A small sample encrypted traffic classification method and system

Abstract

The application discloses a small sample encrypted traffic classification method and system, and relates to the field of network data classification. Firstly, the labeled encrypted traffic is subjected to multi-view feature modeling, the view encoder and the projection head are trained through a supervised contrast loss, so that the model obtains a pre-training feature representation with higher distinguishability. Subsequently, the fusion features of a small number of support samples are extracted and category prototypes are constructed, which are used as classification reference benchmarks. In the inference stage, the Euclidean distance between the query sample and each category prototype is calculated to realize fast classification based on the nearest neighbor principle. The scheme is characterized in that it can support new category recognition without a large number of labels, and can maintain high accuracy in the environment of data scarcity and dynamic category change. Meanwhile, multi-view fusion improves the comprehensiveness and robustness of feature expression, and improves the adaptability and reliability of encrypted traffic classification in actual network scenarios.

Description

Technical Field

[0001] This invention relates to the field of network data classification, specifically to a method and system for classifying encrypted traffic in small samples. Background Technology

[0002] With the increasing diversity of network applications and services, the proportion of encrypted network traffic is rising, and more and more communication protocols, application data, and interactive behaviors are being transmitted in encrypted form. To ensure the effectiveness of tasks such as network security situation analysis, encrypted application identification, abnormal behavior monitoring, and refined traffic scheduling, accurately classifying encrypted traffic without decrypting the data content has become an important research direction in network measurement and intelligent security. Existing encrypted traffic classification methods typically rely on deep learning models to model the statistical characteristics, temporal features, or behavioral patterns of the original traffic, thereby achieving data-driven automated traffic identification.

[0003] However, in real-world network environments, the number of emerging encrypted applications and long-tail categories is increasing daily, resulting in a very limited number of samples for many categories. This leads to a significant small-sample scenario in encrypted traffic classification tasks. In such tasks, traditional deep learning methods typically rely on a large number of labeled samples to obtain stable category representations. When the number of samples is insufficient, the model struggles to learn representative cross-category features, easily leading to decreased classification accuracy and insufficient category discrimination. Furthermore, encrypted traffic often exhibits multi-source features and significant differences across multiple scales, making it difficult for a single view of features to fully characterize the semantic differences between different traffic instances. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method and system for classifying encrypted traffic in small samples.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows:

[0006] In a first aspect, the present invention discloses a method for classifying small-sample encrypted traffic, comprising the following steps:

[0007] Collect encrypted traffic data of a predetermined length and tagged type;

[0008] Multi-view feature extraction is performed on the encrypted traffic data, and the extracted view features are input into the corresponding view encoder to obtain the preset view embedding vector of each view.

[0009] The preset view embedding vectors of each view are input into the corresponding projection head model. The view encoder and the projection head model are trained using supervised contrastive loss to obtain a pre-trained feature encoder for encrypted traffic representation.

[0010] Several categories of support samples are obtained, and the view embedding vector of each support sample is obtained by using the pre-trained feature encoder. The view embedding vector of the support sample is concatenated into the fusion feature vector of the support sample by feature concatenation.

[0011] Calculate the prototype vector of the corresponding category based on the fusion feature vector of the supporting samples for each category;

[0012] Obtain query samples and use a pre-trained feature encoder to process the query samples to generate a fused feature vector of the query samples;

[0013] Calculate the Euclidean distance between the fused feature vector of the query sample and the prototype vector of each category, and classify the query sample into the category corresponding to the nearest prototype vector according to the nearest neighbor principle.

[0014] Secondly, this invention discloses a small-sample encrypted traffic classification system, comprising:

[0015] The encrypted data collection module is used to collect encrypted traffic data of a predetermined length and tagged type;

[0016] The original feature extraction module is used to extract multi-view features from the encrypted traffic data and input the extracted view features into the corresponding view encoder to obtain the preset view embedding vector of each view.

[0017] The feature encoding training module is used to input the preset view embedding vector of each view into the corresponding projection head model, and train the view encoder and the projection head model using supervised contrastive loss to obtain a pre-trained feature encoder for encrypted traffic representation.

[0018] The support sample processing module is used to obtain support samples of several categories, extract features from each support sample using the pre-trained feature encoder to obtain the view embedding vector of the support sample, and concatenate the view embedding vectors of the support samples into a fused feature vector of the support samples using feature concatenation.

[0019] The prototype vector calculation module is used to calculate the prototype vector of the corresponding category based on the fusion feature vector of the supporting samples for each category.

[0020] The query sample processing module is used to obtain query samples and process them using a pre-trained feature encoder to generate a fused feature vector.

[0021] The query sample classification module is used to calculate the Euclidean distance between the fused feature vector and each prototype vector, and classify the query sample into the category corresponding to the nearest prototype vector according to the nearest neighbor principle.

[0022] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0023] 1. By constructing a feature pre-training mechanism with supervised contrastive learning as its core, encrypted traffic forms a more concentrated intra-class and more separated inter-class representation in the multi-view space, which fundamentally improves the feature separability of the model under small sample conditions and effectively alleviates the problem that it is difficult to establish a stable feature structure for small sample categories in existing technologies.

[0024] 2. By further utilizing the fusion expression of multi-view features, the statistical characteristics, sequence characteristics and other multi-dimensional information of encrypted traffic can be characterized simultaneously. Compared with existing methods that rely on single-view features, this invention can obtain a more comprehensive and robust traffic representation, and significantly improve the generalization ability in heterogeneous encrypted traffic scenarios.

