Encrypted traffic multi-classification method based on mamba and large kernel convolution

Abstract

The application provides a kind of encrypted traffic multi-classification method based on Mamba and large kernel convolution, relating to network security technical field.The method captures discriminative features of encrypted traffic sessions from three dimensions of global relationship, temporal pattern and spatial structure through three parallel feature extraction paths.The features of the three paths are complementary, avoiding information loss in serial cascade.The BiMamba bidirectional state space model is used to replace traditional temporal modeling, which can more effectively capture complete temporal dependency at the session level.The axial large kernel convolution ALKConv is used to expand the receptive field while avoiding the high computational overhead of ordinary two-dimensional large kernel convolution, which can fully extract the texture of packet payload and the cross-packet spatial interaction structure.The fusion granularity is refined to the channel dimension through the CTF module, generating independent importance weights for each channel of each feature source, achieving more fine-grained and flexible adaptive feature fusion than simple concatenation and branch-level weighting, significantly improving classification accuracy.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method for multi-classification of encrypted traffic based on Mamba and large kernel convolution. Background Technology

[0002] In recent years, with the widespread adoption of encryption in network communications, an increasing amount of network traffic is transmitted using encryption protocols. While encryption technology protects user privacy and data security, it also poses challenges to network security monitoring, network management, and service identification. Traditional deep packet inspection methods rely on plaintext payload content for traffic identification, which is ineffective against encrypted traffic. Therefore, identifying service types in encrypted traffic based on traffic behavior characteristics and payload statistical characteristics without cracking the encryption content has become a current research hotspot.

[0003] The main shortcomings of existing multi-classification methods for encrypted traffic are: limited feature extraction, insufficient temporal modeling capabilities, inadequate utilization of spatial structure, and coarse multi-branch feature fusion. Existing methods often focus only on single-level feature extraction, such as dependency packet length, statistical features, local byte texture, or a single convolutional structure, making it difficult to simultaneously characterize global interaction relationships within a session, the temporal evolution of data packets, and the spatial distribution characteristics of the payload. While some methods incorporate deep learning models, they fail to adequately utilize bidirectional session relationships, data packet order, packet length variations, and cross-packet dependencies, resulting in limited ability to distinguish complex encrypted service types. Furthermore, traditional concatenation, addition, or branch-level weighted fusion methods struggle to adaptively select effective features based on the importance of different channels, easily leading to redundant feature interference or weakening of key features. Therefore, when facing multi-classification scenarios of encrypted traffic with subtle category differences, complex session rhythms, and uneven data packet distribution, existing technologies are prone to problems such as insufficient recognition accuracy, weak generalization ability, and unstable fine-grained classification results. Summary of the Invention

[0004] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a multi-classification method for encrypted traffic based on Mamba and large kernel convolution, which solves the problems of single feature extraction, insufficient temporal modeling capability, inadequate utilization of spatial structure, and coarse multi-branch feature fusion.

[0005] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: A method for multi-classification of encrypted traffic based on Mamba and large kernel convolution, the method comprising: S1. Obtain the raw encrypted traffic data and preprocess the encrypted traffic data into bidirectional session data based on the 5-tuple information; S2. Perform global feature extraction, temporal feature extraction, and spatial feature extraction on the two-way conversation data respectively; S3. Map global features, temporal features, and spatial features to a unified dimension, generating independent importance weights for each channel of each feature path, using temperature parameters. Normalization is performed on the branch dimension, and the three features are weighted and summed at the channel level to obtain the fused features. Finally, the encrypted traffic category prediction result is output by the MLP classifier.

[0006] Preferably, the five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and transport layer protocol type.

[0007] Preferably, S1 specifically includes: The unidirectional network flows from source to destination and from destination to source with the same quintuple information are merged into a bidirectional session flow, preserving the complete interaction process between the same pair of communication endpoints; Clean the data, removing protocol fields and redundant information below the network layer, and retain only application layer data packets; Extract the application layer front of each data packet bytes, converted A grayscale image, with insufficient parts padded with zeros; Grayscale images obtained from data packets within the same session are combined in chronological order to form a session image; data augmentation of the session image is performed using fixed-step sampling to generate standardized bidirectional session data.

[0008] Preferably, the global feature extraction includes: performing packet embedding, position embedding, and length embedding on the preprocessed session data, and adding a learnable global representation at the beginning of the sequence. We utilize a multi-head self-attention mechanism to model the global dependencies between different data packets and extract session-level global features.

[0009] Preferably, the temporal feature extraction includes: representing data packets in a session as packet-level data arranged by time. The sequence is superimposed with position embedding, length embedding, orientation embedding and time interval embedding. One-dimensional deep convolution is used to capture local temporal patterns between adjacent data packets. Then, the entire session sequence is modeled from the forward and backward directions respectively through a bidirectional Mamba structure. After attention pooling, the complete temporal features are obtained.

[0010] Preferably, the spatial feature extraction includes: treating the session image as a two-dimensional structure composed of a packet axis and a byte axis, modeling along the byte axis and packet axis respectively using axial large kernel convolution, extracting the intra-packet payload byte texture and local payload pattern by the byte axis branch, capturing cross-packet neighborhood relationships and interaction structures by the packet axis branch, and supplementing short-distance two-dimensional texture information through local branches to obtain spatial features.

