A Personal Identification Information Classification Method Based on Information Vector Space Model

Abstract

This invention relates to a personal identification information classification method based on an information vector space model, belonging to the field of network information security technology. This method first extracts characteristic textual information transmitted in network traffic through network traffic analysis and transforms it into a dataset containing service, location, information, and frequency feature dimensions. Then, the dataset description is transformed into a sample space for text classification. Next, a generative model based on three-layer Bayesian methods is established in conjunction with the text classification model. Model parameters are obtained through data sample training, automatically representing services-locations and their transmitted information as vectors, and obtaining the probability distributions between services-locations, information, and types. Finally, new services are inferred by calculating the probability distributions between each service-location, information, and type. This method can more precisely describe the distribution characteristics of different information semantics transmitted in network traffic, achieving the goal of accurately classifying personal identification information.

Description

Technical Field

[0001] This invention relates to a method for classifying personal identification information, specifically a method for classifying personal identification information based on an information vector space model, and belongs to the field of network information security technology. Background Technology

[0002] Personally identifiable information refers to information that can identify, distinguish, or track an individual. It can be a single (or direct) piece of information, or it can consist of several (or indirect) pieces of information.

[0003] The development of mobile internet is gradually changing people's lifestyles, allowing them to access a wide variety of convenient online services anytime, anywhere through numerous applications. Simultaneously, to provide these services with high quality, application service providers (ASPs) typically collect various types of user data directly or indirectly through their applications and upload it to the cloud. Especially with the use of sensors embedded in mobile devices, such as GPS, cameras, and accelerometers, mobile applications (APPs) generate even more diverse types of personally identifiable information (PII). ASPs use PII to not only identify, locate, and track users for market analysis and forecasting, providing more precise services, but also to meticulously characterize users' online behavior. At the same time, network operators and local administrators also seek this PII to provide users with more accurate traffic metering and pricing services, more comprehensive market demand analysis, and more rational network architecture and security services.

[0004] Typically, high-bandwidth network links from telecom operators generate massive amounts of data. Accurately and quickly extracting users' personal identification information from this vast amount of data presents a significant challenge.

[0005] Currently, while existing technologies perform well in their respective application scenarios, in the context of high-performance, high-bandwidth IP networks operated by network operators, they are primarily based on the semantic classification assumption. That is, users accessing the same service-location Domain-Key transmit the same type of information (Value). These services-locations and their transmitted information (Value) belong to a single type or semantic category.

[0006] However, in practice, the information values ​​transmitted in a service-location Domain-Key may belong to different types; that is, information values ​​may exhibit "one word with multiple meanings" or "multiple words with one meaning." The type of the service-location Domain-Key represented by these information values ​​is not unique. This means that there is not a one-to-one correspondence between the service-location Domain-Key, the information value, and the type. The service-location Domain-Key and its transmitted information values ​​may belong to multiple types and should follow the probability distribution related to service-location, information, and type. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of existing technologies and to solve the technical problem of how to accurately and quickly discover user personal identification information from massive amounts of data in high-performance, high-bandwidth IP network scenarios. It creatively proposes a personal identification information classification method based on the information vector space model.

[0008] Traditional vector space models, where features are independent, cannot effectively uncover underlying semantic relationships within information. This method, referencing statistical learning approaches in text classification, calculates the probability distributions between services, locations, information types, and reveals their correlations. This addresses the technical problem of ambiguous correlations in personal representation information, enabling a more refined description of the semantic distribution characteristics of different information transmitted in network traffic, thus achieving accurate classification of personal identification information.

[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0010] A method for classifying personal identification information based on an information vector space model.

[0011] First, through network traffic analysis, characteristic text information transmitted in network traffic is extracted and transformed into a dataset containing service domain, location key, information value, and frequency feature dimensions.

[0012] Then, the dataset description is transformed into a sample space for text classification.

[0013] Subsequently, a generative model based on three-layer Bayes was established by combining the text classification model.

[0014] Then, the model parameters are obtained through data sample training, and the service-location and its transmitted information are automatically represented as vectors to obtain the probability distribution between service-location, information and type.

[0015] Finally, the model is used to infer the probability distribution of new service-location types, accurately classifying personal identification information.

[0016] Beneficial effects

[0017] The method of the present invention has the following advantages compared with the prior art:

[0018] 1. This method obtains the probability distribution relationship between service-location, information and type through data preprocessing, generative model, training model and inference model, and infers the type attributes of other service-location and the information it contains.

