Method, system and device for encrypted traffic classification based on structural perception compression

Abstract

The present application belongs to the technical field of encrypted traffic classification, and particularly relates to an encrypted traffic classification method, system and device based on structure perception compression. The encrypted traffic classification method provided by the present application performs a non-uniform compression operation according to the structure sensitivity related to category discrimination, so that a high-sensitive grid block performs a low compression rate to retain more fine-grained features and ensure the completeness of category discrimination information, and a low-sensitive grid block performs a high compression rate to aggregate into a small amount of features to reduce redundant calculation. Statistical enhancement information is introduced, and consistency constraint processing is applied to ensure that the compressed structure features remain consistent with the statistical enhancement information before entering subsequent classification discrimination, thereby improving the classification accuracy and stability.

Description

Technical Field

[0001] This invention belongs to the field of encrypted traffic classification technology, specifically relating to encrypted traffic classification methods, systems, and devices based on structure-aware compression. Background Technology

[0002] With the widespread application of various encryption mechanisms, the original content in encrypted traffic is difficult to use directly for subsequent identification and analysis. In tasks such as encrypted traffic object identification, anomaly detection, and classification, existing technologies are gradually shifting towards analyzing directly obtainable behavioral characteristics in encrypted traffic, such as length variations, time distribution, direction variations, duration, and their statistical combinations. These characteristics can reflect the category patterns of traffic objects without relying on the parsing of the original content.

[0003] Currently, the main methods for processing observable behavioral characteristics of encrypted traffic include the following categories: ① Traditional classification methods based on manual statistical features These methods typically extract statistical features such as average value, variance, proportional relationship, switching frequency, and duration from encrypted traffic, and then use classifiers such as random forest, support vector machine, KNN, and XGBoost to complete the identification. While these methods are relatively simple to implement, they heavily rely on human experience to construct features, making it difficult to automatically discover higher-order local structural patterns and overall variation rules. They also have weak adaptability to complex objects, cross-scene data, and fine-grained categories.

[0004] ② Deep learning methods based on sequence modeling These methods typically represent encrypted traffic as sequences of varying lengths, temporal distributions, orientation changes, or other one-dimensional behavioral feature sequences, and then input them into networks such as 1D-CNN, RNN, LSTM, GRU, and Transformer for modeling. While these methods offer stronger automatic representation capabilities than manual feature methods, their inputs are usually biased towards single-sequence formats, making it difficult to simultaneously and fully characterize the coupled features of an object across multiple dimensions, including local texture, overall layout, temporal evolution, and frequency distribution.

[0005] ③ Image classification methods based on visual representation These methods map the characteristics of encrypted traffic behavior into image formats such as grayscale images, heatmaps, spectrograms, and multi-channel feature maps, and then use visual networks such as CNNs, ViTs, and Swin Transformers to extract representations. These methods can naturally utilize visual models to capture local textures and overall structure, and are particularly suitable for representing complex temporal-structural coupling patterns. However, when using high-resolution input, the visual encoder often generates a large number of image blocks or feature units, significantly increasing subsequent computational costs and storage pressure, which is not conducive to efficient discrimination under limited resource conditions.

[0006] ④ Classification methods based on multi-source feature fusion These methods attempt to classify encrypted traffic using visual features, statistical features, or behavioral sequence features simultaneously. While this approach can improve representation richness, many existing solutions remain at the level of simple splicing or conventional fusion, lacking specific design tailored to the characteristics of the target task. In particular, if the semantic offset problem after compression is not compensated for before the high-resolution visual representation enters the subsequent discrimination module, it can easily lead to unstable feature representation, insufficient cross-scene generalization, and a decrease in actual discrimination accuracy.

[0007] In summary, the above methods struggle to balance high-resolution representation preservation with computational efficiency, the unified compression method fails to retain the category discrimination structure, and the multi-source feature fusion lacks stable consistency constraints, leading to semantic drift during compression and mapping, which affects the accuracy and stability of encrypted traffic classification. Summary of the Invention

[0008] To address the problems in the background technology, the present invention provides a method, system, and apparatus for classifying encrypted traffic based on structure-aware compression.

