Tor website fingerprint identification method for satellite internet

Abstract

This invention relates to the fields of network security and deep learning, specifically a Tor website fingerprinting method for satellite internet. It achieves this by constructing a self-supervised contrastive learning framework to generate multi-view augmented samples; extracting temporal-granularity feature matrices; generating synthetic negative samples based on linear interpolation, which are then compared with positive samples to form contrast pairs; extracting trajectory representations; and jointly optimizing the results using cross-entropy loss and mask reconstruction loss. Compared to traditional website fingerprinting methods, this invention enhances the model's robustness to satellite-borne inherent noise caused by the Doppler effect. The weakly and strongly augmented views of this invention provide multi-scale semantic features, while the synthetic negative samples improve inter-class discrimination and reduce the false positive rate. The joint loss optimization framework allows the model to consider both global statistical characteristics and local burst features, significantly improving the accuracy and adaptability of website fingerprinting under the conditions of highly dynamic topology and limited annotation in satellite internet constellations.

Description

Technical Field

[0001] This invention relates to the fields of network security and deep learning, specifically to a Tor website fingerprinting method for satellite internet. Background Technology

[0002] With the increasing demand for network security and privacy protection, the application of security protocols such as TLS 1.3 and the widespread deployment of HTTPS have significantly improved the security of user access. However, even in encrypted communication, a large amount of user access information, such as the IP address, DNS requests, and handshake information, can still be leaked, posing privacy risks. To meet users' privacy protection needs, anonymous communication technologies have gradually matured, among which Tor (second-generation onion routing) is currently the most widely used anonymous communication system.

[0003] To identify potential threats, academic research on Tor has made some progress, with passive traffic analysis considered the most significant threat to Tor's anonymity. Website fingerprinting (WF) is one of the most representative techniques in passive traffic analysis. Traditional WF methods mainly rely on statistical features such as packet size, packet direction, and time intervals in encrypted traffic to train classifiers and accurately infer the websites visited by users. Most of this research focuses on terrestrial fiber optic network environments, achieving high identification accuracy.

[0004] However, with the rapid development of low-Earth orbit (LEO) satellite internet, the application scenarios of anonymous communication systems are expanding towards globalization, remote operation, and mobility. Nevertheless, the unique characteristics of the LEO scenario still present the following key technological limitations:

[0005] (1) Insufficient adaptability to dynamic network environments

[0006] Traditional WF methods rely on stable network conditions and low-dynamic topology assumptions. However, with the development of low-Earth orbit satellite internet, user access paths change frequently. Due to the high-speed movement of satellites, the Doppler effect causes signal frequencies to change over time, resulting in communication delay fluctuations, unstable packet arrival intervals, and frequent TCP retransmissions. This leads to increased traffic noise and high heterogeneity of the same website across different access session modes.

[0007] (2) It is highly dependent on data labeling and has high acquisition costs.

[0008] Existing deep learning methods typically rely on large amounts of labeled traffic data for training. In practical satellite internet deployments, especially with a large number of dynamic nodes and cross-regional users, obtaining accurate traffic labels is extremely difficult. This further limits the availability and practical deployment value of traditional WF methods in satellite environments. Summary of the Invention

[0009] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a Tor website fingerprinting method for satellite internet. This method aims to solve problems such as frequent communication path switching, highly dynamic link status, and time delay fluctuations caused by the Doppler effect in the low-Earth orbit satellite internet environment, thereby achieving high-precision and robust identification of satellite internet traffic.

[0010] Technical solution: The present invention provides a Tor website fingerprinting method for satellite internet, which introduces and generates dual-enhanced samples, generates a SAM matrix from traffic trajectories, including the time domain and the direction domain (spatial domain); generates synthetic negative samples as negative samples for contrastive learning; and constructs joint optimization learning.

[0011] The specific steps are as follows:

[0012] Step 1: Data preprocessing and augmentation sample generation;

[0013] First, the raw network traffic generated by user interactions with websites in the satellite internet is acquired, parsed, and its packet-level features (such as timestamps, packet direction, and packet length) are extracted and converted into time series data. The process involves preserving the temporal characteristics reflecting website interaction patterns; then, sample augmentation is performed on the original network traffic to obtain weakly augmented and strongly augmented views; finally, the augmented samples are preserved in terms of temporal correlation and semantic consistency with the original samples, and converted into a matrix representation in a unified format to form a dual-view augmentation trajectory pair. Among them, weakly enhanced view Retain most of the time-series statistical patterns, while significantly enhancing the view. By introducing stronger randomness in multiple dimensions such as time clipping and noise perturbation, an enhanced view that differs more from the original sequence is generated.

