A model-independent network traffic classification robustness enhancement method and system

Abstract

This invention discloses a model-independent method and system for enhancing the robustness of network traffic classification, relating to the fields of network traffic analysis and deep learning. The method includes: loading a pre-trained traffic classification model and constructing multi-domain training and validation data with category and domain labels; subsequently, constructing cross-domain batch data through joint sampling by domain, inputting it into the model to obtain feature representations and classification results; calculating the classification loss and the cross-domain representation distribution difference loss and jointly optimizing them to obtain a single-round model; then applying the model to the validation data, online judgment, and after entering a flat optimization region, weighted fusion to obtain a robust model; outputting the model upon training termination, achieving resistance to distribution shift and high robustness in cross-domain traffic classification. This invention achieves robust enhancement of cross-domain traffic classification through the synergistic effect of domain alignment fine-tuning and stable model fusion, solving the problem of model performance degradation caused by distribution shift.

Description

Technical Field

[0001] This invention relates to the fields of network traffic analysis and deep learning technology, and in particular to a model-independent method and system for enhancing the robustness of network traffic classification. Background Technology

[0002] In recent years, with the widespread adoption of encryption protocols and the rapid development of deep learning technology, deep learning-based Network Traffic Classification (NTC) models have made significant progress in tasks such as encrypted traffic identification, application type identification, and network intrusion detection. They are widely used in core business scenarios such as network service quality assurance, comprehensive security monitoring, and network behavior compliance auditing.

[0003] Leveraging the powerful nonlinear modeling and feature mining capabilities of deep learning, these models can maintain excellent classification and recognition performance in a controlled laboratory environment where training and test data satisfy the independent and identically distributed constraint. However, in complex and ever-changing real-world network scenarios, multiple factors, such as dynamic fluctuations in link transmission paths, continuous iterations of communication protocols, updates to terminal software versions, iterative replacements of encryption suites, changes in traffic collection devices, and the continuous emergence of new network attack methods, can continuously induce traffic data distribution drift. This results in a significant deviation between the feature distribution learned during model training and the actual traffic feature distribution during online deployment, ultimately leading to a substantial decrease in model classification accuracy—a common problem in the industry known as the distribution shift problem.

[0004] To address the performance degradation caused by distribution shift, researchers both domestically and internationally have proposed various robustness enhancement strategies. Among these, model-related optimization methods primarily involve customized modifications or incremental retraining of the network architecture of specific NTC models. These methods improve generalization performance by introducing large language models to mine general feature representations and selecting highly stable traffic graph features. However, these approaches are deeply tied to a single model architecture, resulting in poor versatility and transferability, making them difficult to adapt to multiple mainstream NTC frameworks.

[0005] Model-independent optimization schemes do not require changes to the network structure and have better reusability. Typical examples include Rosetta and MetaTraffic. Rosetta relies on prior knowledge of the TCP protocol and designs heuristic data augmentation strategies for packet length sequences. It can only cover local sequence perturbations induced by the TCP transport layer, and the algorithm input is highly dependent on the packet length sequence. It cannot be compatible with next-generation high-performance NTC models such as NetMamba+ and ET-BERT, which use raw byte streams as input carriers. MetaTraffic introduces a meta-learning training paradigm and relies on multi-task splitting and second-order gradient update mechanisms to enhance cross-scenario generalization. Not only does the overall training cost increase linearly with the number of sub-tasks, resulting in high resource consumption, but the meta-tasks built based on random data partitioning are difficult to replicate the systematic and structural cross-domain distribution shifts in the real environment. The model's generalization effect is highly dependent on the stringent condition that the training dataset pre-includes shift samples.

[0006] In summary, existing mainstream optimization techniques generally suffer from drawbacks such as high architectural coupling, limited input adaptation scenarios, high training computation costs, and insufficient ability to simulate real offsets. These limitations prevent them from effectively improving the drift resistance performance of NTC models in complex deployment scenarios while maintaining model versatility and low training overhead. Therefore, there is an urgent need for a model-independent, multi-input-form adaptive, traffic-robust training scheme. Summary of the Invention

[0007] The main objective of this invention is to provide a model-independent method for enhancing the robustness of network traffic classification.

[0008] Another objective of this invention is to propose a model-independent network traffic classification robustness enhancement system.

[0009] The third objective of this invention is to provide an electronic device.

[0010] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0011] To achieve the above objectives, a first aspect of the present invention proposes a model-independent method for enhancing the robustness of network traffic classification, comprising:

[0012] A pre-trained network traffic classification model is obtained as the initial model, and multi-domain training data and multi-domain validation data with category labels and domain identifiers are obtained. The initial model can output the feature representation before the classification head and the corresponding classification result. Based on multi-domain training data, joint sampling is performed by domain to construct cross-domain batch data, and the cross-domain batch data is input into the initial model to obtain the feature representation and classification results corresponding to each sample in the cross-domain batch data. Based on the feature representation and classification results, the classification loss is calculated in combination with the category label of the sample, and the cross-domain representation distribution difference loss is calculated based on the feature representation after grouping by domain. The classification loss and the cross-domain representation distribution difference loss are jointly optimized to obtain the current round model. The current round model is applied to multi-domain validation data, and the training process is determined to have entered the flat optimization region based on the change in validation loss in consecutive training rounds. When it is determined to have entered the flat optimization region, the current round model in the flat optimization region is weighted and fused online to obtain a robust fusion model. When the training reaches the preset termination condition, the robust fusion model is output as the final deployment model, realizing the anti-distribution offset and highly robust identification of cross-domain network traffic classification.

