An adaptive service traffic classification method and system based on agent closed-loop scheduling

Abstract

This invention relates to the field of computer technology and discloses a method and system for adaptive classification of service traffic based on intelligent agent closed-loop scheduling. The method includes: collecting target network traffic, extracting features, and performing clustering processing to identify unknown traffic clusters that do not match known fingerprints; extracting their core features to construct a summary, inputting it into a large language model to generate structured service hypotheses indicating the predicted service category; when the confidence level is sufficient, performing behavioral simulation in an isolated sandbox according to the hypothesis, collecting simulated traffic and labeling it with corresponding predicted category tags; extracting multidimensional discriminative features from labeled samples, automatically desensitizing them to remove privacy identifier fields, and generating desensitized feature vectors for storage; merging historical real-world labeled data to construct a training set, fine-tuning the initial classification model to obtain the target classification model, and then performing adaptive classification output on real-time network traffic. This achieves autonomous discovery and high-precision identification of unknown service traffic, ensuring data privacy compliance and business continuity.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an adaptive classification method and system for service traffic based on agent-based closed-loop scheduling. Background Technology

[0002] As enterprises deepen their digital transformation, the types of services carried on networks are becoming increasingly diversified, encompassing instant messaging, video conferencing, SaaS office applications, and customized internal systems. Network traffic classification and identification has become a crucial foundational capability for enterprise network management, security auditing, and bandwidth optimization. Currently, the mainstream traffic identification technologies in the industry mainly include the following: The first is a port number-based identification method, which heavily relies on the mapping relationship between registered ports and common application ports. The second is a deep packet inspection (DPI)-based identification method, which primarily identifies applications by matching feature strings in traffic data packets (such as Hypertext Transfer Protocol headers or Transport Layer Security (TLS) server name indicators). The third is a machine learning-based statistical feature classification method, which utilizes the statistical characteristics of traffic (including packet size distribution, temporal features, and flow duration) to train a classification model.

[0003] However, in real-world, complex enterprise network environments, the aforementioned existing technologies have gradually revealed the following serious technical defects and shortcomings: Unable to identify unknown business: Existing solutions all rely on predefined application signatures or labeled datasets, and lack the ability to independently discover and identify customized applications or newly launched SaaS services within enterprises.

[0004] Lack of adaptive learning capability: When business systems are upgraded or traffic characteristics change, existing models need to be manually re-labeled and retrained, resulting in high maintenance costs and long response cycles.

[0005] Low accuracy of encrypted traffic identification: The widespread adoption of encryption protocols such as TLS 1.3 has rendered traditional DPI methods increasingly ineffective, while methods based on statistical features lack semantic understanding capabilities.

[0006] Compliance versus security: Traditional solutions typically require parsing the original traffic content, which presents compliance challenges in the context of increasingly stringent data privacy protection. Summary of the Invention

[0007] To address the problems of existing technologies, such as the inability to autonomously identify unknown business traffic, lack of adaptive learning capabilities, and low accuracy in identifying encrypted traffic, this invention provides a business traffic adaptive classification method and system based on intelligent agent closed-loop scheduling. It adopts a core architecture of AI-assisted cognition + closed-loop self-learning, and achieves autonomous discovery, feature extraction, model training and continuous iteration of unknown business traffic through a closed-loop process of planning-execution-observation-learning-update-reporting. It only outputs the identification results and does not perform any blocking, rate limiting or policy intervention actions, thus ensuring business continuity.

[0008] This invention provides an adaptive classification method for service traffic based on agent-based closed-loop scheduling, comprising: S1. Collect target network traffic and extract multi-dimensional feature vectors. Based on the multi-dimensional feature vectors, use an unsupervised clustering algorithm to cluster the target network traffic to obtain multiple traffic clusters. Match the multiple traffic clusters with a preset known service fingerprint database and mark the traffic clusters that fail to match as unknown traffic clusters. S2. Extract the core features of the unknown traffic cluster to construct a feature summary, and input the feature summary into a preset large language model to generate a structured business hypothesis indicating a predicted business category; wherein, the structured business hypothesis includes the hypothesis content and the confidence level and suggested verification path corresponding to the hypothesis content; S3. If the confidence level is greater than or equal to the preset confidence level threshold, then in response to the structured business hypothesis, the scheduling agent performs behavior simulation in the isolated sandbox environment according to the suggested verification path, synchronously collects the simulated traffic generated by the behavior simulation, and labels the simulated traffic with the label corresponding to the predicted business category to generate labeled traffic samples. S4. Extract multi-dimensional identification features, including transport layer encryption suite information and application layer protocol mode, from the labeled traffic sample, and perform automatic desensitization processing on the multi-dimensional identification features to remove the privacy identifier field, generate a desensitized feature vector, and perform the database operation. S5. The desensitized feature vectors after being stored in the database are merged with the pre-stored historical real-label data to construct a training set. The preset initial classification model is trained and fine-tuned to obtain the target business traffic classification model. The target business traffic classification model is then used to perform adaptive classification output on real-time network traffic.

[0009] Furthermore, S1 specifically includes: S101. Obtain the target network traffic on the enterprise border gateway or core switch by bypass mirroring. Complete the traffic collection by combining kernel-mode socket event capture and user-mode protocol parsing. Aggregate the original data packets into bidirectional network streams according to the five-tuple and timeout, and extract features from them to construct the multi-dimensional feature vector. S102. After dimensionality reduction, the multidimensional feature vector is fed into an unsupervised clustering algorithm for clustering to form multiple traffic clusters. S103. Match the multiple traffic clusters with a preset known service fingerprint database, and mark the traffic clusters that fail to match or whose matching degree is lower than a preset matching degree threshold as unknown traffic clusters.