[0014] Step 2: Extract the time-slot-level traffic aggregation matrix (SAM), i.e., enhance the trajectory pair based on dual views. Construct a slot-level enhanced traffic aggregation matrix (SAM) ; and These correspond to the slot-level traffic aggregation matrices generated by the weak and strong enhancement views, respectively.

[0015] Step 3: Generate synthetic negative samples;

[0016] Enhance the traffic aggregation matrix SAM The input is a multi-scale convolutional encoder, which extracts the temporal feature embedding vector for each trajectory through multiple convolution and pooling operations. The resulting embedding vectors contain both global statistical features and reflect local burst temporal patterns. After obtaining the feature matrix, the feature center and covariance matrix of each category are calculated based on the embedding representations and category labels of samples of different categories, and potential boundary regions are identified by the distance between category centers.

[0017] in, These represent the temporal feature embedding vectors corresponding to the weakly enhanced flow and the strongly enhanced flow, respectively;

[0018] For closely spaced class pairs, a linear interpolation method is used to generate synthetic negative samples. The synthetic negative samples are located in the boundary region of the potential feature space of different classes, which not only retains some real traffic features, but also increases the difficulty of model discrimination, thereby effectively improving the difficulty and discrimination ability of self-supervised contrastive learning.

[0019] Step 4: Feature representation learning, which involves learning the flow aggregation matrix obtained from the dual-view augmented trajectory pair in Step 1 and the synthesized negative sample trajectory in Step 3. The input multi-scale convolutional coding module extracts multi-scale temporal patterns through multi-layer convolution and pooling operations, obtaining high-dimensional representation vectors that can characterize the distribution of different trajectory features, which are then used as input for subsequent contrastive learning and reconstruction tasks.

[0020] Step 5: Comparative learning and joint optimization, i.e., the enhanced traffic aggregation matrix obtained from the dual-enhanced trajectories. Construct positive sample pairs to synthesize negative samples Other samples not belonging to the same category are used as negative sample pairs to form a self-supervised contrastive learning task.

[0021] Meanwhile, an auxiliary objective based on mask reconstruction is introduced, which restores partially obscured traffic sequence segments to enhance the model's ability to model fine-grained temporal dependencies. By jointly optimizing the contrast loss, reconstruction loss, and cross-entropy loss, and dynamically adjusting the loss weights using temperature parameters, the model can learn global traffic patterns while taking into account local burst behavior characteristics, thereby improving the distinguishability between different types of trajectories and reducing the misjudgment rate caused by the Doppler effect and dynamic topology in satellite internet scenarios.

[0022] Step S6: Using the model trained through self-supervised contrastive learning, perform feature extraction and matching on the traffic trajectories of unknown websites in the satellite internet environment, generate corresponding website fingerprint representations, and output website identification results.

[0023] Furthermore, the method for constructing the weakly enhanced view in step 1 is as follows: by performing a low-proportion time pruning on the original network traffic sequence, retaining 90% of the continuous segments, and applying a small-amplitude normal distribution random perturbation to the timestamp of the pruned sequence, some data packets can be masked within a low proportion range;

[0024] The method for constructing a weakly enhanced view is to cut a larger proportion of the original network traffic into time segments, retaining only 60% of the time segments, and to apply a larger amplitude of random jitter to the timestamps, while masking the data packets at a higher proportion.

[0025] When constructing the aforementioned weakly enhanced view and strongly enhanced view, the following conditions must also be met:

[0026] Condition 1: Weak enhancement preserves the core interactive features of the traffic sequence, and only introduces random packet loss, temporal perturbation and amplitude scaling to ensure the consistency of the sample with the original traffic pattern;

[0027] Condition 2, Strong Enhancement, introduces higher intensity randomness in time clipping, frequency domain perturbation, flow reversal, and Gaussian noise injection to maximize the difference between views;

[0028] Condition 3, through the collaborative design of weak and strong enhancements, enables the model to simultaneously achieve stability and robustness in contrastive learning, thereby improving the discriminative power of website fingerprints in satellite internet.