[0025] 3. In the small-sample classification stage, by constructing category prototypes based on supporting samples and using a distance metric for rapid classification, the model can adapt to new categories without retraining. This solves the problems of traditional deep models' strong dependence on large-scale labeled data and slow response to new categories. This invention can complete the identification of new categories with extremely low sample cost, significantly improving the applicability of encrypted traffic classification in dynamic network environments. Attached Figure Description

[0026] The disclosure of this invention is illustrated with reference to the accompanying drawings. It should be understood that the drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention. In the drawings, the same reference numerals are used to refer to the same parts. Wherein:

[0027] Figure 1 This is a flowchart of the method of the present invention;

[0028] Figure 2 This is a data flow diagram of the present invention;

[0029] Figure 3 This is a system architecture diagram of the present invention;

[0030] Figure 4 This is the overall architecture of the CL-MetaFlow framework of the present invention;

[0031] Figure 5 This is a comparison chart of the macro F1 scores of different models of the present invention on the 5-way K-shot task. Detailed Implementation

[0032] It is readily understood that, based on the technical solution of this invention, those skilled in the art can propose various interchangeable structural methods and implementations without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention.

[0033] Application Overview

[0034] This invention relates to the field of intelligent network traffic identification and encrypted traffic analysis technology, and particularly to a few-sample encrypted traffic classification method based on a two-stage learning framework of "Contrastive Learning MetaFlow (CL-MetaFlow)". This method addresses the characteristics of encrypted traffic, such as the invisibility of content, the large number of few-sample categories, and the continuous emergence of new categories. By constructing a contrastive learning-driven representation space and a prototype metric-driven few-sample classification mechanism, it achieves intelligent classification throughout the entire process, from large-scale pre-training to rapid adaptation to few samples. It is a highly generalizable classification strategy for encrypted traffic scenarios.

[0035] In existing technologies, most encrypted traffic classification methods rely on training deep models with large-scale labeled data to learn stable feature representations. However, real-world network environments are rife with long-tail categories and emerging encrypted applications, and many categories have a limited number of labeled samples, making it difficult for traditional deep models to achieve reliable class discrimination under small sample conditions. Furthermore, encrypted traffic has multi-view and multi-scale feature structures, and existing technologies generally use a single feature view as input, failing to fully utilize the multi-source information of encrypted traffic. This results in insufficient generalization ability across applications and scenarios, making it difficult to meet the requirements of encrypted traffic recognition in dynamic network environments.

[0036] This invention aims to address the problems of insufficient model feature representation capabilities, poor adaptability to new categories, and low utilization of multi-view features in scenarios with few labeled samples or even new categories of traffic. Its goal is to maintain stable and high-precision classification performance even with very few labeled samples or when facing traffic with new categories. To this end, the proposed CL-MetaFlow two-stage learning framework includes a "contrastive learning representation stage" and a "few-sample meta-classification stage," which improves feature representation quality and few-sample adaptability through joint design.

[0037] like Figure 4The diagram shows the overall architecture of the CL-MetaFlow framework. In the contrastive learning representation stage, this invention first collects encrypted traffic data of a predetermined number of bits and labeled types, extracts multi-view features, and inputs each view feature into the corresponding view encoder to generate view embedding vectors. These embedding vectors are then input into the projection head model, and the view encoder and projection head are trained using supervised contrastive loss. This constructs a unified feature representation space that is compact within classes and clearly separated between classes, obtaining a pre-trained feature encoder for representing encrypted traffic.

[0038] In the few-sample meta-classification stage, this invention can rapidly adapt to new categories using only a small number of support samples without retraining the main model. Specifically, a pre-trained feature encoder is used to extract multi-view embedding vectors of support samples, and a fused feature vector is generated by feature concatenation; then, a category prototype vector is calculated based on the fused vectors of support samples of the same category. For query samples, a fused feature vector is generated in the same way, and the Euclidean distance between it and the prototype vectors of each category is calculated. The category is determined based on the nearest neighbor principle, achieving fast and lightweight classification inference.

[0039] This two-stage CL-MetaFlow framework effectively combines the general feature construction capabilities of contrastive learning with the advantages of prototype metric classification in small-sample scenarios. By improving the discriminativity and stability of feature representations during the pre-training stage, and then utilizing prototype metrics for rapid adaptation in the meta-classification stage, this invention achieves high classification accuracy even with extremely low sample sizes. This method reduces reliance on large-scale labeled data, improves model robustness and adaptability in scenarios where new categories emerge rapidly, and exhibits significant advantages such as flexible deployment, strong generalization ability, and high classification accuracy, making it suitable for intelligent identification of encrypted traffic in real-world network environments.

[0040] like Figure 1 , Figure 2 As shown, this application discloses a method for classifying small-sample encrypted traffic, including the following steps:

[0041] Collect encrypted traffic data of a predetermined number of bits and labeled types; this encrypted traffic data collectively constitutes a pre-training set, the technical value of which lies in providing the model with sufficient known category samples as the basis for learning general traffic feature representations. By learning from the traffic of large-scale known applications (such as video streaming, web browsing, file transfer, etc.), the model can extract discriminative general behavioral patterns that transcend specific applications.

[0042] Multi-view feature extraction is performed on encrypted traffic data, and the extracted view features are input into the corresponding view encoder to obtain the preset view embedding vector of each view. The purpose of multi-view feature extraction is to characterize the behavioral features of encrypted traffic from multiple complementary dimensions.

[0043] Specifically, features are extracted from traffic view, time view, statistical view, and protocol view. Each view provides different aspects of traffic behavior: the traffic view reflects the sequence patterns of packet size and direction; the time view captures inter-packet arrival times and bursty characteristics of traffic; the statistical view provides statistics such as flow duration and total number of packets; and the protocol view focuses on transport layer interaction patterns such as TCP flag sequences. The advantage of this multi-view representation technique is that it overcomes the limitations of a single feature perspective, providing a rich and comprehensive information foundation for subsequent feature learning.

[0044] Each view encoder is an independent neural network whose purpose is to map the original high-dimensional, noisy view features to a low-dimensional, dense embedding space. This transformation process achieves feature dimensionality reduction on the one hand, and extracts deeper abstract feature representations through the nonlinear transformation of the neural network on the other.

