基于多层双向SRU与注意力模型的加密流量分类方法

Encrypted Traffic Classification Method Based on Multi-Layer Bidirectional SRU and Attention Model

基于传统循环神经网络的加密流量分类方法普遍存在并行性较差、模型运行效率较低等问题。为实现加密流量的快速准确分类,提出一种基于多层双向简单循环单元(SRU)与注意力(MLBSRU-A)模型的加密流量分类方法。将特征学习和分类统一到一个端到端模型中,利用SRU模型高度并行化的序列建模能力来提高整体运行效率。为了提升MLBSRU-A模型的分类精度,堆叠多层双向SRU网络使其自动地从原始流量中提取特征,并引入注意力机制为特征赋予不同的权重,从而提高重要特征之间的区分度。实验结果表明,在公开数据集ISCX VPN-nonVPN上,MLBSRU-A模型具有较高的分类精度和运行效率,与BGRUA模型相比,MLBSRU-A的细粒度分类准确率提高4.34%,训练时间减少55.38%,在USTC-TFC2016数据集上,MLBSRU-A模型对未知加密恶意流量的检测准确率达到99.50%,细粒度分类准确率为98.84%,其兼具对未知加密恶意流量的高精度检测能力以及对加密恶意流量的细粒度分类能力。

The encrypted traffic classification method based on traditional Recurrent Neural Network(RNN)typically have poor parallelism and low efficiency.To quickly and accurately classify encrypted traffic,a classification method for encrypted traffic based on a Multi-Layer Bidirectional Simple Recurrent Unit and Attention(MLBSRU-A)model is proposed.Feature learning and classification are unified into an end-to-end model,and the highly parallel sequence modeling ability of the SRU model is used to improve the overall operation efficiency.To improve the classification accuracy of the MLBSRU-A model,multi-layer bidirectional SRU networks are stacked to automatically extract features from the original traffic,and an attention mechanism is introduced to provide different weights to features to improve discrimination between important features.Experiments show that the MLBSRUA model has a higher classification accuracy and running efficiency on the public dataset ISCX VPN-nonVPN.Compared with the BGRUA model,the fine-grained classification accuracy of MLBSRU-A improved by 4.34%,and the training time reduced by55.38%.On the USTC-TFC 2016 dataset,the detection accuracy of the MLBSRU-A model for unknown encrypted malicious traffic is 99.50%,and the fine-grained classification accuracy is 98.84%.The proposed model can detect unknown encrypted malicious traffic with high precision and perform fine-grained classification of encrypted malicious traffic.