[0029] Furthermore, the detailed method for extracting the time-slot-level traffic aggregation matrix in step 2 is as follows:

[0030] First, enhance the trajectory pairs with dual views to determine the maximum time span of each traffic trajectory. and fixed time slot length The complete time range of the traffic trajectory is evenly divided into N equal-length time slots. , ;

[0031] Then, the number of data packets in different directions and the average outgoing / incoming packet time are counted in each time slot. If the timestamp of a data packet exceeds the maximum loading time, the data packet is discarded, forming the corresponding statistical characteristics.

[0032] Finally, the statistical features within all time slots are arranged in time sequence to generate a traffic aggregation matrix. ,

[0033] The matrix can intuitively reflect the distribution pattern of bidirectional traffic in different time slots, and aggregates multi-dimensional information including the direction, quantity and time of data packets, providing structured input for subsequent feature learning.

[0034] Further, step 3 generates synthetic negative samples. The detailed method is as follows:

[0035] For the enhanced flow aggregation matrix SAM obtained in step 2 Linear interpolation is performed on the traffic representations of different categories. Two sample embedding vectors of different categories are randomly selected from the current batch, denoted as... Negative samples are generated based on a linear combination method. The formula is interpolation coefficients ; Generate a representation matrix of synthetic negative samples that are half true and half false at the inter-class boundaries. The location falls precisely in the decision edge region, thereby maximizing the discrimination difficulty of contrastive learning while avoiding temporal distortion caused by directly mixing data at the original input level, ensuring the continuity and discriminability of the synthesized samples in the feature space.

[0036] This method generates negative samples located in the inter-class transition region, which maintains a certain true distribution while challenging the classification boundary of the model. The method effectively increases the diversity of negative samples and avoids the problem of insufficient negative samples caused by single random sampling.

[0037] Furthermore, the specific work of mask reconstruction in step 5 is as follows:

[0038] The input feature matrix or time slot representation randomly masks a portion of the time slot or feature dimension. The masked feature matrix is ​​then input into a convolutional neural network to predict the original feature values ​​of the masked region. The mean square error or other reconstruction loss is calculated based on the original features and the reconstructed features.

[0039] Furthermore, step 5 employs a joint optimization loss function to enhance the model's learning ability for local burst patterns and global statistical features; the joint optimization loss function The expression is as follows:

[0040] ;

[0041] The self-supervised contrastive learning loss, used to maintain the compact aggregation of samples in the embedding space under the same website interaction pattern, is formulated as follows:

[0042] ;

[0043] in, Indicates cosine similarity; Indicates temperature parameter; This represents the enhanced feature vector (positive sample pair) of the same input sample under different views. Represents the feature vector of a negative sample;

[0044] Cross-entropy loss is used for classified tasks to improve the model's ability to distinguish between different websites. The formula is:

[0045] ;

[0046] in, This represents the category index, with values ​​ranging from 1 to the total number of categories C. This is a real label;

[0047] The mask reconstruction loss is calculated by examining the reconstruction error of random mask regions in the feature matrix, thereby constraining local temporal features. The formula is as follows:

[0048] ;

[0049] in This indicates the number of masked feature elements in the sample. Indicates the first The original feature values ​​that are masked; The model represents the first The reconstructed values ​​of the masked features;

[0050] is the weighting coefficient, used to adjust the relative contribution of each loss in the joint optimization.

[0051] Beneficial effects: This invention enhances the robustness of the model to satellite inherent noise caused by the Doppler effect. The weak and strong augmented views of this invention provide multi-scale semantic features, and the synthesized negative samples improve inter-class discrimination and reduce the false positive rate; the joint loss optimization framework enables the model to take into account both global statistical characteristics and local burst features, significantly improving the accuracy and adaptability of website fingerprinting under the conditions of strong dynamic topology and limited annotation of satellite Internet constellations. Attached Figure Description

[0052] Figure 1 This is a diagram illustrating the overall system framework of the present invention;

[0053] Figure 2 This is a flowchart of the comparative learning joint optimization in the example;

[0054] Figure 3 This is a schematic diagram illustrating the generation of the SAM traffic aggregation matrix in the example.