[0009] The technical solution of the present invention is as follows: This invention provides a method for classifying encrypted traffic based on structure-aware compression, comprising: S1: Acquire the encrypted traffic data to be analyzed and extract observable behavioral features; S2: Based on observable behavioral characteristics, spatial view, temporal view, frequency view and statistical enhancement channel are constructed and then stitched together to generate a traffic fingerprint image; S3: The traffic fingerprint image is processed by visual encoding to obtain the first feature sequence; S4: Calculate the score of each feature unit in the first feature sequence on multiple preset indicators. For each preset indicator, normalize the scores of all feature units and then sum them by weight to obtain the structural sensitivity score of the first feature sequence. After mapping the feature units in the first feature sequence to the two-dimensional grids corresponding to the spatial view, temporal view, and frequency view, the average structural sensitivity of all feature units within a two-dimensional grid block is calculated based on the structural sensitivity score of the first feature sequence, which is used as the overall sensitivity of the grid block. The output quota of each grid block is calculated based on the overall sensitivity of the grid block. According to the output quota of each grid block, a compression operation is performed on multiple feature units within the grid block. The compressed feature sequences of each view are then concatenated according to the original order of the views to obtain the second feature sequence. S5: Based on observable behavioral features, extract statistical feature vectors, concatenate them, and construct a statistically enhanced embedding representation; S6: The second feature sequence is processed by feature mapping and then subjected to consistency constraints using statistical augmented embedding representation to obtain the augmented feature sequence; S7: Enhanced feature sequences, statistically enhanced embedding representations, and task constraints are combined in a preset order and then classified.

[0010] Based on the above-described encrypted traffic classification method based on structure-aware compression, the preset indicators in S4 include local length change rate, time interval fluctuation intensity, direction change density, frequency domain energy concentration, frequency band peak significance, multi-view splicing boundary significance, intermediate layer response intensity, and gradient sensitivity.

[0011] Based on the structure-aware compression-based encrypted traffic classification method described above, step S4 involves normalizing the scores of all feature units for each preset index and then weighted summing them to obtain the structure sensitivity score of the first feature sequence, specifically as follows: For each preset index, the scores of all feature units are normalized to the [0,1] interval; After assigning weights to each preset index, the weighted sums are obtained to get the structural sensitivity score of each feature unit; after concatenation, the structural sensitivity score of the first feature sequence is obtained.

[0012] Based on the structure-aware compression-based encrypted traffic classification method described above, step S4, which calculates the output quota for each grid block based on the overall sensitivity of the grid block, is performed as follows: The average sensitivity of each grid block is raised to the power of γ to calculate the relative retention weight. The relative retention weight is multiplied by the total target output, and after rounding and adjustment, the output quota of each grid block is obtained.

[0013] Based on the structure-aware compression-based encrypted traffic classification method described above, step S4, which involves performing compression operations on multiple feature units within each grid block according to the output quota of that grid block, specifically includes: If the output quota is equal to 1, the original feature vector is retained without compression; If the output quota is greater than 1, then local aggregation or repeated operation is performed on the feature units.

[0014] Based on the structure-aware compression-based encrypted traffic classification method described above, in step S6, the second feature sequence is processed by feature mapping and subjected to consistency constraints using statistical augmented embedding representation to obtain an enhanced feature sequence, specifically: After feature mapping, the cosine similarity or mean square error between the mean vector of all feature vectors in the mapped enhanced feature sequence and the statistical enhanced embedding representation is calculated as the alignment loss value. The alignment loss value is used for optimization to obtain the enhanced feature sequence.

[0015] Based on the structure-aware compression-based encrypted traffic classification method described above, the observable behavioral features in S1 include: length change data, timestamp data, time interval data, direction change data, duration data, and count data.

[0016] Based on the structure-aware compression-based encrypted traffic classification method described above, the statistical feature vector in S5 includes: average length, length variance, average time interval, interval volatility, duration, total number of packets, uplink / downlink byte ratio, and burstiness.

