A traffic statistical feature alignment method and system based on cross-view contrast learning

Abstract

The application discloses a traffic statistical feature alignment method and system based on cross-view contrast learning, and belongs to the technical field of network traffic analysis and self-supervised representation learning. The method first establishes a behavior center feature selection strategy, excludes endpoint identifiers such as IP and port, and only retains features such as packet size and transmission direction which are directly related to traffic behavior. Then, a multi-dimensional window-level statistical summary is extracted for an effective window to form an independent observable description view. Finally, the discrete state view and the statistical feature view are mapped to a shared contrast space through two independent projection heads, and the InfoNCE loss is used to drive the window-level matching pairs to be close and the non-matching pairs to be separated. The application aligns the codebook state division boundary with the observable statistical behavior boundary, prevents the pre-training driven by prediction from degenerating into short-sighted shortcut learning, and provides a stable and interpretable discrete traffic representation in the behavior sense for a downstream traffic classification task.

Description

Technical Field

[0001] This invention relates to the field of network traffic analysis and self-supervised representation learning technology, and in particular to a method and system for aligning traffic statistical features based on cross-view comparative learning. Background Technology

[0002] Network traffic analysis is a fundamental capability of modern network systems. In encrypted communication environments, application-layer payloads are invisible, and the identifiable semantics of traffic are mainly reflected in observable behavioral statistical features such as packet size distribution, transmission direction rhythm, arrival interval, and transport layer control signals. Self-supervised pre-training methods can effectively reduce the dependence of downstream tasks on labeled data by learning general representations from unlabeled traffic. However, existing traffic representation learning methods based on self-supervised pre-training suffer from four main shortcomings in anchoring the learned representations to observable traffic behavioral statistical features, which restrict the transferability and interpretability of the learned representations in downstream tasks.

[0003] Defect 1: The pre-trained representation lacks explicit anchoring to observable statistical behavior. Existing mask reconstruction methods aim to restore the masked byte content or local labels. Their optimization process is driven solely by reconstruction error, without imposing any constraints on the semantic consistency between the learned representation and observable traffic statistics. This leads to pre-trained representations potentially being organized on arbitrary latent partitions unrelated to the real traffic behavior distribution. When such representations are transferred to downstream tasks, the classifier needs to learn decision boundaries from a latent spatial structure unrelated to behavioral statistics, increasing adaptation costs and weakening generalization ability.

[0004] Defect 2: The use of shortcut features obstructs cross-deployment generalization. Network traffic data naturally contains a large number of endpoint identifiers and deployment-specific fields, such as absolute IP addresses, port numbers, TTL, and absolute TCP sequence numbers. These fields often show a strong correlation between the labeled categories and network topology in a specific dataset, enabling models to achieve high accuracy on the training set by learning these shortcut features. However, the learned patterns are not transferable to different network environments or topology changes. Existing methods generally lack systematic exclusion principles and clear feature selection strategies for shortcut features, leading to potential risks associated with shortcut learning during pre-training.

[0005] Defect 3: Inconsistency between the granularity of statistical feature alignment and the granularity of discrete state quantization. Some methods introduce statistical features as auxiliary information at the stream level, but the quantization of discrete states is usually performed at a finer-grained window level. Stream-level statistical features aggregate behaviors across multiple interaction stages into a single summary, failing to provide semantically accurate behavioral references for window states at different interaction stages. In this case of inconsistent alignment granularity, the constraint of statistical features on discrete states is significantly weakened, failing to effectively drive the alignment of codebook state division with the actual traffic behavior boundaries within the window.

[0006] Defect 4: Discrete states driven solely by the prediction objective are prone to degenerate into short-sighted prediction shortcuts. Pre-training aimed at predicting future traffic flow may drive the model to utilize statistical shortcuts based on short-term contextual patterns in the sequence to complete the prediction task, rather than truly learning state transition patterns that reflect the semantics of application-layer interactions. Specifically, if strong temporal autocorrelation exists within a window sequence, the model can complete predictions through simple extrapolation of recent observations without forming a state representation that interprets the statistical characteristics of traffic behavior. In the absence of behavioral statistical anchoring constraints, this tendency to degenerate is difficult to suppress at the training objective level. Summary of the Invention

[0007] To address the aforementioned shortcomings, the main objective of this invention is to provide a traffic statistical feature alignment method based on cross-view contrastive learning. This method establishes a behavior-centered feature selection principle, constructs a window-level multidimensional statistical summary, and uses InfoNCE contrastive loss to anchor discrete traffic states to observable traffic behaviors. This, in conjunction with the state transition prediction objective, drives the semantic formation of the discrete traffic dictionary.

[0008] Another objective of this invention is to propose a traffic statistics feature alignment system based on cross-view comparative learning.

[0009] To achieve the above objectives, a first aspect of the present invention proposes a traffic statistics feature alignment method based on cross-view comparative learning, comprising:

[0010] S1, extracting behavior center features from network traffic data; S2, Based on the behavior center features, construct a multidimensional statistical summary for each traffic window; S3, the discrete state representation of each flow window and the corresponding multidimensional statistical summary are mapped to the shared comparison space through independent projection heads to obtain the discrete state projection representation and the statistical summary projection representation; S4, using the discrete state projection representation and the statistical summary projection representation of the same flow window as positive sample pairs, and the discrete state projection representation and the statistical summary projection representation of different flow windows as negative sample pairs, the positive sample pairs are driven to move closer to each other and the negative sample pairs move further apart in the shared contrast space by a contrast loss function, so that the discrete state representation is aligned with the multidimensional statistical summary.

