Terminal tracing method based on traffic learning

Abstract

The invention discloses a terminal tracing method based on traffic learning. The method comprises the following steps: 1, extracting terminal information used for tracing and dimension information used for forming machine learning in network traffic; 2, preprocessing the information extracted in the step 1; 3, establishing a feature classifier; 4, according to the extracted terminal information and the feature classifier obtained in the step 3, enabling all data to carry the terminal information through a related association strategy to complete terminal tracing. Compared with an existing active traceability method, the method is simpler and more suitable for big data development, and terminal information can be traced.

Description

technical field [0001] The invention relates to a terminal source tracing method based on traffic learning. Background technique [0002] With the explosive development of the Internet and mobile Internet, cyber crimes and cyber frauds are also increasing, and have become a serious social problem. With fewer and fewer global IPV4 addresses, NAT conversion technology is more and more widely used. NAT conversion can map the internal network IP to different ports of the egress IP, thereby shielding the details of the internal network. The emergence of NAT technology makes it more difficult to trace the source of cybercrime. [0003] At present, for cybercrimes after NAT, active traceability is mostly adopted, that is, to find the corresponding NAT device, then check the conversion log, and then do statistical analysis and traceability. [0004] The current active traceability method needs to actively check the conversion log of the corresponding NAT device, but this method ha...

AI Technical Summary

Problems solved by technology

[0005] (1) Most NAT conversion logs are temporary, and the previous information may no longer exist

[0006] (2) The current NAT device network is already very complex, and there may be multiple NAT sub-networks nested inside the NAT device, making it very difficult to actively trace the source

[0007] (3) Many NAT devices are set up in public places, such as coffee shops, stations and other places where people flow, and active traceability cannot trace criminal individuals

Images