[0011] Preferably, packet embedding includes: using two-dimensional convolution with a kernel size of [missing value]. Step size is Projecting the session image onto 3D space, to obtain data packet embedding ; Location embedding includes: encoding the packet order using sine and cosine functions to preserve time-series information; Length embedding includes: converting the packet length to one. hot vector Length embedding is generated through linear layers ,in These are learnable parameters used to compensate for the loss of length information after image processing.

[0012] A multi-classification system for encrypted traffic based on Mamba and large kernel convolution, the system comprising: a session image construction module, a PVT feature extraction module, a BiMamba feature extraction module, an ALKConv feature extraction module, and a CTF fusion module; The session image construction module is used to preprocess the original encrypted traffic data into bidirectional session data based on the 5-tuple information. The PVT feature extraction module is used to perform packet embedding, position embedding, and length embedding on the preprocessed session data, and to add a learnable global representation at the beginning of the sequence. The multi-head self-attention mechanism is used to model the global dependencies between different data packets and extract session-level global features. The BiMamba feature extraction module is used to represent data packets in a session as packet-level packets arranged by time. The sequence is superimposed with position embedding, length embedding, orientation embedding and time interval embedding. One-dimensional deep convolution is used to capture local temporal patterns between adjacent data packets. Then, the entire session sequence is modeled from the forward and backward directions respectively through a bidirectional Mamba structure. After attention pooling, the complete temporal features are obtained. The ALKConv feature extraction module is used to treat the session image as a two-dimensional structure composed of the packet axis and the byte axis. It uses axial large kernel convolution to model along the byte axis and the packet axis respectively. The byte axis branch extracts the byte texture and local load pattern of the packet payload, and the packet axis branch captures the cross-packet neighborhood relationship and interaction structure. At the same time, the local branch supplements the short-distance two-dimensional texture information to obtain spatial features. The CTF fusion module maps global features, temporal features, and spatial features to a unified dimension, generating independent importance weights for each channel of each feature path, and using temperature parameters... Normalization is performed on the branch dimension, and the three features are weighted and summed at the channel level to obtain the fused features. Finally, the encrypted traffic category prediction result is output by the MLP classifier.

[0013] (III) Beneficial Effects This invention provides a multi-classification method for encrypted traffic based on Mamba and large kernel convolution. Compared with existing technologies, it has the following advantages: In this invention, the method employs three parallel feature extraction paths—PVT, BiMamba, and ALKConv—to capture discriminative features of encrypted traffic sessions from three dimensions: global relationships, temporal patterns, and spatial structures. The features of the three paths are complementary, and parallel extraction avoids information loss in serial concatenation. The use of the BiMamba bidirectional state-space model instead of traditional temporal modeling offers advantages in linear time complexity, enabling more effective capture of complete temporal dependencies at the session level. The use of axial large-kernel convolution ALKConv expands the receptive field while avoiding the high computational overhead of ordinary two-dimensional large-kernel convolution, fully extracting intra-packet payload texture and cross-packet spatial interaction structures. The CTF module refines the fusion granularity to the channel dimension, generating independent importance weights for each channel of each feature source, achieving a finer-grained and more flexible adaptive feature fusion than simple concatenation and branch-level weighting, significantly improving classification accuracy. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart of the method described in an embodiment of the present invention.

[0016] Figure 2 This is the ISCXTor2016 traffic type and related application information table in Embodiment 1 of the present invention.

[0017] Figure 3 This is a comparison table of experimental results in Embodiment 2 of the present invention.

[0018] Figure 4 This is a comparison table of ablation experiment results in Example 3 of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are described clearly and completely. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] This application provides a method for multi-classification of encrypted traffic based on Mamba and large kernel convolution, which solves the problems of single feature extraction, insufficient temporal modeling capability, insufficient utilization of spatial structure, and coarse multi-branch feature fusion.

[0021] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0022] Example: like Figure 1 As shown, this invention provides a method for multi-classification of encrypted traffic based on Mamba and large kernel convolution, the method comprising: S1. Obtain the raw encrypted traffic data and preprocess it into bidirectional session data based on the five-tuple information (source IP address, destination IP address, source port number, destination port number, and transport layer protocol type).

[0023] The unidirectional network flows from source to destination and from destination to source with the same quintuple information are merged into a bidirectional session flow, preserving the complete interaction process between the same pair of communication endpoints; The data is cleaned by removing protocol fields and redundant information below the network layer, retaining only application layer data packets to reduce irrelevant noise interference. Encrypting traffic data express: ; ; ; in, Indicates the first The timestamp of each data packet; Indicates the first The source IP address of each data packet; Indicates the first The source port number of each data packet; Indicates the first The destination IP address of each data packet; Indicates the first The destination port number of each data packet; express The total number of data packets in the data; express The first division from the middle A unidirectional network flow; Indicates the first j The total number of data packets in a unidirectional network flow; Indicates the first j In the first unidirectional network flow The timestamp of each data packet; Indicates the first j In the first unidirectional network flow The source IP address of each data packet; Indicates the first j In the first unidirectional network flow The source port number of each data packet; Indicates the first j In the first unidirectional network flow The destination IP address of each data packet; Indicates the first j In the first unidirectional network flow The destination port number of each data packet; This represents the final bidirectional session stream; This indicates a unidirectional network flow from source to destination; This indicates a unidirectional network flow from the destination to the source; This indicates merging by time sequence; it combines all data packets from two unidirectional network streams together, arranging them according to the order of their timestamps to form a new sequence.