[0013] Optionally, a pre-trained network traffic classification model is obtained as the initial model, and multi-domain training data and multi-domain validation data with category labels and domain identifiers are obtained, including: A deep learning network traffic classification model with a cascaded encoder and classifier structure was selected as the basic framework. Publicly pre-trained weights were loaded to complete parameter initialization and an initial model was constructed. Configure the feature output port of the initial model to ensure that the initial model stably outputs the feature representation of the classification head and the traffic classification results; Based on the actual distribution offset influencing factors, all training and validation data are divided into multiple independent data domains. Each sample is labeled with a category label and its domain number to obtain the multi-domain training data and the multi-domain validation data.

[0014] Optionally, based on multi-domain training data, joint sampling is performed by domain to construct cross-domain batch data, and the cross-domain batch data is input into the initial model to obtain the feature representation and classification results corresponding to each sample in the cross-domain batch data, including: Based on the domain partitioning rules of multi-domain training data, a fixed number of samples is allocated to each data domain during a single sampling process, and multi-domain samples are extracted synchronously in parallel. Traffic samples extracted from each domain are systematically spliced ​​and integrated, and data formats and input dimensions are unified to form cross-domain batch data with balanced batch dimensions. The integrated cross-domain batch data is completely input into the initialized initial model. The encoder extracts the sample feature representations, synchronously drives the classifier to complete forward inference, and outputs the feature representation vectors and traffic classification results corresponding to all samples in batches.

[0015] Optionally, based on the feature representation and classification results, a classification loss is calculated in conjunction with the sample category labeling, and a cross-domain representation distribution difference loss is calculated based on the feature representation after domain grouping. The classification loss and the cross-domain representation distribution difference loss are jointly optimized to obtain the current round model, including: Based on the true category labels corresponding to the cross-domain batch data, and combined with the classification results output by the model, a label smoothing correction mechanism is introduced to quantify and calculate the model classification error, thereby obtaining the classification loss that constrains the classification accuracy. Based on the predefined domain identifier of the samples, the global feature representation vector is grouped and clustered according to the data domain. The mean vector and covariance matrix of the single-domain feature distribution are solved respectively. The distribution deviation between domains is calculated by matrix distance measurement to obtain the cross-domain representation distribution difference loss. We set weighting coefficients to adjust the loss of cross-domain representation distribution differences, construct a joint optimization total loss function with the classification loss, update the initial model parameters through backpropagation, complete the multi-objective joint optimization, and iteratively generate the current round model corresponding to this round of training.

[0016] Optionally, the current model is applied to multi-domain validation data, and the training process is determined to have entered a flat optimization region based on the change in validation loss over consecutive training rounds, including: Each iteration generates the current round model, which is then sequentially input into the multi-domain validation data. This process completes the forward inference of validation samples in batches, quantitatively calculates the cross-domain validation loss of the model, and records the validation loss value and model parameter information round by round. Two sets of fixed-capacity queues are used to cache the verification loss of consecutive rounds, and the dynamic trend of the verification loss is monitored in real time through a sliding window. When the first queue is full and the validation loss corresponding to the head round of the queue is a local minimum, the training is determined to have entered a flat optimization region. The head round is marked as the starting point of the flat valley, and the corresponding validation loss is recorded as the reference loss. When the second queue is full and all validation losses in that queue are greater than the sum of the reference loss and the adaptive threshold, the training is determined to have left the flat optimization region.

[0017] Optionally, after determining that the model has entered the flat optimization region, online weighted fusion is performed on the current round model within the flat optimization region, including: Using the baseline validation loss of the starting node of the flat optimization region as a reference, an exponential weight mapping function is constructed by introducing a temperature hyperparameter, and the initial fusion weight of each current round model in the interval is calculated in turn. The cumulative weight values ​​of the fusion model are statistically analyzed in real time, and the weights are normalized by combining them with the initial weights of the single model to determine the mixing and fusion ratio of the model parameters in a single round. An incremental iterative update strategy is adopted to progressively add and correct the global fusion parameters according to the fusion ratio, continuously accumulating weight data and updating the robust fusion model parameters.

[0018] Optionally, when training reaches a preset termination condition, the robust fusion model is output as the final deployment model, including: Pre-configure two types of termination constraints: the maximum number of training iterations for the model and the exit threshold for flat regions, and monitor the training process and the fluctuation status of validation loss in real time. When the number of training iterations reaches the set limit, or when the overall validation loss exceeds the adaptive threshold and is determined to have deviated from the flat optimization range, a training termination command is triggered immediately. Stop iterative updates of model parameters and online fusion calculations, solidify the robust fusion model parameters that have completed incremental aggregation, and directly output the final deployment model whose structure is completely consistent with the initial model.

[0019] To achieve the above objectives, a second aspect of the present invention proposes a model-independent network traffic classification robustness enhancement system, comprising: The initial configuration module is used to obtain a pre-trained network traffic classification model as the initial model, and to obtain multi-domain training data and multi-domain validation data with category labels and domain identifiers. The initial model can output the feature representation before the classification head and the corresponding classification result. The cross-domain sampling module is used to perform joint sampling by domain based on multi-domain training data, construct cross-domain batch data, and input the cross-domain batch data into the initial model to obtain the feature representation and classification results corresponding to each sample in the cross-domain batch data. The joint optimization module is used to calculate the classification loss based on the feature representation and classification results, combined with the category label of the sample, and to calculate the cross-domain representation distribution difference loss based on the feature representation after grouping by domain. The classification loss and the cross-domain representation distribution difference loss are jointly optimized to obtain the current round model. The flat fusion module is used to apply the current round model to multi-domain validation data and determine whether the training process has entered the flat optimization region based on the change of validation loss in consecutive training rounds. When it is determined that it has entered the flat optimization region, the current round model in the flat optimization region is weighted and fused online to obtain a robust fusion model. The deployment output module is used to output the robust fusion model as the final deployment model when the training reaches the preset termination condition, so as to realize the anti-distribution offset and high robustness recognition of cross-domain network traffic classification.