[0017] The present invention also provides an encrypted traffic classification system based on structure-aware compression, comprising: Preprocessing module: Used to acquire encrypted traffic data to be analyzed and extract observable behavioral features; Traffic fingerprint image generation module: Based on observable behavioral features, it constructs spatial view, temporal view, frequency view and statistical enhancement channel, and then stitches them together to generate a traffic fingerprint image; Visual encoding module: The traffic fingerprint image is processed by visual encoding to obtain the first feature sequence; Structure-aware compression module: used to calculate the score of each feature unit in the first feature sequence on multiple preset indicators. For each preset indicator, the scores of all feature units are normalized and then weighted and summed to obtain the structure sensitivity score of the first feature sequence. After mapping the feature units in the first feature sequence to the two-dimensional grids corresponding to the spatial view, temporal view, and frequency view, the average structural sensitivity of all feature units within a two-dimensional grid block is calculated based on the structural sensitivity score of the first feature sequence, which is used as the overall sensitivity of the grid block. The output quota of each grid block is calculated based on the overall sensitivity of the grid block. According to the output quota of each grid block, a compression operation is performed on multiple feature units within the grid block. The compressed feature sequences of each view are then concatenated according to the original order of the views to obtain the second feature sequence. Statistical augmentation building block: Based on observable behavioral features, extract statistical feature vectors, concatenate them, and construct a statistically augmented embedding representation; Consistency alignment module: The second feature sequence is processed by feature mapping and consistency constraints are applied using statistical augmented embedding representation to obtain the augmented feature sequence; Classification module: Enhanced feature sequences, statistically enhanced embedding representations, and task constraints are combined in a preset order and then classified.

[0018] The present invention also provides an encrypted traffic classification device based on structure-aware compression, comprising a processor and a memory, wherein the processor implements the encrypted traffic classification method based on structure-aware compression when executing a computer program stored in the memory.

[0019] Beneficial effects: The encrypted traffic classification method provided by this invention performs non-uniform compression based on the structural sensitivity related to category discrimination. This results in high-sensitivity grid blocks undergoing low compression rates to retain more fine-grained features and ensure the integrity of category discrimination information, while low-sensitivity grid blocks undergo high compression rates to aggregate into a smaller number of features, reducing redundant computation. Furthermore, the introduction of statistical enhancement information and the application of consistency constraints ensure that the compressed structural features remain consistent with the statistical enhancement information before entering subsequent classification, thereby improving classification accuracy and stability. Detailed Implementation

[0020] The following examples are intended to illustrate the present invention, and not to further limit the invention.

[0021] Example 1

[0022] This embodiment provides a method for classifying encrypted traffic based on structure-aware compression, including:

[0023] S1: Acquire the encrypted traffic data to be analyzed and extract observable behavioral features.

[0024] In this embodiment, the encrypted traffic data to be analyzed is divided according to preset rules (five-tuple, session ID, time window or fixed number of packets) to extract observable behavioral features.

[0025] The observable behavioral features refer to the feature information that can be directly obtained through the external behavior of encrypted traffic without relying on the parsing of the original content, including: length change data, timestamp data, time interval data, direction change data, duration data, and count data.

[0026] Specifically, length variation data represents the trend of packet length changes in each data packet or stream session, which can reflect the message structure characteristics of different protocols or applications.

[0027] Timestamp data represents the absolute time of arrival of each packet, used to reconstruct the packet sequence and event order.

[0028] Time interval data, representing the arrival interval between consecutive packets, is used to capture traffic rhythms, bursts, and interval distribution patterns.

[0029] Directional change data indicates a switch in the direction of the data flow (upstream / downstream), which can reveal the interaction pattern between the client and the server.

[0030] Duration data, representing the duration of a streaming session, helps distinguish between long-lived and short-lived connections.

[0031] Count data, representing the number of statistical packets, the count of specific types of events, or the count of bursts, can be used to reflect traffic density and communication intensity.

[0032] This invention uses observable behavioral features to help distinguish different applications, protocols, or attack types during subsequent classification. After uniform preprocessing (duplicate removal, truncation, and normalization), the observable behavioral features ensure comparability between different traffic objects, thereby improving classification accuracy and stability.