[0019] 2. This method reveals the correlations and differences between personally identifiable information and eliminates semantic ambiguity and other issues in the extraction of personally identifiable information, which can help in research on privacy leakage risk assessment.

[0020] This method can infer the content of encrypted information by the correlation between plaintext and ciphertext information in a mixed environment. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of a user behavior feature tree model.

[0022] Figure 2 A schematic diagram of the information transmission generation model.

[0023] Figure 3 This is a schematic diagram illustrating the algorithm for generating information vectorization models.

[0024] Figure 4 This is a schematic diagram of the information vectorization training model algorithm process. Detailed Implementation

[0025] The present invention will now be described in further detail with reference to the accompanying drawings.

[0026] A personal identification information classification method based on an information vector space model includes the following steps:

[0027] Step 1: Using network traffic analysis technology, extract the characteristic text information transmitted in the network traffic and transform it into a dataset containing service domain, location key, information value, and frequency feature dimensions.

[0028] Furthermore, the present invention provides a specific implementation method for step 1, comprising the following steps:

[0029] Step 1.1: Collect traffic data from the network and save it in PCAP format.

[0030] Step 1.2: Determine whether the selected data packet is an HTTP request field. If so, use regular expressions to extract its feature information; otherwise, determine the next data packet.

[0031] Feature information extraction can be performed in the following ways:

[0032] Step 1.2.1: Determine whether the information data packet contains the HTTP protocol GET field. If it contains the GET field, extract the feature information. If it does not contain the GET field, continue to select the next data.

[0033] Step 1.2.2: Slice the GET field from left to right using a "?" symbol, and select the part of the field before the "?" as the service field, and select the part of the field after the "?" as the key-value pair field for preprocessing data.

[0034] Step 1.2.3: According to the regular expression rules, extract the accessed domain name or service IP address from the service field obtained in Step 1.2.2;

[0035] Step 1.2.4: Use an "&" symbol to divide the preprocessed key-value pair field data obtained in Step 1.2.2 into several key-value data groups.

[0036] Step 1.3: Count the frequency of entries with the same field in the data set.

[0037] The text-formatted data, after preprocessing, ultimately contains a four-dimensional sample space: SampleSpace = {Domain, Key, Value, Frequency}. Utilizing the feature information from these four dimensions, the user's online behavior characteristics can be fully represented.

[0038] The specific meaning of network behavior characteristics is: when a user accesses a network service Domain, different information values ​​are transmitted at the same location as the Key, and the transmission frequency of each information is Frequency.

[0039] Step 2: Transform the dataset description into a sample space for text classification.

[0040] Furthermore, the present invention provides a specific implementation method for step 2, comprising the following steps:

[0041] Step 2.1: Based on user behavior characteristics, establish a user behavior feature tree model. For example... Figure 1 As shown.

[0042] Each user behavior feature tree is rooted at the service-location Domain-Key (DK), with information Value (V) as child nodes and the frequency of each information transmission as a leaf node, representing the different information transmitted by the user at this service-location and the frequency of their transmission.

[0043] Step 2.2: According to text classification theory, if we consider several pieces of information (Value) transmitted within the same DK as a single text data set, then the problem of classifying personal identification information can be described as: C = DK × V → Z: {TURE, FALSE}. Here, DK represents the service-location that needs to be classified, DK = {dk1, dk2, ..., dk...} M}, dk M Let dk represent the M-th service-location; V represents information, V = {v1, v2, ..., v...} Nm}, v Nm Indicates v ij The last specific piece of information included; Z represents the set of types under the predefined classification system, that is, the set of personal identification information categories, Z = {z1, z2, ..., z...} K}, z K Represents the Kth type z. The TRUE value indicates that for... <dk m ,z k >, Documentation DK m Belongs to class z k The FALSE value indicates that for <dk m ,z k >, Documentation DK m Not belonging to class z k The goal is to find an effective mapping function that accurately maps the domain Φ:DK×Z→{TURE,FALSE}, which is essentially a classifier for personal identification information.

[0044] When a user accesses different services, this method provides a probability distribution of the types of personally identifiable information transmitted at different locations, thereby determining the type of information transmitted within a service-location context. Therefore, the main problem this method addresses is inferring the type of information transmitted given a service-location context.

[0045] Step 3: Combine the text classification model to establish a generative model based on three-layer Bayesian methods.

