A digital currency anonymous wallet tracing method based on traffic correlation analysis

Abstract

The present invention relates to a digital currency anonymous wallet tracing method based on traffic correlation analysis, and belongs to the field of blockchain technology. By establishing a sensitive transaction tracing model for anonymous wallets, a pioneering comprehensive analysis and processing is performed on cryptocurrency wallets protected by the Tor network, focusing on the correlation between the exit traffic and the entry traffic of the Tor network, the full transaction graph can be dynamically tracked and monitored for the address or behavior of interest, and the anonymous wallet traffic that carries out this behavior can be analyzed and traced, to prevent potential illegal behavior and protect privacy information. According to its digital currency transaction propagation mode, a probe node is introduced to continuously monitor the transactions sent by the target RPC server, and a rule matching mechanism is set, so that the transaction layer full transaction graph rules can be dynamically updated for sensitive transactions. This method can effectively reduce the interference of background traffic on anonymous wallet traffic.

Description

Technical Field

[0001] The present invention relates to a digital currency anonymous wallet tracing method based on flow correlation analysis, belonging to the technical field of blockchain. Background Art

[0002] The development of information technology has spawned a large number of anonymity technologies, which are used as privacy protection technologies in all aspects of life to protect people's privacy information. At present, there are two new technologies that can hide user identities: cryptocurrency and Tor network. Among them, cryptocurrency has attracted the attention of many parties due to its decentralized and anonymous characteristics. Due to the popularity of digital currency, its market value is rising day by day.

[0003] Similar to cryptocurrency, the Tor network also has two sides. Tor is an anonymous communication technology that uses a combination of technologies such as data forwarding, information encryption, and traffic obfuscation to hide the communication entity. Tor was proposed to protect the user's IP address and prevent the user's network layer privacy from being destroyed by traffic analysis technologies such as traffic filtering and sniffing analysis. Among the anonymization tools, Tor, as a veteran anonymous communication protocol network, has a daily proxy traffic of over TB. It uses a layered multi-level relay proxy forwarding mechanism to hide the real IP of users and servers, uses onion layered encryption and decryption to ensure the security of communication between users and servers, and uses public key address access to ensure the reliability of site pages. Tor uses a channel forwarding mechanism. The client will randomly select three relay nodes from the directory server, and then negotiate keys with these nodes in turn to establish a connection session. Before the client sends a data packet, the real data content is encrypted in layers and decrypted layer by layer during the forwarding process. The server is the same, and the two meet at the introduction node. Because the data is encrypted in layers during the transmission process, data security can be guaranteed. The relay does not know where it is located, and the address of the client and site server can ensure privacy.

[0004] Although there have been some works analyzing the abuse of Tor or digital currency, most of these studies only focus on digital currency or one technology in Tor, and very few focus on the combination of digital currency and Tor technologies. Summary of the invention

[0005] The purpose of the present invention is to creatively propose a digital currency anonymous wallet tracing method based on traffic correlation analysis in order to effectively solve the technical problem of anonymous wallet transaction tracing in view of the defects and shortcomings of the prior art.

[0006] The innovation of the present invention lies in: establishing a sensitive transaction tracing model Cryptocorr for anonymous wallets, conducting a pioneering comprehensive analysis and processing on cryptocurrency wallets protected by the Tor network, focusing on analyzing the correlation between the exit traffic and the entry traffic of the Tor network, being able to dynamically track and monitor the full transaction graph of the address or behavior of interest, and tracing the anonymous wallet traffic that conducts this behavior, preventing potential illegal behavior and protecting privacy information.

[0007] The present invention is implemented by the following technical means.

[0008] First, the probe nodes are used to match the rules of transactions in the network, select the transactions of interest, and dynamically update the rules.

[0009] After that, the ingress and egress traffic of the anonymous wallet is captured through the proxy method. On this basis, the traffic belonging to the anonymous wallet is screened out according to the destination IP and port of the captured traffic, as well as the MTU (Maximum Transmission Unit) occupancy rate and packet size distribution of the data packet frequency in the flow.

[0010] Finally, the correlation analysis of anonymous wallet traffic is completed through the deep learning model to achieve traceability.

