基于多层双向SRU与注意力模型的加密流量分类方法  

Encrypted Traffic Classification Method Based on Multi-Layer Bidirectional SRU and Attention Model

作　　者：张稣荣 卜佑军 陈博 孙重鑫 王涵 胡先君 ZHANG Surong;BU Youjun;CHEN Bo;SUN Chongxin;WANG Han;HU Xianjun(Information Technology Institute,PLA Strategic Support Force Information Engineering University,Zhengzhou 450000,China;Endogenous Safety and Security Research Center,Purple Mountain Laboratory of Network Communication and Security,Nanjing 211100,China)

机构地区：[1]中国人民解放军战略支援部队信息工程大学信息技术研究所,郑州450000 [2]网络通信与安全紫金山实验室内生安全研究中心,南京211100

出　　处：《计算机工程》2022年第11期127-136,共10页Computer Engineering

基　　金：国家自然科学基金(62176264)。

摘　　要：基于传统循环神经网络的加密流量分类方法普遍存在并行性较差、模型运行效率较低等问题。为实现加密流量的快速准确分类,提出一种基于多层双向简单循环单元(SRU)与注意力(MLBSRU-A)模型的加密流量分类方法。将特征学习和分类统一到一个端到端模型中,利用SRU模型高度并行化的序列建模能力来提高整体运行效率。为了提升MLBSRU-A模型的分类精度,堆叠多层双向SRU网络使其自动地从原始流量中提取特征,并引入注意力机制为特征赋予不同的权重,从而提高重要特征之间的区分度。实验结果表明,在公开数据集ISCX VPN-nonVPN上,MLBSRU-A模型具有较高的分类精度和运行效率,与BGRUA模型相比,MLBSRU-A的细粒度分类准确率提高4.34%,训练时间减少55.38%,在USTC-TFC2016数据集上,MLBSRU-A模型对未知加密恶意流量的检测准确率达到99.50%,细粒度分类准确率为98.84%,其兼具对未知加密恶意流量的高精度检测能力以及对加密恶意流量的细粒度分类能力。The encrypted traffic classification method based on traditional Recurrent Neural Network(RNN)typically have poor parallelism and low efficiency.To quickly and accurately classify encrypted traffic,a classification method for encrypted traffic based on a Multi-Layer Bidirectional Simple Recurrent Unit and Attention(MLBSRU-A)model is proposed.Feature learning and classification are unified into an end-to-end model,and the highly parallel sequence modeling ability of the SRU model is used to improve the overall operation efficiency.To improve the classification accuracy of the MLBSRU-A model,multi-layer bidirectional SRU networks are stacked to automatically extract features from the original traffic,and an attention mechanism is introduced to provide different weights to features to improve discrimination between important features.Experiments show that the MLBSRUA model has a higher classification accuracy and running efficiency on the public dataset ISCX VPN-nonVPN.Compared with the BGRUA model,the fine-grained classification accuracy of MLBSRU-A improved by 4.34%,and the training time reduced by55.38%.On the USTC-TFC 2016 dataset,the detection accuracy of the MLBSRU-A model for unknown encrypted malicious traffic is 99.50%,and the fine-grained classification accuracy is 98.84%.The proposed model can detect unknown encrypted malicious traffic with high precision and perform fine-grained classification of encrypted malicious traffic.

关 键 词：加密流量分类 加密恶意流量检测 简单循环单元 注意力机制 循环神经网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]