A network traffic fingerprint construction method and detection application

Abstract

The application relates to a network traffic fingerprint construction method and detection application, which comprises the following steps: firstly, four types of modal complementary unified representations are extracted for encrypted traffic; then, a mixed time domain encoder is designed to process byte Token sequence output time domain fingerprint vectors; then, the time domain fingerprint vectors are taken as queries, and frequency domain feature vectors obtained by convolution dimension reduction of frequency domain peak features are taken as keys and values, and a cross attention fusion mechanism is executed to obtain traffic fingerprint vectors; finally, a traffic encoder is constructed to map side channel vectors and frequency domain peak features to obtain normalized traffic embedding, and then a multi-modal unified fingerprint carrier carrying time domain content, frequency domain behavior, password negotiation attribute and statistical features is obtained, one-time construction and multi-point multiplexing are realized with linear complexity; and based on the traffic fingerprint, encrypted traffic classification detection, open world traffic identification and post-quantum password traffic detection are realized, the payload is not decrypted throughout the process while maintaining the operator-level high concurrency real-time processing capability, and the application has the privacy-friendly attribute.

Description

Technical Field

[0001] This invention relates to a method for constructing network traffic fingerprints and its detection application, belonging to the field of network traffic identification and detection technology. Background Technology

[0002] As network traffic encryption becomes increasingly widespread, the application of network traffic fingerprinting is becoming more and more urgent, with the following application scenarios:

[0003] 1) 5G and 6G core network signaling analysis and security detection, real-time identification and anomaly detection of SBI / HTTP2 interface and signaling traffic, covering core network element protocol analysis such as AMF / SMF / UPF / NRF, with the introduction of AI native architecture (NWDAF) with 3GPP R18 / R19, traffic fingerprinting technology has become the cornerstone of intelligent operation and maintenance;

[0004] 2) IoT / IIoT Device Behavioral Baseline Establishment and Deviation Detection. Fine-grained behavioral baselines are established for low-power wide-area communication modes (MQTT / CoAP / LwM2M / NB-IoT) of massive heterogeneous devices, and deviations are detected in real time. Encrypted variant identification of industrial control protocols such as Modbus / OPCUA / Profinet is supported.

[0005] 3) Enterprise Network Security Operations Center (SOC) full-link visualization, providing visualization analysis of the entire protocol stack of the enterprise intranet, enabling internal threat detection, data leakage monitoring and APT attack chain reconstruction, and supporting application identification under new encryption protocols such as TLS 1.3 / ESNI / ECH.

[0006] 4) Cross-agency / cross-domain collaborative threat detection and privacy compliance: Enables multi-site collaborative traffic fingerprinting and threat intelligence sharing without leaving the domain of the original traffic data, adapting to the federalized security operation requirements under the compliance constraints of the "Data Security Law of the People's Republic of China", the "Personal Information Protection Law of the People's Republic of China" and the EU's "General Data Protection Regulation".

[0007] Network traffic fingerprinting technology has evolved continuously with the encryption of network protocols and the scaling of link bandwidth, undergoing four generations of technological iterations and gradually upgrading from a manual rule system to end-to-end intelligent representation.

[0008] 1) Static rule matching era: Based on port mapping and early-generation deep packet inspection (DPI), classification is achieved by relying on static port number mapping and application layer plaintext field regular expression matching. The logic is simple and the matching latency is low, but it completely depends on manual maintenance of rules and the detection capability fails in encrypted payload and dynamic port scenarios.

[0009] 2) The era of statistical modeling and lightweight rules: With the popularization of encryption protocols, the technical route has shifted to deep flow detection (DFI), extracting flow-level statistical features and combining them with traditional machine learning models such as SVM and random forest to classify encrypted traffic; at the same time, the combined rule scheme based on Bloom filter is widely adapted to high-speed link deployment; both types of schemes are still limited by manual feature engineering, and their generalization ability is constrained by the boundary of expert experience.

[0010] 3) The era of deepening traditional machine learning: By optimizing feature combination and selection through shallow neural networks and gradient boosting trees, the cost of manual design can be reduced to a certain extent, but the core still relies on manually defined feature spaces and has failed to break through the performance limit.

[0011] 4) The Era of End-to-End Representation in Deep Learning: Byte-level deep learning solutions, represented by ET-BERT and YaTC, have become mainstream. They directly use raw traffic byte sequences as input and automatically learn discriminative representations through deep neural networks, significantly reducing reliance on manual feature engineering. ET-BERT, for example, builds a byte pre-training paradigm based on Transformer, improving cross-scenario generalization through self-supervised pre-training; YaTC optimizes byte segmentation and attention mechanisms to improve the accuracy of fine-grained classification of encrypted traffic. However, these pure byte-based solutions still have three structural limitations: firstly, the pure attention architecture has an O(N) time complexity. 2 First, it has a quadratic complexity, making deployment costs extremely high for long sequences and high-concurrency scenarios. Second, it relies solely on single-modal byte features, which is insufficient for capturing cross-modal information such as periodic behavior and cryptographic negotiation attributes. Third, it is designed based on the closed-world assumption and does not natively possess the ability to identify unknown traffic and dynamically expand its categories.

[0012] Traditional methods rely on manual feature engineering and static rules, which become largely ineffective against newer encryption protocols such as TLS 1.3 / ECH / QUIC / HTTP3. Traditional techniques have several shortcomings:

[0013] 1) Computational efficiency bottleneck: The quadratic complexity O(N²) of Transformer self-attention leads to severe latency and memory pressure in large-scale real-time deployments, failing to meet the carrier-grade detection requirements of tens of thousands of streams per second. Although first-generation SSM solutions such as NetMamba achieve linear complexity, they lag behind attention mechanisms in long-range dependency modeling quality.

[0014] 2) Closed world assumption: Existing methods can only identify known categories in the training set, and are completely ineffective against zero-day attacks, new protocols and unknown applications. New encryption protocols and applications are constantly emerging, and training data will always lag behind the real network environment.

[0015] 3) Lack of post-quantum cryptography (PQC) detection capability. NIST standardized ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) in 2024, accelerating the global migration to PQC. Existing systems cannot detect and identify PQC negotiation traffic such as ML-KEM / Kyber / sntrup761, creating a huge blind spot for oversight.

[0016] 4) Lack of a deep time-frequency domain fusion mechanism. Existing mainstream solutions only process traffic sequences in the time domain. A few methods that introduce frequency domain features only make independent judgments based on frequency domain statistics and do not deeply integrate with the time domain context. Periodic patterns such as C2 mark intervals, Botnet heartbeats, and DNS tunnels still exist in encrypted environments and are highly discriminative. Single-domain processing cannot fully utilize the complementarity between time domain evidence and frequency domain periodic evidence, which fundamentally limits the ability to distinguish such periodic malicious traffic.

[0017] Current application scenarios require the construction of a complete, scalable, comparable, and retrievable "traffic fingerprint" for an encrypted stream. What is lacking now is not a specific detection function, but a methodological framework that unifies fragmented feature extraction into a complete representation system. The unified traffic fingerprint is precisely the engineering carrier of this framework. Summary of the Invention

[0018] The technical problem to be solved by the present invention is to provide a method for constructing network traffic fingerprints, which uses a multimodal unified representation as the information carrier and a single linear complexity backbone network as the construction engine, so that the same fingerprint can simultaneously possess the intrinsic properties of optional defects, and the capability combination is not an isolated detection of individual defects, but a projection of the same fingerprint on different detection tasks, thereby realizing fingerprint construction once and reuse in multiple places.

[0019] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a network traffic fingerprint construction method. For the intercepted encrypted traffic, according to the process from step A to step D, a model to be trained is constructed, and then a traffic fingerprint construction model is obtained through training, which is used to obtain the traffic fingerprint corresponding to the encrypted traffic.

[0020] Step A. Based on the plaintext header of the encrypted traffic, and the cryptographic negotiation extension field and encrypted payload bytes of the plaintext during the handshake phase, extract the corresponding packet length sequence and packet interval sequence, and further extract the corresponding byte token sequence, frequency domain peak features, and side channel vector;

[0021] Step B. Construct a hybrid temporal encoder that includes a Mamba branch, a Flash Attention branch, and a gating fusion module. This encoder receives the byte token sequence corresponding to the encrypted traffic and processes it to output the corresponding temporal fingerprint vector. ;

[0022] Step C. Obtain the frequency domain feature vector by performing convolutional dimensionality reduction on the frequency domain peak features corresponding to the encrypted traffic. , with frequency domain feature vector It is used as both a key and a value input, in the form of a time-domain fingerprint vector. The input is used as a query, and a cross-attention fusion mechanism is executed to obtain the traffic fingerprint vector corresponding to the encrypted traffic. ;

[0023] Step D. Construct a traffic encoder and perform mapping processing on the side-channel vector and frequency domain peak features corresponding to the encrypted traffic to obtain the normalized traffic embedding. Combined with traffic fingerprint vector Together, they constitute the traffic fingerprint corresponding to the encrypted traffic.

[0024] As a preferred technical solution of the present invention: In step A, based on the plaintext header of the encrypted traffic and the cryptographic negotiation extension field and encrypted payload bytes of the plaintext in the handshake phase, the corresponding packet length sequence and packet interval sequence are extracted, and the following steps A1 to A2 are further performed to extract the corresponding byte token sequence, frequency domain peak features, and side channel vector.