[0011] In one embodiment of the present invention, the behavior center feature includes packet length, transmission direction, arrival interval, transmission control protocol flag, Internet Protocol identifier difference, relative sequence number, and relative acknowledgment number, excluding endpoint identifier field and deployment-specific field; the multidimensional statistical summary includes traffic volume feature, packet length distribution feature, temporal structure feature, transmission control event feature, and traffic behavior pattern feature; the extraction of behavior center feature from network traffic data in S1 includes: The normalized data packet length is obtained by dividing the data packet length by the maximum data packet length threshold and then scaling it linearly. Combining the normalized data packet length, the transmission direction is maintained as a binary indicator, with the direction of the first data packet as the positive reference; logarithmic compression is applied to the arrival interval time between the current data packet and the previous data packet, and then z-fractional normalization is performed to obtain the normalized arrival interval time. Combining the normalized arrival interval time, the combination of transmission control protocol flag bits is linearly scaled by dividing by the maximum encoding value to obtain normalized transmission control protocol flag bits; based on the normalized transmission control protocol flag bits, the difference between the Internet Protocol identifiers of the current data packet and the previous co-directional data packet is normalized by z-score to obtain the normalized Internet Protocol identifier difference. Combining the normalized Internet Protocol identifier difference, the relative sequence number relative to the same-direction initial sequence number is subjected to non-negative truncated logarithmic compression and then z-fraction normalization to obtain the normalized relative sequence number. By combining the normalized relative sequence number, the relative confirmation number relative to the reverse initial confirmation number is subjected to non-negative truncated logarithmic compression and then z-fraction normalization to obtain the normalized relative confirmation number.

[0012] In one embodiment of the present invention, the step S1 of extracting behavior center features from network traffic data further includes: For feature dimensions with missing or inapplicable values, the corresponding normalized feature values ​​are set to zero, and the corresponding positions are set to one in the seven-dimensional missing value indicator vector concatenated with the original feature vector, thus forming a fourteen-dimensional data packet input vector.

[0013] In one embodiment of the present invention, the construction of a multidimensional statistical summary for each traffic window in S2 includes: The basic traffic statistics feature set is constructed by calculating the flow duration defined by the sum of the arrival intervals of all data packets within the window, the number of forward and reverse data packets, the total number of bytes in forward and reverse data packets, the mean and standard deviation of the lengths of forward and reverse data packets, and the flow rate defined by dividing the total number of bytes by the window duration. Calculate the mean, standard deviation, variance, maximum and minimum values ​​of all data packet lengths, the maximum value of the forward data packet length, the maximum value of the reverse data packet length, and the skewness of the distribution of all data packet lengths to form a statistical characteristic group of data packet length distribution; Calculate the mean, standard deviation, maximum and minimum values ​​of the interval time between all adjacent data packets, the mean and standard deviation of the interval time between forward adjacent data packets, and the mean and standard deviation of the interval time between reverse adjacent data packets to form a time-series structure statistical feature group. The number of data packets with the FIN flag set, the number of data packets with the SYN flag set, the number of data packets with the RST flag set, the number of data packets with the PSH flag set, the number of data packets with the ACK flag set, and the number of data packets with the URG flag set are calculated to form a statistical feature group for transmission control events. Calculate the forward and reverse packet rates, the mean duration and standard deviation of the active period, and the mean duration of the idle period to form a statistical feature group for traffic behavior patterns. Concatenate the basic traffic statistical feature group, the packet length distribution statistical feature group, the time sequence structure statistical feature group, the transmission control event statistical feature group, and the traffic behavior pattern statistical feature group in order of group to obtain the statistical summary vector corresponding to each traffic window.

[0014] In one embodiment of the present invention, step S3, which maps the discrete state representation of each flow window and the corresponding multidimensional statistical summary to a shared comparison space through independent projection heads, includes: The discrete state projection head takes the quantized representation of each flow window as input and outputs the corresponding discrete state projection representation. The statistical summary projection head takes the statistical summary vector of each flow window as input and outputs the corresponding statistical summary projection representation. Both the discrete-state projection head and the statistical summary projection head are independent lightweight multilayer perceptrons, and the output vectors of both projection heads are applied with respect to... Normalization is performed, with cosine similarity used as the basis for similarity measurement in the shared comparison space.

[0015] In one embodiment of the present invention, step S4, which drives the positive sample pairs to move closer to each other and the negative sample pairs to move further apart in the shared contrast space using a contrast loss function, includes: The similarity between two vectors in the shared contrast space is measured by cosine similarity, and the sharpness of the similarity distribution is adjusted by a temperature hyperparameter. For the discrete state projection representation of the i-th window within a batch, its similarity with all statistical summary projection representations is temperature-scaled and input into softmax. The logarithm of the normalized probability corresponding to the positive sample is used as the contrast loss term for that sample. The InfoNCE contrast loss is obtained by taking the mean of all windows within the batch.

[0016] in, This represents the number of valid windows in the batch. Let be the discrete state projection representation of the i-th window. Let be the projected representation of the statistical summary for the i-th window. For temperature hyperparameters, This is the cosine similarity function.

[0017] In one embodiment of the present invention, after aligning the discrete state representation with the multidimensional statistical summary in step S4, the statistical feature alignment loss, the joint loss of state transition prediction, and the discrete dictionary commitment loss are linearly combined with their respective weights to obtain the total pre-training loss:

[0018] in, To predict the joint loss for state transitions, The dictionary promises to suffer losses. For statistical feature alignment loss, and These are the weighting coefficients for the corresponding losses.

[0019] In one embodiment of the present invention, the statistical feature alignment loss is applied only at locations where the following conditions are met simultaneously: the current location is a window boundary marker, and the window contains a sufficient number of valid data packets to compute a meaningful statistical summary.

[0020] In one embodiment of the present invention, after aligning the discrete state representation with the multidimensional statistical summary in step S4, the parameters of the causal Transformer encoder and the discrete flow dictionary are saved after pre-training. Downstream fine-tuning adopts a two-stage strategy: the first stage freezes the encoder backbone parameters and optimizes only the task-specific classification head with a higher learning rate; the second stage unfreezes all parameters and performs end-to-end fine-tuning with a lower learning rate. In the fine-tuning stage, the dictionary commitment loss is not used, the cross-entropy loss is used as the classification target, and the validation set macro-average F1 score is used as the model selection index.

