Traffic trajectory generation method for covert communication

Abstract

This application provides a traffic trajectory generation method for covert communication, relating to the field of adversarial defense technology in network traffic classification. The method includes: extracting packet feature sequences based on sending behavior from a user-given traffic trajectory; extracting traffic statistical features based on packet windows from the packet feature sequences; training a GAN-based traffic feature generation model based on the packet feature sequences and traffic statistical features; constructing a probabilistic statistical model based on the user-given traffic trajectory; and generating a traffic trajectory for covert communication by sequentially using the trained GAN-based traffic feature generation model and the constructed probabilistic statistical model according to the user-input labels. This application designs a feature sequence based on sending behavior and constructs corresponding traffic statistical features based on it. It resolves the contradiction between GAN-generated fixed-length features and the requirement for variable-length network traffic feature sequences, constructing a traffic representation with well-distributed data that is conducive to the generation model.

Description

Technical Field

[0001] This application relates to the field of adversarial defense technology for network traffic classification, and more specifically, to a method for generating traffic trajectories for covert communication. Background Technology

[0002] Network regulators utilize deep learning technology to analyze network traffic behavior patterns, gain deeper insights, and classify network traffic for early warning purposes. However, network traffic classification technology can be used to steal user privacy. To protect data privacy, adversarial defenses against traffic classification have emerged. Existing defense methods against traffic classification models can be broadly categorized into two types: traffic feature generation methods based on generative adversarial networks (GANs) and adversarial sample attack methods.

[0003] The first method requires building a proxy model. Using a limited set of test samples, it queries the target model and constructs a local surrogate model with a classification boundary as close as possible to the target model based on the feedback. On this basis, a GAN network is used to attack the local surrogate model, generating statistical features or a specific traffic representation. Then, a search algorithm is used to alter the statistical features of the original network traffic by adjusting time intervals, load sizes, and inserting fabricated data packets, thereby causing the target classifier to misclassify the traffic.

[0004] Existing technologies employing this method include: a Chinese invention patent for a malicious traffic evasion detection method based on generative adversarial networks (publication number CN116707992A), a Chinese invention patent for a malicious traffic protection method and system based on active detection (publication number CN116015788A), and a Chinese invention patent for a data link network traffic generation method based on generative adversarial networks (CN119316303A).

[0005] The second method also requires building a proxy model, then using adversarial example attacks to add perturbations to network traffic statistics, generating adversarial examples, and then using a search algorithm to change the original traffic. Another approach is to directly add perturbations to the traffic data itself, for example, inserting a byte stream before each data packet payload; this inserted byte stream is generated using adversarial example attacks.

[0006] Existing technologies employing this method include: Chinese Invention Patent A Method and System for Generating Adversarial Samples of Network Traffic Based on Time Series (Publication No. CN118659907A), Chinese Invention Patent A Method for Generating Network Deception Traffic Based on Adversarial Samples (Publication No. CN114398977A), and Chinese Invention Patent A Method and Apparatus for Generating and Testing Adversarial Attack Samples Based on Black-Box Scenarios (Publication No. CN117240624A).

[0007] The above methods have the following drawbacks: the search algorithm often incurs significant overhead, making it unsuitable for real-time scenarios, which is fatal for traffic classification because traffic in real-world network environments is bursty. The attacks described also have limitations; whether adversarial attacks or GAN networks, their implementation targets a specific proxy model, inevitably limiting their effectiveness. Summary of the Invention

[0008] To address the aforementioned problems, the technical solution adopted in this application is: 1. A method for generating traffic trajectories for covert communication, comprising the following steps: From the traffic trajectory given by the user, the data packet feature sequence is extracted based on the sending behavior; Traffic statistics features are extracted from the data packet feature sequence based on the data packet window; A GAN-based traffic feature generation model is trained based on packet feature sequences and traffic statistics features. Construct a probabilistic statistical model based on the user-provided traffic trajectory; Based on the user-input tags, the trained GAN-based traffic feature generation model and the constructed probabilistic statistical model are used sequentially to generate traffic trajectories for covert communication.