[0045] The preset view embedding vectors of each view are input into the corresponding projection head model. The view encoder and the projection head model are trained using supervised contrastive loss to obtain a pre-trained feature encoder for encrypted traffic representation. The supervised contrastive loss function, by utilizing the class labels of samples, forces the embedding vectors of samples from the same class to be close to each other in the projection space, while embeddings of samples from different classes are kept far apart. The technical effect of this training mechanism is that it actively shapes a metric-friendly feature space, where intra-class distance is minimized and inter-class distance is maximized, laying a high-quality metric foundation for subsequent few-shot classification.

[0046] After obtaining the pre-trained feature encoder for representing encrypted traffic, the process proceeds to the meta-learning stage.

[0047] First, support samples from several categories are obtained. A pre-trained feature encoder is used to extract features from each support sample, resulting in a view embedding vector. Feature concatenation is then used to concatenate these view embedding vectors into a fused feature vector for the support samples. This leverages the powerful feature representation capabilities learned during the pre-training phase, enabling even entirely new and unseen traffic categories to be mapped into a well-structured feature space. The view embedding vectors of the support samples extracted by the pre-trained feature encoder are concatenated using a parameterless method. This approach aims to fully preserve the complementary information of each view, forming a comprehensive and robust fused feature representation, while avoiding the introduction of additional trainable parameters under small sample conditions, effectively preventing overfitting.

[0048] The prototype vector for each category is calculated based on the fused feature vectors of the supporting samples. This prototype vector is calculated by averaging the fused feature vectors of all supporting samples for each category. The technical advantage of this step is that it establishes a representative "centroid" for each new category. This "centroid" accurately reflects the center position of the category in the feature space, providing a reliable reference for subsequent distance comparison classification.

[0049] For query samples that need to be classified, a pre-trained feature encoder is also used to generate a fused feature vector for the query samples. This step ensures that the query samples and support samples are represented in the same feature space, thus ensuring the consistency of the metrics.

[0050] The Euclidean distance between the fused feature vector of the query sample and the prototype vectors of each category is calculated. Based on the nearest neighbor principle, the query sample is classified into the category corresponding to the nearest prototype vector. A distance-based nonparametric classification method is employed, fully utilizing the favorable metric space characteristics established during the pre-training phase. Accurate classification can be achieved directly through distance comparison in the feature space, ensuring both classification reliability under small sample conditions and maintaining the algorithm's efficiency.

[0051] CL-MetaFlow was compared with multiple baselines under different K-shot settings. Detailed results for the macro F1 scores are shown in the table below:

[0052] Table 1. Performance comparison on the 5-way K-shot task (macro F1 score)

[0053] Starting from scratch (without pre-training) ProtoNet 0.350 0.384 0.387 0.391 MAML 0.346 0.439 0.458 0.463 Pre-training and Adaptive Paradigm AE+ProtoNet 0.346 0.429 0.459 0.477 SimCLR+ProtoNet 0.421 0.545 0.563 0.578 Meta-Baseline 0.455 0.582 0.601 0.615 CL (Fine-tune) 0.104 0.160 0.198 0.224 T-Sanitation (re-impl.) 0.462 0.591 0.613 0.625 CL-MetaFlow (Ours) 0.479 0.620 0.632 0.650

[0054] In 5-way K-shot, "5-way" refers to a specific classification task that involves identifying and distinguishing between 5 different categories of encrypted traffic applications (e.g., Zoom, Netflix, BitTorrent, Skype, WhatsApp); and "K-shot" refers to the number of labeled samples in each category, where K represents the number of labeled samples provided for each category.

[0055] Figure 5 A comparison graph of macro F1 scores for different models on the 5-way K-shot task;

[0056] Figure 5 The advantages of CL-MetaFlow are clearly demonstrated in Table 1. The analysis of Table 1 and... Figure 5 From the content, we can draw the following conclusions:

[0057] The necessity of pre-training: CL-MetaFlow far outperforms methods starting from scratch, such as ProtoNet and MAML (e.g., in the 5-shot case, the F1 score is 23.6% higher than ProtoNet by an absolute value). This confirms that learning from scratch is ineffective for complex traffic data; a strong feature prior is essential.

[0058] Superiority of Supervised Contrast Pre-training: Our method significantly outperforms both reconstructed pre-training (AE+ProtoNet) and unsupervised contrastive pre-training (SimCLR+ProtoNet). In a 5-shot setting, the gap between CL-MetaFlow (0.620) and SimCLR+ProtoNet (0.545) highlights the critical importance of leveraging base class labels via SupCon during pre-training for shaping a more discriminative feature space tailored to the classification task.

[0059] The Necessity of Meta-Learning Adaptation: The most thought-provoking comparison is with Fine-Tune (CL). Despite using equally powerful pre-trained encoders, traditional fine-tuning strategies suffer catastrophic performance collapses due to severe overfitting. In contrast, nonparametric adaptive methods like Meta-Baseline (0.582) and our prototype network-based approach (0.620) are far more robust and efficient. This validates the superiority of meta-learning adaptation strategies in unlocking the potential of pre-trained models.

[0060] Superior Data Efficiency: A significant finding is the data efficiency of our framework. CL-MetaFlow outperforms the standard ProtoNet trained with fifteen samples per class (K=15, F1 score ≈ 0.39) when trained with only one sample per class (K=1, F1 score ≈ 0.48). This demonstrates strong generalization ability, showing that the structured feature space enables the model to extract significantly more discriminative information from each scarce sample.

[0061] By combining the above technologies, the general feature representation learning in the pre-training stage and the rapid adaptive learning of small samples in the meta-learning stage are effectively decoupled. This overcomes the performance degradation problem caused by the simultaneous learning of feature representation and classifier under small sample conditions in traditional methods, and significantly improves the ability to identify new encrypted traffic applications.

[0062] The extraction of view features from encrypted traffic data specifically includes four core views: traffic view features, time view features, statistical view features, and protocol view features. These four views comprehensively depict the behavioral characteristics of encrypted traffic from different dimensions.

