381 results about "Traffic classification" patented technology

The invention discloses a load balancing control method based on data traffic, and relates to the technical field of data transmission. Comprising the following steps: constructing a flow monitoring module based on data flow, constructing a self-adaptive flow classification model, dynamically allocating weights to load nodes with balanced loads, dynamically adjusting a transmission path of the flow, carrying out real-time load balancing scheduling, and processing abnormal flow. According to the load balancing control method based on the data traffic, the self-adaptive traffic classification model and the multi-path traffic reconstruction algorithm are introduced, so that the defects in the prior art are fundamentally overcome. The real-time performance, the stability and the resource utilization rate of the system are remarkably improved through deep classification of the traffic characteristics and a multi-path dynamic segmentation strategy. According to the method, resource allocation can be optimized in a complex traffic scene, the load balancing efficiency is improved, meanwhile, the service quality of delay-sensitive and bandwidth-intensive services is guaranteed, and the availability and reliability of the whole system are enhanced.

The present disclosure relates to: a communication technique for a 5G communication system for supporting a higher data transmission rate higher a 4G system; and a system therefor. According to an embodiment of the present disclosure, a method for a first network node in a wireless communication system may be disclosed, the method comprising the steps of: receiving, from a second network node, a policy and charging control (PCC) rule and fully qualified domain name (FQDN)-based information that indicate any one of traffic detections via DNS message reporting or a DNS resolution; generating a DNS message processing rule on the basis of the FQDN-based information; transmitting the DNS message processing rule to a third network node; and receiving, from the third network node, an FQDN and an IP address for the FQDN, wherein the FQDN and the IP address are identified by the third network node via detection of a DNS response message on the basis of the DNS message processing rule.

The invention discloses an encrypted network traffic classification method and system based on spatio-temporal information fusion, and mainly relates to the technical field of information security. Comprising the steps of obtaining data from an original Pcap file and performing data preprocessing; respectively converting the processed flow into a session flow multi-level representation sequence and a session-level flow graph; carrying out feature vector integration on the flow sequence through a session flow multi-stage representation sequence; the method comprises the following steps of: embedding a session-level flow graph to obtain a spatial feature vector representation of a network flow file; and aggregating the time feature vector and the space feature vector by using a cross gating feature fusion method to obtain the overall representation of the traffic features, and carrying out encrypted traffic classification by using a trained model. The method has the beneficial effects that the feature representation capability of the model is effectively enhanced while the classification effect of the encrypted traffic is improved.

A QUIC encrypted traffic classification method based on multi-model fusion belongs to the field of communication, and comprises the following steps: a model training stage: dividing a data set, training each model in a high-precision model group and a high-recall-rate model group by using a training set, evaluating model performance by using a verification set, if a dynamic weight mechanism is started, calculating the weight of the model according to a model evaluation result, and if the dynamic weight mechanism is started, calculating the weight of the model; carrying out normalization processing on the weight, and searching an optimal decision threshold by using a plurality of candidate thresholds; in the model prediction stage, prediction data are input, each model generates a respective prediction probability, and if a dynamic weight mechanism is started, the prediction probability of each model is subjected to weighted averaging according to the weight obtained in the training stage so as to perform probability calibration; and combining the calibration probability of each model, judging the calibration probability through an optimal decision threshold, and generating a final classification prediction result. According to the method, the risks of overfitting and poor generalization ability of a single model are reduced, and QUIC encrypted traffic classification with high accuracy and stability is realized.

The invention discloses an encrypted network traffic classification method based on a structured state space dual model in the technical field of network information security, and aims to solve the optimization problem of encrypted network traffic classification. The method comprises the following steps: acquiring a pcap data packet in encrypted network traffic; extracting hierarchical flow information in the flow packet and generating a stride sequence; inputting the stride sequence into a pre-trained encrypted network traffic classification model, and outputting a classification result; the training of the encrypted network traffic classification model comprises the following steps: carrying out self-supervised pre-training on unmarked data by using a mask auto-encoder, and learning universal representation of traffic data; and replacing a model decoder with a multi-layer perceptron head, and performing fine tuning optimization by using mark data. According to the method, the reasoning speed is improved while low GPU memory use is kept, and encrypted traffic classification can be more efficiently and effectively achieved.

