A network traffic identification method, device, apparatus and medium

Abstract

The embodiment of the application provides a network traffic identification method, device and equipment and medium, and relates to the technical field of communication. The method comprises the following steps: extracting a statistical feature sequence and a byte feature sequence of network traffic; encoding the statistical feature sequence and the byte feature sequence to obtain a multi-modal embedding sequence; performing flow feature extraction on the multi-modal embedding sequence by using a pre-trained large model containing multiple layers of Transformers to obtain flow representation of the network traffic; and identifying the network traffic by using the flow representation. The scheme can accurately identify encrypted traffic.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, device and medium for identifying network traffic. Background Technology

[0002] Network traffic identification is a cornerstone task in network management and security. Its goal is to categorize network traffic according to application type, service category, or behavioral patterns, providing technical support for quality of service assurance, anomaly detection, and threat attribution. Traditional network traffic identification relies on deep packet inspection and plaintext feature matching. However,

[0003] With the global encryption of internet traffic and the widespread use of anonymous communication systems such as Virtual Private Networks (VPNs) and The Onion Router (Tor), Hypertext Transfer Protocol Secure (HTTPS) traffic accounts for more than 90%, rendering traditional network traffic identification methods severely ineffective. Summary of the Invention

[0004] The purpose of this application is to provide a network traffic identification method, apparatus, device, and medium to achieve accurate identification of encrypted traffic. The specific technical solution is as follows:

[0005] In a first aspect, embodiments of this application provide a network traffic identification method, the method comprising: extracting statistical feature sequences and byte feature sequences of network traffic; encoding the statistical feature sequences and the byte feature sequences to obtain a multimodal embedding sequence; using a pre-trained large model containing multiple Transformers to extract flow features from the multimodal embedding sequence to obtain a flow representation of the network traffic; and using the flow representation to identify the network traffic.

[0006] In some embodiments, the step of extracting the statistical feature sequence and byte feature sequence of network traffic includes: obtaining multiple data streams based on quintuple information; merging the multiple data streams into at least one network traffic stream according to a preset merging rule; and extracting the statistical feature sequence and byte feature sequence of each network traffic stream.

[0007] In some embodiments, the preset merging rules include at least one of the following rules: merging bidirectional data streams; the destination IP address or main domain name is the same, and the time interval between data streams is less than a preset interval.

[0008] In some embodiments, the statistical feature sequence includes at least one of the following: packet length sequence, packet arrival interval sequence, packet statistical feature sequence, protocol behavior feature sequence of the network traffic, data interaction feature sequence of the network traffic, and packet transmission rate feature sequence; the byte features include the header byte content and payload byte content of the packet.

[0009] In some embodiments, the step of encoding the statistical feature sequence and the byte feature sequence to obtain a multimodal embedding sequence includes: encoding the statistical feature sequence into a statistical embedding sequence and encoding the byte feature sequence into a byte embedding sequence; combining the statistical embedding sequence and the byte embedding sequence using a preset processing method to obtain a multimodal embedding sequence; the preset processing method includes at least one of the following: serial splicing, parallel stacking, hierarchical insertion, and adding positional encoding.

[0010] Secondly, embodiments of this application provide a network traffic identification device, the device comprising: a first extraction module for extracting statistical feature sequences and byte feature sequences of network traffic; an encoding module for encoding the statistical feature sequences and the byte feature sequences to obtain a multimodal embedding sequence; a second extraction module for extracting flow features from the multimodal embedding sequence using a pre-trained large model containing multiple Transformers to obtain a flow representation of the network traffic; and an identification module for identifying the network traffic using the flow representation.

[0011] In some embodiments, the first extraction module is specifically used to obtain multiple data streams based on the quintuple information; merge the multiple data streams into at least one network traffic according to a preset merging rule; and extract the statistical feature sequence and byte feature sequence of each network traffic.

[0012] In some embodiments, the preset merging rules include at least one of the following rules: merging bidirectional data streams; the destination IP address or main domain name is the same, and the time interval between data streams is less than a preset interval.

[0013] In some embodiments, the statistical feature sequence includes at least one of the following: packet length sequence, packet arrival interval sequence, packet statistical feature sequence, protocol behavior feature sequence of the network traffic, data interaction feature sequence of the network traffic, and packet transmission rate feature sequence; the byte features include the header byte content and payload byte content of the packet.

