A method and system for processing encrypted network traffic based on multi-level interactive representation

Abstract

This application relates to the field of network security technology, and in particular to a method and system for processing encrypted network traffic based on multi-level interactive representation. The method includes: preprocessing pre-acquired raw PCAP format network traffic data to obtain preprocessed raw PCAP format network traffic data, and performing bidirectional session partitioning based on five-tuple information to form independent session streams; for each independent session stream, selecting the first M data packets, and extracting header data and payload data from each data packet to obtain corresponding fixed-length header byte sequences and payload byte sequences; concatenating and vertically stacking the header byte sequences and payload byte sequences of the M data packets in chronological order to obtain a fixed-length one-dimensional byte sequence; rearranging the one-dimensional byte sequence into a two-dimensional matrix of a preset size according to preset rules, and mapping the byte values ​​in the two-dimensional matrix to grayscale pixel values ​​to generate a multi-level interactive traffic representation grayscale image.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and system for processing encrypted network traffic based on multi-level interactive representation. Background Technology

[0002] With the increasing prevalence of network security protocols and the rapid development of internet applications, encrypted communication protocols have become the primary method for network data transmission. Currently, over 95% of web traffic is transmitted using encryption, and network communication content is gradually shifting from plaintext transmission to encrypted transmission. While ensuring user privacy and data security, encrypted communication also makes traditional network traffic identification technologies that rely on port number matching, protocol feature matching, and Deep Packet Inspection (DPI) ineffective. Therefore, encrypted network traffic analysis and identification technologies based on machine learning, especially deep learning, have gradually become an important research direction in the current network security field. In the process of deep learning-based encrypted traffic identification, raw network traffic is usually stored in PCAP (PacketCapture) format, which is essentially unstructured binary data. Since deep learning models cannot directly process raw PCAP data, preprocessing is required to convert the raw traffic into a data representation suitable for input to the deep learning model. The quality of the preprocessing results directly affects the performance of subsequent tasks such as traffic classification, application identification, malicious traffic detection, and intrusion detection.

[0003] Currently, preprocessing methods for encrypted network traffic mainly include byte sequence truncation, byte concatenation, statistical feature extraction, and traffic visualization. For example, some methods directly extract the first few bytes of data packets or session streams as model input; some methods construct feature vectors by extracting statistical features such as packet length and arrival time intervals; and some methods convert the original traffic bytes into grayscale images and then input them into convolutional neural networks for classification analysis. For instance, patent CN113364787A (classification number H04L) provides a botnet traffic detection method based on parallel neural networks, patent CN119814671A (classification number H04L) provides an encrypted network traffic classification method and system based on spatiotemporal information fusion, and patent CN119854007A (classification number H04L) provides an encrypted traffic classification method and model based on network byte traffic graphs.

[0004] However, existing encrypted traffic preprocessing technologies still have the following shortcomings: First, the semantic representation capability of traffic is insufficient. Most existing methods construct input data using simple byte truncation and concatenation, ignoring the inherent hierarchical structure of "byte-data packet-session stream" in network communication. Especially in encrypted traffic scenarios, the encrypted payload in long data packets often occupies a large amount of byte space, easily obscuring key discriminative features such as protocol headers, control flags, and TLS handshake information. This makes it difficult to effectively preserve the internal structural features of traffic and the temporal interaction features between data packets, thereby reducing the ability of subsequent deep learning models to represent traffic behavior patterns.

[0005] Secondly, the problem of redundant environmental features is prominent. Raw PCAP data typically contains network identification information strongly correlated with the collection environment, such as MAC addresses, IP addresses, and port numbers. Existing preprocessing methods often directly retain this information for model training, which can easily lead the model to learn characteristics of a specific network environment rather than real communication behavior characteristics, resulting in poor model generalization ability. Furthermore, this network identification information may also reflect user communication partners, network topology, and access behavior, posing a certain risk of privacy leakage.

[0006] Secondly, the input data format lacks uniformity. Different session streams contain significantly different numbers of data packets, and the lengths of these packets also vary, resulting in inconsistent sizes of generated data samples. Existing technologies typically struggle to convert heterogeneous session streams into a unified data representation while preserving semantic information, thus posing significant challenges to the batch training, inference deployment, and model transfer applications of deep learning models.

[0007] Furthermore, existing traffic visualization methods often focus only on the simple mapping from byte values ​​to pixel values ​​when converting network traffic into images, lacking joint encoding of the internal structure of data packets and session temporal relationships. This results in the generated images failing to fully express the hierarchical semantic information in the network communication process, limiting the ability of deep learning models to mine the features of encrypted traffic. Summary of the Invention

[0008] (a) Technical problems to be solved In view of the above-mentioned shortcomings and deficiencies of the prior art, this application provides a method and system for processing encrypted network traffic based on multi-level interactive representation, which solves the technical problem that the existing encrypted network traffic preprocessing technology cannot effectively preserve the multi-level communication semantic relationship of "byte-data packet-session stream", resulting in insufficient expression of key protocol features and temporal interactive features.

[0009] (II) Technical Solution To achieve the above objectives, the main technical solutions adopted in this application include: In a first aspect, embodiments of this application provide a method for processing encrypted network traffic based on multi-level interactive representation, comprising the following steps: S1. Preprocess the pre-acquired raw PCAP format network traffic data to obtain preprocessed raw PCAP format network traffic data. Based on the five-tuple information included in the preprocessed raw PCAP format network traffic data, perform bidirectional session segmentation on the data packets in the preprocessed raw PCAP format network traffic data. Sort the data packets in the same session according to the timestamp to form corresponding independent session streams. S2. For each independent session stream, select the first M data packets, and extract the header data and payload data for each data packet. Further, based on the header data and payload data, obtain the corresponding fixed-length header byte sequence and payload byte sequence. S3. In chronological order, the header byte sequence and payload byte sequence of the M data packets are concatenated and stacked vertically to obtain a one-dimensional byte sequence of fixed length; S4. The one-dimensional byte sequence is rearranged into a two-dimensional matrix of a preset size according to a preset rule, and the byte values ​​in the two-dimensional matrix are mapped to grayscale pixel values ​​to generate a multi-level interactive flow representation grayscale image.

[0010] Optionally, in some embodiments of this application, the preprocessing process for the pre-acquired raw PCAP format network traffic data includes: removing the Ethernet MAC frame header from the raw PCAP format network traffic data, anonymizing the network layer IP address in the five-tuple information included in the raw PCAP format network traffic data, and setting the transport layer port number in the five-tuple information to zero, to obtain preprocessed raw PCAP format network traffic data; the anonymization process is a random mapping or an irreversible mapping process based on a hash function; wherein, the five-tuple information includes: network layer IP address, transport layer port, and transport network protocol; the network layer IP address includes source IP address and destination IP address; the transport layer port includes source port number and destination port number.

[0011] Optionally, in some embodiments of this application, in step S2, if the number of data packets in the independent session stream is less than M, the number is padded with zero-based data packets; wherein, if the data packets in the independent session stream are IP / IPv6 packets, the IP header of the data packet is used as the header data, and the application layer data is extracted as the payload data.

[0012] Optionally, in some embodiments of this application, step S2, based on the header data and the payload data, obtains corresponding fixed-length header byte sequences and payload byte sequences, specifically including: for the header data, performing truncation or padding processing using a first fixed length L1 to obtain a fixed-length header byte sequence; for the payload data, performing truncation or padding processing using a second fixed length L2 to obtain a fixed-length payload byte sequence.

[0013] Optionally, in some embodiments of this application, the first fixed length L1 is 80 bytes and the second fixed length L2 is 240 bytes.

[0014] Optionally, in some embodiments of this application, step S3 specifically includes: reading the header byte sequence and payload byte sequence corresponding to each of the M data packets in chronological order according to the timestamps of the data packets, concatenating them in the order of header byte sequence first and payload byte sequence last, and connecting the concatenation results corresponding to the first data packet to the Mth data packet end to end in sequence to form a continuous one-dimensional byte sequence.

[0015] Optionally, in some embodiments of this application, step S4, which rearranges the one-dimensional byte sequence into a two-dimensional matrix of a preset size according to a preset rule, specifically includes: filling each row of the two-dimensional matrix with the byte data in the one-dimensional byte sequence from left to right, and continuing to fill from the left side of the next row after the current row is filled, until all the byte data in the one-dimensional byte sequence is filled, thereby forming a two-dimensional matrix of a preset size.

