Semisupervised Encrypted Traffic Identification Based on Auxiliary Classification Generative Adversarial Network

Abstract

The invention discloses a semi-supervised encrypted traffic identification method based on an auxiliary classification generative adversarial network, and the method comprises the steps: carrying outthe traffic preprocessing, carrying out the inter-flow information extraction through an open-source tool zeek to form a flow log, and extracting flow features from the log according to defined features to form a flow feature matrix; modifying an original auxiliary classification generative adversarial network, enabling a generator to receive random noise, hidden variables and data tags and then fuse the random noise, the hidden variables and the data tags into vectors to generate generated data containing real traffic characteristics, and enabling a discriminator to receive unmarked samples and marked samples in the real data, stack three MLP networks to complete judgment of true and false traffic respectively, and classify the traffic and extracting the hidden variables. According to themethod, the loss function of the original auxiliary classification generative adversarial network is modified, so that semi-supervised learning can be carried out by utilizing unmarked data, the identification precision is improved, the network traffic acquisition and marking cost is reduced, and the network management and security monitoring level is improved.