[0033] S2: Based on observable behavioral characteristics, spatial view, temporal view, frequency view and statistical enhancement channel are constructed and then stitched together to generate a traffic fingerprint image.

[0034] Based on the observable behavioral features extracted in step S1, a high-resolution traffic fingerprint image is generated.

[0035] The traffic fingerprint image is a two-dimensional or multi-channel image representation used for subsequent visual encoding.

[0036] The traffic fingerprint image is preferably a high-resolution two-dimensional matrix with a size that can be set from 512×512 to 2048×2048, preferably 1024×1024, in order to retain more local details and overall structure.

[0037] In the specific implementation process, the spatial view is constructed in the following way.

[0038] Length variation data, direction variation data, and time interval data are mapped onto a two-dimensional grid to form an image representation with spatial layout information.

[0039] The time view is constructed as follows.

[0040] Time interval data, timestamp data, and duration data are mapped to heatmaps, texture maps, or multi-channel feature maps to reflect the temporal dynamic characteristics of objects.

[0041] The frequency view is constructed as follows.

[0042] Frequency domain transformations, such as FFT, STFT, and wavelet transform, are performed on length-varying data and time-interval data to obtain frequency spectra or time-frequency joint graphs, which are used to characterize periodic patterns, frequency band energy distribution, and rhythm information.

[0043] The statistical enhancement channel is constructed as follows.

[0044] Encode duration data, orientation change data, and count data into additional channels or structured meta-information to enhance the task relevance of image representation.

[0045] The multi-view stitching operation is as follows.

[0046] Spatial view, time view, frequency view and statistical enhancement channel are stitched together according to preset layout or adaptive layout to form a unified panoramic traffic fingerprint image.

[0047] S3: The traffic fingerprint image is processed by visual encoding to obtain the first feature sequence. .

[0048] Visual coding can be implemented using ViT, Swing Transformer, hybrid networks of CNN and Transformer, or high-resolution image coding networks.

[0049] Preferably, a concatenated structure of "local detail encoding and global structural modeling" is adopted to simultaneously take into account both high-frequency local textures and long-range global dependencies.

[0050] The number of feature units N0 before compression can be set from 1024 to 8192, preferably 4096.

[0051] The feature unit represents the basic representation unit in the first feature sequence obtained after encoding the traffic fingerprint image.

[0052] S4: Calculate the score of each feature unit in the first feature sequence on multiple preset indicators. For each preset indicator, normalize the scores of all feature units and then sum them by weight to obtain the structural sensitivity score of the first feature sequence. After mapping the feature units in the first feature sequence to the two-dimensional grids corresponding to the spatial view, temporal view, and frequency view, the average structural sensitivity of all feature units within a two-dimensional grid block is calculated based on the structural sensitivity score of the first feature sequence, which is used as the overall sensitivity of the grid block. The output quota of each grid block is calculated based on the overall sensitivity of the grid block. According to the output quota of each grid block, a compression operation is performed on multiple feature units within the grid block. The compressed feature sequences of each view are then concatenated according to the original order of the views to obtain the second feature sequence.

[0053] Unlike existing technologies that perform uniform downsampling, uniform pooling, or simple aggregation on all feature units, the compression of this invention does not aim solely at "reducing the number of features," but rather at "preserving the class discriminative structure and improving classification stability under a fixed budget." To this end, this invention calculates the structural sensitivity for each feature unit or its corresponding region and performs non-uniform compression accordingly.

[0054] Preferably, the preset indicators include local length change rate, time interval fluctuation intensity, direction change density, frequency domain energy concentration, frequency band peak significance, multi-view splicing boundary significance, intermediate layer response intensity, and gradient sensitivity.

[0055] Specifically, the local length change rate represents the magnitude of change in the packet length corresponding to each feature unit. It can identify regions with high changes and is usually more sensitive to classification.

[0056] The intensity of time interval fluctuation indicates the fluctuation of consecutive room intervals and can reflect changes in interaction patterns.

[0057] Directional change density indicates that areas with high uplink / downlink switching frequency may carry key discrimination information.

[0058] Frequency domain energy concentration represents the region where energy is concentrated in the frequency spectrum, indicating strong periodicity of the flow.

