采用序列特征与知识引导的未知网络应用早期识别方法

Early Identification of Unknown Applications Based on Sequence Features and Knowledge Guidance

针对现有网络流量分类方法难以在样本稀缺场景下快速识别早期未知应用这一问题,提出一种基于序列特征与知识引导的未知网络应用早期识别方法。一方面基于Transformer-encoder框架构建流量分类模型(FAIN),该模型利用自注意力机制挖掘流量序列中数据包之间的全局依赖关系,生成具有可分辨性的流量表示向量用于分类。另一方面,为提升FAIN模型在样本稀缺场景下的适应能力,采取监督预训练与元学习相耦合的模型优化策略,赋予模型在小样本场景下快速学习流量分类任务的能力,使其满足识别早期未知网络应用的需求。在公开数据集与真实校园网流量合成的小样本数据集上进行了深入的对比实验。结果表明:所提出的流量分类模型FAIN在公开分类任务上优于现有方法,且优化后的FAIN模型在XJTU-FSTC和CSTNET数据集的5类和10类小样本分类任务上,准确率最高分别提升了16.75%、10.08%和11.57%、8.24%。该研究结果为未知网络应用的早期识别提供了有效的方法支撑。

To address the problem that the existing network traffic classification methods are not able to promptly identify early unknown applications in case of data scarcity,a method for the early identification of unknown applications based on sequence features and knowledge guidance is proposed in this paper.On the one hand,a traffic classification model,named FAIN,is constructed using the Transformer-encoder framework.By leveraging the self-attention mechanism,FAIN model effectively captures global dependencies among packets and generates distinguishable representation for classification.On the other hand,to improve the adaptability of FAIN model to data scarcity,a model optimization strategy that couples supervised pre-training with meta-learning is proposed.This strategy empowers the model to quickly learn unseen tasks in a few-shot setting.In this study,in-depth comparative experiments are conducted on few-shot datasets synthesized from real campus network traffic.The results show that the proposed FAIN traffic classification model is superior to existing methods in terms of public network traffic classification.The optimized FAIN model improves the accuracy on the 5-class and 10-class few-shot classification tasks of the XJTU-FSTC and CSTNET datasets,with the maximum accuracy increases of 16.75%,10.08%and 11.57%,8.24%,respectively.This model provides effective support for the early identification of unknown applications.