528 results about "Traffic classification" patented technology

A network traffic classification process, including the steps of: monitoring network traffic flows to dynamically generate, for each of the network traffic flows and in real-time, time series data sets representing, for each of upstream and downstream directions of the network traffic flow, for each of a plurality of successive timeslots, and for each of a plurality of packet length bins, a packet count and a byte count of packets received within the timeslot and having one or more lengths within the corresponding packet length bin; and processing the time series data sets of each network traffic flow to classify the network flow into one of a plurality of predetermined network traffic classes, without using payload content of the network traffic flow.

The invention discloses a load balancing control method based on data traffic, and relates to the technical field of data transmission. Comprising the following steps: constructing a flow monitoring module based on data flow, constructing a self-adaptive flow classification model, dynamically allocating weights to load nodes with balanced loads, dynamically adjusting a transmission path of the flow, carrying out real-time load balancing scheduling, and processing abnormal flow. According to the load balancing control method based on the data traffic, the self-adaptive traffic classification model and the multi-path traffic reconstruction algorithm are introduced, so that the defects in the prior art are fundamentally overcome. The real-time performance, the stability and the resource utilization rate of the system are remarkably improved through deep classification of the traffic characteristics and a multi-path dynamic segmentation strategy. According to the method, resource allocation can be optimized in a complex traffic scene, the load balancing efficiency is improved, meanwhile, the service quality of delay-sensitive and bandwidth-intensive services is guaranteed, and the availability and reliability of the whole system are enhanced.

The invention discloses a malicious traffic classification and identification method, system and device based on a graph convolutional neural network, and a medium. The method comprises the steps of obtaining a data packet, cleaning data, extracting statistical traffic features of the data, and forming a stream sequence; performing detection and pre-classification on the flow sequence; converting the detected and pre-classified flow sequence into a flow grayscale image; inputting the detected and pre-classified traffic grayscale image into an image convolutional neural network for training, and constructing a malicious traffic classification and recognition model for deep classification and recognition; and adopting the trained malicious traffic classification and identification model to carry out deep classification and identification on the network traffic. According to the method and the device, the malicious traffic conforming to the characteristics can be more accurately screened out from a large number of traffic packets mixed with the malicious traffic.

The present disclosure relates to: a communication technique for a 5G communication system for supporting a higher data transmission rate higher a 4G system; and a system therefor. According to an embodiment of the present disclosure, a method for a first network node in a wireless communication system may be disclosed, the method comprising the steps of: receiving, from a second network node, a policy and charging control (PCC) rule and fully qualified domain name (FQDN)-based information that indicate any one of traffic detections via DNS message reporting or a DNS resolution; generating a DNS message processing rule on the basis of the FQDN-based information; transmitting the DNS message processing rule to a third network node; and receiving, from the third network node, an FQDN and an IP address for the FQDN, wherein the FQDN and the IP address are identified by the third network node via detection of a DNS response message on the basis of the DNS message processing rule.

The invention discloses an encrypted network traffic classification method and system based on spatio-temporal information fusion, and mainly relates to the technical field of information security. Comprising the steps of obtaining data from an original Pcap file and performing data preprocessing; respectively converting the processed flow into a session flow multi-level representation sequence and a session-level flow graph; carrying out feature vector integration on the flow sequence through a session flow multi-stage representation sequence; the method comprises the following steps of: embedding a session-level flow graph to obtain a spatial feature vector representation of a network flow file; and aggregating the time feature vector and the space feature vector by using a cross gating feature fusion method to obtain the overall representation of the traffic features, and carrying out encrypted traffic classification by using a trained model. The method has the beneficial effects that the feature representation capability of the model is effectively enhanced while the classification effect of the encrypted traffic is improved.

A QUIC encrypted traffic classification method based on multi-model fusion belongs to the field of communication, and comprises the following steps: a model training stage: dividing a data set, training each model in a high-precision model group and a high-recall-rate model group by using a training set, evaluating model performance by using a verification set, if a dynamic weight mechanism is started, calculating the weight of the model according to a model evaluation result, and if the dynamic weight mechanism is started, calculating the weight of the model; carrying out normalization processing on the weight, and searching an optimal decision threshold by using a plurality of candidate thresholds; in the model prediction stage, prediction data are input, each model generates a respective prediction probability, and if a dynamic weight mechanism is started, the prediction probability of each model is subjected to weighted averaging according to the weight obtained in the training stage so as to perform probability calibration; and combining the calibration probability of each model, judging the calibration probability through an optimal decision threshold, and generating a final classification prediction result. According to the method, the risks of overfitting and poor generalization ability of a single model are reduced, and QUIC encrypted traffic classification with high accuracy and stability is realized.