[0024] Extract the application layer front of each data packet byte( For square numbers, such as 256, convert to... A grayscale image, with insufficient areas padded with zeros.

[0025] Grayscale images obtained from data packets within the same session are combined in chronological order to form a session image; data augmentation of the session image is performed using fixed-step sampling to generate standardized bidirectional session data.

[0026] S2. Perform global feature extraction, temporal feature extraction, and spatial feature extraction on the two-way conversation data respectively.

[0027] Global feature extraction includes: The PVT module is used to perform packet embedding, position embedding, and length embedding on bidirectional session data; and learnable embeddings are added at the beginning of the sequence to represent global features. ; ; in, Represents embedded data; shape is ; Represents the global session embedding; it is a learnable vector used to aggregate and represent the global features of the entire session. Indicates the first The final embedding vector of each data packet; Indicates packet embedding, is the first A vector representation of the content information of each data packet; Indicates positional embedding, which is the first The timing location information of each data packet in the session; Indicates that the length embedding is the first A vector representation of the payload length of each data packet.

[0028] Packet embedding includes: using two-dimensional convolution with a kernel size of [missing value]. Step size is Projecting the session image onto 3D space, to obtain data packet embedding .

[0029] Location embedding includes: encoding the packet order using sine and cosine functions to preserve time-series information; ; in, Indicates the first in the session The first data packet Dimensional position embedding; Indicates the first The position of each data packet in the session stream.

[0030] Length embedding includes: converting the packet length to one. hot vector Length embedding is generated through linear layers ,in These are learnable parameters used to compensate for the loss of length information after image processing; in, Indicates the first One-hot encoded vectors corresponding to the length of each data packet; Indicates the first The final length of the data packet embedding vector; Represents the length of the embedding matrix; Indicates the preset maximum data packet length category number; Embedded data via PVT encoder Encode the data and output the global features.

[0031] PVT encoders follow a similar structure to Transformer encoders. The head self-attention mechanism projects queries, keys, and values ​​onto a self-attention-based array. In each subspace, independent self-attention operations are performed.

[0032] Specifically, bullish self-attention will Projection for query ,key ,value Attention weights by scaling the dot product The multi-head outputs are then concatenated and linearly projected. The PVT encoder consists of multiple sub-modules, each containing a multi-head self-attention (MHSA) mechanism and a fully connected layer (FC) using the Leaky ReLU activation function. Layer normalization and residual connections are also used in each sub-layer. These designs enable the encoder to perform multi-level transformations and generate representations of the input sequence, thereby enhancing the PVT's ability to capture semantic and contextual information in the embedded sequence. The first vector of the encoder's last layer output sequence is taken as the global feature. ; in, , , They represent the first The query matrix, key matrix, and value matrix of each attention head; Indicates the first Scaling dot product attention weights for each attention head; This represents row-by-row normalization, making the sum of the attention weights for each row equal to 1. Indicates the first The dot product similarity matrix between the query and the key for each attention head has the following shape: Each element represents the degree of closeness between two positions in the sequence; This indicates that attention should be paid to the dimensions within; This represents the scaling factor to prevent the dot product value from becoming too large. Gradient vanishing; Represents global characteristics of the session; express go through The output sequence after layer encoding.

[0033] Temporal feature extraction includes: Representing data packets in a two-way session as time-ordered packet levels. The sequence is captured using lightweight local convolution to capture short-term change patterns between adjacent data packets. Finally, the entire session sequence is modeled forward and backward using a bidirectional Mamba module to obtain a more complete representation of temporal features.

[0034] Compared to unidirectional sequence modeling methods, bidirectional structures can utilize both contextual and background information of a session, making them more suitable for the offline session-level encrypted traffic classification task studied in this paper.

[0035] Specifically, let a two-way session be defined by N It consists of several data packets, each data packet is truncated before... The application layer byte, denoted as the first... The time characteristics of each data packet are Because the preprocessing stage has already preserved the bidirectional session structure, packet time order, and previous data... The payload image representation of bytes continues to use the same input paradigm, but the time branch is rewritten to be packet-sequence oriented. Encoder.

[0036] First, perform a linear projection on each data packet to obtain the corresponding packet-level time. Its calculation form is as follows: ; in, Indicates packet-level time ; Represents the time-projected weight matrix; it is a linear transformation matrix for science systems, used to transform low-dimensional or one-dimensional... Mapped to the high-dimensional embedding space of the model; Indicates the bias term; Indicates the embedding dimension.