The invention provides an encrypted traffic classification method based on a multi-view heterogeneous graph model (MH-Net). The accuracy and robustness of network traffic classification can be effectively improved. In the method, the multi-view flow graph is constructed, and the diversity of information granularity is enriched by aggregating different numbers of flow bits into various types of flow units. And head-head, head-load and load-load flow unit correlation is further introduced to form a heterogeneous flow graph, and feature extraction is performed by using a heterogeneous graph neural network. Besides, through a multi-task contrast learning strategy, the robustness of traffic unit representation is enhanced, synchronous training is realized in traffic level and data packet level classification tasks, and the overall performance is optimized. Experimental results show that the method has excellent performance on a plurality of data sets, exceeds the prior art and shows the application potential in the field of network traffic classification.

The invention relates to an encrypted traffic classification method based on a two-stage adaptive architecture, and belongs to the technical field of computer network security. The method comprises the following steps: firstly, distinguishing data in-distribution (ID) and out-of-distribution (OOD) traffic through a mixed OOD detection mechanism, and processing a detection result by adopting a self-adaptive classification strategy: for the ID traffic, accurately classifying known categories by adopting a transformer-based encoder; for OOD traffic, a classification task is converted into a generation task by combining a large language model (LLM) and a newly proposed semantic enhancement prompt strategy (SPS), so that flexible fine-grained recognition of unknown traffic types is realized. The SPS strategy comprises three levels of a strict mode, a complete mode and an expansion mode, and a flexible generation space is provided while the classification precision is ensured. Through the innovative two-stage design, the problem that the emerging network application cannot be accurately identified by the existing method is effectively solved while the high-precision classification of the ID traffic is maintained.

According to the hierarchical distribution model warehouse synchronization system and method provided by the invention, rapid synchronization of key and frequently accessed data is ensured through design of multiple synchronization strategies and implementation of dynamic scheduling; the data transmission quantity is reduced through a service grading strategy and an on-demand synchronization strategy, and the occupation of network bandwidth and the demand of storage resources are reduced; by adjusting a distribution path and load balancing in real time, it is ensured that a synchronization task is efficiently carried out, and single-point synchronization overload is avoided; and an adaptive fault-tolerant mechanism can automatically identify and process abnormal conditions in the synchronization process, so that the reliability of data synchronization is improved. In addition, the invention provides an end-to-end data encryption and integrity verification mechanism to protect the security of the data in the transmission process; a role-based access control mechanism ensures that only authorized users and a system can access and synchronize data, so that the security management of the data is enhanced. The method has good expandability, and can flexibly adapt to synchronization requirements of different scales and support a new synchronization strategy in the future.

The invention relates to an encrypted traffic classification method and device, computer equipment and a medium, and the method comprises the steps: carrying out the preprocessing of original traffic, and obtaining a session image of a data packet header and a session image of a payload; extracting global features and spatial-temporal features of the header and the load according to the session image of the packet header of the data packet and the session image of the effective load; fusing the global features and the spatial-temporal features of the head and the load through adaptive weighting to obtain initially fused head features and load features; fusing the head feature and the load feature which are initially fused together through adaptive weighting to obtain a final feature vector; and classifying the original traffic according to the final feature vector. In the whole process, the situation that the same byte value has different meanings in the head and the effective load in practical application is fully considered, and accurate encrypted traffic classification can be realized.

The invention is suitable for the technical field of network security, and provides an abnormal traffic identification method, device and equipment, a medium and a computer program, and the method comprises the steps: obtaining a comprehensive traffic feature of a to-be-detected traffic; the total data amount of the to-be-detected traffic is obtained through a pre-trained algorithm distribution model, a recognition algorithm corresponding to the to-be-detected traffic is output based on the total data amount, the recognition algorithm is a first clustering algorithm or a second clustering algorithm, and the total data amount of the traffic suitable for the first clustering algorithm is larger than the total data amount of the traffic suitable for the second clustering algorithm; classifying the traffic to be detected according to the comprehensive traffic features, the recognition algorithm and a plurality of abnormal centers corresponding to the recognition algorithm; and under the condition that the to-be-detected traffic belongs to any abnormal center, determining that the to-be-detected traffic is abnormal traffic. According to the invention, anomaly identification during traffic classification for different conditions is realized, and the accuracy, efficiency and automation degree of abnormal traffic identification can be improved.