[0059] Frequency band peak significance: Frequency bands with high peak values ​​usually contain key communication rhythm information.

[0060] The salience of multi-view stitching boundaries: Boundary information at the stitching point of multiple views may carry important structures across views.

[0061] The strength of the intermediate layer response means that tokens with high activation strength in the intermediate layer of the visual encoding network are usually more critical.

[0062] Gradient sensitivity is calculated by backpropagation, which uses the gradient of a feature with respect to the output class probability to represent the importance of each feature unit for the discrimination.

[0063] In one scenario, when focusing solely on packet length changes to differentiate between VPN and non-VPN traffic, the "local length change rate" can be used as a structural sensitivity indicator.

[0064] At this point, the structural sensitivity score for .

[0065] in It is the i-th feature unit. It is the function for calculating the corresponding length change range.

[0066] In one scenario, a multi-indicator combination strategy is used. Preferably, for each preset indicator, the scores of all feature units are normalized and then weighted and summed to obtain the structural sensitivity score of the first feature sequence. Specifically: For each preset index, the scores of all feature units are normalized to the [0,1] interval; After assigning weights to each preset index, the weighted sums are obtained to get the structural sensitivity score of each feature unit; after concatenation, the structural sensitivity score of the first feature sequence is obtained.

[0067] We have K structural sensitivity indicators (e.g., local length change rate, time interval fluctuation, direction change density). First, we normalize each indicator. The score is the score after normalization.

[0068] Then, the structural sensitivity score of the feature unit is obtained by weighting the various indicators: .

[0069] ≥0 indicates that the weight of the k-th indicator satisfies... .

[0070] The weights can be automatically optimized through gradient analysis, feature contribution analysis, expert experience, or meta-learning methods during the training phase.

[0071] The final concatenation yields the structural sensitivity score of the first feature sequence. .

[0072] This invention calculates structural sensitivity and clearly quantifies the importance of each feature unit, enabling non-uniform compression to preferentially retain highly sensitive regions and avoid the loss of key information by simple uniform downsampling.

[0073] Furthermore, non-uniform compression operations are performed using structural sensitivity, as follows.

[0074] First, the feature units in the first feature sequence are mapped onto the two-dimensional grids corresponding to the spatial view, temporal view, and frequency view, establishing a correspondence between the feature units and the positions of the two-dimensional grids.

[0075] Then, the two-dimensional mesh is divided into several mesh blocks (each block contains multiple feature units), and the average structural sensitivity of all feature units within each two-dimensional mesh block is calculated as the overall sensitivity of that mesh block.

[0076] The calculation formula is as follows.

[0077] . This indicates the number of feature units contained in the current mesh block.

[0078] Next, the output quota for each grid block is calculated based on the overall sensitivity of the grid blocks, as follows: The average sensitivity of each grid block is raised to the power of γ to calculate the relative retention weight. The relative retention weight is multiplied by the total number of target outputs N, and after rounding and adjustment, the output quota of each grid block is obtained, ensuring that each highly sensitive unit has at least one output feature.

[0079] Among them, through the formula To calculate the relative retention weight γ≥1 can adjust the effect of sensitivity on compression ratio (γ=1 is linear, γ>1 emphasizes the high sensitivity region).

[0080] Through formula To calculate the output quota for each grid block ,in This indicates the rounding operation.

[0081] Next, based on the output quota of each grid block, a compression operation is performed on multiple feature units within that grid block, specifically: If the output quota is equal to 1, the original feature vector is retained without compression, that is, the original feature vector is used directly.

[0082] If the output quota is greater than 1, then local aggregation or repeated operations are performed on the feature units. This can be done by using a linear projection layer or a small multilayer perceptron to map the original features to a unified dimension while preserving the discriminative information.

[0083] For low-sensitivity feature units, i.e. Feature units close to 0 can be pooled and aggregated, with pooling methods including average pooling, max pooling, or attention-weighted pooling.

[0084] Finally, the compressed feature sequences of each view are concatenated according to the original order of the views to form an output sequence V′ of uniform length N, which is the second feature sequence.