[0010] Furthermore, S2 specifically includes: S201. Extract the core features of the unknown traffic cluster, and convert the core features into natural language format or a preset structured data format to construct the feature summary; S202. Fill the feature summary into the preset prompt information template, inject the preset system role settings and few sample prompt examples to assemble the prompt information, and perform security constraint filtering on the prompt information; S203. Input the prompt information filtered by security constraints into the preset large language model for reasoning analysis; S204. The structured business hypothesis is output through the large language model using a preset structured data format; wherein, the structured business hypothesis includes the hypothesis content, the confidence level, the suggested verification path, and the predicted business scenario, and the suggested verification path is a specific command sequence used to reproduce the target business behavior in the isolated sandbox environment.

[0011] Furthermore, in S203, In the reasoning and analysis process, the accuracy records of the preset large language model regarding historical hypotheses are extracted, and historical hypotheses with high accuracy are given higher weight than historical hypotheses with low accuracy during the comprehensive decision-making process. The system receives manual corrections from the administrator for the structured business assumptions output by the large language model and feeds these corrections back into the context of the large language model to optimize the inference results.

[0012] Furthermore, S3 specifically includes: S301. When it is determined that the confidence level is greater than or equal to the preset confidence level threshold, start the micro virtual machine or strong isolation container in the isolated sandbox environment, and configure an independent virtual network card for the micro virtual machine or the strong isolation container to complete the environment initialization. S302. The suggested verification path is parsed into a specific command sequence, and the corresponding script file is called by the preset intelligent agent in the isolated sandbox environment to execute the specific command sequence in order to simulate behavior; wherein, the specific command sequence includes program code based on network request library, front-end automated testing tool script or command line interface control instructions of specific client; S303. Synchronously capture all network interaction data generated by the behavior simulation at the virtual gateway in the isolated sandbox environment as the simulated traffic, bind the simulated traffic to the currently executed simulation task, and assign the predicted service category as the initial pseudo-label to the simulated traffic to generate the labeled traffic sample.

[0013] Furthermore, in S302, If the target simulated application is determined to be a preset public software service application, then the built-in standardized operation script is directly invoked to execute the specific command sequence. If the target simulated application is determined to be a customized internal application for an enterprise, a preset recording and playback mechanism is triggered to play back the legitimate operation process script pre-recorded by the administrator to execute the specific command sequence.

[0014] Furthermore, S4 specifically includes: S401. Perform deep protocol parsing on the tagged traffic sample to extract multi-dimensional identification features, including the transport layer encryption suite information, application layer protocol mode, traffic timing features, and traffic statistical features. S402. Traverse the feature dictionary formed after feature extraction, identify and remove or obfuscate fields involving privacy and absolute identification in the feature dictionary through a preset regular expression replacement mechanism, so as to perform the automatic desensitization process; S403. Convert the hybrid type features obtained after desensitization into standard feature vectors to generate the desensitized feature vectors. Under the constraint of refusing to retain the original traffic payload, only associate and save the desensitized feature vectors with their corresponding tag information to complete the database entry operation. The hybrid type features include numerical features, categorical features, and string features extracted from the multidimensional identification features after automatic desensitization.

[0015] Furthermore, S5 specifically includes: S501. Merge the desensitized feature vectors in the newly generated labeled traffic samples with the pre-stored historical real labeled data, and divide them into a training set and a validation set according to a preset ratio; wherein, the training set contains the desensitized feature vectors in the labeled traffic samples and the historical unknown traffic cluster features that have been manually labeled, and the validation set contains the unlabeled real network traffic features that have been retained and manually confirmed to be labeled. S502. The training set is used to train and fine-tune the preset initial classification model, and performance evaluation and feature distribution drift monitoring are performed on the validation set. After the performance evaluation is qualified, the fine-tuned candidate model and the old model currently online are run in parallel using the shadow mode. The difference of the output results is compared to complete the shadow mode verification. After the verification is passed, the target business traffic classification model is generated. S503. The target business traffic classification model is loaded into memory through a hot loading mechanism, and the inference handle of the old model is replaced to achieve seamless switching and online deployment. At the same time, the old model is recorded for version support to support rollback operations. S504. Use the target service traffic classification model after hot loading to adaptively classify and label real-time network traffic, generate a report containing identification indicators, and push structured identification tags to downstream platforms through standardized network interfaces. S505. After performing the adaptive classification and labeling, the recognition results with confidence in the preset low-to-medium range are selected and pushed to the manual review queue. The manual correction results for the feature samples are received, and the correct labels and original features corresponding to the manual correction results are written into the correction dataset. In response to the correction dataset meeting the preset triggering iteration conditions, the model training fine-tuning steps are re-triggered.

[0016] Further, in step S502, the preset initial classification model is trained and fine-tuned using the training set, and performance evaluation and feature distribution drift monitoring are performed on the validation set, specifically including: For data with new business categories, a few-shot learning strategy is adopted to perform incremental training or fine-tuning using a pre-set prototype network algorithm or a text classification algorithm based on a sentence converter. Data augmentation processing, including temporal jitter and packet drop simulation, is introduced during the training process. Multi-class macro-comprehensive evaluation index, precision, and recall are calculated on the validation set for performance evaluation. Changes in feature distribution are monitored through the Kolmogorov-Smirnov test and the population stability index. When the population stability index is greater than a preset stability threshold, it is determined that the feature distribution has drifted significantly and an early warning is triggered. The shadow mode is used to run the fine-tuned candidate model in parallel with the currently online old model, and the differences in the output results are compared to complete the shadow mode validation. Specifically, this includes: A copy of the real-time network traffic is asynchronously sent to the candidate model, and the output results of the candidate model are compared with those of the old model in real time. The comparison includes not only hard comparison of business category labels, but also probability distribution comparison based on Jaccard similarity or cross-entropy. If the overall difference rate is greater than a first preset threshold or the difference rate of a preset key category is greater than a second preset threshold, a difference alarm is triggered and manual review and confirmation are requested. If the difference rate is within a preset acceptable range, the model is automatically approved for deployment and confirmed as the target business traffic classification model.

