基于深度残差胶囊网络与注意力机制的加密流量识别方法

随着用户安全意识的提高和加密技术的发展，加密流量已经成为网络流量中的重要部分，识别加密流量成为网络流量监管的重要部分。基于传统深度学习模型的加密流量识别方法存在效果差、模型训练时间长等问题。针对上述问题，提出了一种基于深度残差胶囊网络模型（DRCN，deep residual capsule network）的加密流量识别方法。原始胶囊网络通过全连接形式堆叠导致模型耦合系数变小，无法搭建深层网络模型。针对上述问题，DRCN模型采用三维卷积算法（3DCNN）动态路由算法代替全连接动态路由算法，减少了每个胶囊层之间传递的参数，降低了运算复杂度，进而构建深层胶囊网络，提高识别的准确率和效率；引入通道注意力机制为不同的特征赋予不同的权重，减少无用特征对识别结果的影响，进一步增强模型特征提取能力；将残差网络引入胶囊网络层，搭建残差胶囊网络模块缓解了深度胶囊网络的梯度消失问题。在数据预处理方面，截取的数据包前784byte，将截取的字节转化成图像输入到DRCN模型中，该方法避免了人工特征提取，减少了加密流量识别的人工成本。在ISCXVPN2016数据集上的实验结果表明，与效果最好的BLSTM模型相比，DRCN模型的准确率提高了5.54%，模型的训练时间缩短了232s。此外，在小数据集上，DRCN模型准确率达到了94.3%。上述实验结果证明，所提出的识别方案具有较高的识别率、良好的性能和适用性。

Encrypted traffic identification method based on deep residual capsule network with attention mechanism

With the improvement of users’ security awareness and the development of encryption technology, encrypted traffic has become an important part of network traffic, and identifying encrypted traffic has become an important part of network traffic supervision.The encrypted traffic identification method based on the traditional deep learning model has problems such as poor effect and long model training time.To address these problems, the encrypted traffic identification method based on a deep residual capsule network (DRCN) was proposed.However, the original capsule network was stacked in the form of full connection, which lead to a small model coupling coefficient and it was impossible to build a deep network model.The DRCN model adopted the dynamic routing algorithm based on the three-dimensional convolutional algorithm (3DCNN) instead of the fully-connected dynamic routing algorithm, to reduce the parameters passed between each capsule layer, decrease the complexity of operations, and then build the deep capsule network to improve the accuracy and efficiency of recognition.The channel attention mechanism was introduced to assign different weights to different features, and then the influence of useless features on the recognition results was reduced.The introduction of the residual network into the capsule network layer and the construction of the residual capsule network module alleviated the gradient disappearance problem of the deep capsule network.In terms of data pre-processing, the first 784byte of the intercepted packets was converted into images as input of the DRCN model, to avoid manual feature extraction and reduce the labor cost of encrypted traffic recognition.The experimental results on the ISCXVPN2016 dataset show that the accuracy of the DRCN model is improved by 5.54% and the training time of the model is reduced by 232s compared with the BLSTM model with the best performance.In addition, the accuracy of the DRCN model reaches 94.3% on the small dataset.The above experimental results prove that the proposed recognition scheme has high recognition rate, good performance and applicability.