[0055] Figure 4 This is a diagram of a multi-scale convolutional coding neural network in an example;

[0056] Figure 5 It is an algorithm for generating synthetic negative samples in instances. Detailed Implementation

[0057] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0058] like Figure 1 As shown, the Tor website fingerprinting method for satellite internet of the present invention includes the following steps:

[0059] Step 1: Data preprocessing and augmentation sample generation;

[0060] First, the raw network traffic generated by user interactions with websites in the satellite internet is acquired, parsed, and its packet-level features are extracted and converted into time series data. Then, sample augmentation is performed on the original network traffic to obtain weakly augmented and strongly augmented views; finally, the augmented samples retain their temporal correlation and semantic consistency with the original samples, forming a dual-view augmented trajectory pair. , For weakly enhanced views, To enhance the view;

[0061] Step 2: Extract the time-slot-level traffic aggregation matrix (SAM), i.e., enhance the trajectory pair based on dual views. Construct time-slot-level enhanced traffic aggregation matrices respectively. ;

[0062] Step 3: Generate synthetic negative samples;

[0063] Enhance the traffic aggregation matrix The input is a multi-scale convolutional encoder, which extracts the temporal feature embedding vector for each trajectory through multiple convolution and pooling operations. ;

[0064] Then, based on the temporal feature embeddings and class labels of samples from different categories, the feature centers and covariance matrices of each category are calculated, and potential boundary regions are identified by the distance between class centers. For class pairs with relatively close distances, a linear interpolation method is used to generate synthetic negative samples. The synthetic negative samples are located in the boundary regions of the potential feature spaces of different categories. The algorithm for generating synthetic negative samples is as follows: Figure 5 As shown;

[0065] Step 4: Feature representation learning, which involves learning the flow aggregation matrix obtained from the dual-view augmented trajectory pair in Step 1 and the synthesized negative sample trajectory in Step 3. Input the multi-scale convolutional coding module, extract multi-scale temporal patterns through multi-layer convolution and pooling operations, and obtain a high-dimensional representation vector;

[0066] Step 5: Comparative learning and joint optimization, i.e., the enhanced traffic aggregation matrix obtained from the dual-enhanced trajectories. Construct positive sample pairs to synthesize negative samples Other samples sampled across batches are used as negative sample pairs to form a self-supervised contrastive learning task;

[0067] Simultaneously, a mask-based reconstruction operation is introduced, which restores partially masked traffic sequence segments; the training process is optimized by jointly using contrastive loss, reconstruction loss, and cross-entropy loss.

[0068] Step S6: Using the model trained through self-supervised contrastive learning, perform feature extraction and matching on the traffic trajectories of unknown websites in the satellite internet environment, generate corresponding website fingerprint representations, and output website identification results.

[0069] The feasibility and technical effects of the present invention are further verified through the following embodiments.

[0070] Step 1 of this embodiment involves data preprocessing and enhanced sample generation. The detailed method is as follows:

[0071] S1.1 Network Traffic Analysis: Reads raw traffic files generated by interactions between satellite internet users and websites from a specified path, retains basic fields with discriminative value for traffic characteristics, such as timestamps, packet direction, packet length, and other packet-level features, and transforms the raw traffic data into a time series. , where each element in the sequence Indicates the first The feature vector of each data packet includes information such as the corresponding timestamp, direction, and packet length. This indicates the total number of packets in this traffic trajectory.

[0072] S1.2, Weakly Enhanced View Construction: In Time Series Generating weakly enhanced trajectories based on By using slight perturbations (such as ±5% time shift and a small amount of random noise), most of the original time series statistical patterns are preserved, ensuring that the augmented samples maintain semantic consistency with the original samples, while improving the robustness of the model to small perturbations.

[0073] S1.3, Enhanced View Construction: In Time Series Generate strongly enhanced trajectories The following operations enhance sample diversity: time pruning: randomly prune some time segments to keep the length at 80%~95% of the original length; frequency offset: randomly add or subtract offsets to the arrival time of data packets to simulate the influence of satellite Doppler effect; noise mixing: introduce Gaussian noise or insert a small number of spoofed packets into the original traffic matrix to enhance the model's adaptability to dynamic topology.

[0074] S1.4 Dual-view generation: Convert the augmented samples into a unified format representation, maintaining temporal correlation and semantic consistency with the original samples, forming dual-view augmented trajectory pairs. This provides high-quality input for subsequent convolutional feature extraction.

