Abstract: In recent years, with the rapid growth of Internet traffic, especially the popularity of encrypted communication, malicious traffic detection is facing a huge challenge, due to the limited resources and performance of mobile devices, which makes it more difficult to identify malicious behaviors in encrypted traffic on mobile. Therefore this paper proposes a knowledge distillation based encrypted traffic detection method. First, the traffic is transformed into images through visualization techniques; second, based on the ConvNeXt network architecture, the SK_SwiGLU_ConvNeXt network is constructed as the teacher network by introducing the SKNet attention mechanism and replacing the activation function GELU with SwiGLU; finally, the lightweight MobileNetV2 is selected as the student network and the use the teacher network to guide the student network training. The experimental results of this paper’s detection method on the publicly available dataset ISCX VPNNonVPN show that even in the resourceconstrained mobile device environment, the student network can improve the detection effect of the teacher model while reducing the model complexity, which proves that this method has efficient deployment potential on mobile devices.

Key words: encrypted traffic identification, knowledge distillation, ConvNeXt, SKNet, MobileNetV2, deep learning

摘要： 近年来，随着互联网流量的迅速增长，尤其是加密通信的普及，恶意流量检测面临巨大挑战，由于移动设备资源和性能有限，使得在移动端加密流量中识别恶意行为更加困难.因此提出了一种基于知识蒸馏的加密流量检测方法.首先，通过可视化技术将流量转化为图像；其次，在ConvNeXt网络架构的基础上，通过引入SKNet注意力机制，替换激活函数GELU为SwiGLU，构建了SK_SwiGLU_ConvNeXt网络作为教师网络；最后，选用轻量级的MobileNetV2为学生网络，并使用教师网络指导学生网络训练.该检测方法在公开数据集ISCX VPNNonVPN上的实验结果表明，即使在资源受限的移动设备环境中，学生网络也能在降低模型复杂度的同时提高教师模型的检测效果，证明了该方法在移动设备上具有高效的部署潜力.

关键词: 加密流量识别, 知识蒸馏, ConvNeXt, SKNet, MobileNetV2, 深度学习