A method, system and storage medium for unknown encrypted traffic classification based on Gaussian reciprocal points

Abstract

The application provides a kind of unknown encrypted traffic classification method, system and storage medium based on Gauss reciprocal point, method includes: step 1: extracting byte view and timing view from encrypted network traffic, learning flow level comprehensive representation by double view encoder;Step 2: design open soft contour loss function, calculate the intra-class distance and inter-class distance of sample to obtain contour score, give higher weight to low contour score sample, make model enhance known class intra-class compactness and inter-class separation, optimize sample representation located in class boundary or easily confused area;Step 3: construct Gauss prototype and reciprocal point joint detection mechanism, use Gauss prototype to describe known class distribution center and intra-class scale, use reciprocal point to describe the rejection direction in open space, combine the distance relationship of sample to Gauss prototype and reciprocal point to make open set decision.The beneficial effect is to improve the reliability of unknown encrypted traffic identification and reduce the risk of misjudgment of unknown samples as known categories.

Description

Technical Field

[0001] This invention relates to the fields of computer technology, network security, encrypted traffic detection, unknown attack identification, and artificial intelligence model training, and in particular to a method, system, and storage medium for classifying unknown encrypted traffic based on Gaussian reciprocal points. Background Technology

[0002] Traffic classification is a fundamental capability for network management and security, capable of identifying specific services, applications, malware, and network attack types, and supporting tasks such as Quality of Service (QoS) management, malware identification, and intrusion detection. As network communication encryption levels continue to increase, traditional deep packet inspection methods relying on plaintext payloads or manual rules face challenges in encrypted environments, including insufficient effective information, high privacy risks, and high rule maintenance costs. Most existing encrypted traffic classification methods based on machine learning or deep learning employ the closed-set assumption, meaning the set of categories is consistent between the training and testing phases. When test samples come from unknown categories, the closed-set model still forces them to be classified into a known category, leading to unknown encrypted traffic being falsely reported as known traffic.

[0003] In real-world network environments, new applications, unknown protocol variants, encrypted malware, and attack behaviors are constantly emerging, and test traffic often contains categories not present during the training phase. Therefore, the model not only needs to accurately classify known categories but also needs to determine whether a sample belongs to an unknown category. Existing technologies mainly suffer from the following shortcomings: First, existing encrypted traffic representation learning methods, such as patents with publication numbers CN122001675A and CN122112779A, enhance feature discriminativeness by using contrastive learning to bring similar samples closer together and push away dissimilar samples. However, contrastive learning often focuses more on the overall separability between known categories and lacks explicit modeling of the boundary regions of known categories. When there are similar traffic patterns between different known categories, or when some samples are located in the category overlap region, the representation space obtained by relying solely on contrastive learning may suffer from problems such as blurred inter-class boundaries and insufficient optimization of boundary samples, making it difficult for subsequent open set detection to obtain a stable and clear category boundary foundation.

[0004] Second, existing open set detection methods, such as patents with publication numbers CN122241335A and CN122247711A, often only characterize whether a sample is close to a known category center, but cannot fully describe whether the sample is far from the rejection region in the open space. For encrypted traffic, different applications or attack traffic may share similar statistical characteristics, temporal behaviors, or local byte patterns, and unknown category samples may be close to certain known category prototypes in the feature space. In this case, if the detection model relies only on prototype distance, reconstruction error, or a single anomaly score for discrimination, it is difficult to simultaneously measure the degree of intra-class affiliation of the sample and the rejection relationship in the open space, thereby reducing the reliability of unknown category identification.

[0005] The information disclosed in this background section is intended only to enhance understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0006] To address the issues of insufficient quality of representation space boundaries and inadequate basis for open decision-making, this invention proposes an unknown encrypted traffic classification method based on a Gaussian reciprocal prototype.

[0007] This invention provides a method for classifying unknown encrypted traffic based on Gaussian reciprocal points, including: Step 1, Dual-view traffic feature extraction: Extract byte view and time-series view from encrypted network traffic, and learn a stream-level synthetic representation through a dual-view encoder; Step 2, Open Boundary-Aware Representation Learning: Based on the flow-level integrated representation in Step 1, an open soft contour loss function is designed to calculate the intra-class distance and inter-class distance of the samples to obtain contour scores. Boundary-aware weights are constructed based on the contour scores, so that the model can optimize the representation of samples located at class boundaries or easily confused regions while enhancing the intra-class compactness and inter-class separation of known categories. Step 3, Gaussian reciprocal prototype construction and detection: Based on the known category samples in Step 2, a joint detection mechanism of Gaussian prototype and reciprocal points is constructed. The Gaussian prototype is used to characterize the distribution center and intra-class scale of the known categories, and the reciprocal points are used to describe the rejection direction in the open space. The open set decision is made by combining the distance relationship between the sample and the Gaussian prototype and the reciprocal points, thereby improving the reliability of unknown encrypted traffic identification.