[0063] Traffic view features primarily extract derived features from packet size and direction sequences. The purpose of this view is to capture the "data morphology" patterns in the communication process; even when traffic content is encrypted, packets generated by different applications still exhibit unique pattern characteristics in size distribution and transmission direction. For example, video streaming applications typically generate continuous large downlink packets, while instant messaging applications exhibit alternating small bidirectional packets. By analyzing these packet size and direction sequence patterns, this view can effectively distinguish encrypted traffic generated by different types of applications.

[0064] The time-view feature focuses on packet arrival times, traffic bursts, and periodicity. Its technical value lies in revealing the "time rhythm" of communication. Different network applications exhibit significant differences in data transmission time patterns: real-time video conferencing exhibits strictly uniform transmission with small intervals, while email clients may display bursty, batch transmission patterns. By accurately capturing the time interval sequence of packet arrivals and traffic burst statistics, this view provides crucial information for distinguishing applications with different real-time requirements.

[0065] The statistical view features include statistics such as stream duration, total number of packets, packet size distribution, and payload entropy. The purpose of this view is to provide a "macro-statistical summary" of the communication process. Stream duration reflects the persistence of the session, the total number of packets reflects the activity level of the interaction, packet size distribution reveals the granularity of the transmitted data, and payload entropy reflects the degree of randomness in the encrypted data. The combination of these statistical features can effectively characterize the overall behavioral patterns of different application categories, providing a stable statistical basis for classification.

[0066] Protocol view features are extracted from observable parameters at the transport and handshake layers, including TCP flag sequences, handshake patterns, and other protocol interaction characteristics. The technical effect of this view is to capture the "protocol interaction" behavior of the communicating parties. Even if the traffic content is encrypted, the control information in the TCP / IP protocol stack remains visible, and different applications exhibit unique protocol interaction patterns during connection establishment, maintenance, and termination. For example, web browsing applications frequently establish short-lived TCP connections, while file transfer applications tend to maintain long-lived connections and perform continuous data transmission.

[0067] The technical advantage of combining these four view features lies in constructing a comprehensive and complementary feature representation system. Each view reveals the behavioral characteristics of encrypted traffic from a different perspective. When these view features are used in combination, they overcome the limitations of a single feature perspective, providing a rich and robust information foundation for subsequent feature learning and classification. This multi-view fusion approach enables the system to accurately identify and classify different network applications based on externally observable behavioral features, even under encrypted conditions.

[0068] To quantify the contribution of each of the four views and understand their interactions, ablation experiments were performed by removing one view at a time. This process helps to reveal the hierarchy of feature importance for few-shot encrypted traffic classification tasks. Results on the 5-way 5-shot task are shown in Table 2:

[0069] Table 2. Ablation studies with contributions from different views (5-way 5-shot macro F1 score)

[0070] Baseline (All Views) 0.6197 - Remove Flow View 0.5246 -0.0951 Remove Temporal View 0.5727 -0.0470 Remove Protocol View 0.5848 -0.0349 Remove the Statistical View. 0.6088 -0.0109

[0071] Analyzing Table 2, we can draw the following conclusions:

[0072] All views have value: removing any single view results in a performance degradation, which confirms that our multi-view representation is effective and that its components are complementary rather than redundant.

[0073] Priority of Behavioral Patterns: The traffic view is the most critical feature; removing it results in a sharp performance drop of 9.51%. This strongly suggests that the sequence of packet size and direction contains the most discriminative information.

[0074] Importance hierarchy: Performance degradation reveals a clear hierarchy of feature importance: traffic, time, protocol, statistics. This in-depth analysis validates our multi-view design and provides valuable insights for feature engineering in future encrypted traffic analysis.

[0075] Both the view encoder and the projection head model are independent two-layer multilayer perceptrons (MLPs), and this architectural choice can achieve a balance between model expressiveness and computational efficiency.

[0076] The view encoder takes 32-dimensional view features as input, passes them through a 512-dimensional hidden layer with ReLU activation, and finally outputs a 256-dimensional feature embedding. This design has several technical advantages: First, the dimensionality increase from 32 to 512 dimensions provides the model with sufficient capacity to learn complex nonlinear feature transformations, allowing the original handcrafted features to be effectively mapped to a higher-level abstract representation space. The introduction of the ReLU activation function not only enhances the model's nonlinear expressiveness but also effectively alleviates the gradient vanishing problem common in deep neural networks, ensuring the stability and convergence efficiency of the training process. The final 256-dimensional feature embedding, while retaining sufficient information, achieves feature compression and refinement, providing standardized, high-quality feature input for subsequent multi-view fusion.

[0077] The projection head model receives the 256-dimensional feature embeddings output by the view encoder and further maps them to a 128-dimensional projection space. The purpose of this design is to construct a feature projection layer specifically for contrastive learning. The technical benefits of reducing the dimensionality from 256 to 128 are mainly reflected in two aspects: firstly, this moderate dimensionality reduction helps remove redundant information from the features, retaining the most discriminative core feature components; secondly, the lower dimensionality facilitates similarity calculation in the subsequent supervised contrastive loss function, improving computational efficiency and helping the model learn more compact and discriminative feature representations.

[0078] Both the view encoder and the projection head model employ independently designed two-layer multilayer perceptrons. Each view encoder independently processes the features of its corresponding view, enabling the model to learn the feature representation patterns of different views in a specialized manner and avoiding mutual interference between features of different modalities. The independence of the projection head model ensures that, during the pre-training phase, the features of each view can be optimized through comparative learning in a dedicated projection space. This modular design not only improves the model's expressive power but also enhances the system's scalability and maintainability.

[0079] Through the aforementioned neural network architecture, this invention achieves efficient encoding and optimization of multi-view encrypted traffic features. The view encoder is responsible for extracting high-level abstract representations from the original features, while the projection head model specifically optimizes feature projection during the contrastive learning process. The two work together to ensure that the final feature embedding has high discriminativeness and metric friendliness, laying a solid technical foundation for subsequent few-shot classification tasks.