[0075] like Figure 3 As shown, step 1 of this embodiment constructs the time-slot-level flow representation matrix. The detailed method is as follows:

[0076] S2.1, Traffic Trajectory Division: This involves dividing the enhanced traffic trajectory... and According to fixed time slot length Divided into A continuous time period The nth time period is denoted as This is used to statistically analyze the characteristics and direction information of the corresponding data packets within each time slot, ensuring that the local statistical features of the time series are preserved. Time slot length. This can be specified in the configuration file. For each traffic trajectory, if the number of packets in the last time slot is insufficient, it can be padded with zeros or by repeating the statistical value of the last time slot to ensure the consistency of the matrix dimensions.

[0077] S2.2, Data packet statistics within a time slot: In each time slot Internal statistics incoming data packets and outgoing data packets , forming vectors This forms packet statistical characteristics at the time slot level.

[0078] S2.3 Constructing the flow matrix: Arrange all time slot statistical vectors in chronological order to form a two-dimensional matrix. This matrix not only extracts key traffic features but also integrates time-dimensional information, providing input for the convolutional neural network.

[0079] Step 3 of this embodiment performs the synthesis of negative samples, and the detailed method is as follows:

[0080] S3.1 Feature Matrix Embedding and Extraction: Transforming the Dual-Enhanced Trajectory into a Flow Aggregation Matrix Input convolutional neural network encoder Each trajectory matrix is ​​subjected to 1D or 2D convolution, followed by multiple convolution and pooling operations to generate deep embedding vectors. , , , ,in For the embedding vector dimension. Embedding vector It includes global statistical features (such as total number of packets, directional distribution, etc.) and local temporal burst features (such as short-term traffic peaks, burst intervals). The embedding vector representing the temporal features of the original traffic.

[0081] S3.2, Category Boundary Analysis: For embedding vectors in the same batch and their corresponding category tags Enter

[0082] Linear analysis, calculating the mean of each category in the feature space. Covariance Matrix , ,in Indicate category The sample index set. Calculate the distance between class centers. Identify potential boundary regions. Select class pairs with small distances as the primary targets for generating negative samples, ensuring that negative samples are located near the decision boundary.

[0083] S3.3, Synthetic Negative Sample Generation: Generate synthetic negative samples near class boundaries. This negative sample retains some characteristics of the actual traffic flow while increasing the difficulty of discrimination. The number of negative samples generated is typically 0.5 to 1 times the number of positive samples in the batch to ensure a reasonable ratio of positive to negative samples during training. The specific generation algorithm... Figure 5 As shown.

[0084] S3.4 Construction of positive and negative sample pairs: synthesizing negative samples Compared with the original sample Enhanced samples ( Embedded into a unified matrix form It is used for self-supervised comparative learning.

[0085] In this embodiment, step 4 involves feature representation learning, and the detailed method is as follows:

[0086] S4.1 Construct a multi-scale convolutional coding network based on CNN, such as Figure 2 and Figure 4 As shown, this stage inputs preprocessed positive and negative sample pairs into the multi-scale convolutional coding network in batches. The multi-scale convolutional coding network adopts a hierarchical feature extraction backbone structure that combines 1D-CNN and 2D-CNN, aiming to perform multi-level representation of traffic trajectory sequences; the core idea is to capture local burst patterns and short-term dependent features simultaneously through multi-scale convolutional kernels, while also taking into account global contextual information.

[0087] Input layer: Receives a traffic time-series matrix composed of packet-level features such as timestamps, directions, and lengths.

[0088] Multi-scale convolutional layers: Convolutional kernels of different scales (such as 3, 5, 7, 9) are set to perform parallel convolution operations on the trajectory, and burst dependencies within the short window and contextual semantics of the long window are learned respectively.

[0089] Convolution-Normalization-Activation Unit: Each convolutional layer is followed by a Batch Normalization and ReLU activation function to improve training stability and the non-linear representation of features.

[0090] Cross-dimensional convolution: 1D-CNN mainly focuses on temporal patterns, while 2D-CNN models the spatial structure of trajectory matrices, thereby achieving dual learning in both the temporal and spatial domains.

[0091] Pooling layer: MaxPooling is inserted between some layers to compress the time dimension, aggregate key information, and reduce redundancy.