[0021] To achieve the above objectives, a second aspect of the present invention proposes a traffic statistics feature alignment system based on cross-view contrastive learning, comprising: The feature extraction module is used to extract behavior-centric features from network traffic data; The statistical summary construction module is used to construct a multidimensional statistical summary for each traffic window based on the behavior center features. The data mapping module is used to map the discrete state representation of each flow window and the corresponding multidimensional statistical summary to a shared comparison space through independent projection heads, so as to obtain the discrete state projection representation and the statistical summary projection representation. The feature alignment module is used to take the discrete state projection representation and the statistical summary projection representation of the same flow window as positive sample pairs, and the discrete state projection representation and the statistical summary projection representation of different flow windows as negative sample pairs. The positive sample pairs are driven to move closer to each other and the negative sample pairs are moved further apart in the shared contrast space by a contrast loss function, so that the discrete state representation is aligned with the multidimensional statistical summary.

[0022] The traffic statistical feature alignment method and system based on cross-view contrastive learning in this invention constructs a behavior-centered feature system and compares and aligns discrete traffic states with window-level statistical summaries to ensure that the learned discrete states maintain statistical anchoring to observable traffic behavior. In particular, through the systematic definition of behavior-centered feature selection principles, the construction of window-level multidimensional statistical summaries, and the cross-view alignment design of InfoNCE contrastive loss, the discrete traffic states obtained by vector quantization are anchored to observable window-level statistical behavior, thereby supporting efficient adaptation to downstream analysis tasks such as encrypted traffic classification, application identification, and anomaly detection.

[0023] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0024] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating a traffic statistics feature alignment method based on cross-view comparative learning, provided in an embodiment of the present invention; Figure 2 This is a structural diagram of a traffic statistics feature alignment system based on cross-view comparative learning, provided in an embodiment of the present invention. Detailed Implementation

[0025] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] The following describes, with reference to the accompanying drawings, a method and system for aligning traffic statistics features based on cross-view comparative learning, according to an embodiment of the present invention.

[0028] This embodiment provides a method for aligning traffic statistics features based on cross-view comparative learning. For example... Figure 1 As shown, it includes: S1, extracting behavior center features from network traffic data; S2, Based on the behavior center features, construct a multidimensional statistical summary for each traffic window; S3, the discrete state representation of each flow window and the corresponding multidimensional statistical summary are mapped to the shared comparison space through independent projection heads to obtain the discrete state projection representation and the statistical summary projection representation; S4, using the discrete state projection representation and the statistical summary projection representation of the same flow window as positive sample pairs, and the discrete state projection representation and the statistical summary projection representation of different flow windows as negative sample pairs, the positive sample pairs are driven to move closer to each other and the negative sample pairs move further apart in the shared contrast space by a contrast loss function, so that the discrete state representation is aligned with the multidimensional statistical summary.

[0029] Understandably, this invention first establishes a behavior-centric feature selection strategy. The system excludes endpoint identifiers and deployment-specific fields such as IP address, port number, and TTL, retaining only relative or difference-based features directly related to traffic behavior and protocol state evolution, such as packet size, transmission direction, arrival interval, TCP flags, IP identifier differences, and relative sequence numbers and acknowledgment numbers. This avoids the risks of rapid learning at the feature definition level. Based on this, a multi-dimensional window-level statistical summary covering traffic volume, packet length distribution, temporal structure, TCP control events, and traffic behavior patterns is extracted for each effective window, forming an independent and observable descriptive view of the behavioral characteristics of the same traffic window. In the alignment stage, two independent projection heads map the discrete state view and the statistical feature view to a shared contrast space. InfoNCE loss drives window-level matching pairs to move closer together and non-matching pairs to separate. Constraints are applied to the one-to-one window-level semantic pairing relationship, aligning the codebook's state division boundary with the observable statistical behavior boundary. This prevents prediction-driven pre-training from degenerating into short-sighted shortcut learning detached from real behavioral statistical features, providing a stable and interpretable discrete traffic representation in a behavioral sense for downstream traffic classification tasks.

[0030] Furthermore, the main objective of this invention is to anchor the discrete flow state obtained by vector quantization to the observable window-level statistical behavior boundary through a systematic behavior center feature selection strategy, multi-dimensional construction of window-level statistical summaries, and cross-view InfoNCE contrastive loss design. This prevents the rapid learning degradation during the pre-training process and enables the learned discrete state to simultaneously possess predictability and behavioral statistical interpretability, providing a transferable pre-trained representation for efficient and lightweight adaptation of downstream classification tasks.

[0031] To achieve the above objectives, this invention proposes a traffic statistics feature alignment method based on cross-view comparative learning, the specific technical solution of which is as follows: Step (1.): Systematic selection of behavior-centric features and principles for excluding quick features. The effectiveness of statistical feature alignment depends on the rationality of the feature selection strategy: the selected features should reflect the inherent statistical regularity of traffic behavior, rather than network identifiers or arbitrary absolute quantities in a specific deployment environment, to ensure that the alignment target drives the model to learn behavioral semantics that can be transferred across deployments.

[0032] Step (1.1): Definition and Exclusion Criteria for Shortcut Features. The following types of fields are defined as shortcut features and excluded: Endpoint identification fields, including source and destination IP addresses and port numbers. These fields directly encode endpoint identity information and lack generalization significance across different network topologies; Deployment-specific fields, including the TTL value in the IP header, whose value is affected by network path length and operating system default configuration, and varies irregularly in different deployment environments; Absolute sequence quantity fields, including absolute TCP sequence number and absolute TCP acknowledgment number. These absolute quantities are determined by random values ​​during connection initialization and do not reflect the evolution of application layer interaction states; Session-level identification fields, including the original IP identifier, whose absolute value depends on the sender's identifier allocation strategy and is deployment-specific. The common characteristic of these fields is that they may have a strong correlation with category labels in a specific dataset, but the reflected patterns cannot be stably transferred across different environments. Using these fields will cause the model to produce artificially high performance on the training set but fail to generalize in actual deployment scenarios.

