单向加密流量的移动应用程序分类技术研究  

Research on Mobile Application Classification Technology for Unidirectional Encrypted Traffic

作　　者：张莉 谭静文 苘大鹏[1] 韩帅 马书磊 ZHANG Li;TAN Jingwen;MAN Dapeng;HAN Shuai;MA Shulei(College of Computer Science and Technology,Harbin Engineering University,Harbin 150001,China)

机构地区：[1]哈尔滨工程大学计算机科学与技术学院,哈尔滨150001

出　　处：《集成技术》2024年第5期40-52,共13页Journal of Integration Technology

基　　金：国家重点研发计划项目(2021YFB3101401)。

摘　　要：在加密移动应用程序流量分类领域,传统方法均基于双向流量的特征对流量进行分类,但在实际场景中,非对称路由会导致远程网络管理员仅能获得单向流量,使得传统方法分类准确率下降。因此设计了一种仅使用单向流量特征的加密移动应用程序流量分类方法。由于下行流量包含的信息多于上行流量,因此选择对下行流量的有效负载进行分析。同时,由于移动应用程序流量具有时间、空间相关性,因此提出利用双向长短期记忆网络捕获数据流的时序相关性,并利用卷积神经网络学习特征的空间相关性,通过引入注意力层关注重要特征,进一步提高分类准确率。该方法比之前方法的使用范围广,可用于单向流量和双向流量场景,并可通过更少的特征获取更高的准确率。In the field of encrypted mobile application traffic classification,traditional methods classify traffic based on the characteristics of bidirectional traffic.However,in actual scenarios,asymmetric routing will cause remote network administrators to only obtain unidirectional traffic,which will reduce the accuracy of traditional methods.Therefore,an encrypted mobile application traffic classification method using only one-way traffic characteristics is designed.Since downlink traffic contains more information than uplink traffic,the payload of downlink traffic is chosen for analysis.Due to the temporal and spatial correlation of mobile application traffic,a bidirectional long short-term memory network is proposed to capture the temporal correlation of data streams,a convolutional neural network is used to learn the spatial correlation of features,and an attention layer is introduced to focus on important features to further improve the recognition accuracy.Compared with the previous methods,this method has a wider range of use,can be applied to both unidirectional and bidirectional traffic scenarios,and uses fewer features to obtain higher accuracy.

关 键 词：加密流量 移动应用程序 单向流量 非对称路由 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]