Encrypted Traffic Identification And Classification Research Based On Deep Learning

It is a trend that network traffic is encrypted and then transmitted.Although traffic encryption technology can protect personal privacy,it also brings great challenges to the regulation and security of cyberspace,so it is important to identify encrypted traffic effectively.Although many results have been achieved,there are also many problems,such as complex structure of recognition models,susceptibility to data imbalance,and single feature extraction,etc.This thesis will address these problems by conducting research on deep learning-based recognition and classification of encrypted traffic.(1)To address the problems that most of the encrypted traffic recognition models based on deep learning are serial in structure,complex in model structure,and prone to gradient disappearance and network degradation.An encrypted traffic recognition method based on improved Inception-Res Net is proposed.The Inception module is improved first,and then the improved Inception module is embedded into the convolutional neural network as the residual block of the residual network to build the recognition model.The experimental results show that compared with the two-dimensional convolutional neural network,the model in this chapter improves 10.75%,10.01%,and 6.77% in precision,recall,and F1,respectively.Compared with the two comparative models,the single-round training time is reduced by 2.3seconds and 4.4 seconds,respectively,which is a significant improvement.(2)To address the problems that the deep learning-based recognition model does not distinguish traffic key features well and the imbalance of encrypted traffic categories affects the classification accuracy of the model.An encrypted traffic recognition method based on a multi-headed attention mechanism is proposed.The method enhances the differentiation of key features by introducing a multi-headed attention mechanism in a one-dimensional convolutional neural network to capture the dependencies among the internal features of traffic from multiple dimensions.In addition,the loss function of the recognition model is improved to address the class imbalance of the dataset.The experimental results show that compared with using single-headed attention,the model in this chapter improves 1.27%,1.29%,and 1.3% in precision,recall,and F1,respectively.The recognition accuracy in some application traffic is improved by at least 7% and 3% compared to the comparison method.(3)Encrypted malicious traffic is highly concealed,and it is difficult to identify encrypted malicious traffic with high accuracy using only spatial features.To address this,an encrypted malicious traffic identification method that incorporates spatio-temporal hierarchical features is proposed.The spatial and temporal features of the encrypted malicious traffic are fused with the hierarchical structure information of the traffic data to achieve effective identification of the encrypted malicious traffic.The experimental results show that the proposed method achieves 99.77%,99.75% and 99.76% in the precision,recall and F1 metrics,respectively.Although each metric is slightly lower than the current state-of-the-art recognition models in overall,the recognition metrics on individual specific applications are at least 2.1% higher,which proves that the model in this chapter has stronger stability.