[0025] Step A1. Regarding the byte token sequence, use the following formula:

[0026] ;

[0027] Double-byte encoding is performed on the encrypted payload bytes of the encrypted traffic to obtain the byte token sequence corresponding to the encrypted traffic, where, , This indicates the preset length of the obtained byte token sequence. Indicates the first byte in the encrypted payload. An unsigned 8-bit integer value of 1 byte. Indicates the first byte in the encrypted payload. An unsigned 8-bit integer value of 1 byte. This indicates the byte token sequence obtained. The encoding result of each token;

[0028] Regarding frequency domain peak characteristics, the following steps are performed for the packet length sequence and packet interval sequence corresponding to the encrypted traffic, respectively: The point fast Fourier transform is calculated using the following formula:

[0029] ;

[0030] ;

[0031] ;

[0032] ;

[0033] Extract the spectral amplitude corresponding to the packet length sequence With phase spectrum values And based on the descending order of the spectral amplitude, the preset order is selected. The spectral amplitude corresponding to each frequency point With phase value ;

[0034] And extract the spectral amplitude corresponding to the packet interval sequence. With phase spectrum values And based on the descending order of the spectral amplitude, the preset order is selected. The spectral amplitude corresponding to each frequency point With phase value ;

[0035] Depend on , , , Together, they constitute the frequency domain peak characteristics corresponding to encrypted traffic, where, Indicates the first packet in the packet length sequence The total IP length of each data packet. Indicates the first packet interval sequence Individual packet interval value, Represents the imaginary unit. Indicates discrete frequency index. This indicates the number of points in the Fast Fourier Transform. The base of the natural logarithm. Represents the value of a unit complex exponential function. This indicates the phase take operation;

[0036] Step A2. Regarding the side channel vector, based on the plaintext header of each data packet in the encrypted traffic, statistical class features composed of corresponding preset statistical attributes are calculated. Time series features are composed of corresponding preset time series attributes. Protocol class features consisting of corresponding preset protocol attributes Then, based on the frequency domain peak characteristics corresponding to the encrypted traffic, statistical analysis of the corresponding frequency domain peak characteristics is obtained. According to the following formula:

[0037] ;

[0038] Concatenation yields the side channel vector corresponding to the encrypted traffic .

[0039] As a preferred technical solution of the present invention: in step B, the hybrid time-domain encoder performs the following steps B1 to B2, receiving the byte token sequence corresponding to the encrypted traffic and processing the output;

[0040] Step B1. The Mamba branch performs linear complexity encoding on the byte token sequence based on a selective state-space model to obtain the first encoded output. The Flash Attention branch performs block-based attention encoding on the byte token sequence to obtain the second encoded output. ;in, Represents the real number field. This indicates the preset length of the obtained byte token sequence. Represents the feature dimensions of the data;

[0041] Step B2. The gating fusion module uses the following formula:

[0042] ;

[0043] For the first encoded output Second encoding output Perform convex combination fusion to obtain the temporal fingerprint vector. and output, where, Indicates the fusion weight. This represents the Sigmoid activation function.

[0044] As a preferred technical solution of the present invention: step C includes the following steps C1 to C2;

[0045] Step C1. Based on the frequency domain peak characteristics corresponding to the encrypted traffic , , , According to the following formula:

[0046] ;

[0047] Perform 1D convolution dimensionality reduction to obtain frequency domain feature vectors. ,in, This represents the concatenation function. Represents a 1D convolution function;

[0048] Step C2. Using frequency domain feature vectors Simultaneously serving as a key AND value Input is a temporal fingerprint vector. As a query Enter the formula as follows:

[0049] ;

[0050] Perform a cross-attention fusion mechanism to obtain the traffic fingerprint vector corresponding to the encrypted traffic. ;in, This represents the function for the cross-attention fusion mechanism.

[0051] As a preferred technical solution of the present invention: During the process of training the model to obtain traffic fingerprints and constructing the model, based on a preset number of encrypted sample traffic of known real categories, step A obtains the byte token sequence, frequency domain peak features, and side channel vectors corresponding to each encrypted sample traffic. For steps B to C, a hybrid temporal encoder with a cross-attention fusion mechanism is used as the backbone network, connected to a closed-set classification head. Based on steps B to D, the following steps are performed: To the steps The total loss is calculated, and the joint training parameters of the hybrid temporal encoder, cross-attention fusion mechanism, and flow encoder are optimized through backpropagation.

[0052] step For the byte token sequence corresponding to the encrypted sample traffic received by the hybrid temporal encoder, a random mask is applied according to a preset ratio. The goal is to predict and reconstruct the original token value at the masked position, and the reconstruction loss corresponding to the encrypted sample traffic during the training process of the hybrid temporal encoder is calculated. Furthermore, the average reconstruction loss of each encrypted sample traffic was calculated. ;in, , This represents the total number of encrypted sample traffic in the current training batch. Indicates the first in the current training batch Reconstruction loss of encrypted sample traffic;

[0053] step Based on the closed-set classification header, receive the traffic fingerprint vector corresponding to the encrypted sample traffic. It processes the first analysis category corresponding to the output encrypted sample traffic, and uses the real category corresponding to the encrypted sample traffic as the supervision target to calculate the cross-entropy loss corresponding to the encrypted sample traffic. Furthermore, the average cross-entropy loss of each encrypted sample traffic was calculated. ;in, Indicates the first in the current training batch Cross-entropy loss of encrypted sample traffic;

[0054] step Based on the semantic encoder mapping the real categories corresponding to the encrypted sample traffic to the same-dimensional semantic embedding, the normalized traffic embedding corresponding to the encrypted sample traffic obtained by the traffic encoder is then calculated. ,Will Same-dimensional positive semantic embedding of the true category of encrypted sample traffic via semantic encoder The negative semantic embedding of the encrypted sample traffic in the same dimension as the real category processed by the semantic encoder is brought closer. To extend the range, based on the InfoNCE contrast loss, use the following formula:

[0055] ;

[0056] Obtain the contrast loss corresponding to the encrypted sample traffic. Furthermore, the average contrast loss of each encrypted sample traffic was calculated. ,in, Indicates the first in the current training batch Normalized traffic embedding of encrypted sample traffic, Indicates the first in the current training batch Same-dimensional positive semantic embedding of encrypted sample traffic, Indicates the first in the current training batch Same-dimensional negative semantic embedding of encrypted sample traffic, This indicates that, except for the first batch, the current training batch contains... Same-dimensional negative semantic embedding of encrypted sample traffic other than the encrypted sample traffic. Indicates the first in the current training batch Comparative loss of encrypted sample traffic, Represents the cosine similarity function. Indicates the temperature coefficient. Represents an exponential function;

[0057] step Construct an auxiliary classifier corresponding to the cross-attention fusion mechanism to encrypt the frequency domain feature vector of sample traffic. As input, the second analysis category of the encrypted sample traffic is obtained through an auxiliary classifier. Combined with the true category corresponding to the encrypted sample traffic as the supervision target, the auxiliary classification loss corresponding to the encrypted sample traffic is calculated. Furthermore, the average auxiliary classification loss of each encrypted sample traffic was calculated. ;in, Indicates the first in the current training batch Auxiliary classification loss for encrypted sample traffic;

[0058] step According to the following formula:

[0059] ;

[0060] Total loss ,in, The weights are, in order: average reconstruction loss, average cross-entropy loss, average contrast loss, and average auxiliary classification loss.

[0061] Corresponding to the above, the technical problem that this invention also needs to solve is to provide a detection application based on a network traffic fingerprint construction method, which realizes fingerprint construction once and reuse in multiple places by projecting the same fingerprint on different detection tasks.

[0062] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a detection application based on a network traffic fingerprint construction method, including an encrypted traffic classification detection method. Based on the traffic fingerprint obtained through training, a model is constructed. For encrypted traffic processing, the corresponding traffic fingerprint is obtained. For the processing steps B to C, a hybrid temporal encoder plus cross-attention fusion mechanism is used as the backbone network and connected to a closed set classification head. Then, the following is executed.

[0063] The traffic fingerprint vector of encrypted traffic Input a closed-set classification header, which processes and outputs the probability distribution of encrypted traffic with respect to preset categories. Then, select the category corresponding to the highest probability value as the category corresponding to the encrypted traffic.

[0064] As a preferred technical solution of the present invention, it further includes an open-world traffic identification method, which obtains the same-dimensional semantic embeddings corresponding to each category by encoding and mapping using a semantic encoder, constructs a semantic library, and normalizes the traffic embeddings of the same encrypted traffic. The semantic embeddings of the true category are located in the same vector space and have the same dimension. A model is built based on the traffic fingerprint obtained through training. The corresponding traffic fingerprint is obtained by processing the target encrypted traffic, and the normalized traffic embedding corresponding to the target encrypted traffic is obtained. and calculate The cosine similarity is compared with each semantic embedding of the same dimension in the semantic library. The maximum cosine similarity is obtained, and then it is determined whether the maximum cosine similarity is greater than or equal to a preset similarity threshold. If it is, the target encrypted traffic is named according to the category corresponding to the maximum cosine similarity; otherwise, the target encrypted traffic is determined to be unknown traffic and... The data is fed into an online incremental clusterer, and the cluster merging radius is preset according to the embedding space. Clustering is performed, and when the amount of encrypted traffic within a cluster reaches a preset threshold... Then, the cluster is treated as a new category, a category identifier is assigned to the new category, and the corresponding semantic embedding is obtained through the semantic encoder. The new category and its corresponding semantic embedding are added to the semantic library to complete the continuous expansion of the category system.

[0065] As a preferred technical solution of the present invention: it also includes a post-quantum cryptography traffic detection method, which further includes extracting PQC metadata corresponding to encrypted traffic in step A, and building a model based on the traffic fingerprint obtained by training, processing the encrypted traffic to obtain the corresponding traffic fingerprint, and then performing the following steps a to c;

[0066] Step a. Parse the negotiation group identifier set in the PQC metadata corresponding to the encrypted traffic. Perform matching with the preset PQC algorithm group identifier code point database. The PQC algorithm group identifier code point database contains at least pure ML-KEM algorithm group code points, IANA hybrid group code points, and SSH KEX algorithm name identifiers; determine the negotiation group identifier set. If there is an identifier in the code point database that successfully matches the code point of the PQC algorithm group, then mark the encrypted traffic as candidate PQC negotiation traffic and proceed to step b; otherwise, mark the encrypted traffic as non-post-quantum cryptography negotiation traffic and end the detection process.

[0067] Step b. Using all handshake messages in the candidate PQC negotiation traffic as an observation window, calculate the length of each public key within the observation window. The frequency of occurrence is calculated using the following formula:

[0068] ;

[0069] Calculate the Shannon entropy of the public key length distribution. ,in, Indicates the first observation within the observation window Frequency of occurrence of different public key lengths;

[0070] Step c. Identify the set by the negotiation group Length of each public key within the observation window Shannon entropy As input, an MLP classifier is applied to process the output, resulting in the identification of a family of quantum cryptography algorithms.

