基于局部和全局流量交互的加密流量分类模型

Encrypted traffic classification using local and global traffic interaction models

  • 摘要: 加密流量的识别对网络安全和网络管理至关重要. 虽然现有的深度学习方法已能够识别流量所属的应用类型或特定应用,但现有的大多数模型往往针对特定任务设计,难以适应多样化的任务需求. 为此,本文提出了一种局部和全局交互模型(local and global traffic interaction models, LGTI). 首先,通过对数据包内不同字段进行独立嵌入处理,避免字节语义信息混淆. 然后,在模型结构中设计局部特征学习模块和全局特征学习模块,分别用于识别局部关键字节信息和建模全局字节顺序关系. 最后,引入局部与全局流量的交互注意力机制,促进特征的信息交互与融合,从而提升模型对复杂流量模式的表达能力. 实验结果表明,在包级和流级流量分类任务中,LGTI模型在泛化能力与分类准确性实现显著性能提升.

     

    Abstract: Encrypted traffic identification is crucial for network security and management. Although existing deep learning methods can recognize the application type or specific application of network traffic, most models are designed for specific tasks and lack adaptability to diverse scenarios. To address this limitation, this paper proposes a local and global traffic interaction model (LGTI). First, different fields within a data packet are independently embedded to avoid the confusion of byte-level semantic information. Then, a local feature learning module and a global feature learning module are designed in the model architecture to identify key local byte information and model the global byte-order relationships, respectively. Finally, an interaction attention mechanism between local and global traffic features is introduced to promote information interaction and fusion, thereby enhancing the model’s ability to represent complex traffic patterns. Experimental results show that, in both packet-level and flow-level traffic classification tasks, the LGTI model achieves significant improvements in generalization ability and classification accuracy.

     

/

返回文章
返回