[0016] Optionally, in some embodiments of this application, the size of the two-dimensional matrix is ​​N×W, where W is a preset image width, N is the ratio of the length of the one-dimensional byte sequence to W; the length of the one-dimensional byte sequence is M×(L1+L2).

[0017] Optionally, in some embodiments of this application, the multi-level interactive traffic represents a grayscale image as a single-channel grayscale image with pixel values ​​ranging from 0 to 255.

[0018] On the other hand, embodiments of this application also provide an encrypted network traffic processing system based on multi-level interactive representation, including: at least one processor; and at least one memory communicatively connected to the processor, wherein the memory stores program instructions executable by the processor, and the processor can execute the encrypted network traffic processing method based on multi-level interactive representation as described in the above embodiments by calling the program instructions.

[0019] (III) Beneficial Effects The encrypted network traffic processing method based on multi-level interactive representation provided in this application preprocesses the original PCAP format network traffic data and performs bidirectional session partitioning of data packets based on five-tuple information. This converts the original network traffic into independent session streams organized in chronological order, effectively preserving session semantic information during network communication while eliminating the influence of environmental correlation features, thus providing a reliable data foundation for subsequent traffic feature extraction. Furthermore, by selecting the first M data packets for each independent session stream and extracting header and payload data from each data packet to obtain fixed-length header byte sequences and payload byte sequences, the protocol header and payload information in the data packets are independently represented. This avoids the long data packet payload from obscuring key protocol features, thereby more completely preserving the structured feature information in the network traffic.

[0020] Furthermore, by concatenating and vertically stacking the header byte sequences and payload byte sequences of the M data packets in chronological order, a fixed-length one-dimensional byte sequence is constructed. This effectively preserves the temporal relationship between data packets and the structural relationship between the header and payload within the data packets, enabling joint encoding of multi-level semantic information of "byte-data packet-session stream" in network communication and improving the expressive power of traffic characteristics.

[0021] Furthermore, by rearranging the one-dimensional byte sequence into a two-dimensional matrix of a preset size according to preset rules, and mapping the byte values ​​in the two-dimensional matrix to grayscale pixel values, a multi-level interactive traffic representation grayscale image is generated. This can uniformly convert session streams of different lengths and scales into a standardized data representation format, thereby effectively solving the problem of inconsistent input formats for heterogeneous session streams. It provides high-quality, standardized input data for deep learning models such as convolutional neural networks and VisionTransformer, improving the accuracy and generalization ability of subsequent encrypted traffic classification, application identification, and network security detection tasks. Attached Figure Description

[0022] Figure 1 This is a flowchart illustrating an encrypted network traffic processing method based on multi-level interactive representation according to an embodiment of this application; Figure 2 This is a schematic diagram of the structure of an encrypted network traffic processing system based on multi-level interactive representation according to an embodiment of this application. Detailed Implementation

[0023] To better explain and facilitate understanding of this application, the following detailed description of the application is provided in conjunction with the accompanying drawings and specific embodiments.

[0024] In related technologies, preprocessing and representation methods for encrypted network traffic can be mainly categorized into three types: The first type is a traffic preprocessing scheme based on byte truncation and direct concatenation. This scheme typically extracts the first few bytes of the session stream or data packets from the original PCAP file and uses the extracted byte sequence directly as input data for a deep learning model. This scheme is simple to implement and has low computational overhead, but because it only uses fixed-length byte truncation, it disrupts the natural hierarchical structure of "byte-data packet-session stream" in network communication. Furthermore, the encrypted payload in long data packets often occupies a large amount of byte space, easily obscuring key features such as protocol headers, control flags, and TLS handshake information. This results in the inability to effectively preserve the internal structural information of the data packets and the temporal interaction information between data packets, thus affecting the accuracy of subsequent traffic classification and identification.

[0025] The second category is traffic representation schemes based on statistical feature extraction. This approach constructs feature vectors by extracting statistical features such as packet length distribution, arrival time intervals, flow duration, and number of data packets, and then uses machine learning models to perform traffic classification. While this scheme can reduce the size of the original traffic data and improve model training efficiency to some extent, the statistical feature extraction process loses a significant amount of underlying byte information and protocol interaction details, making it difficult to fully reflect the communication behavior characteristics in encrypted traffic. Furthermore, statistical features are highly dependent on the data collection environment; when the network environment changes, the model's generalization ability is prone to decline.

[0026] The third category is preprocessing schemes based on traffic visualization representation. These schemes map raw traffic byte data into grayscale or color images and utilize models such as convolutional neural networks for feature learning and classification. While visualization representation can fully leverage the advantages of deep learning models in image processing, most existing schemes employ simple byte-order mapping, lacking joint encoding of the internal structure of data packets and session temporal relationships. Furthermore, environmental information such as MAC addresses, IP addresses, and port numbers in the raw traffic is often directly preserved, which can easily lead to overfitting due to the model learning specific network environment characteristics and also poses a risk of user privacy leakage. In addition, the significant differences in the number and length of data packets across different session flows result in inconsistent data representation formats, hindering the batch training and inference deployment of deep learning models.

[0027] To address this, this application provides a method and system for processing encrypted network traffic based on multi-level interactive representation. By preprocessing the original PCAP format network traffic data and performing bidirectional session partitioning and temporal sequencing based on five-tuple information, the method can preserve the complete session communication process while eliminating the influence of environmental correlation features. Furthermore, by separating and representing the header and payload data of data packets using a fixed-length structured representation, the protocol header and payload information are expressed in a balanced manner, preventing key features from being overwhelmed by long payloads. Simultaneously, by concatenating and stacking the header and payload byte sequences of multiple data packets in chronological order, the method achieves joint encoding of multi-level semantic relationships and inter-packet temporal relationships within the "byte-data packet-session flow" hierarchy. Finally, by rearranging the resulting byte sequences into a fixed-size two-dimensional matrix and mapping it to generate a multi-level interactive traffic representation grayscale image, the method uniformly converts session flows of different lengths and scales into a standardized input format, thereby providing high-quality input data for subsequent deep learning models. Even in complex network environments and with different types of encrypted traffic, the method effectively preserves key communication features, improves the accuracy, generalization ability, and processing efficiency of traffic classification and identification, while also considering user privacy protection needs.

[0028] To better understand the above technical solutions, exemplary embodiments of this application will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of this application are shown in the drawings, it should be understood that this application can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application can be understood more clearly and thoroughly, and that the scope of this application can be fully conveyed to those skilled in the art.

[0029] Figure 1 This is a flowchart illustrating an embodiment of an encrypted network traffic processing method based on multi-level interactive representation according to this application. Figure 1 As shown, this encrypted network traffic processing method based on multi-level interactive representation includes: S1. Preprocess the pre-acquired raw PCAP format network traffic data to obtain preprocessed raw PCAP format network traffic data. Based on the five-tuple information included in the preprocessed raw PCAP format network traffic data, perform bidirectional session segmentation on the data packets in the preprocessed raw PCAP format network traffic data. Sort the data packets in the same session according to the timestamp to form corresponding independent session streams. In this embodiment of the application, the process of preprocessing the pre-acquired raw PCAP format network traffic data includes: removing the Ethernet MAC frame header from the raw PCAP format network traffic data, anonymizing the network layer IP address in the five-tuple information included in the raw PCAP format network traffic data, and setting the transport layer port number in the five-tuple information to zero, so as to obtain the preprocessed raw PCAP format network traffic data. The anonymization process is either a random mapping or an irreversible mapping process based on a hash function; The five-tuple information includes: network layer IP address, transport layer port, and transport network protocol; the network layer IP address includes source IP address and destination IP address; the transport layer port includes source port number and destination port number.