The invention discloses an encrypted network traffic classification method based on a structured state space dual model in the technical field of network information security, and aims to solve the optimization problem of encrypted network traffic classification. The method comprises the following steps: acquiring a pcap data packet in encrypted network traffic; extracting hierarchical flow information in the flow packet and generating a stride sequence; inputting the stride sequence into a pre-trained encrypted network traffic classification model, and outputting a classification result; the training of the encrypted network traffic classification model comprises the following steps: carrying out self-supervised pre-training on unmarked data by using a mask auto-encoder, and learning universal representation of traffic data; and replacing a model decoder with a multi-layer perceptron head, and performing fine tuning optimization by using mark data. According to the method, the reasoning speed is improved while low GPU memory use is kept, and encrypted traffic classification can be more efficiently and effectively achieved.

The invention provides an encrypted traffic classification method based on a multi-view heterogeneous graph model (MH-Net). The accuracy and robustness of network traffic classification can be effectively improved. In the method, the multi-view flow graph is constructed, and the diversity of information granularity is enriched by aggregating different numbers of flow bits into various types of flow units. And head-head, head-load and load-load flow unit correlation is further introduced to form a heterogeneous flow graph, and feature extraction is performed by using a heterogeneous graph neural network. Besides, through a multi-task contrast learning strategy, the robustness of traffic unit representation is enhanced, synchronous training is realized in traffic level and data packet level classification tasks, and the overall performance is optimized. Experimental results show that the method has excellent performance on a plurality of data sets, exceeds the prior art and shows the application potential in the field of network traffic classification.

The invention relates to an encrypted traffic classification method based on a two-stage adaptive architecture, and belongs to the technical field of computer network security. The method comprises the following steps: firstly, distinguishing data in-distribution (ID) and out-of-distribution (OOD) traffic through a mixed OOD detection mechanism, and processing a detection result by adopting a self-adaptive classification strategy: for the ID traffic, accurately classifying known categories by adopting a transformer-based encoder; for OOD traffic, a classification task is converted into a generation task by combining a large language model (LLM) and a newly proposed semantic enhancement prompt strategy (SPS), so that flexible fine-grained recognition of unknown traffic types is realized. The SPS strategy comprises three levels of a strict mode, a complete mode and an expansion mode, and a flexible generation space is provided while the classification precision is ensured. Through the innovative two-stage design, the problem that the emerging network application cannot be accurately identified by the existing method is effectively solved while the high-precision classification of the ID traffic is maintained.

According to the hierarchical distribution model warehouse synchronization system and method provided by the invention, rapid synchronization of key and frequently accessed data is ensured through design of multiple synchronization strategies and implementation of dynamic scheduling; the data transmission quantity is reduced through a service grading strategy and an on-demand synchronization strategy, and the occupation of network bandwidth and the demand of storage resources are reduced; by adjusting a distribution path and load balancing in real time, it is ensured that a synchronization task is efficiently carried out, and single-point synchronization overload is avoided; and an adaptive fault-tolerant mechanism can automatically identify and process abnormal conditions in the synchronization process, so that the reliability of data synchronization is improved. In addition, the invention provides an end-to-end data encryption and integrity verification mechanism to protect the security of the data in the transmission process; a role-based access control mechanism ensures that only authorized users and a system can access and synchronize data, so that the security management of the data is enhanced. The method has good expandability, and can flexibly adapt to synchronization requirements of different scales and support a new synchronization strategy in the future.

The invention relates to an encrypted traffic classification method and device, computer equipment and a medium, and the method comprises the steps: carrying out the preprocessing of original traffic, and obtaining a session image of a data packet header and a session image of a payload; extracting global features and spatial-temporal features of the header and the load according to the session image of the packet header of the data packet and the session image of the effective load; fusing the global features and the spatial-temporal features of the head and the load through adaptive weighting to obtain initially fused head features and load features; fusing the head feature and the load feature which are initially fused together through adaptive weighting to obtain a final feature vector; and classifying the original traffic according to the final feature vector. In the whole process, the situation that the same byte value has different meanings in the head and the effective load in practical application is fully considered, and accurate encrypted traffic classification can be realized.