[0033] Step (1.2): Composition of the Behavior Center Feature Set. The following seven feature dimensions, directly related to traffic behavior and protocol state evolution, are retained to form the behavior center feature set: byte length of data packets truncated to the maximum value, reflecting the distribution characteristics of application layer data volume; a binary indicator representing the transmission direction, with the direction of the first data packet as the positive reference, reflecting the symmetry and directional rhythm of bidirectional interaction; arrival interval time defined by the time difference between the arrival of the current packet and the previous packet, reflecting transmission rhythm and burstiness; a combination of TCP flag bits encoded as integers, reflecting the handshake, acknowledgment, reset, and data transmission status of the transmission control layer; the difference between the IP identifier and the previous in-direction packet, eliminating the deployment specificity of absolute values ​​in the form of differences, and retaining detection information for retransmission and out-of-order events; the relative TCP sequence number relative to the initial sequence number in the same direction, reflecting the progress of in-direction transmission while stripping away the absolute offset at the connection level; and the relative TCP acknowledgment number relative to the initial acknowledgment number in the reverse direction, reflecting the cumulative acknowledgment progress of reverse transmission. The above features are all expressed in the form of relative quantities, difference quantities, or binary labels. At the feature definition level, endpoint identifiers and deployment-specific information are excluded, while behavioral signals that have discriminative power over the evolution of application layer interaction states are retained.

[0034] Step (1.3): Missing Value Handling Rules. For feature dimensions in the seven-dimensional feature set that are missing or inapplicable (e.g., TCP-related fields in UDP packets, and the arrival interval of the first packet in the stream), the corresponding normalized feature values ​​are set to zero, and the corresponding positions in the seven-dimensional missing value indicator vector concatenated alongside the original feature vector are set to one, ultimately forming a fourteen-dimensional packet input vector. The missing value indicator vector enables the encoder to distinguish between the two semantically distinct cases of "values ​​of zero" and "fields inapplicable," avoiding the misinterpretation of missing information as valid behavioral signals.

[0035] Step (2.): Normalization encoding of data packet-level behavioral features. To ensure the comparability of the contributions of behavioral features with different dimensions and numerical ranges to the model learning process, a feature-specific normalization transformation is applied to each dimension of the seven-dimensional behavioral center feature set to generate standardized feature vectors for sequence input and prediction targets.

[0036] Step (2.1): Definition of normalization transformation for each dimension. The packet length feature is linearly scaled by dividing by the maximum packet length threshold: The transmission direction feature retains its original binary form: The arrival interval time feature is first subjected to log compression to handle the heavy-tailed distribution, and then z-score normalization is performed. TCP flag features are linearly scaled by dividing by the maximum encoded value. The IP identifier difference feature is directly normalized using z-scores. Relative to the TCP sequence number characteristics, logarithmic compression with non-negative truncation is applied, followed by z-score normalization: Apply the same transformation to the sequence number as to the TCP acknowledgment number characteristic: .in and These are the mean and standard deviation of the corresponding dimension obtained from the training set. To prevent division by zero, the numerical stability constant is set to zero for dimensions with missing values, and the corresponding missing value indicator is set to one.

[0037] Step (2.2): Design basis of the logarithmic compression normalization strategy. The three features—arrival interval time, relative sequence number, and relative confirmation number—all exhibit a heavy-tailed distribution: a large number of values ​​are concentrated in a small interval, while a few extend to the maximum range. If z-score normalization is performed directly, the maximum values ​​will severely interfere with the normalized statistics, causing most effective values ​​to concentrate in a very small range close to zero after normalization, reducing the model's ability to perceive subtle differences within the main value intervals. Logarithmic compression transforms the above heavy-tailed distribution into an approximately symmetrical distribution. After applying z-score normalization, standardized features evenly distributed within the effective numerical range can be obtained, which is beneficial for stable gradient propagation and effective model learning.

[0038] Step (3.): Construction of window-level statistical summary features. The window-level statistical summary is a second view source for statistical feature alignment, providing a behavioral description vector directly computed from observable flow features for each effective window, serving as a contrastive alignment reference complementary to the discrete state view.

[0039] Step (3.1): Design principles of statistical summaries. Window-level statistical summaries should meet the following three design constraints: First, the calculation of the summary depends only on the directly observable packet features within the window, without relying on any internal representation of the model, ensuring that the statistical view is independent of the learning process of discrete states; Second, the granularity of the summary is consistent with the quantization granularity of the discrete states, both defined at the window level, ensuring that the contrast alignment targets are semantically precisely corresponding, and each discrete state corresponds to a unique statistical summary; Third, the summary should cover multiple complementary dimensions reflecting the semantics of traffic behavior, including traffic volume, size distribution, temporal structure, transmission control state, and traffic behavior patterns, to form a comprehensive statistical description of window behavior and provide a semantically rich reference view for contrastive learning.

[0040] Step (3.2): Basic Traffic Statistics Features. Basic traffic statistics features characterize the coarse-grained traffic volume and directional asymmetry within the window, including the following: flow duration defined as the sum of the arrival intervals of all data packets within the window; the number of forward and reverse data packets; the total number of bytes in forward and reverse data packets; the mean and standard deviation of the lengths of forward and reverse data packets; and the flow rate defined as the total number of bytes divided by the window duration. These features, as a whole, reflect the scale ratio and transmission efficiency of bidirectional traffic within the window.

[0041] Step (3.3): Packet Length Distribution Statistical Features. The packet length distribution statistical features characterize the size distribution of all packets within the window, including the following: the mean, standard deviation, and variance of all packet lengths; the maximum and minimum lengths of all packet lengths; the maximum length of forward packets; the maximum length of reverse packets; and the skewness of the overall packet length distribution. The introduction of the skewness index enables the statistical summary to distinguish between control traffic concentrated in the small packet range and data transmission traffic concentrated in the large packet range, as well as a mixed asymmetric distribution pattern of the two.

