双分支多阶段时空特征融合的加密流量分类方法  

Encrypted Traffic Identification Based on Two-branch Multi-stage Spatiotemporal Feature Fusion

作　　者：陶洋[1] 杜黎明 申婷婷 TAO Yang;DU Liming;SHEN Tingting(School of Communication and Information Engineering,Chongqing University of Posts and Telecommunications,Chongqing 400065,China)

机构地区：[1]重庆邮电大学通信与信息工程学院,重庆400065

出　　处：《小型微型计算机系统》2024年第6期1489-1495,共7页Journal of Chinese Computer Systems

基　　金：国家重点研发计划项目(2019YFB2102001)资助。

摘　　要：针对当前加密流量识别分类研究对时空特征提取不充分以及网络架构引起特征信息损失的情况,该文提出了一种基于双分支多阶段时空特征融合(DBMS-SFF)的加密流量识别分类方法.本方法聚焦于加密流量的“字节-数据包-会话流”层次结构特点,设计两个并行的网络分支进行特征提取,分支一采用门控循环神经网络(GRU)及其变种BiGRU分别提取数据包内部相邻字节、相邻数据包之间的时序特征,并在此基础上利用多头注意力机制赋予关键特征更大的权重.分支二使用异于常规感受野的方式,利用不规则大小卷积核组成的多尺度卷积神经网络(CNN)作用于流的“字节-数据包”两个阶段对空间信息进行表征.在公开数据集上ISCXVPN-nonVPN2016实验表明,本方法的模型总体准确率为97.6%,平均F1得分值97.5%,均显著高于对比的模型.Aiming at the current research on encrypted traffic identification classification,insufficient spatiotemporal feature extraction and feature information loss caused by network architecture,a cryptographic traffic identification classification method based on two-branch multi-stage spatiotemporal feature fusion(DBMS-SFF)is proposed.This method focuses on the hierarchical characteristics of“byte-packet-session flow”of encrypted traffic,and designs two parallel network branches for feature extraction,and branch one uses a gated recurrent neural network(GRU)and its variant BiGRU to extract the adjacent bytes inside the packet and the timing features between adjacent packets,and on this basis,the multi-head attention mechanism is used to give greater weight to the key features.Branch 2 uses a different method from conventional receptive fields,using a multiscale convolutional neural network(CNN)composed of irregularly sized convolutional kernels to characterize the spatial information of the stream in the two stages of“byte-packet”.The ISCXVPN-nonVPN2016 experiment on the public dataset shows that the overall accuracy of the model is 97.6%,and the average F1 score value is 97.5%,which are significantly higher than the comparison model.

关 键 词：深度学习 加密流量 门控循环神经网络 分类识别 注意力机制 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]