal correlation of network traffic; while the FFN module remains frozen to ensure the generalization of feature transformation.
[0036] Step 5: Downstream traffic classification and parameter optimization: The deep global representation features output by the HDF LLM are input into a classifier composed of fully connected layers, and the classification probability distribution is output using the Softmax function. Cross-entropy loss is calculated, and the trainable parameters in the model are updated using the Adam optimizer via backpropagation, ultimately achieving end-to-end encrypted traffic classification.
[0037] The traffic classification module acts as a bridge in the entire system, converting the latent feature representations extracted from a large language model with a hierarchical differential freezing strategy into explicit network traffic categories. Since the preceding modules have already captured rich spatiotemporal dependencies and global contextual information, the traffic classification module in this embodiment can make effective decisions using a lightweight classifier. Specifically, this module contains a classification head consisting of two fully connected layers. Specifically, it comprises the following steps: Feature input: The classification module receives global feature representations from the output of the preceding large language model. As input data.
[0038] The first stage involves feature mapping and regularization: mapping the input features... Linear projection is performed through the first fully connected layer. After this projection operation, the ReLU activation function and Dropout operation are applied sequentially to ensure the non-linearity of feature representation and effectively alleviate overfitting during model training.
[0039] Second-stage classification prediction: The features processed in the first stage then enter the second fully connected layer for a second projection, thereby generating logical values for classification.
[0040] Probability distribution mapping and loss calculation: Finally, the module uses the Softmax function to map the generated logical values to the probability distributions of each category and calculates the cross-entropy target loss function.
[0041] Traffic classification results: Finally, fine-grained classification was performed on three main datasets, such as ISCX-VPN, ISCX-Tor, and USTC-TFC2016.
[0042] Based on the above embodiments, in order to verify the effectiveness and advancement of the encrypted traffic classification method based on spatiotemporal feature fusion large language model proposed in this embodiment, comprehensive experiments were conducted on multiple public datasets, and comparative analysis was performed with various existing mainstream methods.
[0043] 1. Experimental Environment and Parameter Settings Hardware environment: The experiment in this embodiment was conducted on a server configured with an Intel Xeon Platinum 8358P CPU (2.60GHz) and an NVIDIA RTX 3090 GPU (24 GB VRAM).
[0044] Software environment: The operating system is based on Linux system Ubuntu 18.04, and the deep learning framework is PyTorch.
[0045] Parameter configuration: During the traffic graph construction phase, a maximum of 30 packets are captured per sample, the maximum byte length of the load portion is set to 150, and the maximum length of the header portion is set to 40. The default window size of PMI is set to 5.
[0046] Model training: The Adam optimization algorithm was used for training, with a maximum of 120 epochs. The initial learning rate was set to 0.01, decaying to 0.0001 in the last epoch. The batch size was set to 512, the warm-up ratio to 0.1, and Dropout to 0.2. All experimental results are the average of 10 independent runs.
[0047] 2. Experimental Dataset This invention uses three publicly available benchmark datasets for verification, including: USTC-TFC2016: Includes 10 types of normal service traffic and 10 types of malicious traffic, used to evaluate the model's performance under normal network usage and complex attack scenarios.
[0048] ISCX VPN-nonVPN: Includes highly obfuscated VPN traffic as well as non-VPN traffic in a regular network environment, used to test the model's ability to identify encrypted tunnels.
[0049] ISCX Tor-nonTor: Covers 8 activity types, comparing highly obfuscated Tor traffic with regular non-tunnel traffic.
[0050] 3. Comparative Experiment This invention is compared with existing traditional machine learning methods (such as AppScanner, FlowPrint, CUMUL), deep learning methods (such as FlowPic, FS-Net, DeepPacket, GraphDApp, TFE-GNN), and pre-trained methods (such as ET-BERT). The specific comparative experimental results are shown in Table 1.