[0092] S4.2 Embedding Representation Fusion: In the final part of the encoder, the variable-length temporal features are compressed into a fixed-length vector representation. This embedding vector is then passed through a fully connected layer, projecting the features into a low-dimensional embedding space as the final trajectory representation vector.

[0093] S4.3 Multi-task adaptation: After generating the embedded representation, this vector is input into the contrastive learning module to calculate the similarity between the original view and the enhanced view (used for...). On the other hand, the input is fed into the classification branch, and the fully connected layer connects to the softmax output to calculate the cross-entropy loss. This multi-task structure ensures that the extracted representations capture both global consistency in unsupervised semantics and the ability to classify data under supervision.

[0094] like Figure 2 As shown, step 5 of this embodiment involves comparative learning and joint optimization, and the detailed method is as follows:

[0095] S5.1 Constructing positive and negative sample pairs: using the original feature matrix and the enhanced view matrix (including weak enhancement) and strongly enhanced samples As positive sample pairs ( And introduce the negative sample synthesized in step S3. Construct comparative learning training pairs.

[0096] S5.1 Optimization of Contrastive Learning Loss: The InfoNCE loss is calculated using the following formula:

[0097] ;

[0098] Represents cosine similarity. The temperature parameter is represented by this loss. By maximizing the similarity between different views of the same flow trajectory, this loss ensures that the model captures the global statistical features of the trajectory, improving robustness under different perturbation conditions.

[0099] S5.3 Reconstruction Loss Optimization: In addition to contrastive learning, define a decoder. From the mask vector The flow matrix of the reconstructed input is then used. The difference between the reconstructed result and the original input is measured by the mean squared error: the formula is as follows:

[0100] ;

[0101] This constraint ensures that the network can retain local temporal features while extracting high-level semantic features, thus avoiding excessive abstraction that could lead to a decrease in recognition accuracy.

[0102] S5.4 Classification Loss Optimization: In the classification branch, the embedding vectors are passed through a fully connected layer and a softmax function to obtain the predicted probability distribution, and cross-entropy loss is used. The formula is as follows:

[0103] ;

[0104] in The loss statement represents the true label. This loss directly optimizes the classification ability, ensuring that the model learns more separable feature representations.

[0105] S5.5 Joint Optimization Loss: A weighted combination of contrast loss, mask reconstruction loss, and cross-entropy loss. .

[0106] pass Adjusting the weights of each loss can simultaneously improve the overall pattern recognition capability, local temporal capture capability, and classification and discrimination capability.

[0107] In this embodiment, the final website fingerprint recognition output module outputs the final recognition result, using the following method:

[0108] S6.1, Feature Extraction of Unknown Samples: For unknown satellite internet traffic samples to be identified First, its feature matrix is ​​constructed through step S2. The deep feature extraction is completed in the convolutional network in step S4 to obtain the trajectory embedding representation. .

[0109] S6.2 Embedding the trajectory Input the trained fully connected classification layer to obtain the probability distribution of the predicted class. ,in, These are the classifier parameters; the output dimension equals the number of classes. By the category corresponding to the highest probability. This generates website predictions for the traffic.

[0110] This invention proposes a Tor website fingerprinting method for satellite internet by combining self-supervised learning, augmented sample generation, and mask reconstruction. The method constructs a dual-augmented view to generate synthetic negative samples at the feature matrix level, forming diverse and highly discriminative training data. It then utilizes a convolutional neural network to extract feature representations and performs joint optimization using multiple loss functions to achieve robust learning and recognition of traffic fingerprints in low-Earth orbit satellite scenarios.

