A dark web traffic classification method based on tree hierarchy similarity contrast learning

Abstract

This invention belongs to the field of traffic identification technology, specifically relating to a dark web traffic classification method based on tree-structured hierarchical similarity contrastive learning, including the following steps: Step S100: Preprocessing the dark web traffic dataset; Step S200: Constructing ternary labels for samples and building a hierarchical semantic tree; Step S300: Generating enhanced samples for the samples, extracting features and mapping them to the contrast space; Step 400: Defining tree distance, defining hierarchical similarity and weighting coefficients based on tree distance; Step 500: Constructing a hierarchical weighted supervised contrastive loss function based on the hierarchical positive sample set and weighting coefficients; Step 600: Integrating three classification heads, calculating the cross-entropy loss function and constructing a multi-task classification joint loss function; Step 700: Constructing a cross-hierarchical consistency loss function through a mapping matrix; Step 800: Constructing a total loss function, training the model, and after training, inputting the samples to be identified into the model and outputting ternary classification results.

Description

Technical Field

[0001] This invention belongs to the field of traffic identification technology, specifically relating to a dark web traffic classification method based on tree-structured hierarchical similarity comparison learning. Background Technology

[0002] With the rapid development of network anonymization, virtual private networks (VPNs), and encrypted communication technologies, communication traffic via Tor, VPNs, and other similar methods has become widespread on the open internet. While protecting user communication privacy, this type of traffic also significantly increases the technical difficulty of network traffic analysis and malicious behavior detection. Accurate identification of dark web and light web traffic is a core and critical issue in network threat detection, data supervision, behavior auditing, and anonymous communication analysis.

[0003] Existing network traffic classification methods are mainly divided into two categories: traditional machine learning methods and deep learning methods. Traditional machine learning methods rely on manually designed statistical features, which are simple to implement but have weak generalization ability. Deep learning-based methods can automatically learn traffic representation features; however, existing solutions mostly adopt a single-layer label supervision mode, such as using only binary labels for dark web / clear web, four-class labels for Tor / VPN / NoTor / NoVPN, or only labels for specific business types for model training. These methods assume that all positive samples have the same similarity and all negative samples have the same degree of repulsion, failing to explicitly utilize the hierarchical prior relationships that naturally exist between traffic categories.

[0004] Contrastive learning has become an important method in the field of representation learning in recent years. Methods such as SimCLR use different augmented views of the same sample as positive sample pairs, falling under the category of unsupervised contrastive learning. Supervised Contrastive Learning (SupCon) builds upon unsupervised contrastive learning by further utilizing label information, treating similar samples as positive sample pairs and dissimilar samples as negative sample pairs. While the standard SupCon method is suitable for planar, single-layer label scenarios, modeling traffic data with hierarchical relationships using only binary judgments of "same type / dissimilar type" can lead to insufficient semantic representation. For example, samples within the same eight-category business, samples within the same four-category but different business, and samples within the same two-category but different four-category are not semantically equivalent and should not be forced to have identical similarity relationships in the representation space.

[0005] Therefore, there is an urgent need to propose a supervised contrastive learning method that explicitly utilizes hierarchical label trees for dark web traffic data. This method would enable the model to learn coarse-grained dark web / plain web discrimination information, as well as medium-grained VPN / Tor / NoVPN / NoTor category differences, and at the same time grasp fine-grained business type differences, thereby comprehensively improving the accuracy, robustness, and generalization ability of dark web traffic identification. Summary of the Invention

[0006] The purpose of this invention is to provide a dark web traffic classification method based on tree-structured hierarchical similarity comparison learning, in order to solve the problems existing in the background technology.

[0007] To achieve the above-mentioned technical objectives, the technical solution adopted by the present invention is as follows: A method for classifying dark web traffic based on tree-structured hierarchical similarity comparison learning includes the following steps: Step S100: Preprocess the dark web traffic dataset; Step S200: Construct ternary labels for each sample, including binary, quadrilateral, and octet classifications, and build a hierarchical semantic tree; Step S300: Perform data augmentation on each sample to generate two augmented samples. After extracting features through a shared encoder, these samples are mapped to the contrast space and normalized. Step 400: Define the tree distance of sample pairs, define hierarchical similarity based on the tree distance, and define the weighting coefficient; Step 500: Based on the hierarchical positive sample set and the weighting coefficients, construct a hierarchical weighted supervised contrastive loss function; Step 600: Connect three classification heads to the output of the shared encoder, calculate the cross-entropy loss function of each classification head, and construct the joint loss function for multi-task classification. Step 700: Construct a cross-level consistency loss function using the mapping matrix; Step 800: Integrate the above loss functions to construct the total loss function, use a two-stage training strategy to train the model, and after the model training is completed, input the sample to be identified into the model and output the ternary classification result.