[0080] The view encoders are frozen after supervised contrastive loss training and used as pre-trained feature encoders. "Freezing" means fixing the weight parameters of all view encoders at the model parameter level, preventing them from participating in gradient updates and backpropagation in subsequent meta-learning stages. This means the feature extraction capabilities optimized by supervised contrastive learning are fully preserved, becoming a stable and invariant feature extraction basis for subsequent few-shot classification tasks. Each view encoder retains the ability learned during pre-training to map raw view features to a high-quality embedding space.

[0081] Furthermore, because the parameters of the pre-trained feature encoder are frozen, the feature extraction process remains stable and consistent during the meta-learning phase, regardless of how sparse the support set samples are. This effectively prevents the overfitting problem that easily occurs when directly training deep networks under small sample conditions. The model will not change its feature extraction strategy due to specific noise in a few support samples, thus ensuring the robustness and generalization of the feature representation. Simultaneously, during the meta-learning phase, since the parameters of the view encoder remain unchanged, only forward propagation is needed to calculate the feature embeddings, without needing to calculate the gradients of these components or update the parameters. This effectively reduces computational overhead and memory usage, enabling the model to quickly respond to new small-sample classification tasks, making it particularly suitable for network traffic classification scenarios requiring real-time or near-real-time processing.

[0082] Through the pre-trained feature encoder described above, it is ensured that in the task of classifying encrypted traffic with a small number of samples, the model can utilize the powerful feature representation capabilities learned on large-scale data on the one hand, and maintain the stability and efficiency of learning under the condition of a very small number of samples on the other hand, ultimately achieving excellent performance in the identification of new categories of encrypted traffic.

[0083] The core technology of supervised contrastive loss training lies in making full use of the category label information of encrypted traffic data to construct positive and negative sample pairs, thereby guiding the model to learn highly discriminative feature representations.

[0084] In the specific implementation process, for any anchor point sample Positive and negative samples are automatically defined based on category labels. All samples with anchor points... Other samples belonging to the same category are defined as positive samples, forming a set of positive samples. ; and all samples in the batch that are related to the anchor point Samples belonging to different categories are defined as negative samples, which, together with positive samples, constitute the reference sample set. The effect of this sample partitioning method is that it provides the model with a clear learning objective: to group samples of the same category together in the feature space, while pushing samples of different categories apart.

[0085] The loss function for supervised contrastive loss training is defined as:

[0086] ;

[0087] This represents the supervised contrastive loss value during the supervised contrastive loss training process. This represents the entire set of samples used in supervised contrastive loss training. The number of samples in the positive sample set;

[0088] The numerator of the above formula calculates the anchor point sample. The weighted sum of similarities between the sample and all positive samples, where the similarity is calculated by... Normalization is performed to ensure fairness under different numbers of positive samples. Represents anchor point sample eigenvectors Feature vectors of positive samples The dot product operation between them.

[0089] The denominator then calculates the anchor point samples. The sum of similarities with all other samples in the batch (including positive and negative samples). Represents anchor point sample eigenvectors With sets The dot product operation of the eigenvectors of any sample in the dataset.

[0090] The dot product operation in the numerator and denominator, after normalization in the feature space, is equivalent to the cosine similarity between vectors. A larger value indicates greater similarity between the two vectors; a smaller value indicates less similarity.

[0091] It is an exponential function that maps similarity values ​​to a positive range and amplifies the differences between similarities.

[0092] The essence of this score is: the similarity between the anchor point and the positive sample, out of its total similarity with all samples; this proportion can be viewed as a probability, i.e., "anchor point sample..." "The probability of being correctly identified as its true category." Ideally, this probability should be close to 1. Take the negative logarithm of the entire ratio. When the probability is high, the loss is low; when the probability is low, the loss is high.

[0093] The entire loss function, in the form of a logarithmic ratio, forces the model to learn feature representations that maximize the numerator and minimize the denominator.

[0094] Temperature overparameters This plays a moderating role in the loss function, controlling the sharpness of the similarity distribution: a smaller... A higher similarity value amplifies similarity differences, causing the model to focus more on difficult-to-distinguish sample pairs; while a higher similarity value... This makes the distribution smoother, providing a gentler gradient signal. This adjustable characteristic allows the model to adaptively adjust its learning focus based on the characteristics of the data, thereby achieving better feature representation.

[0095] The supervised contrastive loss training mechanism described above can effectively construct metric-friendly embedding representations in the feature space. By explicitly utilizing class label information, the feature representations learned by the model can form clustering structures, with samples of the same class clustering tightly in the embedding space, while samples of different classes maintain sufficient distance. This characteristic greatly facilitates the subsequent meta-learning stage, enabling distance-based prototype classification methods to operate efficiently in the feature space. Furthermore, the training method described above also exhibits good generalization ability. Because the model learns the relative relationships between samples rather than absolute classification boundaries, the learned feature representations can be well transferred to new, unseen classes. This characteristic plays a crucial role in few-shot encrypted traffic classification scenarios, as it ensures that the knowledge gained in the pre-training stage can effectively support the rapid identification and classification of new traffic categories.

[0096] Through the above-mentioned supervised contrastive loss training mechanism, this scheme establishes a powerful and universal feature learning foundation for encrypted traffic classification, enabling the model to maintain excellent classification performance even with a very small number of labeled samples, effectively solving the feature representation problem in a small sample learning environment.

[0097] A fused feature vector for the support samples is constructed by parametrically concatenating the multi-view feature embeddings of the support samples. Specifically, this involves embedding the four view embedding vectors of the support samples: the traffic view embedding vector of the support samples. Supports temporal view embedding vectors for samples Supports statistical view embedding vectors for samples Supporting sample protocol view embedding vector By concatenating functions By combining them, a unified fusion feature vector of support samples is formed. .

[0098] Unlike traditional weighted fusion or neural network-based fusion methods, the concatenation function... The combination does not require the introduction of any trainable parameters; it simply connects and combines the feature vectors of each view in a dimensional manner. This design has significant technical advantages in few-shot learning environments: because the support set samples in the meta-learning stage are extremely small, any additional trainable parameters can easily lead to overfitting, while parameterless concatenation completely avoids this risk, ensuring the stability and generalization ability of the model under few-shot conditions.

