基于路径签名表征学习的加密流量检测

Encrypted traffic detection based on path signature features representation learning

摘要

针对加密流量间交互行为特征的提取存在不足等问题,提出了一种基于路径签名表征学习的加密流量检测方法(path signature feature representation learning, PSFREL),利用路径签名来表征流量间隐藏的、不受加密影响的交互行为特征,使用自动编码器提取字段级局部特征,并使用结合通道注意力机制的残差网络Cam-resnet提取流量全局特征,形成多粒度流量特征后进行加密流量检测。在ISCXVPN-nonVPN等4个加密流量数据集上的评测结果显示,PSFREL的平均F1达到94.91%。

Abstract

Aiming at the problems of insufficient extraction of interactive behavioral features between encrypted flows, a PSFREL (Path Signature Feature Representation Learning) based encrypted flow detection method is proposed. Signature feature representation learning (PSFREL), which uses path signatures to characterize the hidden, unaffected by encryption interactions between traffic flows, uses an autoencoder to extract local features at the field level, and uses the residual network Cam-resnet, which combines the attention mechanism of the channel, to extract the global features of the traffic flow, forming a multi-granularity flow features for encrypted traffic detection. Comprehensive benchmarking across four encrypted network flow datasets (e.g., ISCX VPN-nonVPN) showcases the PSFREL framework’s capability to attain a 94.91% mean F1-Score.

关键词

加密流量 / 路径签名 / 特征工程 / 残差网络

Key words

encrypted traffic / path signatures / feature engineering / residual network

参考文献

[1] 侯剑, 鲁辉, 刘方爱, 等. 加密恶意流量检测及对抗综述[J]. 软件学报, 2024, 35(1): 333-355.

[2] HOU Jian, LU Hui, LIU Fangai, et al. A review of encrypted malicious traffic detection and countermeasure[J]. Journal of Software, 2024, 35(1): 333-355.

[3] 陈子涵, 程光, 徐子恒, 等. 互联网加密流量检测、分类与识别研究综述[J]. 计算机学报, 2023, 46(5): 1060-1085.

[4] CHEN CHENG Zihan, XU Guang, XU Ziheng, et al. A review of research on detection, classification and recognition of encrypted traffic on the internet[J]. Journal of Computing, 2023, 46(5): 1060-1085.

[5] LONG G, ZHANG Z X. Deep encrypted traffic detection: an anomaly detection framework for encryption traffic based on parallel automatic feature extraction[J]. Computational Intelligence and Neuroscience, 2023, 2023: 3316642.

[6] LOTFOLLAHI M, JAFARI S M, SHIRALI H Z R, et al. Deeppacket: a novel approach for encrypted traffic classification using deep learning[J]. Soft Computing, 2020, 24(3): 1999-2012.

[7] AGRAWAL S, SOHI B S. Feature optimization and performance evaluation of machine learning algorithms for identification of P2P traffic[J]. Journal of Advances in Information Technology, 2012, 3(2): 107-114.

[8] WANG Z H, THING V L L. Feature mining for encrypted malicious traffic detection with deep learning and other machine learning algorithms[J]. Computers & Security, 2023, 128: 103143.

[9] ZHAO J J, LI Q, HONG Y P, et al. MetaRockETC: adaptive encrypted traffic classification in complex network environments via time series analysis and meta—learning[J]. IEEE Transactions on Network and Service Management, 2024, 21(2): 2460-2476.

[10] CHEN C, QU L F, AMIRPOUR H, et al. On the security of selectively encrypted HEVC video bitstreams[J]. ACM Transactions on Multimedia Computing, Communications, and Applications, 2024, 20(9): 1-27.

[11] WANG Z H, WANG J R, LIU Y, et al. Privacy—preserving attribute—based access control scheme with intrusion detection and policy hiding for data sharing in VANET[J]. IEEE Internet of Things Journal, 2024, 11(13): 23348-23369.

[12] 谷勇浩, 徐昊, 张晓青. 基于多粒度表征学习的加密恶意流量检测[J]. 计算机学报, 2023, 46(9): 1888-1899.

[13] GU Yonghao, XU Hao, ZHANG Xiaoqing. Encrypted malicious traffic detection based on multi—granularity representation learning[J]. Journal of Computing, 2023, 46(9): 1888-1899.

[14] XU S J, GENG G G, JIN X B, et al. Seeing traffic paths: encrypted traffic classification with path signature features[J]. IEEE Transactions on Information Forensics and Security, 2022, 17: 2166-2181.

[15] CHEVYREV I, KORMILITZIN A. A primer on the signature method in machine learning[EB/OL]. https://arxiv.org/abs/1603.03788

[16] WANG Y, ZHANG L, CHEN H. High—frequency trading anomaly detection via signature—transformer[J]. IEEE Transactions on Financial Informatics, 2023, 19(4): 1234-1245.

[17] LI H, WANG Q, LIU Z. Reinforcement learning optimized path signatures for motion rehabilitation assessment[J]. ACM Transactions on Health Informatics, 2023, 10(3): 1-18.

[18] GUO S, ZHOU T, LI H. Dynamic gene regulatory network modeling via path signature—GNN[J]. Bioinformatics, 2024, 40(1): 1-10.

[19] ZHAO Z M, LI Z X, JIANG J L, et al. ERNN: error—resilient RNN for encrypted traffic detection towards network—induced phenomena[J]. IEEE Transactions on Dependable and Secure Computing, 2023, 99: 1-18.

[20] WANG Q L, WU B G, ZHU P F, et al. ECA—net: efficient channel attention for deep convolutional neural networks[C]∥ 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Seattle: IEEE, 2020: 11534-11542.

[21] 麻文刚, 张亚东, 郭进. 基于LSTM与改进残差网络优化的异常流量检测方法[J]. 通信学报, 2021, 42(5): 23-40.

[22] MA Wengang, ZHANG Yadong, GUO Jin. Anomalous traffic detection method based on LSTM with improved residual network optimization[J]. Journal of Communications, 2021, 42(5): 23-40.

[23] ZHANG S H, MA L F, LIU H J. Encryption—decryption—based event—triggered consensus control for nonlinear MASs under DoS attacks[J]. International Journal of Robust and Nonlinear Control, 2024, 34(1): 132-146.

[24] WANG M N, ZHENG K F, LUO D, et al. An encrypted traffic classification framework based on convolutional neural networks and stacked autoencoders[C]∥ 2020 IEEE 6th International Conference on Computer and Communications (ICCC). Chengdu: IEEE, 2020: 634-641.

[25] WANG Z H, THING V L L. Feature mining for encrypted malicious traffic detection with deep learning and other machine learning algorithms[J]. Computers & Security, 2023, 128: 103143.

[26] CUI S S, JIANG B, CAI Z Z, et al. A session—packets—based encrypted traffic classification using capsule neural networks[C]∥ 2019 IEEE 21st International Conference on High Performance Computing and Communications; IEEE 17th International Conference on Smart City; IEEE 5th International Conference on Data Science and Systems (HPCC/SmartCity/DSS). Zhangjiajie: IEEE, 2019.

基金资助

国家自然科学基金资助项目(62172292)

国家自然科学基金资助项目(62472229)