The invention discloses an encrypted traffic classification method based on Transform, and belongs to the technical field of network security and encrypted traffic analysis. In order to solve the problems that load content in a novel encryption protocol (such as TLS 1.3 and VPN) is encrypted, structural disturbance is complex, category distribution is unbalanced and the like, the invention provides a dual-phase Transform framework (DPFT) with pre-training and structure optimization fine tuning. According to the framework, two self-supervision tasks of masked burst prediction (MBP) and burst structure discrimination (BSDT) are introduced in a pre-training stage, and deep data packet representation is learned from unlabeled traffic, so that the deep data packet representation is learned from the unlabeled traffic; in the fine tuning stage, dynamic weighting of word embedding and position embedding, multi-head attention pooling and Focus Loss are adopted, so that the modeling capability of the model on an encrypted traffic complex structure is enhanced, and the recognition sensitivity on minority class samples is improved. Experimental results show that the method disclosed by the invention is obviously superior to the existing method on various encrypted traffic data sets (including TLS 1.3, VPN, malicious traffic and the like), and achieves leading performance on classification accuracy and macro average F1 index.

The invention provides a ship network hierarchical intrusion detection method and system, and the method comprises the steps: obtaining multi-dimensional flow data from a plurality of hierarchies of a ship network, carrying out the preprocessing of the data, carrying out the feature extraction of the preprocessed flow data through a deep neural network model, obtaining the feature vector of the multi-dimensional flow data, and carrying out the detection of the multi-dimensional flow data. Then, establishing an anomaly detection model based on a random forest algorithm, inputting the feature vector into the anomaly detection model to obtain an anomaly score of the traffic data, and comparing the anomaly score with a preset score threshold to judge a confidence traffic and a question traffic; and finally, establishing an abnormal traffic classification model based on the bidirectional gating recurrent neural network and the convolutional neural network, inputting the doubt traffic into the abnormal traffic classification model to respectively obtain probabilities of the doubt traffic belonging to different known attack types, and respectively comparing the probabilities with a preset threshold. And then judging the attack type and whether the attack is a zero-day attack, and executing a corresponding defense strategy to complete hierarchical intrusion detection of the ship network.

The invention relates to an encrypted network traffic classification method based on a pre-trained large language model, and belongs to the technical field of encrypted network traffic classification. The method mainly comprises three stages: a pre-training stage: converting original encrypted network traffic data into a double-byte hexadecimal format through preprocessing, generating and optimizing a basic vocabulary by using a byte pair coding algorithm, then constructing a large language model, and obtaining a pre-training model through distributed training; in the retraining stage, the data is subjected to head byte shuffling processing, and the pre-training model is quickly retrained to improve the generalization ability. In the fine tuning stage, to-be-classified data is preprocessed to generate hexadecimal double-byte data with labels, and classification task training is performed by using the retrained model to obtain an encrypted network traffic classification fine tuning model and classification accuracy. Through the combination of pre-training and retraining and the fine tuning of the pre-training model by means of data classification, the efficient processing and accurate classification of the complex encrypted network traffic are realized.

The invention relates to the technical field of flow forwarding, in particular to a controllable flow forwarding method. The method comprises the following steps: S1, demand analysis, S2, traffic model construction, S3, equipment initial configuration, S4, traffic monitoring and evaluation, S5, traffic classification and priority setting, S6, bandwidth limitation and rate control, S7, load balancing, S8, resource reservation, S9, security encryption and verification of a data packet, S10, traffic caching and data loss prevention, and S11, dynamic adjustment of a forwarding strategy. According to the method, accurate control and management of network traffic are realized through traffic model construction, traffic monitoring and evaluation, traffic classification and priority setting, bandwidth limitation and rate control, load balancing and resource reservation, the security of data in a forwarding process is improved through security encryption and verification of a data packet, log recording and performance monitoring, and the data forwarding efficiency is improved. And data loss is avoided through flow caching, data loss prevention and dynamic adjustment of a forwarding strategy.

The invention relates to the technical field of computers, in particular to a general traffic image generation method for solving unbalanced network traffic classification, which comprises the following steps of: arranging and combining original network traffic into a session stream according to a time sequence based on a session stream mode, and converting the session stream into an image by taking a data packet as a unit. Converting the effective load of each data packet into a grayscale image; the SCGAN is used for training; eliminating noise by adopting a convolution noise reduction auto-encoder, and performing high-definition reconstruction on the generated flow sample; and combining a minority of types of traffic image samples generated through high-definition reconstruction with the original real traffic samples. According to the method, when the data packets are converted into the traffic images, the time sequence dependency relationship of the network traffic is reserved, the structural features among the data packets in image representation are also reserved, a balanced new network traffic data set is constructed, the authenticity and diversity of the data set are kept, and the generalization ability and effect of the model are improved.

