• 自适应增强协同双域建模的加密流量检测框架

    Adaptive enhancement driven dual-domain modeling approach

    • 随着加密通信协议的广泛部署,传统基于特征匹配的流量检测方法在复杂网络环境中面临数据分布偏移与隐蔽通信模式等挑战,检测性能显著下降。本文提出一种基于传输控制协议(Transmission Control Protocol, TCP)的自适应数据增强策略与双通道特征提取的加密流量检测框架,旨在提升模型在动态网络环境下的鲁棒性与泛化能力。首先,设计三种基于TCP机制的自适应数据增强策略TAAM(TCP-Adaptive Augmentation Method),模拟超时重传、数据包移位及最大报文段长度(Maximum Segment Size, MSS)分割等网络行为,以生成多样化训练样本,缓解训练集与测试集分布不一致问题。其次,构建TSC-Net(Temporal-Spectral Channel Network)模型,融合长短期记忆网络(Long Short-Term Memory, LSTM)提取通信时序特征,以及短时傅里叶变换(Short-Time Fourier Transform, STFT)与卷积神经网络(Convolutional Neural Network, CNN)提取频域特征,实现对流量中潜在模式扰动与周期性的多维建模。在公开加密流量数据集及真实网络环境下的实验结果表明:该方法在准确率、鲁棒性与环境适应性方面均优于现有主流模型,分类准确率较最优对比方法分别提升7.71和12.84个百分点;消融实验进一步验证了各模块对整体性能的积极贡献。

       

      Abstract: With the widespread deployment of encrypted communication protocols, traditional traffic detection methods based on feature matching are becoming increasingly ineffective in complex network environments, struggling to cope with challenges posed by data distribution shifts and covert communication patterns. To address this issue, this paper proposes an encrypted traffic detection framework based on the transmission control protocol (TCP) with adaptive data augmentation strategies and dual-channel feature extraction to improve the robustness and generalization of the model in dynamic environments. Firstly, three TCP-based adaptive augmentation methods (TAAM) are designed to simulate network transmission behaviors such as timeout retransmissions, packet shifts, and MSS splits, generating diverse training samples and alleviating the problem of inconsistent training and test distributions. Secondly, a TSC-Net model is constructed, combining a long short-term memory (LSTM) network to extract communication temporal features with ashort-time Fourier transform (STFT) and convolutional neural network (CNN) to extract frequency domain features. This model achieves multidimensional modeling of potential pattern perturbations and periodicity in traffic. Experimental results on public encrypted traffic datasets and real-world network environments demonstrate that the proposed method outperforms existing mainstream models in terms of accuracy, robustness, and environmental adaptability. Specifically, the proposed method achieves 7.71% and 12.84% points higher classification accuracy than the best comparable method, respectively. Furthermore, ablation studies further validate the positive contributions of each module to the overall system performance.

       

    /

    返回文章
    返回