[0030] For example, suppose the raw PCAP format network traffic data contains communication records in two directions: host A (192.168.1.10:34567) accesses server B (203.0.113.5:443), and server B returns a response packet. The raw packet contains not only IP layer information but also Ethernet MAC frame headers (such as source MAC, destination MAC, and other redundant link layer information). In the preprocessing stage, the Ethernet MAC frame headers are removed, concentrating the data on network layer and above information, thereby reducing interference features irrelevant to application identification. Simultaneously, IP addresses are anonymized; for example, 192.168.1.10 is mapped to a random value A1B2C3D4, and 203.0.113.5 is mapped to E5F6G7H8, thus protecting privacy and preventing the model from overfitting to specific address features. Port numbers are uniformly set to zero, for example, 34567 and 443 are both set to 0, to reduce dependence on specific ports. Based on this, data packets are segmented into sessions according to the five-tuple (source IP, destination IP, source port, destination port, protocol type). For example, requests and responses of the same TCP connection are divided into a bidirectional session stream and sorted by timestamp, so that the time sequence of "request → response → continue request" is maintained.

[0031] S2. For each independent session stream, select the first M data packets, and extract the header data and payload data for each data packet. Further, based on the header data and payload data, obtain the corresponding fixed-length header byte sequence and payload byte sequence. In step S2, if the number of data packets in the independent session stream is less than M, it is padded with zero-based data packets. In the case where the data packets in the independent session stream are IP / IPv6 packets, the IP header of the data packet is used as the header data, and the application layer data is extracted as the payload data.

[0032] In a specific example, assuming M=5, a certain encrypted communication session (such as HTTPS access under TLS 1.3) contains only 3 actual data packets. The session flow is as follows: First data packet: Client → Server (IP header + TLSClientHello); The second data packet: Server → Client (IP header + TLSServerHello); The third data packet: Client → Server (IP header + encrypted application data); Since the actual number of data packets is 3, which is less than M=5, two additional "all-zero data packets" will be added. An all-zero data packet is one in which both the header and payload fields are filled with a sequence of 0x00 bytes. For example, the header is all 64 bytes and the payload is all 128 bytes, thus maintaining the same structure as the real data packet but without carrying any valid information.

[0033] During the data extraction phase, for each IP / IPv6 packet, the IP layer header fields are extracted. For example, the IPv4 header includes: version number, TTL, protocol number, source IP, destination IP, etc.; the IPv6 header includes: flow label, hop count limit, source / destination address, etc.

[0034] For example, the IP header of the first data packet might contain: Source IP: 10.0.0.2, Destination IP: 93.184.216.34, TTL: 64; these fields are parsed and serialized into a fixed-length byte sequence (e.g., 64 bytes), padded with zeros if necessary. The payload data extracts application layer content. For example, the payload of a TLSClientHello message might include: a list of cipher suites, extended fields (SNI, ALPN, etc.). Even in encrypted form, this content retains the protocol structure characteristics and is subsequently truncated or padded to a fixed length (e.g., 128 bytes) to form the payload byte sequence.

[0035] For data packets shorter than M, such as the 4th and 5th "virtual packets", both the header byte sequence and the payload byte sequence are all zeros, thus ensuring the consistency of the input structure.

[0036] In this embodiment, by limiting the number of data packets to "fixed M," structural alignment is achieved at the input level for session streams of different lengths. For example, short sessions (such as a single DNS query) and long sessions (such as continuous video transmission) are completely consistent in the model input dimension, thus avoiding feature bias or model training difficulties caused by inconsistent lengths in traditional methods. Secondly, a "zero-padding" mechanism is adopted to complete data padding without introducing artificial noise. Unlike random padding, zero-padding does not introduce false patterns and can clearly identify "locations without effective communication behavior," enabling the model to learn the implicit feature of session length information, such as the difference in behavioral patterns between short and long sessions. Thirdly, by distinguishing between the IP / IPv6 header and the application layer payload, a dual-channel expression of "protocol behavior characteristics" and "content behavior characteristics" is achieved. The IP header reflects metadata such as routing behavior, communication direction, and latency characteristics, while the application layer payload still contains the protocol handshake structure and data exchange mode even in encrypted cases, thereby enhancing the identifiability of encrypted traffic.

[0037] S3. In chronological order, the header byte sequence and payload byte sequence of the M data packets are concatenated and stacked vertically to obtain a one-dimensional byte sequence of fixed length; For example, for a session with M=3: the header byte sequence H1 of packet 1 + the payload byte sequence P1; the header byte sequence H2 of packet 2 + the payload byte sequence P2; the header byte sequence H3 of packet 3 + the payload byte sequence P3; concatenated in chronological order as: H1→P1→H2→P2→H3→P3; then these sequences are formed into a unified one-dimensional byte sequence according to fixed rules (such as sequential concatenation).

[0038] S4. The one-dimensional byte sequence is rearranged into a two-dimensional matrix of a preset size according to preset rules, and the byte values ​​in the two-dimensional matrix are mapped to grayscale pixel values ​​to generate a multi-level interactive traffic representation grayscale image. For example, assuming the one-dimensional byte sequence obtained in S3 is a 576-byte sequence, it is rearranged into a 24×24 two-dimensional matrix, with each byte value ranging from 0 to 255, directly mapped to grayscale image pixel values. Assuming the byte value is 0x00–0xFF, it corresponds to grayscale values ​​of 0–255, forming a grayscale image. For example: 0x00 → black pixel; 0xFF → white pixel; intermediate values ​​→ different grayscale levels; finally, each independent session stream is represented as a fixed-size traffic image.

[0039] In its implementation, the network traffic, originally presented as data packets, is represented as a two-dimensional image by rearranging the one-dimensional byte sequence and mapping it to grayscale pixel values. For example, each byte value corresponds to a grayscale value within the range of 0–255, thus forming a traffic image with visual representation. This approach allows convolutional neural networks, traditionally used for image classification, to be directly applied to network traffic analysis without relying on complex manual feature engineering. This fully leverages the advantages of CNNs in local feature extraction and hierarchical feature learning, enabling automated modeling and recognition of encrypted traffic patterns. Secondly, the two-dimensional spatial rearrangement enhances the ability to express local correlations, transforming the originally scattered byte information into a textured structure. In this process, the one-dimensional byte sequence is reconstructed into a two-dimensional matrix according to preset rules, making adjacent or temporally related data spatially proximate. For example, the header and payload bytes of adjacent data packets in the same session are continuously distributed in the image, forming a pattern similar to "texture" or "structural blocks." This spatial rearrangement allows network traffic features that are originally dispersed in the time dimension to present a locally correlated structure in a two-dimensional space. This helps the model capture the interaction relationships between data packets and the local pattern changes in communication behavior, thereby improving the feature representation capability.

[0040] Furthermore, the encrypted network traffic processing method based on multi-level interactive representation in this application realizes multi-level interactive expression (packet level → byte level → spatial level), significantly improving the ability to recognize encrypted traffic patterns, such as VPN traffic and malicious encrypted communication. In this multi-level expression system, packet-level representation reflects the temporal structure and interaction relationships in the communication process, byte-level representation reflects the fine-grained features of the header and payload information inside the data packet, and spatial-level representation further enhances the global pattern expression capability through a graphical structure. The fusion of the three levels of information enables the model to simultaneously learn the macroscopic structure and microscopic differences of communication behavior. For example, in VPN traffic identification, different tunneling protocols will exhibit different distribution characteristics at the packet and byte levels; in malicious encrypted communication scenarios, the traffic often exhibits abnormal texture patterns in spatial structure. Through multi-level interactive representation, the model's ability to discriminate complex encrypted traffic behavior can be significantly improved.

[0041] Optionally, in some embodiments of this application, step S2, based on the header data and payload data, obtains a corresponding fixed-length header byte sequence and payload byte sequence, specifically including: for the header data, performing truncation or padding processing using a first fixed length L1 to obtain a fixed-length header byte sequence; The load data is truncated or padded using a second fixed length L2 to obtain a fixed-length load byte sequence.

[0042] In a specific example, assume that L1 = 64 bytes is set for the header sequence and L2 = 128 bytes is set for the payload sequence. For a certain actual data packet, such as a TCP / IP data packet, its header information may include the combined structure of an IP header and a TCP header, with a total length of approximately 54 bytes, including: Source IP address (4 bytes), destination IP address (4 bytes), port information (4 bytes), TCP flag bits, sequence numbers, and other control fields; since the actual header length of 54 bytes is less than the preset L1 = 64 bytes, 10 bytes of 0x00 padding value are added at the end to make it a 64-byte fixed-length header byte sequence. For example: the header byte sequence H = [real 54-byte header information + 10 bytes of 0x00]; if the length of some special protocol headers exceeds 64 bytes, such as in the scenario with较多 IPv6 extension headers, the excess part is truncated, and only the first 64 bytes are retained to ensure consistent input dimensions.

