Research On Network Encrypted Traffic Classification Based On Deep Learning

With the rapid popularization of ciphertext technology in Internet applications and the continuous enhancement of public information security awareness,encryption of network traffic has become a basic method of data transmission today.Although the use of encryption algorithms in network traffic protects the confidentiality and integrity of data,it also provides protection for the spread of various malicious traffic on the network.The accurate distinction of encrypted traffic can not only detect the dangers in the network environment in time,but also improve the effective management of network resources,meet people's needs for network intelligence,and help maintain cyberspace security and guarantee high-quality network services.In the face of the current strong increase in the number of encrypted traffic and the increasingly complex encryption algorithms,traditional classification methods are difficult to meet the analysis efficiency requirements in this network environment.Due to the strong learning and adaptability of Deep Learning(DL),it has great advantages in tasks such as target recognition and classification.In order to ensure the stability and reliability of the classification model for encrypted traffic classification performance,while avoiding the need for complex feature engineering,the analysis efficiency is improved.This work studies the identification and classification of encrypted traffic through deep learning methods,and proposes the following classification model:(1)Aiming at the problem of insufficient flow representation in the existing network encryption traffic classification methods,a convolutional recurrent neural network model(CRNN)combined with a multi-head attention mechanism is proposed.First,this study use the Efficient Net B4 model as a benchmark to improve the Convolutional Neural Networks(CNN)and make it a deep feature extraction module.Then,the bidirectional LSTM(Bi LSTM)is used to fully obtain the front and back dependencies of encrypted traffic data packets from the front and back directions,while avoiding the problem of gradient disappearance.In addition,a multi-head attention mechanism is added to improve the ability to distinguish key packet characteristics.Choose to use the international public data set as the experimental data,and the results show that this model is significantly better than other feature extractors.(2)In order to solve the problem of complex structure and large amount of computation in the application of the existing artificial neural network method in network encrypted traffic classification,a lightweight network model based on feature fusion,Inception-CNN,is proposed for end-to-end encrypted traffic.The classification,while significantly improving the accuracy of the classification results,the computational complexity of the network is greatly reduced.First,the method use the Inception module 1*1 convolution to perform dimensionality reduction,reducing the calculation parameters;this module use filters of different sizes to perform multi-level feature extraction on the encrypted traffic,and fuse the convolutional features,thereby in the original data more abundant features are extracted,through automatic learning,the functional relationship between model input and output is obtained;finally,the parameter-free feature of the pooling operation is used to prevent over-fitting.Experimental results show that the model has a classification accuracy rate of 97.3%,accuracy rate of 97.2%,recall rate of 97.7%,F1-score of 97.5%,and the recognition effect of different types of encrypted traffic is more balanced.(3)Based on the classification model proposed in this work,a network encryption traffic classification system is designed and implemented.Through the network service interface of encrypted traffic classification,the system realizes the functions of identifying encrypted traffic and attributing application traffic to corresponding categories.Finally,the classification results of various data and models are presented to users through visual charts.