[0085] This invention does not simply downsample high-resolution traffic fingerprint images, nor does it uniformly compress feature units. Instead, it performs non-uniform compression based on the structural sensitivity related to category discrimination. This results in high-sensitivity grid blocks being compressed at a low rate to retain more fine-grained features and ensure the integrity of category discrimination information, while low-sensitivity grid blocks are compressed at a high rate to aggregate into a smaller number of features and reduce redundant computation.

[0086] S5: Based on observable behavioral features, extract statistical feature vectors, concatenate them, and construct a statistically enhanced embedding representation.

[0087] The statistical feature vector includes: average length, length variance, average time interval, interval volatility, duration, total number of packets, uplink / downlink byte ratio, and burstiness.

[0088] Specifically, average length refers to the average packet length, used to distinguish between short message-intensive applications (such as chat) and long message applications.

[0089] Length variance represents the fluctuation of packet length, reflecting the burstiness of traffic and protocol differences.

[0090] The average time interval represents the arithmetic mean of all consecutive packet intervals and reflects the communication rhythm.

[0091] Interval fluctuation, representing the variance of the time interval, measures the stability of the flow rhythm.

[0092] Duration indicates the total duration of the streaming session and is used to distinguish between long-lived and short-lived connections.

[0093] Burst frequency indicates the frequency of high-density packet occurrences, reflecting concentrated or sudden traffic patterns.

[0094] The construction method can be represented in any of the following ways.

[0095] Structured metadata fields: Each statistical feature vector is recorded as a separate field (such as a JSON structure or a data table column) for easy visualization or subsequent processing.

[0096] Discretized attribute labels: Classify continuous statistics, such as the average packet length as "short / medium / long" and the interval volatility as "low / medium / high", to facilitate the model's learning of classification features.

[0097] Vectorized embedding: Combining all statistical features into vectors, which can be directly projected or aligned with the visual token sequence.

[0098] As supplementary information fragments in the discriminative input: statistical features can be encoded as cue words or embedded fragments and spliced ​​before / after the visual feature sequence to enhance the discriminative ability.

[0099] Statistical embedding sequences aligned with visual features: Statistical vectors are mapped to the same discriminative space (via linear projection or MLP) and aligned with visual feature sequences by tokens as multimodal inputs.

[0100] S6: The second feature sequence is processed through feature mapping and subjected to consistency constraints using statistically enhanced embedding representation to obtain the enhanced feature sequence. Specifically: After feature mapping, the cosine similarity or mean square error between the mean vector of all feature vectors in the mapped enhanced feature sequence and the statistical enhanced embedding representation is calculated as the alignment loss value. The alignment loss value is used for optimization to obtain the enhanced feature sequence.

[0101] This invention introduces statistical enhancement information and applies consistency constraints to ensure that the compressed structural features remain consistent with the statistical enhancement information before entering subsequent classification and discrimination.

[0102] S7: Enhanced feature sequences, statistically enhanced embedding representations, and task constraints are combined in a preset order and then classified.

[0103] The resulting discriminant sequence combines compressed structural information, statistical augmentation information, and task constraint information, thereby improving classification accuracy and stability.

[0104] The task constraints include: category set description, output format constraints, sampling window information, and object type identifier.

[0105] The classification results can be further used for object recognition, anomaly detection, pattern differentiation, and data analysis tasks.

[0106] The encrypted traffic classification method provided by this invention performs non-uniform compression based on the structural sensitivity related to category discrimination. This results in high-sensitivity grid blocks undergoing low compression to retain more fine-grained features and ensure the integrity of category discrimination information, while low-sensitivity grid blocks undergo high compression to aggregate into a smaller number of features, reducing redundant computation. Furthermore, statistical enhancement information is introduced, and consistency constraints are applied to ensure that the compressed structural features remain consistent with the statistical enhancement information before entering subsequent classification, thereby improving classification accuracy and stability.