[0051] Table 1 Comparative Experimental Results
[0052] The comparative experimental results are analyzed as follows: Overall classification accuracy is leading: The model of this invention achieved state-of-the-art performance on all evaluated datasets. On the ISCX-VPN and ISCX-nonVPN datasets, the accuracy of this invention reached 96.34% and 95.53%, respectively, with F1 scores of 96.34% and 95.41%, respectively. On the USTC-TFC2016 dataset, the accuracy of this invention reached as high as 99.05%.
[0053] Capability against strong encryption and obfuscation: Compared to the high-performance pre-trained benchmark model ET-BERT, this invention improves accuracy and F1 score by 2.02% and 2.71%, respectively, on the ISCX-VPN2016 dataset. On the highly obfuscated ISCX-Tor dataset, the accuracy and F1 score of this invention reach 93.63% and 93.27%, respectively, significantly outperforming the TFE-GNN method.
[0054] Overcoming the limitations of existing graph neural networks: Unlike heuristic-dependent GraphDApp and TFE-GNN which lacks topology specificity, this invention deeply integrates the spatiotemporal dimensions through byte-level load graphs and cross-gated fusion mechanisms, thereby achieving more discriminative raw traffic encoding.
[0055] 4. Ablation test To demonstrate the indispensability of each module in this invention, ablation experiments were conducted in this embodiment, and the specific experimental results are shown in Table 2. The experimental results show that the large language model is extremely necessary. After removing the LLM module, the model performance experienced a precipitous drop, which fully demonstrates that the LLM plays a decisive role in learning complex global dependencies from network traffic and capturing long sequence patterns. Simultaneously, spatiotemporal feature fusion is equally indispensable. Removing the cross-gated fusion module, or simply removing the spatial encoder or temporal encoder, leads to a significant decrease in the model's classification accuracy. This strongly proves that the cross-gated fusion mechanism designed in this invention plays an irreplaceable key role in filtering and synthesizing key spatiotemporal information and enhancing feature representation.
[0056] Table 2 Ablation Experiment Results
[0057] 5. Parameter Analysis Experiment like Figure 4 As shown in the parameter analysis experiment results, this embodiment focuses on the impact of the number of trainable attention layers U on the model performance. The experimental results show that when U is set to 1, the model achieves the best level in all evaluation indicators on the ISCX-VPN and ISCX-nonVPN datasets. This fully demonstrates that the hierarchical differential freezing strategy adopted in this invention has successfully achieved the best balance between computational complexity and classification performance.
[0058] As can be seen from the above embodiments, the present invention, through innovative dual-channel spatiotemporal feature extraction and cross-gating fusion mechanism, combined with a novel hierarchical differentiated freezing large language model strategy, can effectively capture complex global spatiotemporal dependencies in encrypted data stream interactions, and accurately achieve efficient representation and high-precision classification of complex encrypted traffic patterns.
[0059] Example 3 The encrypted traffic classification system based on spatiotemporal feature fusion large language model provided by the present invention is described below. The encrypted traffic classification system based on spatiotemporal feature fusion large language model described below can be referred to in correspondence with the encrypted traffic classification method based on spatiotemporal feature fusion large language model described above.
[0060] Figure 5This is a schematic diagram of the structure of the encrypted traffic classification system based on a spatiotemporal feature fusion large language model provided in an embodiment of the present invention, as shown below. Figure 5 As shown, it includes: a preprocessing module 51, an extraction module 52, a fusion module 53, a training module 54, and a classification module 55, wherein: The preprocessing module 51 is used to acquire raw network traffic data, and obtain the payload byte sequence and the packet header byte sequence from the raw network traffic data; the extraction module 52 is used to extract spatial features from the payload byte sequence to obtain a spatial feature vector, and extract temporal features from the packet header byte sequence to obtain a temporal feature vector; the fusion module 53 is used to perform cross-gated spatiotemporal fusion on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature; the training module 54 is used to superimpose the position encoding of the global spatiotemporal fusion feature and input it into a hierarchical differential frozen large language model for forward propagation, and output a deep global representation feature; the classification module 55 is used to input the deep global representation feature into a classifier composed of fully connected layers to obtain the encrypted traffic classification result.
