基于半监督增量学习的网络通联应用加密流量分类方法  

Network Communication Application Encrypted Traffic Classification Method Based on Semi-Supervised Incremental Learning

作　　者：黄晓明 任远 叶翼 刘磊 王子豪 潘炜[3] HUANG Xiaoming;REN Yuan;YE Yi;LIU Lei;WANG Zihao;PAN Wei(Chengdu Rongwei Software Services Co.,Ltd.,Chengdu Sichuan 610041,China;School of Computer Science and Engineering(School of Cyber Security),University of Electronic Science and Technology of China,Chengdu Sichuan 611731,China;School of Computer Science,Northwestern Polytechnical University,Xi’an Shaanxi 710072,China)

机构地区：[1]成都融微软件服务有限公司,四川成都610041 [2]电子科技大学计算机科学与工程学院(网络空间安全学院),四川成都611731 [3]西北工业大学计算机学院,陕西西安710072

出　　处：《通信技术》2025年第3期319-330,共12页Communications Technology

基　　金：国家自然科学基金:网络空间内容治理关键技术及应用(2022ZHCG0133)。

摘　　要：针对加密流量深层内在特征发现难,精细化分析不足,依赖大量标签流量样本训练的问题,基于半监督学习方式建立了多尺度特征辨识模型,该模型是一种有效的加密流量分类方法。研究构建了基于多尺度负载特征的网络通联应用分类识别模型,设计了网络通联应用半监督增强学习机制,对流量全局特征与局部特征进行多层次关联融合学习与关键特征辨识。实验结果表明,相对于浅层学习网络模型及其他使用深度学习的加密流量分类算法,所提方法具有较高的准确性,同时受标签流量样本规模的影响较小,可以从少量标签流量样本中学习到可泛化性特征,且稳定性高,可以有效应用于现实网络空间信息安全治理。To address the challenges such as the difficulty of discovering deep intrinsic features in encrypted traffic,limitations in fine-grained analysis,and reliance on extensive labeled traffic samples for training,a multi-scale feature recognition model is established based on semi-supervised learning.The model is an effective method for encrypted traffic classification.This paper develops a network communication application classification and recognition model based on multi-scale load features,and designs a semisupervised reinforcement learning mechanism for network communication applications,which performs multi-level associative fusion learning and key feature identification on both global and local traffic features.Experimental results demonstrate that,compared to shallow learning network models and other encrypted traffic classification algorithms using deep learning,the proposed method achieves higher accuracy,and at the same time,it is less sensitive to the scale of labeled traffic samples,can learn generalizable features from a small number of labeled traffic samples,and has high stability,which can be effectively applied to the information security governance in real cyberspace.

关 键 词：网络通联应用 加密流量分类 半监督学习 特征融合 

分 类 号：TN918[电子电信—通信与信息系统] TP393[电子电信—信息与通信工程]