[0017] This invention also provides a service traffic adaptive classification system based on agent-based closed-loop scheduling. Based on the agent-based closed-loop scheduling service traffic adaptive classification method described above, the system includes: The network traffic acquisition module is used to collect target network traffic and extract multi-dimensional feature vectors. Based on the multi-dimensional feature vectors, an unsupervised clustering algorithm is used to cluster the target network traffic to obtain multiple traffic clusters. The multiple traffic clusters are matched with a preset known service fingerprint database, and traffic clusters that fail to match are marked as unknown traffic clusters. The detection plan generation module is used to extract the core features of the unknown traffic cluster to construct a feature summary, and input the feature summary into a preset large language model to generate a structured business hypothesis indicating a predicted business category; wherein, the structured business hypothesis includes the hypothesis content and the confidence level and suggested verification path corresponding to the hypothesis content; The behavior simulation execution module is used to respond to the structured business hypothesis when the confidence level is greater than or equal to the preset confidence level threshold, schedule the intelligent agent to perform behavior simulation in an isolated sandbox environment according to the suggested verification path, synchronously collect the simulated traffic generated by the behavior simulation, and label the simulated traffic with the label corresponding to the predicted business category to generate labeled traffic samples. The traffic observation and feature construction module is used to extract multi-dimensional identification features, including transport layer encryption suite information and application layer protocol mode, from the labeled traffic samples, and to perform automatic desensitization processing on the multi-dimensional identification features to remove privacy identifier fields, generate desensitized feature vectors, and perform database storage operations. The self-learning and model application module is used to merge the desensitized feature vectors after they are entered into the database with the pre-stored historical real labeled data to build a training set to train and fine-tune the preset initial classification model to obtain the target business traffic classification model. The target business traffic classification model is then used to perform adaptive classification output on real-time network traffic.

[0018] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method.

[0019] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method.

[0020] The beneficial effects of this invention are as follows: This invention utilizes a closed-loop mechanism of large language model-assisted reasoning and behavioral simulation to achieve the ability to autonomously discover and identify new or private business traffic without predefined signatures. It possesses full-process adaptive learning capabilities, significantly reducing operational costs through automated iterations of "discovery, labeling, training, evaluation, and deployment." Without requiring decryption, it significantly improves the accuracy of identifying encrypted traffic by fusing multi-dimensional features such as transport layer security fingerprints and temporal characteristics. Simultaneously, by employing automatic desensitization, storing only meta-features, private deployment, and a pure observation mode, it ensures business continuity while strictly meeting data privacy protection compliance requirements, effectively mitigating the risk of business interruption. Furthermore, its standardized interfaces ensure seamless integration and collaboration with downstream systems such as security analysis or network management. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of a method flow according to an embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram of the shadow pattern verification process in this invention.

[0023] Figure 3 This is a schematic diagram of the device structure according to an embodiment of the present invention.

[0024] Figure 4 This is a schematic diagram of the internal structure of a computer device according to an embodiment of the present invention.

[0025] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0026] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0027] This invention, deployed within an enterprise LAN, achieves autonomous identification and classification of unknown or novel business traffic through a closed-loop process of orchestrated agent coordination: planning, execution, observation, learning, updating, and reporting. It utilizes a large language model to assist in generating business hypotheses, generates labeled traffic samples through behavioral simulation in an isolated sandbox, extracts de-identified feature vectors, trains a classification model, performs secure verification using shadow mode, hot-loads and deploys, and pushes identification results through a standardized interface. This invention offers advantages such as autonomous discovery of unknown businesses, closed-loop adaptive learning, high-precision identification of encrypted traffic, and security and compliance assurance. Furthermore, it only outputs identification results without implementing policy interventions, ensuring business continuity.

[0028] This invention, based on the deep integration of cutting-edge artificial intelligence and automation technologies, first establishes the fundamental boundary of AI being native but not entirely controlled by AI. Specifically, the large language model is only used to assist in generating detection hypotheses and attribution analysis, providing suggestions, and never directly triggers any blocking or rate-limiting actions on the network control plane. At the data acquisition and cognition level, a hybrid perception and label-driven strategy is adopted, organically combining passive traffic clustering for discovering unknown traffic patterns with active behavior simulation for obtaining high-confidence classification labels, thereby constructing a high-quality model training dataset. In terms of the overall operational cycle, closed-loop self-learning and open output are achieved, enabling not only automated continuous iteration of the business traffic identification model but also seamlessly pushing the identification results to downstream security or network analysis platforms in a standard format. Furthermore, a strict privacy and compliance security bottom line principle is implemented at the underlying architecture level, ensuring that all data processing flows are securely completed in a local environment, and that the original traffic data undergoes rigorous anonymization processing, retaining only the necessary meta-features, comprehensively protecting data privacy and security.

[0029] like Figure 1 As shown, this invention provides an adaptive classification method for service traffic based on agent-based closed-loop scheduling, comprising: S1. Collect target network traffic and extract multi-dimensional feature vectors. Based on the multi-dimensional feature vectors, use an unsupervised clustering algorithm to cluster the target network traffic to obtain multiple traffic clusters. Match the multiple traffic clusters with a preset known service fingerprint database and mark the traffic clusters that fail to match as unknown traffic clusters.

[0030] In a preferred embodiment of the present invention, step S1 specifically includes the following sub-steps: S101. Collect target network traffic and extract corresponding multi-dimensional feature vectors. Specifically, traffic is obtained through bypass mirroring on the enterprise border gateway or core switch as the target network traffic. During the collection process, the eBPF program captures socket events in kernel mode, while Zeek performs protocol parsing in user mode. The two complement each other to complete the traffic collection.