[0008] As a further improvement of the present invention, step 1 further includes: Step 10: Divide the original flow into bidirectional flow; Step 11: Select the first N valid data packets for each bidirectional stream, and truncate the first L bytes of each data packet to construct a stream sample. ,in, For byte sequence view, The packet length sequence This is the arrival time sequence of packets; if the packet length is less than L or the number of packets is less than N, it is padded with a preset padding value. Step 12: Generate timing sequence The temporal representation consists of packet length embedding and inter-packet arrival time sequence encoding: in For learnable packet length embedding, Encoding for time location, For projection dimensions; Map the byte sequence view to a continuous vector representation through a byte embedding layer. : in, This indicates a byte embedding function. Represents the set of real numbers. Indicates the number of data packets. Indicates the length of the data packet in bytes; Step 13: Employ local convolution to extract bytes, and preserve the original byte embeddings using residuals: Representing the bytes after convolution Divide the data packet into non-overlapping segments along the byte dimension and project them to obtain a packet-level byte representation. ; Introducing a learnable focus parameter λ to establish cross-view interactive representation : Finally, the timing representation will be... Data packet level byte representation and cross-view interaction representation By splicing and projecting, we obtain the initial fused sequence representation: in, This represents the initial fused sequence representation before the input sequence modeling module for the i-th traffic sample; and These represent the learnable weight matrix and bias term of the fusion projection layer, respectively; Presentation layer normalization operation; Represents a non-linear activation function; This represents the feature dimension of each data packet after fusion; Step 14: Input the sequence representation fused in Step 13 into the sequence modeling module to obtain a context-aware packet-level representation: in, This represents the input representation of the i-th flow sample in the r-th sequence modeling layer; This represents the output representation after being updated by the r-th sequence modeling layer; This indicates a Mamba-based sequence modeling module used to capture contextual dependencies in packet sequences; R represents the number of layers in the sequence modeling module. This represents the context-aware data packet-level representation obtained after R-layer sequence modeling. This represents the context-aware representation of the j-th data packet in the i-th traffic sample; N represents the number of data packets.

[0009] The stream-level synthesis representation is obtained through attention pooling: in, This represents the attention weight of each data packet in the i-th traffic sample; This represents the attention weight corresponding to the j-th data packet; This represents the normalization function used to convert attention scores into weights; This represents the learnable weight matrix in attention pooling; This represents the learnable score vector in attention pooling; Represents the hyperbolic tangent activation function; This represents the flow level comprehensive representation of the i-th flow sample; The parameter is A dual-view feature encoder.

[0010] As a further improvement of the present invention, in step 10, the original traffic is divided into bidirectional streams according to the source IP address, destination IP address, source port, destination port and communication protocol.

[0011] As a further improvement of the present invention, in step 11, in order to reduce the risk of identity field leakage, the fields included in the data are masked, including MAC address, IP address and port.

[0012] As a further improvement of the present invention, step 2 further includes: Step 20: Use samples of known categories Training was conducted, among which Represents the training dataset. This represents the i-th encrypted traffic sample. This represents the known category label corresponding to the i-th sample. This represents the number of training samples for known categories. This represents a set of labels consisting of K known categories; a projection head is connected after the dual-view traffic feature extractor. The projected features used to represent the learning are obtained. ,Right now ; Step 21: Calculate the open soft contour loss, as follows: Calculate the distance between samples , and Let represent the features of the i-th and j-th samples respectively. Then, the intra-class average distance of sample i is: in, It represents the average distance between sample i and other samples of the same class, and is used to measure the intra-class compactness of sample i. This indicates that samples in the current batch have the same category label as sample i. The sample set; This indicates the number of samples in the set; j Represents the sample set The samples in; The average distance from sample i to other classes c is: in, This represents the average distance from sample i to category c, used to measure the degree of separation between sample i and a certain dissimilar category; This represents the set of samples belonging to category c in the current batch; This indicates the number of samples of category c in the current batch; The nearest inter-class distance is obtained using the soft minimum method: in, The soft inter-class distance represents the distance from sample i to the nearest competing class, which measures the minimum degree of separation between sample i and other classes. This represents the soft minimum temperature parameter, used to control the degree of attention the soft minimum pays to the nearest category; Therefore, the sample contour score is defined as: in, The contour score of sample i is used to simultaneously characterize the intra-class compactness and inter-class separability of the sample. This represents a numerical stability constant to prevent the denominator from being zero. Typically, The larger the value, the closer sample i is to samples of the same class and the further away it is from samples of different classes; The smaller the value, the more likely sample i is to be located at the class boundary or in a confusing region; Normalize the contour scores and construct boundary-aware weights: in, This represents the normalized contour score, used to map the original contour score to a non-negative range; Represents the boundary-aware weights of sample i; This represents the set of valid samples in the current batch that participate in the loss calculation; This represents the focus parameter, used to control the intensity of the model's attention to samples with low contour scores; Represents the numerical stability constant; The final open set contour loss is: in, Represents the open soft contour loss; minimize This is equivalent to maximizing the weighted contour score.