[0046] Furthermore, the present invention provides a specific implementation method for step 3, comprising the following steps:

[0047] Step 3.1: Describe the process of network traffic generating data using probability distributions, and establish an information transmission generation model, such as... Figure 2 As shown.

[0048] Generative models assume that each service-location (DK) and the information transmitted within it in network traffic are generated through a probabilistic selection process. First, a DK type is selected using one probability distribution; then, information is selected from this type using another probability distribution. If we need to generate arbitrary network traffic, the probability p(V|DK) of each piece of information V appearing in its service-location DK is as shown in Equation 1:

[0049]

[0050] Where Z represents the type of service-location; p(Z|DK) represents the probability of each piece of information V appearing in its service-location DK.

[0051] The conditional probability described above can also be expressed in matrix multiplication form, as shown in Equation 2:

[0052]

[0053] In this equation, the C matrix on the left side represents the probability p(V|DK) of each piece of information occurring in each service-location; the Φ matrix on the right side represents the probability p(V|Z) of each piece of information V occurring in each type Z; and the Θ matrix represents the probability p(Z|DK) of each type Z occurring in each service-location DK.

[0054] Step 3.2: Suppose that among the traffic generated by several users accessing the network, several pieces of information V are transmitted in several service-location dKs, then construct the i-th service-location dK. i The j-th piece of information v i,j Generative models. For example... Figure 2 As shown.

[0055] Specifically, the construction of the generative model includes:

[0056] Step 3.2.1:

[0057] This process means that when generating the i-th service-location, it first starts from the Dirichlet prior parameters. Randomly select DK i Type probability distribution Then from the multinomial probability distribution Randomly select the j-th piece of information v i,j type z i,j .

[0058] Step 3.2.2:

[0059] This process represents the generation of the j-th information v transmitted in the i-th service-location. i,j That is, from Dirichlet prior parameters Choose k=z i,j Multinomial probability distribution and from Randomly select transmission information v i,j .

[0060] Repeat steps 3.2.1 and 3.2.2 to obtain the generated service-location dk. m , and all the information transmitted within it.

[0061] The specific algorithmic process of generative models, such as Figure 3 As shown.

[0062] Step 4: Train the model parameters using data samples, automatically represent the service-location and its transmitted information as vectors, and obtain the probability distribution between service-location, information and type.

[0063] The specific algorithm process for training the model is as follows: Figure 4 As shown.

[0064] Furthermore, the present invention provides a specific implementation method for step 4, comprising the following steps:

[0065] Step 4.1: Select the appropriate type K and the appropriate prior parameters.

[0066] Step 4.2: For each piece of information in each DK of the corpus C (equivalent to matrix C in Equation 2), randomly select a type number;

[0067] Step 4.3: Re-search corpus C, using Gibbs sampling, as shown in Equation 3:

[0068]

[0069] Where Z represents the service-location type, z i,j Represents the j-th information v i,j Type; This represents the probability distribution of all service-location overall types. This represents the overall type probability distribution for all service-location services. This indicates removing information v. i,j The subsequent type probability distribution; Indicates the joint distribution. For information v i,j The corresponding type z i,j The conditional probability is given by k, where k represents the individual type; K represents the total number of types; L represents the total number of information entries in the corpus; and t represents the number of information entries in the corpus. and Given the prior parameters, the goal is to obtain each z ij With v ij Corresponding to and The probability distribution of α; k Denotes the Dirichlet prior parameter, β k Denotes the Dirichlet prior parameters; This indicates the number of items in the i-th row that belong to topic k. This represents the number of entries belonging to the i-th piece of information.

[0070] In the estimation process of the Gibbs sampling method, firstly and Given the prior parameters, the goal is to obtain each z i,j With v i,j The corresponding wholes and The probability distribution of the whole and The probability distributions represent the probability distribution of service-location type and the probability distribution of type information, respectively.

[0071] Since Gibbs sampling is used, to obtain the desired target probability distribution, it is necessary to obtain the conditional probability distributions of each feature dimension of the corresponding probability distribution. Specifically, this requires knowing all information vectors transmitted between all services and locations. Find the overall type distribution of all services and locations. First, find the joint distribution. Then, a certain piece of information v can be solved. i,j The corresponding type z i,j conditional probability in This indicates removing information v. i,j The probability distribution of the type is then used. From this, the conditional probability distribution of the Gibss sampling method can be used. To simulate

[0072] Then, update the type number of all information and update the type number of that information in the corpus;

[0073] Step 4.4: Repeat step 4.3 to perform Gibbs sampling based on coordinate axis rotation until Gibbs sampling converges;

[0074] Step 4.5: Count the number of each information type in all DKs of corpus C, and obtain the distribution of each type in all DKs. Count the number of messages in all types in corpus C to obtain the distribution of each message type.