[0037] To address the issue of insufficient retention of explicit temporal metadata during the visualization process, position embedding, length embedding, orientation embedding, and time interval embedding are further superimposed on top of packet embedding to construct a unified temporal input representation: ; in, Indicates the first The location embedding of individual data packets; used to preserve the temporal location information of data packets within a session; Indicates the first The length embedding of each data packet; used to supplement the behavioral characteristics contained in the variation of data packet length.

[0038] After embedding, the input sequence for the time branch is obtained: ; To enhance the model's ability to detect local burst patterns, a one-dimensional depthwise convolution is introduced before Mamba encoding to model short-term dependencies between adjacent data packets: ; in, Presentation layer normalization operation; This represents a one-dimensional depthwise convolution performed along the time dimension.

[0039] This local convolutional layer is primarily used to capture short-term interactions and local rhythm changes between adjacent data packets, such as patterns like consecutive small packets, sudden large packets, or frequent interactions within a short period. Unlike the complex stacking of large kernel convolutions in the original TCN, this convolutional layer serves only as a lightweight local enhancement module, mainly responsible for short-range pattern extraction, while long-range dependency modeling is handled by the subsequent BiMamba module.

[0040] Subsequently, the locally enhanced sequence is input into the bidirectional Mamba module. Mamba models the sequence through a selective state-space mechanism, dynamically determining the retention, updating, and suppression of historical information based on the current input content. Therefore, it is more suitable for handling non-stationary and highly variable session sequences in encrypted traffic. Forward Mamba encodes the session according to the original time sequence: ; in, Indicates the forward timing state output; used to describe the evolution process of a session from start to end; This indicates forward processing by the Mamba module; To supplement the contextual interpretation capabilities of subsequent data packets regarding the current state, backward Mamba first reverses the input sequence, then performs state-space encoding, and finally restores the output to its original order: ; in, Indicates the output of the backward timing state; Indicates sequence reversal; This indicates that the process is handled by the Mamba module. The forward branch emphasizes the impact of historical information on the current state, while the backward branch supplements the interpretability of the current data packet by the future context. Since the task in this paper is a session-level multi-classification task, the complete session sequence is visible during the inference phase. Therefore, adopting bidirectional modeling does not introduce information leakage problems, but can make fuller use of the global temporal context within the session.

[0041] After obtaining the forward and backward state representations, the two are concatenated along the feature dimension and a unified bidirectional time representation is obtained through linear mapping: ; in, Indicates feature concatenation operation; This indicates the output linear mapping weight matrix; Represents the bias term of a linear mapping; This operation can integrate sequence dependency information from two directions into the same feature space, enabling the model to simultaneously obtain forward evolution features and backward context features.

[0042] Finally, in order to generate session-level temporal features from packet-level sequence states, attention pooling is used to adaptively weight the importance of different time positions: ; ; in, Indicates the first The importance weight of each packet location in session-level temporal features; This represents the final output time feature vector; Represents the attention context vector; Represents a linear projection matrix; Represents the hyperbolic tangent activation function; Compared to simple average pooling, attention pooling can highlight the locations of key data packets with discriminative significance, making the model pay more attention to the temporal segments in the session that have a greater impact on the classification results.

[0043] In summary, the BiMamba module mainly consists of four parts: packet-level embedding, local convolutional enhancement, bidirectional Mamba encoding, and attention pooling. This module leverages Mamba's selective state-space modeling capabilities to dynamically encode dependencies in long program sequences; simultaneously, the bidirectional structure fully utilizes the contextual information of the complete session, improving the model's ability to characterize complex temporal behaviors. Therefore, the BiMamba module is better suited to address issues such as hidden category differences, complex session rhythms, and uneven distribution of key packets in multi-classification scenarios of encrypted traffic, providing a more discriminative temporal representation for subsequent multi-branch feature fusion.

[0044] Spatial feature extraction includes: To address the challenge of discriminative significance in multi-class classification of encrypted traffic, where subtle class differences exist and both local byte texture and cross-packet structural relationships are crucial, this paper simplifies and replaces the original spatial branch with an axial large-kernel convolution module, namely ALKConv (AxialLarge-KernelConv). This module expands the effective receptive field with lower computational overhead by performing one-dimensional large-kernel convolutions along both the byte and packet axes, thereby enhancing the model's ability to represent the spatial structure of session images.

[0045] Let the input session image features of the spatial branch be: ; in, Indicates the number of channels; Indicates the number of packets in the session; This indicates the length of bytes extracted from each data packet; For single-channel grayscale session images After shallow convolution mapping, the input can be converted into a multi-channel feature representation.

[0046] First, this paper uses a shallow convolutional layer to perform preliminary feature mapping on the original session image: ; in, This operation extracts basic local spatial features and maps the original input to a uniform feature dimension. This operation can both preserve the local byte texture in the session image and provide a stable input representation for subsequent axial large kernel convolution.