[0043] For the payload data, such as TLS encrypted application data, its length may vary greatly. Assume that the payload length of a certain data packet is 200 bytes, which contains encrypted application layer data fragments. Since L2 = 128 bytes, which is less than the actual payload length, the first 128 bytes are intercepted as the payload byte sequence; if the payload is only 80 bytes, such as TLS handshake phase data, 48 bytes of 0x00 padding are added at the end to meet the fixed-length requirement: if the payload data > L2: truncate the first 128 bytes, if the payload data < L2: pad with zeros to 128 bytes. Finally, each data packet is uniformly represented as: header byte sequence: 64-byte fixed length, payload byte sequence: 128-byte fixed length.

[0044] In this embodiment, by setting two fixed lengths, L1 and L2, "differentiated standardization processing" of header and payload information is achieved. Since header data is typically structurally stable and information-dense, while payload data varies greatly in length and is semantically complex, using different length constraints can more reasonably preserve information distribution characteristics and avoid information loss or redundancy caused by uniform length processing. Secondly, through truncation and padding mechanisms, strong consistency of input data is achieved, ensuring that different protocol types (such as TCP, UDP, QUIC) and different business types (such as web page access, video streaming, file transfer) have a unified dimensional structure at the model input, thereby significantly reducing model training complexity and improving convergence stability. Thirdly, padding with 0x00 not only serves as length alignment but also implicitly introduces "information missing identifiers." For example, when the payload is short, more zero-value padding occurs, allowing the model to indirectly learn that the session may belong to short-interaction behavior; while longer payloads have less padding, helping to distinguish between long-connection and short-connection behavior patterns. Finally, by modeling the header and payload with fixed lengths respectively, the model can capture "protocol behavior features" (from the header) and "content interaction features" (from the payload) respectively, enhancing the multi-dimensional expression of encrypted traffic and thus improving the overall recognition performance of complex network scenarios (such as VPN traffic identification, encrypted malicious communication detection, application classification, etc.).

[0045] Optionally, in some embodiments of this application, the first fixed length L1 is 80 bytes and the second fixed length L2 is 240 bytes.

[0046] In this embodiment, setting L1 to 80 bytes is beneficial for fully covering the key fields in the IP layer and transport layer headers. In actual network protocols, the IPv4 header is typically 20 bytes, the IPv6 basic header is 40 bytes, and the TCP header is generally 20 bytes. In some cases, TCP option fields (such as timestamps, window expansion, etc.) may also be present, making the total header length potentially exceed 60 bytes. Therefore, setting L1 to 80 bytes can effectively cover most header extension information in real network scenarios, avoiding the loss of key control fields (such as flags, sequence numbers, window sizes, protocol extension options, etc.) due to excessive truncation, thereby improving the completeness and accuracy of communication behavior modeling.

[0047] Secondly, setting L2 to 240 bytes helps to more fully preserve the effective information representation capabilities of the payload layer. Although the payload content cannot be directly parsed in encrypted traffic scenarios, its byte distribution still contains characteristics of the protocol interaction structure, such as the message sequence during the TLS handshake phase, the length variation pattern of encrypted application data, and segmented transmission characteristics. If L2 is set too small (e.g., 64 or 128 bytes), it may only cover a partial fragment of a single data packet, resulting in an inability to reflect the complete interaction structure; while setting it to 240 bytes can cover more continuous payload fragments, thereby enhancing the expressive power of "session-level behavioral patterns" and enabling the model to capture a longer range of contextual dependencies.

[0048] Furthermore, while header information is stable, it has high information density, so a moderate length is sufficient to fully express protocol features. Payload information, although semantically unreadable, has rich structural variations, requiring longer sequences to characterize behavioral patterns. Therefore, by using a length ratio of approximately 3 (240 / 80=3), the contribution of the payload to the overall representation can be structurally strengthened, making the model more inclined to capture behavioral pattern differences during learning, rather than solely relying on static protocol fields. In addition, this length configuration also has advantages in engineering implementation. On the one hand, both 80 bytes and 240 bytes are fixed lengths that facilitate alignment and batch processing computation, which is beneficial for GPU / CPU vectorization processing and batch training. On the other hand, this fixed-ratio structure can stably map to subsequent one-dimensional sequence concatenation and two-dimensional image reconstruction processes, resulting in a more regular spatial distribution of the generated matrix, thereby improving the convolutional neural network's ability to extract local texture structures.

[0049] Optionally, in some embodiments of this application, step S3 specifically includes: reading the header byte sequence and payload byte sequence corresponding to each of the M data packets in chronological order according to the timestamps of the data packets, concatenating them in the order of header byte sequence first and payload byte sequence last, and connecting the concatenation results corresponding to the first data packet to the Mth data packet end to end in sequence to form a continuous one-dimensional byte sequence.

[0050] In a specific example, assuming M=3, a session stream contains three data packets in chronological order, which have been processed by S2 to obtain a fixed-length representation: First data packet: Header byte sequence H1 (80 bytes); Payload byte sequence P1 (240 bytes); Second data packet: H2 (80 bytes); P2 (240 bytes); Third data packet: H3 (80 bytes); P3 (240 bytes); First, following the rule of "header first, payload last," each data packet is concatenated internally. For example: Data packet 1 concatenation result = H1 + P1 (320 bytes in total); Data packet 2 concatenation result = H2 + P2 (320 bytes in total); Data packet 3 concatenation result = H3 + P3 (320 bytes in total).

[0051] Then, according to the timestamp order, the three splicing results are concatenated end to end to form the final one-dimensional byte sequence Sa: Sa=(H1+P1)→(H2+P2)→(H3+P3); finally, a one-dimensional sequence with a length of M×(L1+L2)=3×320=960 bytes is obtained.

[0052] For example, structurally it can be represented as: Sa=H1|P1|H2|P2|H3|P3, where "|" represents the temporal sequence connection boundary between different data packets.

[0053] This application's embodiments utilize a "timestamp sorting + sequential concatenation" method to fully preserve the time dependencies of network traffic. Network communication is essentially a dynamic interactive process; for example, the TCP three-way handshake, TLS handshake, and data transmission phases all have strict temporal structures. By strictly sorting according to timestamps, it ensures that the model input accurately reflects the sequential logic of communication behaviors, thus avoiding semantic distortion caused by out-of-order processing. Secondly, a fixed concatenation method of "header first, payload last" is used within each data packet, ensuring a unified semantic arrangement rule between different data packets. Header information typically reflects protocol control behaviors (such as connection establishment and flow control), while payload information reflects the actual data exchange content. This fixed order arrangement makes it easier for the model to learn the inherent correlation structure of "control behavior → data behavior," thereby enhancing the interpretability and consistency of feature representation. Thirdly, by concatenating the concatenation results of M data packets end-to-end to form a one-dimensional byte sequence, unified encoding of multi-granularity information is achieved. On the one hand, it retains the packet-level structure (each 320 bytes is a complete packet unit), and on the other hand, it forms a continuous stream-level representation, enabling the model to learn both local packet features and global behavior patterns across packets, such as burst traffic, periodic communication, or abnormal data injection.

[0054] Specifically, step S4, which rearranges the one-dimensional byte sequence into a two-dimensional matrix of a preset size according to a preset rule, includes: The byte data in the one-dimensional byte sequence is sequentially filled into each row of the two-dimensional matrix from left to right. After the current row is filled, the filling continues from the left side of the next row until all the byte data in the one-dimensional byte sequence is filled, thereby forming a two-dimensional matrix of a preset size.

[0055] In this embodiment, the size of the two-dimensional matrix is ​​N×W, where W is the preset image width and N is the ratio of the length of the one-dimensional byte sequence to W; the length of the one-dimensional byte sequence is M×(L1+L2).

