Flow identification and association method based on multi-classification neural network model, anti-association analysis method and device

Abstract

The invention discloses a flow identification and association method based on a multi-classification neural network model, and an anti-association analysis method and device, and belongs to the field of network security, and the method comprises the steps: extracting non-association white noise from non-association flow through a mode of training the multi-classification neural network model; input traffic is processed by using a multi-classification neural network, an anonymous communication network category to which to-be-associated traffic belongs and a feature distance between the to-be-associated traffic and non-associated white noise are obtained at the same time, and then traffic identification and traffic association results are obtained at the same time. According to the method, the technical problem that the existing traffic identification and association model and algorithm cannot execute traffic identification and traffic association at the same time is solved, the technical problem that the existing traffic identification and association model and algorithm are not universal when executing traffic association tasks for different anonymous communication networks is solved, and meanwhile, a novel and universal technical scheme for anti-association analysis of the anonymous communication networks is provided.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more specifically, to a traffic identification and association method based on a multi-classification neural network model, and an anti-correlation analysis method and device. Background Art

[0002] Anonymous network traffic correlation is an important research direction in the field of network security. It refers to the analysis and correlation of traffic data generated in an anonymous network environment to identify and track the source and destination of data flows in the network. This process involves breaking or bypassing the anonymity of traffic to achieve tracking and auditing of network behavior. Anonymous network traffic correlation technology has application value in scenarios such as network attack tracing and malicious behavior tracking.

[0003] Existing anonymous network traffic association methods can be divided into statistics-based methods and model-based methods. They all need to abstract each data flow into a sequence of primitive features that describe the shape of the flow (e.g., sequence of packet size, time, direction, traffic bursts). Statistics-based methods use correlation coefficients or statistical distances to measure the similarity of inbound and outbound flow sequences. Flow pairs with the highest similarity are considered to be related. Model-based methods apply machine learning or deep learning models to associate data flows, directly putting inbound and outbound flow sequences together and inputting them into the model, and then training the model based on binary labels of "related" or "unrelated". A well-trained correlation model will output the correlation probability of the input flow pairs, and similarly, the flow pairs with the highest probability are considered to be related.

[0004] Since the anonymous communication related technologies were proposed, a large number of anonymous communication systems have been produced, including Tor, I2P, Freenet, NetCamo, Tarzan, etc. Among them, Tor, I2P, and Freenet account for about 90% of the entire market share. Since the official version of Tor was released in 2003, relying on the core technology "onion routing", it has become the most widely used and user-friendly low-latency anonymous communication system. Due to the highest utilization rate of the Tor network, traffic correlation technology has been basically based on the Tor network as a research object for a long time, making the attack model rigid and the input features limited. At present, the most advanced traffic correlation methods are generally only effective for Tor network traffic, such as Raptor by Sun et al., DeepCorr by Nasr et al., DeepCoFFEA by Oh et al., and sliding subset and traffic correlation methods by Lopes et al. At the same time, there are also a small number of traffic correlation methods for other specific categories of anonymous communication networks. In practice, the premise of using these methods is to first identify the category of the anonymous communication network used by the communication traffic to be associated, and then apply the corresponding traffic association method to perform the association action. This adds a traffic identification link to the traffic association task, thereby increasing the monitoring time requirement. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a traffic identification and association method, an anti-correlation analysis method and a device based on a multi-classification neural network model, which solves the technical problem that the existing traffic identification, association models and algorithms cannot simultaneously perform traffic identification and traffic association, and the technical problem that the existing traffic association models and algorithms cannot be universal when performing traffic association tasks for different anonymous communication networks, and at the same time provides a novel and universal anonymous communication network anti-correlation analysis technical solution.

[0006] The object of the present invention is achieved through the following solutions:

[0007] A traffic identification and association method based on a multi-classification neural network model includes the following steps:

[0008] The common basic characteristics of traffic that has no communication relationship with each other in various anonymous communication networks are regarded as non-correlated white noise;

[0009] Then, by training a multi-classification neural network model, non-correlated white noise is extracted from non-correlated traffic to achieve the extraction of non-correlated common features; by using a multi-classification neural network to process the input traffic, the anonymous communication network category to which the intended associated traffic belongs and the characteristic distance from the non-correlated white noise are obtained at the same time, thereby obtaining the traffic identification and traffic association results at the same time.

[0010] Furthermore, the generation training of the multi-classification neural network model includes the following sub-steps:

[0011] S1, builds a communication dataset containing multiple types of anonymous communication traffic;

[0012] S2, organizes the communication data set into non-associated traffic and associated traffic;

[0013] S3, constructing a structured non-correlated data set from the non-correlated traffic information;

[0014] S4, selects a multi-classification neural network model for traffic correlation problems;

[0015] S5, training a multi-classification neural network model based on the non-correlated data set.

[0016] Furthermore, in step S1, the construction of a communication data set containing multiple types of anonymous communication traffic specifically includes the following sub-steps:

[0017] First, establish a pair of communication sources and communication targets that use different types of anonymous communication networks for communication; a communication source communicates with a communication target only through one type of anonymous communication network;

[0018] Then construct multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks; set up sending-end monitoring and receiving-end monitoring facilities between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, respectively, to realize the monitoring and collection of the communication source traffic and the communication target traffic; collect all the collected communication pair traffic to form a communication data set.