The invention discloses a multi-modal network traffic classification method based on deep learning. The method comprises the following steps: data preprocessing; establishing a traffic classification network; training a traffic classification network; a traffic classification network is tested. According to the method, the traffic features are extracted from different angles by inputting the two modalities of the original bytes and the length sequences, so that the performance of the classifier is improved, and the problem that single-modal feature extraction is insufficient is solved. According to the method, the features of the original bytes of the traffic are extracted by using the Transform of the improved attention mechanism, meanwhile, the features of the data packet length sequence are extracted by using the bidirectional LSTM, and then the two extracted features are fused to generate a new more comprehensive feature representation, so that the accuracy of network traffic classification is improved. According to the method, on the design of the loss function, the final classification result is measured, and the classification performance of the learning features of each part is considered, so that the optimal classification performance of each part is obtained, and the overall classification accuracy is finally improved.

The invention is suitable for the technical field of network security, and provides an abnormal traffic identification method, device and equipment, a medium and a computer program, and the method comprises the steps: obtaining a comprehensive traffic feature of a to-be-detected traffic; the total data amount of the to-be-detected traffic is obtained through a pre-trained algorithm distribution model, a recognition algorithm corresponding to the to-be-detected traffic is output based on the total data amount, the recognition algorithm is a first clustering algorithm or a second clustering algorithm, and the total data amount of the traffic suitable for the first clustering algorithm is larger than the total data amount of the traffic suitable for the second clustering algorithm; classifying the traffic to be detected according to the comprehensive traffic features, the recognition algorithm and a plurality of abnormal centers corresponding to the recognition algorithm; and under the condition that the to-be-detected traffic belongs to any abnormal center, determining that the to-be-detected traffic is abnormal traffic. According to the invention, anomaly identification during traffic classification for different conditions is realized, and the accuracy, efficiency and automation degree of abnormal traffic identification can be improved.

The invention relates to the technical field of traffic transmission, and provides a server traffic real-time monitoring method, device and system, and the method comprises the steps: obtaining normal traffic data segments and abnormal traffic data segments of a plurality of main features; obtaining an analysis interval and a contrast analysis interval according to the state value of the normal flow data segment; obtaining an overall correlation index according to the analysis interval and a contrast analysis interval thereof; obtaining an abnormal degree according to the state values of the abnormal traffic data segment and the normal traffic data segment; obtaining an anomaly expression index according to the anomaly degree; obtaining an abnormal performance degree according to the abnormal performance index; obtaining the retention degree of the main features according to the abnormal performance degree; obtaining retention characteristics according to the retention degree; performing model training according to the reserved features to obtain a traffic classification model; and monitoring the traffic of the server in real time by using the traffic classification model. According to the method, the retention features are obtained through retention degree screening, and the traffic classification model is trained, so that the accuracy of traffic monitoring is improved.

A system, method, and device for detecting Command and Control (C2) traffic is disclosed. The method includes (i) converting a monitored traffic sample to an image representation, (ii) querying a classifier based at least in part on the image representation to obtain a traffic classification, (iii) automatically detecting C2 traffic based at least in part on the traffic classification, and (iv) handling the network traffic based at least in part on the traffic classification.

The invention discloses an encrypted traffic classification method based on Transform, and belongs to the technical field of network security and encrypted traffic analysis. In order to solve the problems that load content in a novel encryption protocol (such as TLS 1.3 and VPN) is encrypted, structural disturbance is complex, category distribution is unbalanced and the like, the invention provides a dual-phase Transform framework (DPFT) with pre-training and structure optimization fine tuning. According to the framework, two self-supervision tasks of masked burst prediction (MBP) and burst structure discrimination (BSDT) are introduced in a pre-training stage, and deep data packet representation is learned from unlabeled traffic, so that the deep data packet representation is learned from the unlabeled traffic; in the fine tuning stage, dynamic weighting of word embedding and position embedding, multi-head attention pooling and Focus Loss are adopted, so that the modeling capability of the model on an encrypted traffic complex structure is enhanced, and the recognition sensitivity on minority class samples is improved. Experimental results show that the method disclosed by the invention is obviously superior to the existing method on various encrypted traffic data sets (including TLS 1.3, VPN, malicious traffic and the like), and achieves leading performance on classification accuracy and macro average F1 index.