[0107] Furthermore, the classification model corresponding to the encrypted traffic classification method provided in this invention constructs a teacher branch during the training phase. The teacher branch and student branch receive the same traffic fingerprint image input, but the teacher branch uses uncompressed features or a higher feature retention rate than the student branch to obtain a more comprehensive, high-resolution representation. Knowledge transfer from the teacher branch to the student branch is used to compensate for the information loss caused by feature compression. The total loss function during training is a weighted average of the supervised classification loss and the knowledge transfer loss. After training, only the student branch is retained for deployment. Since the number of compressed features is fixed, the input length is controllable, facilitating resource budget management and efficient inference.

[0108] This invention also provides an encrypted traffic classification system based on structure-aware compression, comprising: Preprocessing module: Used to acquire encrypted traffic data to be analyzed and extract observable behavioral features; Traffic fingerprint image generation module: Based on observable behavioral features, it constructs spatial view, temporal view, frequency view and statistical enhancement channel, and then stitches them together to generate a traffic fingerprint image; Visual encoding module: The traffic fingerprint image is processed by visual encoding to obtain the first feature sequence; Structure-aware compression module: used to calculate the score of each feature unit in the first feature sequence on multiple preset indicators. For each preset indicator, the scores of all feature units are normalized and then weighted and summed to obtain the structure sensitivity score of the first feature sequence. After mapping the feature units in the first feature sequence to the two-dimensional grids corresponding to the spatial view, temporal view, and frequency view, the average structural sensitivity of all feature units within a two-dimensional grid block is calculated based on the structural sensitivity score of the first feature sequence, which is used as the overall sensitivity of the grid block. The output quota of each grid block is calculated based on the overall sensitivity of the grid block. According to the output quota of each grid block, a compression operation is performed on multiple feature units within the grid block. The compressed feature sequences of each view are then concatenated according to the original order of the views to obtain the second feature sequence. Statistical augmentation building block: Based on observable behavioral features, extract statistical feature vectors, concatenate them, and construct a statistically augmented embedding representation; Consistency alignment module: The second feature sequence is processed by feature mapping and consistency constraints are applied using statistical augmented embedding representation to obtain the augmented feature sequence; Classification module: Enhanced feature sequences, statistically enhanced embedding representations, and task constraints are combined in a preset order and then classified.

[0109] The present invention also provides an encrypted traffic classification device based on structure-aware compression, comprising a processor and a memory, wherein the processor implements the encrypted traffic classification method based on structure-aware compression when executing a computer program stored in the memory.

[0110] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for classifying encrypted traffic based on structure-aware compression, characterized in that, include: S1: Acquire the encrypted traffic data to be analyzed and extract observable behavioral features; S2: Based on observable behavioral characteristics, spatial view, temporal view, frequency view and statistical enhancement channel are constructed and then stitched together to generate a traffic fingerprint image; S3: The traffic fingerprint image is processed by visual encoding to obtain the first feature sequence; S4: Calculate the score of each feature unit in the first feature sequence on multiple preset indicators. For each preset indicator, normalize the scores of all feature units and then sum them by weight to obtain the structural sensitivity score of the first feature sequence. After mapping the feature units in the first feature sequence to the two-dimensional grids corresponding to the spatial view, temporal view, and frequency view, the average structural sensitivity of all feature units within a two-dimensional grid block is calculated based on the structural sensitivity score of the first feature sequence, which is used as the overall sensitivity of the grid block. The output quota of each grid block is calculated based on the overall sensitivity of the grid block. According to the output quota of each grid block, a compression operation is performed on multiple feature units within the grid block. The compressed feature sequences of each view are then concatenated according to the original order of the views to obtain the second feature sequence. S5: Based on observable behavioral features, extract statistical feature vectors, concatenate them, and construct a statistically enhanced embedding representation; S6: The second feature sequence is processed by feature mapping and then subjected to consistency constraints using statistical augmented embedding representation to obtain the augmented feature sequence; S7: Enhanced feature sequences, statistically enhanced embedding representations, and task constraints are combined in a preset order and then classified.

2. The encrypted traffic classification method based on structure-aware compression according to claim 1, characterized in that, The preset indicators mentioned in S4 include local length change rate, time interval fluctuation intensity, direction change density, frequency domain energy concentration, frequency band peak significance, multi-view splicing boundary significance, intermediate layer response intensity, and gradient sensitivity.