[0014] In some embodiments, the encoding module is specifically used to encode the statistical feature sequence into a statistical embedding sequence and the byte feature sequence into a byte embedding sequence; and to combine the statistical embedding sequence and the byte embedding sequence using a preset processing method to obtain a multimodal embedding sequence; the preset processing method includes at least one of the following: serial splicing, parallel stacking, hierarchical insertion, and adding positional encoding.

[0015] Thirdly, embodiments of this application provide an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement any of the methods provided in the first aspect when executing the programs stored in the memory.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the methods provided in the first aspect.

[0017] Fifthly, this application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the methods provided in the first aspect.

[0018] Beneficial effects of the embodiments in this application:

[0019] The technical solution provided in this application introduces a multimodal feature fusion mechanism for network traffic. Without parsing the network traffic payload, it not only extracts the byte features of network traffic but also fully mines the statistical features of network traffic. The statistical features can contain implicit information of network traffic in multiple dimensions such as time sequence, statistics, and behavior. By fusing the statistical feature sequence and the byte feature sequence of network traffic, a multimodal embedding sequence is obtained. This sequence is then input into a pre-trained large model containing multiple Transformers for processing, thereby obtaining a general flow representation that reflects the hierarchical structure and transmission logic of network protocols. This significantly overcomes the limitations of insufficient traffic representation and modality singularity, improves the accuracy of network traffic identification, and provides more comprehensive and accurate feature support for downstream tasks such as traffic identification and network attack detection.

[0020] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0022] Figure 1 A schematic diagram of a network traffic identification method provided in an embodiment of this application;

[0023] Figure 2 A schematic diagram of feature sequence extraction provided in an embodiment of this application;

[0024] Figure 3 A schematic diagram of the traffic identification model architecture provided in the embodiments of this application;

[0025] Figure 4 A schematic diagram of a network traffic identification device provided in an embodiment of this application;

[0026] Figure 5 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0028] Early network traffic identification relied primarily on port numbers and payload characteristics. However, the use of dynamic ports and encryption protocols in anonymous communication systems rendered this method almost ineffective. Subsequent developments in machine learning methods based on statistical features addressed the problem to some extent by manually extracting statistical features such as packet length and arrival intervals from network traffic. These features were then input into a classifier for network traffic identification. While this approach alleviated the issue to some extent, it still faces limitations such as reliance on expert experience in feature engineering, poor cross-scenario generalization ability, and sensitivity to data distribution shifts.

[0029] In recent years, deep learning technology has been widely adopted due to its end-to-end automatic feature extraction capabilities. Models such as Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs) have achieved better results than traditional methods on many tasks. However, deep learning models still heavily rely on large-scale labeled data, while the manual labeling of network traffic data is extremely costly and highly scenario-specific, severely limiting the transferability of models across different tasks.

[0030] To reduce reliance on labeled data, researchers have drawn inspiration from pre-training paradigms in natural language processing, attempting to learn general representations on large-scale unlabeled traffic data and then fine-tune them using a small amount of labeled data. Early works such as Encrypted Traffic Classification with Bidirectional Encoder Representations from Transformers (ET-BERT) treat data packets as "byte sequences" and pre-train them using masked language modeling tasks similar to those in BERT, achieving initial success. However, this presents a fundamental problem: network traffic differs fundamentally from natural language or images in data structure. Directly applying pre-training tasks from other domains makes it difficult to fully capture the inherent characteristics of the traffic and may even corrupt protocol structure information.

[0031] Overall, large-scale network traffic identification models are evolving from "transplanting pre-training techniques from other fields" to "designing traffic-specific pre-training paradigms." The core consensus of large-scale network traffic identification models lies in the fact that the essence of network traffic understanding is not "decrypting content," but rather extracting "behavioral semantics" from packet sequences, flow characteristics, and temporal patterns. Key challenges currently facing large-scale network traffic identification models include: how to construct a universal representation that truly reflects the hierarchical structure and transmission logic of network protocols; how to reduce computational overhead to adapt to high-speed network environments while maintaining the model's expressive power; and how to effectively identify unknown traffic types in open worlds, driving the paradigm shift of network traffic identification technology from "experience-driven" to "cognitive-driven."

[0032] Recent representative works have begun to focus on the unique characteristics of traffic data, designing targeted pre-training strategies as follows:

[0033] 1) Another Traffic Classifier: A Masked Autoencoder Based Traffic Transformer with Multi-Level Flow Representation (YaTC) constructs a traffic transformer that includes packet-level and flow-level attention mechanisms and introduces the masked autoencoder paradigm to utilize multi-level flow information for pre-training.