[0009] Optionally, extracting the data packet feature sequence based on sending behavior includes: representing the traffic trajectory as a tuple sequence, extracting the tuple sequence of sent data packets and the tuple sequence of received data packets from the tuple sequence of the traffic trajectory, and then calculating the time interval of the data packets based on the timestamps to form the tuple sequence of sent data packets based on sending behavior and the tuple sequence of received data packets based on sending behavior, respectively, as follows: ; In the formula, Represents the input sequence. The threshold representing the time interval. Indicates the first The timestamp of the first data packet of the sending action. The absolute value of represents the first The number of data packets per sending action. The sign indicates the direction of the original data packet. This indicates the number of transmission actions contained in the input sequence. Indicate the merge rules; Merge the transmitted tuple sequence based on transmission behavior with the received tuple sequence based on transmission behavior, and sort them according to timestamps to obtain the original traffic trajectory tuple sequence based on transmission behavior. Based on the tuple sequence of sending actions, the time interval between sending actions is calculated according to the timestamps to obtain the data packet feature sequence, as expressed by the following formula: ; In the formula, Indicates the relationship with the first The time interval between each sending action and the previous sending action.

[0010] Optionally, the traffic statistics features extracted based on the packet window include: dividing the data into intervals to form categories based on the data distribution of the number of packets included in the sending behavior in the packet feature sequence, and then converting the packet feature sequence into a category-based feature sequence, as shown below: ; In the formula, Indicates by The derived category label, where j represents the number of intervals divided; Then, based on the number of tuples contained in the category-based feature sequence, the category-based feature sequence is divided into n segments of equal number, and 2+j statistical features are extracted from each segment. The statistical features include the mean and variance of all time intervals in the segment, as well as the number of occurrences of each category from category 1 to category j, forming a statistical feature matrix.

[0011] Optionally, the process of segmenting the category-based feature sequence further includes setting a minimum value of the number of tuples contained in the segment as a threshold m, and judging the length of the category-based feature sequence relative to the threshold m. Relationship, If the length of the category-based feature sequence is greater than or equal to If so, it is evenly divided into n segments, each segment contains K / n tuples, and the number of tuples in each segment is rounded up; If the length of the category-based feature sequence is less than Then, each segment is filled sequentially, each segment contains m tuples, and 0 is filled in the positions of the statistical feature matrix where no tuples are filled.

[0012] Optionally, the GAN-based traffic feature generation model includes a generator, a discriminator, and an observer; The generator is a multilayer perceptron, which takes conditional information y and random noise z as input and outputs a fake sample G(z|y) generated with the conditional information y as guidance. When generating traffic statistics features, the conditional information y is a target label c, and the generator output G(z|y) consists of the traffic statistics features and their lengths. When generating the data packet feature sequence, the conditional information y consists of a target label c and the corresponding traffic statistics features, and the generator output G(z|y) is the data packet feature sequence. The discriminator is a multilayer perceptron, whose inputs are real sample x and fake sample G(z|y), and whose output is the logarithm of the probability of judging the input as a real sample; The observer is a pre-trained deep learning classification model. Its input consists of fake samples that the discriminator predicts to be real samples. The observer judges the category of the fake samples and feeds the results back to the generator through gradient backpropagation.

[0013] Optionally, the discriminator's loss function The following formula represents: ; In the formula, This indicates that the discriminator can distinguish between real samples. and condition information The output, Represents the distribution of real data. The discriminant's average output value for real samples is represented by z, where z represents random noise. This indicates that the generator operates given random noise z and conditional information. The fake samples generated at that time This indicates that the discriminator can detect a given fake sample. and condition information The output, This represents the average output value of the discriminator for fake samples. Indicates the distribution of forged data. This represents a linear interpolation between real and fabricated data points. The corresponding distribution is denoted as , This indicates that the discriminator is in the interpolation The gradient with respect to the input, Indicates gradient Take the p-norm, This means averaging the p-norm of the gradient over all interpolated samples. express The hyperparameter weights of the item; Loss function of generator The following formula represents: ; The process by which the observer feeds back the results to the generator is represented by the following formula: ; In the formula, This represents the cross-entropy loss of the observer. This represents the final loss function of the generator after observer-assisted training. This means minimizing the loss corresponding to the final loss function. The hyperparameter weights represent the observer loss.