[0011] Specifically, according to the digital currency wallet, the message propagation mechanism of digital currency and the working principle of Tor, a probe node is built to monitor transactions in the blockchain P2P network, and the outgoing connection is sent to the target RPC (Remote Process Call) server to monitor it. At the same time, the traffic characteristics are used to filter and extract the traffic of the anonymous wallet and perform correlation analysis.

[0012] Figure 1 The overall architecture and workflow of the sensitive transaction traceability model (Cryptocorr) proposed in the present invention are shown.

[0013] The data collection part includes three sets: Tor network inflow flow in , network outflow flow out , and the probe receives the transaction tx broadcast by the target RPC node recvd .

[0014] When network traffic is monitored or censored, flow in and flow out All can be saved for subsequent analysis.

[0015] When the transaction data collected by the probe node comes only from the target RPC node, the combination of the three provides conditions for the subsequent tracing of transaction information.

[0016] The collected network data traffic set is expressed as:

[0017] flow in|out ={packet1,packet2,…,packet n}

[0018] Among them, for each packet, its characteristics are expressed as: packet = {timestamp, source_ip, destination_ip, length, source_port, destination_port, protocol}, where timestamp represents the timestamp when the data packet is received, source_ip represents the initial sending IP address of the data packet, destination_ip represents the destination IP of the data packet, length represents the length of the data packet, source_port represents the originating port of the data packet, destination_port represents the destination port of the data packet, and protocol represents the protocol type parsed according to the payload content of the data packet.

[0019] When data is stored, the actual data load of the Tor network is encrypted and cannot be analyzed. When transmitting data packets in the Tor network, the network is designed to reduce latency and transmit efficiently as much as possible without confusing time and packet length characteristics. Therefore, the actual data load, which is large in size and of low analytical use, is ignored.

[0020] It is expensive to conduct traceability analysis for each transaction. Therefore, only sensitive transactions that users are interested in need to be analyzed, tracked and traced. A transaction is regarded as a state transfer function, with different state transitions for different digital currencies. For the state transition of the common UTXO (Unspend TranXtion Output) model, it is defined as Tx = {in_addrs, out_addrs, in_value, out_value}. For balance-based systems with smart contract support, the state transition is defined as Tx = {addr_from, addr_to, binary_inputdata, value, gas}. By matching with the pre-made rules Rules = {addrs, activity, value, ...}, and updating the full transaction graph of the rules, This will enable further automated tracking of subsequent transactions and better traceability of sensitive transaction entities.

[0021] After collecting traffic related to sensitive transactions, the collected data is usually very large. For traffic that needs to be analyzed in detail, define a time window to filter network data packets: W = {end_timestamp, window_size}, end_timestamp represents the timestamp when the peer node in the blockchain network receives the sensitive transaction, and window_size represents the window span determined by the transaction forwarding delay and network delay. The selection of the time window is related to the minimum number of valid data packets required for the subsequent model to carry out the association attack and the packet sending rate of the target wallet software.

[0022] By screening a large number of data packets, we can obtain the traffic that needs to be associated and belongs to the anonymous wallet. We further abstractly define the traffic, and for a flow, we define it as: T is the time feature, S is the size feature, u represents the upload traffic, and d represents the download traffic.

[0023] Specifically, a digital currency anonymous wallet tracing method based on traffic correlation analysis includes the following steps:

[0024] Step 1: Capture anonymous wallet traffic by deploying front-end proxy and transit proxy servers.

[0025] Since digital currency wallets are often personal devices with limited resources (smartphones, personal PCs, etc.), they do not store complete copies of transactions, but only the block header information of transactions. Therefore, when a user uses a digital wallet to initiate a transaction request, it is necessary to remotely request the blocks that may contain transactions from the full node of the blockchain to verify the transaction. After the verification is passed, the signed transaction is broadcast by the remote full node of the blockchain to other nodes in the network.

[0026] Using this transaction mechanism, this method sets up a front-end proxy client at the Tor network client traffic entrance of the anonymous wallet. The proxy client wraps the request data packet into a proxy data packet in a nested SSR proxy manner, and the target IP of the proxy data packet points to the remote transit proxy server. At the same time, the tcpdump software deployed in the front-end proxy client is used to capture the inlet traffic.