[0034] 2) Generic Packet Representation for Traffic Classification Based on Header-Payload Differences (TraGe): The TraGe model keenly grasps the essential structure of data packets—the byte distribution of the header and payload is fundamentally different (the header is a continuous protocol field, while the payload is discontinuous application data). Based on this, it designs differentiated pre-training tasks and dynamic masking strategies to avoid the problem of losing protocol information caused by treating the header and payload uniformly.

[0035] 3) Network Traffic Modeling with State Space Sequence Model (NetMamba) introduces state space models into the field of traffic classification. It replaces the Transformer with a unidirectional state space sequence model (Mamba) architecture to address the quadratic complexity bottleneck and achieve linear inference efficiency. NetMamba preserves the IP header and payload and anonymizes the IP during preprocessing, employing stride-based sequence segmentation to retain byte semantics. In training, NetMamba introduces the Masked Autoencoder (MAE) pre-training paradigm, enabling self-supervised learning of a general traffic representation based on large-scale unlabeled data. After fine-tuning, the accuracy approaches 99% on multiple tasks, with inference speed improved by up to 60 times.

[0036] 4) The Multi-Modal deep learning for networkflow (MM4flow) framework proposes a multi-modal pre-training framework that simultaneously represents network traffic as three modalities: a) byte sequences (i.e., the raw payload), b) statistical features (including temporal statistics such as packet length and time intervals), and c) structured fields in the packet header (including protocol flags). By designing modality alignment and fusion modules, MM4flow enables the model to learn complementary information between different modalities during the pre-training stage. This multi-modal design allows a single model to adapt to multiple downstream tasks such as classification, anomaly detection, and traffic generation, demonstrating stronger versatility and transferability.

[0037] 5) Convolutional Temporal Classification (Conv-TC) proposes a lightweight pre-training framework based on Convolutional Neural Networks (CNNs). Its core premise is that in tasks like traffic classification where local patterns are highly repetitive, the local receptive field and parameter sharing characteristics of CNNs are more efficient than the global attention of Transformers. Conv-TC captures traffic patterns at different granularities, such as intra-packet byte relationships and inter-packet temporal relationships, through multi-scale convolutional modules. Combined with a contrastive learning pre-training strategy, it achieves several times the training and inference speed while maintaining accuracy comparable to Transformers.

[0038] However, the above techniques 1) to 5) only solve the following shortcomings.

[0039] Disadvantage 1: It requires manual annotation of a large amount of data.

[0040] The effectiveness of reinforcement learning-based traffic identification relies heavily on supervised training using massive amounts of manually labeled data. However, in the field of network traffic, obtaining high-quality labeled data is extremely costly and time-consuming, which severely limits the scalability and practical application of traditional network traffic identification methods in real-world scenarios.

[0041] Disadvantage 2: Low model efficiency.

[0042] The core self-attention mechanism of Transformer has a computational complexity that is quadratic with the sequence length (O(n²)). When processing long sequence data such as network traffic, the inference speed is slow and the memory consumption is high, making it difficult to meet the needs of real-time online classification.

[0043] Disadvantage 3: Insufficient flow rate representation.

[0044] Many methods, when processing raw network traffic, either discard important bytes such as packet headers or retain redundant information that can introduce bias, such as Internet Protocol (IP) addresses, causing models to be unable to accurately learn traffic characteristics.

[0045] Disadvantage 4: The input data has a single modality, lacks a global perspective, and is sensitive to noise and bias.

[0046] Byte sequences reflect the microstructure within a data packet, such as specific identifier bits and payload patterns. Byte sequences struggle to reflect macroscopic traffic behavior patterns, such as whether an application is continuously uploading data. This is reflected in the overall trend of packet length and arrival intervals, rather than the internal bytes of a single data packet. Furthermore, the payload bytes of encrypted traffic or traffic encapsulated through tunnels appear almost random and are easily affected by network latency, retransmissions, and other factors, leading to unstable byte-level patterns.

[0047] Disadvantage 5: Poor scalability.

[0048] Instability with Length Extension. When the length of the input byte sequence far exceeds the length used during model pre-training, the Transformer architecture exhibits instability in classification performance. This instability stems from the Transformer's reliance on explicit positional encoding to convey sequence order information, as its self-attention mechanism is inherently position-invariant. When extended to longer byte sequences, the learned positional embeddings may fail to adequately capture the expanded positional information, causing the model to struggle to generalize well and maintain performance when fine-tuning for longer byte sequences.