[0071] As a preferred embodiment of the present invention: step b further includes targeting Shannon entropy. Analysis, if If it is determined to be a single PQC algorithm negotiation, then If so, it is determined to be a mixed negotiation or a downgraded negotiation.

[0072] The network traffic fingerprint construction method and detection application described in this invention, compared with the prior art, have the following technical advantages:

[0073] This invention designs a method for constructing network traffic fingerprints. First, it performs non-intrusive preprocessing on encrypted traffic to extract a unified representation corresponding to four complementary modalities. Next, it designs a hybrid temporal encoder composed of Mamba and Flash Attention gating to process byte token sequences and output a temporal fingerprint vector. Then, using the temporal fingerprint vector as a query, it obtains a frequency domain feature vector by convolutional dimensionality reduction of frequency domain peak features. Simultaneously, as keys and values, a cross-attention fusion mechanism is executed to obtain traffic fingerprint vectors. Finally, a traffic encoder is constructed to obtain normalized traffic embedding by mapping side-channel vectors and frequency domain peak features. Then, a multimodal unified fingerprint carrier carrying time-domain content, frequency-domain behavior, cryptographic negotiation attributes, and statistical features is designed to achieve one-time construction and multiple reuses with linear complexity. Based on traffic fingerprints, encrypted traffic classification and detection, open-world traffic identification, and post-quantum cryptographic traffic detection are realized. While maintaining carrier-grade high-concurrency real-time processing capabilities, the payload is never decrypted, thus possessing privacy-friendly attributes. Attached Figure Description

[0074] Figure 1 This is a flowchart illustrating the network traffic fingerprint construction method of the present invention.

[0075] Figure 2 This is a schematic diagram of step A in the network traffic fingerprint construction method of the present invention;

[0076] Figure 3 This is a schematic diagram of step B in the network traffic fingerprint construction method of the present invention;

[0077] Figure 4 This is a schematic diagram of step C in the network traffic fingerprint construction method of the present invention;

[0078] Figure 5 This is a schematic diagram of an open-world traffic identification method in a detection application based on a network traffic fingerprinting construction method, as designed in this invention.

[0079] Figure 6 This is a schematic diagram of a post-quantum cryptographic traffic detection method in the detection application based on the network traffic fingerprinting construction method of this invention;

[0080] Figure 7 This is a comparative diagram of four models in the embodiment of encrypted application traffic classification of the present invention;

[0081] Figure 8 This is a comparative diagram of different byte budgets in the embodiment of the encrypted application traffic classification scheme of the present invention;

[0082] Figure 9 This is a comparative schematic diagram in the zero-sample unknown application identification embodiment of the design scheme of the present invention;

[0083] Figure 10 This is a comparative schematic diagram in the PQC negotiation flow detection embodiment of the present invention;

[0084] Figure 11 This is a comparative schematic diagram of the controlled complementary fusion ablation experiment of the design scheme of this invention;

[0085] Figure 12 This is a comparative schematic diagram of the design complexity and scalability of the present invention in an embodiment. Detailed Implementation

[0086] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0087] This invention designs a method for constructing network traffic fingerprints, targeting encrypted traffic identity recognition and network monitoring scenarios. It builds a complete traffic fingerprint construction and detection system, with a unified traffic fingerprint carrier as its core. This system possesses the characteristics of "traffic fingerprints"—combinable information, scalable generation, comparable retrieval, and sustainable expansion—and can support carrier-grade large-scale and engineering deployments. In practical applications, such as... Figure 1 As shown, for the intercepted encrypted traffic, the process from step A to step D is followed to construct a model to be trained, and then the traffic fingerprint is obtained through training to construct a model, which is used to obtain the traffic fingerprint corresponding to the encrypted traffic.

[0088] Step A. Figure 2 As shown, based on the plaintext header of the encrypted traffic, and the cryptographic negotiation extension field and encrypted payload bytes of the plaintext during the handshake phase, the corresponding packet length sequence and packet interval sequence are extracted, and the corresponding byte token sequence, frequency domain peak features, and side channel vector are further extracted.

[0089] In practical applications, in step A above, based on the plaintext header of the encrypted traffic and the cryptographic negotiation extension field and encrypted payload bytes of the plaintext during the handshake phase, the corresponding packet length sequence and packet interval sequence are extracted, and further steps A1 to A2 are performed to extract the corresponding byte token sequence, frequency domain peak features, PQC metadata (post-quantum cryptographic negotiation parameters), and side channel vector.

[0090] Step A1. Regarding the byte token sequence, use the following formula:

[0091] ;

[0092] Double-byte encoding is performed on the encrypted payload bytes of the encrypted traffic to obtain the byte token sequence corresponding to the encrypted traffic, where, , This indicates the preset length of the obtained byte token sequence. Indicates the first byte in the encrypted payload. An unsigned 8-bit integer value of 1 byte. , Indicates the first byte in the encrypted payload. An unsigned 8-bit integer value of 1 byte. This indicates the byte token sequence obtained. The encoding result of each token, Only the first part of a single traffic stream is captured. Each token corresponds to the first 1024 bytes of the streaming payload.

[0093] Regarding frequency domain peak characteristics, the following steps are performed for the packet length sequence and packet interval sequence corresponding to the encrypted traffic, respectively: The point fast Fourier transform is calculated using the following formula:

[0094] ;

[0095] ;

[0096] ;

[0097] ;

[0098] Extract the spectral amplitude corresponding to the packet length sequence With phase spectrum values And based on the descending order of the spectral amplitude, the preset order is selected. The spectral amplitude corresponding to each frequency point With phase value .

[0099] And extract the spectral amplitude corresponding to the packet interval sequence. With phase spectrum values And based on the descending order of the spectral amplitude, the preset order is selected. The spectral amplitude corresponding to each frequency point With phase value .

[0100] Depend on , , , Together, they constitute the frequency domain peak characteristics corresponding to encrypted traffic, where, Indicates the first packet in the packet length sequence The total IP length of each data packet. Indicates the first packet interval sequence Individual packet interval value, Represents the imaginary unit. Indicates discrete frequency index. This indicates the number of points in the Fast Fourier Transform. The base of the natural logarithm. Represents the value of a unit complex exponential function. This indicates the phase take operation.

[0101] Regarding PQC metadata, based on the plaintext header of each data packet in the encrypted traffic, the cryptographic negotiation metadata is extracted from the plaintext message of the TLS / SSH / QUIC handshake in the encrypted traffic to form PQC metadata, which is in the form of the following triples;

[0102] ;

[0103] in, This is the set of negotiation group identifiers extracted from the `supported_groups` extension of the TLS / QUIC handshake. This indicates the total number of negotiating groups that made statements during the handshake. Indicates the first A 2-byte identifier for each candidate cipher group; The length of the public key extracted from the TLS / QUIC handshake key_share extension (extension type code 0x0033), or the length of the public key of the key exchange algorithm in the KEXINIT message under the SSH protocol; This is the set of key exchange algorithm names extracted from KEXINIT messages under the SSH protocol.

[0104] Step A2. Regarding the side channel vector, based on the plaintext header of each data packet in the encrypted traffic, statistical class features composed of corresponding preset statistical attributes are calculated. Time series features are composed of corresponding preset time series attributes. Protocol class features consisting of corresponding preset protocol attributes Then, based on the frequency domain peak characteristics corresponding to the encrypted traffic, statistical analysis of the corresponding frequency domain peak characteristics is obtained. According to the following formula:

[0105] ;

[0106] Concatenation yields the side channel vector corresponding to the encrypted traffic Among them, the statistical attributes include basic statistics such as total number of bytes in the stream, total number of packets, and packet length distribution moments; the time-series attributes include features such as packet interval distribution, burst sequence, and traffic time-series pattern; and the protocol attributes include protocol field features such as transport layer protocol type, port, and message type distribution.

[0107] The extraction of the above-mentioned four-modal data—byte token sequence, frequency domain peak features, PQC metadata, and side channel vector—carries content clues, behavioral cycle clues, cryptographic negotiation clues, and cross-class migration statistics clues, respectively, complementing each other to ensure the discriminative power and transferability of fingerprints in complex scenarios such as payload encryption, byte limitation, and protocol evolution.

[0108] Step B. As Figure 3 As shown, a hybrid temporal encoder is constructed, comprising a Mamba branch (based on a state-space model), a Flash Attention branch (memory attention mechanism), and a gating fusion module. The hybrid temporal encoder performs the following steps B1 to B2: receiving the byte token sequence corresponding to the encrypted traffic, processing it, and outputting the corresponding temporal fingerprint vector. .

[0109] Step B1. The Mamba branch performs linear complexity encoding on the byte token sequence based on a selective state-space model to obtain the first encoded output. The Flash Attention branch performs block-based attention encoding on the byte token sequence to obtain the second encoded output. ;in, Represents the real number field. This indicates the preset length of the obtained byte token sequence. Represents the feature dimensions of the data.

[0110] Step B2. The gating fusion module uses the following formula:

[0111] ;

[0112] For the first encoded output Second encoding output Perform convex combination fusion to obtain the temporal fingerprint vector. and output, where, This represents the fusion weights. In practical applications, initialization... , Describes the Sigmoid activation function, which satisfies This ensures that the fusion results in a convex combination of the two branch outputs, and the fusion weights are adaptively adjusted during training.

[0113] In practical applications, typical configurations and architectural characteristics, core parameters: feature dimensions Sequence length It consists of 8 Mamba modules, with one Flash Attention layer inserted every 4 Mamba layers. Its core properties include: maintaining linear complexity while mitigating the long-range decay problem of pure state-space models, achieving linearly constructible fingerprints, with fingerprint generation costs increasing linearly with sequence length. In long-sequence scenarios, its computational efficiency and memory usage are significantly better than pure attention architectures, supporting real-time traffic fingerprint generation for carriers.