[0014] Optionally, training the GAN-based traffic feature generation model includes the following steps: S301: Loop through the specified number of iterations, then execute S302~S313; S302: From Gaussian distribution Sample m noise samples. S303: From the distribution of real data Sample m real samples and their corresponding conditional information; S304: Generating fake samples ; S305: When generating statistical features, from Get the effective length of the output When generating the data packet feature sequence, from Obtain the effective length of the output. ; S306: Will tail Each element is set to 0, in the formula, Represents the feature dimension of the sample; S307: From uniform distribution Medium sampling vector ; S308: In the formula, Represents the j-th vector; S309: Based on the discriminator's loss function Update the discriminator D parameter; S310: After the discriminator is trained k times, the generator is trained once, and S311~S313 are executed; S311: Select the option that satisfies fake sample set , This indicates that the discriminator operates under given conditions. Below, regarding fake samples The output value; S312: Input the model predictions and true labels of all samples into the cross-entropy loss function, and assign the result to... ; S313: Update the generator parameters based on the final loss function of the generator after training with observer assistance; S314: Returns the generator after training is complete.

[0015] Optionally, constructing a probabilistic statistical model based on the user-given traffic trajectory includes: establishing a probabilistic statistical model using a Beta distribution, and defining the probability density function of the probabilistic statistical model. for: ; In the formula, Represents a random variable. This represents the first shape parameter of the Beta distribution. This represents the second shape parameter of the Beta distribution. The kernel function represents the distribution pattern. It is a Beta function, defined as: ; in, This represents the integral form of the Beta function, where t represents the integration variable. The analytical formula for calculating the normalization constant is given. express The corresponding gamma function value, express The corresponding gamma function value, Indicates parameters The corresponding gamma function value; A probability model is established for each tag. For the traffic trajectory corresponding to each tag, the time intervals that are less than a specified time threshold are extracted and used to fit the probability model to obtain α and β in the probability density function. Finally, the probability model set Beta for each tag is obtained.

[0016] Optionally, generating traffic tracing for covert communication includes: The user-specified label and randomly sampled first noise are input into the first generator, and the traffic statistics features generated by the model are output. The user-specified label, randomly sampled second noise, and traffic statistics features generated by the model are input into the second generator, which outputs a data packet feature sequence generated by the model. The user-specified tags and the data packet feature sequence generated by the model are input into the probabilistic model set of the probabilistic statistical model, and the output is a traffic trajectory for covert communication.

[0017] Optionally, the interval division to form categories follows these steps: For intervals where the number of a single data packet accounts for more than 10% of the overall data distribution, they are classified into a separate category. The numerical intervals of the remaining data packets are sequentially accumulated and merged. For the set of intervals whose proportion after accumulation does not exceed q×10%, they are divided into q subcategories, where q is a positive integer. The following constraints must be met during the division process: each subcategory consists of consecutive adjacent intervals of data packet quantity, and the sample size dispersion of the q subcategories is minimized.

[0018] The beneficial effects of the traffic trajectory generation method for covert communication provided in this application are as follows: (1) This application designs a feature sequence based on sending behavior and constructs corresponding traffic statistical features based on it. This not only solves the contradiction between the fixed-length features generated by GAN and the variable-length requirements of network traffic feature sequences, but also constructs a traffic representation with good data distribution that is conducive to the generation of the generative model. Based on the designed feature construction method and the GAN-based traffic feature generation model, a multi-level network traffic feature generation process based on GAN is designed. This multi-level generation process is divided into three stages: traffic statistical feature generation, feature sequence generation based on sending behavior, and original traffic trajectory reconstruction based on probability statistical model, which solves the problem of irreversibility between machine learning feature space and real traffic space.

[0019] (2) A probabilistic statistical model is established using the time interval information of the data packets contained in each sending action unit. During the reconstruction of the original traffic trajectory, the corresponding number of time intervals are generated using the probabilistic model according to the number of data packets in the sending action, thereby restoring a tuple of an action to a sequence of tuples containing time intervals and directions, and fully reproducing the dynamic change process of network flow in the time dimension. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0021] Figure 1 This is a feature sequence construction diagram based on sending behavior provided in the embodiments of this application; Figure 2 This is a distribution diagram of the number of data packets included in the sending behavior provided in the embodiments of this application; Figure 3 This is a schematic diagram of the traffic feature generation model based on GAN provided in the embodiments of this application; Figure 4 This is a schematic diagram of multi-layered network traffic feature generation based on GAN provided in the embodiments of this application; Figure 5 This is a schematic diagram of the DF model architecture. Detailed Implementation

[0022] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0023] Example 1 This application provides a method for generating traffic trajectories for covert communication, including the following steps: From the traffic trajectory given by the user, the data packet feature sequence is extracted based on the sending behavior; Traffic statistics features are extracted from the data packet feature sequence based on the data packet window; A GAN-based traffic feature generation model is trained based on packet feature sequences and traffic statistics features. Construct a probabilistic statistical model based on the user-provided traffic trajectory; Based on the user-input tags, the trained GAN-based traffic feature generation model and the constructed probabilistic statistical model are used sequentially to generate traffic trajectories for covert communication.