[0027] When the proxy data packet passes through the entry node, intermediate node and exit node of the Tor network in sequence, it will flow to the transit proxy server according to the target IP. After the transit proxy server verifies the received proxy data packet, it parses it to obtain the real destination, and then establishes a connection with the RPC server to complete the data exchange. At the same time, the tcpdump software deployed in the transit proxy client is used to capture the exit traffic. After that, the captured entry and exit traffic are transferred to the storage server.

[0028] The probe node interacts with the rule matching service to determine whether the association mechanism needs to be triggered. If not, it continues to monitor; if it needs to be triggered, the proxy server sends the traffic feature information set within the time window to the central computing server, and then updates the rules that need to be matched in the database according to the blockchain state changes generated by the transaction, realizing continuous full transaction graph tracking.

[0029] Step 2: Filter background traffic.

[0030] Specifically, step 2 may include the following steps:

[0031] Step 2.1: Time window combined with Tor Relay IP and port filtering.

[0032] The core idea of ​​filtering anonymous wallet traffic in a time window is: in order to meet the minimum number of valid data packets of the associated traffic in the third component, a time window is determined based on the packet sending frequency of the specific wallet software and the interactive activity of the address in the rule, so that the number of traffic packets generated by the anonymous wallet contained in this window interacting with the remote node meets the minimum number of packets required by the associated program. Based on this, the transaction traffic of the anonymous wallet that meets the quantity requirements is screened from the traffic within the time window.

[0033] Furthermore, since the transaction structure of mainstream digital currencies such as digital currency and Ethereum does not include transaction time. At the same time, the transaction time displayed in many blockchain browsers (such as btc.com, etherscan.io, etc.) is not the time when the transaction was created, but the time when the transaction was added to the node memory pool after being broadcast. Therefore, by deploying a full node and counting the time when the target transaction arrives at the node, the calculated transaction creation time can be made more accurate.

[0034] Specifically, the transaction is taken as the transaction time t tx When the probe node receives the transaction, it records the current time and first calculates the time window w:

[0035]

[0036] w end =ttx (2)

[0037]

[0038] in, Indicates the timestamp when the probe node receives the sensitive transaction, delay node is the intermediate delay of the full node broadcasting to each neighbor, flow rate is the heartbeat synchronization frequency of the anonymous wallet being analyzed, w end Indicates the end timestamp of the time window, w size Indicates the span of the time window, size flow Indicates the minimum number of packets required for network flow when performing traffic association. After calculating the time window, only the traffic data in the traffic window needs to be analyzed, thus reducing the workload of subsequent analysis.

[0039] After that, we obtain the active nodes published daily at UTC 0:00 from the Tor directory server (e.g. https: / / onionoo.torproject.org / details?search=flag:Guard%20running:true to obtain GuardRelay, https: / / onionoo.torproject.org / details?search=flag:Exit%20running:true to obtain ExitRelay), which contains comprehensive node information including IP address and port number. We use IP:PORT as a feature to filter Tor traffic that the user is interested in.

[0040] Step 2.2: Data stream feature screening.

[0041] After filtering in step 2.1, continue to count the flow.rate (i.e., the packet flow of the current network flow, in packets / second) of the traffic contained in this time window. Determine whether a certain flow is anonymous wallet traffic based on the volume distribution of the data packets and the proportion of the data packets that fill the RFC864 standard MTU.

[0042] Specifically, since the frequency of interaction between anonymous wallets and full nodes is much lower than the frequency of interaction between clients and servers for network activities such as browsing web pages and watching videos, the transaction traffic of encrypted wallets has a smaller flow rate, and the amount of data in one interaction is small. Based on this, data packets with a network data flow (flow_packet_rate) of 1.2 neighborhood, a small data packet ratio of 50% neighborhood, and less than 10% of data packets occupying the full MTU can be marked as encrypted wallet traffic. In addition, in order to alleviate the high noise caused by Tor network congestion and the high uncertainty of user interaction, a parameter N1 can be added to better cope with noise and wallet users who interact with RPC more frequently to avoid omissions.