[0019] Furthermore, in step S2, the communication data set is sorted into non-associated traffic and associated traffic, specifically including sub-steps:

[0020] In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic;

[0021] Then, the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is non-associated traffic; wherein, when constructing the non-communication group, the communication source traffic in the communication group is paired with all communication target traffic except the communication target that communicates with the communication source to form a non-communication group.

[0022] Furthermore, in step S3, the step of constructing a structured non-correlated data set from the non-correlated traffic information specifically includes the following sub-steps:

[0023] Non-correlated traffic information is extracted from non-correlated traffic to construct a structured non-correlated data set; the extracted traffic information is used as input information for executing traffic correlation operations, and the extracted traffic information is organized in a structured manner while retaining the original non-correlated pairings to form a structured non-correlated data set.

[0024] Further, in step S4, the multi-classification neural network model is selected for the traffic association problem, specifically including the following sub-steps:

[0025] Taking various anonymous communication network types as different categories, the goal is to identify the type of anonymous communication network used by the input non-associated traffic pairs.

[0026] Furthermore, in step S5, the multi-classification neural network model is trained based on the non-correlated data set, specifically including the sub-steps of:

[0027] The input data is prepared by extracting non-correlated traffic information sequences from structured non-correlated data sets as input data for the model;

[0028] The model calculates the output of the input data through a multi-classification neural network operation and outputs the probability of different anonymous communication networks that may be used;

[0029] The cross entropy loss function is a loss function used to measure the difference between the predicted probability distribution and the true probability distribution. It can also represent the confidence of the classifier in the classification when performing classification. The smaller the loss function, the stronger the confidence.

[0030] Parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

[0031] Furthermore, the method extracts non-correlated white noise from non-correlated traffic by training a multi-classification neural network model to extract non-correlated common features; processes input traffic by using a multi-classification neural network to simultaneously obtain the anonymous communication network category to which the intended associated traffic belongs and the characteristic distance from the non-correlated white noise, thereby simultaneously obtaining traffic identification and traffic association results, specifically including the following sub-steps:

[0032] Step 1), collecting the traffic data of both parties to be associated: collecting the traffic of the communication source and the communication target to be analyzed for traffic association through monitoring facilities;

[0033] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the multi-classification neural network;

[0034] Step 3), using the multi-classification neural network model to calculate each classification probability: input the constructed traffic information sequence of the communication source and the communication target into the trained multi-classification neural network model, and obtain each classification probability through the calculation of the model. The output data represents the classification result of the model on the input data;

[0035] Step 4), traffic identification by classification probability: traffic identification is performed based on the classification results output by the multi-classification neural network; the category with the highest classification probability is selected as the identification result, and it is considered that the traffic to be associated uses the anonymous communication network of this category for communication;

[0036] Step 5), using the input and output data to calculate the loss value based on the cross entropy loss function: the loss value of the model output data is calculated based on the cross entropy loss function; the calculation method of the loss function is consistent with the calculation method of the loss function used in the training stage of the multi-classification neural network; by calculating the loss function, the loss value is obtained;

[0037] Step 6) Identify the correlation by determining whether the loss value is greater than the judgment threshold: compare the calculated loss value with the preset judgment threshold; if the loss value is greater than the threshold, it means that the multi-classification neural network classifier has insufficient confidence in this sub-classification, further indicating that the deviation of the proposed associated traffic from the non-associated white noise is large, and it is determined to be "associated"; if the loss value is less than the threshold, it means that the multi-classification neural network classifier has sufficient confidence in this sub-classification, further indicating that the deviation of the proposed associated traffic from the non-associated white noise is small, and it is determined to be "unassociated".

[0038] An anti-correlation analysis method based on a multi-classification neural network model, comprising:

[0039] Step 1), collecting traffic data of both communicating parties: in the selected anonymous communication network, collecting traffic data of the communication source and the communication target with known communication relationship; monitoring the sending / receiving traffic of the communication source and the receiving / sending traffic of the communication target respectively through the monitoring facilities of the sending end and the receiving end;

[0040] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the multi-classification neural network;

[0041] Step 3), using the multi-classification neural network model to calculate each classification probability: input the constructed traffic information sequence of the communication source and the communication target into the trained multi-classification neural network model, and obtain each classification probability through the calculation of the model. The output data represents the classification result of the model on the input data;

[0042] Step 4), using the input and output data to calculate the loss value based on the cross entropy loss function: the loss value of the model output data is calculated based on the cross entropy loss function; the calculation method of the loss function is consistent with the calculation method of the loss function used in the training stage of the multi-classification neural network; by calculating the loss function, the loss value is obtained;

[0043] Step 5), using the loss value to mark the anti-correlation ability of the anonymous communication network: the loss value is used as an anti-correlation index; the smaller the loss value, the stronger the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is smaller, and the anti-correlation ability is better; the larger the loss value, the worse the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is greater, and the anti-correlation ability is weaker.

[0044] A traffic identification and association device based on a multi-classification neural network model, characterized in that it includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, any of the methods described above is executed.

[0045] An anti-correlation analysis device based on a multi-classification neural network model comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method described above is executed.