[0013] As a further improvement of the present invention, step 3 further includes: Step 30: Load the trained dual-view encoder and extract the stream-level representation. Normalized detection features were obtained by detecting the projection head. ; Step 31: For each known category k Building a Gaussian prototype , where the category mean The diagonal covariance is calculated as follows: in, Indicates that it belongs to the first in the training set. k A set of samples of known categories, Indicates the number of samples in this category. Represents the detection features of sample i In the d Values ​​in each dimension This indicates variance calculation. Used to describe categories k In the d Intra-class discreteness in each dimension; Indicates detection features The dimension; This indicates the construction of a diagonal matrix; Step 32: For each category k Construct reciprocal points; reciprocal points are formed by the mean of the detection features of samples from other known categories: in, Indicates category k The corresponding reciprocal points, This indicates that the training set does not belong to any category. k Other known category sample sets, This indicates the number of samples in the set; Sample to Category k The distance to the Gaussian prototype is defined as: in, Indicates sample i To Category k The distance of the Gaussian prototype This represents the normalized vector of class means. Indicates its first d The distance has several dimensions; this distance is used to measure the relationship between the sample and the category. k The degree of matching of the distribution centers; the smaller the value, the closer the sample is to the prototype of that category. Sample to Category k The distance between mutually exclusive points is defined as: in, Indicates sample i To Category k The distance between the opposite points, Represents the reciprocal points after normalization. Indicates its first d The values ​​of each dimension, Indicates detection features The dimension; this distance is used to measure the distance between the sample and the category. k The value indicates the degree of distance between the directions of rejection; the larger the value, the further the sample is from the reciprocal point of that category. Based on the distance from the sample to the Gaussian prototype, the categorical conditional log density is defined as: in, Indicates sample i Category k Category conditional log density, Represents the covariance matrix The determinant; this formula takes into account both the distance from the sample to the class prototype and the dispersion of the class distribution; further, the classification score: in, Indicates that sample i is a pair of categories k Category score, The temperature parameter is used to adjust the smoothness of the classification distribution; based on the scores above, a classification loss for known categories is constructed. : Where B represents the number of samples in the current training batch, and K represents the number of known classes. This represents the known category label corresponding to the i-th sample; this classification loss is used to improve the detection module's ability to classify samples of known categories. Step 33: To move known samples away from the inverse points of their corresponding classes, construct an open-space constraint loss: in, Indicates the open space interval parameter, Indicates detection features Dimensions; Minimize open space constraint loss It can push known class samples away from their corresponding reciprocal points, thus preserving a clearer open space for the rejection of unknown samples; Step 34: To further amplify the difference between the reciprocal distance and the prototype distance, define the distance ratio: in, The distance ratio of sample i is represented by a score. Represents the numerical stability constant; Construct a loss function based on the distance ratio. : in, Represents a smooth nonlinear function. Indicates the distance ratio interval parameter; loss function This is used to encourage samples of known categories to form spatial relationships that are close to the Gaussian prototype of their class and far from the reciprocal point of their class. Finally, the total loss of the detection module is obtained as follows: in, The weighting coefficients represent the open space constraint loss. The weighting coefficients representing the distance ratio loss. The weighting coefficients for the temperature regularization term are represented. This indicates a temperature regularization term, used to prevent excessive deviation of temperature parameters.

[0014] As a further improvement of the present invention, step 3 further includes: Step 35: Inference phase, candidate known categories are obtained based on the minimum Gaussian prototype distance: in, Indicates the candidate known class of sample i. Represents a set of known categories. Represents the relationship between sample i and category i. k Distance to the Gaussian prototype; Step 36: Calculate the prototype score: in, Indicates sample The prototype score, This represents the distance from the sample to the Gaussian prototype of the candidate known class. This represents the covariance matrix of the candidate categories; a higher score indicates that the sample better matches the distribution of the known candidate categories; the distance ratio score is also calculated. in, Indicates sample The distance ratio is scored; the higher the score, the closer the sample is to the Gaussian prototype of the candidate class, and the farther away it is from the inverse point of the candidate class. Step 37: Combine the scores from Step 36 to obtain the final score. : in, Indicates the weighting of the score fusion; The final open set decision function is: in, Indicates sample The final prediction result, K represents the rejection threshold, and K+1 represents the unknown category. When the score is higher than the preset threshold, the sample is judged as a candidate known category; when it is lower than the preset threshold, the sample is judged as an unknown category.

