为了应对当前有标签加密流量数量有限的挑战,同时迅速适应新兴流量的分类任务,提出了一种融合模型无关元学习(model-agnostic meta-learning,MAML)和对比学习的小样本加密流量分类模型.具体来说,通过引入监督对比损失来改进MAML的内层优化,使得会话流经过特征编码网络生成的嵌入表示在标签空间更易区分,从而获得跨多个任务的通用的元知识.借助元知识,新任务适应阶段只需少量标记数据,即可在目标任务上快速学习并获得出色性能.在公有数据集ISCXVPN-NonVPN2016和一个私有数据集上的实验结果表明,所提方法超越了已有的小样本分类方法.在2way-10shot任务中,所提方法在公有数据集上达到97.46%的准确率和97.12%的F1分数;在私有数据集上达到95.19%的准确率和94.96%的F1分数.此外,所提出的模型能够缓解MAML难以应对的类间相似性和类内差异性问题.在公有数据集的5way-10shot任务中,所提出模型的准确率和F1分数相较于MAML分别提升了3.62%和3.70%.
In order to address the current challenge of limited labeled encrypted traffic and rapidly adapt to the classification tasks of emerging traffic, this paper proposed a few-shot encrypted traffic classification model incorporating model-agnostic meta-learning (MAML) and contrastive learning. Specifically, it improved the inner-loop optimization of the MAML by incorporating supervised contrastive loss, thereby enabling the embedding representations generated by the feature encoding network during the conversation flow to be more distinguishable in the label space. Consequently, general meta-knowledge across multiple tasks was obtained. Leveraging this meta-knowledge, the adaptation phase for new tasks requires only a small amount of labeled data, enabling rapid learning and satisfactory performance on the target task. Results on the public dataset ISCXVPN-NonVPN2016 and a private dataset show that the proposed method exceeds the existing few-shot classification methods. In the 2way-10shot task, the proposed method achieves 97.46% accuracy and 97.12% F1-score on the public dataset, as well as 95.19% accuracy and 94.96% F1-score on the private dataset, respectively. In addition, the proposed model can alleviate the problems of inter-class similarity and intra-class difference that MAML is difficult to deal with. Compared to MAML, its accuracy and F1-score improve by 3.62% and 3.70% on the 5way-10shot task in the public dataset, respectively.
[1] Abbasi M, Shahraki A, Taherkordi A. Deep learning for network tra-c monitoring and analysis (NTMA): a survey [J]. Computer Communications, 2021, 170: 19-41.
[2] 陈子涵, 程光, 徐子恒, 等. 互联网加密流量检测、 分类与识别研究综述[J]. 计算机学报, 2023, 46(5): 1060-1085.
[3] Wang Y, Xiang Y, Zhang J, et al. A novel semi-supervised approach for network tra-c clustering [C]// 20115th International Conference on Network and System Security. 2011: 169- 175.
[4] Guo H, Zhang X, Wang Y, et al. Few-shot malware tra-c classiflcation method using network tra-c and meta transfer learning [C]//2022 IEEE 96th Vehicular Technology Conference (VTC2022-Fall). 2022: 1-5.
[5] Ma X T, Wang Y P, Lai X Y, et al. A multi-perspective feature approach to few-shot classiflcation of IoT tra-c [J]. IEEE Transactions on Green Communications and Networking, 2023, 7(4): 2052-2066.
[6] Finn C, Abbeel P, Levine S. Model-agnostic meta-learning for fast adaptation of deep networks [C]// 201734th International Conference on Machine Learning. 2017: 1126-1135.
[7] Yue Y, Chen X, Han Z, et al. Contrastive learning enhanced intrusion detection [J]. IEEE Transactions on Network and Service Management, 2022, 19(4): 4232-4247.
[8] Shao Y, Wu W, You X, et al. Improving the generalization of MAML in few-shot classiflcation via bi-level constraint [J]. IEEE Transactions on Circuits and Systems for Video Technology, 2022, 33(7): 3284-3295.
[9] Rezaei S, Liu X. How to achieve high classiflcation accuracy with just a few labels: a semi-supervised approach using sampled packets [EB/OL]. (2018-12-23) [2024-01-25]. https://arxiv.org/abs/1812.09761.
[10] Xu C, Shen J, Du X. A method of few-shot network intrusion detection based on meta-learning framework [J]. IEEE Transactions on Information Forensics and Security, 2020, 15: 3540-3552.
[11] Feng T, Qi Q, Wang J, et al. Few-shot class-adaptive anomaly detection with model-agnostic meta-learning [C]// 2021 IFIP Networking Conference. 2021: 1-9.
[12] Rong C, Gou G, Hou C, et al. UMVD-FSL: unseen malware variants detection using few-shot learning [C]// 2021 International Joint Conference on Neural Networks (IJCNN). 2021: 18-22.
[13] Yang C, Xiong G, Zhang Q, et al. Few-shot encrypted tra-c classiflcation via multi-task representation enhanced meta-learning [J]. Computer Networks, 2023, 228: 109731.
[14] Hjelm R D, Fedorov A, Lavoie-Marchildon S, et al. Learning deep representations by mutual information estimation and maximization [EB/OL]. (2018-08-20) [2024-01-25]. https://arxiv.org/abs/1808.06670.
[15] Chen T, Kornblith S, Norouzi M, et al. A simple framework for contrastive learning of visual representations [C]// 202037th International Conference on Machine Learning. 2020: 1597-1607.
[16] Grill J B, Strub F, Altche F Á, et al. Bootstrap your own latent: a new approach to selfsupervised learning [J]. Advances in Neural Information Processing Systems, 2020, 33: 21271- 21284.
[17] Khosla P, Teterwak P, Wang C, et al. Supervised contrastive learning [J]. Advances in Neural Information Processing Systems, 2020, 33: 18661-18673.
[18] Yang J, Jiang X, Liang G, et al. Malicious tra-c identiflcation with self-supervised contrastive learning [J]. Sensors, 2023, 23(16): 7215-7232.
[19] Wang W, Zhu M, Zeng X, et al. Malware tra-c classiflcation using convolutional neural network for representation learning [C]// 2017 International Conference on Information Networking (ICOIN). 2017: 712-717.
[20] Wang Z. The applications of deep learning on tra-c identiflcation [J]. BlackHat USA, 2015, 24(11): 1-10.
[21] 苏庆, 林佳锐, 黄海滨, 等. 融合MAML和CBAM的安卓恶意应用家族分类模型[J]. 计算机工程与应用, 2023, 59(2): 271-279.
[22] Vaswani A, Shazeer N, Parmar N, et al. Attention is all you need [C]// 201731st International Conference on Neural Information Processing Systems. 2017: 6000-6010.
[23] Yao H, Liu C, Zhang P, et al. Identiflcation of encrypted tra-c through attention mechanism based long short-term memory [J]. IEEE Transactions on Big Data, 2019, 8(1): 241-252.
[24] Zhao Z, Guo Y, Wang J H, et al. CL-ETC: a contrastive learning method for encrypted tra-c classiflcation [C]// 2022 IFIP Networking Conference. 2022: 1-9.
[25] Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks [EB/OL]. (2017-06-19) [2024-01-25]. https://arxiv.org/abs/1706.06083.
[26] Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples [EB/OL]. (2014-12-20) [2024-01-25]. https://arxiv.org/abs/1412.6572.