[0114] The aforementioned hybrid temporal encoder employs a dual-branch hybrid structure of NetMamba+ and Flash-Attention to generate temporal traffic fingerprint vectors. The Mamba branch maintains O(N) linear computational complexity by relying on a selective state-space model to complete high-quality temporal encoding, while the Flash-Attention branch optimizes memory access bottlenecks through block-based computation and supplements the ability to model high-quality long-range dependencies. The outputs of the two branches are fused by adaptive convex combination of learnable gating parameters. This architecture retains the advantage of linear complexity while compensating for the long-range decay defects of pure state-space models. In long sequence scenarios, the computational cost and memory usage are far lower than those of pure attention schemes, enabling the real-time fingerprint construction of each stream to be implemented in carrier-grade environments.

[0115] Step C. Figure 4 As shown, frequency domain feature vectors are obtained by convolutional dimensionality reduction of the frequency domain peak features corresponding to encrypted traffic. , with frequency domain feature vector It is used as both a key and a value input, in the form of a time-domain fingerprint vector. The input is used as a query, and a cross-attention fusion mechanism is executed to obtain the traffic fingerprint vector corresponding to the encrypted traffic. Strengthen the ability to identify periodic malicious traffic.

[0116] In practical applications, the above step C is specifically designed to be executed as follows: steps C1 to C2.

[0117] Step C1. Based on the frequency domain peak characteristics corresponding to the encrypted traffic , , , According to the following formula:

[0118] ;

[0119] Perform 1D convolution (one-dimensional convolution) to reduce dimensionality and obtain frequency domain feature vectors. ,in, This represents the concatenation function. This represents a 1D convolution function.

[0120] Step C2. Using frequency domain feature vectors Simultaneously serving as a key AND value Input is a temporal fingerprint vector. As a query Enter the formula as follows:

[0121] ;

[0122] Perform a cross-attention fusion mechanism to obtain the traffic fingerprint vector corresponding to the encrypted traffic. ;in, This represents the function for the cross-attention fusion mechanism.

[0123] Performance verification through controlled ablation experiments showed an accuracy of 0.875 for the complete FTDP architecture, representing a 19.2 percentage point improvement over the pure time-domain scheme and an 18.9 percentage point improvement over the pure frequency-domain scheme. Real-world scenario verification: In CTU-13 multi-family botnet traffic detection, Botnet F1=0.998, accuracy=0.998, and false positive rate FPR=0.000.

[0124] The design of step C above implements a time-frequency dual-path fusion mechanism, namely a specific frequency-time dual-path parallel processing architecture (FTDP). An independent frequency-domain processing link is added outside the time-domain coding branch. After performing convolutional dimensionality reduction on the frequency-domain features of packet length and packet interval, it is deeply fused with the time-domain fingerprint through a cross-attention mechanism. The time-domain features are used as query vectors to actively match the frequency-domain energy components with the highest correlation, and the spectral features of periodic malicious traffic such as C2 beacons, botnet heartbeats, and DNS tunnels are explicitly modeled. This mechanism enables a single fingerprint to simultaneously carry time-domain content evidence and frequency-domain behavioral evidence, which greatly improves the recognition accuracy and significantly reduces the false alarm level compared to a single time-domain or frequency-domain scheme.

[0125] Step D. Construct a traffic encoder and perform mapping processing on the side-channel vector and frequency domain peak features corresponding to the encrypted traffic to obtain the normalized traffic embedding. ,satisfy Combined with traffic fingerprint vector Together, they constitute the traffic fingerprint corresponding to the encrypted traffic.

[0126] Regarding the aforementioned model to be trained, a traffic fingerprint model is obtained through training, which is used to obtain the traffic fingerprint corresponding to encrypted traffic. In practical applications, during the process of training the model to obtain the traffic fingerprint model, based on a preset number of encrypted sample traffic of known real categories, step A obtains the byte token sequence, frequency domain peak feature, and side channel vector corresponding to each encrypted sample traffic. For steps B to C, a hybrid temporal encoder with a cross-attention fusion mechanism is used as the backbone network, connected to a closed-set classification head. According to the processing steps B to D, the following steps are followed. To the steps The total loss is calculated, and the joint training parameters of the hybrid temporal encoder, cross-attention fusion mechanism, and flow encoder are optimized through backpropagation.

[0127] step For the byte token sequence corresponding to the encrypted sample traffic received by the hybrid temporal encoder, a random mask is applied according to a preset ratio. The goal is to predict and reconstruct the original token value at the masked position, and the reconstruction loss corresponding to the encrypted sample traffic during the training process of the hybrid temporal encoder is calculated. Furthermore, the average reconstruction loss of each encrypted sample traffic was calculated. ;in, , This represents the total number of encrypted sample traffic in the current training batch. Indicates the first in the current training batch The reconstruction loss of each encrypted sample traffic.

[0128] step Based on the closed-set classification header, receive the traffic fingerprint vector corresponding to the encrypted sample traffic. It processes the first analysis category corresponding to the output encrypted sample traffic, and uses the real category corresponding to the encrypted sample traffic as the supervision target to calculate the cross-entropy loss corresponding to the encrypted sample traffic. Furthermore, the average cross-entropy loss of each encrypted sample traffic was calculated. ;in, Indicates the first in the current training batch Cross-entropy loss of encrypted sample traffic.

[0129] step Based on the semantic encoder mapping the real categories corresponding to the encrypted sample traffic to the same-dimensional semantic embedding, the normalized traffic embedding corresponding to the encrypted sample traffic obtained by the traffic encoder is then calculated. ,Will Same-dimensional positive semantic embedding of the true category of encrypted sample traffic via semantic encoder The negative semantic embedding of the encrypted sample traffic in the same dimension as the real category processed by the semantic encoder is brought closer. Further calculations are performed based on the InfoNCE contrast loss (information noise contrast estimation loss), using the following formula:

[0130] ;

[0131] Obtain the contrast loss corresponding to the encrypted sample traffic. Furthermore, the average contrast loss of each encrypted sample traffic was calculated. ,in, Indicates the first in the current training batch Normalized traffic embedding of encrypted sample traffic, Indicates the first in the current training batch Same-dimensional positive semantic embedding of encrypted sample traffic, Indicates the first in the current training batch Same-dimensional negative semantic embedding of encrypted sample traffic, This indicates that, except for the first batch, the current training batch contains... Same-dimensional negative semantic embedding of encrypted sample traffic other than the encrypted sample traffic. Indicates the first in the current training batch Comparative loss of encrypted sample traffic, Represents the cosine similarity function. Represents the temperature coefficient, in applications, ,Depend on Used to control the sharpness of the similarity distribution. This represents an exponential function.

[0132] step Construct an auxiliary classifier corresponding to the cross-attention fusion mechanism to encrypt the frequency domain feature vector of sample traffic. As input, the second analysis category of the encrypted sample traffic is obtained through an auxiliary classifier. Combined with the true category corresponding to the encrypted sample traffic as the supervision target, the auxiliary classification loss corresponding to the encrypted sample traffic is calculated. Furthermore, the average auxiliary classification loss of each encrypted sample traffic was calculated. ;in, Indicates the first in the current training batch Auxiliary classification loss for encrypted sample traffic.

[0133] step According to the following formula:

[0134] ;

[0135] Total loss ,in, These represent the weight coefficients for the average reconstruction loss, average cross-entropy loss, average contrastive loss, and average auxiliary classification loss, respectively. A typical configuration is as follows: , , , .

[0136] The above design enables multi-task joint training. The total loss is composed of mask flow reconstruction loss, closed set classification cross-entropy loss, zero-sample retrieval comparison loss, and time-frequency fusion branch auxiliary classification loss combined with preset weights. The multi-objective constraint enables the fingerprint generated by a single backbone network to simultaneously meet four requirements: reconstruction fidelity, closed set discrimination, open retrieval, and time-frequency fusion, supporting the core characteristic of fingerprints: "constructed once, reused in multiple places".

[0137] Based on the above design and training, a traffic fingerprint construction model is obtained. In the actual processing of encrypted traffic, the corresponding traffic fingerprint is obtained. In practical applications, based on the construction and traffic fingerprint, corresponding detection applications are designed, including encrypted traffic classification and detection, open-world traffic identification, and post-quantum cryptography traffic detection. Regarding the encrypted traffic classification and detection method, based on the trained traffic fingerprint construction model, the corresponding traffic fingerprint is obtained for encrypted traffic processing. For steps B to C, a hybrid temporal encoder with a cross-attention fusion mechanism is used as the backbone network, connected to a closed-set classification head, and then the following is executed.

[0138] The traffic fingerprint vector of encrypted traffic Input a closed-set classification header, which processes and outputs the probability distribution of encrypted traffic with respect to preset categories. Then, select the category corresponding to the highest probability value as the category corresponding to the encrypted traffic.

[0139] Regarding open-world traffic identification methods, such as Figure 5 As shown, the semantic encoder encodes and maps to obtain the same-dimensional semantic embeddings corresponding to each category. Build a semantic library, and Normalized traffic embedding of the same encrypted traffic The semantic embeddings of the true category are located in the same vector space and have the same dimension. A model is built based on the traffic fingerprint obtained through training. The corresponding traffic fingerprint is obtained by processing the target encrypted traffic, and the normalized traffic embedding corresponding to the target encrypted traffic is obtained. and calculate The cosine similarity is calculated between the embedding and each semantic embedding of the same dimension in the semantic library. The maximum cosine similarity is then obtained, and it is determined whether the maximum cosine similarity is greater than or equal to a preset similarity threshold. If the result is positive, the target encrypted traffic is named according to the category corresponding to the maximum cosine similarity; otherwise, the target encrypted traffic is determined to be unknown traffic, and... The data is fed into an online incremental clusterer, and the cluster merging radius is preset according to the embedding space. Clustering is performed, and when the amount of encrypted traffic within a cluster reaches a preset threshold... Then, the cluster is treated as a new category, a category identifier is assigned to the new category, and the corresponding semantic embedding is obtained through the semantic encoder. The new category and its corresponding semantic embedding are added to the semantic library to complete the continuous expansion of the category system.

[0140] According to the above design, a dual-head architecture of closed-set classification head + open retrieval branch is adopted. Known classes are identified by the closed-set classification head without loss of accuracy, while unknown traffic is handled by the retrieval branch. The accuracy of known classification is 0.915; the accuracy of unknown traffic rejection is 0.947; and the accuracy of naming unknown classes in Top-5 retrieval is 0.913.