[0043] Since the IP address and RPC interaction port of the RPC server to be monitored are known during the interaction, the required anonymous wallet egress traffic can be directly obtained. However, the Tor network traffic at the entrance is still huge, especially in the scenario of collecting traffic on the backbone network center switch in reality. Therefore, it is necessary to filter the anonymous wallet traffic at the entrance.

[0044] Therefore, by combining the time window with Tor Relay IP port filtering and data packet feature filtering, anonymous wallet traffic is successfully filtered out from background traffic. The filtered anonymous wallet data set will be used as the traffic to be analyzed for traffic correlation analysis.

[0045] Step 3: Correlation analysis and processing of Tor network inbound and outbound flows.

[0046] A deep convolutional neural network is used to correlate multiple anonymous wallet flows that have been screened out, with the goal of locating the real transaction initiator.

[0047] Since the encrypted traffic of anonymous wallets makes it impossible to analyze the data payload part of the traffic, the common traffic features in encrypted traffic analysis are used: packet time and packet size. Among them, the packet time feature uses the time interval between traffic packets (inter packet delay, IPD), and the packet size feature is the number of bytes contained in each traffic packet.

[0048] Specifically, according to the required features, the n selected streams are constructed into flow pairs. The flow pair is represented as:

[0049]

[0050] Among them, F i represents the ingress traffic into the Tor anonymous network, F jIt represents the egress traffic out of the Tor anonymous network. T represents IPD, S represents the number of bytes in the data packet, u represents the collected traffic is upload traffic, and d represents the collected traffic is download traffic.

[0051] In actual traffic distribution, the flow size of each flow or each time period is inconsistent. Therefore, only the first size flow If the number of packets in a flow does not reach size flow If the requirement is met, IPD and size are padded with 0. For example, the size here flow You can select 300.

[0052] In this step, a deep convolutional neural network is used to determine the correlation between the two streams. The entire system can be abstracted as: learning a correlation function Ψ(F i,j ), the input is the time features and size features of the two streams, and the output is the confidence p related to the two streams i,j .

[0053] During the training process, if you want to achieve better association results, the data set used for training needs to be consistent with the data set used in the target association scenario. The loss function for training uses the cross entropy function. Here, the cross entropy function of the standard binary classification is optimized and the weight attribute pos is introduced. weight , the corresponding proportion of penalty calculation is performed on the loss deviation of different classification situations:

[0054]

[0055] in, represents the loss function value, represents the flow as the flow pair of the training set, y i,j Indicates F i With F j The correlation of traffic, Ψ represents the confidence function learned by the model.

[0056] The convolutional structure of the network is flattened after two convolution pooling operations and sent to the fully connected network, and finally the relevant confidence is output.

[0057] Step 4: Repeat steps 1 to 3 until the IP address of the real transaction initiator of the entire event and the corresponding Tor exit traffic are successfully associated.

[0058] Beneficial Effects

[0059] In view of the close integration of Tor and digital currency wallet payments, this method innovatively proposes to continuously track and trace the entire transaction graph of the real digital currency transaction initiator by organically combining the traffic of anonymous wallets flowing through the Tor network and RPC probe nodes.

[0060] Compared with the prior art, this method has the following advantages:

[0061] 1. This method designs a sensitive transaction tracing model Cryptocorr for anonymous wallets, which can dynamically track and monitor the full transaction graph of the address or behavior of interest, and analyze the anonymous wallet traffic that performs this behavior. Use a proxy to collect the inlet and outlet traffic of the Tor circuit, purify and clean the traffic sent by the anonymous wallet to the remote RPC node, realize the screening and correlation analysis of the anonymous wallet traffic, and finally achieve the purpose of tracing.

[0062] 2. According to the digital currency transaction propagation model, the present invention introduces probe nodes to continuously monitor the transactions sent by the target RPC server, sets a rule matching mechanism, can dynamically update the transaction layer full transaction graph rules for sensitive transactions, and provides a method for defining the traffic time window of the transaction process.

[0063] 3. Aiming at the characteristics of digital currency traffic and Tor traffic, the present invention designs an anonymous wallet traffic identification method. The method can first remove non-Tor background traffic, and then mine and construct the characteristics of anonymous wallet traffic and conventional Tor Browser traffic so that they can be distinguished. The method can effectively reduce the interference of background traffic on anonymous wallet traffic.

