摘要： 恶意加密流量分类领域模型通过增加流量特征维度扩展学习判别表征的丰富性，但仍然存在选择模型与恶意加密流量数据特征不匹配与特征选择不充分的问题，同时缺乏对加密流量数据特征的讨论研究。为此，针对物联网恶意加密流量分类领域提出基于多表征融合的分类模型，一方面使用抽象表征学习模型学习流量会话的数据包级字节关联表征与会话统计表征，另一方面使用明文表征学习模型学习未加密明文的会话连接表征，最后根据抽象表征学习模型对分类结果的置信分数融合两个模型的分类结果获得最终的恶意流量分类结果。为验证模型的先进性，与其他7种基于不同方法的基准模型表现进行比较，模型在F1值指标上达到0.7694的结果，相较其他现有基准模型指标均有大幅提升。同时为讨论验证各个模块与流量表征学习的适配性、选择特征所含判别表征之间的互补性，生成10种基于不同输入与不同模型架构的变体模型进行比较，结果表明该模型具有更优的检测性能，证明模型架构的适配与表征之间的互补。

Abstract: In the field of malicious encrypted traffic classification, algorithms enhance the richness of learning discriminative representations by increasing the dimensionality of traffic features. However, challenges persist, such as the mismatch between selected models and the characteristics of malicious encrypted traffic data, insufficient feature selection, and a lack of in-depth discussion on the characteristics of encrypted traffic data. To address these issues, a classification method based on multi-representation fusion is proposed for the domain of IoT malicious encrypted traffic classification. On one hand, an abstract representation learning module is used to learn packet-level byte association representations and session statistical representations of traffic sessions. On the other hand, a plaintext representation learning module is employed to learn session connection representations of unencrypted plaintext. Finally, the classification results of the two modules are fused based on the confidence scores of the abstract representation learning module to obtain the final malicious traffic classification result. To validate the method's advancement, its performance is compared with 7 benchmark methods based on different methods. The method achieves an F1 score of 0.7694, significantly outperforming other existing benchmark methods. Additionally, to discuss and validate the adaptability of each module to traffic representation learning and the complementarity between the discriminative representations contained in the selected features, 10 variant models based on different inputs and model architectures are generated and compared. The results demonstrate that the proposed method has superior detection performance, proving the adaptability of the model architecture and the complementarity between the representations.