Network traffic confrontation defense method based on heuristic ant colony optimization

Abstract

The invention discloses a network flow confrontation defense method based on heuristic ant colony optimization, and belongs to the technical field of network security and privacy protection. According to the method, a self-adaptive disturbance generation strategy is designed according to spatial and temporal features of a network traffic trajectory, a disturbance injection rule meeting real-time constraint and direction consistency is established, an integrated substitution model is constructed, a feature fusion mechanism of spatial convolution, time sequence circulation and noise reduction coding is used, and a traffic fingerprint identification model with strong generalization ability is generated. An improved ant colony optimization algorithm is adopted to improve the disturbance search capability, and a batch processing method and a universal patch scoring mechanism are integrated to improve the defense universality of samples among different network flows. The method can be directly applied to a black box scene of real-time communication, gradient information or white box access permission of a target model is not needed, the attack recognition suppression rate exceeding 90% is achieved when only 20% of bandwidth overhead is increased, defense universality and deployment feasibility are remarkably improved, and meanwhile disturbance overhead is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of website fingerprint attack defense in the network field, and particularly to a network traffic comparison defense method based on heuristic ant colony optimization. Background Art

[0002] In recent years, more and more people have started using privacy-enhanced communication tools, such as Tor (The Onion Router), to cope with the increasing threats of network monitoring and censorship. Tor protects user privacy by establishing a path consisting of three nodes between the user and the server. On this path, fixed-size data packets (called cells) are encrypted and transmitted, and no single node can know the identities of both the user and the server at the same time. However, relevant research has shown that local eavesdroppers can attempt to undermine privacy protection by launching website fingerprinting attacks (WF).

[0003] Website fingerprinting attack is a method of inferring sensitive information by analyzing the communication patterns of encrypted traffic. Early methods matched the characteristics of encrypted traffic by maintaining a fingerprint database. Such fingerprint database-based methods achieved certain results in the early stage. However, with the rapid growth of network traffic, maintaining such a large fingerprint database is not only costly but also the recognition effect gradually declines.

[0004] With the rise of machine learning technology, the focus of website fingerprinting attack methods has gradually shifted from building fingerprint databases to training classifier models, mainly divided into traditional machine learning methods and deep learning methods. Traditional machine learning methods usually extract features such as packet size, time series, and direction sequence from encrypted traffic, and then transform these raw features into higher-level information through manually designed statistical features (such as mean, variance, etc.). Subsequently, they are input into models such as support vector machines (SVM) and Bayesian classifiers for training. Compared with the early methods, this traditional machine learning-based recognition method reduces the cost of maintaining a large database to a certain extent and improves the recognition accuracy by adding high-level feature information. However, the recognition ability of the model depends on the manually designed feature information. If the feature extraction design is poor, the recognition effect will also decline significantly. In addition, traditional machine learning models also have relatively limited learning capabilities.

[0005] In recent years, the development of deep learning technology has promoted the further evolution of website fingerprint attacks. Deep neural network (DNN) models can directly extract high-level feature information from raw fingerprint features and establish a mapping relationship with website categories. Compared with traditional machine learning methods, deep learning methods do not require manual feature design and have stronger adaptability. Moreover, as the depth of the model increases, deep learning models also perform better in terms of recognition accuracy and robustness against attacks. On this basis, Sirinam et al. found through research that website fingerprint recognition models mainly rely on direction information for recognition and can achieve a recognition accuracy of 98% using direction information. Therefore, most current DNN-based recognition models use direction information to model Tor traffic, including two forms: direction sequence or burst sequence, and are used to analyze web page types.

[0006] Direction sequence modeling takes the cell as the basic unit, where each cell represents the transmission direction of a data packet. Red upward data packets are represented by +1, and green downward data packets are represented by -1. Burst sequence modeling takes the burst as the basic unit, and one or more consecutive cells in the same direction are defined as a burst. The size of the burst is represented by the number of data packets, and the plus or minus sign represents the upward or downward direction.

[0007] The main challenges in currently introducing adversarial samples into the network domain to counter network fingerprint attacks are as follows: (1) It is difficult to generate effective defense perturbations in scenarios where the attack model is unknown (black-box scenarios). Currently, the defense methods in black-box scenarios mainly include three categories: regularization, heuristic algorithms, and generative adversarial networks. However, the regularization algorithm has high overhead; heuristic algorithms are prone to falling into local extrema, resulting in unsatisfactory defense effects; and generative adversarial networks are prone to gradient disappearance during training with large amounts of data, leading to perturbation failures. In addition, the current approach for black-box scenarios is to generate perturbations for a certain local surrogate model and migrate them to other models, but this approach is easily affected by the overfitting phenomenon of a single model, resulting in the inability to effectively apply the perturbations to other attack models. Therefore, there is still a vast research space for generating efficient and strongly migratory adversarial perturbations in black-box scenarios; (2)Existing perturbation insertion schemes have deficiencies in terms of real-time performance and directional constraints, limiting their practicality. Most schemes use bursts as the basic unit of perturbation. However, due to the indivisibility of bursts, defenders need to collect complete website traffic data before they can calculate and add perturbations, making it difficult to meet the real-time response requirements of interactive websites. Although some schemes have designed methods of injecting virtual packets based on packets or fixed time units to try to solve the real-time problem, they have not fully considered the directional constraints of network data packets. For example, when using the method of inserting virtual data packets to implement perturbations, if the direction of the inserted virtual data packets is inconsistent with the direction of the original traffic, artificial delays are needed to split the burst to maintain the coherence of transmission. However, such delays will not only increase additional network overhead but may also have a negative impact on user experience and system performance; (3)Existing research has limitations in the generality of perturbations, resulting in relatively high overall overhead. Perturbation overhead includes not only the direct resource consumption of adding perturbations but also the additional transmission and computational overhead caused by perturbations. Currently, most perturbation methods are designed for specific websites or single traffic characteristics. Although they can improve the defense effect against a single target, in practical applications, network traffic is diverse. Customizing perturbations for each website or traffic individually is neither practical nor will cause huge overhead. Therefore, a general perturbation method is needed that can be applied to a wide range of network scenarios without relying on specific traffic characteristics, thereby improving the applicability of perturbations in large-scale network flows. Summary of the Invention