[0020] Regarding the system in the above embodiments, the specific ways in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0021] To achieve the above objectives, a third aspect of this application provides an electronic device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code stored in the memory, for implementing a model-independent network traffic classification robustness enhancement method as described in the first aspect embodiment.

[0022] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements a model-independent network traffic classification robustness enhancement method as described in the first aspect embodiment.

[0023] The embodiments of the present invention have the following beneficial effects: 1. Simultaneously enhances adaptability to complex offset scenarios and recognition performance in stable environments. Leveraging a collaborative architecture combining domain alignment fine-tuning with stable model fusion, it effectively mitigates performance degradation caused by network traffic data distribution offsets, significantly improving classification and recognition stability in complex heterogeneous network scenarios compared to traditional optimization methods. Simultaneously, it preserves fundamental recognition capabilities under standard data distribution conditions, avoiding the performance decline issues in normal scenarios that are easily caused by conventional robust optimization methods, achieving bidirectional performance optimization for both application scenarios.

[0024] 2. Wide applicability and no additional modification costs required for deployment. The overall framework adopts a generalized design approach, does not rely on specific network model structure constraints, and is compatible with various mainstream deep learning traffic classification architectures without requiring adjustments or optimizations to the original model's internal structure and inference logic. The optimized model maintains the same form as the original architecture and can directly replace the original business model for use without adjusting online programs and deployment architecture, demonstrating excellent adaptability to practical applications.

[0025] 3. Stable and controllable training workload with significant resource consumption advantages. It eliminates the redundant computational burden of traditional multi-task training and multi-dimensional data augmentation, and does not consume additional computing resources as the number of task divisions or sample perturbation strategies increase. The overall training computation intensity remains consistent with conventional supervised training, and the core functional modules adopt an incremental iterative update mode, maintaining stable memory usage and effectively reducing hardware resource consumption and time costs during model iteration and optimization. Attached Figure Description

[0026] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating a model-independent network traffic classification robustness enhancement method provided in this embodiment of the invention; Figure 2 This is an overall architecture diagram of the network traffic classification robustness enhancement framework provided in the embodiments of the present invention; Figure 3 This is a structural diagram of a model-independent network traffic classification robustness enhancement system provided in an embodiment of the present invention. Detailed Implementation

[0027] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] The following describes, with reference to the accompanying drawings, a model-independent network traffic classification robustness enhancement method and system proposed according to embodiments of the present invention.

[0030] Example 1 This invention provides a model-independent method for enhancing the robustness of network traffic classification. Figure 1 This is a schematic flowchart illustrating a model-independent network traffic classification robustness enhancement method provided in an embodiment of the present invention. Figure 1 As shown, the method includes the following steps: Step S1: Obtain a pre-trained network traffic classification model as the initial model, and obtain multi-domain training data and multi-domain validation data with category labels and domain identifiers, wherein the initial model can output the feature representation before the classification head and the corresponding classification result.

[0031] Combination Figure 2 The overall system architecture shown clearly demonstrates that the training framework built in this application is entirely designed and constructed based on the abstract structure of a generalized deep learning network traffic classification model. The overall logical architecture adopts a basic combination of cascaded encoders and classifiers, resulting in a simple and highly versatile structure compatible with various mainstream traffic recognition models. In the specific implementation of this application's embodiments, the encoder is preferentially selected. With classifier The cascaded deep learning NTC network traffic classification model serves as the core framework. By loading publicly available and mature pre-trained weight parameters from the industry, the initial configuration of the model's basic parameters is completed, thereby quickly building the initial model required for subsequent training and optimization.

[0032] Based on this, the internal output ports of the initial model are specifically adapted and configured to accurately locate the internal structural hierarchy of the model, stably open the feature output channel before the classification head, and ensure that the high-dimensional feature representation vector before the classification head can be continuously and stably output during the model training process. At the same time, the final classification inference result corresponding to the network traffic sample is output synchronously, providing complete feature support for subsequent multi-loss joint calculation and model optimization.

[0033] In this embodiment of the application, the collected raw network traffic samples are uniformly labeled as variables. This type of sample can cover various input formats, including raw byte message sequences, packet length sequences, and traffic statistical feature vectors. When raw traffic samples... Input to encoder After internal feature extraction operations are completed, it can map and generate fixed-dimensional features. The 3D deep feature representation vector, and the calculation formula related to the operation between the two is as follows: , where variables The overall representation represents the deep feature representation extracted by the encoder from a single traffic sample. Fixed dimensions for pre-defined feature vectors, It is the complete network forward computation logic inside the encoder, responsible for completing feature mining and dimensional transformation of the underlying data.

[0034] After the encoder completes feature output, the classifier configured in the backend... It will receive feature vectors in real time. And perform classification reasoning operations, the corresponding operation expression is: In this formula, the variable The probability distribution results of each category in the final output of the classifier can intuitively reflect the confidence level of the current traffic sample belonging to each traffic category. This probability distribution data will be directly used for the quantitative solution of the subsequent classification loss, ensuring the constraint optimization of the model's basic classification ability.