[0046] The beneficial effects of the present invention include:

[0047] The present invention solves the technical problem that existing traffic identification, association models and algorithms cannot perform traffic identification and traffic association at the same time, and the technical problem that existing traffic association models and algorithms cannot be universal when performing traffic association tasks for different anonymous communication networks. At the same time, a novel and universal anonymous communication network anti-correlation analysis technology is provided. The "non-correlated white noise" in this method refers to the common basic characteristics between traffic that has no communication relationship with each other in various anonymous communication networks. The present invention builds non-correlated white noise based on the characteristics of multiple types of anonymous communication traffic, calculates the characteristic distance between the proposed associated communication traffic and the non-correlated white noise, and uses threshold comparison and reverse judgment to identify the correlation, thereby obtaining a general traffic correlation method with cross-anonymous network categories; extracts non-correlated white noise from non-correlated traffic by training a multi-classification neural network, realizes the high-dimensional and automatic extraction of non-correlated common features, improves the accuracy of non-correlated white noise extraction, and also ensures the operability of the method; by using a multi-classification neural network to process the input traffic, the anonymous communication network category to which the proposed associated traffic belongs and the characteristic distance with the non-correlated white noise can be obtained at the same time, and then the traffic identification and traffic correlation results can be obtained at the same time, which gives the method versatility, saves the intermediate links of traffic correlation work, and reduces the task execution cost. Furthermore, the size of the characteristic distance between the known associated traffic with communication relationship and the non-correlated white noise in a specific anonymous communication network can characterize the strength of the anti-correlation ability of the anonymous communication network, and becomes a novel, cross-network category general anonymous communication network anti-correlation analysis technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0049] Figure 1 Generate training steps for multi-classification neural network models;

[0050] Figure 2 Collect samples for various types of anonymous communication traffic;

[0051] Figure 3 A method for obtaining non-associated traffic;

[0052] Figure 4 It is a general framework for multi-classification neural network models;

[0053] Figure 5 Train a multi-classification neural network to calculate the loss function;

[0054] Figure 6 It is a flow chart of traffic identification and association based on multi-classification neural network model;

[0055] Figure 7 To obtain traffic categories and associated results through probability comparison and threshold determination;

[0056] Figure 8 It is a flowchart of anti-correlation evaluation based on multi-classification neural network model;

[0057] Fig. 9 The loss value is used to indicate the quality of anti-correlation. DETAILED DESCRIPTION

[0058] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0059] The specific implementation process of the present invention is as follows:

[0060] The technical solution of the present invention includes three aspects: generation and training technology of multi-classification neural network model, traffic identification and association technology based on multi-classification neural network model, and anti-association evaluation technology based on multi-classification neural network model. The details are as follows:

[0061] 1. Generation and training technology of multi-classification neural network model:

[0062] The generation and training steps of the multi-classification neural network model are as follows Figure 1 shown.

[0063] The following steps are included in sequence:

[0064] 1) Construct a communication dataset containing various types of anonymous communication traffic

[0065] The present invention co-constructs non-correlated white noise based on the characteristics of multiple types of anonymous communication traffic, so it is necessary to construct a communication data set containing multiple types of anonymous communication traffic. To construct a communication data set, it is first necessary to build a communication source and a communication target pair that use different types of anonymous communication networks for communication. A communication source only communicates with a communication target through one anonymous communication network. Construct multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks. Between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, set the sending end monitoring and receiving end monitoring facilities respectively to realize the monitoring and collection of the communication source traffic and the communication target traffic. Collect all the collected communication pair traffic to form a communication data set.

[0066] Figure 2 The figure shows a variety of anonymous communication traffic collection examples. The figure shows a variety of anonymous communication networks including but not limited to Tor, I2P and Freenet. Each anonymous communication network has several communication sources and communication targets. The communication source using Tor communication is represented by t 1 to n , the communication target is denoted as T 1 To T n The communication source using I2P communication is denoted as i 1 to i n , the communication target is represented as I 1 to I n The communication source using Freenet communication is denoted as f 1 to f n , the communication target is denoted as F 1 To F n These communication sources and communication targets communicate one-to-one through their respective anonymous communication networks. For example, the communication source t 1 Communicate with target T through Tor network 1 To communicate, the communication source i 1 Communicate with target I through I2P network 1 To communicate, the communication source f 1 Communication target F through Freenet network 1 to communicate.

[0067] In each communication pair, a sending-end monitoring facility and a receiving-end monitoring facility are respectively set between the communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target. These monitoring facilities are used to collect the traffic of the communication source and the traffic of the communication target. Specifically, the sending-end monitoring facility monitors the sending / receiving traffic of the communication source, while the receiving-end monitoring facility monitors the receiving / transmitting traffic of the communication target. Through these monitoring facilities, comprehensive communication data can be collected to construct a communication data set containing multiple types of anonymous communication traffic.

[0068] The construction process of this communication dataset ensures that the traffic characteristics of each anonymous communication network are accurately captured, thus providing a solid data foundation for the subsequent generation of uncorrelated white noise.

[0069] 2) Organize the communication data set into non-correlated traffic and related traffic

[0070] In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic; then the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is the non-associated traffic. When constructing a non-communication group, the communication source traffic in the communication group is paired with all the communication target traffic except the communication target that communicates with the communication source, forming a non-communication group.

[0071] Figure 3 The method of dividing non-communication groups to obtain non-correlated traffic is shown. Each communication group (such as t 1 -T 1 ,t 2 -T 2 , ...) are matched with their corresponding communication target flows to form associated flows. When constructing a non-communication group, for example, the communication source t 1 The traffic will be transmitted to all other communication targets T 2 ...T n ,I 1 ...I n 、F 1 ...F n The traffic of each node is paired separately to form non-correlated traffic. All non-correlated traffic is constructed in this way. This method can generate a large amount of non-correlated traffic, providing a rich data source across anonymous network types for the construction of non-correlated white noise.