The invention provides a ship network hierarchical intrusion detection method and system, and the method comprises the steps: obtaining multi-dimensional flow data from a plurality of hierarchies of a ship network, carrying out the preprocessing of the data, carrying out the feature extraction of the preprocessed flow data through a deep neural network model, obtaining the feature vector of the multi-dimensional flow data, and carrying out the detection of the multi-dimensional flow data. Then, establishing an anomaly detection model based on a random forest algorithm, inputting the feature vector into the anomaly detection model to obtain an anomaly score of the traffic data, and comparing the anomaly score with a preset score threshold to judge a confidence traffic and a question traffic; and finally, establishing an abnormal traffic classification model based on the bidirectional gating recurrent neural network and the convolutional neural network, inputting the doubt traffic into the abnormal traffic classification model to respectively obtain probabilities of the doubt traffic belonging to different known attack types, and respectively comparing the probabilities with a preset threshold. And then judging the attack type and whether the attack is a zero-day attack, and executing a corresponding defense strategy to complete hierarchical intrusion detection of the ship network.

The invention relates to an encrypted network traffic classification method based on a pre-trained large language model, and belongs to the technical field of encrypted network traffic classification. The method mainly comprises three stages: a pre-training stage: converting original encrypted network traffic data into a double-byte hexadecimal format through preprocessing, generating and optimizing a basic vocabulary by using a byte pair coding algorithm, then constructing a large language model, and obtaining a pre-training model through distributed training; in the retraining stage, the data is subjected to head byte shuffling processing, and the pre-training model is quickly retrained to improve the generalization ability. In the fine tuning stage, to-be-classified data is preprocessed to generate hexadecimal double-byte data with labels, and classification task training is performed by using the retrained model to obtain an encrypted network traffic classification fine tuning model and classification accuracy. Through the combination of pre-training and retraining and the fine tuning of the pre-training model by means of data classification, the efficient processing and accurate classification of the complex encrypted network traffic are realized.

The invention relates to the technical field of flow forwarding, in particular to a controllable flow forwarding method. The method comprises the following steps: S1, demand analysis, S2, traffic model construction, S3, equipment initial configuration, S4, traffic monitoring and evaluation, S5, traffic classification and priority setting, S6, bandwidth limitation and rate control, S7, load balancing, S8, resource reservation, S9, security encryption and verification of a data packet, S10, traffic caching and data loss prevention, and S11, dynamic adjustment of a forwarding strategy. According to the method, accurate control and management of network traffic are realized through traffic model construction, traffic monitoring and evaluation, traffic classification and priority setting, bandwidth limitation and rate control, load balancing and resource reservation, the security of data in a forwarding process is improved through security encryption and verification of a data packet, log recording and performance monitoring, and the data forwarding efficiency is improved. And data loss is avoided through flow caching, data loss prevention and dynamic adjustment of a forwarding strategy.

The invention relates to the technical field of computers, in particular to a general traffic image generation method for solving unbalanced network traffic classification, which comprises the following steps of: arranging and combining original network traffic into a session stream according to a time sequence based on a session stream mode, and converting the session stream into an image by taking a data packet as a unit. Converting the effective load of each data packet into a grayscale image; the SCGAN is used for training; eliminating noise by adopting a convolution noise reduction auto-encoder, and performing high-definition reconstruction on the generated flow sample; and combining a minority of types of traffic image samples generated through high-definition reconstruction with the original real traffic samples. According to the method, when the data packets are converted into the traffic images, the time sequence dependency relationship of the network traffic is reserved, the structural features among the data packets in image representation are also reserved, a balanced new network traffic data set is constructed, the authenticity and diversity of the data set are kept, and the generalization ability and effect of the model are improved.

