Research On Encrypted Traffic Classification Problem Based On Few-shot Learning

With the development of the Internet,the traffic generated in the network has exploded.At the same time,with the continuous development of encryption technology and the continuous specification of protocol standards,the proportion of encrypted traffic in the network is increasing.Although network traffic encryption technology can be used for privacy protection and information security transmission,it also provides opportunities for malware and malicious network services.More and more malicious attacks bypass firewalls and intrusion detection systems through encryption or tunneling techniques.Although traffic classification based on machine learning algorithms is a mainstream solution,it often requires a lot of manual work and rich expert knowledge to extract relevant features.Although the deep learning algorithm model can automatically extract features and classify,when a new traffic type appears,the model needs to be retrained to classify the new category,and each type of traffic category also requires a large number of labeled samples during model training,which cannot be accurately classified for categories with a small number of labeled samples.Therefore,this thesis studies the encrypted traffic classification problem based on small sample learning.The main work is as follows:1.A few-shot network traffic multi-classification model for common traffic is proposed.Aiming at the problem that the traditional deep learning algorithm has poor performance in the face of small sample traffic,the existing intrusion detection model is improved,and the FCAR-Net model is proposed.The model is designed as an end-to-end structure,which consists of three modules:feature extraction module,attention module and relation module.The designed attention module improves the general feature extraction ability of the model by establishing the correlation between samples of different categories.Finally,compared with the traditional deep learning traffic classification model DeepPacket and the classic small sample classification models MathchNet,MAML,etc.,the experimental results show that the average classification accuracy of the FCAR-Net model has achieved the best results,reaching 98.93%,and at the same time The generalization ability is better,and the average classification accuracy of the cross-dataset test is 95.76%.2.A multi-feature fusion few-shot network traffic classification model for encrypted traffic is proposed.Firstly,aiming at the problems of incomplete data processing and incomplete feature extraction in common encrypted traffic classification work,a preprocessing process for comprehensive information extraction of encrypted traffic is designed.Later,in view of the problem that FCAR-Net cannot handle encrypted traffic classification well,the FCAR-Net model was improved,and a multifeature fusion feature extraction scheme was proposed to improve the feature extraction module of FCAR-Net,the improved few-shot encrypted traffic classification model is called MFFCAR-Net.In order to verify the effectiveness of the multi-feature fusion feature extraction scheme,a largesample encrypted traffic classification model MFF-Net and a few-shot encrypted traffic classification model MFFCAR-Net were constructed.Finally set up the experimental verification.Compared with the traditional deep learning encrypted traffic classification model DeepPacket and FSNet experiments,it is proved that the feature fusion of MFF-Net has better classification performance,among which the recall rate,precision and accuracy rate are the best,and the recall rate reaches 96.%,the accuracy is 95%,and the accuracy rate is 99%;MFFCAR-Net also improves the classification accuracy of encrypted traffic under the condition of small samples,and the average classification accuracy rate reaches 96.85%.3.Design and implement a two-stage encrypted traffic classification system based on few-shot learning.Starting from the actual demand,based on the above-mentioned multi-feature fusion encrypted traffic feature extraction model MFF-Net and few-shot encrypted traffic classification model MFFCAR-Net as theoretical support,an encrypted traffic classification system composed of six sub-modules is designed.The design and implementation of the system are introduced in detail,and finally the system test is carried out to verify the availability of the system.