[0141] The design of the aforementioned open-world traffic identification method constructs a dual-encoder cross-modal retrieval framework, breaking through the closed-world assumption of traditional closed-set classification. The traffic encoder only inputs side-channel and frequency domain features that can be transferred across categories and outputs a normalized traffic embedding vector. The semantic encoder maps the structured behavioral semantics of each category to semantic vectors of the same dimension, and the two are jointly trained and aligned to the same vector space through contrastive loss. The system adopts a dual-head architecture of "closed-set classification head + open retrieval branch". Known category traffic is identified with accuracy through the closed-set classification head, while unknown traffic is named with zero samples by searching the semantic library through KNN. Traffic below the confidence threshold is judged as completely new unknown traffic. After incremental clustering and manual confirmation, the semantic library can be directly expanded, and the identification range can be continuously expanded without retraining the model.

[0142] Regarding post-quantum cryptography traffic detection methods, such as Figure 6 As shown, step A also includes extracting the PQC metadata corresponding to the encrypted traffic, and building a model based on the traffic fingerprint obtained through training, processing the encrypted traffic to obtain the corresponding traffic fingerprint, and then performing the following steps a to c.

[0143] Step a. Parse the negotiation group identifier set in the PQC metadata corresponding to the encrypted traffic. The process involves matching the PQC algorithm group identifier code point database with the pre-defined database. This database contains at least pure ML-KEM algorithm group code points, IANA hybrid group code points, and SSH KEX algorithm name identifiers. ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is a standardized post-quantum cryptography algorithm, specifically a key encapsulation mechanism based on the lattice hard problem, used to establish shared keys. IANA (Internet Assigned Numbers Authority) is responsible for the registration and coordination of Internet protocol parameters, protocol numbers, port numbers, DNS root zones, etc., and here mainly involves the registration of cryptographic protocol parameters / name group identifiers. SSH (Secure Shell) is a network protocol used to establish secure communication channels over insecure networks. SSH KEX (SSH Key Exchange) is the key exchange mechanism in the SSH protocol used to negotiate algorithms and establish shared secrets and key materials required for a session.

[0144] Determine the set of negotiation group identifiers If there is an identifier in the code point database that successfully matches the code point of the PQC algorithm group, then mark the encrypted traffic as candidate PQC negotiation traffic and proceed to step b; otherwise, mark the encrypted traffic as non-post-quantum cryptography negotiation traffic and end the detection process.

[0145] Step b. Using all handshake messages in the candidate PQC negotiation traffic as an observation window, calculate the length of each public key within the observation window. The frequency of occurrence is calculated using the following formula:

[0146] ;

[0147] Calculate the Shannon entropy of the public key length distribution. ,in, Indicates the first observation within the observation window The frequency of occurrence of public key lengths, related to Shannon entropy. Further analysis of the design is needed, if... If it is determined to be a single PQC algorithm negotiation, then If so, it is determined to be a mixed negotiation or a downgraded negotiation.

[0148] Step c. Identify the set by the negotiation group Length of each public key within the observation window Shannon entropy As input, an MLP (Multilayer Perceptron) classifier (2 hidden layers, 128 units per layer, ReLU activation, Softmax output) is applied to process the output and identify the quantum cryptography algorithm family.

[0149] In practical applications, the MLP classifier in the PQC subsystem is trained independently using weighted binary cross-entropy loss and does not participate in the main multi-task joint optimization. Furthermore, in practical applications, the above design achieves the following results: PQC binary classification accuracy: 0.992, false positive rate: 0.000; four-class algorithm family (traditional algorithm / ML-KEM / ML-KEM hybrid / sntrup761 hybrid) recognition accuracy: 0.956; hybrid / degraded negotiation detection accuracy: 0.992; single-stream detection latency: .

[0150] The above-described post-quantum cryptography traffic detection method can identify post-quantum cryptography negotiation behavior in practical applications without decrypting the payload. It first filters handshake messages by port and protocol features, then parses the handshake fields to match an updatable PQC algorithm library, then calculates the information entropy of the public key length distribution to distinguish between single algorithms or hybrid and downgraded negotiation scenarios, and finally completes the accurate identification of the algorithm family through a lightweight multilayer perceptron. The design relies on deterministic public key length to construct fingerprints, resulting in high detection accuracy, extremely low single-stream latency, and the algorithm library supports flexible expansion, adapting to future new algorithms without modifying the model structure.

[0151] The traffic fingerprint generated by the technical solution designed according to this invention inherently possesses privacy-friendly attributes, featuring end-to-end non-intrusiveness, no payload decryption, irreversible embedding vectors, inability to restore the original content, and lightweight data exchange across nodes. Based on these characteristics, it can be seamlessly extended to a federated deployment mode, where each detection node completes fingerprint construction locally, and the original traffic and payload data never leaves the domain. Nodes only exchange lightweight data such as normalized embedding vectors, semantic prototypes, semantic library increments, and model updates. Through a federated averaging framework, parameters are aggregated, and cross-node collaboration completes semantic library expansion and PQC library updates, achieving cross-organizational collaborative defense while meeting data compliance requirements.

[0152] This invention's design is based on a multimodal unified representation, a dual-encoder retrieval architecture, and a PQC detection subsystem. The traffic fingerprint constructed by this invention inherently possesses privacy-friendly attributes and can be extended to a multi-node federated deployment mode without modifying the core model structure, balancing data compliance constraints and cross-domain collaborative defense capabilities. Non-intrusive construction: The entire process requires no payload decryption; the PQC detection subsystem only reads plaintext metadata from the handshake; the zero-shot retrieval branch only inputs side-channel statistics and frequency domain features; and fingerprint generation does not touch the encrypted application layer content. Embedding irreversibility: The traffic embedding used in zero-shot retrieval... The data is generated by normalizing and projecting the lossy statistical features using a traffic encoder. It is a 512-dimensional unit vector that does not contain the original payload bytes, and there is no feasible path to reverse-engineer the communication content. The exchanged data is lightweight: the amount of category semantic prototypes, semantic library increments, and model parameter updates that need to be exchanged across nodes is much smaller than the original traffic, resulting in extremely low transmission and storage overhead.

[0153] This invention selects a model architecture adapted to the FedAvg training framework and distributed incremental process, without altering the core network structure. Local computation closed loop: Each detection node independently completes multimodal unified representation extraction, traffic fingerprint construction, and local training of the dual encoders locally, ensuring that the original traffic and payload data remain within the domain. Parameter federated aggregation: The aggregation end only performs global aggregation on the projection head and semantic encoder parameters uploaded by each node, weighted by sample size, and then updates and sends the results back to all nodes; the training logic is consistent with single-point deployment, only the update method changes from centralized iteration to distributed aggregation. Cross-domain incremental expansion: Unknown traffic candidate clusters discovered locally by each node are merged according to the embedding space radius. Deduplication and merging are performed at the aggregation point, and the number of samples within the cluster reaches the submission threshold. The PQC detection library is expanded to the global semantic library and synchronized across all nodes; code point updates are also distributed through the same channel, enabling continuous class expansion without retraining the model.

[0154] In practical applications, the design scheme of this invention relies on the computing power advantage of the linear complexity backbone architecture, and can be adapted to multi-level deployment forms from single nodes to cross-institutional federations, covering a variety of application scenarios such as encrypted traffic identification, malicious traffic detection, post-quantum cryptography supervision, and open-world traffic governance.

[0155] (1) Large-scale deployment of computing power. The computational load and memory usage of the core backbone network increase linearly with the sequence length, which is significantly different from the O(N²) quadratic growth of the traditional attention architecture. According to the model structure analysis and calculation (unrelated to hardware implementation), when the sequence length L=8192, the peak computational load of the backbone network of the present invention is only 1 / 14 of that of the pure attention architecture, and the peak memory usage is only 1 / 128. It has an overwhelming scalability advantage in long sequence and high concurrency scenarios. This characteristic allows the construction cost of traffic fingerprints to be linearly scaled with the network size, which can support the real-time fingerprint construction and detection requirements of tens of thousands of streams per second at the operator level, and meet the large-scale deployment requirements of infrastructure-level traffic identity identification.

[0156] (2) Multi-level deployment forms. (a) Single-point deployment: A single node can independently complete the entire process of multimodal feature extraction, traffic fingerprint generation, closed set classification, open world retrieval and PQC detection. It is suitable for traffic governance scenarios in a single campus and a single link. No payload decryption is required throughout the process, which meets local data compliance requirements. (b) Federated deployment: Relying on the privacy-friendly attributes of fingerprints, it can be expanded into a multi-node federated collaborative architecture. Each node completes fingerprint construction locally. The original traffic does not leave the domain. Cross-domain collaborative defense and open world incremental expansion are achieved only by exchanging embedding vectors, semantic prototypes and model parameters. It is suitable for threat intelligence sharing scenarios across institutions and regions.

[0157] (3) Core Application Scenarios. (a) Refined Identification of Encrypted Traffic: Based on the dual-path fusion of time and frequency, it accurately identifies various encrypted application and business traffic. (b) Advanced Threat Detection: It achieves real-time detection with high accuracy and low false alarms for periodic malicious traffic such as C2 beacons and botnet heartbeats. (c) Post-Quantum Cryptography Migration Monitoring: It non-intrusively identifies PQC negotiation traffic, supporting compliance monitoring in the process of cryptographic generational evolution. (d) Open World Traffic Governance: Through zero-sample retrieval and incremental clustering mechanisms, it realizes the discovery, naming and continuous expansion of unknown traffic, breaking through the scenario limitations of traditional closed-set classifiers.

[0158] This invention achieves a core technological breakthrough based on a unified multimodal traffic fingerprint architecture, and verifies the effectiveness and beneficial effects of the technical solution through specific embodiments. Unless otherwise specified, all embodiments are trained and evaluated in a pure CPU environment without GPU, using a training configuration that is completely identical in design specifications and structure to that in Section 3, but scaled down proportionally. Sequence length Mamba has 4 layers, with an attention module inserted every 2 layers; batch size. AdamW optimizer, initial learning rate (Cosine annealing learning rate scheduling). All model structures and algorithms (selective scanning, gated fusion, cross attention, InfoNCE, PQC MLP) are consistent with the design scheme, with only the scale parameters scaled down proportionally; all comparative models involved in each embodiment are trained and evaluated under the same conditions with the same configuration and data partitioning, and the relative performance conclusions are not affected by the scale scaling.