[0061] Example 4 Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute an encrypted traffic classification method based on a spatiotemporal feature fusion large language model. This method includes: acquiring raw network traffic data; obtaining a payload byte sequence and a packet header byte sequence from the raw network traffic data; extracting spatial features from the payload byte sequence to obtain a spatial feature vector; extracting temporal features from the packet header byte sequence to obtain a temporal feature vector; performing cross-gated spatiotemporal fusion on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature; superimposing the global spatiotemporal fusion feature with position encoding, and inputting it into a hierarchical differential freezing large language model for forward propagation to output a deep global representation feature; and inputting the deep global representation feature into a classifier composed of fully connected layers to obtain the encrypted traffic classification result.
[0062] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0063] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0064] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for classifying encrypted traffic based on a large language model fusion of spatiotemporal features, characterized in that, include: Obtain raw network traffic data, and derive the payload byte sequence and packet header byte sequence from the raw network traffic data; Spatial feature extraction is performed on the payload byte sequence to obtain a spatial feature vector, and temporal feature extraction is performed on the data packet header byte sequence to obtain a temporal feature vector; Cross-gated spatiotemporal fusion is performed on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature; After superimposing the location encoding of the global spatiotemporal fusion features, the input is fed into the hierarchical differential frozen large language model for forward propagation, and the deep global representation features are output. The deep global representation features are input into a classifier composed of fully connected layers to obtain the encrypted traffic classification results.
2. The encrypted traffic classification method based on a spatiotemporal feature fusion large language model according to claim 1, characterized in that, Obtain raw network traffic data, and derive the payload byte sequence and packet header byte sequence from the raw network traffic data, including: The raw network traffic data is divided into bidirectional data streams according to timestamps; The underlying protocol fields of the bidirectional data stream are stripped away, and the source IP address and destination IP address are removed to obtain the processed bidirectional data stream; Extract the payload byte sequence and the data packet header byte sequence from the processed bidirectional data stream.
3. The encrypted traffic classification method based on a spatiotemporal feature fusion large language model according to claim 1, characterized in that, Spatial feature extraction is performed on the payload byte sequence to obtain a spatial feature vector, including: The unique payload byte is mapped to a graph node. The co-occurrence probability between payload bytes is evaluated based on the point mutual information rule. The co-occurrence probability is used as the edge weight. A byte-level topology graph is constructed based on the graph node and the edge weight. The byte-level topology graph is input into a multi-layer GraphSAGE graph neural network. Spatial correlation is implicitly learned through neighbor sampling and message aggregation, and spatial feature vectors are generated through mean pooling.
4. The encrypted traffic classification method based on a spatiotemporal feature fusion large language model according to claim 3, characterized in that, Temporal feature extraction is performed on the header byte sequence of the data packet to obtain a temporal feature vector, including: The data packet header byte sequence is input into a two-layer bidirectional long short-term memory network. The hidden states of the forward long short-term memory network and the reverse long short-term memory network in the first layer are concatenated and then input into the second layer network for deep abstraction. Through linear layer projection, the temporal feature vector containing the global temporal dynamic evolution context is output.
5. The encrypted traffic classification method based on a spatiotemporal feature fusion large language model according to claim 1, characterized in that, Cross-gated spatiotemporal fusion is performed on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature, including: The spatial feature vector is input into a nonlinear spatial filter and normalized by an activation function to generate a spatial gated vector. The time-series feature vector is input into a nonlinear time filter and normalized by an activation function to generate a time-gated vector. The spatial feature vector is filtered element-by-element using the time-gated vector to obtain the filtered spatial feature vector. The spatial gating vector is used to filter the temporal feature vector element by element to obtain the filtered temporal feature vector. The filtered spatial feature vector and the filtered temporal feature vector are concatenated along the channel dimension to obtain the global spatiotemporal fusion feature.