[0047] After obtaining preliminary characteristics Subsequently, AxialLarge-KernelConv performs feature modeling along both the byte and packet axes. For the byte axis, adjacent bytes within the same data packet may collectively constitute a local payload pattern; therefore, it is necessary to capture the byte distribution characteristics within the packet along the horizontal dimension. This paper adopts... Depth convolution models the byte axis: ; in, Indicates byte axis characteristics; Indicates the kernel size of the byte axis convolution; This represents a depthwise convolution performed along the horizontal byte dimension; This branch is primarily used to extract byte arrangement patterns and local texture structures within a single data packet. For example, although the plaintext content cannot be directly read from encrypted traffic of different application types, their payload length, byte distribution, and local statistical morphology may still differ. Byte-axis big kernel convolution can capture these implicit spatial patterns over a wider range.

[0048] For the packet axis, there are sequential relationships and neighborhood correlations among the vertically arranged data packets in the session image. Different service types may exhibit different interaction rhythms between consecutive data packets, such as consecutive small packets, periodic responses, burst transmissions, or alternation of long and short packets. To capture these cross-packet spatial relationships, this paper adopts... Depth convolution is modeled along the envelope axis: ; in, Indicates the wrap-around characteristic; Indicates the size of the convolution kernel along the envelope axis; This represents a depthwise convolution performed along the vertical dimension of the packet sequence; This branch can perceive the spatial correlation between different data packets in the local to medium range, which helps to identify the class differences formed by the packet sequence structure in encrypted traffic.

[0049] Because the horizontal byte dimension and the vertical packet dimension in a session image have different semantics, this paper adopts a large kernel convolution approach with axial decomposition instead of directly using a large two-dimensional convolution kernel. While traditional two-dimensional large kernel convolution can expand the receptive field, it has a high parameter and computational cost and easily overlooks the semantic differences between the two axes. In contrast, axial large kernel convolution decomposes the two-dimensional spatial modeling into one-dimensional convolutions in two directions, which both expands the receptive field and reduces computational complexity. Its fundamental advantage lies in the fact that the byte axis branch focuses on modeling the intra-packet byte distribution, while the packet axis branch focuses on modeling cross-packet neighborhood relationships. This clear division of labor better adapts to the structural characteristics of encrypted traffic session images.

[0050] In obtaining byte axis characteristics and wrap axis features Subsequently, this paper fuses the two feature paths. To enhance the ability to preserve local details, a lightweight 3×3 local branch can also be retained: ; in, This is used to supplement local detail information in the two-dimensional neighborhood, avoiding the weakening of short-range local textures while expanding the receptive field through large kernel convolution. Subsequently, the three features are concatenated along the channel dimension, and channel compression and information fusion are achieved through 1×1 convolution. ; in, This indicates a channel-level concatenation operation; This process is used to fuse the outputs of branches along different axes and restore the feature dimensions to a set size. It enables the model to simultaneously preserve intra-packet byte structure, cross-packet neighborhood relationships, and local two-dimensional details.

[0051] To ensure the stability of deep feature propagation, the module output adopts a residual connection form: ; Residual connections can mitigate the information loss that may occur during convolution stacking, enabling axially large kernel convolutions to maintain stable transfer of original features while enhancing spatial expressiveness. Finally, global average pooling is performed on the output feature Y to obtain the session-level representation of the spatial branch: ; in, This indicates a global average pooling operation; This is the final output spatial feature vector.

[0052] In summary, the AxialLarge-KernelConv module mainly consists of shallow feature mapping, byte-axis large kernel convolution, packet-axis large kernel convolution, local detail supplementation branch, feature fusion, and residual output. This module explicitly utilizes the structural characteristics of different semantics along the horizontal and vertical axes of session images, modeling intra-packet byte distribution and cross-packet neighborhood relationships through axial large kernel convolution. This design expands the spatial receptive field while avoiding the excessive computational overhead of ordinary two-dimensional large kernel convolution, making it more suitable for extracting fine-grained spatial structural differences in encrypted traffic multi-classification tasks. Ultimately, AxialLarge-KernelConv can provide the model with more discriminative spatial representations, thereby improving the overall performance of encrypted traffic multi-classification recognition.

[0053] S3. Use the CTF module to extract global features. Time characteristics and spatial features Mapping to a unified dimension generates independent importance weights for each channel of each feature path, using a temperature parameter. Normalization is performed on the branch dimension, and the three features are weighted and summed at the channel level to obtain the fused features. Finally, the encrypted traffic category prediction result is output by the MLP classifier.

[0054] For multi-class classification tasks involving encrypted traffic, the discriminative information between different categories is often not evenly distributed across all feature dimensions. For example, some categories may rely more on the temporal evolution patterns between data packets, while others may rely more on the intra-packet byte distribution or cross-packet spatial structure. Even within the same session sample, different channels may correspond to discriminative information at different levels. Therefore, assigning a uniform weight to each branch may weaken some effective channels or over-retain some redundant channels. Based on this, a CTF (Channel-wise Temperature Fusion) module was designed to achieve fine-grained adaptive fusion of global, temporal, and spatial features.

[0055] The basic idea of ​​the CTF module is as follows: First, map the outputs of the three branches to the same feature space, giving them consistent dimensions and distribution scale; then, generate corresponding fusion weights for each channel of each feature; finally, use temperature parameters... Normalization along the branch dimension enables the model to adaptively select more important feature sources for each channel. Compared to the branch-level weighting in Chapter 3, CTF no longer assigns a single scalar to each branch, but instead generates independent weights for each branch on each channel, thereby improving the flexibility and expressiveness of the fusion process.