[0015] The present invention also discloses an unknown encrypted traffic classification system based on Gaussian reciprocal points, comprising: a memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0016] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0017] Key points of this invention: 1. This invention designs an open soft contour loss method for training a feature extractor. Compared with ordinary classification loss, contrastive learning, or uniform contour loss, this invention not only focuses on the overall separability of known categories, but also explicitly models the boundary regions of known categories, thereby obtaining a clearer and more stable representation space boundary, which is more suitable for subsequent unknown category rejection tasks.

[0018] 2. This invention establishes a Gaussian prototype and reciprocal points for each known category. Compared to detection methods that only focus on the center of the known category or a single anomaly score, this invention simultaneously models the degree to which a sample belongs to a known category and its distance from the open space rejection region, thereby improving the reliability of unknown encrypted traffic identification and reducing the risk of unknown samples being misclassified as known categories.

[0019] The beneficial effects of this invention are: 1. This invention designs an open soft contour loss function, which obtains contour scores by calculating the intra-class distance and inter-class distance of samples, and assigns higher weights to samples with low contour scores. This enables the model to enhance the intra-class compactness and inter-class separation of known categories, while focusing on optimizing the representation of samples located at category boundaries or easily confused regions.

[0020] 2. This invention designs a Gaussian reciprocal point modeling and detection module. The Gaussian prototype is used to characterize the distribution center and internal density of a known category, and the reciprocal point is used to characterize the open space rejection direction relative to the category. During the detection process, both the proximity to the prototype and the distance from the rejection point are considered simultaneously to reduce the risk of misjudgment. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the process of the unknown encrypted traffic classification method based on Gaussian reciprocal points according to the present invention. Detailed Implementation

[0022] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0023] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0024] The main steps of this invention include three parts: dual-view traffic feature extraction, open boundary-aware representation learning, and Gaussian reciprocal prototype construction and detection, such as... Figure 1 As shown.

[0025] This invention discloses a method for classifying unknown encrypted traffic based on Gaussian reciprocal prototypes. Its main steps include three parts: dual-view traffic feature extraction, open boundary-aware representation learning, and Gaussian reciprocal prototype construction and detection. Figure 1 As shown.

[0026] Step 1: Dual-view traffic feature extraction First, byte views and time-series views are extracted from the encrypted network traffic, and a flow-level synthesis representation is learned through a dual-view encoder. The raw traffic is divided into bidirectional flows based on the source IP address, destination IP address, source port, destination port, and communication protocol. For each bidirectional flow, the first N valid packets are selected, and the first L bytes of each packet are truncated to construct flow samples. ,in, For byte sequence view, The packet length sequence This is the arrival time sequence of packets. If the packet length is less than L or the number of packets is less than N, it is padded with preset values. To reduce the risk of identity field leakage, fields such as MAC address, IP address, and port are masked.

[0027] Timing representation It consists of packet length embedding and inter-packet arrival time encoding: in For learnable packet length embedding, Encoding for time location, For the projection dimension. The byte sequence view is first mapped to a continuous vector representation through a byte embedding layer: in, This indicates a byte embedding function. Represents the set of real numbers. Indicates the number of data packets. Indicates the length of the data packet in bytes; Furthermore, a local convolution byte extraction mode is employed, and the original byte embedding is preserved through residuals: Representing the bytes after convolution Divide the data packet into non-overlapping segments along the byte dimension and project them to obtain a packet-level byte representation. To integrate the temporal view and the byte view, a learnable focus parameter λ is introduced to establish a cross-view interactive representation: Finally, the timing representation will be... byte representation and cross-view interaction representation By splicing and projecting, we obtain the initial fused sequence representation: in, This represents the initial fused sequence representation before the input sequence modeling module for the i-th traffic sample; and These represent the learnable weight matrix and bias term of the fusion projection layer, respectively; Presentation layer normalization operation; Represents a non-linear activation function; This represents the feature dimension of each data packet after fusion.

[0028] The fused sequence representation is input into the sequence modeling module to obtain a context-aware, packet-level representation: in, This represents the input representation of the i-th flow sample in the r-th sequence modeling layer; This represents the output representation after being updated by the r-th sequence modeling layer; This indicates a Mamba-based sequence modeling module used to capture contextual dependencies in packet sequences; R represents the number of layers in the sequence modeling module. This represents the context-aware data packet-level representation obtained after R-layer sequence modeling. This represents the context-aware representation of the j-th data packet in the i-th traffic sample.

[0029] The stream-level synthesis representation is obtained through attention pooling: in, This represents the attention weight of each data packet in the i-th traffic sample; This represents the attention weight corresponding to the j-th data packet; This represents the normalization function used to convert attention scores into weights; This represents the learnable weight matrix in attention pooling; This represents the learnable score vector in attention pooling; Represents the hyperbolic tangent activation function; This represents the flow level comprehensive representation of the i-th flow sample; The parameter is A dual-view feature encoder.