[0072] 3) Constructing a structured non-correlated dataset from non-correlated traffic information

[0073] Extract non-correlated traffic information from non-correlated traffic to construct a structured non-correlated data set. The extracted traffic information is the input information for performing traffic correlation operations, including but not limited to packet size sequence, packet timestamp sequence, packet direction sequence, etc. The extracted traffic information is organized in a structured manner while retaining the original non-correlated pairing to form a structured non-correlated data set.

[0074] Table 1 shows an example of a structured non-correlated dataset. In the table, C1 represents traffic feature 1 (e.g., packet size), C2 represents traffic feature 2 (e.g., packet timestamp), u identifies traffic as uplink, and d identifies traffic as downlink. Each row in the table represents a non-correlated pairing, e.g., communication source t 1 and communication target T 2 Constitute a non-associated pairing. Correspondingly, the communication source t 1 The flow information sequence is recorded as [C1 t1 u ; C1 t1 d; C2 t1 u ; C2 t1 d ], communication target T 2 The flow information sequence is recorded as [C1 T2 u ; C1 T2 d ; C2 T2 u ; C2 T2 d ]. Each traffic information sequence contains the packet size and timestamp information for both the uplink and downlink directions. By structuring these traffic information, the non-correlated datasets can be easily used for training and testing subsequent multi-classification neural network models.

[0075] Table 1: Examples of structured non-associative datasets

[0076]

[0077]

[0078] 4) Selecting a multi-classification neural network model for traffic correlation problems

[0079] The multi-classification problem is a common problem in machine learning and deep learning, and the goal is to assign given input data to one of multiple possible categories. Multi-classification models usually output the probability distribution of each category, and then select the category with the highest probability as the prediction result. In the present invention, various anonymous communication network types are used as different categories, and the goal is to identify the type of anonymous communication network used by the input non-associated traffic. The present invention uses a multi-classification neural network to solve the multi-classification problem.

[0080] Select a suitable multi-classification neural network model, including but not limited to convolutional neural networks, recurrent neural networks, and composite structures and variants of various neural networks. Figure 4 The general framework of the multi-classification neural network model shown in the figure abstracts the common elements and processes of the general multi-classification neural network, including the input layer, feature extractor, and output layer. Each module can be concretized according to the specific model selection and requirements to build a multi-classification neural network model suitable for specific applications.

[0081] For example, for an ordinary convolutional neural network, the feature extractor includes convolutional layers, pooling layers, flattening layers, fully connected layers, etc.; the output layer outputs the probability that the input instance belongs to a certain category.

[0082] 5) Training a multi-classification neural network model based on a non-correlated dataset

[0083] Based on the constructed structured non-correlated data set, the selected multi-classification neural network model is trained. The training process is generally divided into the following steps: input data preparation, model calculation output, cross entropy loss function calculation, and parameter adjustment. The relationship between the steps is as follows: Figure 5 As shown in the figure. The input data is prepared by extracting a sequence of non-correlated traffic information from a structured non-correlated data set as the input data of the model; the model calculates the output of the input data through a multi-classification neural network operation to output the probability of different anonymous communication networks that may be used; the cross entropy loss function E(p 1 ,p 2 ,...p n ) is a loss function used to measure the difference between the predicted probability distribution and the true probability distribution. It can also characterize the confidence of the classifier in the classification when performing classification. The smaller the loss function, the stronger the confidence. Parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

[0084] For example, a convolutional neural network can be selected as a multi-classification neural network. The cross entropy is used as the loss function, and the calculation formula is:

[0085]

[0086] Where N is the number of separable categories, p i is the returned probability for the i-th predicted class. A classifier that is confident in its decision gives high probabilities to each predicted class, thus minimizing the cross entropy.

[0087] When adjusting the parameters of the neural network through the back-propagation algorithm to minimize the loss function, the network weights can be updated using stochastic gradient descent (SGD) or other optimization algorithms, such as the Adam optimizer. During the training process, the training data set is used for multiple iterations. In each iteration, a batch of non-correlated traffic pairs is input into the model, the loss is calculated, and the parameters are updated. The above process is repeated until the model converges, that is, the loss function no longer decreases significantly.

[0088] 2. Traffic identification and association technology based on multi-classification neural network model:

[0089] The traffic identification and association process based on the multi-classification neural network model is as follows: Figure 6 shown.

[0090] The following steps are included in sequence:

[0091] 1) Collect traffic data of both parties to be associated

[0092] The monitoring facility is used to collect the traffic of the communication source and the communication target for traffic correlation analysis. The sending end monitoring facility is responsible for monitoring the sending / receiving traffic of the communication source, and the receiving end monitoring facility is responsible for monitoring the receiving / sending traffic of the communication target, ensuring that the traffic data of both parties of the communication is fully and accurately captured.

[0093] 2) Construct the communication source flow information sequence and the communication target flow information sequence

[0094] The collected traffic data of the communication source and the communication target are organized into a traffic information sequence. The traffic information sequence should be consistent with the content and format of the traffic information sequence in the structured non-associative data set used in the training phase of the multi-classification neural network.