[0042] Step (3.4): Temporal Structure Statistical Features. Temporal structure statistical features characterize the time distribution of data packet arrivals within the window, including the following: the mean, standard deviation, maximum, and minimum intervals between all adjacent data packets; the mean and standard deviation of the intervals between forward adjacent data packets; and the mean and standard deviation of the intervals between reverse adjacent data packets. Independent calculation of forward and reverse temporal statistics allows the abstract to distinguish the differences in the time rhythm of bidirectional traffic, reflecting two typical temporal patterns: request-response interaction and bidirectional concurrent transmission.

[0043] Step (3.5): TCP Control Event Statistical Feature Group. TCP control event statistical features characterize the frequency of transport control layer events within a window, including the number of packets setting the FIN flag, the SYN flag, the RST flag, the PSH flag, the ACK flag, and the URG flag. The SYN flag count reflects whether the window includes a connection establishment phase; the FIN and RST flag counts reflect connection termination or abnormal reset events; and the PSH and ACK flag counts reflect the control density during data exchange. These counting features expose transport control plane state events in a compact scalar form, providing valuable control semantic information without relying on payload parsing.

[0044] Step (3.6): Flow Behavior Pattern Statistical Features. Flow behavior pattern statistical features characterize the temporal distribution of traffic activity within the window, including the forward and reverse packet rates (calculated by dividing the number of forward and reverse packets by the window duration, respectively), the mean duration and standard deviation of the active period, and the mean duration of the idle period calculated from the packet arrival time intervals within the window duration. The active and idle period statistical features together reflect the burstiness and intermittency of traffic within the window, and are important indicators for distinguishing between continuous transmission applications and interactive request applications.

[0045] Step (3.7): Concatenation and Dimensioning of Statistical Summary Vectors. The statistical features defined in steps (3.2) to (3.6) are concatenated in group order to obtain the statistical summary vector corresponding to each effective window. ,in This represents the total dimension of the statistical summary. This vector is obtained entirely from the features of the original data packets within the window through deterministic statistical calculations, independent of model parameters, and constitutes an independent reference for the discrete-state view.

[0046] Step (4.): Extraction of discrete state representations. Statistical feature alignment is defined at the window granularity, requiring the extraction of discrete state representations at each window boundary as the first view for contrastive learning. Discrete states are jointly generated by the causal Transformer encoder and the vector quantization module. The specific process is defined in the discrete flow dictionary construction method; here, only the extraction interface related to statistical feature alignment is described.

[0047] Step (4.1): Extraction of window boundary context representation. After processing the hierarchical flow sequence, the causal Transformer encoder outputs the corresponding latent context vector at each [WIN] marker position. , where d is the encoder hidden layer dimension. This vector integrates all historical traffic information from the start of the sequence to the end boundary of the i-th window, and is a compact and continuous summary of the current interaction history.

[0048] Step (4.2): Vector quantization and discrete state generation. Context representation for the i-th window. Map it to the codebook using nearest neighbor lookup. The closest codeword in the middle is quantized. The discrete state index is Quantification This is the discrete state vector of the i-th window, which will be compared with the statistical summary vector extracted in step (3.7). Two complementary views that make up the same window will then proceed to the subsequent cross-view comparison and alignment process.

[0049] Step (5): Construction of the cross-view projection space. The discrete state view and the statistical summary view are defined in different feature spaces, and their dimensionality and numerical characteristics differ significantly, making direct similarity measurement impossible. To impose alignment constraints in a unified contrast space, independent projection heads are designed for the two views, mapping them to a shared contrast representation space with the same dimensions.

[0050] Step (5.1): Design of the discrete-state projection head. Discrete-state projection head. For a lightweight multilayer perceptron, the quantization representation of the i-th window is used. For input, output the corresponding comparison representation ,in The dimension of the contrast space. The nonlinear transformation of the projector allows the model to learn an optimal semantic mapping for the contrast learning objective without changing the quantization representation itself, extracting information related to statistical behavior in discrete states and projecting it into the contrast space.

[0051] Step (5.2): Design of the statistical summary projection head. Statistical summary projection head For another independent lightweight multilayer perceptron, the statistical summary vector of the i-th window is used. For input, output the corresponding comparison representation The statistical summary projection head and the discrete-state projection head have independent parameters, and each learns a feature mapping function best suited to the characteristics of its current view. The output vectors of both projection heads are applied... Normalization is used, with cosine similarity as the basis for similarity measurement in the comparison space.

[0052] Step (5.3): The Necessity of Independent Projector Design. Discrete state views (quantized vectors) and statistical summary views (manual statistical features) differ fundamentally in their feature properties: the former is a high-dimensional dense representation learned by a neural network, while the latter is a low-dimensional statistic of the original traffic data. If a single projector is used or similarity is directly calculated in the original feature space, the design of the projection function will be constrained by the differences between the two types of features, making it difficult to find the optimal mapping method for each view. Independent projectors allow the model to optimize its mapping to the contrast space separately for the characteristics of each view, achieving semantic alignment across views without imposing the feature space coupling assumption.

[0053] Step (6.): Construction of positive and negative sample pairs and calculation of InfoNCE contrastive loss. The core of cross-view contrastive learning is to construct semantically matching positive sample pairs and semantically mismatched negative sample pairs in the same batch, so as to drive positive sample pairs to move closer to each other and negative sample pairs to separate each other in the contrastive space with contrastive loss.

[0054] Step (6.1): Definition of positive sample pairs. Given a training batch containing M valid windows, for the i-th window in the batch, represent the projection of its discrete state view. Projection representation of the statistical summary view in the same window Defined as positive sample pairs The two vectors in a positive sample pair describe two complementary aspects of the same traffic window—the discrete state reflects the semantic position of the window after causal history encoding and vector quantization, and the statistical summary reflects the observable behavior statistics of data packets within the window—therefore, they constitute a consistent description of the same interaction segment semantically and should be close to each other in the comparison space.