The invention relates to an encrypted traffic classification method fusing space, time sequence and frequency spectrum features, and belongs to the field of encrypted traffic classification and deep learning. The method comprises the following steps: analyzing a network original flow Pcap packet, segmenting the packet into different sessions according to a quintuple, and preprocessing each session: extracting first n data packets, and then extracting first m bytes and t time sequence data from each packet; utilizing byte data of the session to train a spatial feature module, and extracting spatial features of the session; training a time sequence feature module by using the time sequence data of the session, and extracting time sequence features of the session; the byte data of the session are converted into frequency spectrum information through fast Fourier transform, a frequency spectrum feature module is trained, and frequency spectrum features of the session are extracted; and fusing the extracted global spatial features, time sequence features and frequency spectrum features, and training by using multi-modal joint feature representation to realize fine classification of encrypted traffic. According to the invention, the precision and robustness of traffic classification can be improved.

The invention designs a cross-Tor version domain small sample website fingerprint identification method based on comparative learning. The method comprises three parts of a pre-training strategy based on comparative learning, a fine tuning strategy based on double-branch confidence alignment and a flow classification strategy driven by a prototype. The method comprises the following steps: firstly, constructing a discriminative representation space through a trunk convolution feature extractor and a traffic attention module based on a pre-training strategy of comparative learning, and introducing supervised comparative learning to obtain feature representation with a cross-domain migration capability; secondly, a double-branch confidence alignment fine tuning strategy is adopted, the stability of a model structure is kept in combination with a partial freezing mechanism, and rapid adaptation to a target domain is achieved through joint optimization of cross entropy loss and weighted comparison loss; and finally, introducing a prototype-driven classification strategy, and on the basis of a semantic structure formed in a fine tuning stage, realizing accurate identification of Tor traffic in closed world and open world scenes by using a category prototype, so that the cross-domain generalization ability of small sample website fingerprint identification is remarkably improved.

The invention relates to the technical field of traffic classification, in particular to an encrypted traffic content identification method and system based on multi-dimensional features, and the method comprises the steps: collecting encrypted traffic data of a plurality of preset data sources every preset sampling period, so as to obtain target encrypted traffic data, performing data preprocessing operation on the target encrypted traffic data to obtain standard target encrypted traffic data; and performing feature extraction on the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and encoding the statistical features and the static features to obtain a statistical feature vector and a static feature vector. According to the method, various statistical characteristics, such as packet arrival time, packet quantity, packet length, packet direction and combination characteristics of packet length and transmission direction, are extracted, the statistical characteristics can effectively reflect the time dependence and behavior pattern of the data stream, and rich information is provided for subsequent analysis and processing.

The invention discloses an intelligent detection method and system for security vulnerabilities of a terminal layer of an electric power internet of things, and relates to the technical field of security protection of the electric power internet of things, and the method comprises the steps: collecting multi-dimensional information and network traffic characteristics of terminal equipment of the electric power internet of things, constructing an equipment fingerprint database, carrying out the comparison verification of the equipment, and obtaining a security vulnerability of the terminal layer of the electric power internet of things according to a verification result; the method comprises the following steps: classifying network traffic, identifying an abnormal traffic sequence, extracting behavior parameters of network traffic abnormity and network access abnormity, carrying out association analysis on the abnormal parameters, labeling equipment, and generating a security vulnerability detection report. The technical problem that potential security vulnerabilities are difficult to find and repair in time due to the fact that complex abnormal behaviors in a device layer and network traffic cannot be effectively recognized and handled in the prior art is solved, real-time and accurate security vulnerability detection is achieved by constructing a device fingerprint database and carrying out traffic classification and abnormal behavior analysis, and the security vulnerability detection efficiency is improved. Therefore, the technical effect of improving the security of the terminal layer of the power Internet of Things is achieved.

The invention provides a lightweight Internet of Things traffic classification method based on improved MobileNetV2. A lightweight model based on MobileNetV2 is constructed and comprises an input layer, a network introducing an attention mechanism, a classification network and an output layer which are connected in sequence; the input layer performs flow splitting and anonymization processing on input network flow data and constructs a multi-dimensional feature representation matrix comprising a byte level, a data packet level and a data flow level; according to the introduction of the attention mechanism network, an attention mechanism module is added behind a plurality of bottleneck layers so as to combine current layer features with shallow high-resolution features; performing iterative training on the lightweight model by taking the training set as training data and adopting a combined strategy based on cosine annealing and hot restart to obtain a trained model; model parameters are optimized through quantitative compression and structure pruning, the test set serves as test data, the optimized model is evaluated, and a classification result is output. According to the invention, efficient and accurate traffic classification is realized, and the problem of resource limitation of the Internet of Things equipment is solved at the same time.