[0064] 4. This paper takes electrum, a digital currency wallet with a built-in Tor proxy, as an example, and collects the transaction traffic generated by the wallet during the transaction process to construct a test set to verify the proposed model. The experimental results prove the effectiveness of the proposed model. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a schematic diagram of the learning member reasoning attack defense model of the method of the present invention.

[0066] Figure 2 It is a schematic diagram of the effect of the method of the present invention on distinguishing the data packet rate of anonymous wallet and ordinary Tor web browsing traffic.

[0067] Figure 3 It is a schematic diagram of the effect of distinguishing the MTU full rate of anonymous wallet and ordinary Tor web browsing traffic by the method of the present invention.

[0068] Figure 4 This is a diagram showing the effect of the network traffic correlation tracing analysis for anonymous wallets in the present invention. DETAILED DESCRIPTION

[0069] The following specifically describes the implementation process of the present invention in conjunction with the accompanying drawings and embodiments, and explains its advantages. It should be noted that the implementation of the present invention is not limited to the following embodiments, and any form of modification or change made to the present invention will fall within the scope of protection of the present invention.

[0070] Example

[0071] In this embodiment, a model of an attack method for de-anonymizing a digital currency wallet protected by Tor is established, such as Figure 1 shown.

[0072] Figure 1 This paper describes the federated learning member reasoning attack defense scenario. There are 5 servers in this scenario. One anonymous wallet software node and one central exchange router. Taking the Electrum wallet as an example, a probe node is built to monitor transactions in the blockchain P2P network and focus on sending outgoing connections to the target RPC server to monitor it. At the same time, the traffic characteristics are used to filter and extract the traffic of the anonymous wallet and perform correlation analysis. The first component is Data Collection, which realizes the Tor network inlet and outlet traffic collection function by deploying a front-end proxy at the entrance of the Tor client software of the anonymous wallet so that the traffic passes through the Tor network and directly reaches the transit proxy server. By deploying a probe node at a location close to the RPC node network and with a stable connection, it is made to send a CONN request to the target RPC server to establish an outgoing connection to receive transaction information in the blockchain network.

[0073] The proxy server in the first component will collect and store the network traffic flowing through. The probe node interacts with the second component to determine whether the association mechanism needs to be triggered. If not, it will continue to monitor. If it needs to be triggered, the proxy server will send the traffic feature information set in the time window to the central computing server. The flow set will then be provided to the second component for anonymous wallet traffic screening. Then, the rules that need to be matched in the database are updated according to the blockchain state changes generated by the transaction to achieve continuous chain tracking. The second component is Rules Match & Background traffic filtering. During the interaction with the first component, the component matches the rules of the transactions received by the probe node. If the transaction matches the address or call in the rule, the command to trigger the association is returned. In addition, the second component can extract the traffic belonging to the Tor network based on the IP address and port number of the Guard Node and Exit node records in the Tor directory server in the recent time (for example, within one day), and then filter the anonymous wallet traffic from the background traffic based on the port number, flow rate, the volume distribution law of the packet in the flow, and the MTU occupancy rate characteristics to form an encrypted wallet traffic data set. This data set will be provided to the third component for association analysis. The third component is Traffic correlation analysis, which can use the trained deep learning model to complete the correlation analysis of encrypted wallet traffic.

[0074] Relying on the above Figure 1 The model in the specific implementation of the method of the present invention includes the following steps:

[0075] Step 1: Actively initiate transactions in the test network and collect traffic-related information. The probe node can be used to complete the traffic interception of the data window. At the same time, build a traffic capture environment. Run the digital currency wallet software Electrum, deployed in the Windows operating system with an Intel Core i5-10210U CPU@1.60GHz and 16GB RAM configuration, which will fully meet the running configuration of the wallet software. Connect the wallet software to a proxy client running the ssr protocol, and then interact with the Tor network through a router running OpenWRT. The Proxy Server is deployed on Vultr with a 1-CoreAMD EPYC-Rome Processor, 1GB RAM and 25GB NVMe SSD. The probe node has an i7-4770 processor and 16G memory configuration. Traffic data can be collected into a pcap file.