[0030] Step 2: Open boundary-aware representation learning.

[0031] This invention designs an open soft contour loss, which optimizes intra-class compactness and inter-class separability of known categories while enhancing the representation learning ability of boundary samples, thereby improving the quality of category boundaries in the representation space. During the training phase, only samples of known categories are used. ,in Represents the training dataset. This represents the i-th encrypted traffic sample. This represents the known category label corresponding to the i-th sample. This represents the number of training samples for known categories. This represents a set of labels consisting of K known categories. The dual-view traffic feature extractor is followed by a projection head. The projected features used to represent the learning are obtained. ,Right now The open soft profile loss is calculated as follows: For a batch, calculate the distance between samples. , and Let represent the features of the i-th and j-th samples respectively. Then, the intra-class average distance of sample i is: in, It represents the average distance between sample i and other samples of the same class, and is used to measure the intra-class compactness of sample i. This indicates that samples in the current batch have the same category label as sample i. The sample set; This indicates the number of samples in the set; j Represents the sample set The samples in.

[0032] The average distance from sample i to other classes c is: in, This represents the average distance from sample i to category c, used to measure the degree of separation between sample i and a certain dissimilar category; This represents the set of samples belonging to category c in the current batch; This indicates the number of samples of category c in the current batch.

[0033] To ensure gradient propagation and avoid instability caused by hard minimum selection, a soft minimum approach is used to obtain the nearest inter-class distance: in, The soft inter-class distance represents the distance from sample i to the nearest competing class, which measures the minimum degree of separation between sample i and other classes. This represents the soft minimum temperature parameter, used to control the degree of attention the soft minimum pays to the nearest-neighbor category. When When smaller, It is closer to the traditional hard minimum inter-class distance; when When it is large, It will integrate distance information from more out-of-category items.

[0034] Therefore, the sample contour score is defined as: in, The contour score of sample i is used to simultaneously characterize the intra-class compactness and inter-class separability of the sample. This represents a numerical stability constant to prevent the denominator from being zero. Typically, The larger the value, the closer sample i is to samples of the same class and the further away it is from samples of different classes; The smaller the value, the more likely sample i is to be located at the class boundary or in a confusing region.

[0035] To optimize boundary samples, contour scores are normalized and boundary-aware weights are constructed: in, This represents the normalized contour score, used to map the original contour score to a non-negative range; Represents the boundary-aware weights of sample i; v This represents the set of valid samples in the current batch that participate in the loss calculation, excluding samples in the batch that do not have samples of the same class that can be used to calculate the intra-class distance. This represents the focus parameter, used to control the intensity of the model's attention to samples with low contour scores; This represents the numerical stability constant. Because... It increases as the contour score decreases, so boundary samples with lower contour scores will receive greater weight.

[0036] The final open set contour loss is: in, This represents the open soft contour loss. Minimize... This is equivalent to maximizing the weighted contour score, making known category clusters more compact, category gaps larger, and applying stronger optimization to boundary samples with low contour scores.

[0037] Step 3: Construction and testing of Gaussian reciprocal prototypes.

[0038] This step constructs a joint detection mechanism using Gaussian prototypes and reciprocal points. Gaussian prototypes characterize the distribution center and intra-class scale of known categories, while reciprocal points describe the rejection directions in the open space. The open set decision is then performed by combining the distance relationships from samples to the Gaussian prototypes and reciprocal points, thereby improving the reliability of identifying unknown encrypted traffic. First, the trained encoder is loaded, and the flow-level representation is extracted. Normalized detection features were obtained by detecting the projection head. .

[0039] Gaussian prototypes are used to characterize the distribution center of known classes in the detection feature space and the scale of intra-class variation. A Gaussian prototype is constructed for each known class k. , where the category mean The diagonal covariance is calculated as follows: in, Indicates that it belongs to the first in the training set. k A set of samples of known categories, Indicates the number of samples in this category. Represents the detection features of sample i In the d Values ​​in each dimension This indicates variance calculation. Used to describe categories k In the d Intra-class discreteness in each dimension; Indicates detection features The dimension; This indicates the construction of a diagonal matrix.

[0040] To characterize the open space rejection direction relative to each known category, for each category k Construct reciprocal points. Reciprocal points are formed by the mean of the detection features of samples from other known categories: in, Indicates category k The corresponding reciprocal points, This indicates that the training set does not belong to any category. k Other known category sample sets, This indicates the number of samples in the set.

[0041] Sample to Category k The distance to the Gaussian prototype is defined as: in, Indicates sample i To Category k The distance of the Gaussian prototype This represents the normalized vector of class means. Indicates its first d The distance is measured by the values ​​of each dimension. This distance is used to measure the relationship between the sample and the category. k The degree of matching of the distribution center; the smaller the value, the closer the sample is to the prototype of that category.