[0095] For example, if the traffic information sequence of the communication source in the structured non-associative dataset is recorded as [C1 tn u ; C1 tn d ; C2 tn u ; C2 tn d ], the traffic information sequence of the communication target is recorded as [C1 TN u ; C1 TN d ; C2 TN u ; C2 TN d ], C1 represents traffic feature 1 (e.g., packet size), C2 represents traffic feature 2 (e.g., packet timestamp), u indicates that the traffic is uplink, and d indicates that the traffic is downlink. In this step, the collected traffic data of the communication source and communication target should also be organized into the same content and format as the above traffic information sequence.

[0096] 3) Use the multi-classification neural network model to calculate the probability of each classification

[0097] The constructed traffic information sequence of the communication source and communication target is input into the trained multi-classification neural network model, and the classification probability is obtained through the calculation of the model. The output data represents the classification result of the model on the input data.

[0098] For example, the trained multi-classification neural network is a convolutional neural network, then the traffic information sequence to be associated [C1 tn u ; C1 tn d ; C2 tn u ; C2 tn d ] and [C1TN u ; C1 TN d ; C2 TN u ; C2 TN d ] Input the convolutional neural network and get the classification result: p 1 =0.6, indicating that the probability of Tor network is 60%; p 2 =0.2, indicating that the I2P network probability is 20%; p 3 =0.2, indicating that the probability of Freenet network is 20%.

[0099] 4) Traffic identification by classification probability

[0100] Traffic identification is performed based on the classification results output by the multi-classification neural network. The category with the highest classification probability is selected as the identification result, and it is considered that the traffic to be associated uses the anonymous communication network of this category for communication.

[0101] For example, if the classification result is: p 1 =0.6, indicating that the probability of Tor network is 60%; p 2 =0.2, indicating that the I2P network probability is 20%; p 3 =0.2, indicating that the probability of Freenet network is 20%. Then it is determined that the traffic to be associated belongs to Tor network traffic.

[0102] 5) Use input and output data to calculate the loss value based on the cross entropy loss function

[0103] The loss value of the model output data is calculated based on the cross entropy loss function. The calculation method of the loss function should be consistent with the calculation method of the loss function used in the training phase of the multi-classification neural network. By calculating the loss function, the loss value is obtained.

[0104] For example, the calculation formula of the cross entropy loss function selected in the training stage is The output of the multi-classification neural network is: p 1 =0.6, p 2 =0.2, p 3 =0.2, then the loss value calculated in this step is

[0105] 6) Identify the correlation by determining whether the loss value is greater than the judgment threshold

[0106] Compare the calculated loss value with the preset judgment threshold. If the loss value is greater than the threshold, it means that the multi-classification neural network classifier has insufficient confidence in this sub-classification, which further indicates that the deviation of the proposed associated traffic from the non-associated white noise is large, so it is judged as "associated"; if the loss value is less than the threshold, it means that the multi-classification neural network classifier has sufficient confidence in this sub-classification, which further indicates that the deviation of the proposed associated traffic from the non-associated white noise is small, so it is judged as "unassociated". In this way, the multi-classification neural network model is used to identify the traffic correlation between the communication source and the communication target. Figure 7 The process of achieving traffic identification through probability comparison and obtaining correlation results through threshold judgment of cross entropy loss value is demonstrated.

[0107] For example, if the calculated loss value between the input and the output is 0.5 and the preset threshold is 0.1, since 0.5 is greater than 0.1, the proposed associated traffic is determined to be associated.

[0108] 3. Anti-correlation evaluation technology based on multi-classification neural network model:

[0109] The anti-correlation evaluation process based on the multi-classification neural network model is as follows: Figure 8 shown.

[0110] The following steps are included in sequence:

[0111] 1) Collect traffic data of both parties in communication

[0112] In a specific anonymous communication network, the traffic data of the communication source and the communication target with known communication relationship is collected. Through the sending and receiving end monitoring facilities, the sending / receiving traffic of the communication source and the receiving / receiving traffic of the communication target are monitored respectively.

[0113] For example, collect traffic data of known communication pairs t1 and T1 in the Tor network, and record the size, timestamp, and direction information of their sent / received data packets.

[0114] 2) Construct the communication source flow information sequence and the communication target flow information sequence

[0115] The collected traffic data of the communication source and the communication target are organized into a traffic information sequence. The traffic information sequence should be consistent with the content and format of the traffic information sequence in the structured non-associative data set used in the training phase of the multi-classification neural network.

[0116] For example, if the traffic information sequence of the communication source in the structured non-associative dataset is recorded as [C1 tn u ; C1 tn d ; C2 tn u ; C2tn d ], the traffic information sequence of the communication target is recorded as [C1 TN u ; C1 TN d ; C2 TN u ; C2 TN d ], C1 represents traffic feature 1 (such as packet size), C2 represents traffic feature 2 (such as packet timestamp), u indicates that the traffic is uplink, and d indicates that the traffic is downlink. In this step, the collected traffic data of the communication source and communication target should be sorted into [C1 t1 u ; C1 t1 d ; C2 t1 u ; C2 t1 d ] and [C1 T1 u ; C1 T1 d ; C2 T1 u ; C2 T1 d ].

[0117] 3) Use the multi-classification neural network model to calculate the probability of each classification

[0118] The constructed traffic information sequence of the communication source and communication target is input into the trained multi-classification neural network model, and the classification probability is obtained through the calculation of the model. The output data represents the classification result of the model on the input data.