[0099] From an information preservation perspective, each view embedding vector contains behavioral characteristics unique to that view: traffic view embeddings capture the sequence patterns of data packets, time view embeddings reflect the temporal characteristics of traffic, statistical view embeddings provide macroscopic statistical features, and protocol view embeddings contain protocol interaction information. Through a simple concatenation operation, these features from different perspectives are completely preserved without losing any original information due to weighting or transformation during the fusion process, thus forming a comprehensive and rich integrated feature representation.

[0100] The concatenation function itself is computationally simple, requiring no complex matrix operations or nonlinear transformations, resulting in minimal computational overhead during inference. This enables the entire fusion process to be completed efficiently, making it suitable for network traffic classification scenarios with high real-time requirements. Furthermore, since no additional parameter optimization is needed, the training process during the meta-learning phase is also more stable and efficient.

[0101] To validate the choice of simple feature concatenation as the fusion method, an additional experiment was conducted, comparing it with a more complex attention-based fusion mechanism ('CL-MetaFlow-Attn').

[0102] In this variant, a small attention network learns to assign weights to the features of each view before summing; the analysis results are shown in Table 3:

[0103] Table 3. Comparison of Feature Fusion Methods (5-way 5-shot Macro F1 Score)

[0104] CL-MetaFlow 0.6197 CL-MetaFlow-Attn 0.6152

[0105] The results shown in Table 3 indicate that while the attention mechanism performs well, it does not offer a significant advantage over simple concatenation and introduces additional complexity. This suggests that within the two-stage framework of this scheme (CL-MetaFlow), since the pre-trained features already possess high discriminative power, a simple and parameter-free fusion method like concatenation is a more robust and efficient choice.

[0106] This multi-view feature fusion scheme fully utilizes the unique discriminative information of each view while avoiding the risk of overfitting under small sample conditions, forming a comprehensive and robust feature representation that provides a high-quality feature foundation for subsequent prototype calculations and classification decisions. This technical feature effectively solves the contradiction between feature richness and model complexity in small sample environments and is a key step in achieving efficient small-sample encrypted traffic classification.

[0107] Prototype vector computation first relies on the fused feature vector of the support samples obtained in the preceding steps. These fused feature vectors already contain rich information from four views: traffic, time, statistics, and protocol, providing a high-quality feature foundation for prototype computation. For each new category to be classified... (in , (Representing the total number of categories involved in this classification task), the system will select from the entire set of all supporting samples, i.e., the support set. The sample is then filtered to select all samples belonging to that category.

[0108] prototype vector The calculation formula is:

[0109] ;

[0110] in, Indicates the first The fused feature vector of each supporting sample;

[0111] The above formula embodies the idea of ​​mean clustering, which uses categories... All Sum the fused feature vectors of each support sample and divide by the number of samples. This yields the prototype vector for that category. The filtering conditions in this calculation process... This ensures that only samples truly belonging to that category participate in the calculation, avoiding interference between categories. Representative support group One of the labeled samples, For sample data, This corresponds to the actual category label.

[0112] By calculating the average value, the prototype vector This approach effectively counteracts the influence of noise and outliers in individual samples, resulting in a robust estimate of the overall characteristics of the category. This prototype representation is particularly important in small-sample environments because it can extract the most class-discriminative common features from a limited sample size.

[0113] Regardless of how many supporting samples are included in each category ( (Value size), and ultimately each category is compressed into a single prototype vector. This representation greatly simplifies the subsequent classification calculation process, allowing the system to only need to store and compare values ​​when performing distance comparisons. Using a prototype vector instead of the original features of all supporting samples significantly improves computational efficiency.

[0114] From a mathematical perspective, prototype vectors The computation essentially involves finding the centroids of each category in the feature space. Based on the well-developed metric space properties established during pre-training, feature vectors of samples from the same category naturally cluster together, while samples from different categories remain separate. By calculating the centroids, the central location of each category in the feature space can be accurately captured, providing a reliable reference point for distance-based classification decisions.

[0115] Through the aforementioned prototype vector computation mechanism, this scheme transforms the complex few-sample classification problem into a simple nearest neighbor search problem in a high-quality feature space, ensuring both classification accuracy and algorithm efficiency, and providing a solid technical foundation for realizing real-time online encrypted traffic classification.

[0116] For the classification process of query samples, a mechanism based on probabilistic distance comparison is adopted. This mechanism enables the small sample classification process to maintain mathematical rigor while also possessing flexibility in practical applications.

[0117] In terms of technical implementation, for the first Query sample First, the fused feature vector is obtained through a pre-trained feature encoder. Then, the eigenvector is calculated along with all... The squared Euclidean distance between the prototype vectors of each category. Let be the distance function, representing the squared Euclidean distance. The squared Euclidean distance is not only computationally efficient, but also accurately reflects the similarity between samples in a high-quality feature space.

[0118] Specifically:

[0119] ;

[0120] Indicates query sample With category prototype vector The "similarity score" indicates a high degree of similarity between the sample and the category. The better the match. Similarly, Indicates query sample With category prototype vector The "similarity score" is used to evaluate the query sample. With all The similarity scores of each category are summed and used as the denominator.

[0121] The probability distribution is obtained by applying the Softmax function to the negative squared Euclidean distance. The mathematical expression for this transformation process is as follows: taking the negative squared Euclidean distance between the query sample and each class prototype as input, and then applying an exponential function and normalization, the probability distribution of the query sample is obtained. Category belongs to probability The use of the negative sign is a key technical design feature. It transforms the "distance minimization" problem into a "similarity maximization" problem, resulting in higher probability values ​​for categories with smaller distances.

[0122] The probabilistic output format provides richer decision-making information than simple nearest neighbor classification. It not only gives the most probable class judgment but also provides the confidence level for each candidate class, which is invaluable in applications requiring reliability assessment of classification results. When the probability values ​​of multiple classes are similar, users can identify these "difficult-to-determine" samples and take further verification measures.