The invention relates to an encrypted traffic classification method fusing space, time sequence and frequency spectrum features, and belongs to the field of encrypted traffic classification and deep learning. The method comprises the following steps: analyzing a network original flow Pcap packet, segmenting the packet into different sessions according to a quintuple, and preprocessing each session: extracting first n data packets, and then extracting first m bytes and t time sequence data from each packet; utilizing byte data of the session to train a spatial feature module, and extracting spatial features of the session; training a time sequence feature module by using the time sequence data of the session, and extracting time sequence features of the session; the byte data of the session are converted into frequency spectrum information through fast Fourier transform, a frequency spectrum feature module is trained, and frequency spectrum features of the session are extracted; and fusing the extracted global spatial features, time sequence features and frequency spectrum features, and training by using multi-modal joint feature representation to realize fine classification of encrypted traffic. According to the invention, the precision and robustness of traffic classification can be improved.

The invention designs a cross-Tor version domain small sample website fingerprint identification method based on comparative learning. The method comprises three parts of a pre-training strategy based on comparative learning, a fine tuning strategy based on double-branch confidence alignment and a flow classification strategy driven by a prototype. The method comprises the following steps: firstly, constructing a discriminative representation space through a trunk convolution feature extractor and a traffic attention module based on a pre-training strategy of comparative learning, and introducing supervised comparative learning to obtain feature representation with a cross-domain migration capability; secondly, a double-branch confidence alignment fine tuning strategy is adopted, the stability of a model structure is kept in combination with a partial freezing mechanism, and rapid adaptation to a target domain is achieved through joint optimization of cross entropy loss and weighted comparison loss; and finally, introducing a prototype-driven classification strategy, and on the basis of a semantic structure formed in a fine tuning stage, realizing accurate identification of Tor traffic in closed world and open world scenes by using a category prototype, so that the cross-domain generalization ability of small sample website fingerprint identification is remarkably improved.

The invention discloses an intelligent detection method and system for security vulnerabilities of a terminal layer of an electric power internet of things, and relates to the technical field of security protection of the electric power internet of things, and the method comprises the steps: collecting multi-dimensional information and network traffic characteristics of terminal equipment of the electric power internet of things, constructing an equipment fingerprint database, carrying out the comparison verification of the equipment, and obtaining a security vulnerability of the terminal layer of the electric power internet of things according to a verification result; the method comprises the following steps: classifying network traffic, identifying an abnormal traffic sequence, extracting behavior parameters of network traffic abnormity and network access abnormity, carrying out association analysis on the abnormal parameters, labeling equipment, and generating a security vulnerability detection report. The technical problem that potential security vulnerabilities are difficult to find and repair in time due to the fact that complex abnormal behaviors in a device layer and network traffic cannot be effectively recognized and handled in the prior art is solved, real-time and accurate security vulnerability detection is achieved by constructing a device fingerprint database and carrying out traffic classification and abnormal behavior analysis, and the security vulnerability detection efficiency is improved. Therefore, the technical effect of improving the security of the terminal layer of the power Internet of Things is achieved.

The invention provides a lightweight Internet of Things traffic classification method based on improved MobileNetV2. A lightweight model based on MobileNetV2 is constructed and comprises an input layer, a network introducing an attention mechanism, a classification network and an output layer which are connected in sequence; the input layer performs flow splitting and anonymization processing on input network flow data and constructs a multi-dimensional feature representation matrix comprising a byte level, a data packet level and a data flow level; according to the introduction of the attention mechanism network, an attention mechanism module is added behind a plurality of bottleneck layers so as to combine current layer features with shallow high-resolution features; performing iterative training on the lightweight model by taking the training set as training data and adopting a combined strategy based on cosine annealing and hot restart to obtain a trained model; model parameters are optimized through quantitative compression and structure pruning, the test set serves as test data, the optimized model is evaluated, and a classification result is output. According to the invention, efficient and accurate traffic classification is realized, and the problem of resource limitation of the Internet of Things equipment is solved at the same time.

The invention discloses an encrypted network flow classification method based on large model hierarchical fine tuning, comprising the following steps: obtaining an input tensor used for representing encrypted network flow data to be classified; inputting the input tensor into a local time sequence aggregator, so that the local time sequence aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism; inputting the short-time high-frequency burst features and the input tensor into a hierarchical fine-tuning large model to enable the hierarchical fine-tuning large model to extract encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fusing the short-time high-frequency burst features and the encrypted traffic features to obtain advanced spatial-temporal features; and based on the short-time high-frequency burst feature and the advanced spatial-temporal feature, obtaining a classification result of the encrypted network traffic data to be classified. According to the method, the accuracy of classifying the encrypted network traffic data can be improved, and meanwhile, the training resource consumption is reduced.