[0008] In view of the above deficiencies in the prior art, the present invention proposes a network traffic adversarial defense method based on heuristic ant colony optimization. This method is an optimization algorithm constructed based on the ant colony algorithm in a black-box scenario, so it is named the adversarial ant (HAAD). The present invention is based on an integrated surrogate model, which improves the perturbation migration ability and the effectiveness of perturbations in the black-box scenario; it improves the ant colony algorithm with multi-agent cooperation ability, enhances the search ability for the optimal perturbation solution, and generates more effective perturbations; the present invention also proposes a direction constraint mechanism to ensure the integrity of network flows, meeting the requirements of directional constraints and perturbation real-time performance; through the TopK general perturbation algorithm, a patch scoring mechanism is designed to evaluate and select the generality of the patch, that is, the insertion position and the number of inserted data packets, and the TopK selection mechanism is used to select the K patches with the highest scores to improve the generality of perturbations.

[0009] The specific technical solution of the present invention is as follows: The present invention provides a network traffic adversarial defense method based on heuristic ant colony optimization, including the following steps: Step S1. Construct a spatio-temporal perturbation constraint system for network traffic: Define the spatio-temporal characteristics of the original traffic trajectory through the direction sequence modeling paradigm, and establish a perturbation injection rule that meets real-time constraints and direction consistency; Step S2. Train an integrated surrogate model: Construct a deep neural network architecture for multi-feature extraction, and generate a traffic fingerprint recognition model with strong generalization ability through the feature fusion mechanism of spatial convolution, temporal recurrence, and denoising coding; Step S3. Generate an adaptive adversarial perturbation vector: Based on the improved ant colony optimization algorithm, select patches through the pheromone probability selection strategy and the roulette method selection mechanism to construct a dynamic perturbation vector, and perform pheromone update to achieve dynamic optimization of the virtual packet defense ability; Step S4. Implement a generalization perturbation migration strategy: Adopt a batch processing method combined with a patch scoring mechanism based on the defense success rate to improve the defense generality of samples among different network traffics.

[0010] Preferably, the specific method of step S1 includes: S11. Construction of the direction sequence modeling paradigm: Encode the direction of network traffic packets into a discrete numerical sequence, where packets from the client to the server are marked as +1, and packets from the server to the client are marked as -1, thereby defining the spatio-temporal characteristics of the original traffic trajectory; S12. Establishment of the direction consistency rule: Constrain the direction of the inserted virtual packets to be synchronized with the original traffic direction to avoid the generation of conflict packets resulting in transmission delay; S13. Establishment of real-time constraints: Define that the perturbation rule vector consists of multiple patches, each patch is characterized by (p, η), where p identifies the insertion position of the virtual packet, and η quantifies the insertion quantity. Insert the virtual packet at the target position through the perturbation rule vector, without waiting for the complete transmission of the network flow. Only need to complete the insertion operation at the corresponding position to add perturbations, thereby meeting the real-time constraint requirements.

[0011] Preferably, the virtual packet in S13 is an empty packet sent by the client or the server, or a copy of the previous sent packet.

[0012] Furthermore, the input form of the spatio-temporal perturbation constraint system for network traffic in step S1 is to define the direction sequence modeling paradigm; Furthermore, the virtual packet in S13 of step S1 is implemented on a P4 switch; Preferably, the specific method of step S2 includes: S21. Construct a deep neural network architecture: Integrate the Var-CNN spatial convolution model, the LSTM temporal recurrence model, and the SDAE denoising coding model to extract and generate spatial features, temporal features, and denoising features respectively; S22. Design a feature fusion mechanism and generate an identification model: Adopt a weighted feature fusion method based on fully connected layers to adaptively adjust the weights of different features, and generate a traffic fingerprint identification model in which the feature fusion ability and the model decision-making ability are enhanced synergistically.

[0013] Further, the Var-CNN model in the integrated surrogate model described in step S2 is an architecture based on the convolutional neural network (CNN) framework and has a leading attack performance. The LSTM and SDAE models are based on the models described in the Rimmer paper. Further, the Var-CNN in the integrated surrogate model described in step S2 can extract spatial features from spatial information through convolution. The LSTM extracts temporal features from sequence data using a three-gate design, while the SDAE reconstructs samples in the encoding layer and extracts effective denoising features.

[0014] Further, by integrating the features of three different types of models, the integrated surrogate model described in step S2 can classify samples from multiple dimensions, and thus obtain more accurate results. When generating effective perturbations specifically for the integrated model, the generated perturbations can directly affect multiple effective features of the input samples, thereby improving the transferability of the perturbations.

[0015] Further, the specific operations of the feature fusion mechanism described in step S2 include: performing weighted fusion on the output features of each base model; aggregating the fusion features through a fully connected layer; and outputting the final classification decision based on the aggregation result.

[0016] Preferably, the specific method of step S3 includes: S31. Patch probability calculation: Calculate the probability of each patch being selected according to the pheromone concentration level. S32. Patch selection: According to the pheromone concentration and the local defense effect, apply the roulette wheel selection mechanism to select patches, retain the randomness characteristics of the selection process, and combine and construct a dynamic perturbation vector δ. S33. Patch injection: Map the dynamic perturbation vector δ to the original traffic trajectory according to the perturbation injection rule generated in step S1 to form a perturbed network traffic trajectory. S34. Pheromone update: Input the perturbed network traffic trajectory into the integrated surrogate model, and update the pheromone concentration without gradient according to the defense success result to guide the iterative optimization of the subsequent patch search direction.

[0017] Preferably, the calculation process of the patch probability includes: transforming the task of searching for perturbations into the process of searching for different patches in the perturbations; quantifying and recording the global defense effectiveness of each patch through the pheromone concentration; and providing a convergence direction guidance when the ant agent performs local patch search to enhance the stability of the defense strategy.