3. The encrypted traffic classification method based on structure-aware compression according to claim 1, characterized in that, S4 describes the process of normalizing the scores of all feature units for each preset index and then summing them using a weighted method to obtain the structural sensitivity score of the first feature sequence, specifically as follows: For each preset index, the scores of all feature units are normalized to the [0,1] interval; After assigning weights to each preset index, the weighted sums are obtained to get the structural sensitivity score of each feature unit; after concatenation, the structural sensitivity score of the first feature sequence is obtained.

4. The encrypted traffic classification method based on structure-aware compression according to claim 1, characterized in that, S4 describes the calculation of the output quota for each grid block based on the overall sensitivity of the grid blocks, as follows: The average sensitivity of each grid block is raised to the power of γ to calculate the relative retention weight. The relative retention weight is multiplied by the total target output, and after rounding and adjustment, the output quota of each grid block is obtained.

5. The encrypted traffic classification method based on structure-aware compression according to claim 1, characterized in that, S4 describes performing a compression operation on multiple feature units within each grid block based on the output quota of that grid block, specifically as follows: If the output quota is equal to 1, the original feature vector is retained without compression; If the output quota is greater than 1, then local aggregation or repeated operation is performed on the feature units.

6. The encrypted traffic classification method based on structure-aware compression according to claim 1, characterized in that, S6 The second feature sequence is processed by feature mapping and consistency constraints are applied using statistical augmented embedding representation to obtain an augmented feature sequence, specifically: After feature mapping, the cosine similarity or mean square error between the mean vector of all feature vectors in the mapped enhanced feature sequence and the statistical enhanced embedding representation is calculated as the alignment loss value. The alignment loss value is used for optimization to obtain the enhanced feature sequence.

7. The encrypted traffic classification method based on structure-aware compression according to claim 1, characterized in that, The observable behavioral features described in S1 include: length change data, timestamp data, time interval data, direction change data, duration data, and count data.

8. The encrypted traffic classification method based on structure-aware compression according to claim 1, characterized in that, The statistical feature vectors described in S5 include: average length, length variance, average time interval, interval volatility, duration, total number of packets, uplink / downlink byte ratio, and burstiness.

9. A cryptographic traffic classification system based on structure-aware compression, characterized in that, include: Preprocessing module: Used to acquire encrypted traffic data to be analyzed and extract observable behavioral features; Traffic fingerprint image generation module: Based on observable behavioral features, it constructs spatial view, temporal view, frequency view and statistical enhancement channel, and then stitches them together to generate a traffic fingerprint image; Visual encoding module: The traffic fingerprint image is processed by visual encoding to obtain the first feature sequence; Structure-aware compression module: used to calculate the score of each feature unit in the first feature sequence on multiple preset indicators. For each preset indicator, the scores of all feature units are normalized and then weighted and summed to obtain the structure sensitivity score of the first feature sequence. After mapping the feature units in the first feature sequence to the two-dimensional grids corresponding to the spatial view, temporal view, and frequency view, the average structural sensitivity of all feature units within a two-dimensional grid block is calculated based on the structural sensitivity score of the first feature sequence, which is used as the overall sensitivity of the grid block. The output quota of each grid block is calculated based on the overall sensitivity of the grid block. According to the output quota of each grid block, a compression operation is performed on multiple feature units within the grid block. The compressed feature sequences of each view are then concatenated according to the original order of the views to obtain the second feature sequence. Statistical augmentation building block: Based on observable behavioral features, extract statistical feature vectors, concatenate them, and construct a statistically augmented embedding representation; Consistency alignment module: The second feature sequence is processed by feature mapping and consistency constraints are applied using statistical augmented embedding representation to obtain the augmented feature sequence; Classification module: Enhanced feature sequences, statistically enhanced embedding representations, and task constraints are combined in a preset order and then classified.

10. A device for classifying encrypted traffic based on structure-aware compression, characterized in that, It includes a processor and a memory, wherein the processor implements the encrypted traffic classification method based on structure-aware compression as described in any one of claims 1-8 when executing a computer program stored in the memory.