[0075] Step 5: Use the model to infer the probability distribution of the new service-location type and accurately classify personal identification information.

[0076] Furthermore, the present invention provides a specific implementation method for step 5, comprising the following steps:

[0077] Step 5.1: Randomly select a type Z for each piece of information in the current service-location DK;

[0078] Step 5.2: Re-search the current service-location DK and update the type of each piece of information using Equation 3;

[0079] Step 5.3: Repeat step 5.2 to perform Gibbs sampling based on coordinate axis rotation until Gibbs sampling converges;

[0080] Step 5.4: Analyze the types of each piece of information in the service-location DK to obtain the type distribution of the DK.

[0081] Step 5.5: The type distribution parameters of the obtained DK In the middle, select the type z with the highest probability of occurrence. i,j Based on its specific type, the personal identification information is accurately classified.

Claims

1. A method of classifying personal identification information based on an information vector space model, characterized by, The method comprises the following steps: Step 1: extracting feature text information transmitted in network traffic by network traffic analysis, and converting the feature text information into a dataset comprising service domain, location key, information value and frequency feature dimensions; Step 2: converting the dataset description into a sample space for text classification; Step 3: combining a text classification model to establish a three-layer Bayesian generation model; Step 3.1: describing the process of generating network traffic data by a probability distribution, and establishing an information transmission generation model; The generative model is the belief that each service-location DK in the network traffic and the information transmitted therein are generated through a probabilistic selection process; first, a probability distribution selects DK type, and then another probability distribution selects a certain information from this type; if it is necessary to generate any network traffic, the probability of occurrence of each information V in the service-location DK As shown in Equation 1: （1） wherein Z denotes the type of service-location; denotes the probability of each information V to occur in its service-location DK. Step 3.2: Construct a generation model of the jth information v in the ith service-location dk if a number of users access a network to generate a traffic, and a number of information V are transmitted in a number of service-locations DK i i,j ​​ Step 4: obtaining model parameters by training the data sample, automatically representing the service-location and the information transmitted thereby as a vector, and obtaining the probability distribution between the service-location, the information and the type; Step 5: inferring the type probability distribution of a new service-location by the model, and accurately classifying personal identification information.

2. The method of claim 1, wherein the information vector space model is based on a bag-of-words model. Step 1 comprises the following steps: Step 1.1: collecting traffic data from the network, and saving the traffic data in a PCAP format; Step 1.2: judging whether the selected data packet is an HTTP request field, and if so, extracting feature information by using a regular expression, otherwise judging the next data packet; Step 1.3: counting the frequency of the same field entries in the dataset; The text format data is preprocessed, and finally contains a sample space SampleSpace with four dimensions, SampleSpace={Domain, Key, Value, Frequency}; the feature information of the four dimensions can fully represent the network behavior characteristics of the user, and the specific meaning of the network behavior characteristics is that the user transmits different information Value at the same location Key when accessing the network service Domain, and the transmission frequency of each information is Frequency.

3. The method of claim 2, wherein the information vector space model is based on a bag-of-words model. The feature information is extracted in the following manner: Step 1.2.1: judging whether the information data packet contains a GET field of the HTTP protocol, and if so, extracting the feature information, otherwise selecting the next data packet; Step 1.2.2: slicing the GET field from left to right by using a "?" symbol, and selecting the part of the field before the "?" symbol as a service field, and selecting the part of the field after the "?" symbol as a key-value pair field preprocessed data; Step 1.2.3: extracting the domain name or service IP address in the service field obtained in step 1.2.2 according to a regular expression rule; Step 1.2.4: dividing the key-value pair field preprocessed data obtained in step 1.2.2 into a plurality of Key-Value data groups by using an "&" symbol.