[0018] Preferably, the specific method of selecting patches using the roulette wheel selection mechanism includes: calculating the cumulative value of each patch probability as the cumulative probability; generating a uniformly distributed random number within [0, 1]; traversing the patch list, and when it is detected that the cumulative probability of a certain patch first exceeds the random number, selecting this patch as the i-th element and adding it to the dynamic perturbation vector; repeating the execution until Q patches are cumulatively selected to form a complete dynamic perturbation vector.

[0019] Preferably, the pheromone is a global pheromone, which is calculated by taking the average of the sum of pheromones of all ant agents.

[0020] Furthermore, the S31 patch probability calculation in step S3 is to ensure that the search process meets two necessary conditions: First, it must have sufficient randomness to jump out of local extrema; Second, the search needs to have a directional strategy guidance, otherwise it will lead to inconsistent results. To meet these two requirements, we transform the task of finding perturbations into a process of searching for different patches in the perturbation space. During this process, pheromones are used to record the global defense effect of patches. When numerous ant agents conduct local searches, this mechanism provides them with a clear guiding direction, thus making the defense results more stable.

[0021] Moreover, using multiple ant agents combined with the roulette wheel method to explore different patches, compared with the single-agent method, this group exploration method not only ensures sufficient randomness but also expands the exploration space through collaborative search. This design can not only effectively avoid falling into local optimal solutions but also significantly improve the search efficiency and the reliability of the defense strategy.

[0022] Furthermore, during the S31 patch probability calculation in step S3, to search for patches with good defense effects, it is necessary to calculate the search probability of each possible patch. The probability calculation of each ant's search process is described by the following formula: ; where, represents the probability of selecting a patch with a value of (where p is the injection position and η is the number of injected data packets); represents the pheromone associated with the patch (all pheromone values are initialized to 1 to ensure equal search directions for all patches during the initial search); N represents the maximum number of injected data packets; α represents the weight control parameter of the pheromone; β represents the weight control parameter of the number of inserted data packets; M represents the maximum insertion position of the data packets; This probability formula indicates that for a given patch, the algorithm will preferentially select the patch with a higher pheromone concentration and a lower data packet injection volume. This preference mechanism will significantly increase the probability value of this patch being selected. Therefore, the search direction is more likely to converge towards the current dominant patch, making the subsequent selection process more guiding and effective.

[0023] Furthermore, the S32 patch selection mechanism in step S3 aims to introduce randomness in the search results to avoid falling into local extrema. After precisely calculating the probability of each patch, a roulette wheel-based selection strategy is adopted to construct the perturbation vector: First, accurately calculate the cumulative probability of each patch; Second, generate a random number uniformly distributed within the interval [0,1]; When the cumulative probability of a certain patch first exceeds this random number, this patch is selected and added as the i-th element to the perturbation vector; Repeat the above process until Q patches are selected, thus completing the construction of the entire perturbation vector. The patch selection mechanism based on cumulative probability is highly efficient, avoiding the high computational complexity and complex evaluation process of traditional exhaustive search, and significantly reducing the computational overhead. At the same time, the built-in randomness mechanism enables the perturbation vector to explore a wider range of solution space possibilities, effectively preventing the search process from falling into local optimal solutions and enhancing the robustness and execution efficiency of the overall solution by increasing the diversity of solutions.

[0024] Furthermore, after completing a perturbation injection, the S34 pheromone update in step S3 needs to evaluate all patches in the current perturbation to update the pheromone and guide the search direction of subsequent ants. The specific pheromone update formula is as follows: ; In the formula, represents a batch of data containing multiple samples x. The function applies the current perturbation to . The number of misclassified samples in the prediction results of the i-th ant is denoted as and is calculated by comparing the prediction results with the original labels using the L0 norm ; ; In the formula, represents the pheromone of the i-th ant, and is the decay rate of the previous pheromone. The formula indicates that the more misclassified samples there are, the higher the pheromone concentration. Therefore, future ants are more likely to explore stronger defense patches in this direction.

[0025] ​​Since the pheromone of a single ant cannot provide meaningful guidance, the global pheromone should reflect the sum of the pheromones of all ants; the global pheromone is calculated by the following formula: ; In the formula, the pheromones of all ants are averaged to obtain the new global pheromone . The updated global pheromone will guide the ants to determine the next perturbation.

[0026] Preferably, the specific method of step S4 includes: S41. Batch processing: A batch processing mechanism is adopted to synchronously process multiple original traffic trajectories, and by combining different input samples into the same batch, the algorithm can cover a wider data distribution in each iteration; S42. Generalization scoring mechanism: After the batch processing step, a patch scoring mechanism is introduced. Based on the defense success rate of the candidate patch within the current batch, the generalization score is calculated. A high-scoring patch indicates excellent defense performance or stable performance in multi-batch defenses, with strong generalization; S43. TopK selection mechanism: The generalization of the perturbation is improved by screening the top K patches with the highest scores.

[0027] Furthermore, the batch processing in step S4 integrates a batch processing mechanism in the HAAD algorithm, enabling multiple traffic trajectories to be processed simultaneously during each perturbation generation process; this operation reduces the algorithm overhead caused by processing only a single trajectory each time and improves the generalization of the generated perturbation; in addition, aggregating different input samples into one batch allows the algorithm to come into contact with a wider data distribution in each iteration; therefore, the ant-based optimization process can more effectively access the global data pattern, reduce the sensitivity to abnormal inputs, and enhance the stability of the learning process.

[0028] Furthermore, the generalization scoring in step S4 introduces a patch scoring mechanism based on the defense success rate after batch processing to improve the generalization of the generated perturbation. Specifically, the defense effect of each candidate patch is evaluated by calculating its success rate in the current batch. The higher the score, the more excellent the defense performance of the patch in this batch, or the more frequently it appears in multiple batches, indicating stronger generalization. This scoring method can effectively improve the generalization of the evaluated patches. Finally, multiple patches with the highest scores are selected to form the final general perturbation vector.

[0029] Furthermore, the patch scoring mechanism based on the defense success rate in step S4 is implemented by constructing a perturbation unit effectiveness evaluation function.