[0056] Since the three features come from network branches with different structures, their feature dimensions and numerical distributions may differ. Therefore, they are first projected onto a unified dimension through independent linear mapping. : ; ; ; ; in, , , This represents the corresponding learning weight matrix; , , Indicates the corresponding bias term; Presentation layer normalization operation; After this step, the three features are mapped into the same latent space.

[0057] The purpose of feature alignment is not only to unify dimensions, but more importantly, to reduce the magnitude deviation between different branches due to differences in network structure, and to avoid interference from feature scale differences in subsequent fusion weights.

[0058] After feature alignment is completed, the three features are concatenated to construct a fused context vector: ; in, This represents a vector concatenation operation; The fused context vector U contains three types of information: global relationships, temporal dependencies, and spatial structure. It can be used to generate importance scores for different branches on each channel.

[0059] Subsequently, channel-level scoring vectors for the global branch, temporal branch, and spatial branch are generated through three independent linear mappings: ; ; ; ; in, These represent the three branches in Non-normalized importance scores on each channel. Unlike branch-level weights, each here... Each feature is a vector, not a single numerical value. Therefore, the model can determine the importance of global features, temporal features, and spatial features for different channels.

[0060] To obtain the normalized channel-level fusion weights, this paper performs temperature-parameterized fusion along the branch dimension on each channel. For the first The weights of the three branches of each channel are defined as follows: ; ; ; in, This represents the temperature parameter; it is used to adjust the smoothness of the fusion weight distribution. When... When smaller, The output is sharper, and the model will be more inclined to select a dominant feature in each channel; when When the temperature is large, the weight distribution is smoother, and the model tends to preserve the synergistic contribution of multiple features. By introducing a temperature parameter, CTF can achieve a balance between "highlighting key branches" and "maintaining the complementarity of multiple features".

[0061] The channel-level weights described above can be expressed in vector form as follows: ; And for any channel ,satisfy: ; Finally, the three features are weighted and summed at the channel level to obtain the fused feature: ; in, This represents element-wise multiplication; This represents the fused session-level features.

[0062] The key to this fusion approach lies in the dynamic variation of contributions from different branches across different channels. For example, in some channels, the model can rely more on the temporal patterns extracted by BiMamba, while in others it can make better use of the spatial structural features extracted by AxialLarge-KernelConv. This avoids the coarse-grained problem of "overall enhancement or weakening of features from the same path" in traditional branch-level fusion.

[0063] Features after fusion The data is input into the classifier to generate the final class prediction result. The classification process can be represented as: ; ; in, This represents the probability distribution of the model's predictions for each traffic category; This represents the normalized exponential function; Indicates the activation function; This represents the first weight matrix; This represents the second weight matrix; Indicates the first bias term; Indicates the second bias term; CTF refines weight allocation down to the channel dimension, making the fusion process more precise. At the same time, CTF avoids overly complex cross-guidance and high-order interaction designs, maintaining a low number of parameters and good interpretability.

[0064] In summary, the CTF channel-level temperature fusion module mainly consists of four steps: feature alignment, channel-level weight generation, temperature softmax normalization, and weighted fusion. This module can adaptively adjust the contribution ratios of global, temporal, and spatial features according to the discrimination requirements of different samples and channels. Compared with simple concatenation, fixed weighting, or branch-level dynamic weighting methods, CTF achieves a better balance between fusion granularity, feature selection capability, and structural complexity, making it more suitable for multi-branch feature integration in encrypted traffic multi-classification tasks.

[0065] This invention provides a multi-classification system for encrypted traffic based on Mamba and large kernel convolution. The system includes: a session image construction module, a PVT feature extraction module, a BiMamba feature extraction module, an ALKConv feature extraction module, and a CTF fusion module. The session image construction module is used to preprocess the original encrypted traffic data into bidirectional session data based on the 5-tuple information. The PVT feature extraction module is used to perform packet embedding, position embedding, and length embedding on the preprocessed session data, and to add a learnable global representation at the beginning of the sequence. The multi-head self-attention mechanism is used to model the global dependencies between different data packets and extract session-level global features. The BiMamba feature extraction module is used to represent data packets in a session as packet-level packets arranged by time. The sequence is superimposed with position embedding, length embedding, orientation embedding and time interval embedding. One-dimensional deep convolution is used to capture local temporal patterns between adjacent data packets. Then, the entire session sequence is modeled from the forward and backward directions respectively through a bidirectional Mamba structure. After attention pooling, the complete temporal features are obtained. The ALKConv feature extraction module is used to treat the session image as a two-dimensional structure composed of the packet axis and the byte axis. It uses axial large kernel convolution to model along the byte axis and the packet axis respectively. The byte axis branch extracts the byte texture and local load pattern of the packet payload, and the packet axis branch captures the cross-packet neighborhood relationship and interaction structure. At the same time, the local branch supplements the short-distance two-dimensional texture information to obtain spatial features. The CTF fusion module maps global features, temporal features, and spatial features to a unified dimension, generating independent importance weights for each channel of each feature path, and using temperature parameters... Normalization is performed on the branch dimension, and the three features are weighted and summed at the channel level to obtain the fused features. Finally, the encrypted traffic category prediction result is output by the MLP classifier.