[0008] As a further limitation of the technical solution of the present invention, step S300 specifically includes: Step S310: Process the sample Two augmented samples are generated by a random augmentation function, which includes one or more of feature perturbation, feature masking, and noise injection. Step S320: Input the enhanced sample into the shared encoder to extract the feature vector; Step S330: Map the feature vector to the contrast space vector using the projection head; Step S340: Compare the space vectors Perform L2 normalization.

[0009] As a further limitation of the technical solution of the present invention, step S500 specifically includes: Step S510: Calculate the cosine similarity of the sample pairs in the comparison space; Step S520: Define the hierarchical positive sample set, which includes samples of the same eight categories, samples of the same four categories but different eight categories, and samples of the same two categories but different four categories; Step S530: Based on the samples as anchors, introduce weighting coefficients to construct a hierarchical weighted supervised contrastive loss function; Step S540: Based on hierarchical weighted supervised contrastive loss function The overall hierarchical weighted supervised contrastive loss function is obtained.

[0010] As a further limitation of the technical solution of the present invention, step S600 specifically includes: Step S610: Connect three classification heads to the output of the shared encoder, each corresponding to a classification task of different granularities; Step S620: Calculate the cross-entropy loss function for each of the classification heads; Step S630: Construct the joint loss function for multi-task classification.

[0011] As a further limitation of the technical solution of the present invention, step S700 specifically includes: Step S710: Define the mapping matrix from eight categories to four categories and the mapping matrix from four categories to two categories; Step S720: Backtrack the coarse-grained prediction distribution using the fine-grained prediction results; Step S730: Construct a cross-level consistency loss function using KL divergence to constrain the consistency between the backtracking distribution and the model's direct output distribution.

[0012] As a further limitation of the technical solution of the present invention, the two-stage training strategy in step S800 is specifically as follows: Phase 1: Contrastive pre-training. Contrastive pre-training is performed using only the overall hierarchical weighted supervised contrastive loss function, enabling the model to learn a representation space that conforms to the tree-like hierarchical label relationship. The second stage is joint optimization training, which uses the total loss function for joint optimization to improve the recognition performance of multi-granularity classification tasks.

[0013] As a further limitation of the technical solution of the present invention, the two-class header is used for the classification and identification of dark web / light web, the four-class header is used for the classification and identification of VPN / Tor / NoVPN / NoTor, and the eight-class header is used for the classification and identification of eight major service types.

[0014] Compared with the prior art, the technical solution of the present invention has the following advantages: 1. This invention uses tree-like hierarchical similarity modeling to enable sample representation learning to break through the limitations of single-layer label division, fully explore the hierarchical semantic information between dark web / light web traffic, between different communication environments, and between various service types, and improve the effectiveness of representation learning.

[0015] 2. The hierarchical weighted supervised contrastive learning method proposed in this invention not only retains the core advantages of supervised contrastive learning such as intra-class aggregation and inter-class separation, but also distinguishes positive sample relationships of different strengths through hierarchical weights, significantly improving the model's ability to organize the representation space.

[0016] 3. This invention constructs a multi-task joint training framework consisting of binary, quadri-class, and octa-class heads, and introduces cross-level consistency constraints to effectively reduce logical conflicts between prediction results of different granularities and ensure the rationality of classification results.

[0017] 4. This invention is applicable to dark web traffic identification, VPN traffic identification, Tor traffic identification, and multi-service type traffic classification. It has strong applicability and application value in practical engineering scenarios such as category imbalance and complex communication environments. Attached Figure Description

[0018] The present invention can be further illustrated by the non-limiting embodiments given in the accompanying drawings.