[0024] This application presents a traffic trajectory generation method for covert communication, used for traffic pattern masquerading between two communicating hosts. First, a multi-level network traffic representation method is constructed: at the fine-grained level, a data packet feature sequence based on sending behavior is proposed. By merging consecutive same-direction data packets with time intervals less than a threshold, the problem of uneven time interval distribution in the original traffic is effectively alleviated; further, a category partitioning strategy is introduced to map the number of data packets to balanced category labels. At the coarse-grained level, a statistical feature construction algorithm based on data packet windows is designed to extract a fixed-length statistical feature matrix from variable-length traffic, taking into account both time interval statistical attributes and category distribution characteristics. Then, to address the irreversibility between the machine learning feature space and the real traffic space, a multi-level traffic feature generation method based on GAN is proposed. Based on the proposed network traffic representation, a traffic feature sequence is generated in two stages: using the target traffic label as input, macroscopic statistical features (i.e., traffic statistical features) are first generated, and then a data packet feature sequence is generated based on these features. Finally, the feature sequence is restored to the original traffic trajectory using a Beta distribution probability model.

[0025] This application addresses the problem of uneven data distribution in real-world traffic trajectories, which hinders the generation of generative models. A feature sequence construction method based on sending behavior is designed, exhibiting good classification performance and robustness against packet insertion defense mechanisms. To convert variable-length traffic trajectories into fixed-length statistical features, a statistical feature construction algorithm based on packet windows is further designed, laying the data foundation for the generative model. To address the irreversibility between the machine learning feature space and the real traffic space, a multi-level traffic feature generation method based on GANs is designed.

[0026] Feature sequence construction method based on sending behavior (fine-grained feature construction): In the field of web traffic classification, a website's traffic trajectory is represented as a series of tuples.<timestamp,±packet_size> Where timestamp is the timestamp of the data packet, packet_size is the size of the data packet, and its sign indicates the direction of the data packet: a positive number indicates outbound, and a negative number indicates inbound.

[0027] The tuple sequence of traffic trajectories is represented in the following form: ; in, A sequence of tuples representing traffic trajectories. Represents timestamp ( ), Indicates the size of the signed data packet. Indicates the direction of the data packet. Indicates the data packet size. Indicates the number of data packets.

[0028] Statistical analysis revealed that the time intervals of a large number of data packets are concentrated around 0. This characteristic leads to a large amount of irrelevant information in the feature sequences based on data packet time intervals. Furthermore, for generative models, the uneven distribution of data can cause model inertia; GAN models tend to generate a larger proportion of values, rather than outputting fewer values ​​that contain important information.

[0029] The fundamental reason for this phenomenon is that when the amount of data transmitted is too large, due to network protocol limitations (such as the maximum transmission unit (MTU) typically being 1500 bytes), the transmitted data is divided into multiple data packets. Based on this fact, this application merges consecutive data packets with the same direction and a time interval of less than a certain threshold (1 millisecond in this embodiment) into a single transmission. This is because consecutive data packets are likely caused by a single transmission of a large amount of data. Furthermore, the ability to identify the website visited by a user using side-channel information from network traffic is possible because the server's data transmission behavior in response to client requests always exhibits certain characteristics, as the data returned by the server (front-end pages, images, etc.) and its operational logic (underlying code) are deterministic.

[0030] This operation will extract feature sequences based on sending behavior, such as Figure 1 As shown, this sequence uses sending actions as the basic unit, and each sending action contains three core features: action start time, total data packet size, and direction. Action start time refers to the time when the first data packet in this sending action is sent; the total data packet size is the sum of the sizes of all data packets in this sending action; and the direction is consistent with the original data packet direction, with positive numbers indicating outbound sending actions and negative numbers indicating inbound sending actions. In this way, the original data packet sequence is compressed into a sending action-based feature sequence, preserving the key spatiotemporal behavioral patterns of traffic while avoiding feature redundancy caused by uneven distribution of data packet time intervals. This makes the generated feature sequence more closely resemble the sending logic in actual network communication, laying the foundation for guiding the packet sending behavior of both communicating parties.