[0066] Example 1: To evaluate the performance of this method, a publicly available traffic dataset, ISCXTor2016, was used. This section first compares the performance of our method with two more advanced encrypted traffic multi-classification methods, ESDBO-MSCNN and HGTB-Fusion, to verify its superior performance in encrypted traffic multi-classification. Then, ablation experiments on the network structure were conducted.

[0067] ISCXTor2016: Focuses on the classification of encrypted traffic in normal network scenarios. For the Tor dataset, they capture outbound traffic from both workstations and gateways. Each packet in the dataset contains multiple traffic types, including Audio, Browsing, Chat, File, Email, P2P, Video, and VoIP. Detailed information is as follows... Figure 2 As shown.

[0068] To evaluate the performance of this scheme, the validation process used four metrics: AC (Accuracy), PR (Precision), RC (Recall), and F1 (Harmonic Mean of Precision and Recall). Accuracy is a common metric in classification schemes, representing the ratio of correctly classified samples to the total number of samples. F1, Recall, and Precision are evaluation metrics specifically designed for multi-class classification problems. The relevant calculation methods are as follows: ; ; ; ; Where TP stands for true, which is the number of samples that the model correctly predicts as positive; TN represents true negative, which is the number of samples that are correctly predicted as negative; FP stands for false positive, which is the number of samples that are incorrectly predicted as positive. FN stands for false negative, which is the number of samples that were incorrectly predicted as negative.

[0069] Example 2: MCET-MLK was compared with other state-of-the-art traffic classification methods on the ISCXTor2016 dataset, including ESDBO-MSCNN, a multi-classification method for encrypted traffic that fuses graph structure, temporal data, and BERT semantics; and HGTB-Fusion, a multi-classification method for encrypted traffic that utilizes multi-scale convolution combined with crowdsourcing optimization. The comparative experimental results are as follows: Figure 3 As shown.

[0070] The experimental results show that MCET-MLK performs excellently on this public dataset. Compared with the other two methods, the AC score is improved by 5.16% and 0.51%, respectively, and the F1 score is improved by 0.0515 and 0.0051, respectively, indicating that the MCET-MLK method has a greater advantage in handling multi-classification problems of encrypted traffic.

[0071] Example 3: To comprehensively evaluate the performance contribution of each component module of MCET-MLK, module ablation experiments need to be designed for verification. Except for the last experiment, all other experiments in this section use the method of directly adding the features for classification. The experimental results are as follows: Figure 4 As shown in the data, the PVT module performs best, while the BiMamba and ALKConv modules perform worse and are inferior to PVT. When PVT works in conjunction with the BiMamba and ALKConv modules, the model can simultaneously capture the global, temporal, and spatial features of network traffic. The complementarity of these three types of features effectively improves the recognition accuracy. Furthermore, by fusing and optimizing the features extracted by the three modules through CTF (Content-Based Test), the classification performance is further improved, making the model's classification results more accurate.

[0072] In summary, compared with the prior art, the present invention has the following beneficial effects: 1. In this embodiment of the invention, the method captures the discriminative features of encrypted traffic sessions from three dimensions—global relationship, temporal pattern, and spatial structure—through three parallel feature extraction paths: PVT, BiMamba, and ALKConv. The features of the three paths are complementary, and parallel extraction avoids information loss in serial cascading. Ablation experiments show that the three-way parallel architecture is significantly superior to any single-way or dual-way combination.

[0073] 2. In this embodiment of the invention, the method uses the BiMamba bidirectional state-space model to replace the traditional LSTM / GRU for time series modeling. The Mamba structure has linear time complexity, and its training and inference speed is much better than that of recurrent neural networks. At the same time, it first captures short-term interaction patterns through one-dimensional deep convolution, and then models the complete contextual time relationship with bidirectional Mamba, taking into account both local rhythm and global time series.

[0074] 3. In this embodiment of the invention, the method employs axial large kernel convolution (ALKConv), performing one-dimensional large kernel convolutions along both the bag axis and the byte axis. This expands the receptive field while reducing the computational cost of two-dimensional large kernel convolutions to that of two one-dimensional large kernel convolutions. This captures long-distance spatial dependencies across and within bags while controlling computational overhead. Furthermore, the use of local detail branches ensures the preservation of fine-grained texture information.

[0075] 4. In this embodiment of the invention, the method refines the fusion granularity to the channel dimension through the CTF module, generates independent importance weights for each channel of each feature source, and normalizes them through softmax with temperature parameters. Compared with simple splicing or branch-level weighting, CTF can dynamically emphasize different feature sources on different channels according to the discrimination requirements of samples and channels, and achieve more refined and flexible multi-feature fusion.

[0076] 5. In this embodiment of the invention, the method achieves an accuracy of 0.9731 and an F1 score of 0.9730 on the ISCXTor2016 public dataset, which is superior to existing methods such as ESDBO-MSCNN (0.9215) and HGTB-Fusion (0.9679).