[0056] In this embodiment, M represents the number of data packets selected from each independent session stream, used to characterize the number of data packets participating in the construction of multi-level interactive representation; L1 represents the fixed length of the data packet header byte sequence, and L2 represents the fixed length of the data packet payload byte sequence, both in bytes, used to characterize the standardized byte length obtained after truncation or padding of the original data packets. Further, the length of the one-dimensional byte sequence is determined by M×(L1+L2), in bytes, used to characterize the total length of continuous byte data formed by concatenating M data packets in chronological order. This length reflects the overall representation scale of a single session stream at the byte level. Wherein, W represents the preset image width, corresponding to the number of columns in the two-dimensional matrix, a dimensionless integer parameter used to represent the number of elements contained in each row when the one-dimensional byte sequence is divided at equal intervals; N represents the number of rows in the two-dimensional matrix, a dimensionless integer parameter determined by the ratio of the one-dimensional byte sequence length to W, used to characterize the vertical expansion scale of the two-dimensional structure formed after the one-dimensional byte sequence is padded in row-major order. The resulting two-dimensional matrix has a size of N×W, where N×W represents a two-dimensional array structure consisting of N rows and W columns. This two-dimensional matrix numerically corresponds one-to-one with a one-dimensional byte sequence, with each matrix element corresponding to a byte value, which is then mapped to the pixel value of a grayscale image in subsequent processing, thus realizing the conversion from a byte sequence to a two-dimensional image space representation.

[0057] For example, in this embodiment, the number of data packets M is set to 5, meaning that the first 5 data packets are selected for processing for each independent session stream. For each data packet, the header byte sequence length is fixed at 80 bytes, and the payload byte sequence length is fixed at 240 bytes. Therefore, after standardization, each data packet can be represented as a structured byte unit of 320 bytes, where the first 80 bytes correspond to the header information and the last 240 bytes correspond to the payload information.

[0058] For example, in a given encrypted communication session, if the first five data packets are denoted as R1, R2, R3, R4, and R5, then each data packet can be represented as: R1 = Header byte sequence H1 (80 bytes) of R1 + Payload byte sequence P1 (240 bytes) of R1; R2 = Header byte sequence H2 (80 bytes) of R2 + Payload byte sequence P2 (240 bytes) of R2; R3 = Header byte sequence H3 (80 bytes) of R3 + Payload byte sequence P3 (240 bytes) of R3; R4 = Header byte sequence H4 (80 bytes) of R4 + Payload byte sequence P4 (240 bytes) of R4; R5 = Header byte sequence H5 (80 bytes) of R5 + Payload byte sequence P5 (240 bytes) of R5; Based on this, the five data packets are concatenated in timestamp order to form a one-dimensional byte sequence Sb. Since each data packet is 320 bytes long, the total length of the one-dimensional byte sequence Sb is 5 × 320 = 1600 bytes; this one-dimensional byte sequence Sb can be represented as: Sb = (H1 + P1) → (H2 + P2) → (H3 + P3) → (H4 + P4) → (H5 + P5); Further, in step S4, the one-dimensional byte sequence is mapped to a two-dimensional matrix. Assuming the size of the two-dimensional matrix is ​​set to 40×40, the total capacity of the matrix is ​​40×40=1600 elements; since the length of the one-dimensional byte sequence is also 1600 bytes, a lossless one-to-one mapping can be achieved.

[0059] During the filling process, the data is arranged in row-major order, that is, the bytes are filled from left to right in each row: The first row is filled with bytes 1 to 40 of the one-dimensional byte sequence Sb, corresponding to the first row and first column to the 40th column of the matrix; The second row is filled with bytes 41 to 80 of the one-dimensional byte sequence Sb, corresponding to the first to fourth columns of the second row of the matrix; ... The 40th row is filled with bytes 1561 to 1600 of the one-dimensional byte sequence Sb, corresponding to the 40th row, column 1 to column 40 of the matrix.

[0060] Through the above mapping method, each of the 1600 bytes in the one-dimensional byte sequence Sb uniquely corresponds to an element in the two-dimensional matrix, thereby achieving a lossless mapping from the one-dimensional byte sequence to a 40×40 two-dimensional matrix.

[0061] For example, the first line may mainly contain the header information and part of the payload data of the first data packet P1, while the middle lines may span the boundary areas of multiple data packets, such as the boundary between the payload of P2 and the header of P3, and the last few lines may mainly correspond to the payload data part of P5.

[0062] In this embodiment, setting M=5 ensures the integrity of session behavior while controlling computational complexity. This allows the model to capture short-term interaction patterns without introducing redundant information from excessively long sequences, thus achieving a balance between efficiency and expressive power. Secondly, the combination of an 80-byte header and a 240-byte payload ensures that each data packet structure fully expresses protocol control information while retaining sufficient cryptographic payload features, facilitating the model's learning of joint patterns of "control behavior + data behavior." Thirdly, the strict correspondence between the 1600-byte one-dimensional sequence length and the 40×40 two-dimensional matrix ensures complete alignment during the mapping process, eliminating truncation or zero-padding errors and guaranteeing lossless information conversion, thus improving representation stability. Finally, the 40×40 two-dimensional structure has good adaptability in computer vision models, avoiding the computational burden of excessively high dimensions while retaining sufficient spatial structural information. This allows convolutional neural networks to effectively extract local texture features and global structural features, significantly improving the ability to identify and classify encrypted network traffic.

[0063] It should be noted that by rearranging a one-dimensional byte sequence into a two-dimensional matrix of a preset size according to preset rules, a lossless mapping from a one-dimensional sequence to a two-dimensional structure is achieved. This means only the data organization format is changed without altering the byte order, thus fully preserving the temporal and intra-packet structural features of network traffic, ensuring that the original communication behavior is not semantically corrupted by the conversion. Secondly, by using row-by-row padding, locally adjacent bytes maintain their continuity in two-dimensional space, forming structured "locally related regions" in the spatial dimension. For example, the header field of the same data packet often appears as a continuous texture region in a two-dimensional image, while the payload data forms a different distribution pattern. This structure is well-suited for convolutional neural networks to extract local features. Thirdly, by introducing the parameter control of the image width W, the "temporal dimension unfolding ratio" can be flexibly adjusted. For example, when W is small, the image is "taller and longer," enhancing the expression of temporal continuity; when W is large, the image is "flatter," enhancing the expression of local spatial structure, thus providing adjustable representation capabilities for different tasks (such as classification or detection).

[0064] Furthermore, this two-dimensional matrix construction method is naturally adapted to subsequent grayscale mapping processing. Since the byte values ​​themselves are in the range of 0–255, they can be directly mapped to grayscale pixel values, so that the generated image does not require additional normalization or complex transformations, thereby significantly reducing preprocessing complexity and improving overall processing efficiency.

[0065] Optionally, in some embodiments of this application, the multi-level interactive traffic represents a grayscale image as a single-channel grayscale image with pixel values ​​ranging from 0 to 255.

[0066] In detail, the aforementioned embodiment yielded a 40×40 two-dimensional matrix containing 1600 bytes, each byte ranging from 0 to 255. Assuming a byte value of 0x00 at a certain location, the corresponding pixel in the grayscale image will appear as pure black; if the byte value is 0xFF (decimal 255), the corresponding pixel will appear as pure white; and if the byte value is 128, the corresponding pixel will appear as medium grayscale (moderate shade). Through this one-to-one correspondence, the byte distribution of network traffic can be directly converted into visually observable grayscale changes.

[0067] In a specific 40×40 grayscale image: the first row may contain a large number of low-value bytes (such as 10, 20, 35), appearing as darker areas on the image; the middle area may contain a mixture of protocol headers and payload data, for example, values ​​between 80 and 180, presenting a medium grayscale texture; some bursty data areas (such as encrypted payload fragments) may have extreme values ​​close to 255 or close to 0, thus forming a contrast structure of bright or dark spots. Furthermore, since this image is a single-channel grayscale image and does not introduce RGB multi-channel information, each pixel represents only one byte value. This design avoids color channel redundancy, making the data representation more compact. For example, a 40×40 grayscale image only requires 1600 values ​​to fully represent the multi-level interactive features of a session stream.