[0031] Based on the tuple sequence of traffic trajectories, the sent and received data packets are extracted separately. Data packet size information is discarded, and only the timestamp and data packet direction information are retained, forming separate tuple sequences for sent and received data packets (e.g., ...). Figure 1 The characteristic sequences of the first row of the table are represented as follows: ; ; In the formula, This represents a sequence of tuples representing the data packets being sent. This represents the sequence of tuples containing the received data packets. For other parameters, please refer to the description of the symbols in the tuple sequence of the traffic trajectory.

[0032] Based on this, the time interval of data packets is calculated according to the timestamp. Consecutive data packets with a time interval less than a certain threshold (in this embodiment, the threshold is 1 millisecond) are merged into a single transmission action, using tuples.<timestamp,±packet_count> This indicates that `timestamp` is the timestamp of the data packet, taking the timestamp of the first data packet sent, and `packet_count` represents the number of data packets sent. Positive and negative values ​​indicate the direction of the original data packets, forming tuple sequences based on the sending and receiving actions (e.g., ...). Figure 1 The characteristic sequence of the second row of the table. Its representation is as follows: ; In the formula, Represents the input sequence or , The threshold representing the time interval. Indicates the first The timestamp of the first data packet of the sending action. The absolute value is the first The number of data packets per sending action. The sign indicates the direction of the original data packet. This indicates the number of transmission actions contained in the input sequence. The merging rules are as shown in the merging algorithm based on sending behavior, which will be discussed later.

[0033] Merge the tuple sequences of transmitted and received data based on transmission behavior, and sort them according to timestamps to obtain the original traffic trajectory's tuple sequence based on transmission behavior. (like Figure 1 (Feature sequence of the third row of the table) ; In the formula, Represents the sorting function, according to (Timestamp) Sorts the merged sequence in ascending order.

[0034] Finally, based on the tuple sequence of the original traffic trajectory based on sending behavior, the time interval between sending behaviors is calculated according to the timestamp, resulting in the feature sequence based on sending behavior proposed in this paper: ; in, Indicates the relationship with the first The time interval between each sending action and the previous sending action. and The meaning remains consistent with the previous text.

[0035] Merging algorithms based on sending behavior: Input: Input sequence Threshold for time interval .

[0036] Output: A sequence of tuples based on the sending behavior. (That is, the sequence of tuples sent and received based on the sending behavior, as described above) Here, "b" is used in conjunction with the sequence of tuples representing the original traffic trajectory based on sending behavior. (To make distinctions).

[0037] S101: Using the first tuple in sequence S Initialize the send behavior tuple , This represents the timestamp of the first tuple in sequence S. Indicates the data packet direction of the first tuple in sequence S. Indicates the number of data packets sent as a tuple of actions. Indicates the timestamp of the first data packet in the sent action tuple; S102: Starting from the second element, traverse each data packet feature in sequence S (i.e., i from 2 to n), and execute S103~S105; S103: Check the current timestamp Compared to the previous timestamp Is the difference less than the set time threshold? If yes, execute S104; otherwise, execute S105. S104: If so (i.e., the two data packets are close enough in time), merge the current data packet into the current sending action tuple. ; S105: If not (i.e., the time interval exceeds the threshold), send the current action tuple. Add it to the end of the result sequence b, and initialize a new sending action tuple based on the current data packet tuple. ; S106: After the traversal is complete, send the last tuple of the sent actions. Add to the result sequence b; S107: Return to b.

[0038] Statistical feature construction based on packet windows (coarse-grained feature construction): In the feature sequence based on sending behavior, the second item of the sending tuple (i.e., the number of data packets included in the sending behavior) exhibits a significant uneven distribution. To facilitate subsequent processing, based on the data distribution of the second item of the sending tuple, it is divided into multiple intervals (with each interval maintaining a relatively balanced data proportion). This transforms the number of data packets included in the sending behavior into features based on multiple categories, which are then called category-based feature sequences. Based on the feature sequence based on sending behavior, the category-based feature sequence is represented as follows: ; In the formula, It is by The resulting category label, where j is the number of numerical intervals divided.

