| As a method in the field of artificial intelligence,deep learning,because of its end-to-end network structure,can automatically carry out feature extraction steps,so as to avoid expert experience reference,artificial design feature steps,and make the training model have similar generalization ability.In recent years,it has been tried to be applied in the Research of encrypted traffic identification algorithm.Because the related work is still in the development stage in the industry,there are some problems;The deep learning algorithm has been widely used in the fields of picture recognition,speech recognition and natural language processing,and has achieved excellent results.Combined with the characteristics of network data traffic,this paper studies the traffic classification based on deep learning algorithm.The main research work and innovation are as follows:(1)there are few open and pure data sets related to encrypted traffic,and because the captured traffic itself does not have the original application label,it is unable to directly grab the traffic for experiment;(2)how to choose a reasonable way to convert encrypted traffic data into deep learning model input is not unified in the industry In addition,there are few researches on the byte length of intercepted traffic and the number of packets;(3)the development of deep learning has brought about a variety of models,how to select the appropriate network structure and model for encrypted traffic identification;(4)due to the natural imbalance of network traffic data,it is necessary to select the appropriate objective function and super parameter in the process of model convergence,training and so on.In this paper,the above problems in the field of encrypted traffic identification are studied in detail,and the overall process from the automatic collection and marking of pure data to the systematic in-depth learning of encrypted traffic identification modeling and the subsequent model optimization is established.The main research content and innovation work of this paper are as follows:As for the problem of less data sets of pure traffic,this paper designs a system N-CD to automatically collect pure traffic based on the script operation of ADB system.It realizes the function of Android system to automatically generate the encrypted traffic of the required application;according to the mapping relationship between the traffic generated by the local application and the port number of the process,it successfully obtains the traffic data with application background information,and enables N-CD to realize the collection and purification of the fixed port encrypted traffic data with zero error and zero leakage package.It provides convenience for the future research of encrypted traffic.In this paper,the convolutional neural network is studied deeply in the field of encrypted traffic recognition.In the machine learning recognition method based on the characteristics of encrypted traffic statistics,the features of artificial design not only require a high level of professional knowledge,but also filter some information features,so that the global optimal solution can be lost.So in recent years,researchers have learned neural network through end-to-end deep learning Network analysis of encrypted traffic.Because this kind of depth model structure can integrate the process of feature extraction,selection,combination and classification,so it does not filter the feature information of samples,so it is more likely to design a recognition model to achieve the global optimal solution.In this paper,a convolution network is designed,which accords with the characteristics of encrypted traffic data structure.The network layer structure of concept and capsnet is added,and the multi-dimensional feature extraction ability and strong feature location capture learning ability of the model are improved.Compared with the basic CNN model,the accuracy of encrypted traffic is improved by5%.At the same time,in order to improve the negative impact of the imbalance of network traffic samples,the gradient optimization method and the objective function of the model are experimented and designed many times.In terms of accuracy and recognition rate,the experimental results in this paper are comparable to the results in the field of encrypted traffic recognition in relevant literature,but the generalization ability and convenience of the model are better.Because the communication interaction process of encrypted traffic is highly similar to the conversation in the field of human natural language,this paper studies the encrypted traffic based on Elmo + LSTM + self attention.In order to make better use of the time series characteristic information of network traffic in the communication between data packets,this paper uses the time series neural network LSTM to identify the encrypted traffic,considering the diversity of encryption suites The network layer structure of Elmo and self attention is added to the relative position relationship between the time sequence features and data packets.The network model can fully learn the interaction protocol features and time sequence information features of traffic.The recognition results on the open data set exceed most of the machine learning methods that need manual design features.Its good experimental results prove that the time sequence neural network is able to The feasibility of encrypted traffic identification.On the basis of the good effect of convolution network and sequential network in the identification of encrypted traffic,this paper uses the combined neural network of convolution and sequential to study the identification of encrypted traffic.On the left side of the model,the content structure features of encrypted traffic are learned throughconvolution network,on the right side,the sequential communication features of encrypted traffic are learned through sequential network,and then the two special features are grouped Identify together.According to the experimental results,the influence of parameters such as the length of network flow interception,the number of packet interception,the form of traffic division on the recognition results is studied,and the optimal combination form is selected,and the recognition effect has a 3% quasi curvature improvement for simple convolution or timing,which exceeds all previous machine learning methods,and it is proved that the optimization of model structure can improve the recognition effect It standardizes the process of deep learning to identify encrypted traffic. |
