| With the rapid development and popularization of the Internet,it has promoted the digital transformation of various industries and the vigorous development of Internet applications,and the network traffic has exploded.For the privacy and security of network information during transmission,more and more network Services and applications use encryption technology to encrypt data.While encrypted traffic protects personal privacy and network security,it also makes it difficult for traditional traffic identification and classification methods based on plaintext traffic to correctly identify and classify traffic.Traffic identification and classification can improve network management and Maintaining network security is of great significance.Therefore,how to correctly identify and classify encrypted traffic is an urgent problem to be solved.Aiming to achieve an efficient and reliable method for identifying and classifying encrypted traffic,and by comparing other existing methods,a method for identifying and classifying encrypted traffic based on spatiotemporal characteristics and self-attention mechanism is designed.This method first extracts the temporal and spatial features of encrypted traffic and focuses on the more important temporal and spatial features through self-attention mechanism.Then,the extracted temporal and spatial features are fused as an important basis for identifying and classifying encrypted traffic.Experimental results show that on a publicly available encrypted traffic dataset,when this method identifies and classifies 12 types of encrypted traffic,the accuracy,precision,recall,and F1 value are all above 97.5%.Aiming at the problem that most current methods for identifying and classifying encrypted traffic being vulnerable to adversarial attacks and having low robustness,a method based on multi-model fusion is designed.This method uses the idea of ensemble learning to combine multiple single classification models into a more powerful ensemble classification model.The single classification models in the ensemble classification model can be dynamically updated and optimized through negative feedback controllers,and different single classification models have different feature extraction methods,model structures,and hyperparameters,which greatly increases the difficulty of attacks by attackers and improves the ability of this classification method to resist adversarial samples.Experimental results show that on a publicly available encrypted traffic dataset,compared with the environment without adversarial samples,in an environment with adversarial samples,when this method identifies and classifies encrypted traffic in different experimental scenarios,the highest decrease in accuracy and F1 value is only 4.2%.Combining the above two methods for identifying and classifying encrypted traffic,a system for identifying and classifying encrypted traffic is designed.The system adopts modular design,has good maintainability and extensibility,and implements the functions of traffic collection,traffic preprocessing,traffic identification and classification,classification result storage,and display,achieving the identification and classification of encrypted traffic. |