[0119] For example, the trained multi-classification neural network is a convolutional neural network, then the traffic information sequences [C1 t1 u ; C1 t1 d ; C2 t1 u ; C2 t1 d ] and [C1 T1 u ; C1 T1 d ; C2 T1 u ; C2 T1 d ] Input the convolutional neural network and get the classification result: p 1 =0.6, indicating that the probability of Tor network is 60%; p 2=0.2, indicating that the I2P network probability is 20%; p 3 =0.2, indicating that the probability of Freenet network is 20%.

[0120] 4) Use input and output data to calculate the loss value based on the cross entropy loss function

[0121] The loss value of the model output data is calculated based on the cross entropy loss function. The calculation method of the loss function should be consistent with the calculation method of the loss function used in the training phase of the multi-classification neural network. By calculating the loss function, the loss value is obtained.

[0122] For example, the calculation formula of the cross entropy loss function selected in the training stage is The output of the multi-classification neural network is: p 1 =0.6, p 2 =0.2, p 3 =0.2, then the loss value calculated in this step is

[0123] 5) Using loss value to mark the anti-correlation ability of anonymous communication network

[0124] The loss value is used as an anti-correlation indicator. The smaller the loss value, the stronger the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is smaller, and the anti-correlation ability is better; the larger the loss value, the worse the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is greater, and the anti-correlation ability is weaker. In this way, the anti-correlation of a specific anonymous communication network can be evaluated. Because different anonymous communication networks are compared with the same non-correlated white noise, this technology provides a universal anti-correlation evaluation scheme across network categories. Fig. 9 The advantages and disadvantages of using loss value to mark anti-correlation are demonstrated.

[0125] For example, if t1 and T1 use the Tor network to communicate with a loss value of 0.03, and another pair of communication t2 and T2 use the I2P network to communicate with a loss value of 0.07, then the traffic characteristics of t1 and T1 are closer to non-correlated white noise, indicating that the Tor network has a stronger anti-correlation ability.

[0126] It should be noted that within the scope of protection defined in the claims of the present invention, the following embodiments can be combined and / or expanded or replaced in any logical way from the above specific implementation methods, such as disclosed technical principles, disclosed technical features or implicitly disclosed technical features.

[0127] Example 1

[0128] A traffic identification and association method based on a multi-classification neural network model includes the following steps:

[0129] The common basic characteristics of traffic that has no communication relationship with each other in various anonymous communication networks are regarded as non-correlated white noise;

[0130] Then, by training a multi-classification neural network model, non-correlated white noise is extracted from non-correlated traffic to achieve the extraction of non-correlated common features; by using a multi-classification neural network to process the input traffic, the anonymous communication network category to which the intended associated traffic belongs and the characteristic distance from the non-correlated white noise are obtained at the same time, thereby obtaining the traffic identification and traffic association results at the same time.

[0131] Example 2

[0132] Based on Example 1, the generation training of the multi-classification neural network model includes the following sub-steps:

[0133] S1, builds a communication dataset containing multiple types of anonymous communication traffic;

[0134] S2, organizes the communication data set into non-associated traffic and associated traffic;

[0135] S3, constructing a structured non-correlated data set from the non-correlated traffic information;

[0136] S4, selects a multi-classification neural network model for traffic correlation problems;

[0137] S5, training a multi-classification neural network model based on the non-correlated data set.

[0138] Example 3

[0139] On the basis of Example 1, in step S1, the construction of a communication data set containing multiple types of anonymous communication traffic specifically includes the following sub-steps:

[0140] First, establish a pair of communication sources and communication targets that use different types of anonymous communication networks for communication; a communication source communicates with a communication target only through one type of anonymous communication network;

[0141] Then construct multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks; set up sending-end monitoring and receiving-end monitoring facilities between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, respectively, to realize the monitoring and collection of the communication source traffic and the communication target traffic; collect all the collected communication pair traffic to form a communication data set.

[0142] Example 4

[0143] On the basis of Embodiment 1, in step S2, the communication data set is sorted into non-associated traffic and associated traffic, specifically including sub-steps:

[0144] In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic;

[0145] Then, the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is non-associated traffic; wherein, when constructing the non-communication group, the communication source traffic in the communication group is paired with all communication target traffic except the communication target that communicates with the communication source to form a non-communication group.

[0146] Example 5

[0147] On the basis of Example 1, in step S3, the step of constructing a structured non-correlated data set from the non-correlated traffic information specifically includes the following sub-steps:

[0148] Non-correlated traffic information is extracted from non-correlated traffic to construct a structured non-correlated data set; the extracted traffic information is used as input information for executing traffic correlation operations, and the extracted traffic information is organized in a structured manner while retaining the original non-correlated pairings to form a structured non-correlated data set.

[0149] Example 6

[0150] On the basis of Example 1, in step S4, the multi-classification neural network model is selected for the traffic association problem, specifically including the following sub-steps:

[0151] Taking various anonymous communication network types as different categories, the goal is to identify the type of anonymous communication network used by the input non-associated traffic pairs.

[0152] Example 7

[0153] On the basis of Example 1, in step S5, the multi-classification neural network model is trained based on the non-correlated data set, specifically including the sub-steps of:

[0154] The input data is prepared by extracting non-correlated traffic information sequences from structured non-correlated data sets as input data for the model;

[0155] The model calculates the output of the input data through a multi-classification neural network operation and outputs the probability of different anonymous communication networks that may be used;

[0156] The cross entropy loss function is a loss function used to measure the difference between the predicted probability distribution and the true probability distribution. It can also represent the confidence of the classifier in the classification when performing classification. The smaller the loss function, the stronger the confidence.