[0031] The raw data packets are aggregated into a bidirectional network stream based on the 5-tuple (source IP, destination IP, source port, destination port, protocol) and timeout. As an example, the stream terminates if no new packets are received within 60 seconds. After aggregation, features are extracted to construct a multi-dimensional feature vector. The extracted features include: 5-tuple plus timestamp, packet length distribution, packet interval, uplink / downlink byte ratio, and application layer features such as TLS SNI, JA3 fingerprint, HTTP User-Agent / API path, and DNS request domain name.

[0032] S102. Based on the multidimensional feature vector, an unsupervised clustering algorithm is used to cluster the target network traffic to obtain multiple traffic clusters.

[0033] Specifically, high-dimensional features are reduced in dimensionality and then fed into a clustering algorithm to form different traffic groups, resulting in multiple traffic clusters. In practice, DBSCAN is used to handle outliers, and cosine similarity and Euclidean distance are combined to complete the distance measurement for mixed feature scenarios.

[0034] S103. Match the multiple traffic clusters with a preset known service fingerprint database, and mark the traffic clusters that fail to match as unknown traffic clusters. Specifically, match the above clustering results with the existing known service fingerprint database, and mark the clusters that cannot be matched or whose matching degree is lower than the threshold as "unknown traffic clusters".

[0035] S2. Extract the core features of the unknown traffic cluster to construct a feature summary, and input the feature summary into a preset large language model to generate a structured business hypothesis indicating a predicted business category; wherein, the structured business hypothesis includes the hypothesis content and the confidence level and suggested verification path corresponding to the hypothesis content.

[0036] In a preferred embodiment of the present invention, step S2 specifically includes the following sub-steps: S201. Extract the core features of the unknown traffic clusters and construct a feature summary. Specifically, The orchestration agent extracts the core features of the unknown traffic clusters. These core features include traffic statistics feature vectors, cluster labels, traffic size, average packet length, Transport Layer Security (TLS) version, Server Name Indicator (SNI), and the presence of periodic heartbeats. For example, the extracted feature summary can be described as "average packet length 1400 bytes, primarily using TLS 1.3, empty SNI, presence of periodic heartbeats." Subsequently, these core features are converted into natural language or structured JSON format to construct the feature summary.

[0037] S202. Assemble the prompt message template and filter for safety constraints. Specifically, The feature summary is filled into a preset Prompt template and injected into the system role setting, which is set to "Senior Network Protocol Analyst". Simultaneously, a Few-Shot approach is used, providing 2-3 example feature-hypothesis mappings of known traffic (e.g., video conferencing) in the prompt message. Before being sent to the large language model, it must undergo security filtering and inference constraints. The prompt message is verified through a whitelist gateway, and a blacklist of sensitive systems (e.g., financial systems, human resources systems) is embedded. The constraints explicitly limit it to common enterprise business operations and strictly prohibit the generation of attack-related hypotheses.

[0038] S203. Utilize a pre-defined large language model to perform reasoning and generate structured business hypotheses. Specifically, The assembled prompts are sent to a pre-defined Large Language Model (LLM). The LLM, combining its prior knowledge, performs inference analysis on the input unknown traffic cluster feature summary. During this process, the accuracy records of the LLM's historical hypotheses are maintained, and hypotheses with high accuracy are given higher weight in the comprehensive decision-making process. At the same time, the administrator can confirm or revise the output hypotheses, and the revision results will be fed back into the LLM's Context to continuously optimize its inference tendency.

[0039] S204. Output structured business hypotheses containing the predicted business categories. Specifically, The large language model outputs structured business assumptions in JSON format according to the template requirements. These assumptions include the following fields: (1) Hypothesis content: Describe the predicted business attributes, that is, what kind of application, service or business process the traffic may be; (2) Confidence level: A numerical value indicating the probability of accurate prediction, ranging from 0 to 1; (3) Business Scenarios: Describe possible application scenarios; (4) Recommended verification path: Specifically, instructions on how to reproduce the behavior in the sandbox, such as using API (Application Programming Interface) to simulate sending commands or calling Agent (intelligent agent) to execute specific business process command sequences.

[0040] S3. If the confidence level is greater than or equal to the preset confidence level threshold, then in response to the structured business hypothesis, the scheduling agent performs behavioral simulation in the isolated sandbox environment according to the suggested verification path, synchronously collects the simulated traffic generated by the behavioral simulation, and labels the simulated traffic with the label corresponding to the predicted business category, generating labeled traffic samples.

[0041] In a preferred embodiment of the present invention, step S3 specifically includes the following sub-steps: S301, Confidence Determination and Isolation Environment Initialization. Specifically, The orchestration agent determines whether the confidence level in the structured business assumption is greater than or equal to a preset confidence level threshold. If the confidence level meets the threshold, a micro virtual machine or a strongly isolated container is launched in the isolated sandbox environment and an independent virtual network card is configured for it to complete the physical or logical isolation initialization of the behavior simulation environment.

[0042] S302, It is recommended to verify path resolution and behavior simulation execution. Specifically, The orchestration agent parses the "suggested validation path" generated by the Large Language Model (LLM) into specific command sequences, including but not limited to Python requests, Playwright (an automation tool), or CLI (command-line interface) for specific clients. The parsed instructions are then passed to the Agent module of LangChain (a large model development framework) and executed within a sandbox. For mainstream SaaS (Software as a Service) applications such as Zoom, Teams, and DingTalk, built-in standardized operation scripts are directly invoked to generate traffic. For customized internal enterprise applications, a recording and playback mechanism is used to replay legitimate operation process scripts recorded by the administrator to generate tagged traffic.