[0049] Disadvantage 6: Data leakage problem.

[0050] 1) Unidirectional data flow partitioning: Only data with identical quintuples are partitioned into one flow. For example, the interaction between traffic from device A to device B and traffic from device B to device A is considered as two separate flows. This partitioning method can lead to data leakage, resulting in abnormally high accuracy in large-scale model testing, but extremely low accuracy in actual deployment.

[0051] 2) Data not cleaned: The IP address, port, and Server Name Indication (SNI) of the data packets were not set to 0, causing the model to memorize specific types of data through IP address, specific port, SNI, etc., resulting in overfitting.

[0052] To address the aforementioned problems, embodiments of this application provide a network traffic identification method, such as... Figure 1 As shown, the method includes:

[0053] Step S101: Extract the statistical feature sequence and byte feature sequence of network traffic;

[0054] Step S102: Encode the statistical feature sequence and the byte feature sequence to obtain the multimodal embedding sequence;

[0055] Step S103: Use a pre-trained large model containing multiple Transformers to extract flow features from the multimodal embedding sequence to obtain the flow representation of network traffic.

[0056] Step S104: Identify network traffic using flow representation.

[0057] The technical solution provided in this application introduces a multimodal feature fusion mechanism for network traffic. Without parsing the network traffic payload, it not only extracts the byte features of network traffic but also fully mines the statistical features of network traffic. The statistical features can contain implicit information of network traffic in multiple dimensions such as time sequence, statistics, and behavior. By fusing the statistical feature sequence and the byte feature sequence of network traffic, a multimodal embedding sequence is obtained. This sequence is then input into a pre-trained large model containing multiple Transformers for processing, thereby obtaining a general flow representation that reflects the hierarchical structure and transmission logic of network protocols. This significantly overcomes the limitations of insufficient traffic representation and modality singularity, improves the accuracy of network traffic identification, and provides more comprehensive and accurate feature support for downstream tasks such as traffic identification and network attack detection.

[0058] In addition, the embodiments of this application can adopt the paradigm of "pre-training base + downstream task fine-tuning". The pre-training base (such as pre-trained large model) does not need to rely on any manually labeled data, and can learn general traffic representations from massive unlabeled traffic. When the downstream task fine-tunes the pre-trained large model, only a very small number of labeled samples are needed to achieve efficient adaptation, which fundamentally overcomes the strong dependence of traditional network traffic identification methods on large-scale manually labeled data.

[0059] The embodiments of this application can be applied to devices such as routers, switching equipment, servers, server clusters, and cloud computing. For ease of understanding, the following description uses electronic devices as the execution subject and is not intended to be limiting.

[0060] In step S101 above, the electronic device captures data packets, splits and merges the captured data packets into at least one network traffic, and then extracts the statistical feature sequence and the byte feature sequence of each network traffic.

[0061] The byte sequence of network traffic includes the header bytes and payload bytes of data packets. For network traffic, electronic devices extract the header bytes and payload bytes of each data packet to obtain the byte sequence of the network traffic.

[0062] For example, network traffic consists of three data packets, such as data packets 1 through 3. The electronic device extracts the header bytes of data packet 1, such as the hexadecimal string "1111 aaa bbbb…", and the payload bytes, such as the hexadecimal string "1222 aaa bbbb…", resulting in the byte content of data packet 1: {1111 aaa bbbb…, 1222 aaabbbbb…}. Similarly, the electronic device extracts the header bytes of data packet 2, such as the hexadecimal string "2111 aaa bbbb…", and the payload bytes, such as the hexadecimal string "2222 aaa bbbb…", resulting in the byte content of data packet 2: {2111 aaa bbbb…, 2222 aaa bbbb…}. The electronic device extracts the header bytes of data packet 3, such as the hexadecimal string "3111 aaa bbbb…", and extracts the payload bytes of data packet 3, such as the hexadecimal string "3222 aaabbbb…", obtaining the byte content of data packet 3 as {3111 aaa bbbb…, 3222 aaa bbbb…}. Therefore, the byte characteristic sequence of the network traffic is {1111 aaa bbbb…, 1222 aaa bbbb…, 2111 aaa bbbb…, 2222 aaabbbbb…, 3111 aaa bbbb…, 3222 aaa bbbb…}.