[0077] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0078] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for multi-classification of encrypted traffic based on Mamba and large kernel convolution, characterized in that, The method includes: S1. Obtain the raw encrypted traffic data and preprocess the encrypted traffic data into bidirectional session data based on the 5-tuple information; S2. Perform global feature extraction, temporal feature extraction, and spatial feature extraction on the two-way conversation data respectively; S3. Map global features, temporal features, and spatial features to a unified dimension, generating independent importance weights for each channel of each feature path, using temperature parameters. Normalization is performed on the branch dimension, and the three features are weighted and summed at the channel level to obtain the fused features. Finally, the encrypted traffic category prediction result is output by the MLP classifier.

2. The encrypted traffic multi-classification method based on Mamba and large kernel convolution as described in claim 1, characterized in that, The five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and transport layer protocol type.

3. The encrypted traffic multi-classification method based on Mamba and large kernel convolution as described in claim 2, characterized in that, S1 specifically includes: The unidirectional network flows from source to destination and from destination to source with the same quintuple information are merged into a bidirectional session flow, preserving the complete interaction process between the same pair of communication endpoints; Clean the data, removing protocol fields and redundant information below the network layer, and retain only application layer data packets; Extract the application layer front of each data packet bytes, converted A grayscale image, with insufficient parts padded with zeros; Grayscale images obtained from data packets within the same session are combined in chronological order to form a session image; data augmentation of the session image is performed using fixed-step sampling to generate standardized bidirectional session data.

4. The encrypted traffic multi-classification method based on Mamba and large kernel convolution as described in claim 1, characterized in that, The global feature extraction includes: performing packet embedding, position embedding, and length embedding on the preprocessed session data, and adding a learnable global representation at the beginning of the sequence. We utilize a multi-head self-attention mechanism to model the global dependencies between different data packets and extract session-level global features.

5. The encrypted traffic multi-classification method based on Mamba and large kernel convolution as described in claim 1, characterized in that, The temporal feature extraction includes: representing data packets in a session as packet-level packets arranged by time. The sequence is superimposed with position embedding, length embedding, orientation embedding and time interval embedding. One-dimensional deep convolution is used to capture local temporal patterns between adjacent data packets. Then, the entire session sequence is modeled from the forward and backward directions respectively through a bidirectional Mamba structure. After attention pooling, the complete temporal features are obtained.

6. The encrypted traffic multi-classification method based on Mamba and large kernel convolution as described in claim 1, characterized in that, The spatial feature extraction includes: treating the session image as a two-dimensional structure composed of the packet axis and the byte axis, using axial large kernel convolution to model along the byte axis and the packet axis respectively, extracting the intra-packet payload byte texture and local payload pattern by the byte axis branch, capturing cross-packet neighborhood relationships and interaction structures by the packet axis branch, and supplementing short-distance two-dimensional texture information through local branches to obtain spatial features.

7. The encrypted traffic multi-classification method based on Mamba and large kernel convolution as described in claim 4, characterized in that, Packet embedding includes: using two-dimensional convolution with a kernel size of [missing value]. Step size is Projecting the session image onto 3D space, to obtain data packet embedding ; Location embedding includes: encoding the packet order using sine and cosine functions to preserve time-series information; Length embedding includes: converting the packet length to one. hot vector Length embedding is generated through linear layers ,in These are learnable parameters used to compensate for the loss of length information after image processing.

8. A multi-classification system for encrypted traffic based on Mamba and large kernel convolution, characterized in that, The system includes: a session image construction module, a PVT feature extraction module, a BiMamba feature extraction module, an ALKConv feature extraction module, and a CTF fusion module; The session image construction module is used to preprocess the original encrypted traffic data into bidirectional session data based on the 5-tuple information. The PVT feature extraction module is used to perform packet embedding, position embedding, and length embedding on the preprocessed session data, and to add a learnable global representation at the beginning of the sequence. The multi-head self-attention mechanism is used to model the global dependencies between different data packets and extract session-level global features. The BiMamba feature extraction module is used to represent data packets in a session as packet-level packets arranged by time. The sequence is superimposed with position embedding, length embedding, orientation embedding and time interval embedding. One-dimensional deep convolution is used to capture local temporal patterns between adjacent data packets. Then, the entire session sequence is modeled from the forward and backward directions respectively through a bidirectional Mamba structure. After attention pooling, the complete temporal features are obtained. The ALKConv feature extraction module is used to treat the session image as a two-dimensional structure composed of the packet axis and the byte axis. It uses axial large kernel convolution to model along the byte axis and the packet axis respectively. The byte axis branch extracts the byte texture and local load pattern of the packet payload, and the packet axis branch captures the cross-packet neighborhood relationship and interaction structure. At the same time, the local branch supplements the short-distance two-dimensional texture information to obtain spatial features. The CTF fusion module maps global features, temporal features, and spatial features to a unified dimension, generating independent importance weights for each channel of each feature path, and using temperature parameters... Normalization is performed on the branch dimension, and the three features are weighted and summed at the channel level to obtain the fused features. Finally, the encrypted traffic category prediction result is output by the MLP classifier.

Images