[0042] Sample to Category k The distance between mutually exclusive points is defined as: in, Indicates sample i To Category k The distance between the opposite points, Represents the reciprocal points after normalization. Indicates its first d The values ​​of each dimension, Indicates detection features The dimension of the distance. This distance is used to measure the difference between the sample and the category. k The value indicates the degree of distance between the directions of rejection; the larger the value, the further the sample is from the reciprocal point of that category.

[0043] Based on the distance from the sample to the Gaussian prototype, the categorical conditional log density is defined as: in, Indicates sample i Category k Category conditional log density, Represents the covariance matrix The determinant of the matrix. This formula takes into account both the distance of the sample to the class prototype and the dispersion of the class distribution. Further, the classification score: in, This represents the classification score of sample i for category k. The temperature parameter is used to adjust the smoothness of the classification distribution. Based on the scores above, a classification loss for known categories is constructed. : Where B represents the number of samples in the current training batch, and K represents the number of known classes. This represents the known class label corresponding to the i-th sample. This loss is used to improve the detection module's ability to classify samples of known classes.

[0044] To keep known samples away from the inverse points of their corresponding classes, an open-space constraint loss is constructed: in, Indicates the open space interval parameter, Indicates detection features The dimension of the loss. Minimizing this loss can push known class samples away from their corresponding reciprocal points, thus preserving a clearer open space for the rejection of unknown samples.

[0045] To further amplify the difference between the reciprocal distance and the prototype distance, a distance ratio is defined as: in, The distance ratio of sample i is represented by a score. This represents the numerical stability constant. For an ideal sample of a known class, it should be close to the Gaussian prototype of that class and far from the reciprocal point of that class. It should have a large value. Construct a loss function based on the distance ratio. : in, Represents a smooth nonlinear function. This represents the distance ratio interval parameter. This loss is used to encourage samples of known classes to form spatial relationships that are close to the Gaussian prototype of their class and far from the reciprocal point of their class.

[0046] Finally, the total loss of the detection module is: in, The weighting coefficients represent the open space constraint loss. The weighting coefficients representing the distance ratio loss. The weighting coefficients for the temperature regularization term are represented. This indicates a temperature regularization term, used to prevent excessive deviation of temperature parameters.

[0047] In the reasoning phase, candidate known categories are first obtained based on the minimum Gaussian prototype distance: in, Indicates the candidate known class of sample i. Represents a set of known categories. Represents the relationship between sample i and category i. k The distance of the Gaussian prototype.

[0048] Then calculate the prototype score: in, Indicates sample The prototype score, This represents the distance from the sample to the Gaussian prototype of the candidate known class. This represents the covariance matrix of the candidate categories. A higher score indicates that the sample better matches the distribution of the known candidate categories. The distance ratio score is also calculated. in, Indicates sample The distance ratio is scored. The higher the score, the closer the sample is to the Gaussian prototype of the candidate class, and the farther away it is from the inverse point of the candidate class.

[0049] The final score is obtained by combining these scores: in, Indicates the weighted score fusion. The final open set decision function is: in, Indicates sample The final prediction result, K represents the rejection threshold, and K+1 represents the unknown category. When the score is not lower than the threshold, the sample is identified as a candidate known category; when it is lower than the threshold, the sample is identified as an unknown category.

[0050] The present invention also discloses an unknown encrypted traffic classification system based on Gaussian reciprocal points, comprising: a memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0051] The present invention also discloses an unknown encrypted traffic classification system based on Gaussian reciprocal points, comprising: a memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0052] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for classifying unknown encrypted traffic based on Gaussian reciprocal points, characterized in that, include: Step 1, Dual-view traffic feature extraction: Extract byte view and time-series view from encrypted network traffic, and learn a stream-level synthetic representation through a dual-view encoder; Step 2, Open Boundary-Aware Representation Learning: Based on the flow-level integrated representation in Step 1, an open soft contour loss function is designed to calculate the intra-class distance and inter-class distance of the samples to obtain contour scores. Boundary-aware weights are constructed based on the contour scores, so that the model can optimize the representation of samples located at class boundaries or easily confused regions while enhancing the intra-class compactness and inter-class separation of known categories. Step 3, Gaussian reciprocal prototype construction and detection: Based on the known category samples in Step 2, a joint detection mechanism of Gaussian prototype and reciprocal points is constructed. The Gaussian prototype is used to characterize the distribution center and intra-class scale of the known categories, and the reciprocal points are used to describe the rejection direction in the open space. The open set decision is made by combining the distance relationship between the sample and the Gaussian prototype and the reciprocal points, thereby improving the reliability of unknown encrypted traffic identification.