6. The encrypted traffic classification method based on a spatiotemporal feature fusion large language model according to claim 1, characterized in that, After overlaying the global spatiotemporal fusion features with positional encoding, the results are input into a hierarchical differential frozen large language model for forward propagation, outputting deep global representation features, including: The hierarchical differentiated frozen large language model includes a cascaded M-layer freezing layer and a U-layer fine-tuning layer, wherein the M-layer freezing layer is the general knowledge preservation stage, and the U-layer fine-tuning layer is the task adaptation optimization stage; The global spatiotemporal fusion features are superimposed with position encoding to obtain any layer representation of the feedforward neural network output. In the M-layer frozen layer, after performing layer normalization and multi-head attention calculation on any layer representation after the output of the feedforward neural network, it is added to any layer representation after the output of the feedforward neural network to obtain any intermediate representation of the frozen multi-head attention layer. After performing layer normalization and multi-head attention calculation on any layer, it is added to any intermediate representation of the frozen multi-head attention layer to obtain the next layer representation after the output of the frozen feedforward neural network, which is used as the output representation of the M-layer. In the U-layer fine-tuning layer, after performing layer normalization and multi-head attention calculation on the output representation of the M-layer in sequence, it is added to the output representation of the M-layer to obtain the intermediate representation of any layer of the fine-tuned multi-head attention. After performing layer normalization and multi-head attention calculation in sequence, it is added to the intermediate representation of any layer of the fine-tuned multi-head attention to obtain the next layer representation after the output of any layer of the fine-tuned feedforward neural network, which serves as the deep global representation feature.
7. The encrypted traffic classification method based on a spatiotemporal feature fusion large language model according to claim 6, characterized in that, The weight matrices for multi-head attention computation and feedforward network computation in the M-layer frozen layer are both fixed and frozen, and the scaling and translation parameters in the layer normalization computation are adaptively adjusted. In the multi-head attention module of the U-layer fine-tuning layer, the query projection matrix, key projection matrix, and value projection matrix are in a trainable state, and the global attention weight allocation is adaptively adjusted by the global spatiotemporal fusion feature.
8. The encrypted traffic classification method based on a spatiotemporal feature fusion large language model according to claim 1, characterized in that, The deep global representation features are input into a classifier composed of fully connected layers to obtain encrypted traffic classification results, including: After the deep global representation features are input into the first fully connected layer for linear projection, the modified linear unit activation function is applied sequentially for regularization to obtain the first layer processed features. The features processed by the first layer are input into the second fully connected layer for linear projection to generate classification logical values; The classification logic value is mapped to the probability distribution of each category using a normalized exponential function, the cross-entropy target loss function is calculated, and the trainable parameters in the model are updated using the Adam optimizer through the backpropagation algorithm. Fine-grained classification is performed on multiple datasets to be identified to obtain the encrypted traffic classification results.
9. An encrypted traffic classification system based on a spatiotemporal feature fusion large language model, characterized in that, include: The preprocessing module is used to acquire raw network traffic data and obtain the payload byte sequence and data packet header byte sequence from the raw network traffic data; The extraction module is used to extract spatial features from the payload byte sequence to obtain a spatial feature vector, and to extract temporal features from the data packet header byte sequence to obtain a temporal feature vector. The fusion module is used to perform cross-gated spatiotemporal fusion on the spatial feature vector and the temporal feature vector to form a global spatiotemporal fusion feature; The training module is used to superimpose the location encoding of the global spatiotemporal fusion features and input them into the hierarchical differential frozen large language model for forward propagation, and output deep global representation features. The classification module is used to input the deep global representation features into a classifier composed of fully connected layers to obtain the encrypted traffic classification result.
10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the encrypted traffic classification method based on a spatiotemporal feature fusion large language model as described in any one of claims 1 to 8.