[0063] The statistical characteristic sequence of network traffic can include at least one of the following sequences: packet length sequence, packet arrival interval sequence, packet statistical characteristic sequence, protocol behavior characteristic sequence of network traffic, data interaction characteristic sequence in network traffic, and packet transmission rate characteristic sequence. Each statistical characteristic sequence is described below.

[0064] Packet length sequence: For network traffic, electronic devices extract the packet length value of each packet included in the network traffic to obtain the packet length sequence. For example, if the network traffic includes 3 packets, such as packet 1 to packet 3, the electronic device extracts the packet length value L1 of packet 1, the packet length value L2 of packet 2, and the packet length value L3 of packet 3 to obtain the packet length sequence {L1, L2, L3}.

[0065] Packet arrival interval sequence: For network traffic, electronic devices extract the arrival time interval of each packet in the network traffic to obtain the packet arrival interval sequence. For example, the network traffic includes 3 packets, such as packet 1 to packet 3. The electronic device extracts the arrival time t1 of packet 1, the arrival time t2 of packet 2, and the arrival time t3 of packet 3. The arrival time interval between packet 1 and packet 2 is t2-t1=Δt1, and the arrival time interval between packet 2 and packet 3 is t3-t2=Δt2, thus obtaining the packet arrival interval sequence {Δt1, Δt2}.

[0066] Data packet statistical feature sequence: For network traffic, electronic devices extract the statistical features of multiple data packets included in the network traffic, such as the mean packet length, the variance of the packet length, the maximum / minimum packet length, the mean arrival time interval, the variance of the arrival time interval, the ratio of uplink to downlink packets, and the load entropy value.

[0067] Protocol behavior feature sequence of network traffic: Electronic devices determine the transmission protocol of network traffic, extract the behavioral features of the transmission protocol, and obtain the protocol behavior feature sequence of network traffic.

[0068] Data interaction feature sequence in network traffic: When network traffic is bidirectional, electronic devices extract the data interaction features between the communicating parties corresponding to the network traffic, such as response time interval, uplink and downlink data volume ratio, etc.

[0069] In this embodiment of the application, the statistical feature sequence may also include other feature sequences, which may be expanded according to actual needs, and no limitation is imposed on them.

[0070] In step S102 above, the encoding methods used by the electronic device include, but are not limited to: convolution, fully connected linear layer, state space model (such as Mamba), multilayer perceptron (MLP), CNN, GNN, long short-term memory network (LSTM), reinforcement learning (RL), Transformer, content concatenation, linear transformation, etc.

[0071] Electronic devices can merge statistical feature sequences and byte feature sequences, and encode the merged sequence into an embedding sequence, which is a multimodal embedding sequence. Electronic devices can also obtain multimodal embedding sequences by: encoding the statistical feature sequence into a statistical embedding sequence and the byte feature sequence into a byte embedding sequence; combining the statistical embedding sequence and the byte embedding sequence using a preset processing method to obtain the multimodal embedding sequence; the preset processing method includes at least one of the following: serial concatenation, parallel stacking, hierarchical insertion, and adding positional encoding.

[0072] In this embodiment, the serial splicing method splices the embedding sequences of all modalities along the sequence dimension to form a long embedding sequence; the parallel stacking method treats the embedding sequences of each modality as independent channels or views and stacks them in the feature dimension; the hierarchical insertion method inserts learnable vectors or modal embeddings representing modal types at specific positions of feature embedding, such as the beginning, end or keyframe.

[0073] Electronic devices can use convolution, fully connected linear layers, state-space models, MLP, CNN, GNN, LSTM, RL, Transformer, content concatenation, or linear transformation to encode statistical feature sequences into embedding sequences, which are then connected to statistical embedding sequences. They can also use convolution, fully connected linear layers, state-space models, MLP, CNN, GNN, LSTM, RL, Transformer, content concatenation, or linear transformation to encode byte feature sequences into embedding sequences, which are then connected to byte embedding sequences. Combining statistical embedding sequences and byte embedding sequences yields multimodal embedding sequences.

[0074] For example, statistical feature sequences include data packet length sequences, data packet arrival interval sequences, and data packet statistical feature sequences. Electronic devices use convolutional layers, fully connected linear layers, state-space models, MLPs, CNNs, GNNs, LSTMs, RLs, Transformers, content concatenation, or linear transformations to encode data packet length sequences into embedding sequences (i.e., data packet length embedding sequences), data packet arrival interval sequences into embedding sequences (i.e., data packet arrival interval embedding sequences), data packet statistical feature sequences into embedding sequences (i.e., data packet statistical feature embedding sequences), and byte feature sequences into byte embedding sequences.