[0043] S303, Traffic Packet Recording and Automatic Labeling. Specifically, At the virtual gateway in the sandbox, all network interactions generated by the execution of the aforementioned script are captured synchronously, thus completing the recording of simulated traffic packets. Subsequently, the captured simulated traffic is bound to the executed script task and automatically labeled with the tag corresponding to the predicted business category assumed by the large language model (as the initial pseudo-label), thereby generating labeled traffic samples.

[0044] In step S3, all simulated actions are executed in an independent network sandbox, completely isolated from the production environment, ensuring no interference with real business operations. Simultaneously, complete operation logs for all simulated actions are retained to form audit logs, supporting post-event auditing and behavior retrospection.

[0045] S4. Extract multi-dimensional identification features, including transport layer encryption suite information and application layer protocol mode, from the labeled traffic samples, and perform automatic desensitization processing on the multi-dimensional identification features to remove privacy identifier fields, generate desensitized feature vectors, and perform database entry operations.

[0046] In a preferred embodiment of the present invention, step S4 specifically includes the following sub-steps: S401. Perform deep protocol parsing and extract multi-dimensional discriminative features. Specifically, Deep protocol parsing is performed on the labeled traffic samples (i.e., simulated traffic) generated in step S3 and the real unknown traffic collected in step S1. During this stage, multi-dimensional discriminative features are extracted, particularly strong application-layer features. The extracted feature types specifically include: 1) Transport Layer Security (TLS) fingerprint characteristics: including JA3 or JA3S fingerprint, a list of supported cipher suites, and the TLS version, etc.; 2) Application layer protocol and domain name characteristics: including User-Agent and Uniform Resource Identifier (URI) patterns at the Hypertext Transfer Protocol (HTTP) layer, as well as Server Name Indication (SNI), Application Layer Protocol Negotiation (ALPN) results, and Domain Name System (DNS) query patterns, etc. 3) Traffic temporal characteristics: including packet interval distribution (such as mean, variance, quantiles), flow duration, and packet count statistics; 4) Traffic statistics characteristics: including uplink / downlink traffic ratio, average packet size, and burst characteristics, etc.

[0047] S402. Perform automatic privacy desensitization to remove the privacy identifier field. Specifically, To meet data privacy compliance requirements, the feature dictionary formed after feature extraction is traversed to identify and remove or obfuscate fields involving privacy and absolute identification. In specific implementation, privacy-identifying fields that can directly identify users or devices, such as Internet Protocol (IP) addresses, cookies, user-agents, and Uniform Resource Locators (URLs), are automatically removed; or, sensitive information such as IP addresses, cookies, and access tokens are obfuscated using regular expression replacements to achieve automatic desensitization.

[0048] S403. Generate de-identified feature vectors and perform the database entry operation for retaining only the original features. Specifically, After anonymization, the resulting mixed-type features (including numerical, categorical, and string data) are converted into standard feature vectors acceptable to machine learning models, thus generating the anonymized feature vectors. Subsequently, the data is stored in the database. During this process, strict security and compliance measures are implemented, ensuring that only the original traffic payload is not retained; only the extracted and converted anonymized feature vectors and their corresponding tag information are saved.

[0049] S5. The desensitized feature vectors after being stored in the database are merged with the pre-stored historical real-label data to construct a training set. The preset initial classification model is trained and fine-tuned to obtain the target business traffic classification model. The target business traffic classification model is then used to perform adaptive classification output on real-time network traffic.

[0050] In a preferred embodiment of the present invention, step S5 specifically includes the following sub-steps: S501. Construct the training set. Specifically, The newly generated simulated labeled data (i.e., the labeled traffic sample features generated in step S3) is merged with the original historical real labeled data, and the training set and validation set are divided proportionally. The training set contains the generated labeled data and a small number of manually labeled historical unknown cluster features; the validation set retains the real traffic that is unlabeled and whose labels have been manually confirmed.

[0051] S502, Model Training Fine-tuning, Performance Evaluation, and Shadow Mode Validation. Specifically, this step covers the entire security verification process from model training to pre-deployment, mainly including: 1) Training and Fine-tuning Phase: To address the scarcity of samples in the early stages of new business operations, a Few-shot learning strategy is supported. Prototypical Networks or SetFit algorithms based on Sentence-transformers are selected as the initial classification models for incremental training or fine-tuning. Simultaneously, XGBoost combined with handcrafted features is retained as the traditional baseline model. In terms of training strategy, training can be initiated with 5 to 20 samples for each new category, and data augmentation techniques, including temporal jitter and packet drop simulation, are introduced.

[0052] 2) Performance Evaluation and Drift Monitoring Phase: After model training, multi-class F1 scores (especially Macro-F1 scores to prevent class imbalance from masking problems), precision, and recall are calculated on independent validation sets. Simultaneously, feature distribution changes are continuously monitored using the Kolmogorov-Smirnov test and the PSI (Population Stability Index). When the feature distribution difference between the new training data and the previous version of the training data causes the PSI to exceed 0.2, it is considered a significant drift and an alert is triggered. Only models whose performance metrics reach the preset thresholds are allowed to enter the validation phase.

[0053] 3) Shadow mode verification phase: such as Figure 2 As shown, a shadow mode is used to run the new model and the old model in parallel, with real-time traffic copies from the production environment asynchronously fed into the new model. The comparison engine compares the outputs of the new and old models in real time, not only comparing hard labels such as business actions, but also focusing on the probability distribution of Jaccard Similarity or Cross-entropy. If the overall difference rate is greater than 5% or the difference rate of a key category is greater than 10%, a difference alarm is triggered, and the protocol analysis engineer reviews and decides whether to approve the deployment through the Web UI; if the difference is within an acceptable range (e.g., the difference rate is less than 1% and there are no high-risk errors), the deployment is automatically approved and the final target business traffic classification model is obtained.