[0035] In addition, considering various distribution offset influencing factors commonly found in complex real-world network scenarios, including protocol differences between different versions of encryption suites, differences in the collection environments of desktop terminals, mobile devices, and IoT devices, and behavioral differences between normal business traffic and various new types of attack traffic, all training and validation data are rationally divided into multiple independent data domains with different distribution characteristics. For each network traffic sample after division, a unified double-labeling process is performed, configuring accurate real business category labels and unique domain number identifiers to strictly distinguish traffic data under different distribution scenarios.

[0036] After standardization, organization, and classification labeling, a complete multi-domain training dataset was finally constructed. With multi-domain validation datasets The multi-domain training dataset can be further subdivided into... Combination forms, symbols This represents the total number of independent training domains obtained during the overall division in this training process. By regularly dividing the multi-domain data, we can fully simulate the distribution offset scenario in the real deployment environment, providing sufficient and diverse data support for subsequent cross-domain joint sampling and cross-domain feature alignment training, and steadily improving the model's generalization and adaptation capabilities in complex and ever-changing scenarios.

[0037] Step S2: Based on the multi-domain training data, perform joint sampling by domain to construct cross-domain batch data, and input the cross-domain batch data into the initial model to obtain the feature representation and classification results corresponding to each sample in the cross-domain batch data.

[0038] Combination Figure 2 As can be seen from the operating logic of the left-side domain alignment fine-tuning module, the core of the training phase of this application embodiment adopts a cross-domain hybrid sampling mechanism to carry out batch data construction. The core design of this mechanism is to ensure that multi-domain data can be fully integrated, so that the model can simultaneously contact traffic samples with different distribution characteristics during the training process, laying the foundation for cross-domain feature alignment from the source.

[0039] In the actual training phase of this application embodiment, the established domain partitioning rules in step S1 are strictly followed to ensure that the sampling process is consistent with the data domain partitioning logic, avoiding problems such as domain confusion and sampling bias. During a single training iteration, an equal number of samples are allocated to each independent data domain. This equal allocation effectively prevents the sample proportion of a certain data domain from becoming too high, causing the model to overfit the distribution characteristics of that domain, thereby affecting cross-domain generalization ability. Based on this sampling rule, the system performs parallel synchronous extraction operations of traffic samples from multiple data domains, significantly improving sampling efficiency and ensuring that each training round can quickly obtain a sample set covering all data domains.

[0040] After sampling, the traffic samples extracted from different domains need to be standardized, followed by ordered splicing and integration. Since samples from different data domains may have inconsistent data formats, varying input sizes, and mismatched feature dimensions, directly inputting them into the model could lead to training anomalies. Therefore, this embodiment specifically adds a sample standardization step to unify the data format, input size, and feature dimensions of all samples, eliminating format differences between domain samples. Through this standardization process, a cross-domain mini-batch data set with balanced batch dimensions and uniform domain sample distribution is finally constructed. This batch data ensures both the reasonable number of samples within the batch and a balanced mixture of samples from multiple domains, providing a standardized data foundation for subsequent cross-domain feature alignment training.

[0041] After constructing the cross-domain mini-batch data, the entire batch of normalized samples is input into the initialized initial model, and computation is performed step by step according to the model's forward propagation logic. First, the data passes through the encoder in the initial model. The encoder completes the deep feature extraction operation. Through its internal network computing logic, it performs low-level feature mining, dimensionality transformation, and feature filtering on each traffic sample, and finally outputs a batch of traffic samples corresponding to each other. 3D feature representation vector The feature vector The ability to accurately characterize the core features of traffic samples is crucial data for subsequent calculations of cross-domain distribution differences.

[0042] Based on this, all feature vectors output by the encoder It will be synchronously passed to the backend classifier Classifier Forward inference is performed based on the received feature vectors. Through internal fully connected layers, activation functions, and other network structures, the high-dimensional feature vectors are mapped to class probability distributions, and the class probability distributions corresponding to all samples are output in batches. This probability distribution It can reflect the confidence level of each sample belonging to each traffic category, providing a direct basis for the subsequent calculation of classification loss.

[0043] To ensure the orderly progress of subsequent dual-loss collaborative optimization, the embodiments of this application obtain feature vectors. With category probability distribution Subsequently, all feature vectors and classification output results are grouped and stored according to the domain number of the samples. This grouping and storage method can clearly distinguish the feature distribution and classification performance of different data domains, which facilitates the accurate calculation of feature distribution differences between different domains in subsequent steps. At the same time, it can also accurately match the classification result and true label of each domain sample, ensuring the accuracy of classification loss calculation. This provides a complete and accurate computational basis for the joint optimization of dual losses in the domain alignment fine-tuning module, and promotes the simultaneous improvement of the model in both classification accuracy and cross-domain robustness.

[0044] Step S3: Based on the feature representation and classification results, calculate the classification loss by combining the category label of the sample, and calculate the cross-domain representation distribution difference loss based on the feature representation after grouping by domain. Jointly optimize the classification loss and the cross-domain representation distribution difference loss to obtain the current round model.

[0045] In this embodiment of the application, in order to simultaneously improve the model classification accuracy and cross-domain robustness, a training optimization mechanism with dual loss joint constraints is specially designed. The two types of losses have clear division of labor and work together to drive the efficient iterative update of model parameters, ensuring that the model can effectively align with the feature distribution of different domains while learning classification capabilities.