[0076] Step 2: Filter the data flow of ordinary web browsing and the flow of anonymous wallets. It can be seen that there are significant differences in the flows in the two scenarios. Experiments have shown that all flows belonging to anonymous wallets can also be filtered out. The following two figures show the obvious differences in the number of packets changing over time and the volume distribution of the data flow of ordinary web browsing and the flow of anonymous wallets under the Tor network.

[0077] The number of uplink and downlink packets is counted over time when accessing web pages and RPC servers through Tor, as shown in the figure. Obviously, the packet growth rate when the wallet accesses the RPC server is much lower than when accessing the web page. This is understandable. When accessing a web page, the client and the server need to interact frequently to transmit the required text, pictures, audio and other resources. However, when the wallet accesses the RPC server, it only needs to transmit a small amount of text information related to the transaction.

[0078] The number of packets when the wallet software interacts with the RPC server through Tor shows a clear step-like distribution. This is because the wallet will periodically access the RPC server to query information such as the current block height, and also verify whether the RPC server is accessible. During the query period, the number of interactive packets will increase significantly, and there will be only a small number of communication packets at other times. Figure 2 shown.

[0079] By further counting the size distribution of downlink data packets when the wallet accesses the RPC server and the application accesses ordinary web pages, as shown in the figure, the flow generated when the wallet accesses the RPC server shows a clear small packet distribution. When Tor Browser accesses the web page, it shows a large packet distribution. Figure 3 shown.

[0080] When an application accesses a web page, the data packet usually reaches the MTU, and the MTU value setting is generally related to the router. 1500 is the most common value. Therefore, when accessing a web page, more than 35% of the data packets are 1500 in size. When a wallet accesses an RPC server through Tor, the most frequent interactive information is that the wallet queries the current block height and the RPC server returns the current status information. Therefore, less information is transmitted, and more than 40% of the data packets are less than 100 bytes in length.

[0081] The experimental results show that when accessing the RPC server through Tor and accessing ordinary web pages, there are obvious differences in the data flow in terms of packet growth rate and packet size distribution. Combined with the screening algorithm proposed in this invention, 82,077 anonymous wallet-related flows were screened out from the background flow.

[0082] Step 3: Use a deep convolutional network to perform correlation analysis on the collected ingress and egress traffic.

[0083] This type of correlation analysis performs correlation analysis on every two streams, and then inputs a similarity probability, which is called confidence. Figure 4 It is a hotspot map drawn based on confidence, with the horizontal axis representing the inlet flow and the vertical axis representing the outlet flow. The same sequence number represents the same flow. The results show that the correlation between the inlet flow and the outlet flow of the same flow is significantly higher than that of other flow pairs.

[0084] The above description describes the implementation mode of the present invention in combination with the drawings and embodiments. However, for those skilled in the art, several improvements can be made without departing from the principle of this patent, and these also belong to the scope of protection of this patent.