Devices and methods for adaptively classifying network traffic associated with a new application are provided. A network device, for example, an edge device, stores a Machine Learning (ML) model pre-trained based on historical network traffic associated with a set of applications. The network device receives network traffic associated with a new application, for example, a zero-day application, that is different from the set of applications. The ML model learns one or more patterns associated with the received network traffic. The ML model detects whether the learned pattern(s) is similar to previously learned patterns of at least one application. The ML model classifies the received network traffic as legitimate traffic or anomalous traffic based on the detection. The ML model is scalable, providing timely classifications for different types of network traffic, while handling protocol and application diversity, variability in traffic patterns, and emergence of zero-day application traffic.

The invention discloses a network resource scheduling method and device, equipment, a storage medium and a product, and the method comprises the steps: obtaining the network slicing demand information of a target network, carrying out the slicing operation of the target network according to the network slicing demand information, and obtaining a plurality of different types of network slicing demands; classifying network traffic of the target network according to business service quality requirements, slice priorities and traffic characteristics to obtain a traffic classification result of the target network; and performing resource scheduling on the target network according to the flow classification result and the network slicing requirement. Performing priority division of the flow based on QoS parameters such as the bandwidth requirement, the time delay requirement and the priority of the flow; according to different flow characteristics and business demand optimization classification rules, a resource allocation strategy is adjusted in real time in a dynamically changing network environment, it is ensured that high-priority flow is processed in time, and network load fluctuation and business demand changes can be coped with in real time.

The invention relates to the technical field of network traffic classification, in particular to a network traffic data classification method, device and system for a data center, and the method specifically comprises the steps: constructing a feature data matrix based on all types of feature information of all traffic in a data set, obtaining principal components in the matrix through a principal component analysis algorithm, screening representative principal components based on the variance contribution rates of the principal components and the correlation between the variance contribution rates; calculating a dynamic flow interference degree index of the data set based on the Shannon entropy of the representative principal component and the density clustering characteristic; a dynamic threshold is set, a trigger condition of incremental learning is set in combination with a dynamic traffic interference degree index, and after the incremental learning is triggered, a bidirectional GRU network in an RNN model is dynamically adjusted through an elastic weight solidification method, so that traffic classification is carried out, historical knowledge is reserved, and meanwhile, the method adapts to a new traffic mode. The system is ensured to quickly respond to the traffic mode change, the performance degradation is avoided, and the accuracy of network traffic data classification is improved.

The invention relates to a multi-level management IPv6 flow multifunctional monitoring platform which comprises a data acquisition layer, a region monitoring layer, a core analysis layer, a control and arrangement layer and a feedback optimization layer. The data acquisition layer is located at the edge of a network and is responsible for acquiring real-time traffic data and completing preliminary traffic classification and anomaly detection; the area monitoring layer is distributed in each area, constructs an area flow characteristic database by aggregating edge data, and processes local flow abnormity and executes a response strategy at the same time; a core calculation unit of a centralized platform is arranged in the core analysis layer, a global AI model is optimized through federal learning, meanwhile, a double-flow neural network is introduced to fuse global features and personalized features, and cross-regional cooperative monitoring and global optimization are provided; the control and arrangement layer provides dynamic resource allocation and strategy adjustment, and coordinates the operation of global and regional nodes; and the feedback optimization layer continuously optimizes the traffic scheduling and protection strategy in combination with digital twinning and reinforcement learning.

The invention discloses a cloud side-end cooperative multi-scene adaptive network intrusion detection method, and solves the problems of poor scene adaptation, weak dynamic processing, privacy-precision imbalance and the like in the prior art. The method is realized through four steps: 1, multi-scene traffic collection and hierarchical preprocessing, terminal sensing layer optimization frame processing and traffic classification, edge layer screening of high-value traffic, and cloud fragmentation scheduling; 2, multi-scene adaptive feature fusion is carried out, scene exclusive features and general features are extracted, and 50-dimensional feature vectors are generated; 3, a cloud edge-end collaborative detection model and an edge lightweight model are preliminarily screened, a cloud federal fusion model is finely detected, and dynamic weight and differential privacy are combined; 4, dynamic attack response and model iteration are carried out, attacks are responded in a scene mode, and the stability of the model is guaranteed through anti-forgetting optimization. According to the method, multiple scenes are covered, the detection precision is larger than or equal to 98.5%, the edge delay is smaller than or equal to 40 ms, the privacy leakage risk is reduced by 90%, the renaturation is high, and the robustness is high.