[0055] Step (6.2): ​​Definition of negative sample pairs and intra-batch negative sample mechanism. For the discrete state projection representation of the i-th window in the batch... Combine it with all other windows within the batch. Statistical summary projection representation Constructing negative sample pairs The two vectors in a negative sample pair come from different flow windows, and there is no semantic correspondence between their discrete states and statistical summaries; therefore, they should be separated in the contrast space. The use of in-batch negative samples eliminates the need for additional negative sample sampling overhead in contrastive learning. The number of contrast samples increases linearly with batch size, achieving a good balance between computational efficiency and contrast quality.

[0056] Step (6.3): Calculation of InfoNCE contrast loss. Using cosine similarity... The similarity between two vectors in the comparison space is measured using the temperature hyperparameter. Adjust the sharpness of the similarity distribution. For the discrete state projection representation of the i-th window within a batch. Project it onto all statistical summary representations The similarity scores, after being scaled by temperature, are input into softmax to evaluate the positive samples. The logarithm of the corresponding normalized probability is used as the contrastive loss term for that sample, and the loss is obtained by averaging over all windows within the batch:

[0057] This loss is a direct application of the InfoNCE loss in the cross-view alignment scenario. It transforms the contrastive learning problem into a classification problem of identifying the correct view that matches the current discrete state among M candidate statistical summaries. This drives the discrete state projection representation to move closer to its corresponding statistical summary projection representation while moving away from the statistical summary projection representations of all other windows in the batch.

[0058] Step (7.): Analysis of the discrete state space constraint mechanism. Statistical feature alignment imposes behavioral statistical constraints on the formation of the discrete state space by comparing alignment targets across views. Its core mechanism can be understood from the following aspects.

[0059] Step (7.1): The propagation path of behavioral consistency constraints. The statistical feature alignment loss is updated simultaneously with the discrete state projection head through backpropagation. and statistical summary projection head The parameters are calculated and the gradients are fed back to the encoder via a pass-through estimator. The encoder is encouraged to produce a contextual representation in the contrast space that is similar to the statistical summary of the corresponding window, thereby semantically aligning the discrete states of the vector quantization assignment with the statistical features of the observable behavior of the window.

[0060] Step (7.2): The intrinsic mechanism of codebook state partitioning and behavior boundary alignment. In discrete codebooks At the semantic organization level, statistical feature alignment imposes an indirect constraint on each discrete state based on the statistical summary of the window it aggregates with: if a codeword is shared by windows with similar statistical behavior, the projected representations of the statistical summaries of these windows are close to each other in the contrast space. The statistical feature alignment loss will drive the corresponding discrete state projected representations to also be close to each other in the contrast space, forming a codebook structure organized based on the similarity of statistical behavior. Conversely, if two codewords are respectively occupied by groups of windows with significantly different statistical behaviors, the statistical feature alignment loss will drive them to separate in the contrast space, aligning the state division boundary of the codebook with the statistical boundary line of the flow behavior.

[0061] Step (7.3): Suppressing the degradation of state transition prediction. When state transition prediction is the sole optimization objective, the encoder may learn shortcut strategies that exploit short-term temporal autocorrelation or local contextual patterns in the sequence. The resulting discrete states may be effective for short-term predictions but lack a correspondence with the statistical distribution of actual traffic behavior. Statistical feature alignment, by forcing the projected representation of each discrete state to align with the projected representation of the statistical summary of its corresponding window in the contrast space, provides the state space with external anchors from observable behavioral statistics. This suppresses the evolution of discrete states in directions unrelated to window statistical features, ensuring that the improvement in predictive ability is truly reflected in the semantic quality of states with behavioral statistical significance, rather than relying solely on short-term shortcuts unrelated to observable behavior.

[0062] Step (7.4): Control of temperature parameters on the strength of the constraint. Temperature hyperparameter. Controlling the sharpness of the similarity distribution in the InfoNCE loss: When a smaller value is taken, the model is required to impose a more stringent distinction on pairs of positive and negative samples in the contrast space, resulting in a stronger contrast constraint. When a larger value is chosen, the constraints are relatively relaxed, allowing for a certain degree of similarity between partially similar non-matching sample pairs. In practical configurations, The selection should be based on batch size and the characteristic distribution of the statistical summary to strike a balance between preventing the contrast target from overly dominating representation learning and providing effective behavioral anchoring.

[0063] Step (8.): Integration of statistical feature alignment with the overall pre-training objective and downstream adaptation interface. Statistical feature alignment, as the statistical behavior anchoring objective, together with the state transition prediction objective and the discrete dictionary commitment loss, constitutes a complete pre-training objective function, jointly optimizing the encoder and codebook, and providing a behaviorally semantically stable pre-trained representation for downstream task adaptation.

[0064] Step (8.1): Composition of the total pre-training loss. The joint state transition prediction loss, discrete dictionary commitment loss, and statistical feature alignment loss are linearly combined with their respective weights to obtain the total pre-training loss:

[0065] in To predict the joint loss for state transitions, the discrete states are driven to retain forward prediction information. To compensate for dictionary commitment loss, the encoder output is constrained to converge toward the assigned codeword in order to stabilize the quantization assignment; and These are the weighting coefficients for the corresponding losses, used to adjust the relative contribution of each objective to the encoder's optimization direction.

[0066] Step (8.2): Analysis of the complementary relationship between statistical feature alignment and other pre-training objectives. The three types of loss branches constrain the semantic formation of discrete states from different perspectives, and their complementary relationships are as follows: The discrete state is driven to form a forward predictive state space guided by the prediction of interactive state evolution, but without explicitly constraining the correspondence between the state and the observable statistical behavior. To fill this gap, each discrete state is anchored to the observable statistical summary of its corresponding window, ensuring that the state division boundary is aligned with the behavioral statistical differences, thus giving interpretability to the discrete state behavioral statistics. Maintaining the stability of quantization allocation between the two prevents the encoder representation from drifting away from the assigned codewords during training, ensuring the consistency of quantization allocation provides a solid discretization foundation for the first two objectives. The three work together to enable the learned discrete state to simultaneously possess temporal predictability, behavioral statistical interpretability, and quantization allocation stability, forming a semantically rich and transferable discrete traffic dictionary.