4. The method of claim 1, wherein the information vector space model is based on a bag-of-words model. Step 2 comprises the following steps: Step 2.1: establishing a user behavior characteristic tree model according to the behavior characteristics of the user; wherein each user behavior characteristic tree takes the service-location Domain-Key as the root, the Domain-Key is abbreviated as DK, the information Value is a child node, the Value is abbreviated as V, and the frequency Frequency of each information transmission is a leaf node, indicating different information transmitted by the user at the service-location and the transmission frequency thereof; Step 2.2: If the several information Value transmitted in the same DK is regarded as a text data, the problem of personal identification information classification is described as: C=DKxV→Z:{TURE, FALSE}; where DK represents the service-locations that need to be classified, DK = {dk1, dk2,..., dk M}, dk M represents the Mth service-location dk; V represents the information, V = {v1, v2,..., v Nm}, v Nm represents the last specific information contained in v ij ; Z represents the type set under the predefined classification system, i.e. the personal identification information category set, Z = {z1, z2,..., z K}, z K represents the Kth type z; the TURE value represents that the document dk m belongs to the category z k for <dk m , z k >; the FALSE value represents that the document dk m does not belong to the category z k for <dk m , z k >. When the user accesses different services, the probability distribution of the type of personal identification information transmitted in different locations is given, so as to determine the type of information transmitted in the service-location.

5. The method of claim 1, wherein the method is based on an information vector space model. In step 3.1, the conditional probability is expressed in the form of matrix multiplication, as shown in equation 2: （2） Wherein, the C matrix on the left side of the equation represents the probability p(V|DK) of each information appearing in each service-location; On the right side of the equation, the Φ matrix represents the probability p(V|Z) of each information V appearing in each type Z; The Θ matrix represents the probability p(Z|DK) of each type Z appearing in each service-location DK.

6. The method of claim 1, wherein the method is based on an information vector space model. In step 3.2, the construction of the generation model includes the following steps: Step 3.2.1: ; The process represents generating the i-th service-location by first selecting a type for the i-th service-location from the Dirichlet prior parameters Randomly select DK i from the type probability distribution and then randomly select the type of the j-th information from the multinomial probability distribution ;​ Step 3.2.2: ; This process represents the generation of the j-th information transmitted in the i-th service-location. That is, from Dirichlet prior parameters Choose k= Multinomial probability distribution and from Randomly select transmission information ; Steps 3.2.1 and 3.2.2 are repeated to obtain the generated service- location dk m and all information transmitted therewith.

7. The method of claim 1, wherein the method is based on an information vector space model. Step 4 includes the following steps: Step 4.1 : Selecting a suitable type K, selecting suitable prior parameters ; Step 4.2: Randomly select a type number for each information in each service-location DK in the corpus C; Step 4.3: Re-search the corpus C, and use Gibbs sampling, as shown in equation 3: （3） where Z denotes the type of service-location, denotes the type of the jth information ; denotes the probability distribution of the overall type of all service-locations, denotes the probability distribution of the overall type of all service-locations; ¬(i,j) denotes the probability distribution of the type after removing the information ; , ) denotes the joint distribution, p( = k| ) is the conditional probability of the information corresponding to the type , k denotes the individual type; K denotes the total number of types; L denotes the total number of information entries in the corpus, and t denotes the number of information entries in the corpus; and are given prior parameters, and the goal is to obtain the probability distribution of and corresponding to and , respectively; denotes the Dirichlet prior parameter, denotes the Dirichlet prior parameter; ) denotes the number of information belonging to topic k in the ith row, ) denotes the number of entries belonging to the ith information; Then, update the type number of all information, and update the type number of the information in the corpus; Step 4.4: Repeat step 4.3 to perform Gibbs sampling based on the coordinate axis rotation until the Gibbs sampling converges; Step 4.5: Count the number of each type of information in all DKs in the corpus C, to get the distribution of each type in all DKs Step 4.6: Count the number of each type of information in all DKs in the corpus C, to get the distribution of each type in all DKs .

8. The method of claim 1, wherein the method is based on an information vector space model. Step 5 includes the following steps: Step 5.1: Randomly select a type Z for each information in the current service-location DK; Step 5.2: Re-search the current service-location DK, and update the type of each information therein by using Gibbs sampling; Step 5.3: Repeat step 5.2 to perform Gibbs sampling based on the coordinate axis rotation until the Gibbs sampling converges; Step 5.4: Count the types of information in each information of the service-location DK, and get the type distribution of the DK ; Step 5.5: In the parameter of type distribution of the resulting DK, take the type with the maximum probability to its specific type, accurate classification of personal identification information is completed.​

Images