[0123] Meanwhile, the Softmax-based probabilistic transformation enhances robustness in handling boundary samples. In the feature space, some query samples may lie near the decision boundaries of two or more classes. The probabilistic output can clearly reflect such boundary situations, avoiding the risk of misclassification that may arise from hard decision-making. This flexible classification mechanism is particularly suitable for application scenarios such as encrypted traffic classification, which inherently possess a certain degree of ambiguity.

[0124] The entire classification process requires no trainable parameters, relying entirely on the quality of the feature space obtained during pre-training and the prototype vectors computed during the meta-learning phase. This non-parametric characteristic ensures that overfitting does not occur under small sample conditions, while also making the classification decision process highly interpretable. Furthermore, the Softmax function ensures that the sum of the probabilities of all classes is 1, satisfying the basic requirements of the probability distribution. Through logarithmic space computation techniques, potential numerical overflow issues in exponential calculations are avoided, guaranteeing the reliability of the algorithm in practical deployments.

[0125] To address the sensitivity issue of the classification head, a nonlinear adapter was evaluated as an alternative to simple distance-based classification in the prototype network. Specifically, a two-layer multilayer perceptron (MLP) was used instead of distance computation. This MLP takes the query embedding and class prototype as input to predict a matching score, and the results are shown in Table 4.

[0126] Table 4. Comparison of Adaptive Methods (5-way 5-shot Macro F1 Score)

[0127] Prototype distance (method in this scheme) 0.6197 Nonlinear MLP adapter 0.5985

[0128] The results shown in Table 4 indicate that the nonlinear adapter performs worse than the simpler method in this scheme. This is presumably due to overfitting on a small K-shot support set, as the MLP introduces additional parameters that are difficult to train with limited data. This finding reinforces the correctness of choosing a nonparametric, metric-based approach in this scheme, which is more robust in small sample settings.

[0129] Through the probabilistic classification mechanism described above, this scheme successfully combines distance metric with probability estimation, inheriting the intuitiveness and effectiveness of the nearest neighbor method while incorporating the rich information and robustness of the probabilistic model, providing an accurate and practical solution for small-sample encrypted traffic classification.

[0130] like Figure 3 As shown, this application also discloses a small-sample encrypted traffic classification system, which forms a complete hardware and software collaborative implementation scheme through modular design. The technical features and effects of each module are described in detail below.

[0131] The encrypted data collection module is responsible for collecting encrypted traffic data of a predetermined length and already tagged types. This module establishes a standardized data collection and storage mechanism, capable of obtaining raw encrypted traffic from network interfaces, traffic mirroring ports, or historical traffic databases, and associating it with application type tags. It provides a standardized data input interface for the entire system, ensuring that subsequent processing stages obtain training and testing data of controllable quality and accurate labels, thus guaranteeing system reliability from the source.

[0132] The original feature extraction module undertakes the core function of multi-view feature extraction. This module integrates multiple parallel feature processing units, capable of simultaneously extracting traffic view, time view, statistical view, and protocol view features from traffic data. Each feature processing unit is optimized for the feature type of a specific view, such as using a sliding window to process packet sequences and using statistical counters to aggregate flow information. This achieves efficient parallel extraction of multi-dimensional features, fully leveraging the advantages of modern processors' multi-core architecture, and significantly improving the speed and efficiency of feature extraction.

[0133] The feature encoding training module is a key component for pre-training. This module includes a view encoder group, a projector head model group, and a supervised contrastive loss calculation unit. Employing a batch training mechanism, the module automatically constructs positive and negative sample pairs, calculates the contrastive loss, and backpropagates to update parameters. Through dedicated hardware acceleration and memory optimization, the efficiency of large-scale data pre-training is significantly improved, making it possible to train a high-quality feature encoder within a reasonable timeframe.

[0134] The support sample processing module is specifically designed for handling small support set data. This module integrates the inference engine of a pre-trained feature encoder and a multi-view feature concatenation unit. It can batch process support samples, automatically invoking the corresponding view encoder to extract feature embeddings, and achieving parameter-free feature concatenation through efficient memory operations. It provides a specially optimized data processing pipeline for few-shot learning, ensuring fast and stable generation of high-quality fused feature representations even with a very small number of samples.

[0135] The prototype vector calculation module enables online computation of category prototypes. This module includes a category sample filter, a vector accumulator, and a mean calculator. It can automatically filter and classify samples based on their labels, compute prototype vectors for multiple categories in parallel, and provides a real-time update mechanism for these vectors. This allows the system to dynamically adapt to newly emerging traffic categories, supports online incremental learning and model updates, and enhances the system's practicality and adaptability.

[0136] The query sample processing module handles query traffic to be classified. This module shares a pre-trained feature encoder with the support sample processing module, ensuring consistency in feature extraction. The module is designed with a low-latency data path, enabling rapid feature extraction and fusion of real-time traffic. This guarantees that query samples and support samples are represented in the same feature space, laying a solid foundation for accurate distance comparison while meeting the need for rapid response to real-time traffic.

[0137] The query sample classification module is the core of the entire system's decision-making process. This module integrates a high-performance distance calculation unit and a Softmax probability converter. It can calculate the Euclidean distance between the query sample and all class prototypes in parallel and achieve stable probability output through optimized numerical calculations. It provides an interpretable classification decision-making process, ensuring classification accuracy while also outputting classification confidence levels, thus providing rich information support for subsequent security decisions.

[0138] The overall technical advantage of this modular system lies in breaking down the complex task of classifying small-sample encrypted traffic into multiple specialized processing stages. Each module can be independently optimized and upgraded, ensuring both overall system performance and improved maintainability and scalability. Through a close integration of hardware acceleration and algorithm optimization, the system can achieve efficient and accurate small-sample encrypted traffic classification in real-world network environments, meeting the real-time requirements of modern network security management.