Claims

1. A Tor website fingerprinting method for satellite internet, characterized in that, Includes the following steps: Step 1: Data preprocessing and augmented sample generation; extract packet-level features from the raw network traffic and convert them into time series data. ; The original network traffic is sample augmented to obtain weakly augmented views and strongly augmented views, forming a dual-view augmentation trajectory pair. , For weakly enhanced views, To enhance the view; Step 2: Extract the time-slot-level traffic aggregation matrix (SAM), i.e., enhance the trajectory pair based on dual views. Construct a slot-level enhanced traffic aggregation matrix (SAM) ; and These correspond to the slot-level traffic aggregation matrices generated by the weak and strong enhancement views, respectively. Step 3: Generate synthetic negative samples ; Enhance the traffic aggregation matrix The input is a multi-scale convolutional encoder, which extracts the temporal feature embedding vector for each trajectory through multiple convolution and pooling operations. ; Calculate and identify the potential boundary regions of each category of sample, and generate synthetic negative samples; These represent the temporal feature embedding vectors corresponding to the weakly enhanced flow and the strongly enhanced flow, respectively; Step 4: Feature representation learning, which involves combining the dual-view augmented trajectory pairs and the flow trajectories of the synthetic negative samples to obtain the flow aggregation matrix. Then, the traffic aggregation matrix Input the multi-scale convolutional coding module, and extract multi-scale temporal patterns to obtain high-dimensional representation vectors through multi-layer convolution and pooling operations; Step 5: Comparative learning and joint optimization, i.e., the enhanced traffic aggregation matrix obtained from the dual-enhanced trajectories. Construct positive sample pairs to synthesize negative samples. Other samples of different categories are used as negative sample pairs to form a self-supervised contrastive learning task; at the same time, a mask-based reconstruction operation is introduced, that is, to restore partially masked traffic sequence segments; the training process is optimized by combining contrastive loss, reconstruction loss and cross-entropy loss. Step S6: Using the model trained through self-supervised contrastive learning, perform feature extraction and matching on the traffic trajectories of unknown websites in the satellite internet environment, generate corresponding website fingerprint representations, and output website identification results.

2. The Tor website fingerprinting method for satellite internet according to claim 1, characterized in that, The method for constructing the weakly enhanced view in step 1 is as follows: the original network traffic sequence is pruned by a certain proportion of time, retaining 90% of the continuous segments, and a normal distribution random perturbation is applied to the timestamp of the pruned sequence. The method for constructing a weakly enhanced view is to prune the original network traffic by a certain percentage of time, retaining only 60% of the time segments, and applying random jitter to the timestamps.

3. The Tor website fingerprinting method for satellite internet according to claim 1, characterized in that, The detailed method for extracting the time-slot-level traffic aggregation matrix in step 2 is as follows: First, enhance the trajectory pairs with dual views to determine the maximum time span of each traffic trajectory. and fixed time slot length The complete time range of the traffic trajectory is evenly divided into N equal-length time slots. , ; Then, the number of data packets in different directions and the average outgoing / incoming packet time are counted in each time slot. If the timestamp of a data packet exceeds the maximum loading time, the data packet is discarded, forming the corresponding statistical characteristics. An enhanced traffic aggregation matrix is ​​generated by arranging the statistical features within all time slots in a temporal sequence. .

4. The Tor website fingerprinting method for satellite internet according to claim 1, characterized in that, The detailed method for generating synthetic negative samples in step 3 is as follows: For the enhanced flow aggregation matrix obtained in step 2 Linear interpolation is performed on the traffic representations of different categories. Two sample embedding vectors of different categories are randomly selected from the current batch, denoted as... Negative samples are generated based on a linear combination method. The formula is , The interpolation coefficients are used to generate the representation matrix of the synthetic negative samples at the inter-class boundaries. Synthetic negative Its location falls precisely at the edge of the decision-making process.

5. The Tor website fingerprinting method for satellite internet according to claim 1, characterized in that, The specific work of step 5, mask reconstruction, is as follows: input the masked feature matrix into the convolutional neural network, predict the original feature values ​​of the masked region, and calculate the mean square error and reconstruction loss based on the original features and the reconstructed features.

6. The Tor website fingerprinting method for satellite internet according to claim 1, characterized in that, Step 5 employs a joint optimization loss function to enhance the model's learning ability for local burst patterns and global statistical features; the joint optimization loss function The expression is as follows: ； The loss for self-supervised contrastive learning is given by the following formula: ； in, Indicates cosine similarity; Indicates temperature parameter; This represents the enhanced feature vector of the same input sample under different views; Represents the feature vector of a negative sample; The formula for the classification cross-entropy loss is: ； in, This represents the category index, with values ​​ranging from 1 to the total number of categories C. This is a real label; The formula for the mask reconstruction loss is: ； in This indicates the number of masked feature elements in the sample. Indicates the first The original feature values ​​that are masked; The model represents the first The reconstructed values ​​of the masked features; is the weighting coefficient, used to adjust the relative contribution of each loss in the joint optimization.

Images