[0046] First, we prioritize calculating the classification loss. The core objective is to constrain the model's basic classification capabilities, ensuring that the model can accurately identify different categories of network traffic. In the specific calculation process, we incorporate the true category labels inherent in the cross-domain mini-batch data. (This label is a one-hot hard label, meaning that the label for one category is 1, and the labels for all other categories are 0.) This application introduces a label smoothing coefficient. The original hard labels are optimized to mitigate the overfitting risk and improve the model's generalization ability. The specific formula for label smoothing correction is as follows:

[0047] The specific meanings of each parameter are as follows: This represents a soft label that has undergone smoothing. It is no longer an absolute 0 or 1, but presents a continuous probability distribution, which can weaken the constraint strength of a single hard label. The label smoothing coefficient is a user-defined value, typically ranging from 0 to 1. It can be flexibly adjusted according to the needs of specific training tasks to control the degree of label smoothing. This represents the total number of categories in this network traffic classification task, i.e., the total number of traffic categories the model needs to distinguish. This label smoothing process prevents the model from over-relying on a single label during training, effectively avoiding overfitting to noisy samples in a specific domain and laying the foundation for cross-domain generalization.

[0048] After obtaining the smoothed soft label Then, combine the class probability distribution output by the model in step S2. The label smooth cross-entropy classification loss can then be calculated using the following formula:

[0049] in, This is the overall value of the improved label smoothing cross-entropy loss in this application, used to measure the error gap between the model's traffic classification results and the true labels.

[0050] The core function of this loss function is to quantify the deviation between the model's classification results and the true labels. By backpropagating the classification error back to the model, it precisely constrains the model's basic classification ability, ensuring that the model can correctly distinguish different categories of network traffic. At the same time, it further suppresses the overfitting problem, allowing the model to learn a more generalized classification boundary.

[0051] Secondly, based on the calculation of classification loss, and using the grouping features of each data domain as the core basis, the cross-domain representation distribution difference loss (i.e., representation alignment loss) is solved. This is a key step in achieving cross-domain feature alignment and improving model robustness. Specifically, all feature representation vectors obtained in step S2 are first... The samples are grouped according to their domain numbers, ensuring that feature vectors from the same data domain are grouped together and feature vectors from different data domains are independent. For each group of data domains, the corresponding first-order mean vector is calculated. With the second-order covariance matrix The first-order mean vector The second-order covariance matrix is ​​used to characterize the central location of the feature distribution of this data domain. It is used to characterize the degree of dispersion of the feature distribution of this data domain and the correlation between features.

[0052] The complete formula for calculating alignment loss used in the embodiments of this application is as follows:

[0053] in, The loss is the mean distance between domains. The two types of losses work together to quantify the feature distribution bias between different domains, and are used for inter-domain covariance distance loss.

[0054] Its complete operational logic is as follows: traverse all training domains, and for any two different training domains (denoted as domains)... Heyu , ), calculate the mean vectors of the two respectively. and The Frobenius distance and their covariance matrix and The Frobenius distance is then calculated by summing the mean distance and covariance distance between all pairwise domains, ultimately yielding... and The sum of the two represents the alignment loss. By constraining this loss, the feature distribution differences between different training domains can be explicitly compressed, forcing the encoder to learn invariant features that are independent of specific domains and only related to traffic categories, thereby fundamentally alleviating the model performance degradation problem caused by cross-domain distribution shift.

[0055] Finally, to achieve synergistic optimization of classification loss and representation alignment loss, this application introduces an alignment loss weight coefficient. Establish a unified total loss optimization function, with the corresponding calculation formula as follows: In this formula, These are user-customizable hyperparameters whose values ​​can be flexibly adjusted according to the priority of the training task. Their core function is to balance the weight ratio of classification loss and representation alignment loss, preventing the loss of one task from dominating the entire training process due to the large difference in magnitude between the two types of losses (for example, avoiding the model ignoring cross-domain feature alignment due to excessive classification loss, or the model's classification accuracy decreasing due to excessive alignment loss).

[0056] After obtaining the total loss Then, relying on the backpropagation algorithm, the gradients corresponding to the total loss are sequentially passed to the encoder. With classifier Simultaneously update all learnable parameters of both modules, and achieve simultaneous improvement in model classification accuracy and cross-domain robustness through multi-objective joint optimization. After a complete round of loss calculation and parameter update, iteratively generate the model parameters corresponding to the current training round. It can stably complete the optimization iteration of a single round of the model, providing a high-performance model checkpoint for the online fusion of the subsequent stable model fusion module.

[0057] Step S4: Apply the current round model to the multi-domain validation data, and determine whether the training process has entered the flat optimization region based on the change in validation loss of consecutive training rounds. When it is determined that it has entered the flat optimization region, perform online weighted fusion on the current round model in the flat optimization region to obtain a robust fusion model.

[0058] Combination Figure 2As can be seen from the operational architecture of the stable model fusion module on the right, this functional module runs online synchronously throughout the entire model training process. It relies on four core steps: queue caching storage, dynamic monitoring of validation loss, adaptive weight calculation, and incremental fusion of model parameters. It continuously completes parameter aggregation and optimization for multiple rounds of model checkpoints without the need for additional offline processing, effectively improving the robustness of the model to the distribution shift in the parameter space.