[0019] Figure 1 This is a schematic diagram of the overall process of the present invention; Figure 2 This is a schematic diagram of the tree-like hierarchical label structure of two-category, four-category, and eight-category classifications in this invention; Figure 3 This is a schematic diagram of the hierarchical weighted supervised contrastive learning network framework used in this invention; Figure 4 This is a schematic diagram illustrating the composition of the total loss function of this invention; Figure 5 This is a schematic diagram of the two-stage training and online inference process of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solution of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0021] Example (This example is based on the CIC-Darknet2020 dark web traffic dataset and strictly follows the 8 steps of this invention. All parameter settings meet the actual experimental requirements): Please refer to the details. Figures 1 to 5 The method for classifying dark web traffic based on tree-structured hierarchical similarity comparison learning, as shown, includes the following steps: Step S100: Preprocess the dark web traffic dataset; Taking the CIC-Darknet2020 dark web traffic dataset as an example, the following preprocessing steps are performed on the network traffic data: (1) Field filtering: Remove identifier fields such as FlowID (traffic identifier), SrcIP (source IP address), DstIP (destination IP address), and Timestamp (time stamp) that have no actual classification significance, retain numerical features that reflect traffic statistics behavior, and finally filter out 42 effective features, including core traffic features such as average packet length, number of packets, total number of bytes, transmission rate, and connection duration, to ensure that the features have strong classification differentiation.

[0022] (2) Label standardization: Synonymous and heterogeneous labels in the dataset are merged and mapped to unified category names. Combined with the characteristics of the dataset, the standardization is clear: In the binary category label, 0 represents open network traffic and 1 represents dark network traffic; in the four category label, 0 represents VPN, 1 represents Tor, 2 represents NoVPN, and 3 represents NoTor; in the eight category label, 0 represents Audio, 1 represents Video, 2 represents VoIP, 3 represents Chat, 4 represents Mail, 5 represents P2P, 6 represents File-Transfer, and 7 represents Browsing, to ensure that the label semantics are unified and unambiguous.

[0023] (3) Missing value handling: Through the statistical analysis of the dataset, it was found that the "average length of data packets" and "connection duration" fields of some traffic samples had missing values, with a missing rate of about 3.2%. The median imputation method was used to fill in the missing values ​​to avoid the missing values ​​interfering with the model training. For infinite value samples, the median of the corresponding feature was also used for replacement.

[0024] (4) Outlier handling: The quantile pruning method is used to handle extreme outliers. For each numerical feature, the 25th quantile (Q1) and 75th quantile (Q3) are calculated. The outlier threshold is set as [Q1-1.5×IQR, Q3+1.5×IQR] (IQR is the interquartile range, i.e. Q3-Q1). Extreme values ​​exceeding this threshold are pruned to the threshold boundary to reduce the impact of outlier samples on model training.

[0025] (5) Standardization: Z-score standardization is performed on all the selected 42-dimensional numerical features to eliminate the dimensional differences between different features. The standardization formula is: ,in The mean of this feature. The standard deviation of this feature is denoted as σ. After standardization, the mean of all features is 0 and the standard deviation is 1, ensuring that the weights of each feature are balanced during model training.

[0026] Step S200: For each sample Construct ternary labels that include binary, quadrilateral, and octet classifications. And construct a hierarchical semantic tree; The ternary label Represented as ; in, This indicates a binary category label, where 0 represents open web traffic and 1 represents dark web traffic; The four categories are represented by labels: 0 for VPN, 1 for Tor, 2 for NoVPN, and 3 for NoTor. The tags represent eight categories: 0 for Audio, 1 for Video, 2 for VoIP, 3 for Chat, 4 for Mail, 5 for P2P, 6 for File-Transfer, and 7 for Browsing. The hierarchical semantic tree is represented as follows: The hierarchical mapping relationship is as follows: This hierarchical mapping relationship reflects the layer-by-layer mapping of samples from fine-grained labels to coarse-grained labels; Based on the dataset labels preprocessed in step S100 above, construct ternary labels for each traffic sample in the CIC-Darknet2020 dataset. And construct a tree-like hierarchical semantic tree The hierarchical mapping relationship is as follows: Specific examples are as follows: The ternary labels for three typical samples selected from the dataset are constructed as follows: Sample 1: Video service traffic under a VPN environment, labeled as follows: (Dark Web) (VPN) (Video), the ternary tag is represented as ; Sample 2: Audio service traffic under a VPN environment, labeled as follows: (Dark Web) (VPN) (Audio), the ternary tag is represented as ; Sample 3: Browsing traffic in a NoVPN environment, tagged as follows: (Ming.net) (NoVPN) (Browsing), a ternary tag is represented as .