[0075] The electronic device inserts learnable special markers at the beginning of the embedding sequence for each modality. For example, it inserts [STAT] (statistical marker) at the beginning of the packet statistical feature embedding sequence, [BYTE] (byte marker) at the beginning of the byte embedding sequence, [LENGTH] (packet length marker) at the beginning of the packet length embedding sequence, and [INTERVAL] (interval marker) at the beginning of the packet arrival interval embedding sequence. These special markers distinguish modality types and serve as aggregate representations of that modality. The electronic device then concatenates the embedding sequences along the sequence dimension and adds positional encoding to the concatenated sequences to preserve the temporal positional relationship of the original data packets in network traffic, forming a complete multimodal embedding sequence.

[0076] In step S103 above, the pre-trained large model includes multiple Transformers and may also include processing layers. The electronic device inputs the multimodal embedding sequence into the pre-trained large model, where multiple Transformers extract flow features from the multimodal embedding sequence and output a flow embedding sequence, i.e., a flow representation of network traffic. The pre-trained large model may include a processing layer, which additionally uses convolutional layers, fully connected linear layers, state-space models, MLP, CNN, GNN, LSTM, RL, Transformer, content concatenation, or linear transformations to encode the flow features into a flow embedding sequence (i.e., a flow representation). This is not limited.

[0077] In step S104 above, after obtaining the flow representation of network traffic, the network device can use the flow representation for downstream classification tasks, such as application type identification and network attack detection.

[0078] The embodiments of this application can flexibly adapt to various mainstream algorithms such as convolution, fully connected linear layers, state-space models, MLP, CNN, GNN, LSTM, RL, Transformer, content concatenation, and linear transformation, and have high compatibility in processing methods. This effectively avoids the inherent problem of low model efficiency in a single Transformer architecture. Furthermore, by using multiple mainstream algorithms, the length of the multimodal embedding sequence of the input pre-trained large model can be stabilized, unaffected by the instability of the flow length expansion, thus effectively avoiding the inherent problem of insufficient scalability in a single Transformer architecture.

[0079] In some embodiments, such as Figure 2 As shown, the above step S101 may include: step S201, obtaining multiple data streams based on the quintuple information; step S202, merging multiple data streams into at least one network traffic according to a preset merging rule; and step S203, extracting the statistical feature sequence and byte feature sequence of each network traffic.

[0080] In this embodiment, the preset merging rule is a rule for merging data streams. The preset merging rule may include at least one of the following rules: 1) merging bidirectional data streams; 2) the destination IP address or main domain name is the same, and the time interval between data streams is less than a preset interval. The size of the preset interval can be set according to actual needs. The preset merging rule may include other merging rules, which are not limited thereto.

[0081] Electronic devices can capture data packets and, based on the five-tuple information (source IP address, destination IP address, source port, destination port, protocol, etc.), split the captured data packets into multiple data streams. These multiple data streams are then merged according to a preset merging rule to obtain at least one network traffic stream. For each network traffic stream, the electronic device extracts its statistical and byte characteristic sequences.

[0082] For example, the preset merging rules include: 1) merging bidirectional data streams; 2) the destination IP address or primary domain name is the same, and the time interval between data streams is less than a preset interval. The electronic device splits data packets according to the five-tuple information to obtain data streams 1 to 5. Among them, data stream 1 and data stream 2 are bidirectional data streams. For example, if data stream 1 is a data stream from A to B, and data stream 2 is a data stream from B to A, then the electronic device merges data stream 1 and data stream 2 into network traffic 1, extracts the statistical feature sequence and byte feature sequence of network traffic 1, and then executes steps S102 to S104. Data streams 3 to 5 access the same primary domain name, and the interval between the last data packet in data stream 3 and the first data packet in data stream 4 is less than a preset interval, and the interval between the last data packet in data stream 4 and the first data packet in data stream 5 is less than a preset interval, then the electronic device merges data streams 3 to 5 into network traffic 2, extracts the statistical feature sequence and byte feature sequence of network traffic 2, and then executes steps S102 to S104.

[0083] In this embodiment, the electronic device can preprocess the data stream using preset merging rules, thereby supporting diverse data preprocessing strategies. This effectively prevents data leakage risks while ensuring performance, and significantly improves the robustness and security of the model in actual deployment.

[0084] The following is combined with Figure 3 The traffic identification model architecture shown herein explains the network traffic identification method provided in the embodiments of this application.