[0059] After each training iteration, the model parameters updated in that iteration will be output. The entire model was then fed into a multi-domain validation dataset. Cross-domain inference tests were conducted, and the corresponding validation loss for this round was calculated using a unified loss function. .in, Representing the After a round of training iterations, the complete learnable parameters of the model include all weights and biases of the encoder and classifier. The cross-domain comprehensive validation loss value can objectively quantify the generalization performance and anti-interference ability of the current model in the face of unseen distributed offset data, and is the core evaluation index for judging the convergence state and stable interval of the model.

[0060] In this embodiment, two independent, fixed-capacity first-in-first-out queues are maintained within the module. One queue is a buffer queue used to detect the starting position of the flat loss valley. And a cache queue used to determine the end boundary of a flat loss valley. The maximum storage capacity of the two queues is determined by manually preset hyperparameters. , Limitations are imposed. During the training process, the validation loss value generated in each iteration and the corresponding model parameters are synchronously written into two queues. Relying on the monitoring logic of the sliding window, the fluctuation pattern of the validation loss in consecutive training rounds is continuously captured, thereby accurately identifying the flat optimization interval in the training trajectory.

[0061] When cache queue When the queue is completely full of data and the validation loss of the training epoch corresponding to the head of the queue is at a local minimum, the model training process can be determined to have officially entered the flat loss valley stage. This critical training node is marked as the starting point of the flat loss valley. The verification loss value corresponding to this starting position is defined as the benchmark reference loss. This application configures an adaptive threshold to complete the interval boundary determination. The calculation formula is:

[0062] in, An adaptive loss fluctuation threshold is used to dynamically define the reasonable loss fluctuation range for flat valleys; This is a tolerance ratio hyperparameter that can be flexibly adjusted according to the task scenario to adapt to the loss fluctuation characteristics of different traffic classification tasks. For queue Fixed capacity; This indicates the summation of multiple consecutive sets of verification loss values, starting from the beginning of the flat valley.

[0063] In the subsequent boundary determination phase, the queue is continuously monitored. The internally stored loss data, once in the queue The queue is full, and all validation loss values ​​recorded in the queue are greater than the benchmark reference loss. With adaptive threshold The sum of the results indicates a significant overall increase in model loss and a marked decrease in generalization performance. This accurately determines that the model training has deviated from the flat optimization region, and it is time to prepare to terminate the fusion process.

[0064] For all model checkpoints selected within the flat loss valley interval, this application employs an exponential decay weighting strategy to complete the differentiated fusion assignment. The formula for calculating the unnormalized weights of a single round of model checkpoints is as follows:

[0065] in, For the first The original unnormalized fusion weights of the wheel model; This is an exponential operation function used to construct nonlinear weight distributions; It is the benchmark loss at the starting point of the flat valley, which serves as the reference benchmark for weight calculation; For the current number The real-time validation loss corresponding to the round model; This is a temperature-adjusting hyperparameter used to control the smoothness of weight distribution. A larger value results in smaller differences in weights among models and a smoother fusion result, while a smaller value will strengthen the weight ratio of low-loss, high-quality models.

[0066] At the same time, the module maintains the cumulative weight scalar in real time. This variable continuously records the sum of the original weights of all models that have been fused within the flat valley interval, ensuring the stable execution of weight normalization calculations. Combining the original weights and cumulative weights of a single model, the parameter fusion ratio of the current model is calculated in real time. The corresponding ratio calculation formula is:

[0067] In the formula, This represents the mixing ratio of the current round model parameters in the global fusion model. Through normalization, it ensures a reasonable and balanced weight distribution for incremental fusion of multiple round models, and avoids a single model parameter from excessively dominating the overall weight distribution.

[0068] After determining the fusion ratio coefficient, perform incremental parameter update calculations. The model fusion iteration formula is as follows:

[0069] in, The parameters of the globally cumulative fusion model are persistently retained throughout the process for real-time iterative updates; The retention coefficients for historical fusion parameters; This represents the weighted component of the model parameters in the current round; the overall parameters of the fusion model are continuously corrected and updated in a progressively superimposed manner.

[0070] The stable model fusion module maintains only a fixed number of state variables and cache queues throughout the process. It does not require batch storage of complete model checkpoints for all training rounds in history. The memory overhead remains constant, and the space complexity is completely decoupled from the total number of training iterations. In a lightweight online fusion manner, it continuously aggregates high-quality model parameters within flat intervals and ultimately iteratively generates a robust fusion model with stronger resistance to distribution shifts and more stable generalization performance, which is fully adaptable to complex and ever-changing real network traffic deployment environments.

[0071] Step S5: When the training reaches the preset termination condition, output the robust fusion model as the final deployment model to achieve anti-distribution offset and high robustness recognition of cross-domain network traffic classification.

[0072] In this embodiment of the application, in order to balance training efficiency and model optimization effect, dual training termination constraints are preset, namely the maximum number of training rounds. Along with the flat loss valley exit mechanism, the two types of constraints complement each other, and monitor the training iteration progress and validation loss fluctuation status in real time throughout the process to ensure that the model achieves the optimal balance between performance and efficiency.

[0073] First, the maximum number of training rounds A preset hard upper bound constraint is used to prevent the training process from continuing indefinitely, which would lead to wasted computational resources and increased risk of overfitting. During the actual training process, the system records the number of training iterations round by round. When the cumulative number of training rounds reaches the preset maximum number of training rounds... Regardless of whether the model is currently in the optimization range, the system will automatically trigger the training termination process to ensure that training is completed within a controllable time and resource cost, avoiding computational power consumption and model performance degradation caused by unlimited iteration.