2. The method for classifying unknown encrypted traffic according to claim 1, characterized in that, Step 1 also includes: Step 10: Divide the original flow into bidirectional flow; Step 11: Select the first N valid data packets for each bidirectional stream, and truncate the first L bytes of each data packet to construct a stream sample. ,in, For byte sequence view, The packet length sequence This is the arrival time sequence of packets; if the packet length is less than L or the number of packets is less than N, it is padded with a preset padding value. Step 12: Generate timing sequence The temporal representation consists of packet length embedding and inter-packet arrival time sequence encoding: in For learnable packet length embedding, Encoding for time location, For projection dimensions; Map the byte sequence view to a continuous vector representation through a byte embedding layer. : in, This indicates a byte embedding function. Represents the set of real numbers. Indicates the number of data packets. Indicates the length of the data packet in bytes; Step 13: Employ local convolution to extract bytes, and preserve the original byte embeddings using residuals: Representing the bytes after convolution Divide the data packet into non-overlapping segments along the byte dimension and project them to obtain a packet-level byte representation. ; Introducing a learnable focus parameter λ to establish cross-view interactive representation : Finally, the timing representation will be... Data packet level byte representation and cross-view interaction representation By splicing and projecting, we obtain the initial fused sequence representation: in, This represents the initial fused sequence representation before the input sequence modeling module for the i-th traffic sample; and These represent the learnable weight matrix and bias term of the fusion projection layer, respectively; Presentation layer normalization operation; Represents a non-linear activation function; This represents the feature dimension of each data packet after fusion; Step 14: Input the sequence representation fused in Step 13 into the sequence modeling module to obtain a context-aware packet-level representation: in, This represents the input representation of the i-th flow sample in the r-th sequence modeling layer; This represents the output representation after being updated by the r-th sequence modeling layer; This indicates a Mamba-based sequence modeling module used to capture contextual dependencies in packet sequences; R represents the number of layers in the sequence modeling module. This represents the context-aware data packet-level representation obtained after R-layer sequence modeling. Let N represent the context-aware representation of the j-th data packet in the i-th traffic sample; N represents the number of data packets. The stream-level synthesis representation is obtained through attention pooling: in, This represents the attention weight of each data packet in the i-th traffic sample; This represents the attention weight corresponding to the j-th data packet; This represents the normalization function used to convert attention scores into weights; This represents the learnable weight matrix in attention pooling; This represents the learnable score vector in attention pooling; Represents the hyperbolic tangent activation function; This represents the flow level comprehensive representation of the i-th flow sample; The parameter is A dual-view feature encoder.

3. The method for classifying unknown encrypted traffic according to claim 1, characterized in that, In step 10, the original traffic is divided into bidirectional streams based on the source IP address, destination IP address, source port, destination port, and communication protocol.

4. The method for classifying unknown encrypted traffic according to claim 1, characterized in that, In step 11, to reduce the risk of identity field leakage, the fields in the data are masked, including MAC address, IP address and port.

5. The method for classifying unknown encrypted traffic according to claim 1, characterized in that, Step 2 also includes: Step 20: Use samples of known categories Training was conducted, among which Represents the training dataset. This represents the i-th encrypted traffic sample. This represents the known category label corresponding to the i-th sample. This represents the number of training samples for known categories. This represents a set of labels consisting of K known categories; a projection head is connected after the dual-view traffic feature extractor. The projected features used to represent the learning are obtained. ,Right now ; Step 21: Calculate the open soft contour loss, as follows: Calculate the distance between samples , and Let represent the features of the i-th and j-th samples respectively. Then, the intra-class average distance of sample i is: in, It represents the average distance between sample i and other samples of the same class, and is used to measure the intra-class compactness of sample i. This indicates that samples in the current batch have the same category label as sample i. The sample set; This indicates the number of samples in the set; j Represents the sample set The samples in; The average distance from sample i to other classes c is: in, This represents the average distance from sample i to category c, used to measure the degree of separation between sample i and a certain dissimilar category; This represents the set of samples belonging to category c in the current batch; This indicates the number of samples of category c in the current batch; The nearest inter-class distance is obtained using the soft minimum method: in, The soft inter-class distance represents the distance from sample i to the nearest competing class, which measures the minimum degree of separation between sample i and other classes. This represents the soft minimum temperature parameter, used to control the degree of attention the soft minimum pays to the nearest category; Therefore, the sample contour score is defined as: in, The contour score of sample i is used to simultaneously characterize the intra-class compactness and inter-class separability of the sample. This represents a numerical stability constant to prevent the denominator from being zero; typically, The larger the value, the closer sample i is to samples of the same class and the further away it is from samples of different classes; The smaller the value, the more likely sample i is to be located at the class boundary or in a confusing region; Normalize the contour scores and construct boundary-aware weights: in, This represents the normalized contour score, used to map the original contour score to a non-negative range; Represents the boundary-aware weights of sample i; This represents the set of valid samples in the current batch that participate in the loss calculation; This represents the focus parameter, used to control the intensity of the model's attention to samples with low contour scores; Represents the numerical stability constant; The final open set contour loss is: in, Represents the open soft contour loss; minimize This is equivalent to maximizing the weighted contour score.

