基于时序双模特征融合的加密FTP指令细粒度识别方法OA

To address deficiencies in fine-grained identification of application-layer commands in network traffic,a fine-grained recognition method for encrypted FTP commands based on temporal dual-modal feature fusion was proposed,solving FTP command identification under IPsec-ESP encrypted tunnels.First,a multi-constraint matching algorithm based on the encrypted proxy was designed to achieve accurate instruction-level annotation of ESP encrypted traffic.Then,a traffic analysis framework with temporal dual-modal feature fusion was constructed to extract features from mac-roscopic traffic patterns and microscopic temporal dynamics.In experiments,real FTP traffic was obtained in the en-crypted proxy environment to realize matching annotation and accurate identification of 24 fine-grained FTP commands(responses).Comparative experiments with five machine learning models verify the effectiveness of the proposed method.The results show that the proposed method achieves 95.4%accuracy in encrypted FTP command-level classifi-cation,significantly outperforming traditional single-modal feature methods,providing a new technical approach for application-layer traffic identification in encrypted networks.