[0068] From an overall perspective, this grayscale image can directly reflect the strength and weakness of the distribution of network traffic bytes, allowing different protocol behaviors to present different texture structures on the image. Secondly, since the pixel values ​​are strictly limited to the range of 0–255, which is naturally consistent with the bytes, no additional normalization or complex preprocessing is required. Finally, this single-channel structure can effectively adapt to the input requirements of convolutional neural networks, enabling the model to learn session-level behavioral patterns from local pixel blocks, such as the rule structure of the TLS handshake phase and the random texture features of the encrypted data transmission phase, thereby improving the accuracy of encrypted network traffic identification and classification.

[0069] Specifically, the method also includes normalizing or data augmenting the generated grayscale image.

[0070] In this embodiment, the method further includes normalizing or data augmenting the generated grayscale image, with the aim of further improving the stability and generalization ability of model training, and making the multi-level interactive flow representation grayscale image more suitable for the input requirements of deep learning models.

[0071] First, regarding normalization, pixel values ​​can be linearly mapped or scaled to transform them from the original 0–255 range to 0–1 or other standardized intervals. For example, for a 40×40 grayscale image, if any pixel value is P(i,j) and the original range is 0 to 255, then the normalized value can be expressed as: P'(i,j) = P(i,j) / 255; For example: if a pixel value is 0, then the normalized value is 0; if the pixel value is 128, then the normalized value is approximately 0.502; if the pixel value is 255, then the normalized value is 1.

[0072] In real-world network traffic images, such as grayscale images generated from a session stream, the upper left region may contain many low-value bytes (e.g., 10, 20, 30). After normalization, these values ​​become 0.04, 0.08, and 0.12, thus avoiding the bias caused by different numerical scales to the model training. This makes the neural network more stable during gradient descent and accelerates the convergence speed.

[0073] Secondly, regarding data augmentation, this method is mainly used to expand the diversity of training samples, thereby improving the model's generalization ability and preventing overfitting. Slight transformations can be applied to grayscale images without altering the semantic structure of network traffic.

[0074] For example, the following typical data augmentation methods can be used: First, slight noise perturbation. For example, adding a small amount of random noise to the original grayscale image: the original pixel value is 120, and after adding noise, it may become 118 or 123. This perturbation simulates sampling errors or transmission fluctuations that may exist in the real network environment, making the model more robust. Second, random cropping or partial occlusion. For example, randomly occluding a 5×5 region in a 40×40 image and setting its pixels to 0 or the mean. This method can simulate the situation of partial packet loss or incomplete traffic, enabling the model to maintain its recognition ability under incomplete information conditions. Third, slight translation or rearrangement (without destroying the temporal structure). For example, shifting the entire image to the right by 1–2 pixels and padding the left side with zeros. This method can be used to enhance the model's adaptability to local positional changes, but will not change the overall traffic structure semantics. Fourth, brightness scaling. For example, multiplying the entire image by 0.9 or 1.1 to slightly darken or brighten the overall grayscale, used to simulate differences in encryption strength or sampling devices.

[0075] In this embodiment, normalization processing unifies the data scale, ensuring that the grayscale images generated by different session streams maintain a consistent numerical distribution. This avoids training instability or gradient oscillations caused by differences in numerical ranges, thus improving convergence efficiency. Secondly, data augmentation expands the training sample space without increasing the cost of real-world data acquisition, enabling the model to learn richer traffic variation patterns, such as traffic characteristics under different network environments, encryption strengths, or transmission fluctuations, significantly improving generalization ability. Finally, the combination of these two methods allows the model to possess both numerical stability and structural robustness during the training phase, resulting in higher accuracy and anti-interference capabilities in practical applications such as VPN traffic identification, encrypted malicious communication detection, and application classification.

[0076] In a typical network security application scenario, such as an enterprise-level Intrusion Detection System (IDS) or a carrier-grade encrypted traffic identification platform, the system is typically deployed at the enterprise's egress gateway, firewall device, or network traffic mirroring port to continuously monitor and analyze passing network communications. In this scenario, raw PCAP format network traffic data is collected through continuous packet capture. This data contains the complete Ethernet frame structure and payload information from the IP layer, transport layer, and even the encrypted application layer.

[0077] For example, at the exit of a company's office network, various types of network communication traffic were continuously captured during actual operation. These included encrypted communication traffic from employee terminals accessing HTTPS websites (such as video platforms, office systems, or cloud services), encrypted communication traffic connecting to remote office servers via VPN tunnels, and a small amount of abnormal external encrypted traffic (such as communication behavior attempting to connect to unknown external IP addresses). All of the above traffic was stored and recorded in the original PCAP format, and its raw data simultaneously included Ethernet MAC frame header information, IP layer address information, transport layer port information, and application layer payload data protected by TLS or other encryption protocols.

[0078] In the data processing stage, the collected raw PCAP traffic undergoes standardization and feature conversion processes as described in steps S1 to S4 of this application. First, in step S1, the raw PCAP data is preprocessed, including removing Ethernet MAC frame header information to eliminate redundant data at the link layer. Simultaneously, IP addresses are anonymized, for example, mapping "192.168.1.10" to an irreversible random identifier "A1B2C3D4," and both the source and destination port numbers are set to zero to reduce sensitivity to specific network topology and port dependencies. Based on this, data packets are bidirectionally segmented into sessions based on 5-tuple information (anonymized IP address, transport layer protocol type, etc.), and data packets within the same session are sorted according to timestamp order, thus forming independent session streams with temporal continuity.

[0079] Taking a VPN communication session as an example, after session segmentation, the system selects the first M=5 data packets from the session stream as analysis objects. For each data packet, its IP / IPv6 header information is extracted as header data, and the corresponding application layer data is extracted as payload data. In this embodiment, the header data is converted into a fixed-length header byte sequence of 80 bytes, and the payload data is converted into a fixed-length payload byte sequence of 240 bytes, thus obtaining a unified structure representation for each data packet. Subsequently, the 5 data packets are concatenated sequentially according to their timestamps to form a continuous one-dimensional byte sequence with a total length of 1600 bytes, i.e., 5×(80+240)=1600.

[0080] Further, in step S4, the one-dimensional byte sequence is rearranged into a two-dimensional matrix structure according to preset rules. In this embodiment, the one-dimensional byte sequence is sequentially filled into a 40×40 two-dimensional matrix in row-major order, that is, every 40 bytes are filled into a row, forming a total of 40 rows, thereby realizing the mapping from one-dimensional to two-dimensional structure. Since the length of the one-dimensional sequence is 1600 bytes, which is exactly the same as the capacity of the 40×40 matrix, a complete mapping without redundancy or truncation is achieved. Finally, each byte value in the two-dimensional matrix is ​​directly mapped to a grayscale pixel value in the range of 0 to 255, thereby generating a single-channel grayscale image, and further normalization or data augmentation processing is performed on the grayscale image to improve the stability and generalization ability of the model training.

[0081] Thus, each network session is converted into a fixed-size, multi-level interactive traffic representation grayscale image. This image not only contains packet-level temporal structure information but also integrates byte-level header and payload feature information, thereby achieving a unified visual representation of encrypted network traffic.

[0082] Subsequently, the generated grayscale image is input into a deep learning classification model for feature learning and classification. In one specific implementation, an improved ResNet-50 convolutional neural network or a lightweight EfficientNet model can be used as the classifier. The model input is a 40×40×1 single-channel grayscale image. First, local texture features are extracted through multi-layer convolutional operations, such as the regular structure pattern of the TLS handshake phase, the distribution characteristics of encrypted payload data, and the temporal variation pattern across data packets. Then, multi-scale feature integration is achieved through residual connections or feature fusion modules. Finally, the corresponding traffic category result is output through a fully connected classification layer.

[0083] The model's final output may include, but is not limited to, the following categories: normal HTTPS webpage access traffic, VPN encrypted tunnel traffic (such as WireGuard or OpenVPN protocols), video streaming traffic, malicious encrypted communication traffic (such as command and control C2 communication), and suspicious scanning or data outflow behavior. For example, for the above VPN communication session, the model output may be "VPN traffic" with a high confidence score of 0.97; while for abnormal outbound encrypted traffic, it may output "malicious C2 communication" with a confidence score of 0.92.

[0084] Compared to traditional statistical feature-based methods (such as manual features based on average packet length, flow duration, byte mean or variance, etc.), the embodiments of this application do not rely on complex feature engineering design. Instead, they convert network traffic into grayscale images and use deep learning models to automatically learn multi-level feature representations, thereby significantly reducing the cost of manual modeling and improving feature representation capabilities.