[0030] Furthermore, the patch scoring mechanism described in step S4 is implemented by the TopK universal perturbation algorithm, which evaluates and selects the general performance of the patches, i.e., the insertion positions and the number of inserted data packets, and uses the TopK selection mechanism to select the top K patches with the highest scores to improve the perturbation universality.

[0031] The present invention also provides an application based on the above-mentioned traffic adversarial defense method, which deploys the method to a P4 switch and conducts tests in a Tor network environment for a network security defense platform.

[0032] Furthermore, to verify the deployability of the defense method, it is implemented on a P4 platform and tested in a Tor network environment. The experimental results show that the defense method can achieve nearly 90% defense effect with only 20% network overhead.

[0033] The beneficial technical effects of the present invention are as follows: (1) To solve the difficulty of perturbation generation in the black-box scenario, the present invention proposes an adversarial ant heuristic algorithm based on an integrated surrogate model. First, a surrogate model integrating multiple recognition models is constructed, and then an improved adversarial ant algorithm based on the ant colony algorithm is applied to solve the problem on the surrogate model. Each ant maintains a perturbation solution according to the shared pheromone table and collects the feedback information of the perturbation solution in each iteration to update the public pheromone, thereby guiding the next solution. Through this method, each solution can perform a global search based on the shared information, and at the same time, use the local information of the solution space of a single ant to ensure local optimality. It not only avoids the problem of traditional heuristic algorithms falling into local extrema but also effectively solves the problem of perturbation generation in the black-box scenario. (2) To maintain the directional constraint and real-time performance of network flows, the present invention improves the perturbation insertion scheme and proposes a direction constraint mechanism. By generating a perturbation sequence to guide the insertion positions and the number of virtual packets, the perturbation can be completed without waiting for the full data packet sequence to be loaded, thus meeting the real-time requirements. To ensure that the network flow remains intact after the perturbation is added, a constraint function is used to stipulate that the insertion direction of each packet must be the same as that of the previous packet, thereby ensuring that the complete network flow burst is not split and avoiding additional network overhead. (3) To solve the overhead problem caused by insufficient perturbation universality in existing research, the present invention proposes a universal perturbation algorithm. The algorithm adopts a topk scoring mechanism to screen the universal perturbations effective for all network flows. In each iteration, the weighted scores of the perturbation sequence insertion points of each ant are calculated to evaluate its perturbation effect on the current traffic. At the same time, the number of data packets at the same insertion position is selected with a certain probability. When all samples are iterated, the top k insertion positions with the highest scores and the current inserted data packet number are selected as the universal perturbations, thereby solving the problem of insufficient perturbation universality in existing research. Description of the Drawings

[0034] Figure 1 It is a schematic flow chart of the network traffic countermeasure and defense method based on heuristic ant colony optimization proposed by the present invention; Figure 2 It is a schematic flow chart of the perturbation generation algorithm proposed by the present invention; Figure 3 It is a schematic flow chart of the generalized perturbation algorithm proposed by the present invention. Detailed implementation manners

[0035] The present invention will be specifically described below in conjunction with the accompanying drawings and embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0036] Embodiment 1: This embodiment provides a network traffic countermeasure and defense method based on heuristic ant colony optimization. The specific process is as Figure 1 shown, including the following steps: Step S1, construct a network traffic spatio-temporal perturbation constraint system: define the spatio-temporal characteristics of the original traffic trajectory through the direction sequence modeling paradigm, and establish a perturbation injection rule that satisfies real-time constraints and direction consistency; Construction of the direction sequence modeling paradigm: encode the direction of network traffic data packets into a discrete numerical sequence, where the data packets from the client to the server are marked as +1, and the data packets from the server to the client are marked as -1, so as to define the spatio-temporal characteristics of the original traffic trajectory; Establishment of the direction consistency rule: constrain the direction of the inserted virtual data packet to be synchronized with the original traffic direction to avoid the generation of conflict packets resulting in transmission delay; Establishment of real-time constraints: define that the perturbation rule vector is composed of multiple patches, each patch is characterized by (p, η), where p identifies the insertion position of the virtual data packet, and η quantifies the insertion quantity. Insert the virtual data packet at the target position through the perturbation rule vector, without waiting for the complete network flow transmission to complete, and only need to complete the insertion operation at the corresponding position to add perturbations, thereby meeting the requirements of real-time constraints.

[0037] In this embodiment, the specific implementation steps include: (1) Obtain the original network flow; (2) Encode the network flow according to the direction sequence modeling paradigm; (3) Generate a general perturbation through the defense algorithm (in the subsequent steps, the general perturbation will be calculated by applying the direction consistency rule, and the generated perturbation is a vector composed of the patches described in the real-time constraints); (4) Deploy the general perturbation to the P4 switch and perform packet forwarding based on real-time constraints and direction consistency rules. The specific implementation includes: Maintain the forwarding table and packet counter; when the counter value matches the patch insertion position, trigger the operation of inserting virtual packets and repeat forwarding the previous packet. This packet-level transmission mechanism avoids the waiting delay of sending packets only after the complete network flow transmission is completed, and at the same time inherits the transmission direction of the previous packet to maintain the direction consistency principle, and finally completes immediate forwarding to achieve a packet processing method with zero additional delay.

[0038] Spatiotemporal features include temporal features and spatial features: Temporal features, for example, the direction sequence generally starts with [+1, -1, +1] at the beginning, which represents the time sequence of packet sending, with the client's request first and the server's response later. There is a time-dependent relationship between packets. The sequence of packets between different websites is different, which constitutes the temporal features; Spatial features, for example, if a lot of -1s appear continuously in a certain flow sequence, it means that this sequence is very likely related to video network applications because, similar to video streams, a large number of packets need to be transmitted from the server to return data. Similarly, if a lot of +1s appear continuously, it may be related to database query network applications because a lot of requests need to be sent. Thus, it can be seen that the number of consecutive packets in the same direction can also reflect the usage differences of different applications and also constitutes the spatial features of different applications.