The invention discloses an encrypted network flow classification method based on large model hierarchical fine tuning, comprising the following steps: obtaining an input tensor used for representing encrypted network flow data to be classified; inputting the input tensor into a local time sequence aggregator, so that the local time sequence aggregator extracts short-time high-frequency burst features in the input tensor through a deep convolution mechanism; inputting the short-time high-frequency burst features and the input tensor into a hierarchical fine-tuning large model to enable the hierarchical fine-tuning large model to extract encrypted traffic features in the input tensor based on a hierarchical parameter fine-tuning mechanism, and fusing the short-time high-frequency burst features and the encrypted traffic features to obtain advanced spatial-temporal features; and based on the short-time high-frequency burst feature and the advanced spatial-temporal feature, obtaining a classification result of the encrypted network traffic data to be classified. According to the method, the accuracy of classifying the encrypted network traffic data can be improved, and meanwhile, the training resource consumption is reduced.

Devices and methods for adaptively classifying network traffic associated with a new application are provided. A network device, for example, an edge device, stores a Machine Learning (ML) model pre-trained based on historical network traffic associated with a set of applications. The network device receives network traffic associated with a new application, for example, a zero-day application, that is different from the set of applications. The ML model learns one or more patterns associated with the received network traffic. The ML model detects whether the learned pattern(s) is similar to previously learned patterns of at least one application. The ML model classifies the received network traffic as legitimate traffic or anomalous traffic based on the detection. The ML model is scalable, providing timely classifications for different types of network traffic, while handling protocol and application diversity, variability in traffic patterns, and emergence of zero-day application traffic.

The invention discloses a network resource scheduling method and device, equipment, a storage medium and a product, and the method comprises the steps: obtaining the network slicing demand information of a target network, carrying out the slicing operation of the target network according to the network slicing demand information, and obtaining a plurality of different types of network slicing demands; classifying network traffic of the target network according to business service quality requirements, slice priorities and traffic characteristics to obtain a traffic classification result of the target network; and performing resource scheduling on the target network according to the flow classification result and the network slicing requirement. Performing priority division of the flow based on QoS parameters such as the bandwidth requirement, the time delay requirement and the priority of the flow; according to different flow characteristics and business demand optimization classification rules, a resource allocation strategy is adjusted in real time in a dynamically changing network environment, it is ensured that high-priority flow is processed in time, and network load fluctuation and business demand changes can be coped with in real time.

A system and method for classifying network traffic including: providing a framework of models configured to classify network traffic; determining, via a packet processing engine, whether the network traffic flow is encrypted; if the network traffic flow is encrypted: extracting, via the packet processing engine, encrypted flow attributes associated with a network traffic flow; deriving further flow attributes based on the extracted encrypted flow attributes; determining at least one model of the framework of models based on the derived flow attributes and extracted encrypted flow attributes; and classifying, via a traffic classification engine, the traffic flow as a category of traffic based on the at least one model; and if the network traffic flow is not encrypted: extracting non-encrypted flow attributes associated with a network traffic flow; classifying the traffic flow as a category of traffic based on the non-encrypted flow attributes.

The invention relates to the technical field of network traffic classification, in particular to a network traffic data classification method, device and system for a data center, and the method specifically comprises the steps: constructing a feature data matrix based on all types of feature information of all traffic in a data set, obtaining principal components in the matrix through a principal component analysis algorithm, screening representative principal components based on the variance contribution rates of the principal components and the correlation between the variance contribution rates; calculating a dynamic flow interference degree index of the data set based on the Shannon entropy of the representative principal component and the density clustering characteristic; a dynamic threshold is set, a trigger condition of incremental learning is set in combination with a dynamic traffic interference degree index, and after the incremental learning is triggered, a bidirectional GRU network in an RNN model is dynamically adjusted through an elastic weight solidification method, so that traffic classification is carried out, historical knowledge is reserved, and meanwhile, the method adapts to a new traffic mode. The system is ensured to quickly respond to the traffic mode change, the performance degradation is avoided, and the accuracy of network traffic data classification is improved.