[0085] Secondly, compared with traditional sequence-based modeling methods (such as support vector machines (SVM), random forests, or single LSTM networks), this method captures packet-level temporal relationships, byte-level structural information, and spatial texture patterns simultaneously through "multi-level interactive representation + graphical modeling". This enables the model to more comprehensively characterize the complex behavioral features in encrypted traffic, such as the periodic encryption structure of VPN traffic and the sudden abnormal patterns of malicious traffic.

[0086] Furthermore, compared to deep learning methods that are directly based on the original byte sequence (such as 1DCNN or RNN), this method maps the one-dimensional sequence into a two-dimensional image structure, enabling the convolutional neural network to fully leverage its advantages in local receptive field modeling, spatial invariance, and texture feature extraction, thereby significantly improving feature extraction efficiency and recognition accuracy.

[0087] Finally, in terms of practical application effects, the method of this application embodiment not only significantly improves the accuracy of traffic classification, but also enhances the ability to generalize the identification of unknown encryption protocols and new attack traffic.

[0088] Optionally, in some other embodiments of this application, after generating the multi-level interactive traffic representation grayscale image, a self-supervised contrastive learning training mechanism is introduced, specifically including: generating two different perturbation views for the same session flow as positive sample pairs, and images generated by different session flows as negative sample pairs, and training a feature encoding model for encrypted traffic representation learning by maximizing the feature similarity of positive sample pairs and minimizing the feature similarity of negative sample pairs, thereby improving the generalization recognition capability for unknown encrypted protocol traffic.

[0089] For example, in this embodiment, after generating the multi-level interactive traffic representation grayscale image, a self-supervised contrastive learning training mechanism is introduced to improve the model's representation and generalization capabilities for encrypted network traffic. For instance, for a VPN encrypted communication session stream Q, after processing by the method of this application, an original grayscale image I can be generated. This original grayscale image I fully expresses the structural features of the session stream under the multi-level interactive representation, including the packet temporal structure, header and load distribution, and spatial texture patterns. To construct self-supervised learning samples, two different data augmentation operations are performed on the original grayscale image I, thereby generating two different perturbation views I1 and I2. For example: The first perturbation method is slight pixel noise perturbation, which involves randomly adding tiny Gaussian noise to the original grayscale image I, causing some pixel values ​​to shift slightly within the range of 0–255. For example, a pixel value changes from 128 to 125 or 131, thus obtaining the enhanced view I1.

[0090] The second perturbation method is local occlusion enhancement. For example, in a 40×40 grayscale image, a 5×5 local area is randomly occluded, and the pixel value of the area is set to 0 or the average value is 128, thereby simulating the situation of local data loss or sampling omission in the network and obtaining the enhanced view I2.

[0091] At this point, both I1 and I2 are generated from the same original grayscale image I, and I corresponds to the same encrypted communication session stream Q. Therefore, I1 and I2 constitute a positive sample pair. Meanwhile, other grayscale images are selected from different session streams, such as image J generated from session stream T (from a regular HTTPS webpage access) and image K generated from session stream U (from video streaming communication). Since these session streams differ in communication behavior, protocol structure, and traffic patterns, I1 and J, I1 and K, I2 and J, and I2 and K all constitute negative sample pairs.

[0092] During training, I1 and I2 are input into a feature encoding network (such as ResNet or a lightweight CNN encoder) with shared parameters, resulting in feature vectors f(I1) and f(I2) respectively. By calculating the similarity between them (e.g., cosine similarity) and maximizing this similarity, the model learns a consistent feature representation of the same session under different perturbation conditions.

[0093] For example: f(I1) = [0.12, 0.85, 0.33, ...]; f(I2) = [0.10, 0.88, 0.31, ...]; The model optimization objective is to make its similarity as close to 1 as possible.

[0094] Meanwhile, for negative sample pairs, such as f(I1) and f(J), the model minimizes their similarity, making different types of traffic as separate as possible in the feature space. For example, VPN traffic and HTTP traffic are separated in the feature space, while malicious C2 traffic forms a clear boundary with normal traffic.

[0095] Since large-scale, accurate labels are often difficult to obtain for network traffic data, this method eliminates the need for manually labeled data, enabling training using a large amount of unlabeled PCAP traffic, thus significantly reducing data labeling costs. Secondly, by constructing different perturbation views of the same session flow as positive sample pairs, the model learns stable feature representations robust to changes in real-world network environments such as noise, packet loss, and local missing data, thereby improving its adaptability to complex network environments. Thirdly, by introducing different session flows as negative sample pairs, the model can form clear class separation boundaries in the feature space, enhancing its ability to distinguish between different types of traffic, such as VPN traffic, video traffic, and malicious encrypted communications.

[0096] Finally, when faced with unknown encryption protocols or zero-day attack traffic, this method learns the "traffic structure representation space" rather than fixed rule features, thus maintaining good generalization ability. This allows the model to still have high recognition accuracy and stability on unseen encrypted traffic types, which is significantly better than traditional methods based on supervised classification or handmade features.

[0097] In other embodiments of this application, after generating the multi-level interactive traffic representation grayscale image, the method introduces a fusion feature encoding structure of graph neural network and convolutional neural network. Specifically, it includes: taking each pixel or local pixel block in the grayscale image as a graph node, and using spatial adjacency and semantic association based on temporal order mapping as graph edges to construct corresponding traffic graph structure data; simultaneously, inputting the grayscale image into a convolutional neural network to extract local texture feature representation to obtain a first feature vector; and inputting the traffic graph structure data into a graph neural network for message passing and neighborhood aggregation calculation to obtain a second feature vector. The first feature vector and the second feature vector are fused to obtain a joint multimodal traffic representation vector, and the encrypted network traffic is classified and identified or anomaly detected based on the joint multimodal traffic representation vector. The feature fusion process includes at least one of splicing fusion, weighted fusion, or attention fusion.

[0098] Taking a 40×40 grayscale image generated by a VPN encrypted communication session as an example, this image is obtained by filling rows of a one-dimensional byte sequence, where each pixel corresponds to a byte value. First, the grayscale image is divided into several local pixel blocks, for example, by sliding a 2×2 or 4×4 window. Each pixel block can be regarded as a graph node. For example, the 2×2 pixel block in the upper left corner can be represented as node V1, which contains 4 adjacent byte values; adjacent pixel blocks are represented as nodes V2, V3, etc., thus mapping the entire grayscale image into graph structure data composed of multiple nodes.

[0099] When constructing a graph structure, the connections between nodes are based not only on spatial adjacency but also on semantic associations based on temporal order mapping. For example, strong connections are established between pixel blocks within the same data packet, while weak connections are established between pixel blocks that cross data packet boundaries but are temporally consecutive, thus forming graph edge relationships that combine spatial structure and temporal semantics. The resulting graph structure can reflect the inherent interaction relationships of network traffic after spatial unfolding.

[0100] In the feature extraction stage, the original grayscale image is first input into a convolutional neural network (CNN), such as a ResNet or EfficientNet structure, and local texture features are extracted through convolution operations. Specifically, CNN can identify local patterns formed by byte distribution in grayscale images, such as regular structure regions in the TLS handshake phase and random texture regions in the cryptographic payload phase, and finally outputs the first feature vector f1, which mainly characterizes local spatial features and texture distribution features.

[0101] Simultaneously, the constructed graph structure data is input into a graph neural network (GNN), such as a Graph Convolution Network (GCN) or a Graph Attention Network (GAT). In a GNN, each node receives information from neighboring nodes through a neighborhood aggregation mechanism and continuously updates its own representation through multi-layer message passing. For example, during the update process, node V1 fuses the feature information of its neighboring pixel blocks V2 and V3 to obtain a more globally dependent expression, ultimately yielding a second feature vector f2. This vector is used to represent the topological relationships and cross-regional interaction patterns of the traffic flow.