[0039] The process of dividing intervals into categories follows these steps: For intervals where the number of a single data packet accounts for more than 10% of the overall data distribution, they are classified into a separate category. The numerical intervals of the remaining data packets are sequentially accumulated and merged. For the set of intervals whose proportion after accumulation does not exceed q×10%, they are divided into q subcategories. The following constraints must be met during the division process: each subcategory consists of consecutive adjacent intervals of data packet quantity, and the sample size dispersion of the q subcategories is minimized.

[0040] In this embodiment, based on the CW dataset, when the data packet time interval threshold is set to 1 millisecond, over 85% of the transmission behaviors in the original traffic sequence contain data packets ranging from 1 to 3. Figure 2 As shown in Table 1, to facilitate subsequent processing, the data is divided into 7 categories based on its distribution.

[0041] by Figure 2 Taking the data distribution in [the context of] [the data] as an example, the following explanation will be given. Based on the feature sequence of sending behavior [the data]... The x-axis represents the number of times a value appears out of all data in the graph, and the y-axis represents the percentage of times that value appears. First, indivisible intervals with a data percentage exceeding 10% are grouped into a single category. For example... , , , These four intervals cannot be divided (because) The values ​​are integers, and each of these values ​​accounts for more than 10% of the total data. For the remaining intervals... Its data proportion is less than 10%, so it is directly classified into one category. For the interval... Since its data proportion exceeds 10%, it is further divided into two intervals with roughly equal proportions (to minimize the dispersion of the sample size). , The specific results are shown in Table 1.

[0042] Table 1. Classification of sending behavior based on the number of data packets

[0043] Among them, categories 1 to 7 correspond to different ranges of data packet number. Through this classification method, the data packet number characteristics that were originally concentrated in a few intervals are mapped to multiple balanced categories.

[0044] The process of segmenting category-based feature sequences also includes setting a minimum number of tuples in a segment as a threshold m, and determining the length of the category-based feature sequence in relation to... The relationship is that if the length of the category-based feature sequence is greater than or equal to... Then it is evenly divided into n segments, each segment containing K / n tuples, and the number of tuples in each segment is rounded up; if the length of the category-based feature sequence is less than Then, each segment is filled sequentially, each segment contains m tuples, and 0 is filled in the positions of the statistical feature matrix where no tuples are filled.

[0045] To extract fixed-length traffic statistical features from variable-length traffic trajectories and minimize data padding, this application employs an equal-packet-count segmentation method for feature extraction. As shown in the traffic statistical feature construction algorithm based on packet windows, the feature sequence, based on the category-based feature sequence, is divided into a fixed number of n segments of equal size according to the number of tuples contained in the sequence, and the statistical features of each segment are calculated. To prevent the number of packets in each segment from being too small, a minimum threshold m is set; the number of packets in each segment must not be lower than this threshold. When the feature sequence length is less than... When adding zeros, fill in the end of the statistical features. For each segment, calculate the mean and variance for each time interval, and count the number of labels for each category.

[0046] Based on the category classification in Table 1, 2+j statistical features are extracted from each segment. These features include the mean and variance of all time intervals within the segment, and the number of occurrences of each category from 1 to j. In this embodiment, 9 statistical features will be extracted from each segment, forming a shape... The statistical feature matrix is ​​as follows. Specifically, the nine statistical features include: the mean and variance of all time intervals within the segment, and the number of occurrences of each of categories 1 to 7, totaling two time interval statistics and seven category count statistics. Taking n=5 and m=10 as an example, if the category-based feature sequence contains 55 data packets, it is evenly divided into 5 segments, each containing 11 data packets (all greater than the threshold m=10). Nine statistical features are calculated for each segment, ultimately forming a 5×9 fixed-length statistical feature matrix. If the feature sequence contains only 39 data packets, which is less than n×m=50, it is divided into 4 segments (the first 3 segments each contain 10 data packets, and the last segment contains 9 data packets). In this case, since the number of segments (4) is less than n=5, a feature vector consisting of 0s needs to be padded at the end of the statistical feature matrix to meet the fixed-length requirement.