[0027] The mapping relationship of the hierarchical semantic tree is as follows: the eight service types in the eight categories all correspond to the four communication environments in the four categories (such as Audio, Video, VoIP and other services can appear in VPN, Tor, NoVPN and NoTor environments); the four communication environments in the four categories are further mapped to two categories (VPN and Tor are classified as dark web, and NoVPN and NoTor are classified as open web), forming a tree-like hierarchical structure of "fine-grained service type → medium-grained communication environment → coarse-grained network type".

[0028] Step S300: For each sample Two augmented samples are generated by performing data augmentation. After feature extraction by a shared encoder, they are mapped to the contrast space and normalized. This step specifically includes: Step S310: Process the sample Two augmented samples are generated using a random augmentation function, denoted as follows: and ,in and This represents a random augmentation function, which includes one or more of feature perturbation, feature masking, and noise injection. In practical implementation, the enhancement function is selected. The feature masking function is specifically for randomly selecting samples. 5% to 10% of the feature dimensions are set to 0 to simulate partial information loss during traffic feature transmission; an enhancement function is selected. The Gaussian noise perturbation function is specifically applied to the sample. Gaussian noise with a mean of 0 and a standard deviation of 0.01 is added to each feature dimension to simulate noise interference during network transmission. At the same time, the enhancement intensity is controlled within the range that does not change the original semantic label of the sample, ensuring that the enhanced sample can still accurately correspond to its ternary label.

[0029] Step S320: Input the enhanced sample into the shared encoder to extract the feature vector, represented as... ; Step S330: Map the feature vector to the contrast space vector using the projection head, represented as follows: ; In specific implementations of steps S320 and S330, the shared encoder adopts a multilayer perceptron (MLP) structure with hidden layer dimensions of 256, 256, and 128 respectively, and the activation function is ReLU; the projection head adopts a two-layer fully connected structure with an output dimension of 128 and the activation function is ReLU. Taking sample 1 as an example, its original sample is processed by the enhancement function. and After enhancement, the result is and The feature vector is obtained after inputting into the shared encoder. and (Their dimensions are all 128).

[0030] Step S340: Compare the space vectors Perform L2 normalization, and represent as This ensures the stability of subsequent cosine similarity calculations, with the normalized vector having a magnitude of 1. Referring to sample 1, after projection and L2 normalization, the comparison space vector is obtained. and (All of them have a dimension of 128 and a modulus of 1).

[0031] Step 400: Define the tree distance of sample pairs, define hierarchical similarity based on the tree distance, and define the weighting coefficient; In this step, the sample pairs The tree distance is represented as: ; Based on tree distance, hierarchical similarity is represented as follows: ; The weighted coefficients based on tree distance are expressed as follows: ; in, ; This indicates an indicator function that satisfies the condition within the parentheses when true. ,otherwise 0.

[0032] Taking samples 1, 2, and 3 as examples, the tree distance, hierarchical similarity, and weighted weights between each pair are calculated, where the weight coefficients are selected as follows: , , (satisfy ); Thus, based on the ternary labels of Sample 1 The ternary label of sample 2 The ternary label of sample 3 The following results can be obtained: ① Sample 1 and Sample 2 belong to the same four categories but different eight categories. Their tree distance is expressed as: ; Hierarchical similarity ; Weighted weight ; ② Sample 1 and Sample 3 belong to different binary categories, and their tree distance is expressed as: ; Similarly, we can obtain: hierarchical similarity. ; Weighted weight (The distance between the two trees is 3, so they are not considered positive samples, and therefore the weight is calculated to be 0). ③Supplementary Sample 4 (labeled as) (For VoIP services in the Tor environment), it is classified as a binary class but a quadruple class with sample 1. Calculate the modeling results for sample 1 and sample 4: Tree distance ; Hierarchical similarity ; Weighted weight ; ④ Supplementary Sample 5 (labeled as) It belongs to the same eight-class classification as sample 1, and the modeling results are as follows: Tree distance ; Hierarchical similarity ; Weighted weight .