[0039] This perturbation addition method can be conveniently deployed on the P4 switch. To prevent network identifiers from modeling network traffic with this direction sequence and then using network traffic analysis technology to monitor the network, the present invention adopts a defense based on this method. The specific defense measure is to add virtual packets to such inputs for perturbation defense.

[0040] Step S2: Train an integrated surrogate model: Construct a deep neural network architecture for multi-feature extraction, and generate a traffic fingerprint recognition model with strong generalization ability through a feature fusion mechanism of spatial convolution, temporal recurrence, and noise reduction coding; Construct a deep neural network architecture: By integrating the Var-CNN spatial convolution model, LSTM temporal recurrence model, and SDAE noise reduction coding model, extract and generate spatial features, temporal features, and denoising features respectively; Design a feature fusion mechanism and generate a recognition model: Adopt a weighted feature fusion method based on fully connected layers to adaptively adjust the weights of different features and generate a traffic fingerprint recognition model with synergistically enhanced feature fusion ability and model decision-making ability.

[0041] In this embodiment, a fully connected integration method is adopted to achieve weighted fusion of the output results of each model, comprehensively considering the different feature extraction capabilities of each model and their complementary output results, and forming an integrated model decision with significantly enhanced robustness; among them, the weight allocation is automatically realized through the backpropagation mechanism during the neural network training process.

[0042] By analogy with the unique identification characteristics of biological fingerprints, the direction information is used as a component element of the traffic fingerprint and has the ability to distinguish individuals similar to fingerprints; although a complete traffic fingerprint should include multi-dimensional features such as protocols, time series, and operating systems, this model focuses on identifying this key fingerprint feature subset of direction information. Therefore, the model finally generated in this step is defined as a "traffic fingerprint recognition model".

[0043] Step S3: Generate an adaptive adversarial perturbation vector. Based on the improved ant colony optimization algorithm, patches are selected through the pheromone probability selection strategy and the roulette method selection mechanism to construct a dynamic perturbation vector, and pheromone is updated to achieve dynamic optimization of the virtual data packet defense ability. Patch probability calculation: Calculate the probability of each patch being selected according to the pheromone concentration level. Patch selection: According to the pheromone concentration and local defense effect, apply the roulette method selection mechanism to select patches, retain the randomness characteristics of the selection process, and combine them to construct a dynamic perturbation vector δ. Patch injection: Map the dynamic perturbation vector δ to the original traffic trajectory according to the perturbation injection rule generated in step S1 to form a perturbed network traffic trajectory. Pheromone update: Input the perturbed network traffic trajectory into the integrated surrogate model, and update the pheromone concentration without gradient based on the successful defense result to guide the iterative optimization of the subsequent patch search direction.

[0044] Step S4: Implement a generalized perturbation migration strategy. By batch processing combined with a patch scoring mechanism based on the defense success rate, improve the defense ability of adversarial samples among different network traffics.

[0045] Batch processing: Adopt a batch processing mechanism to synchronously process multiple original traffic trajectories, and by combining different input samples into the same batch, enable the algorithm to cover a wider data distribution during each iteration. Generalization scoring mechanism: Introduce a patch scoring mechanism after the batch processing step, calculate the generalization score based on the defense success rate of candidate patches within the current batch, and a high-scoring patch indicates excellent defense performance or stable performance in multi-batch defenses, with strong generalization ability. TopK selection mechanism: Improve the perturbation generalization ability by screening the top K patches with the highest scores.

[0046] The batch processing method of the present invention generates a general perturbation for batch data through the ant colony algorithm, enabling a single perturbation to be applicable to the entire batch of data. Its purpose is to enhance the generality of the perturbation rather than generating a specific perturbation specifically for a single piece of data. Since directly applying it to the entire dataset will cause the generated general perturbation to have too strong a dependence on a specific dataset (i.e., it is effective in this dataset but ineffective in other similar datasets), a batch processing mechanism is adopted to record the processing results of each batch, and finally, effective patch units are screened through an evaluation function and combined to form a general perturbation.

[0047] Embodiment 2: This embodiment provides a defense method based on an integrated surrogate model and heuristic ant colony. The specific process is as Figure 2 shown. Building a perturbation generation framework based on an improved ant colony optimization algorithm includes the following steps: Step S31 Patch probability calculation: Ants calculate the probability of each patch being selected according to the concentration level of pheromone.

[0048] In this embodiment, to ensure that the search process meets two necessary conditions: First, it must have sufficient randomness to jump out of local extrema. Second, the search needs to have a certain direction strategy guidance, otherwise the final result will have the problem of inconsistency. To meet the above two requirements, we transform the task of finding perturbations into the process of searching for different patches in the perturbations. In this process, we use pheromone to record the global defense effect of these patches. In this way, when many "ant" agents perform local searches, they have a clear guiding direction, making the final defense result more stable. At the same time, we use multiple agents (ants) combined with the roulette method to explore different patches. Compared with the single-agent method, this exploration method not only ensures sufficient randomness but also provides a broader search space, effectively preventing the search from falling into local optima and significantly improving the search efficiency and the reliability of the defense strategy.

[0049] To search for patches with good defense effects, we need to calculate the search probability of each possible patch. The probability calculation of each ant's search process is described by the following formula: ; where, represents the probability of selecting a patch with a value of (where p is the injection position and η is the number of injected data packets). represents the patch Related pheromones (all pheromone values are initialized to 1 to ensure equal search directions for all patches during the initial search). N represents the maximum number of injected data packets. α represents the weight control parameter of the pheromone. β represents the weight control parameter of the number of inserted data packets. M represents the maximum insertion position of the data packet (for example, if the length of the Trace is 200, then the maximum insertion position is 199). This probability formula indicates that for a given patch, we tend to prefer the case with a higher pheromone concentration and fewer injected data packets, which makes the probability range for selecting this patch larger. Therefore, the search direction is more likely to converge towards the current patch, making the subsequent selection process more instructive and effective.

[0050] Step S32 Patch Selection: Select patches probabilistically based on the pheromone concentration and the current local defense effect; combine the selected patches to form a perturbation vector .