[0139] The technical scope of this invention is not limited to the content described above. Those skilled in the art can make various modifications and variations to the above embodiments without departing from the technical concept of this invention, and all such modifications and variations should fall within the protection scope of this invention.

Claims

1. A method for classifying encrypted traffic in small samples, characterized in that: Includes the following steps: Collect encrypted traffic data of a predetermined length and tagged type; Multi-view feature extraction is performed on the encrypted traffic data, and the extracted view features are input into the corresponding view encoder to obtain the preset view embedding vector of each view. The preset view embedding vectors of each view are input into the corresponding projection head model. The view encoder and the projection head model are trained using supervised contrastive loss to obtain a pre-trained feature encoder for encrypted traffic representation. Several categories of support samples are obtained, and the view embedding vector of each support sample is obtained by using the pre-trained feature encoder. The view embedding vector of the support sample is concatenated into the fusion feature vector of the support sample by feature concatenation. Calculate the prototype vector of the corresponding category based on the fusion feature vector of the supporting samples for each category; Obtain query samples and use a pre-trained feature encoder to process the query samples to generate a fused feature vector of the query samples; Calculate the Euclidean distance between the fused feature vector of the query sample and the prototype vector of each category, and classify the query sample into the category corresponding to the nearest prototype vector according to the nearest neighbor principle.

2. The method for classifying small-sample encrypted traffic according to claim 1, characterized in that: The view features extracted from the encrypted traffic data include at least traffic view features, time view features, statistical view features, and protocol view features.

3. The method for classifying small-sample encrypted traffic according to claim 2, characterized in that: The traffic view features include features derived from packet size and direction sequences; the time view features include inter-packet arrival time, traffic bursts, and periodic correlation features; the statistical view features include flow duration, total number of packets, packet size distribution, and payload entropy; and the protocol view features include observable parameters from the transport layer and handshake layer.

4. The method for classifying small-sample encrypted traffic according to claim 1, characterized in that: The view encoder and the projection head model are both independent two-layer multilayer perceptrons. The view encoder takes 32-dimensional view features as input and outputs a 256-dimensional feature embedding through a 512-dimensional hidden layer with ReLU activation. The projection head model maps the 256-dimensional embedding to the final 128-dimensional projection space.

5. The method for classifying small-sample encrypted traffic according to claim 1, characterized in that: The view encoder is frozen after supervised contrastive loss training and serves as a pre-trained feature encoder.

6. The method for classifying small-sample encrypted traffic according to claim 1, characterized in that: During the supervised contrastive loss training process, positive and negative sample pairs are defined by utilizing the label type of encrypted traffic data; for any anchor sample All other samples from the same class are considered positive samples, and all samples from different classes are considered negative samples. The loss function for supervised contrastive loss training is defined as: ； in, This represents the supervised contrastive loss value during the supervised contrastive loss training process. This represents the entire set of samples used in supervised contrastive loss training; Represents anchor point sample eigenvectors, The feature vector representing a positive sample. Indicates the anchor point sample A set of positive samples with the same category label. The number of samples in the positive sample set; For anchor point samples The set of all other samples in the same batch besides itself. Represents a set The feature vector of any sample in the dataset; This refers to temperature hyperparameters.

7. The method for classifying small-sample encrypted traffic according to claim 1, characterized in that: The view embedding vector of the supporting sample includes the flow view embedding vector of the supporting sample. Supports temporal view embedding vectors for samples Supports statistical view embedding vectors for samples Supporting sample protocol view embedding vector ; The fusion feature vector of the supporting samples Represented as: ； in, This is a concatenation function.

8. The method for classifying small-sample encrypted traffic according to claim 7, characterized in that: The calculation process for the prototype vector is as follows: Support samples from several categories are input into a pre-trained encoder and a fusion layer to obtain fused feature vectors of the support samples. ; For each category, by average The fused feature vector of each sample's support samples To calculate the prototype vector : ； in, , For the category index of the prototype currently being calculated, For the set of all categories, The number of samples in each category; Indicates the first The fused feature vector of each supporting sample This represents the overall set of all supporting samples; express One of the samples, To support the sample, The true category label corresponding to the supporting sample. This indicates the filtering condition, limiting the summation operation to only apply to the true category labels. Equal to the category currently being calculated The sample.

9. A method for classifying small-sample encrypted traffic according to claim 8, characterized in that: The process of classifying the query sample into the category corresponding to the nearest prototype vector based on the nearest neighbor principle is as follows: For any query sample, its feature vector is fused with all... The negative squared Euclidean distance between each class prototype is used to calculate the probability distribution of the classes using the Softmax function: ； in, Indicates query sample Category belongs to The probability, For query samples The predicted category, where c is the category index. Indicates the first One query sample; Let be the distance function, representing the squared Euclidean distance; Indicates the first Query sample The fused feature vector, Indicates category prototype vector, Indicates category prototype vector, This indicates the total number of categories.

10. A small-sample encrypted traffic classification system, characterized in that: include: The encrypted data collection module is used to collect encrypted traffic data of a predetermined length and tagged type; The original feature extraction module is used to extract multi-view features from the encrypted traffic data and input the extracted view features into the corresponding view encoder to obtain the preset view embedding vector of each view. The feature encoding training module is used to input the preset view embedding vector of each view into the corresponding projection head model, and train the view encoder and the projection head model using supervised contrastive loss to obtain a pre-trained feature encoder for encrypted traffic representation. The support sample processing module is used to obtain support samples of several categories, extract features from each support sample using the pre-trained feature encoder to obtain the view embedding vector of the support sample, and concatenate the view embedding vectors of the support samples into a fused feature vector of the support samples using feature concatenation. The prototype vector calculation module is used to calculate the prototype vector of the corresponding category based on the fusion feature vector of the supporting samples for each category. The query sample processing module is used to obtain query samples and process them using a pre-trained feature encoder to generate a fused feature vector. The query sample classification module is used to calculate the Euclidean distance between the fused feature vector and each prototype vector, and classify the query sample into the category corresponding to the nearest prototype vector according to the nearest neighbor principle.

Images