[0033] Step 500: Based on the hierarchical positive sample set and the weighting coefficients, construct a hierarchical weighted supervised contrastive loss function; This step specifically includes: Step S510: Calculate sample pairs The cosine similarity in the comparison space is denoted as... ,in The temperature coefficient is used to adjust the similarity. Step S520: Define the hierarchical positive sample set, including samples of the same eight categories, samples of the same four categories but different eight categories, and samples of the same two categories but different four categories, represented as: For the sample Its hierarchical positive sample set is represented as ; Step S530: Based on samples As anchor points, weighting coefficients are introduced. Construct a hierarchically weighted supervised contrastive loss function, expressed as: ; Step S540: Based on hierarchical weighted supervised contrastive loss function The overall hierarchical weighted supervised contrastive loss function is obtained, expressed as: .

[0034] Based on the aforementioned steps, in specific implementation, the temperature coefficient will be... Batch size (total number of samples) ; ① Perform cosine similarity calculation: Suppose the normalized contrast space vectors of sample 1, sample 2, sample 4, and sample 5 are respectively , , , The calculation yields: ; ; ; ② Positive sample set, the hierarchical positive sample set of sample 1 can be represented as Based on the aforementioned tree distance, it can be known that The tree distance between sample 3 and sample 1 is 3, which does not meet the requirement of being less than 3, so it is excluded. ③ Calculation of hierarchical weighted supervised contrastive loss function: First, the sum of the positive sample weights for sample 1: ; Then calculate the weight percentage for each positive sample: , , ; Assume the sum of the similarity indices of all 256 samples in the batch with sample 1: The following results are obtained: ; ; ; Therefore, the loss with sample 1 as the anchor point is: ; Overall hierarchical weighted supervised comparative loss That is, for the 256 samples in the batch. Take the average value.

[0035] Compared to the traditional SupCon loss function, the SupCon loss function equally weights positive samples, with each weight accounting for 1 / 3, resulting in... In this embodiment, a weighting coefficient is introduced. Differential weighting was applied to positive samples at different semantic levels, strengthening the contribution of samples in the same eight categories (i.e., sample 5) and weakening the contribution of samples in the same two categories (i.e., sample 4), thus constructing a multi-level positive sample structure. Specifically, samples with strong semantic association (same eight categories with a tree distance of 0) are strong positive samples, and samples with weak semantic association (same two categories with a tree distance of 2) are weak positive samples, thereby distinguishing strong positive samples, medium positive samples, and weak positive samples in the multi-level positive sample structure.

[0036] Step 600: Connect three classification heads to the output of the shared encoder, calculate the cross-entropy loss function of each classification head, and construct the joint loss function for multi-task classification. This step is specifically as follows: Step S610: Connect three classification heads to the output of the shared encoder, each corresponding to a classification task of different granularities, as shown below. , , ,in For binary classification heads, It is a four-category head, It is divided into eight categories; Specifically, each of the above classification heads adopts a single-layer fully connected layer structure, with output dimensions of 2 / 4 / 8 respectively, and the activation function is the Softmax function (binary classification, four-class classification, and eight-class classification). The two-class header is used for classifying and identifying dark web / plain web, the four-class header is used for classifying and identifying VPN / Tor / NoVPN / NoTor, and the eight-class header is used for classifying and identifying eight major service types. The output of each of the classification heads is represented as follows: , , ; Taking sample 1 as an example, its feature representation vector (Dimension 128) After inputting the above classification header, the output predicted probability distribution is as follows: Binary classification head prediction output This corresponds to the open web and the dark web, and the prediction is dark web, which is consistent with the real label. Four-class head prediction output The corresponding labels are VPN, Tor, NoVPN, and NoTor. The prediction is VPN, which is consistent with the actual label. Eight-class head prediction output The data corresponds to eight business types and is predicted as Video, which is consistent with the actual label. Step S620: Calculate the cross-entropy loss function for each of the classification heads, expressed as follows: Binary classification loss function: ; Four-class classification loss function: ; Eight-class loss function: ; In this step, we assume that the true label of sample 1 is , , ,but: The binary classification loss is calculated as follows: ; The four-class classification loss is calculated as follows: ; The eight-class classification loss is calculated as follows: ; Step S630: Construct the joint loss function for multi-task classification, expressed as: ; in, , , Weighting coefficients for each category of loss.