[0159] Based on the above parameter configuration, specific implementation examples are designed for encrypted application traffic classification, zero-sample unknown application identification, PQC negotiation traffic detection, periodic malicious traffic detection ablation, and complexity and scalability. The specific design and implementation of each example will be carried out below.

[0160] (1) Regarding the example of encrypted application traffic classification, the example uses the public dataset ISCX VPN-nonVPN2016, which covers 11 types of traffic in both VPN and non-VPN scenarios, including browsing, streaming media, VoIP, file transfer, email, and P2P. All samples are segmented into bidirectional streams according to 5-tuples, and double-byte token sequences and extended side-channel features are extracted. ET-BERT, YaTC, and the original NetMamba are selected as the comparison baseline.

[0161] The full-byte window classification results show that the accuracy of this invention is on par with the original NetMamba, ranking best among the four models, and significantly outperforming ET-BERT and YaTC. Experimental data and comparisons are shown in Table 1, and as shown in... Figure 7 As shown.

[0162] Table 1 Comparison of four models in the encrypted application traffic classification examples.

[0163]

[0164] Compared to the pure byte NetMamba architecture, the core advantages of this invention have clear scenario differences: in the full byte window scenario, the payload byte information is sufficient and highly discriminative, and the classification accuracy of various strong backbone models approaches the upper bound of the task, with performance being basically on par; while the multimodal fusion advantage of this invention is fully released in scenarios with limited byte information (such as early detection, insufficient effective bytes in encrypted payloads), which is a direct manifestation of the information completeness of multimodal traffic fingerprints compared to single-modal features. Under the same byte token budget and the same training and evaluation conditions, this invention, relying on additional side-channel features and frequency domain features, does not perform worse than pure byte NetMamba at all budget levels, and the smaller the byte budget, the more significant the performance advantage. Experimental data and comparisons are shown in Table 2 and [further details omitted]. Figure 8 As shown.

[0165] Table 2 Comparison of different byte budgets in the examples of encrypted application traffic classification

[0166]

[0167] This invention maintains the same linear complexity and peak accuracy as the original NetMamba while providing additional capabilities. These capabilities all originate from different projection outputs of the same multimodal traffic fingerprint, rather than a simple stacking of multiple independent subsystems. This allows for the construction of a detection capability boundary with significantly broader coverage. Experimental data and comparisons are shown in Table 3.

[0168] Table 3 Comparison of Multimodal Capability Dimensions in Encryption Application Traffic Classification Examples

[0169]

[0170] (2) Regarding the zero-shot unknown application identification implementation, a zero-shot test partition was constructed based on the ISCX VPN-nonVPN dataset. Application categories with distinguishable behavioral characteristics were selected as the unknown class, appearing only during the testing phase; the remaining categories were considered as known classes and participated in the comparative training of the dual encoder; the retrieval semantic library covered all 11 traffic categories. Evaluation metrics included the Top-1 and Top-5 retrieval accuracy for the unknown class, and the rejection rate for unknown traffic (i.e., the Top-1 cosine similarity satisfies...). (Sample percentage).

[0171] The random baseline results for 11 semantic databases are as follows: Top-1 retrieval accuracy is approximately 0.09, and Top-5 retrieval accuracy is approximately 0.45. The Top-1 retrieval accuracy for the unknown category in this invention is approximately four times that of the random baseline. In the Top-5 retrieval scenario, 91% of the correct unknown applications fall within the top 5 candidate range. Experimental data and comparisons are shown in Table 4, and as shown in... Figure 9 As shown.

[0172] Table 4. Experimental data from zero-sample unknown application identification examples.

[0173]

[0174] Traditional closed-set classifiers, inherently constrained by the closed-world assumption, suffer from structural failures when dealing with unknown traffic. The model forces unknown samples to be mapped to known incorrect categories with high confidence, resulting in a native rejection rate of only 0.4%, essentially lacking the ability to identify unknowns in open scenarios. This invention, relying on a dual-encoder cross-modal semantic architecture, achieves a correct rejection accuracy of 0.947 for unknown traffic and a Top-5 retrieval and naming accuracy of 0.913 for unknown classes while maintaining a known classification accuracy of 0.915 without decay. Combined with an incremental clustering mechanism, it can automatically generate candidate clusters for unknown traffic, enabling continuous online class expansion without model retraining. The searchable traffic fingerprint internalizes the processes of discovering, naming, and absorbing the unknown into a normalized governance mechanism of the system, breaking through the scenario boundaries of closed-set classifiers at the underlying structural level and enabling open-world recognition capabilities.

[0175] (3) Regarding the PQC negotiation traffic detection implementation, the positive samples are constructed through controlled collection and synthesis, covering three types of post-quantum negotiation scenarios: snrup761x25519 and mlkem768x25519 mixed key exchange traffic under OpenSSH 9.x, HTTPS negotiation traffic with X25519MLKEM768 mixed group enabled, and pure PQC negotiation traffic of ML-KEM-512 / 768 / 1024 full range generated in batches in a controlled environment; the negative samples are selected from the conventional negotiation traffic using traditional ECDHE key exchange (X25519 / P-256 curve).

[0176] The algorithm family recognition covers four negotiation modes: traditional algorithms, pure ML-KEM, ML-KEM hybrid, and snrup761 hybrid. The detection library has a pre-built Kyber transition draft code point 0x6399; adding new algorithm families only requires expanding the lookup table, without modifying the model structure. To simulate the non-ideal observation environment of real-world deployments, three types of acquisition noise—incomplete handshake observations, observation timing jitter, and field parsing ambiguity—are injected into the feature layer. Experimental evaluation metrics include PQC binary classification accuracy, false alarm rate, and algorithm family recognition accuracy. Experimental data and comparisons are shown in Table 5, and as shown in... Figure 10 As shown.

[0177] Table 5. Test data from a PQC negotiation flow detection example.

[0178]

[0179] This invention uses PQC handshake metadata (group key points, deterministic public key length, and Shannon entropy of public key length distribution) to... A deterministic fingerprint is constructed, and combined with a lightweight MLP classifier, achieving a PQC binary classification accuracy of 0.992, a four-class algorithm family recognition accuracy of 0.956, a false alarm rate approaching 0, and a single-stream detection latency of <0.05ms in scenarios with acquisition noise. No decryption payload is required throughout the process, enabling traffic monitoring during the post-quantum cryptography migration period. By encoding cryptographic generational evolution information into the fingerprint, the monitoring system can evolve synchronously with the PQC migration.

[0180] (4) Regarding the ablation implementation of periodic malicious traffic detection, in order to rigorously verify the structural discriminative gain of the frequency-time dual-path fusion architecture and eliminate the interference of natural point increase caused by the increase in feature dimensions, this implementation adopts a dual verification paradigm of controlled complementary probe ablation + real-world scenario verification. All comparison groups only adjust the input feature path, and the model structure, training configuration, and data partitioning are completely consistent to ensure that the variables are unique and the conclusions can be directly attributed to the fusion mechanism.

[0181] (a) Controlled Complementary Fusion Ablation Experiment. A test probe was constructed where the label was determined by two independent noisy signals: a time-domain byte signal and a frequency-domain periodic signal. A single path inherently suffers from irreducible errors due to incomplete information. Only by effectively fusing the two independent pieces of evidence could the upper limit of task accuracy be approximated, thus purifying the effectiveness of the fusion mechanism itself. Experimental results show that the accuracy of the complete FTDP architecture reached 0.875, an absolute improvement of 19.2 percentage points compared to the pure time-domain scheme (0.683), and an absolute improvement of 18.9 percentage points compared to the pure frequency-domain scheme (0.686), representing a relative improvement of over 27%. This demonstrates that cross-attention achieves adaptive deep complementarity between the two pieces of evidence, rather than the marginal gain from simple feature splicing. Experimental data and comparisons are shown in Table 6 and [further details omitted]. Figure 11 As shown.

[0182] Table 6 Data from the controlled complementary fusion ablation experiment

[0183]

[0184] (b) CTU-13 Real-World Detection Validation. The CTU-13 real-world botnet traffic dataset, covering multiple botnet families including Neris, Rbot, Donbot, and Virut, was used to validate the architecture's generalization ability under real, highly mixed traffic conditions. Experimental results show that the complete FTDP architecture achieves an F1 score of 0.998 for botnet traffic detection, with an overall accuracy (Acc) of 0.998 and a false positive rate (FPR) of 0.000. It maintains extremely high detection accuracy and low false positives even under high-noise, multi-background traffic scenarios in real networks, demonstrating its engineering application value.

[0185] In summary, controlled ablation theoretically demonstrates the structural effectiveness of time-frequency cross-fusion, while real-world testing verifies its ability to detect periodic malicious traffic. Both findings indicate that the deep complementary fusion of temporal content evidence and frequency-domain behavioral evidence within a single fingerprint is the core structural reason why its discriminative power surpasses all single-domain schemes, effectively compensating for the blind spots in identifying periodic malicious traffic by single-modal features.

[0186] (5) Regarding the complexity and scalability of the embodiments, the peak computational cost and memory usage of the present invention both increase linearly with the sequence length, which is significantly different from the traditional pure attention architecture O(N) 2 The resource cost difference between the two follows a quadratic growth pattern, and the difference accelerates as the sequence length increases. The following calculations are based on theoretical analysis of the model structure and are independent of engineering factors such as specific hardware implementation and operator optimization. When the sequence length L=8192, the peak computational cost of this invention is only 1 / 14 of that of the pure attention architecture, and the peak memory usage is only 1 / 128. This linear complexity characteristic has an overwhelming scalability advantage in long sequence and high-concurrency scenarios: the construction cost of traffic fingerprints can be linearly scaled with the network size, which can fully meet the real-time detection deployment requirements of tens of thousands of streams per second for carriers. Experimental data and comparisons are shown in Table 7 and as shown in Table 8. Figure 12 As shown.