6. The method for classifying unknown encrypted traffic according to claim 1, characterized in that, Step 3 also includes: Step 30: Load the trained dual-view encoder and extract the stream-level representation. Normalized detection features were obtained by detecting the projection head. ; Step 31: For each known category k Building a Gaussian prototype , where the category mean The diagonal covariance is calculated as follows: in, Indicates that it belongs to the first in the training set. k A set of samples of known categories, Indicates the number of samples in this category. Represents the detection features of sample i In the d Values ​​in each dimension This indicates variance calculation. Used to describe categories k In the d Intra-class discreteness in each dimension; Indicates detection features The dimension; This indicates the construction of a diagonal matrix; Step 32: For each category k Construct reciprocal points; reciprocal points are formed by the mean of the detection features of samples from other known categories: in, Indicates category k The corresponding reciprocal points, This indicates that the training set does not belong to any category. k Other known category sample sets, This indicates the number of samples in the set; Sample to Category k The distance to the Gaussian prototype is defined as: in, Indicates sample i To Category k The distance of the Gaussian prototype This represents the normalized vector of class means. Indicates its first d The distance has several dimensions; this distance is used to measure the relationship between the sample and the category. k The degree of matching of the distribution centers; the smaller the value, the closer the sample is to the prototype of that category. Sample to Category k The distance between mutually exclusive points is defined as: in, Indicates sample i To Category k The distance between the opposite points, Represents the reciprocal points after normalization. Indicates its first d The values ​​of each dimension, Indicates detection features The dimension; this distance is used to measure the distance between the sample and the category. k The value indicates the degree of distance between the directions of rejection; the larger the value, the further the sample is from the reciprocal point of that category. Based on the distance from the sample to the Gaussian prototype, the categorical conditional log density is defined as: in, Indicates sample i Category k Category conditional log density, Represents the covariance matrix The determinant; this formula takes into account both the distance from the sample to the class prototype and the dispersion of the class distribution; further, the classification score: in, Indicates that sample i is a pair of categories k Category score, The temperature parameter is used to adjust the smoothness of the classification distribution; based on the scores above, a classification loss for known categories is constructed. : Where B represents the number of samples in the current training batch, and K represents the number of known classes. This represents the known category label corresponding to the i-th sample; this classification loss is used to improve the detection module's ability to classify samples of known categories. Step 33: To move known samples away from the inverse points of their corresponding classes, construct an open-space constraint loss: in, Indicates the open space interval parameter, Indicates detection features Dimensions; Minimize open space constraint loss It can push known class samples away from their corresponding reciprocal points, thus preserving a clearer open space for the rejection of unknown samples; Step 34: To further amplify the difference between the reciprocal distance and the prototype distance, define the distance ratio: in, The distance ratio of sample i is represented by a score. Represents the numerical stability constant; Construct a loss function based on the distance ratio. : in, Represents a smooth nonlinear function. Indicates the distance ratio interval parameter; loss function This is used to encourage samples of known categories to form spatial relationships that are close to the Gaussian prototype of their class and far from the reciprocal point of their class. Finally, the total loss of the detection module is obtained as follows: in, The weighting coefficients represent the open space constraint loss. The weighting coefficients representing the distance ratio loss. The weighting coefficients for the temperature regularization term are represented. This indicates a temperature regularization term, used to prevent excessive deviation of temperature parameters.

7. The method for classifying unknown encrypted traffic according to claim 6, characterized in that, Step 3 also includes: Step 35: Inference phase, candidate known categories are obtained based on the minimum Gaussian prototype distance: in, Indicates the candidate known class of sample i. Represents a set of known categories. Represents the relationship between sample i and category i. k Distance to the Gaussian prototype; Step 36: Calculate the prototype score: in, Indicates sample The prototype score, This represents the distance from the sample to the Gaussian prototype of the candidate known class. This represents the covariance matrix of the candidate categories; a higher score indicates that the sample better matches the distribution of the known candidate categories; the distance ratio score is also calculated. in, Indicates sample The distance ratio is scored; the higher the score, the closer the sample is to the Gaussian prototype of the candidate class, and the farther away it is from the inverse point of the candidate class. Step 37: Combine the scores from Step 36 to obtain the final score. : in, Indicates the weighting of the score fusion; The final open set decision function is: in, Indicates sample The final prediction result, K represents the rejection threshold, and K+1 represents the unknown category. When the score is higher than the preset threshold, the sample is judged as a candidate known category; when it is lower than the preset threshold, the sample is judged as an unknown category.

8. An unknown encrypted traffic classification system based on Gaussian reciprocal points, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-7 when invoked by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-7 when invoked by a processor.

Images