[0051] In this embodiment, to introduce randomness in the search results and avoid falling into local extrema. After accurately determining the probability of each patch, a roulette-based selection strategy is introduced to select patches to construct the perturbation vector. First, accurately calculate the cumulative probability of each patch. Then, generate a random number uniformly distributed in the interval [0,1]. The first patch whose cumulative probability exceeds this random value will be selected and added as the i-th element to the perturbation vector. Repeat this operation until Q patches are selected, thus completing the construction of the perturbation vector. The patch selection mechanism based on cumulative probability is very efficient. It cleverly avoids the computationally expensive exhaustive search and complex evaluation, thereby reducing the computational overhead. In addition, its inherent randomness endows the construction of the perturbation vector with the ability to explore a wider range of possibilities. This expands the search space, effectively prevents falling into local optimal solutions, and enhances the robustness and effectiveness of the overall solution.

[0052] Step S33 Patch Injection: Inject this perturbation vector into the original traffic trace according to certain rules.

[0053] In this embodiment, the perturbation vector is injected into the original traffic trajectory according to the perturbation injection rule described in step S1. Although there is a chronological order in packet sending, since the perturbation injection rule established by this method satisfies the principle of direction consistency, the impact of this perturbation on the timing is not significant. Step S1 not only obtains time features but also obtains spatial features. Introducing a large number of virtual packets causes a change in the size of the burst (the number of consecutive packets with the same direction), and the spatial relationship changes. For example, TCP packets that originally did not need to be retransmitted present a high-frequency retransmission mode to deceive attackers after the intervention of virtual packets. Since this method realizes the collaborative capture of spatio-temporal features, the effectiveness of subsequent defense mechanisms is enhanced in both dimensions of traffic trajectory camouflage and attacker misdirection.

[0054] Step S34 Pheromone update: Input the perturbed network traffic trajectory into the integrated model, then use the result of the integrated model to update the pheromone, and then start the next round of calculation.

[0055] In this embodiment, after completing one perturbation injection, we need to evaluate all patches in the current perturbation in order to update the pheromone and guide the search direction of subsequent ants. The specific pheromone update formula is given by the following formula: ; In the formula, represents a batch of data containing multiple samples x. The function applies the current perturbation to . The number of misclassified samples in the prediction results of the -th ant, denoted as , is calculated by comparing the prediction results with the original labels using the L0 norm ; ; In the formula, represents the pheromone of the -th ant, and is the decay rate of the previous pheromone. The formula shows that the more misclassified samples, the higher the pheromone concentration. Therefore, future ants are more likely to explore stronger defense patches in this direction; , since the pheromone of a single ant cannot provide meaningful guidance, the global pheromone should reflect the sum of the pheromones of all ants. Therefore, in the formula, we average the pheromones of all ants to obtain the new global pheromone . Then, this global pheromone will guide the ants to determine the next perturbation.

[0056] The experimental platform is equipped with an NVIDIA GeForce RTX 4090 GPU, 32GB of memory, and the system environment is Linux 11. The development framework uses Python version 3.7 and PyTorch version 2.0. In the experiment, 6 types of DNN models are tested for defense on the Rimmer100 and Sirinam datasets and compared and evaluated with 4 types of defense algorithms.

[0057] Website fingerprinting (WF) attack is essentially a multi-classification problem relying on a deep neural network (DNN) model. Therefore, in our experimental evaluation, we use recall, precision, and F1-score as key metrics to measure the experimental results and evaluate the performance of the model. These metrics are defined as follows: Recall: Recall measures the ability of the model to correctly identify all relevant samples.

[0058] Precision: Precision represents the proportion of correctly predicted positive samples among all samples predicted as positive.

[0059] Weighted F1 Score: The F1-score is the harmonic mean of recall and precision, balancing these two metrics. The weighted F1 takes into account the class distribution and can more accurately evaluate the performance of our attacker's deep neural network model.

[0060] Table 1 Results of network fingerprinting attacks based on DNN models:

[0061] In Table 1, the first column represents different datasets; the second column represents various evaluation metrics, where: Rec represents recall, Pre represents precision, and F1 represents the weighted F1-score; the first row represents various deep neural network (DNN) models, where: CNN is a convolutional neural network, LSTM is a long short-term memory neural network, SDAE is a stacked denoising autoencoder, VarCNN is an attack method for semi-automated network feature extraction based on deep learning, DF is the abbreviation of Deep Fingerprinting, which is a deep fingerprint neural network, and Ensemble is an integrated model proposed in the present invention based on Var-CNN, LSTM, and SDAE. From the results, we draw the following conclusions: (1) The Ensemble model demonstrated significant attack advantages in all evaluation metrics. For the Rimmer100 dataset, the recall (Rec), precision (Pre), and F1-score (F1) of the Ensemble model reached 0.978, 0.984, and 0.979 respectively, outperforming the second-ranked DF model (0.976, 0.982, 0.976). Similarly, for the Sirinam dataset, these values reached 0.913, 0.934, and 0.912, also exceeding the second-ranked DF model (0.906, 0.928, 0.905). Compared with the worst-performing Convolutional Neural Network (CNN) model on the Rimmer100 dataset, the Ensemble model identified 14.02% more actual positive samples, while on the Sirinam dataset, it identified 17.2% more actual positive samples. These significant improvements can be attributed to the effective overcoming of the limitations of a single model in feature extraction, classification decision-making, etc. through the integration of multiple models, thus enhancing the performance; (2) The Ensemble model showed stable and reliable performance on both datasets. For the Rimmer100 dataset, the recall was 0.978, the precision was 0.984, and the F1-score was 0.979. These values were very close, indicating consistent performance under different evaluation metrics. Similarly, for the Sirinam dataset, the recall was 0.913, the precision was 0.934, and the F1-score was 0.912. This stability of performance can be attributed to the Ensemble model's ability to balance all aspects of classification, thus providing reliable results in different application scenarios.