The invention provides a network traffic classification method, device and equipment based on multi-feature fusion, and belongs to the field of artificial intelligence. The method comprises the following steps: preprocessing traffic data to obtain a traffic grey-scale map; screening a minority class traffic sample set from the traffic grey-scale map; simulating a minority class traffic sample set through a WGAN model, and constructing and generating a sample; supplementing the generated sample into the flow grey-scale map to form a balanced sample set; inputting the balanced sample set into a ViT hybrid model to extract features, and obtaining sequence features; fusing the sequence features based on a cross attention mechanism to obtain a target traffic diagram; and classifying the target flow diagram by utilizing a multi-layer perceptron module of the perceptual layer to obtain a classification result. According to the method, the global features and the local features of the network traffic data can be effectively combined for classification, meanwhile, the model architecture is lightened, the accuracy of the model is improved, and the situation that the number of partial traffic type samples is small can be effectively handled.

The invention discloses an intelligent and efficient network intrusion detection system, method and product based on federated learning and P4. The system comprises an abnormal traffic detection module and an abnormal traffic classification module. The abnormal traffic detection module is used for extracting data packet feature information in network traffic, calculating a traffic reconstruction loss value according to preset parameters, and comparing the reconstruction loss value with a benign threshold and an attack threshold to judge whether the traffic is abnormal traffic; if the traffic is normal traffic, forwarding the traffic, and if the traffic is abnormal traffic, submitting the traffic to an abnormal traffic classification module; and the abnormal flow classification module is used for calculating an energy value of each flow and comparing the energy value of each flow with an energy threshold value of a flow category so as to detect a network attack type. According to the method, the comprehensiveness and the accuracy of network attack detection are remarkably improved, and a new solution is provided for constructing an intelligent and efficient network protection system.

The invention relates to the technical field of traffic prediction, and discloses an IPv6 traffic prediction system based on machine learning, and the system comprises a traffic collection module which is used for capturing the original traffic data of an IPv6 network interface and carrying out the protocol analysis and traffic classification preprocessing, and obtaining the preprocessed IPv6 traffic data; the multi-dimensional feature extraction module is used for performing multi-modal feature extraction on the preprocessed IPv6 flow data to generate a fusion feature vector; the real-time prediction module is used for inputting the fusion feature vector into a dynamic prediction model to obtain an IPv6 traffic prediction value of a future preset duration; and the dynamic scheduling module is used for pushing the IPv6 traffic prediction value of the future preset duration to a traffic scheduling controller so as to realize dynamic scheduling of network resources. According to the method, the network traffic prediction accuracy and real-time performance are improved, the adaptive capacity to IPv6 traffic mode change is enhanced, and reasonable distribution and efficient utilization of network resources are effectively promoted.

The invention relates to a traffic classification method based on a parallel multi-channel fusion graph neural network. The method comprises the following steps: S1, modeling an encrypted network traffic classification problem; s2, preprocessing the original data stream file to obtain a head part and a load part of each data packet; s3, modeling the preprocessed data packet byte sequence into a graph to obtain a flow graph of a head part and a load part; s4, inputting the flow diagrams of the head part and the load part into a parallel dual-channel graph neural network module to obtain a packet-level head vector representation and a packet-level load vector representation; s5, splicing the head vector representation and the load vector representation to obtain a complete data packet vector representation, and sending the three vector representations into a parallel three-channel network to obtain a flow level vector representation; and S6, performing feature fusion on the three vector representations, and obtaining a flow classification result through a final classification layer. Compared with the prior art, the method has the advantages of higher precision and the like.

The embodiment of the invention provides an encrypted traffic classification model training method, an electronic device, a storage medium and a program product, through a self-supervised learning framework, an unmarked patch is utilized to embed and express a training encoder-decoder structure, so that the model can autonomously learn universal spatio-temporal features from an encrypted traffic grey-scale map. The mask reconstruction task promotes the model to understand the internal structure rule of the traffic data, the understanding depth of the model for the input data is enhanced, the adaptability of the model to the distributed data is improved, and the generalization ability, adaptability and robustness of the model are also improved.