[0037] Specifically, select weighting coefficients. , , The weighting coefficients can be adjusted according to the importance of the classification task. This value is just an example. .

[0038] Step 700: Construct a cross-level consistency loss function using the mapping matrix; This step is specifically as follows: Step S710: Define the following hierarchical mapping matrix; , which is represented as a mapping matrix from eight categories to four categories; , which is represented as a mapping matrix from four categories to two categories; Step S720: Backtrack the coarse-grained prediction distribution using the fine-grained prediction results, as shown below: ; represents the backtracking of the four-category prediction distribution from the eight-category prediction results; ; represents the backtracking of the binary classification prediction distribution from the four-class classification prediction results; The output of the eight-class prediction based on sample 1 For example, let's backtrack the predicted distributions for four-class and two-class classification: The four-category backtracking distribution is as follows: ; The binary classification backtracking distribution is as follows: ; Step S730: Construct a cross-level consistency loss function using KL divergence to constrain the consistency between the backtracking distribution and the model's direct output distribution, expressed as: .

[0039] Based on the above results, we can conclude that: ; ; Then consistency loss ; If a logical conflict occurs in the model prediction (e.g., the eight-class classification prediction result is a VPN environment after hierarchical mapping backtracking, but the two-class classification predicts it as a plain network), the backtracking distribution differs significantly from the direct output distribution, the KL divergence increases, and the consistency loss will generate additional penalties, forcing the model to correct the prediction results.

[0040] Step 800: Integrate the above loss functions to construct the total loss function, use a two-stage training strategy to train the model, and after the model training is completed, input the sample to be identified into the model and output the ternary classification result.

[0041] The total loss function mentioned in this step is expressed as follows: ; In this step, hyperparameters are selected. , In combination with the steps mentioned above , as well as Therefore, the total loss is calculated as follows: ; The two-stage training strategy employed is as follows: Phase 1: Compared to pre-training, only the overall hierarchical weighted supervised contrastive loss function is used. Perform comparative pre-training to enable the model to learn a representation space that conforms to the hierarchical label relationship of a tree; Specifically, this involves training a shared encoder and projector head for 50 epochs, using AdamW as the optimizer, and an initial learning rate of [missing information]. Weight decay The batch size is 256, which aims to allow the model to first learn a representation space that conforms to the hierarchical label relationship of the tree, laying the foundation for subsequent classification tasks. Phase 2: Joint optimization training, using the total loss function. Joint optimization is performed to improve the recognition performance of multi-granularity classification tasks; Specifically, the joint training rounds are 100, and the optimizer and hyperparameters are the same as in the first stage. The goal is to further improve the recognition performance of the three granularity classification tasks. The validation set loss is monitored in real time during training. When the validation set loss does not decrease for 10 consecutive rounds, training is stopped to avoid overfitting.

[0042] Inference phase: After the model training is completed, the projection head is removed, leaving only the shared encoder and three classification heads. No dual-view augmentation is required. The network traffic sample to be identified is directly input (the traffic sample needs to be preprocessed in step 1), and the ternary classification result can be output.

[0043] The following is an example of reasoning in this application: Select a test set sample that was not used in training, preprocess it, and input it into the model to obtain the feature representation vector. After inputting three classifiers, the output is the predicted probability: This means it is predicted to be the dark web. ; That is, it is predicted to be Tor. ; That is, the prediction is Chat. ; Its final output is a ternary classification result. The corresponding "dark web traffic → Tor environment → Chat business" is consistent with the real label of the sample, realizing multi-granularity traffic identification.

[0044] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A method for classifying dark web traffic based on tree-structured hierarchical similarity comparison learning, characterized in that: Includes the following steps: Step S100: Preprocess the dark web traffic dataset; Step S200: For each sample Construct ternary labels that include binary, quadrilateral, and octet classifications. And construct a hierarchical semantic tree; Step S300: For each sample Two augmented samples are generated by performing data augmentation. After feature extraction by a shared encoder, they are mapped to the contrast space and normalized. Step 400: Define the tree distance of sample pairs, define hierarchical similarity based on the tree distance, and define the weighting coefficient; Step 500: Based on the hierarchical positive sample set and the weighting coefficients, construct a hierarchical weighted supervised contrastive loss function; Step 600: Connect three classification heads to the output of the shared encoder, calculate the cross-entropy loss function of each classification head, and construct the multi-task classification joint loss function; Step 700: Construct a cross-level consistency loss function using the mapping matrix; Step 800: Integrate the above loss functions to construct the total loss function, use a two-stage training strategy to train the model, and after the model training is completed, input the sample to be identified into the model and output the ternary classification result.

2. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 1, characterized in that: In step S200 The ternary label Represented as ;in, Indicates a binary category label. This indicates a four-category label. This indicates an eight-category label; The hierarchical semantic tree is represented as follows: The hierarchical mapping relationship is as follows: .

3. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 2, characterized in that: Step S300 specifically includes: Step S310: Process the sample Two augmented samples are generated using a random augmentation function, denoted as follows: and ,in and This represents a random augmentation function, which includes one or more of feature perturbation, feature masking, and noise injection. Step S320: Input the enhanced sample into the shared encoder to extract the feature vector, represented as... ; Step S330: Map the feature vector to the contrast space vector using the projection head, represented as follows: ; Step S340: Compare the space vectors Perform L2 normalization, and represent as .

4. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 3, characterized in that: In step S400 Sample pairs The tree distance is represented as: ； Based on tree distance, hierarchical similarity is represented as follows: ； The weighted coefficients based on tree distance are expressed as follows: ； in, ; This indicates an indicator function that satisfies the condition within the parentheses when true. ,otherwise 0.

5. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 4, characterized in that: Step S500 specifically includes: Step S510: Calculate sample pairs The cosine similarity in the comparison space is denoted as... ,in The temperature coefficient is used to adjust the similarity. Step S520: Define the hierarchical positive sample set, including samples of the same eight categories, samples of the same four categories but different eight categories, and samples of the same two categories but different four categories, represented as: For the sample Its hierarchical positive sample set is represented as ; Step S530: Based on samples As anchor points, weighting coefficients are introduced. Construct a hierarchically weighted supervised contrastive loss function, expressed as: ； Step S540: Based on hierarchical weighted supervised contrastive loss function The overall hierarchical weighted supervised contrastive loss function is obtained, expressed as: 。 6. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 5, characterized in that: Step S600 specifically involves: Step S610: Connect three classification heads to the output of the shared encoder, each corresponding to a classification task of different granularities, as shown below. ,in For binary classification heads, It is a four-category head, It is divided into eight categories; The output of each of the classification heads is represented as follows: , , ; Step S620: Calculate the cross-entropy loss function for each of the classification heads, expressed as follows: Binary classification loss function: ; Four-class classification loss function: ; Eight-class loss function: ; Step S630: Construct the joint loss function for multi-task classification, expressed as: ； in, , , Weighting coefficients for each category of loss.

7. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 6, characterized in that: The specific steps of S700 are as follows: Step S710: Define the following hierarchical mapping matrix; , which is represented as a mapping matrix from eight categories to four categories; , which is represented as a mapping matrix from four categories to two categories; Step S720: Backtrack the coarse-grained prediction distribution using the fine-grained prediction results, as shown below: ; represents the backtracking of the four-category prediction distribution from the eight-category prediction results; ; represents the backtracking of the binary classification prediction distribution from the four-class classification prediction results; Step S730: Construct a cross-level consistency loss function using KL divergence to constrain the consistency between the backtracking distribution and the model's direct output distribution, expressed as: 。 8. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 7, characterized in that: The total loss function in step S800 is expressed as follows: ； in, and These are hyperparameters that adjust the weights of the classification joint loss function and the consistency loss function, respectively.

9. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 8, characterized in that: The two-stage training strategy in step S800 is specifically as follows: Phase 1: Compared to pre-training, only the overall hierarchical weighted supervised contrastive loss function is used. Perform comparative pre-training to enable the model to learn a representation space that conforms to the hierarchical label relationship of a tree; Phase 2: Joint optimization training, using the overall loss function. Joint optimization is performed to improve the recognition performance of multi-granularity classification tasks.

10. The dark web traffic classification method based on tree-structured hierarchical similarity comparison learning according to claim 9, characterized in that: The two-class header is used for classifying and identifying dark web / plain web, the four-class header is used for classifying and identifying VPN / Tor / NoVPN / NoTor, and the eight-class header is used for classifying and identifying eight major service types.

Images