[0054] S503, model hot loading and deployment, and version management. Specifically, The currently running old model, configuration files, and training metrics are packaged and pushed to platforms such as MLflow (model registry) for version management. Upon receiving a notification of a new version path change, the inference engine loads the new model file into memory and builds the inference graph in a background thread. Once completed, it replaces the original inference handle using a hot-loading mechanism, achieving seamless switching without requiring a service restart. The configuration center retains the paths of the most recent N versions. If an online anomaly occurs, it supports one-click, second-level rollback to a historical version via API (Application Programming Interface).

[0055] S504, adaptive classification output and report push. Specifically, The target business traffic classification model, deployed via hot loading, adaptively classifies and labels real-time network traffic. A scheduled task retrieves classification logs, generating a readable report containing information such as newly identified categories, traffic proportion trends for each business type, and differences in model performance metrics. Finally, structured JSON (JavaScript Object Notation) formatted identification tags or Syslog (system logs) are pushed to downstream network management systems, security analysis platforms, or SIEM (Security Information and Event Management) platforms via a RESTful API (Representative State Transition Application Programming Interface).

[0056] S505. After outputting the classification results, the administrator can view the generated report and feature samples of unknown traffic (such as anonymized original traffic payload fragments and time series diagrams) through the console. For traffic with confidence levels in the preset low to medium range (e.g., between 0.4 and 0.7), the final label is not directly output but is instead pushed to the manual review queue for manual confirmation of the machine's judgment or manual correction to the correct category. The corrected high-confidence true label, along with the original features, is directly written back into a dedicated calibration dataset. When the calibration dataset accumulates to a preset time threshold (e.g., 24 hours), or when the number of consecutive classification errors reaches or exceeds a preset threshold (e.g., 5 times), a closed-loop mechanism is automatically triggered, returning to the steps of building the training set and fine-tuning the model training, thereby achieving continuous iteration and correction of the model.

[0057] The present invention will be illustrated by specific examples below: Example 1: Identification of High-Frequency SaaS Applications Taking the identification of Zoom video conference traffic in an enterprise network as an example: 1. Passive collection phase: Zeek collects network traffic and uses unsupervised clustering to discover a group of unknown traffic clusters with similar TLS fingerprints and packet timing characteristics.

[0058] 2. LLM Inference Phase: The orchestration agent inputs a feature summary of the traffic cluster into the LLM. The LLM outputs the hypothesis "This traffic cluster is likely Zoom video conferencing traffic" based on a specific combination of cipher suites in the TLS fingerprint and the SNI pattern, with a confidence level of 0.75.

[0059] 3. Behavioral simulation phase: Start the Zoom client in the isolated sandbox and simulate standard operations such as joining a meeting, starting video, and screen sharing, while collecting and labeling traffic.

[0060] 4. Feature matching stage: Extract TLS fingerprints (JA3), packet timing features, etc. from the simulated traffic, and compare them with the features of unknown traffic clusters to verify the validity of the hypothesis.

[0061] 5. Model training phase: Add labeled data to the training set, train the Zoom traffic classifier, and achieve an F1-score of 0.92 on the validation set, which meets the upper limit threshold.

[0062] 6. Going live: After the new classifier is verified through shadow mode, it is hot-loaded and launched, and subsequent Zoom traffic is automatically identified and marked.

[0063] Example 2: Identification of Privatized Internal Systems Taking the identification of traffic from a company's self-developed internal approval system as an example: 1. LLM cannot directly generate valid hypotheses due to the lack of a corresponding knowledge base, and outputs guesses with low confidence.

[0064] 2. The system triggers a manual intervention process. The administrator confirms that the traffic belongs to the internal approval system and provides the operation recording script of the system.

[0065] 3. The system replay operation recording script generates labeled traffic samples, extracts features, and then trains a classifier.

[0066] This business knowledge is stored in the system's knowledge base, allowing the LLM to directly match similar traffic in the future, thus improving hypothesis generation efficiency.

[0067] like Figure 3 As shown, the present invention also provides a service traffic adaptive classification system based on agent-based closed-loop scheduling. Based on the service traffic adaptive classification method based on agent-based closed-loop scheduling described above, the system includes: The network traffic acquisition module 1 is used to acquire target network traffic and extract multi-dimensional feature vectors. Based on the multi-dimensional feature vectors, an unsupervised clustering algorithm is used to cluster the target network traffic to obtain multiple traffic clusters. The multiple traffic clusters are matched with a preset known service fingerprint database, and traffic clusters that fail to match are marked as unknown traffic clusters. The detection plan generation module 2 is used to extract the core features of the unknown traffic cluster to construct a feature summary, and input the feature summary into a preset large language model to generate a structured business hypothesis indicating a predicted business category; wherein, the structured business hypothesis includes the hypothesis content and the confidence level and suggested verification path corresponding to the hypothesis content; The behavior simulation execution module 3 is used to respond to the structured business hypothesis when the confidence level is greater than or equal to the preset confidence level threshold, to schedule the intelligent agent to perform behavior simulation in the isolated sandbox environment according to the suggested verification path, to synchronously collect the simulated traffic generated by the behavior simulation, and to label the simulated traffic with the label corresponding to the predicted business category, thereby generating labeled traffic samples. Traffic observation and feature construction module 4 is used to extract multi-dimensional identification features, including transport layer encryption suite information and application layer protocol mode, from the labeled traffic samples, and to perform automatic desensitization processing on the multi-dimensional identification features to remove privacy identifier fields, generate desensitized feature vectors, and perform database storage operations. The self-learning and model application module 5 is used to merge the desensitized feature vectors after they are entered into the database with the pre-stored historical real labeled data to build a training set to train and fine-tune the preset initial classification model to obtain the target business traffic classification model. The target business traffic classification model is then used to perform adaptive classification output on real-time network traffic.