[0085] (1) Data preprocessing. Electronic devices capture raw data packets, such as... Figure 3 Packet 1, packet 2, ... packet n, etc., split and merge the original data packets into one or more network flows. There can be many different splitting and merging methods (such as the preset merging rules mentioned above).

[0086] (2) Multimodal raw feature extraction. Electronic devices extract byte content (i.e. byte feature sequence) and extract statistical feature sequences, such as data packet long sequence, data packet arrival interval sequence, data packet statistical feature sequence, etc.

[0087] (3) Multimodal embedding coding. The electronic device inputs the extracted byte content into the processing layer for processing to obtain the byte embedding sequence; the electronic device inputs the extracted data packet length sequence into the processing layer for processing to obtain the packet length embedding sequence; the extracted data packet arrival interval sequence into the processing layer for processing to obtain the arrival interval embedding sequence; the extracted data packet statistical feature sequence into the processing layer for processing to obtain the statistical embedding sequence. The processing methods of the processing layer include, but are not limited to, convolution, fully connected linear layers, state space models, MLP, CNN, GNN, LSTM, RL, Transformer, content concatenation, linear transformation, etc.

[0088] (4) Construction of Multimodal Embedding Sequence. The electronic device combines the feature embedding sequences of each modality (the embedding sequence obtained in step (3)) to form a complete multimodal embedding sequence.

[0089] (5) Multimodal embedding encoding and flow representation output. The pre-trained large model includes multi-layer Transformers and processing layers. The electronic device inputs the multimodal embedding sequence into the multi-layer Transformers for flow feature extraction, and then inputs it into the processing layer for processing to obtain the flow representation. The processing methods of the processing layer include, but are not limited to, convolution, fully connected linear layers, state-space models, MLP, CNN, GNN, LSTM, RL, Transformer, content concatenation, linear transformation, etc.

[0090] The flow representations output by the pre-trained large model are used in downstream classification tasks such as application type recognition and network attack detection to identify network traffic.

[0091] The technical solution provided in this application is a network traffic identification framework based on a large model of artificial intelligence (AI). This network traffic identification framework uses the statistical features of the flow together with the byte information of the flow as the input of multimodal raw features, overcoming the shortcomings of the above-mentioned need for manual annotation of a large amount of data, low model efficiency, insufficient traffic representation, modality uniformity, poor scalability, and data leakage.

[0092] Corresponding to the above-described network traffic identification method, this application also provides a network traffic identification device, such as... Figure 4As shown, the device includes:

[0093] The first extraction module 401 is used to extract the statistical feature sequence and byte feature sequence of network traffic;

[0094] Encoding module 402 is used to encode statistical feature sequences and byte feature sequences to obtain multimodal embedding sequences;

[0095] The second extraction module 403 is used to extract flow features from multimodal embedding sequences using a pre-trained large model containing multiple Transformers to obtain flow representations of network traffic.

[0096] The identification module 404 is used to identify network traffic using flow representation.

[0097] In some embodiments, the first extraction module 401 is specifically used to obtain multiple data streams based on the quintuple information; merge the multiple data streams into at least one network traffic according to a preset merging rule; and extract the statistical feature sequence and byte feature sequence of each network traffic.

[0098] In some embodiments, the preset merging rules include at least one of the following rules: merging bidirectional data streams; the destination IP address or main domain name is the same, and the time interval between data streams is less than a preset interval.

[0099] In some embodiments, the statistical feature sequence includes at least one of the following: packet length sequence, packet arrival interval sequence, packet statistical feature sequence, network traffic protocol behavior feature sequence, data interaction feature sequence in network traffic, and packet transmission rate feature sequence.

[0100] Byte characteristics include the header bytes and payload bytes of the data packet.

[0101] In some embodiments, the encoding module 402 is specifically used to encode the statistical feature sequence into a statistical embedding sequence and the byte feature sequence into a byte embedding sequence; and to combine the statistical embedding sequence and the byte embedding sequence using a preset processing method to obtain a multimodal embedding sequence; the preset processing method includes at least one of the following: serial splicing, parallel stacking, hierarchical insertion, and adding positional encoding.