[0157] Parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

[0158] Example 8

[0159] On the basis of Example 1, the method extracts non-correlated white noise from non-correlated traffic by training a multi-classification neural network model to extract non-correlated common features; by using a multi-classification neural network to process input traffic, the anonymous communication network category to which the intended associated traffic belongs and the characteristic distance from the non-correlated white noise are obtained, thereby obtaining traffic identification and traffic association results at the same time, specifically including the following sub-steps:

[0160] Step 1), collecting the traffic data of both parties to be associated: collecting the traffic of the communication source and the communication target to be analyzed for traffic association through monitoring facilities;

[0161] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the multi-classification neural network;

[0162] Step 3), using the multi-classification neural network model to calculate each classification probability: input the constructed traffic information sequence of the communication source and the communication target into the trained multi-classification neural network model, and obtain each classification probability through the calculation of the model. The output data represents the classification result of the model on the input data;

[0163] Step 4), traffic identification by classification probability: traffic identification is performed based on the classification results output by the multi-classification neural network; the category with the highest classification probability is selected as the identification result, and it is considered that the traffic to be associated uses the anonymous communication network of this category for communication;

[0164] Step 5), using the input and output data to calculate the loss value based on the cross entropy loss function: the loss value of the model output data is calculated based on the cross entropy loss function; the calculation method of the loss function is consistent with the calculation method of the loss function used in the training stage of the multi-classification neural network; by calculating the loss function, the loss value is obtained;

[0165] Step 6) Identify the correlation by determining whether the loss value is greater than the judgment threshold: compare the calculated loss value with the preset judgment threshold; if the loss value is greater than the threshold, it means that the multi-classification neural network classifier has insufficient confidence in this sub-classification, further indicating that the deviation of the proposed associated traffic from the non-associated white noise is large, and it is determined to be "associated"; if the loss value is less than the threshold, it means that the multi-classification neural network classifier has sufficient confidence in this sub-classification, further indicating that the deviation of the proposed associated traffic from the non-associated white noise is small, and it is determined to be "unassociated".

[0166] Example 9

[0167] An anti-correlation analysis method based on a multi-classification neural network model, comprising:

[0168] Step 1), collecting traffic data of both communicating parties: in the selected anonymous communication network, collecting traffic data of the communication source and the communication target with known communication relationship; monitoring the sending / receiving traffic of the communication source and the receiving / sending traffic of the communication target respectively through the monitoring facilities of the sending end and the receiving end;

[0169] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the multi-classification neural network;

[0170] Step 3), using the multi-classification neural network model to calculate each classification probability: input the constructed traffic information sequence of the communication source and the communication target into the trained multi-classification neural network model, and obtain each classification probability through the calculation of the model. The output data represents the classification result of the model on the input data;

[0171] Step 4), using the input and output data to calculate the loss value based on the cross entropy loss function: the loss value of the model output data is calculated based on the cross entropy loss function; the calculation method of the loss function is consistent with the calculation method of the loss function used in the training stage of the multi-classification neural network; by calculating the loss function, the loss value is obtained;

[0172] Step 5), using the loss value to mark the anti-correlation ability of the anonymous communication network: the loss value is used as an anti-correlation index; the smaller the loss value, the stronger the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is smaller, and the anti-correlation ability is better; the larger the loss value, the worse the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is greater, and the anti-correlation ability is weaker.

[0173] Example 10

[0174] A traffic identification and association device based on a multi-classification neural network model includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method described in any one of Examples 1 to 8 is executed.

[0175] Embodiment 11

[0176] An anti-correlation analysis device based on a multi-classification neural network model includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method described in Example 9 is executed.

[0177] The units involved in the embodiments of the present invention may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, limit the units themselves.

[0178] According to one aspect of an embodiment of the present invention, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in the above various optional implementations.

[0179] As another aspect, an embodiment of the present invention further provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

Claims

1. A traffic identification and association method based on a multi-classification neural network model, characterized in that: The following steps are involved: The common basic characteristics of traffic that has no communication relationship with each other in various anonymous communication networks are regarded as non-correlated white noise; Then, by training a multi-classification neural network model, non-correlated white noise is extracted from non-correlated traffic to achieve the extraction of non-correlated common features; by using a multi-classification neural network to process the input traffic, the anonymous communication network category to which the intended associated traffic belongs and the characteristic distance from the non-correlated white noise are obtained at the same time, thereby obtaining the traffic identification and traffic association results at the same time.

2. The traffic identification and association method based on a multi-classification neural network model according to claim 1 is characterized in that: The generative training of the multi-classification neural network model includes the following sub-steps: S1, builds a communication dataset containing multiple types of anonymous communication traffic; S2, organizes the communication data set into non-associated traffic and associated traffic; S3, constructing a structured non-correlated data set from the non-correlated traffic information; S4, selects a multi-classification neural network model for traffic correlation problems; S5, training a multi-classification neural network model based on the non-correlated data set.

3. The traffic identification and association method based on a multi-classification neural network model according to claim 1 is characterized in that: In step S1, the construction of a communication data set containing multiple types of anonymous communication traffic specifically includes the following sub-steps: First, establish a pair of communication sources and communication targets that use different types of anonymous communication networks for communication; a communication source communicates with a communication target only through one type of anonymous communication network; Then construct multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks; set up sending-end monitoring and receiving-end monitoring facilities between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, respectively, to realize the monitoring and collection of the communication source traffic and the communication target traffic; collect all the collected communication pair traffic to form a communication data set.