[0074] Secondly, the flat loss valley exit mechanism is an adaptive soft constraint used to capture the critical point where the model's generalization performance begins to decline, terminating training early and preventing the model from continuously iterating in the overfitting direction. During training, the system relies on the queue caching and loss monitoring logic of the stable model fusion module to continuously track the fluctuations in the validation loss. When the queue... When the storage is full and all validation losses exceed the sum of the reference loss and the adaptive threshold, the system will determine that the model has deviated from the flat optimization range and the generalization performance has declined overall. At this time, the system will immediately issue a training termination command to stop the entire operation process of model parameter iteration update, loss calculation and online fusion, so as to avoid the subsequent low-quality model parameters from interfering with the fusion results.

[0075] Upon triggering the training termination command, the system immediately stops all training-related operations and solidifies the model parameters obtained through incremental fusion throughout the process. This final model is used as the output for deployment. The network structure of this final model is completely consistent with the original NTC model, without introducing any additional structural modifications or computational modules. Therefore, no additional deployment code modifications are required, and it can directly replace the original model to load the application, significantly reducing the engineering implementation cost of the method, while being compatible with various existing traffic classification model deployment environments.

[0076] The model optimized using the complete method described in this application achieves enhanced robustness in two core dimensions: at the feature level, multi-domain feature distribution alignment is achieved through domain alignment fine-tuning, forcing the encoder to learn invariant features that are independent of specific domains but related to traffic categories, thus mitigating the performance fluctuations caused by distribution shifts in different scenarios; at the parameter space level, stable model fusion converges to a flat region with stable low loss, avoiding the model's dependence on a single optimal checkpoint, effectively reducing the risk of model overfitting, and improving the adaptability to subtle distribution differences in the deployment environment.

[0077] Ultimately, the optimized model can effectively cope with various distribution offset scenarios such as differences in encryption suites, different collection devices, and updated attack behaviors in complex and ever-changing network environments. It achieves high-precision and high-stability network traffic classification, significantly improving the practical application adaptability and operational robustness of deep learning traffic classification models, and providing reliable technical support for traffic identification and security protection in real network environments.

[0078] Example 2 This invention provides a model-independent network traffic classification robustness enhancement system. Figure 3 This is a schematic flowchart illustrating a model-independent network traffic classification robustness enhancement system provided in an embodiment of the present invention. Figure 3 As shown, the system includes: The initial configuration module 100 is used to acquire a pre-trained network traffic classification model as an initial model, and to acquire multi-domain training data and multi-domain validation data with category labels and domain identifiers, wherein the initial model can output the feature representation before the classification head and the corresponding classification result; The cross-domain sampling module 200 is used to perform joint sampling by domain based on multi-domain training data, construct cross-domain batch data, and input the cross-domain batch data into the initial model to obtain the feature representation and classification result corresponding to each sample in the cross-domain batch data. The joint optimization module 300 is used to calculate the classification loss based on the feature representation and classification results, combined with the category label of the sample, and to calculate the cross-domain representation distribution difference loss based on the feature representation after grouping by domain. The classification loss and the cross-domain representation distribution difference loss are jointly optimized to obtain the current round model. The flat fusion module 400 is used to apply the current round model to multi-domain validation data and determine whether the training process has entered the flat optimization region based on the change of validation loss in consecutive training rounds. When it is determined that it has entered the flat optimization region, the current round model in the flat optimization region is subjected to online weighted fusion to obtain a robust fusion model. The deployment output module 500 is used to output the robust fusion model as the final deployment model when the training reaches the preset termination condition, so as to realize the anti-distribution offset and high robustness recognition of cross-domain network traffic classification.

[0079] Regarding the system in the above embodiments, the specific ways in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0080] Example 3 To implement the methods of the above embodiments, the present invention also provides an electronic device, which includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the various steps of the methods described above.

[0081] Example 4 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0082] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0083] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0084] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A model-independent method for enhancing the robustness of network traffic classification, characterized in that, include: A pre-trained network traffic classification model is obtained as the initial model, and multi-domain training data and multi-domain validation data with category labels and domain identifiers are obtained. The initial model can output the feature representation before the classification head and the corresponding classification result. Based on multi-domain training data, joint sampling is performed by domain to construct cross-domain batch data, and the cross-domain batch data is input into the initial model to obtain the feature representation and classification results corresponding to each sample in the cross-domain batch data. Based on the feature representation and classification results, the classification loss is calculated in combination with the category label of the sample, and the cross-domain representation distribution difference loss is calculated based on the feature representation after grouping by domain. The classification loss and the cross-domain representation distribution difference loss are jointly optimized to obtain the current round model. The current round model is applied to multi-domain validation data, and the training process is determined to have entered the flat optimization region based on the change in validation loss in consecutive training rounds. When it is determined to have entered the flat optimization region, the current round model in the flat optimization region is weighted and fused online to obtain a robust fusion model. When the training reaches the preset termination condition, the robust fusion model is output as the final deployment model, realizing the anti-distribution offset and highly robust identification of cross-domain network traffic classification.

2. The method according to claim 1, characterized in that, Obtain a pre-trained network traffic classification model as the initial model, and acquire multi-domain training data and multi-domain validation data with category labels and domain identifiers, including: A deep learning network traffic classification model with a cascaded encoder and classifier structure was selected as the basic framework. Publicly pre-trained weights were loaded to complete parameter initialization and an initial model was constructed. Configure the feature output port of the initial model to ensure that the initial model stably outputs the feature representation of the classification head and the traffic classification results; Based on the actual distribution offset influencing factors, all training and validation data are divided into multiple independent data domains. Each sample is labeled with a category label and its domain number to obtain the multi-domain training data and the multi-domain validation data.