[0187] Table 7. Complexity and Scalability Example Data

[0188]

[0189] Based on the analysis of the above embodiments, a comparative experiment was designed from multiple dimensions, including classification accuracy, resource efficiency, malicious detection, open identification, special detection and compliance extension, to complete comprehensive performance verification and obtain the following core conclusions.

[0190] (1) The classification performance and coding efficiency have reached the expected balance: the classification accuracy in the full-byte scenario is on par with the current best level, and the detection capability in the byte-limited scenario is better than the pure byte baseline; the coding resource overhead increases linearly with the sequence length, and the resource advantage is significant in the long sequence high-concurrency scenario, which can meet the real-time processing requirements of carriers.

[0191] (2) Outstanding ability to detect periodic malicious traffic: The multi-domain feature fusion scheme has a significant performance gain compared to single-domain features. It achieves extremely high detection accuracy and extremely low false alarms in real botnet traffic tests and can effectively identify typical periodic malicious behaviors.

[0192] (3) Open world recognition capability breaks through the limitations of traditional closed sets: While maintaining the classification accuracy of known categories without loss, it realizes efficient rejection and retrieval naming of unknown traffic and supports the expansion of the category system without retraining.

[0193] (4) Post-quantum cryptography traffic detection is feasible for engineering implementation: the non-intrusive detection scheme maintains high accuracy and low latency in non-ideal collection environments, and the detection rule base can be smoothly iterated to adapt to the needs of cryptographic algorithm evolution.

[0194] (5) Native support for privacy compliance and cross-domain expansion capabilities: Fingerprints have the characteristic of irreversible content, which can be directly adapted to the distributed deployment mode where data does not leave the domain, and support cross-node collaborative detection and capability sharing.

[0195] This invention proposes an integrated network traffic fingerprinting construction and detection mechanism based on multimodal unified representation. It integrates time-domain bytes, frequency-domain features, handshake metadata, and side-channel statistics through a unified representation framework, simultaneously achieving four core capabilities: high-precision traffic classification, periodic malicious behavior detection, open-world unknown traffic identification, and post-quantum cryptography traffic awareness. It also balances high-concurrency deployment efficiency with privacy compliance requirements. Addressing five core shortcomings of existing traffic fingerprinting technologies—bottlenecks in large-scale deployment efficiency, limitations of the closed-world assumption, insufficient fusion of time and frequency features, lack of post-quantum cryptography oversight, and weak privacy compliance support—the core innovations of this invention are as follows.

[0196] (1) Linear complexity hybrid coding architecture, breaking through the computing power bottleneck of large-scale deployment.

[0197] This paper presents a hybrid encoder architecture based on the Mamba selective state-space model and Flash Attention gating, achieving high-quality temporal traffic fingerprint encoding with O(N) linear complexity. This addresses the computational constraints of long sequences and high concurrency scenarios caused by the O(N²) complexity of traditional pure attention architectures, while ensuring detection performance in byte-limited scenarios. Experimental data shows that the classification accuracy of the complete byte window is on par with the current best solution, and the performance advantage is more significant with a smaller byte budget. At k=16, the accuracy is 3.7 percentage points higher than the pure byte NetMamba baseline. With a sequence length L=8192, the peak backbone computation and peak GPU memory are only 1 / 14 and 1 / 128 of those of the pure attention architecture, respectively, supporting real-time fingerprint construction of tens of thousands of streams per second at carrier-grade speeds.

[0198] (2) Time-frequency dual-path cross-fusion mechanism to enhance the ability to identify periodic malicious traffic.

[0199] The protected frequency-time dual-path parallel processing (FTDP) architecture and the adaptive feature fusion mechanism based on cross-attention significantly improve the detection accuracy of covert periodic attacks such as C2 beacons and botnet heartbeats by deeply complementing time-domain content evidence and frequency-domain behavioral evidence to compensate for the recognition blind spots of single-domain features, rather than simply splicing features. Controlled complementarity ablation experiments verify that the complete architecture achieves an accuracy of 0.875, which is an absolute improvement of 19.2 and 18.9 percentage points compared with pure time-domain and pure frequency-domain schemes, respectively, confirming the structural discriminative gain of the fusion mechanism. In the CTU-13 real multi-family botnet traffic detection, the botnet identification F1 score and overall accuracy both reach 0.998, with a false positive rate (FPR) of 0.

[0200] (3) Zero-sample cross-modal retrieval framework, breaking through the inherent limitations of the closed-world assumption.

[0201] A dual-encoder cross-modal retrieval framework, combining a protected closed-set classification head with an open-world retrieval branch, maps traffic fingerprints to a semantically aligned embedding space. This endows fingerprints with open-world attributes, allowing them to be searchable, named, and expanded, structurally addressing the shortcomings of traditional closed-set classifiers, such as structural misjudgment of unknown traffic and extremely low native rejection rates. Experimental results show that, while maintaining the known class classification accuracy of 0.915 without loss, the scheme achieves a correct rejection rate of 0.947 for unknown traffic and a Top-5 retrieval and naming accuracy of 0.913 for unknown classes. On the ISCX VPN-nonVPN dataset, the Top-1 retrieval accuracy for unknown classes is four times that of the random baseline, far exceeding the native rejection rate of 0.4% for traditional closed-set classifiers. Combined with an incremental clustering mechanism, the identified categories can be continuously expanded without model retraining, forming a complete open-world governance process of "discovering the unknown - naming the unknown - absorbing the unknown."

[0202] (4) Non-invasive PQC detection pipeline, forward-looking adaptation for generational evolution of quantum cryptography

[0203] This invention presents a non-intrusive PQC traffic detection scheme based on deterministic fingerprints of handshake metadata, along with a hot-update detection library structure. It identifies post-quantum cryptography negotiation traffic and distinguishes algorithm families without requiring payload decryption, filling the gap in traffic monitoring during the post-quantum cryptography migration transition. In a test environment with acquisition noise, the accuracy of PQC binary classification and hybrid / degraded negotiation detection both reach 0.992, with an FPR of 0. The accuracy of identifying four algorithm families—traditional algorithm, pure ML-KEM, ML-KEM hybrid, and snrup761 hybrid—reaches 0.956. Single-stream detection latency is less than 0.05ms. The detection library has pre-configured Kyber transition draft code points; subsequent additions of algorithms only require table expansion for adaptation, without modifying the main model structure.

[0204] (5) Native privacy-friendly fingerprint design to support federated cross-domain collaborative deployment

[0205] This system protects a privacy-friendly fingerprint construction method based on normalized embedding, along with a supporting federated cross-domain collaborative class expansion and database update mechanism. While meeting data compliance and privacy protection requirements, it supports cross-organizational threat intelligence collaboration. The traffic fingerprint construction process does not decrypt the payload; the output retrieval embedding is a 512-dimensional normalized unit vector, making it impossible to reverse-engineer the original communication content. The amount of semantic prototypes, database increments, and model parameters exchanged across nodes is far smaller than the original traffic, naturally possessing non-intrusive, irreversible, and lightweight privacy attributes. Based on this characteristic, it can be directly extended to a multi-node federated deployment mode. The original traffic data never leaves the domain; cross-domain capability synchronization is achieved simply by exchanging embedding vectors, semantic prototypes, and model parameters, realizing an upgrade from single-point detection capabilities to a cross-organizational threat intelligence collaboration system.

[0206] In summary, all of the above capabilities are based on different projection outputs of the same multimodal traffic fingerprint, rather than a stacking of multiple independent subsystems. While maintaining linear complexity and baseline classification accuracy, this invention adds core capabilities not found in pure byte backbone network structures, such as time-frequency joint discrimination, open-world recognition, and post-quantum cryptography awareness, thus constructing a traffic fingerprint detection system with wider capability boundaries and stronger scenario adaptability.

[0207] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for constructing network traffic fingerprints, characterized in that: For the intercepted encrypted traffic, following steps A to D, a model to be trained is constructed, and then the traffic fingerprint is obtained through training to construct the model, which is used to obtain the traffic fingerprint corresponding to the encrypted traffic. Step A. Based on the plaintext header of the encrypted traffic, and the cryptographic negotiation extension field and encrypted payload bytes of the plaintext during the handshake phase, extract the corresponding packet length sequence and packet interval sequence, and further extract the corresponding byte token sequence, frequency domain peak features, and side channel vector; Step B. Construct a hybrid temporal encoder that includes a Mamba branch, a Flash Attention branch, and a gating fusion module. This encoder receives the byte token sequence corresponding to the encrypted traffic and processes it to output the corresponding temporal fingerprint vector. ; Step C. Obtain the frequency domain feature vector by performing convolutional dimensionality reduction on the frequency domain peak features corresponding to the encrypted traffic. , with frequency domain feature vector It is used as both a key and a value input, in the form of a time-domain fingerprint vector. The input is used as a query, and a cross-attention fusion mechanism is executed to obtain the traffic fingerprint vector corresponding to the encrypted traffic. ; Step D. Construct a traffic encoder and perform mapping processing on the side-channel vector and frequency domain peak features corresponding to the encrypted traffic to obtain the normalized traffic embedding. Combined with traffic fingerprint vector Together, they constitute the traffic fingerprint corresponding to the encrypted traffic.