4. The traffic identification and association method based on a multi-classification neural network model according to claim 1 is characterized in that: In step S2, the communication data set is sorted into non-associated traffic and associated traffic, specifically including sub-steps: In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic; Then, the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is non-associated traffic; wherein, when constructing the non-communication group, the communication source traffic in the communication group is paired with all communication target traffic except the communication target that communicates with the communication source to form a non-communication group.

5. The traffic identification and association method based on a multi-classification neural network model according to claim 1 is characterized in that: In step S3, the step of constructing a structured non-correlated data set from the non-correlated traffic information specifically includes the following sub-steps: Non-correlated traffic information is extracted from non-correlated traffic to construct a structured non-correlated data set; the extracted traffic information is used as input information for executing traffic correlation operations, and the extracted traffic information is organized in a structured manner while retaining the original non-correlated pairings to form a structured non-correlated data set.

6. The traffic identification and association method based on a multi-classification neural network model according to claim 1 is characterized in that: In step S4, the multi-classification neural network model is selected for the traffic association problem, which specifically includes the following sub-steps: Taking various anonymous communication network types as different categories, the goal is to identify the type of anonymous communication network used by the input non-associated traffic pairs.

7. The traffic identification and association method based on a multi-classification neural network model according to claim 1 is characterized in that: In step S5, the multi-classification neural network model is trained based on the non-correlated data set, specifically including the sub-steps of: The input data is prepared by extracting non-correlated traffic information sequences from structured non-correlated data sets as input data for the model; The model calculates the output of the input data through a multi-classification neural network operation and outputs the probability of different anonymous communication networks that may be used; The cross entropy loss function is a loss function used to measure the difference between the predicted probability distribution and the true probability distribution. It can also represent the confidence of the classifier in the classification when performing classification. The smaller the loss function, the stronger the confidence. Parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

8. The traffic identification and association method based on a multi-classification neural network model according to claim 1 is characterized in that: The method extracts non-correlated white noise from non-correlated traffic by training a multi-classification neural network model, thereby extracting non-correlated common features; and uses a multi-classification neural network to process input traffic, thereby obtaining the anonymous communication network category to which the intended associated traffic belongs and the characteristic distance from the non-correlated white noise, thereby obtaining traffic identification and traffic association results at the same time. Specifically, the method includes the following sub-steps: Step 1), collecting the traffic data of both parties to be associated: collecting the traffic of the communication source and the communication target to be analyzed for traffic association through monitoring facilities; Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the multi-classification neural network; Step 3), using the multi-classification neural network model to calculate each classification probability: input the constructed traffic information sequence of the communication source and the communication target into the trained multi-classification neural network model, and obtain each classification probability through the calculation of the model. The output data represents the classification result of the model on the input data; Step 4), traffic identification by classification probability: traffic identification is performed based on the classification results output by the multi-classification neural network; the category with the highest classification probability is selected as the identification result, and it is considered that the traffic to be associated uses the anonymous communication network of this category for communication; Step 5), using the input and output data to calculate the loss value based on the cross entropy loss function: calculating the loss value of the model output data based on the cross entropy loss function; The calculation method of the loss function is consistent with the calculation method of the loss function used in the training stage of the multi-classification neural network; by calculating the loss function, the loss value is obtained; Step 6) Identify the correlation by determining whether the loss value is greater than the judgment threshold: compare the calculated loss value with the preset judgment threshold; if the loss value is greater than the threshold, it means that the multi-classification neural network classifier has insufficient confidence in the sub-classification, further indicating that the deviation of the proposed associated traffic from the non-associated white noise is large, and it is determined to be "associated"; if the loss value is less than the threshold, it means that the multi-classification neural network classifier has sufficient confidence in the sub-classification, further indicating that the deviation of the proposed associated traffic from the non-associated white noise is small, and it is determined to be "unassociated".

9. An anti-correlation analysis method based on a multi-classification neural network model, characterized in that: include: Step 1), collecting traffic data of both communicating parties: in the selected anonymous communication network, collecting traffic data of the communication source and the communication target with known communication relationship; monitoring the sending / receiving traffic of the communication source and the receiving / sending traffic of the communication target respectively through the monitoring facilities of the sending end and the receiving end; Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the multi-classification neural network; Step 3), using the multi-classification neural network model to calculate each classification probability: input the constructed traffic information sequence of the communication source and the communication target into the trained multi-classification neural network model, and obtain each classification probability through the calculation of the model. The output data represents the classification result of the model on the input data; Step 4), using the input and output data to calculate the loss value based on the cross entropy loss function: Calculate the loss value of the model output data based on the cross entropy loss function; The calculation method of the loss function is consistent with the calculation method of the loss function used in the training stage of the multi-classification neural network; by calculating the loss function, the loss value is obtained; Step 5), using the loss value to mark the anti-correlation ability of the anonymous communication network: the loss value is used as an anti-correlation index; the smaller the loss value, the stronger the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is smaller, and the anti-correlation ability is better; the larger the loss value, the worse the confidence of the multi-classification neural network classifier in the sub-classification, indicating that the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise is greater, and the anti-correlation ability is weaker.

10. A traffic identification and association device based on a multi-classification neural network model, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method according to any one of claims 1 to 8 is executed.

11. An anti-correlation analysis device based on a multi-classification neural network model, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method according to claim 9 is executed.

Images