[0062] Table 2 Results of black-box defense based on the Ensemble model:

[0063] As can be seen from Table 2: (1) HAAD (Heuristic Ant Algorithm Defense) can effectively reduce the performance of deep neural networks (DNNs) in black-box scenarios. Our method reduced the performance of the Ensemble model by more than 90% on multiple datasets. This demonstrates the strong defensive ability of our method, even when having no knowledge of the internal structure of the model; (2) The perturbations generated by HAAD also showed strong transferability. These perturbations could also reduce the performance of other deep neural network models (such as the DF model) by more than 91%. This indicates that these perturbations are effective not only for the target Ensemble model but also for other models, highlighting their broad defensive capabilities; (3)The integrated model always demonstrates excellent robustness. After applying adversarial defenses, compared with the individual single models that compose it, the integrated model shows robustness in the classification performance on all datasets. On the Rimmer100 dataset, the integrated model outperforms the second-best model by more than 10% in all evaluation metrics. This is because the integration of multiple models enhances the ability of the integrated model to maintain high resilience under adversarial conditions, which has significant advantages in practical applications. In addition, the DF model shows significant robustness and even exceeds the integrated model on the Sirinam dataset, demonstrating its unique advantages in specific scenarios.

[0064] Table 3 Comparison of results of different defense algorithms:

[0065] The experiment used a network sequence length of 200 data packets, and the DF model was used as the unknown attack model to identify the perturbed sequence. At the same time, DFD and MockingBird were selected as perturbation defense methods. As shown in Table 3, in the first row, DFD is the abbreviation of Deep Fingerprinting Defender, which is a deep fingerprint defense system; MockingBird is a website fingerprint attack simulation framework; BLANKET is a blind adversarial perturbation, which is a targetless model adversarial attack technique; Minipatch is a lightweight real-time traffic obfuscation defense scheme; HAAD is the heuristic ant colony optimization algorithm proposed in the present invention. DFD and MockingBird consume 57 and 62 data packets respectively, both reaching a perturbation overhead of nearly 30%. Both MockingBird and DFD require a perturbation overhead of nearly 30% to achieve a defense effectiveness of less than 80%. Although BLANKET has less packet overhead, its defense performance is worse, and the effectiveness is lower than 70%.

[0066] In contrast, the HAAD algorithm proposed in the present invention can achieve strong defense performance with only about 20% perturbation overhead. On both datasets, HAAD reduces the classification accuracy of the target model by more than 90%, and the performance improvement compared to the sub-optimal method Minipatch is more than 5%. The experimental results prove that HAAD (heuristic ant algorithm) has significantly stronger defense capabilities compared to other defense algorithms.

[0067] Example 3: This embodiment provides a general perturbation defense method based on an integrated surrogate model and heuristic ant colony, and the specific process is as Figure 3 shown, including the following specific methods: S41 Batch processing, this method is used to integrate the batch processing mechanism into HAAD. During each perturbation generation process, multiple traffic trajectories can be processed simultaneously. In this way, the algorithm overhead generated by processing a single trajectory individually each time is effectively reduced, and at the same time, the generality of the generated perturbation is improved. In addition, this method also aggregates different input samples into a batch, enabling the algorithm to come into contact with a wider data distribution during each iteration. As a result, the ant colony-based optimization process can more effectively access the global data pattern, reduce the sensitivity to abnormal inputs, and further enhance the stability of the learning process. Finally, the robustness and adaptability of the generated perturbation are improved, and the defense ability against adversarial samples is strengthened.

[0068] In this embodiment, batch processing starts from calculating the perturbation. The original method of processing a single sample is changed to a method that can process multiple samples at a time, similar to the batch training acceleration in neural network training. However, in this method, it is not only for acceleration but also for improving generality.

[0069] S42 Generality scoring mechanism, this method is used to further improve the generality of the generated perturbation. After the batch processing step is completed, a patch scoring mechanism based on the defense success rate is introduced. The specific method is to calculate the success rate of each candidate patch within the current batch to evaluate its defense effect. The higher the score, the better the defense performance of the patch in this batch, or if it appears frequently in multiple batches, it indicates stronger generality. The scoring method adopted by this mechanism can effectively assist in evaluating the generality of the patch.

[0070] S43 TopK selection mechanism: This method mainly operates based on the generality score calculated in S42, and finally selects the top K patches with the highest scores to form the final general perturbation vector.

[0071] In this embodiment, the specific formula for scoring is actually the formula for pheromone, as follows: ; In the formula, represents a batch of data containing multiple samples x. The function applies the current perturbation to . The number of misclassified samples in the prediction results of the th ant is denoted as This step uses the result of Lj as the score in the patch scoring mechanism. This score is essentially the success rate of the perturbation result. For example, in a batch of 64 samples, the perturbation vector is 4 patches, and the successful defense (the surrogate model predicts 5 or 6 samples incorrectly), then the success rate is 7 / 8. The scores of these four patches are all 7 / 8. The same calculation process is repeated for each supplement, and the calculated scores are accumulated until the entire dataset is calculated. Finally, the TopK (the top K patches with the highest scores) are selected.

[0072] In the existing WF defense solutions, there is no proposal to use a single perturbation to defend network data. The present invention first proposes to use a single universal perturbation to defend network data, which can significantly reduce network overhead. In the existing methods: minipatch uses a universal perturbation for a single website, but the large number of websites leads to huge overhead; mockingbird relies on model gradient information and complete flow records, which is infeasible in practice because it is impossible to pre-record complete flows; BLANKET and DFD have the defects of high bandwidth overhead and poor defense effect. The present invention uses a heuristic ant colony algorithm, which does not rely on model gradient information. The universal perturbation algorithm can not only pre-compute perturbations, but also greatly reduces the computational overhead due to its universality. The present invention significantly improves the defense effect, and its perturbation addition method has practical deployment feasibility.

[0073] Table 4 The impact of different perturbation delays on the network:

[0074] The first column in Table 4 represents the bandwidth of the transmitted data, the second column represents the normal forwarding delay, and the third to eighth columns represent the delays caused by adding perturbations of different sizes. The delay overhead in the table is obtained by calculating the universal perturbation of the heuristic ant colony. Data analysis shows that the impact of perturbation delay is lower than the impact of network jitter. This embodiment is actually deployed on a P4 switch. Based on the perturbation injection method proposed by this method, fast perturbation deployment can be achieved on P4; the measured data shows that the introduced delay impact is lower than the impact of network jitter, indicating that the impact of this perturbation mechanism can be ignored.