3. The method according to claim 2, characterized in that, Based on multi-domain training data, joint sampling is performed by domain to construct cross-domain batch data. This cross-domain batch data is then input into the initial model to obtain the feature representations and classification results corresponding to each sample in the cross-domain batch data, including: Based on the domain partitioning rules of multi-domain training data, a fixed number of samples is allocated to each data domain during a single sampling process, and multi-domain samples are extracted synchronously in parallel. Traffic samples extracted from each domain are systematically spliced ​​and integrated, and data formats and input dimensions are unified to form cross-domain batch data with balanced batch dimensions. The integrated cross-domain batch data is completely input into the initialized initial model. The encoder extracts the sample feature representations, synchronously drives the classifier to complete forward inference, and outputs the feature representation vectors and traffic classification results corresponding to all samples in batches.

4. The method according to claim 3, characterized in that, Based on the feature representation and classification results, a classification loss is calculated in conjunction with the sample category labeling, and a cross-domain representation distribution difference loss is calculated based on the feature representation after domain grouping. The classification loss and the cross-domain representation distribution difference loss are jointly optimized to obtain the current round model, including: Based on the real category labels corresponding to the cross-domain batch data, and combined with the classification results output by the model, a label smoothing correction mechanism is introduced to quantify and calculate the model classification error, thereby obtaining the classification loss that constrains the classification accuracy. Based on the predefined domain identifier of the samples, the global feature representation vector is grouped and clustered according to the data domain. The mean vector and covariance matrix of the single-domain feature distribution are solved respectively. The inter-domain distribution deviation is calculated by matrix distance measurement to obtain the cross-domain representation distribution difference loss. We set weight coefficients to weight and regulate the loss of cross-domain representation distribution differences, construct a joint optimization total loss function with the classification loss, update the initial model parameters through backpropagation, complete the multi-objective joint optimization, and iteratively generate the current round model corresponding to this round of training.

5. The method according to claim 4, characterized in that, The current model is applied to multi-domain validation data, and the training process is determined to have entered a flat optimization region based on the change in validation loss over consecutive training rounds, including: Each iteration generates the current round model, which is then sequentially input into the multi-domain validation data. This process completes the forward inference of validation samples in batches, quantitatively calculates the cross-domain validation loss of the model, and records the validation loss value and model parameter information round by round. Two sets of fixed-capacity queues are used to cache the verification loss of consecutive rounds, and the dynamic trend of the verification loss is monitored in real time through a sliding window. When the first queue is full and the validation loss corresponding to the head round of the queue is a local minimum, the training is determined to have entered a flat optimization region. The head round is marked as the starting point of the flat valley, and the corresponding validation loss is recorded as the reference loss. When the second queue is full and all validation losses in that queue are greater than the sum of the reference loss and the adaptive threshold, the training is determined to have left the flat optimization region.

6. The method according to claim 5, characterized in that, Once the model is determined to have entered the flat optimization region, online weighted fusion is performed on the current round model within the flat optimization region, including: Using the baseline validation loss of the starting node of the flat optimization region as a reference, an exponential weight mapping function is constructed by introducing a temperature hyperparameter, and the initial fusion weight of each current round model in the interval is calculated in turn. The cumulative weight values ​​of the fusion model are statistically analyzed in real time, and the weights are normalized by combining them with the initial weights of the single model to determine the mixing and fusion ratio of the model parameters in a single round. An incremental iterative update strategy is adopted to progressively add and correct the global fusion parameters according to the fusion ratio, continuously accumulating weight data and updating the robust fusion model parameters.

7. The method according to claim 6, characterized in that, When the training reaches the preset termination condition, the robust fusion model is output as the final deployment model, including: Pre-configure two types of termination constraints: the maximum number of training iterations for the model and the exit threshold for flat regions, and monitor the training process and the fluctuation status of validation loss in real time. When the number of training iterations reaches the set limit, or when the overall validation loss exceeds the adaptive threshold and is determined to have deviated from the flat optimization range, a training termination command is triggered immediately. Stop iterative updates of model parameters and online fusion calculations, solidify the robust fusion model parameters that have completed incremental aggregation, and directly output the final deployment model whose structure is completely consistent with the initial model.

8. A model-independent network traffic classification robustness enhancement system, characterized in that, include: The initial configuration module is used to obtain a pre-trained network traffic classification model as the initial model, and to obtain multi-domain training data and multi-domain validation data with category labels and domain identifiers. The initial model can output the feature representation before the classification head and the corresponding classification result. The cross-domain sampling module is used to perform joint sampling by domain based on multi-domain training data, construct cross-domain batch data, and input the cross-domain batch data into the initial model to obtain the feature representation and classification results corresponding to each sample in the cross-domain batch data. The joint optimization module is used to calculate the classification loss based on the feature representation and classification results, combined with the category label of the sample, and to calculate the cross-domain representation distribution difference loss based on the feature representation after grouping by domain. The classification loss and the cross-domain representation distribution difference loss are jointly optimized to obtain the current round model. The flat fusion module is used to apply the current round model to multi-domain validation data and determine whether the training process has entered the flat optimization region based on the change of validation loss in consecutive training rounds. When it is determined that it has entered the flat optimization region, the current round model in the flat optimization region is weighted and fused online to obtain a robust fusion model. The deployment output module is used to output the robust fusion model as the final deployment model when the training reaches the preset termination condition, so as to realize the anti-distribution offset and high robustness recognition of cross-domain network traffic classification.

9. An electronic device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images