[0067] Step (8.3): Definition of the application range of statistical feature alignment. Statistical feature alignment applies contrastive alignment constraints only at positions that simultaneously meet the following conditions: First, the current position is marked as [WIN], i.e., the effective window boundary position in the sequence; second, the window contains a sufficient number of effective data packets to compute a meaningful statistical summary. This application range ensures that each pair of (discrete state, statistical summary) sample pairs participating in contrastive alignment has a clear semantic correspondence, avoiding the introduction of noisy contrastive targets at unreliable short-stream or window boundary filling positions. Unlike state transition prediction, which applies dense coverage supervision to all effective marker positions in the sequence, statistical feature alignment applies sparse statistical anchoring constraints only at the window granularity boundary positions. The application granularity of the two is complementary, jointly constraining the semantic formation of discrete states in both the global and local dimensions of the sequence.

[0068] Step (8.4): Downstream Adaptation Interface of the Encoder After Pre-training. After pre-training, the parameters of the causal Transformer encoder and the discrete traffic dictionary are saved as a unified traffic representation module to support efficient and lightweight adaptation to downstream classification tasks. Downstream fine-tuning adopts a two-stage strategy: In the first stage, the encoder backbone (including the embedding layer, Transformer encoder layer, and discrete traffic dictionary) parameters are frozen, and only the task-specific classification head is optimized with a higher learning rate, so that the classification head can quickly adapt to the downstream supervision signal; in the second stage, all parameters are unfrozen, and end-to-end fine-tuning is performed with a lower learning rate, so that the encoder representation can be further specialized to the semantics of the downstream task while retaining the pre-trained behavioral semantic prior. In the fine-tuning stage, the dictionary commitment loss is not used, the cross-entropy loss is used as the classification objective, the macro-average F1 score of the validation set is used as the model selection index, and the optimal checkpoint is retained as the final model to ensure that the selected model has balanced classification performance across all categories.

[0069] The traffic statistical feature alignment method based on cross-view contrastive learning in this invention establishes the behavior center feature selection principle, constructs a window-level multidimensional statistical summary, and anchors discrete traffic states to observable traffic behaviors with InfoNCE contrastive loss, thereby collaboratively driving the semantic formation of the discrete traffic dictionary with the state transition prediction objective.

[0070] To implement the methods of the above embodiments, the present invention also provides a traffic statistics feature alignment system 10 based on cross-view comparison learning, such as... Figure 2 As shown, it includes: Feature extraction module 100 is used to extract behavior center features from network traffic data; Statistical summary construction module 200 is used to construct a multidimensional statistical summary for each traffic window based on the behavior center features; The data mapping module 300 is used to map the discrete state representation of each flow window and the corresponding multidimensional statistical summary to a shared comparison space through independent projection heads, so as to obtain the discrete state projection representation and the statistical summary projection representation. The feature alignment module 400 is used to use the discrete state projection representation and the statistical summary projection representation of the same flow window as positive sample pairs, and the discrete state projection representation and the statistical summary projection representation of different flow windows as negative sample pairs. The positive sample pairs are driven to move closer to each other and the negative sample pairs are moved further apart in the shared contrast space by a contrast loss function, so that the discrete state representation is aligned with the multidimensional statistical summary.

[0071] The traffic statistical feature alignment system based on cross-view contrastive learning in this invention establishes the behavior center feature selection principle, constructs a window-level multidimensional statistical summary, and anchors discrete traffic states to observable traffic behaviors with InfoNCE contrastive loss, thereby collaboratively driving the semantic formation of the discrete traffic dictionary with the state transition prediction objective.

[0072] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0073] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0074] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A traffic statistics feature alignment method based on cross-view comparative learning, characterized in that, include: S1, extracting behavior center features from network traffic data; S2, Based on the behavior center features, construct a multidimensional statistical summary for each traffic window; S3, the discrete state representation of each flow window and the corresponding multidimensional statistical summary are mapped to the shared comparison space through independent projection heads to obtain the discrete state projection representation and the statistical summary projection representation; S4, using the discrete state projection representation and the statistical summary projection representation of the same flow window as positive sample pairs, and the discrete state projection representation and the statistical summary projection representation of different flow windows as negative sample pairs, the positive sample pairs are driven to move closer to each other and the negative sample pairs move further apart in the shared contrast space by a contrast loss function, so that the discrete state representation is aligned with the multidimensional statistical summary.

2. The method as described in claim 1, characterized in that, The behavior center features include packet length, transmission direction, arrival interval, transmission control protocol flag, Internet Protocol identifier difference, relative sequence number, and relative acknowledgment number, while excluding endpoint identifier fields and deployment-specific fields; The multidimensional statistical summary includes traffic volume characteristics, packet length distribution characteristics, temporal structure characteristics, transmission control event characteristics, and traffic behavior pattern characteristics; The extraction of behavior center features from network traffic data in S1 includes: The normalized data packet length is obtained by dividing the data packet length by the maximum data packet length threshold and then scaling it linearly. Combining the normalized data packet length, the transmission direction is maintained as a binary indicator, with the direction of the first data packet as the positive reference; logarithmic compression is applied to the arrival interval time between the current data packet and the previous data packet, and then z-fraction normalization is performed to obtain the normalized arrival interval time; Combining the normalized arrival interval time, the combination of transmission control protocol flag bits is linearly scaled by dividing by the maximum encoding value to obtain normalized transmission control protocol flag bits; based on the normalized transmission control protocol flag bits, the difference between the Internet Protocol identifiers of the current data packet and the previous co-directional data packet is normalized by z-score to obtain the normalized Internet Protocol identifier difference. Combining the normalized Internet Protocol identifier difference, the relative sequence number relative to the same-direction initial sequence number is subjected to non-negative truncated logarithmic compression and then z-fraction normalization to obtain the normalized relative sequence number. By combining the normalized relative sequence number, the relative confirmation number relative to the reverse initial confirmation number is subjected to non-negative truncated logarithmic compression and then z-fraction normalization to obtain the normalized relative confirmation number.