[0102] Subsequently, the first feature vector f1 extracted by the CNN and the second feature vector f2 extracted by the GNN are fused to obtain a joint multimodal traffic representation vector f. In one implementation, f1 and f2 can be directly concatenated to form a high-dimensional feature representation using vector concatenation. In another implementation, a weighted fusion method can be used, linearly combining f1 and f2 according to learnable weights. In yet another implementation, an attention mechanism can be introduced to adaptively allocate fusion weights according to the importance of different features, thereby enhancing the expressive power of key traffic features.

[0103] In this embodiment, by using CNN to model the local texture of grayscale images, the spatial pattern features formed after byte-level unpacking of encrypted traffic can be effectively captured, giving the model a strong ability to extract local features. Secondly, by further constructing the grayscale image into a graph structure and introducing GNN modeling, the model can overcome the limitations of the local receptive field of traditional two-dimensional convolution, further capturing long-distance dependencies across regions and data packets, thereby enhancing the global modeling ability for complex session behaviors. Thirdly, by fusing the feature representations of CNN and GNN, the model possesses both "spatial texture perception ability" and "topological relationship modeling ability," enabling a more comprehensive characterization of multi-level interaction features in encrypted network traffic, thus significantly improving the accuracy of identifying VPN traffic, encrypted malicious communication, and unknown protocol traffic.

[0104] Please see Figure 2 This is a schematic diagram of an encrypted network traffic processing system based on multi-level interactive representation, provided in one embodiment of this application. Figure 2 As shown, the system includes: at least one processor, and at least one memory communicatively connected to the processor.

[0105] The processor and the memory are connected via a communication interface or internal bus structure. The processor is used to call and execute program instructions stored in the memory, thereby realizing the processing and analysis of encrypted network traffic. In some embodiments, the processor can be located in a single computing device or deployed in a distributed manner across multiple computing nodes to improve the system's processing power and scalability.

[0106] Specifically, when the processor executes the program instructions stored in the memory, it can perform the encrypted network traffic processing method based on multi-level interactive representation as described in the above embodiments. For example, the processor can preprocess the collected raw PCAP format network traffic data, perform session segmentation and sorting operations; further, extract the header data and payload data of each independent session stream and generate a fixed-length byte sequence; then, concatenate the byte sequences of multiple data packets in a time series to form a one-dimensional byte sequence; rearrange the one-dimensional byte sequence into a two-dimensional matrix structure and map it to generate a single-channel grayscale image; finally, complete the classification and recognition or behavior detection of encrypted network traffic based on the grayscale image.

[0107] The processor may be a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), or a combination thereof. In some alternative embodiments, the processor may further include a dedicated hardware acceleration unit, such as an application-specific integrated circuit (ASIC), a programmable logic device (such as an FPGA), or other forms of hardware acceleration modules, to improve the processing efficiency of large-scale network traffic data.

[0108] The memory is used to store program instructions and related data that can be executed by the processor. Specifically, the memory may store the operating system, traffic processing program, model parameters, and various functional module programs for implementing the multi-level interactive representation encrypted network traffic processing method. In some embodiments, the memory may also store raw PCAP data acquired through the network, preprocessed session data, one-dimensional byte sequences, and generated grayscale image data, etc.

[0109] The memory may include a program storage area and a data storage area. The program storage area stores program instructions required to execute the above method, and the data storage area stores intermediate and result data generated during operation. In some optional embodiments, the memory may include high-speed random access memory (RAM) or non-volatile memory, such as flash memory, disk storage, or solid-state drive.

[0110] Furthermore, in some embodiments, the memory may also include a remote storage unit connected to the device containing the processor via a wired or wireless network to achieve distributed data storage and processing. The network may include, but is not limited to, the Internet, a local area network, an enterprise intranet, or a mobile communication network.

[0111] Through the above structural design, the encrypted network traffic processing system based on multi-level interactive representation provided in this application can realize the automated collection, structured representation, image conversion and intelligent identification and analysis of encrypted network traffic, thus having good application value and scalability in application scenarios such as network security monitoring, abnormal traffic detection and encrypted communication identification.

[0112] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0113] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make modifications, alterations, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for processing encrypted network traffic based on multi-level interactive representation, characterized in that, Includes the following steps: S1. Preprocess the pre-acquired raw PCAP format network traffic data to obtain preprocessed raw PCAP format network traffic data. Based on the five-tuple information included in the preprocessed raw PCAP format network traffic data, perform bidirectional session segmentation on the data packets in the preprocessed raw PCAP format network traffic data. Sort the data packets in the same session according to the timestamp to form corresponding independent session streams. S2. For each independent session stream, select the first M data packets, and extract the header data and payload data for each data packet. Further, based on the header data and payload data, obtain the corresponding fixed-length header byte sequence and payload byte sequence. S3. In chronological order, the header byte sequence and payload byte sequence of the M data packets are concatenated and stacked vertically to obtain a one-dimensional byte sequence of fixed length; S4. The one-dimensional byte sequence is rearranged into a two-dimensional matrix of a preset size according to a preset rule, and the byte values ​​in the two-dimensional matrix are mapped to grayscale pixel values ​​to generate a multi-level interactive flow representation grayscale image.

2. The encrypted network traffic processing method based on multi-level interactive representation according to claim 1, characterized in that, The preprocessing process for pre-acquired raw PCAP format network traffic data includes: The Ethernet MAC frame header is removed from the original PCAP format network traffic data. The network layer IP address in the five-tuple information included in the original PCAP format network traffic data is anonymized and the transport layer port number in the five-tuple information is set to zero to obtain the preprocessed original PCAP format network traffic data. The anonymization process is either a random mapping or an irreversible mapping process based on a hash function; The five-tuple information includes: network layer IP address, transport layer port, and transport network protocol; the network layer IP address includes source IP address and destination IP address; the transport layer port includes source port number and destination port number.

3. The encrypted network traffic processing method based on multi-level interactive representation according to claim 1, characterized in that, In step S2, if the number of data packets in the independent session stream is less than M, it is padded with zero-based data packets. In the case where the data packets in the independent session stream are IP / IPv6 packets, the IP header of the data packet is used as the header data, and the application layer data is extracted as the payload data.

4. The encrypted network traffic processing method based on multi-level interactive representation according to any one of claims 1 to 3, characterized in that, Step S2 involves obtaining a fixed-length header byte sequence and a payload byte sequence based on the header data and payload data, specifically including: The header data is truncated or padded using a first fixed length L1 to obtain a header byte sequence of fixed length. The load data is truncated or padded using a second fixed length L2 to obtain a fixed-length load byte sequence.

5. The encrypted network traffic processing method based on multi-level interactive representation according to claim 4, characterized in that, The first fixed length L1 is 80 bytes, and the second fixed length L2 is 240 bytes.

6. The encrypted network traffic processing method based on multi-level interactive representation according to claim 5, characterized in that, Step S3 specifically includes: reading the header byte sequence and payload byte sequence of each of the M data packets in chronological order according to their timestamps, concatenating them with the header byte sequence first and the payload byte sequence last, and then connecting the concatenation results of the first to the Mth data packets end to end to form a continuous one-dimensional byte sequence.

7. The encrypted network traffic processing method based on multi-level interactive representation according to claim 6, characterized in that, Step S4, which rearranges the one-dimensional byte sequence into a two-dimensional matrix of a preset size according to a preset rule, specifically includes: The byte data in the one-dimensional byte sequence is sequentially filled into each row of the two-dimensional matrix from left to right. After the current row is filled, the filling continues from the left side of the next row until all the byte data in the one-dimensional byte sequence is filled, thereby forming a two-dimensional matrix of a preset size.

8. The encrypted network traffic processing method based on multi-level interactive representation according to claim 7, characterized in that, The size of the two-dimensional matrix is ​​N×W, where W is the preset image width and N is the ratio of the length of the one-dimensional byte sequence to W; the length of the one-dimensional byte sequence is M×(L1+L2).

9. The encrypted network traffic processing method based on multi-level interactive representation according to claim 8, characterized in that, The multi-level interactive flow indicates that the grayscale image is a single-channel grayscale image with a pixel value range of 0 to 255.

10. A cryptographic network traffic processing system based on multi-level interactive representation, characterized in that, include: At least one processor; The processor includes at least one memory communicatively connected to the processor, wherein the memory stores program instructions executable by the processor, and the processor invokes the program instructions to execute the encrypted network traffic processing method based on multi-level interactive representation as described in any one of claims 1-9.

Images