[0102] The technical solution provided in this application introduces a multimodal feature fusion mechanism for network traffic. Without parsing the network traffic payload, it not only extracts the byte features of network traffic but also fully mines the statistical features of network traffic. The statistical features can contain implicit information of network traffic in multiple dimensions such as time sequence, statistics, and behavior. By fusing the statistical feature sequence and the byte feature sequence of network traffic, a multimodal embedding sequence is obtained. This sequence is then input into a pre-trained large model containing multiple Transformers for processing, thereby obtaining a general flow representation that reflects the hierarchical structure and transmission logic of network protocols. This significantly overcomes the limitations of insufficient traffic representation and modality singularity, improves the accuracy of network traffic identification, and provides more comprehensive and accurate feature support for downstream tasks such as traffic identification and network attack detection.

[0103] This application also provides an electronic device, such as... Figure 5 As shown, it includes a processor 501, a communication interface 502, a memory 503, and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0104] Memory 503 is used to store computer programs;

[0105] The processor 501, when executing the program stored in the memory 503, implements any of the above-mentioned network traffic identification methods.

[0106] The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0107] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0108] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0109] The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0110] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements any of the above-described network traffic identification methods.

[0111] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the above-described network traffic identification methods.

[0112] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0113] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0114] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, electronic devices, storage media, and program products are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0115] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A method for identifying network traffic, characterized in that, The method includes: Extract statistical feature sequences and byte feature sequences from network traffic; The statistical feature sequence and the byte feature sequence are encoded to obtain a multimodal embedding sequence; The multimodal embedding sequence is subjected to flow feature extraction using a pre-trained large model containing multiple Transformers to obtain the flow representation of the network traffic; The network traffic is identified using the flow representation.

2. The method according to claim 1, characterized in that, The steps of extracting the statistical feature sequence and byte feature sequence of network traffic include: Multiple data streams are obtained based on the quintuple information; According to the preset merging rules, multiple data streams are merged into at least one network traffic stream; Extract the statistical feature sequence and byte feature sequence of each network traffic item.

3. The method according to claim 2, characterized in that, The preset merging rules include at least one of the following rules: Merge bidirectional data streams; The destination IP address or main domain name is the same, and the time interval between data streams is less than the preset interval.

4. The method according to claim 1, characterized in that, The statistical feature sequence includes at least one of the following: packet length sequence, packet arrival interval sequence, packet statistical feature sequence, protocol behavior feature sequence of network traffic, data interaction feature sequence of network traffic, and packet transmission rate feature sequence. The byte characteristics include the header bytes and payload bytes of the data packet.

5. The method according to claim 1, characterized in that, The step of encoding the statistical feature sequence and the byte feature sequence to obtain the multimodal embedding sequence includes: The statistical feature sequence is encoded into a statistical embedding sequence, and the byte feature sequence is encoded into a byte embedding sequence; The statistical embedding sequence and the byte embedding sequence are combined using a preset processing method to obtain a multimodal embedding sequence; The preset processing methods include at least one of the following: serial splicing, parallel stacking, layered insertion, and adding position encoding.

6. A network traffic identification device, characterized in that, The device includes: The first extraction module is used to extract the statistical feature sequence and byte feature sequence of network traffic; An encoding module is used to encode the statistical feature sequence and the byte feature sequence to obtain a multimodal embedding sequence; The second extraction module is used to extract flow features from the multimodal embedding sequence using a pre-trained large model containing multiple Transformers, so as to obtain the flow representation of the network traffic. An identification module is used to identify the network traffic using the flow representation.

7. The apparatus according to claim 6, characterized in that, The first extraction module is specifically used to obtain multiple data streams based on the quintuple information; merge the multiple data streams into at least one network traffic according to a preset merging rule; and extract the statistical feature sequence and byte feature sequence of each network traffic.

8. The apparatus according to claim 7, characterized in that, The preset merging rules include at least one of the following rules: merging bidirectional data streams; the destination IP address or main domain name is the same, and the time interval between data streams is less than a preset interval.

9. The apparatus according to claim 6, characterized in that, The statistical feature sequence includes at least one of the following: packet length sequence, packet arrival interval sequence, packet statistical feature sequence, protocol behavior feature sequence of network traffic, data interaction feature sequence of network traffic, and packet transmission rate feature sequence. The byte characteristics include the header bytes and payload bytes of the data packet.

10. The apparatus according to claim 6, characterized in that, The encoding module is specifically used to encode the statistical feature sequence into a statistical embedding sequence and the byte feature sequence into a byte embedding sequence; and to combine the statistical embedding sequence and the byte embedding sequence using a preset processing method to obtain a multimodal embedding sequence; the preset processing method includes at least one of the following: serial splicing, parallel stacking, hierarchical insertion, and adding position encoding.

11. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-5.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-5.

Images