首页|期刊导航|电子学报|基于梯度协同与特征融合的加密流量检测

基于梯度协同与特征融合的加密流量检测OA

Encrypted Traffic Detection Based on Gradient Collaboration and Feature Fusion

中文摘要英文摘要

随着物联网(Internet of Things,IoT)设备的广泛部署和网络通信的快速发展,加密流量已成为主流传输形式,但同时也为后门攻击和针对性投毒攻击等高级威胁提供了隐蔽通道.为应对加密恶意流量检测这一关键安全挑战,本文提出基于梯度协同与特征融合网络的加密流量检测模型,专用于提升网络中加密恶意流量的检测能力.该模型包含两大核心模块:特征融合模块与梯度协同模块,显著增强模型对复杂加密流量模式的表征学习能力.在特征融合模块中,该模型充分利用卷积神经网络(Convolutional Neural Network,CNN)的局部特征提取优势以及知识增强网络(Kolmogorov-Arnold Networks,KAN)的全局特征建模能力,实现局部与全局特征的高效深度融合.为进一步提升子模型间的协同性与鲁棒性,梯度协同机制使多个子模型能够实时动态共享梯度并联合优化损失函数,从而在训练过程中相互引导、纠错,强化对多样化加密恶意流量模式的捕获.该机制不仅缓解了局部与全局特征学习间的冲突,还显著提升了模型对隐蔽加密攻击流量的敏感性.在多个公开加密流量数据集上的实验结果表明,本文所提出的模型相较现有方法在F1分数上提升约7%,实现了对加密恶意流量的高精度分类.

With the widespread deployment of Internet of Things(IoT)devices and the rapid development of network communications,encrypted traffic has become the mainstream transmission form.However,it also provides covert channels for advanced threats such as backdoor attacks and targeted poisoning attacks.To address the critical security challenge of encrypted malicious traffic detection,this paper proposes an encrypted traffic detection model based on gradient collabora⁃tion and feature fusion networks,specifically designed to enhance the detection capability of encrypted malicious traffic in networks.The model consists of two core modules:the feature fusion module and the gradient collaboration module,which significantly improve the model's ability to learn representations of complex encrypted traffic patterns.In the feature fusion module,the model fully leverages the local feature extraction advantages of convolutional neural networks(CNN)and the global feature modeling capabilities of knowledge-augmented networks(KAN)to achieve efficient deep fusion of local and global features.To further enhance the collaboration and robustness among sub-models,the gradient collaboration mecha⁃nism enables multiple sub-models to dynamically share gradients in real-time and jointly optimize the loss function,thereby guiding and correcting each other during training,and strengthening the capture of diverse encrypted malicious traffic pat⁃terns.This mechanism not only alleviates conflicts between local and global feature learning but also significantly improves the model's sensitivity to covert encrypted attack traffic.Experimental results on multiple public encrypted traffic datasets show that the proposed model achieves an improvement of approximately 7%in F1 score compared to existing methods,en⁃abling high-precision classification of encrypted malicious traffic.

卢嘉中;余坤;刘小垒;张小松

成都信息工程大学网络空间安全学院(芯谷产业学院),四川 成都 610225||先进密码技术与系统安全四川省重点实验室,四川 成都 610225||先进微处理器技术国家工程研究中心(工业控制与安全分中心),四川 成都 610225||成都信息工程大学人工智能学院,四川 成都 610225成都信息工程大学网络空间安全学院(芯谷产业学院),四川 成都 610225||先进密码技术与系统安全四川省重点实验室,四川 成都 610225||先进微处理器技术国家工程研究中心(工业控制与安全分中心),四川 成都 610225国家工程物理交叉科学研究中心,四川 绵阳 621000电子科技大学信息与软件工程学院,四川 成都 611731

信息技术与安全科学

加密流量流量检测特征融合梯度协同

encrypted traffictraffic detectionfeature fusiongradient collaboration

《电子学报》 2026 (2)

532-543,12

国家自然科学基金(No.62102049)四川省自然科学基金(No.2025ZNSFSC0507)先进密码技术与系统安全四川省重点实验室开放基金(No.SKLACSS-202402,No.SKLACSS-202307) National Natural Science Foundation of China(No.62102049)Natural Science Foundation of Sichuan Province(No.2025ZNSFSC0507)Open Fund of Advanced Cryptography and System Security Key Laboratory of Sichuan Province(No.SKLACSS-202402,No.SKLACSS-202307)

10.12263/DZXB.20251021

评论