Claims

1. A digital currency anonymous wallet tracing method based on traffic correlation analysis, characterized in that: The following steps are involved: Step 1: Capture anonymous wallet traffic by deploying front-end proxy and transit proxy servers; Step 2: Filter background traffic, including the following steps: Step 2.1: Time window combined with Tor Relay IP and port filtering; In order to meet the minimum number of valid data packets of the associated traffic in the third component, a time window is determined based on the packet sending frequency of the wallet software and the interactive activity of the addresses in the rules, so that the number of traffic packets generated by the anonymous wallet contained in this window interacting with the remote node meets the minimum number of packets required by the associated program; from the traffic within the time window, the transaction traffic of the anonymous wallet that meets the quantity requirements is screened, and the full node is deployed and the time when the target transaction arrives at the node is counted; Take this transaction as transaction time t tx ; When the probe node receives the transaction, it records the current time and first calculates the time window w: w end =t tx (2) in, Indicates the timestamp when the probe node receives the sensitive transaction, delay node is the intermediate delay of the full node broadcasting to each neighbor, flow rate is the heartbeat synchronization frequency of the anonymous wallet being analyzed, w end Indicates the end timestamp of the time window, w size Indicates the span of the time window, size flow Indicates the minimum number of packets required for network flow when performing traffic association; after calculating the time window, analyze the traffic data in the traffic window; After that, we obtain the active nodes published at UTC 00:00 every day from the Tor directory server, which contains comprehensive node information including IP addresses and port numbers. We use IP:PORT as a feature to filter the Tor traffic that the user is interested in. Step 2.2: Data flow feature screening; After filtering in step 2.1, continue to count the flow.rate of the traffic contained in this time window, that is, the data packet flow of the current network flow, in packets / second. According to the volume distribution of the data packets and the proportion of the data packets occupying the RFC864 standard MTU, determine whether a certain flow is anonymous wallet traffic; then, filter the anonymous wallet traffic at the entrance; By combining the time window with Tor Relay IP port filtering and data packet feature filtering, anonymous wallet traffic is filtered out from background traffic. The filtered anonymous wallet data set is used as the traffic to be analyzed for traffic correlation analysis. Step 3: Correlation analysis and processing of Tor network inbound and outbound flows; Use deep convolutional neural networks to correlate the filtered anonymous wallet traffic; The common traffic features used in encrypted traffic analysis are packet time and packet size. The packet time feature uses the time interval IPD between traffic packets, and the packet size feature is the number of bytes contained in each traffic packet. According to the required characteristics, the n selected flows are constructed into flow pairs; where the flow pair is expressed as: Among them, F i represents the ingress traffic into the Tor anonymous network, F j Indicates the egress traffic out of the Tor anonymous network. T represents IPD, S represents the number of bytes in the data packet, u represents the collected traffic is upload traffic, and d represents the collected traffic is download traffic. Take the previous size flow If the number of packets in a flow does not reach size flow If required, fill IPD and size with 0; A deep convolutional neural network is used to determine the correlation between the two streams. The entire system is abstracted as: learning a correlation function Ψ(F i,j ), the input is the time features and size features of the two streams, and the output is the confidence p related to the two streams i,j ; During the training process, the training loss function uses the cross entropy function to optimize the standard binary cross entropy function and introduce the weight attribute pos weight , the corresponding proportion of penalty calculation is performed on the loss deviation of different classification situations: in, represents the loss function value, represents the flow as the flow pair of the training set, y i,j Indicates F i With F j The correlation of traffic, Ψ represents the confidence function learned by the model; The convolution structure of the network is flattened after two convolution poolings and sent to the fully connected network, and finally outputs the relevant confidence; Step 4: Repeat steps 1 to 3 until the IP address of the real transaction initiator of the entire event and the corresponding Tor exit traffic are successfully associated.

2. A digital currency anonymous wallet tracing method based on traffic correlation analysis as claimed in claim 1, characterized in that: In step 1, a front-end proxy client is set up at the Tor network client traffic entrance of the anonymous wallet. The proxy client wraps the request data packet into a proxy data packet in a nested SSR proxy manner. The target IP of the proxy data packet points to the remote transit proxy server. At the same time, the tcpdump software deployed in the front-end proxy client is used to capture the entrance traffic. When the proxy data packet passes through the entry node, intermediate node and exit node of the Tor network in sequence, it will flow to the transit proxy server according to the target IP; the transit proxy server verifies the received proxy data packet, parses it to get the real destination, and then establishes a connection with the RPC server to complete the data exchange; at the same time, the tcpdump software deployed in the transit proxy client is used to capture the exit traffic; Afterwards, the captured ingress and egress traffic is transferred to the storage server; The probe node interacts with the rule matching service to determine whether the association mechanism needs to be triggered; if not, it continues to monitor; if it needs to be triggered, the proxy server sends the traffic feature information set within the time window to the central computing server, and then updates the rules that need to be matched in the database according to the blockchain status changes generated by the transaction, thereby achieving continuous tracking of the entire transaction graph.

3. A digital currency anonymous wallet tracing method based on traffic correlation analysis as claimed in claim 1, characterized in that: In step 2, the data packets with a network data flow flow_packet_rate of 1.2 neighborhood, small data packets accounting for 50% neighborhood, and less than 10% of the data packets occupying the full MTU are marked as encrypted wallet traffic.

Images