通信学报2026，Vol.47Issue(4)：126-144,19.DOI:10.11959/j.issn.1000-436x.2026075
基于时序双模特征融合的加密FTP指令细粒度识别方法
Fine-grained recognition method for encrypted FTP commands based on temporal dual-mode feature fusion
摘要
Abstract
To address deficiencies in fine-grained identification of application-layer commands in network traffic,a fine-grained recognition method for encrypted FTP commands based on temporal dual-modal feature fusion was proposed,solving FTP command identification under IPsec-ESP encrypted tunnels.First,a multi-constraint matching algorithm based on the encrypted proxy was designed to achieve accurate instruction-level annotation of ESP encrypted traffic.Then,a traffic analysis framework with temporal dual-modal feature fusion was constructed to extract features from mac-roscopic traffic patterns and microscopic temporal dynamics.In experiments,real FTP traffic was obtained in the en-crypted proxy environment to realize matching annotation and accurate identification of 24 fine-grained FTP commands(responses).Comparative experiments with five machine learning models verify the effectiveness of the proposed method.The results show that the proposed method achieves 95.4%accuracy in encrypted FTP command-level classifi-cation,significantly outperforming traditional single-modal feature methods,providing a new technical approach for application-layer traffic identification in encrypted networks.关键词
FTP指令细粒度识别/时序双模特征融合/IPsec-ESP加密隧道/流量分类/机器学习Key words
fine-grained recognition for FTP command/temporal dual-mode feature fusion/IPsec-ESP encrypted tunnel/traffic classification/machine learning分类
信息技术与安全科学引用本文复制引用
付春辉,杨智,郭渊博,李勇飞,金舒原..基于时序双模特征融合的加密FTP指令细粒度识别方法[J].通信学报,2026,47(4):126-144,19.基金项目
国家自然科学基金资助项目(No.62472456) The National Natural Science Foundation of China(No.62472456) （No.62472456）