2. The network traffic fingerprinting method according to claim 1, characterized in that: In step A, based on the plaintext header of the encrypted traffic and the cryptographic negotiation extension field and encrypted payload bytes of the plaintext during the handshake phase, the corresponding packet length sequence and packet interval sequence are extracted, and the following steps A1 to A2 are further performed to extract the corresponding byte token sequence, frequency domain peak features, and side channel vector. Step A1. Regarding the byte token sequence, use the following formula: ； Double-byte encoding is performed on the encrypted payload bytes of the encrypted traffic to obtain the byte token sequence corresponding to the encrypted traffic, where, , This indicates the preset length of the obtained byte token sequence. Indicates the first byte in the encrypted payload. An unsigned 8-bit integer value of 1 byte. Indicates the first byte in the encrypted payload. An unsigned 8-bit integer value of 1 byte. This indicates the byte token sequence obtained. The encoding result of each token; Regarding frequency domain peak characteristics, the following steps are performed for the packet length sequence and packet interval sequence corresponding to the encrypted traffic, respectively: The point fast Fourier transform is calculated using the following formula: ； ； ； ； Extract the spectral amplitude corresponding to the packet length sequence With phase spectrum values And based on the descending order of the spectral amplitude, the preset order is selected. The spectral amplitude corresponding to each frequency point With phase value ; And extract the spectral amplitude corresponding to the packet interval sequence. With phase spectrum values And based on the descending order of the spectral amplitude, the preset order is selected. The spectral amplitude corresponding to each frequency point With phase value ; Depend on , , , Together, they constitute the frequency domain peak characteristics corresponding to encrypted traffic, where, Indicates the first packet in the packet length sequence The total IP length of each data packet. Indicates the first packet interval sequence Individual packet interval value, Represents the imaginary unit. Indicates discrete frequency index. This indicates the number of points in the Fast Fourier Transform. The base of the natural logarithm. Represents the value of a unit complex exponential function. This indicates the phase take operation; Step A2. Regarding the side channel vector, based on the plaintext header of each data packet in the encrypted traffic, statistical class features composed of corresponding preset statistical attributes are calculated. Time series features are composed of corresponding preset time series attributes. Protocol class features consisting of corresponding preset protocol attributes Then, based on the frequency domain peak characteristics corresponding to the encrypted traffic, statistical analysis of the corresponding frequency domain peak characteristics is obtained. According to the following formula: ； Concatenation yields the side channel vector corresponding to the encrypted traffic .

3. The method for constructing network traffic fingerprints according to claim 1, characterized in that: In step B, the hybrid time-domain encoder performs the following steps B1 to B2: receiving the byte token sequence corresponding to the encrypted traffic and processing the output. Step B1. The Mamba branch performs linear complexity encoding on the byte token sequence based on a selective state-space model to obtain the first encoded output. The Flash Attention branch performs block-based attention encoding on the byte token sequence to obtain the second encoded output. ;in, Represents the real number field. This indicates the preset length of the obtained byte token sequence. Represents the feature dimensions of the data; Step B2. The gating fusion module uses the following formula: ； For the first encoded output Second encoding output Perform convex combination fusion to obtain the temporal fingerprint vector. and output, where, Indicates the fusion weight. This represents the Sigmoid activation function.

4. The method for constructing network traffic fingerprints according to claim 2, characterized in that: Step C includes the following steps C1 to C2; Step C1. Based on the frequency domain peak characteristics corresponding to the encrypted traffic , , , According to the following formula: ； Perform 1D convolution dimensionality reduction to obtain frequency domain feature vectors. ,in, This represents the concatenation function. Represents a 1D convolution function; Step C2. Using frequency domain feature vectors Simultaneously serving as a key AND value Input is a temporal fingerprint vector. As a query Enter the formula as follows: ； Perform a cross-attention fusion mechanism to obtain the traffic fingerprint vector corresponding to the encrypted traffic. ;in, This represents the function for the cross-attention fusion mechanism.

5. The method for constructing network traffic fingerprints according to claim 1, characterized in that: In the process of training the model to obtain traffic fingerprints and constructing the model, based on a preset number of encrypted sample traffic with known real categories, step A obtains the byte token sequence, frequency domain peak features, and side channel vectors corresponding to each encrypted sample traffic. For steps B to C, a hybrid temporal encoder with a cross-attention fusion mechanism is used as the backbone network, connected to a closed-set classification head. Following the steps B to D, the process proceeds as follows: To the steps The total loss is calculated, and the joint training parameters of the hybrid temporal encoder, cross-attention fusion mechanism, and flow encoder are optimized through backpropagation. step For the byte token sequence corresponding to the encrypted sample traffic received by the hybrid temporal encoder, a random mask is applied according to a preset ratio. The goal is to predict and reconstruct the original token value at the masked position, and the reconstruction loss corresponding to the encrypted sample traffic during the training process of the hybrid temporal encoder is calculated. Furthermore, the average reconstruction loss of each encrypted sample traffic was calculated. ;in, , This represents the total number of encrypted sample traffic in the current training batch. Indicates the first in the current training batch Reconstruction loss of encrypted sample traffic; step Based on the closed-set classification header, receive the traffic fingerprint vector corresponding to the encrypted sample traffic. It processes the first analysis category corresponding to the output encrypted sample traffic, and uses the real category corresponding to the encrypted sample traffic as the supervision target to calculate the cross-entropy loss corresponding to the encrypted sample traffic. Furthermore, the average cross-entropy loss of each encrypted sample traffic was calculated. ;in, Indicates the first in the current training batch Cross-entropy loss of encrypted sample traffic; step Based on the semantic encoder mapping the real categories corresponding to the encrypted sample traffic to the same-dimensional semantic embedding, the normalized traffic embedding corresponding to the encrypted sample traffic obtained by the traffic encoder is then calculated. ,Will Same-dimensional positive semantic embedding of the true category of encrypted sample traffic via semantic encoder The negative semantic embedding of the encrypted sample traffic in the same dimension as the real category processed by the semantic encoder is brought closer. To extend the range, based on the InfoNCE contrast loss, use the following formula: ； Obtain the contrast loss corresponding to the encrypted sample traffic. Furthermore, the average contrast loss of each encrypted sample traffic was calculated. ,in, Indicates the first in the current training batch Normalized traffic embedding of encrypted sample traffic, Indicates the first in the current training batch Same-dimensional positive semantic embedding of encrypted sample traffic, Indicates the first in the current training batch Same-dimensional negative semantic embedding of encrypted sample traffic, This indicates that, except for the first batch, the current training batch contains... Same-dimensional negative semantic embedding of encrypted sample traffic other than the encrypted sample traffic. Indicates the first in the current training batch Comparative loss of encrypted sample traffic, Represents the cosine similarity function. Indicates the temperature coefficient. Represents an exponential function; step Construct an auxiliary classifier corresponding to the cross-attention fusion mechanism to encrypt the frequency domain feature vector of sample traffic. As input, the second analysis category of the encrypted sample traffic is obtained through an auxiliary classifier. Combined with the true category corresponding to the encrypted sample traffic as the supervision target, the auxiliary classification loss corresponding to the encrypted sample traffic is calculated. Furthermore, the average auxiliary classification loss of each encrypted sample traffic was calculated. ;in, Indicates the first in the current training batch Auxiliary classification loss for encrypted sample traffic; step According to the following formula: ； Total loss ,in, The weights are, in order: average reconstruction loss, average cross-entropy loss, average contrast loss, and average auxiliary classification loss.

6. The detection application based on the network traffic fingerprinting construction method according to any one of claims 1 to 5, characterized in that: The method includes an encrypted traffic classification and detection method. It builds a model based on the traffic fingerprint obtained through training, obtains the corresponding traffic fingerprint for encrypted traffic processing, and uses a hybrid temporal encoder plus cross-attention fusion mechanism as the backbone network for the processing steps B to C, and connects it to a closed set classification head, and then performs the following: The traffic fingerprint vector of encrypted traffic Input a closed-set classification header, which processes and outputs the probability distribution of encrypted traffic with respect to preset categories. Then, select the category corresponding to the highest probability value as the category corresponding to the encrypted traffic.

7. The detection application of the network traffic fingerprint construction method according to claim 6, characterized in that: It also includes an open-world traffic identification method, which uses a semantic encoder to encode and map the semantic embeddings of each category to obtain the corresponding same-dimensional semantic embeddings, constructs a semantic library, and normalizes the traffic embeddings of the same encrypted traffic. The semantic embeddings of the true category are located in the same vector space and have the same dimension. A model is built based on the traffic fingerprint obtained through training. The corresponding traffic fingerprint is obtained by processing the target encrypted traffic, and the normalized traffic embedding corresponding to the target encrypted traffic is obtained. and calculate The cosine similarity is compared with each semantic embedding of the same dimension in the semantic library. The maximum cosine similarity is obtained, and then it is determined whether the maximum cosine similarity is greater than or equal to a preset similarity threshold. If it is, the target encrypted traffic is named according to the category corresponding to the maximum cosine similarity; otherwise, the target encrypted traffic is determined to be unknown traffic and... The data is fed into an online incremental clusterer, and the cluster merging radius is preset according to the embedding space. Clustering is performed, and when the amount of encrypted traffic within a cluster reaches a preset threshold... Then, the cluster is treated as a new category, a category identifier is assigned to the new category, and the corresponding semantic embedding is obtained through the semantic encoder. The new category and its corresponding semantic embedding are added to the semantic library to complete the continuous expansion of the category system.

8. The detection application of the network traffic fingerprint construction method according to claim 6, characterized in that: It also includes a post-quantum cryptography traffic detection method, which is based on step A, which includes extracting PQC metadata corresponding to encrypted traffic and building a model based on the traffic fingerprint obtained by training. The encrypted traffic is then processed to obtain the corresponding traffic fingerprint, and then the following steps a to c are performed. Step a. Parse the negotiation group identifier set in the PQC metadata corresponding to the encrypted traffic. Perform matching with the preset PQC algorithm group identifier code point database. The PQC algorithm group identifier code point database contains at least pure ML-KEM algorithm group code points, IANA hybrid group code points, and SSH KEX algorithm name identifiers; determine the negotiation group identifier set. If there is an identifier in the code point database that successfully matches the code point of the PQC algorithm group, then mark the encrypted traffic as candidate PQC negotiation traffic and proceed to step b; otherwise, mark the encrypted traffic as non-post-quantum cryptography negotiation traffic and end the detection process. Step b. Using all handshake messages in the candidate PQC negotiation traffic as an observation window, calculate the length of each public key within the observation window. The frequency of occurrence is calculated using the following formula: ； Calculate the Shannon entropy of the public key length distribution. ,in, Indicates the first observation within the observation window Frequency of occurrence of different public key lengths; Step c. Identify the set by the negotiation group Length of each public key within the observation window Shannon entropy As input, an MLP classifier is applied to process the output, resulting in the identification of a family of quantum cryptography algorithms.

9. The detection application of the network traffic fingerprint construction method according to claim 8, characterized in that: Step b also includes targeting Shannon entropy. Analysis, if If it is determined to be a single PQC algorithm negotiation, then If so, it is determined to be a mixed negotiation or a downgraded negotiation.

Images