[0068] Each of the above modules is used to execute the corresponding steps in the above-described adaptive classification method for business traffic based on agent-based closed-loop scheduling. The specific implementation methods are as described in the above-described method embodiments, and will not be repeated here.

[0069] like Figure 4 As shown, the present invention also provides a computer device, which may be a server, and its internal structure may be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores all data required for the process of the agent-based closed-loop scheduling adaptive traffic classification method. The network interface communicates with external terminals via a network connection. The computer program is executed by the processor to implement the agent-based closed-loop scheduling adaptive traffic classification method.

[0070] Those skilled in the art will understand that Figure 4The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer equipment on which the present application is applied.

[0071] An embodiment of this application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the above-described adaptive classification methods for service traffic based on agent-based closed-loop scheduling.

[0072] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by hardware related to computer program instructions. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. Any references to memory, storage, databases, or other media provided in this application and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM), such as dynamic RAM (used as main storage) or static RAM (commonly used as cache memory). By way of illustration and not limitation, RAM has various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), and Rambus DRAM (RDRAM).

[0073] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, apparatus, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0074] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A service traffic adaptive classification method based on agent-based closed-loop scheduling, characterized in that, include: S1. Collect target network traffic and extract multi-dimensional feature vectors. Based on the multi-dimensional feature vectors, use an unsupervised clustering algorithm to cluster the target network traffic to obtain multiple traffic clusters. Match the multiple traffic clusters with a preset known service fingerprint database and mark the traffic clusters that fail to match as unknown traffic clusters. S2. Extract the core features of the unknown traffic cluster to construct a feature summary, and input the feature summary into a preset large language model to generate a structured business hypothesis indicating a predicted business category; wherein, the structured business hypothesis includes the hypothesis content and the confidence level and suggested verification path corresponding to the hypothesis content; S3. If the confidence level is greater than or equal to the preset confidence level threshold, then in response to the structured business hypothesis, the scheduling agent performs behavior simulation in the isolated sandbox environment according to the suggested verification path, synchronously collects the simulated traffic generated by the behavior simulation, and labels the simulated traffic with the label corresponding to the predicted business category to generate labeled traffic samples. S4. Extract multi-dimensional identification features, including transport layer encryption suite information and application layer protocol mode, from the labeled traffic sample, and perform automatic desensitization processing on the multi-dimensional identification features to remove the privacy identifier field, generate a desensitized feature vector, and perform the database operation. S5. The desensitized feature vectors after being stored in the database are merged with the pre-stored historical real-label data to construct a training set. The preset initial classification model is trained and fine-tuned to obtain the target business traffic classification model. The target business traffic classification model is then used to perform adaptive classification output on real-time network traffic.

2. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 1, characterized in that, S1 specifically includes: S101. Obtain the target network traffic on the enterprise border gateway or core switch by bypass mirroring. Complete the traffic collection by combining kernel-mode socket event capture and user-mode protocol parsing. Aggregate the original data packets into bidirectional network streams according to the five-tuple and timeout, and extract features from them to construct the multi-dimensional feature vector. S102. After dimensionality reduction, the multidimensional feature vector is fed into an unsupervised clustering algorithm for clustering to form multiple traffic clusters. S103. Match the multiple traffic clusters with a preset known service fingerprint database, and mark the traffic clusters that fail to match or whose matching degree is lower than a preset matching degree threshold as unknown traffic clusters.

3. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 1, characterized in that, S2 specifically includes: S201. Extract the core features of the unknown traffic cluster, and convert the core features into natural language format or a preset structured data format to construct the feature summary; S202. Fill the feature summary into the preset prompt information template, inject the preset system role settings and few sample prompt examples to assemble the prompt information, and perform security constraint filtering on the prompt information; S203. Input the prompt information filtered by security constraints into the preset large language model for reasoning analysis; S204. The structured business hypothesis is output through the large language model using a preset structured data format; wherein, the structured business hypothesis includes the hypothesis content, the confidence level, the suggested verification path, and the predicted business scenario, and the suggested verification path is a specific command sequence used to reproduce the target business behavior in the isolated sandbox environment.

4. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 3, characterized in that, In S203, In the reasoning and analysis process, the accuracy records of the preset large language model regarding historical hypotheses are extracted, and historical hypotheses with high accuracy are given higher weight than historical hypotheses with low accuracy during the comprehensive decision-making process. The system receives manual corrections from the administrator for the structured business assumptions output by the large language model and feeds these corrections back into the context of the large language model to optimize the inference results.

5. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 1, characterized in that, S3 specifically includes: S301. When it is determined that the confidence level is greater than or equal to the preset confidence level threshold, start the micro virtual machine or strong isolation container in the isolated sandbox environment, and configure an independent virtual network card for the micro virtual machine or the strong isolation container to complete the environment initialization. S302. The suggested verification path is parsed into a specific command sequence, and the corresponding script file is called by the preset intelligent agent in the isolated sandbox environment to execute the specific command sequence in order to simulate behavior; wherein, the specific command sequence includes program code based on network request library, front-end automated testing tool script or command line interface control instructions of specific client; S303. Synchronously capture all network interaction data generated by the behavior simulation at the virtual gateway in the isolated sandbox environment as the simulated traffic, bind the simulated traffic to the currently executed simulation task, and assign the predicted service category as the initial pseudo-label to the simulated traffic to generate the labeled traffic sample.

6. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 5, characterized in that, In S302, If the target simulated application is determined to be a preset public software service application, then the built-in standardized operation script is directly invoked to execute the specific command sequence. If the target simulated application is determined to be a customized internal application for an enterprise, a preset recording and playback mechanism is triggered to play back the legitimate operation process script pre-recorded by the administrator to execute the specific command sequence.

7. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 1, characterized in that, S4 specifically includes: S401. Perform deep protocol parsing on the tagged traffic sample to extract multi-dimensional identification features, including the transport layer encryption suite information, application layer protocol mode, traffic timing features, and traffic statistical features. S402. Traverse the feature dictionary formed after feature extraction, identify and remove or obfuscate fields involving privacy and absolute identification in the feature dictionary through a preset regular expression replacement mechanism, so as to perform the automatic desensitization process; S403. Convert the hybrid type features obtained after desensitization into standard feature vectors to generate the desensitized feature vectors. Under the constraint of refusing to retain the original traffic payload, only associate and save the desensitized feature vectors with their corresponding tag information to complete the database entry operation. The hybrid type features include numerical features, categorical features, and string features extracted from the multidimensional identification features after automatic desensitization.

8. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 1, characterized in that, S5 specifically includes: S501. Merge the desensitized feature vectors in the newly generated labeled traffic samples with the pre-stored historical real labeled data, and divide them into a training set and a validation set according to a preset ratio; wherein, the training set contains the desensitized feature vectors in the labeled traffic samples and the historical unknown traffic cluster features that have been manually labeled, and the validation set contains the unlabeled real network traffic features that have been retained and manually confirmed to be labeled. S502. The training set is used to train and fine-tune the preset initial classification model, and performance evaluation and feature distribution drift monitoring are performed on the validation set. After the performance evaluation is qualified, the fine-tuned candidate model and the old model currently online are run in parallel using the shadow mode. The difference of the output results is compared to complete the shadow mode verification. After the verification is passed, the target business traffic classification model is generated. S503. The target business traffic classification model is loaded into memory through a hot loading mechanism, and the inference handle of the old model is replaced to achieve seamless switching and online deployment. At the same time, the old model is recorded for version support to support rollback operations. S504. Use the target service traffic classification model after hot loading to adaptively classify and label real-time network traffic, generate a report containing identification indicators, and push structured identification tags to downstream platforms through standardized network interfaces. S505. After performing the adaptive classification and labeling, the recognition results with confidence in the preset low-to-medium range are selected and pushed to the manual review queue. The manual correction results for the feature samples are received, and the correct labels and original features corresponding to the manual correction results are written into the correction dataset. In response to the correction dataset meeting the preset triggering iteration conditions, the model training fine-tuning steps are re-triggered.

9. The adaptive classification method for service traffic based on agent-based closed-loop scheduling according to claim 8, characterized in that, In step S502, the preset initial classification model is trained and fine-tuned using the training set, and performance evaluation and feature distribution drift monitoring are performed on the validation set, specifically including: For data with new business categories, a few-shot learning strategy is adopted to perform incremental training or fine-tuning using a pre-set prototype network algorithm or a text classification algorithm based on a sentence converter. Data augmentation processing, including temporal jitter and packet drop simulation, is introduced during the training process. Multi-class macro-comprehensive evaluation index, precision, and recall are calculated on the validation set for performance evaluation. Changes in feature distribution are monitored through the Kolmogorov-Smirnov test and the population stability index. When the population stability index is greater than a preset stability threshold, it is determined that the feature distribution has drifted significantly and an early warning is triggered. The shadow mode is used to run the fine-tuned candidate model in parallel with the currently online old model, and the differences in the output results are compared to complete the shadow mode validation. Specifically, this includes: A copy of the real-time network traffic is asynchronously sent to the candidate model, and the output results of the candidate model are compared with those of the old model in real time. The comparison includes not only hard comparison of business category labels, but also probability distribution comparison based on Jaccard similarity or cross-entropy. If the overall difference rate is greater than a first preset threshold or the difference rate of a preset key category is greater than a second preset threshold, a difference alarm is triggered and manual review and confirmation are requested. If the difference rate is within a preset acceptable range, the model is automatically approved for deployment and confirmed as the target business traffic classification model.

10. A service traffic adaptive classification system based on agent-based closed-loop scheduling, based on the service traffic adaptive classification method based on agent-based closed-loop scheduling as described in any one of claims 1 to 9, characterized in that, The system includes: The network traffic acquisition module is used to collect target network traffic and extract multi-dimensional feature vectors. Based on the multi-dimensional feature vectors, an unsupervised clustering algorithm is used to cluster the target network traffic to obtain multiple traffic clusters. The multiple traffic clusters are matched with a preset known service fingerprint database, and traffic clusters that fail to match are marked as unknown traffic clusters. The detection plan generation module is used to extract the core features of the unknown traffic cluster to construct a feature summary, and input the feature summary into a preset large language model to generate a structured business hypothesis indicating a predicted business category; wherein, the structured business hypothesis includes the hypothesis content and the confidence level and suggested verification path corresponding to the hypothesis content; The behavior simulation execution module is used to respond to the structured business hypothesis when the confidence level is greater than or equal to the preset confidence level threshold, schedule the intelligent agent to perform behavior simulation in an isolated sandbox environment according to the suggested verification path, synchronously collect the simulated traffic generated by the behavior simulation, and label the simulated traffic with the label corresponding to the predicted business category to generate labeled traffic samples. The traffic observation and feature construction module is used to extract multi-dimensional identification features, including transport layer encryption suite information and application layer protocol mode, from the labeled traffic samples, and to perform automatic desensitization processing on the multi-dimensional identification features to remove privacy identifier fields, generate desensitized feature vectors, and perform database storage operations. The self-learning and model application module is used to merge the desensitized feature vectors after they are entered into the database with the pre-stored historical real labeled data to build a training set to train and fine-tune the preset initial classification model to obtain the target business traffic classification model. The target business traffic classification model is then used to perform adaptive classification output on real-time network traffic.

Images