[0075] Although the embodiments of the present invention have been disclosed as above, it is not limited to the applications listed in the specification and embodiments. It can be fully applied to various fields suitable for the present invention. For those familiar with the field, for those of ordinary skill in the art, various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirits of the present invention. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to specific details.

Claims

1. A network traffic countermeasure and defense method based on heuristic ant colony optimization, characterized in that It includes the following steps: Step S1, constructing a spatio-temporal perturbation constraint system for network traffic: Defining the spatio-temporal characteristics of the original traffic trajectory through the direction sequence modeling paradigm, and establishing a perturbation injection rule that satisfies real-time constraints and direction consistency; Step S2, training an integrated surrogate model: Constructing a deep neural network architecture for multi-feature extraction, and generating a traffic fingerprint recognition model with strong generalization ability through the feature fusion mechanism of spatial convolution, temporal recurrence, and noise reduction coding; Step S3, generating an adaptive adversarial perturbation vector: Based on the improved ant colony optimization algorithm, selecting patches through the pheromone probability selection strategy and the roulette method selection mechanism to construct a dynamic perturbation vector, and performing pheromone update to achieve dynamic optimization of the virtual packet defense ability; Step S4, implementing a generalized perturbation migration strategy: Adopting a batch processing method combined with a patch scoring mechanism based on the defense success rate to improve the defense generality of samples among different network traffics.

2. The network traffic countermeasure and defense method according to claim 1, characterized in that The specific method of step S1 includes: S11, constructing the direction sequence modeling paradigm: Encoding the direction of network traffic data packets into a discrete numerical sequence, where the data packet from the client to the server is marked as +1, and the data packet from the server to the client is marked as -1, so as to define the spatio-temporal characteristics of the original traffic trajectory; S12, establishing the direction consistency rule: Constraining the direction of the inserted virtual data packet to be synchronized with the original traffic direction to avoid generating conflict packets that cause transmission delays; S13, establishing the real-time constraint: Defining that the perturbation rule vector consists of multiple patches, each patch is characterized by (p, η), where p identifies the insertion position of the virtual data packet, and η quantifies the insertion quantity. Inserting the virtual data packet at the target position through the perturbation rule vector, without waiting for the complete network flow transmission to complete, only need to complete the insertion operation at the corresponding position to add perturbation, thus meeting the real-time constraint requirements.

3. The network traffic countermeasure and defense method according to claim 2, characterized in that The virtual data packet in S13 is an empty packet sent by the client or the server, or a copy of the previous sent data packet.

4. The network traffic countermeasure and defense method according to claim 1, wherein The specific method of step S2 includes: S21, constructing a deep neural network architecture: Extracting and generating spatial features, temporal features, and denoising features respectively by integrating the Var-CNN spatial convolution model, the LSTM temporal recurrence model, and the SDAE noise reduction coding model; S22, designing a feature fusion mechanism and generating a recognition model: Adopting a weighted feature fusion method based on full connection, adaptively adjusting the weights of different features, and generating a traffic fingerprint recognition model with the collaborative enhancement of feature fusion ability and model decision-making ability.

5. The network traffic countermeasure and defense method according to claim 1, wherein The specific method of step S3 includes: S31, calculating the patch probability: Calculating the probability of each patch being selected according to the pheromone concentration level; S32, patch selection: Selecting patches according to the pheromone concentration and local defense effect, applying the roulette method selection mechanism to select patches, retaining the randomness characteristics of the selection process and combining them to construct a dynamic perturbation vector δ; S33, patch injection: Mapping the dynamic perturbation vector δ to the original traffic trajectory according to the perturbation injection rule generated in step S1 to form a perturbed network traffic trajectory; S34, Pheromone Update: Input the perturbed network traffic trajectory into the integrated surrogate model, and update the pheromone concentration without gradient according to the defense success result to guide the iterative optimization of the subsequent patch search direction.

6. The network traffic countermeasure and defense method according to claim 5, characterized in that The calculation process of the patch probability includes: transforming the task of searching for perturbations into the process of searching for different patches in the perturbations; quantifying and recording the global defense effectiveness of each patch through the pheromone concentration; providing a convergence direction guidance when the ant agent performs local patch search to enhance the stability of the defense strategy.

7. The network traffic countermeasure and defense method according to claim 5, wherein The specific method of using the roulette wheel selection mechanism to select patches includes: calculating the cumulative value of each patch probability as the cumulative probability; generating a random number uniformly distributed within [0, 1]; traversing the patch list, and when it is detected that the cumulative probability of a certain patch first exceeds the random number, selecting this patch as the i-th element and adding it to the dynamic perturbation vector; repeating the execution until Q patches are cumulatively selected to form a complete dynamic perturbation vector.

8. The network traffic countermeasure and defense method according to claim 5, wherein The pheromone is a global pheromone, which is obtained by calculating the average of the sum of the pheromones of all ant agents.

9. The network traffic countermeasure and defense method according to claim 1, characterized in that The specific method of step S4 includes: S41, Batch Processing: Adopt a batch processing mechanism to synchronously process multiple original traffic trajectories, and by combining different input samples into the same batch, the algorithm can cover a wider data distribution in each iteration; S42, Generalization Scoring Mechanism: Introduce a patch scoring mechanism after the batch processing step, calculate the generalization score based on the defense success rate of the candidate patches within the current batch, and a high-scoring patch indicates excellent defense performance or stable performance in multi-batch defenses, with strong generalization; S43, TopK Selection Mechanism: Improve the perturbation generalization by screening the top K patches with the highest scores.

10. An application of the network traffic confrontation defense method according to any one of claims 1-9, characterized in that, Deploy the method to a P4 switch and conduct tests in a Tor network environment for a network security defense platform.

Images