3. The method as described in claim 2, characterized in that, The extraction of behavior center features from network traffic data in S1 also includes: For feature dimensions with missing or inapplicable values, the corresponding normalized feature values ​​are set to zero, and the corresponding positions are set to one in the seven-dimensional missing value indicator vector concatenated with the original feature vector, thus forming a fourteen-dimensional data packet input vector.

4. The method as described in claim 1, characterized in that, The construction of a multidimensional statistical summary for each flow window in S2 includes: The basic traffic statistics feature set is constructed by calculating the flow duration defined by the sum of the arrival intervals of all data packets within the window, the number of forward and reverse data packets, the total number of bytes in forward and reverse data packets, the mean and standard deviation of the lengths of forward and reverse data packets, and the flow rate defined by dividing the total number of bytes by the window duration. Calculate the mean, standard deviation, variance, maximum and minimum values ​​of all data packet lengths, the maximum value of the forward data packet length, the maximum value of the reverse data packet length, and the skewness of the distribution of all data packet lengths to form a statistical characteristic group of data packet length distribution; Calculate the mean, standard deviation, maximum and minimum values ​​of the interval time between all adjacent data packets, the mean and standard deviation of the interval time between forward adjacent data packets, and the mean and standard deviation of the interval time between reverse adjacent data packets to form a time-series structure statistical feature group. The number of data packets with the FIN flag set, the number of data packets with the SYN flag set, the number of data packets with the RST flag set, the number of data packets with the PSH flag set, the number of data packets with the ACK flag set, and the number of data packets with the URG flag set are calculated to form a statistical feature group for transmission control events. Calculate the forward and reverse packet rates, the mean duration and standard deviation of the active period, and the mean duration of the idle period to form a statistical feature group for traffic behavior patterns. Concatenate the basic traffic statistical feature group, the packet length distribution statistical feature group, the time sequence structure statistical feature group, the transmission control event statistical feature group, and the traffic behavior pattern statistical feature group in order of group to obtain the statistical summary vector corresponding to each traffic window.

5. The method as described in claim 1, characterized in that, In step S3, the discrete state representation of each flow window and the corresponding multidimensional statistical summary are mapped to the shared comparison space through independent projection heads, including: The discrete state projection head takes the quantized representation of each flow window as input and outputs the corresponding discrete state projection representation. The statistical summary projection head takes the statistical summary vector of each flow window as input and outputs the corresponding statistical summary projection representation. Both the discrete-state projection head and the statistical summary projection head are independent lightweight multilayer perceptrons, and the output vectors of both projection heads are applied with respect to... Normalization is performed, with cosine similarity used as the basis for similarity measurement in the shared comparison space.

6. The method as described in claim 1, characterized in that, In step S4, driving the positive sample pairs to move closer to each other and the negative sample pairs to move further apart in the shared contrast space using a contrastive loss function includes: The similarity between two vectors in the shared contrast space is measured by cosine similarity, and the sharpness of the similarity distribution is adjusted by a temperature hyperparameter. For the discrete state projection representation of the i-th window within a batch, its similarity with all statistical summary projection representations is temperature-scaled and input into softmax. The logarithm of the normalized probability corresponding to the positive sample is used as the contrast loss term for that sample. The InfoNCE contrast loss is obtained by taking the mean of all windows within the batch. in, This represents the number of valid windows in the batch. Let be the discrete state projection representation of the i-th window. Let be the projected representation of the statistical summary for the i-th window. For temperature hyperparameters, This is the cosine similarity function.

7. The method as described in claim 1, characterized in that, In step S4, after aligning the discrete state representation with the multidimensional statistical summary, the statistical feature alignment loss, the joint loss of state transition prediction, and the discrete dictionary commitment loss are linearly combined with their respective weights to obtain the total pre-training loss: in, To predict the joint loss for state transitions, The dictionary promises to suffer losses. For statistical feature alignment loss, and These are the weighting coefficients for the corresponding losses.

8. The method as described in claim 7, characterized in that, The statistical feature alignment loss applies contrast alignment constraints only at locations where the following conditions are met simultaneously: the current location is a window boundary marker, and the window contains a sufficient number of valid data packets to compute a meaningful statistical summary.

9. The method as described in claim 1, characterized in that, In step S4, after aligning the discrete state representation with the multidimensional statistical summary, the parameters of the causal Transformer encoder and the discrete traffic dictionary are saved after pre-training. Downstream fine-tuning adopts a two-stage strategy: in the first stage, the encoder backbone parameters are frozen, and the task-specific classification head is optimized only with a higher learning rate. The second stage unfreezes all parameters and performs end-to-end fine-tuning with a low learning rate. During the fine-tuning stage, dictionary commitment loss is not used; instead, cross-entropy loss is used as the classification objective, and the validation set macro-average F1 score is used as the model selection metric.

10. A traffic statistics feature alignment system based on cross-view comparative learning, characterized in that, include: The feature extraction module is used to extract behavior-centric features from network traffic data; The statistical summary construction module is used to construct a multidimensional statistical summary for each traffic window based on the behavior center features. The data mapping module is used to map the discrete state representation of each flow window and the corresponding multidimensional statistical summary to a shared comparison space through independent projection heads, so as to obtain the discrete state projection representation and the statistical summary projection representation. The feature alignment module is used to take the discrete state projection representation and the statistical summary projection representation of the same flow window as positive sample pairs, and the discrete state projection representation and the statistical summary projection representation of different flow windows as negative sample pairs. The positive sample pairs are driven to move closer to each other and the negative sample pairs are moved further apart in the shared contrast space by a contrast loss function, so that the discrete state representation is aligned with the multidimensional statistical summary.

Images