[0047] In practical applications, by adjusting the values ​​of n and m, feature sequences of different lengths can be flexibly adapted. For example, when processing long traffic sequences containing a large number of data packets, appropriately increasing the value of n allows for more detailed segmentation of time segments, thereby capturing the behavioral changes of traffic at different stages. Conversely, for short traffic sequences with fewer data packets, setting a reasonable threshold for m can avoid statistical feature instability caused by overly fine segmentation. This dynamic adjustment mechanism makes the traffic statistical feature construction method based on data packet windows highly adaptable to various scenarios, ensuring feature length stability while preserving key information from the original traffic data to the greatest extent possible. Furthermore, the constructed statistical feature matrix combines the statistical attributes of time intervals with category distribution characteristics, reflecting not only the dynamic trend of traffic changes but also the category composition of data packet sending behavior. This provides multi-dimensional input for subsequent traffic classification and generation models, helping to improve the model's ability to identify and generate various traffic patterns in complex network environments.

[0048] Algorithm for constructing traffic statistics features based on packet windows Input: Input sequence Statistical feature length n, minimum threshold m; Output: A traffic statistics matrix based on packet windows, consisting of n tuples. composition, , Let be the mean and variance of the time interval for the i-th segment, respectively. For the i-th segment The number of data packets.

[0049] S201: Determine the input sequence Is the length greater than or equal to If yes, execute S202; otherwise, execute S207.

[0050] S202: Calculate the number of data packets in each segment. Round up to the nearest integer.

[0051] S203: Loop through and calculate the statistical characteristics of each segment (i.e., i from 1 to n), and execute S204~S206.

[0052] S204: Calculate the value of the i-th segment in... The index range. , Indicates the current segment is in The starting index in Indicates the current segment is in The end index in.

[0053] S205: According to Calculate the interval mean, variance, and the number of labels for each category, forming a tuple. , This indicates a sequence slicing operation.

[0054] S206: Add the tuples calculated in step S205 to the final output.

[0055] S207: Calculate the effective length of the statistical feature and round it up. .

[0056] S208: Iteratively calculate the statistical characteristics of each segment within the effective length (i.e., i from 1 to...). ), execute S209~S210.

[0057] S209: Calculate the value of the i-th segment in... The index range.

[0058] S210: Perform steps S205 and S206.

[0059] S211: Output statistical features matrix Multi-level network traffic trajectory generation based on GAN model: Building upon research into network traffic representation methods based on spatiotemporal features, this paper utilizes generative adversarial networks (GANs) to learn the behavioral patterns of target traffic. Given labels, it generates a feature matrix of network flows and a sequence of data packet features. Furthermore, in a real-world network environment, the communicating parties use the generated data packet feature sequences to guide the communication process, resulting in network flows with specific behavioral patterns. This deceives the network traffic classifier, achieving the goal of covert communication.

[0060] (1) Model structure The structure of the traffic feature generation model based on GAN is as follows: Figure 3As shown, the model architecture consists of three parts: generator G, discriminator D, and observer O.

[0061] The generator G is a multilayer perceptron (MLP). It takes conditional information y and random noise z as input and outputs the fake samples G(z|y) generated with the conditional information y as guidance. All input vectors are normalized to the range [0,1] to facilitate the training process.

[0062] When generating coarse-grained statistical features (corresponding to...) Figure 4 (Statistical features generated in the data), the conditional information y is a target label c (one-hot encoded), Figure 4 The output G(z|y) of the generator, defined by the label c in the table, is determined by statistical features ( Figure 4 The characteristic matrix m) and its length ( Figure 4 medium length )composition.

[0063] When generating fine-grained data packet feature sequences (corresponding to...) Figure 4 (Based on the feature sequence generated by the sending behavior), the conditional information y is generated by a target tag c (one-hot encoded). Figure 4 The label c) and its corresponding statistical features ( Figure 4 The generator consists of a feature matrix m, and its output G(z|y) is the data packet feature sequence ( Figure 4 middle ).

[0064] Because different network flows have varying durations and numbers of data packets, their corresponding statistical features and data packet feature sequence lengths differ, while the generator's output is a fixed-length vector. Therefore, post-processing is necessary: ​​when generating statistical features, the output length is considered, specifically setting invalid positions to 0; when generating data packet feature sequences, the length information inherent in the input statistical features is considered. This helps prevent the generator from outputting a large number of zeros at the end, resulting in a more reasonable distribution of output data.

[0065] The discriminator D is also a multilayer perceptron (MLP). Its inputs are real samples x and fake samples G(z|y), and its output is the logarithm of its judgment that the input is a real sample. Similar to the generator G, the discriminator also includes conditional information y as input.

[0066] Observer O is a pre-trained deep learning classification model that further provides feedback to the generator G. The fake samples G(z|y) that successfully fool the discriminator—that is, those predicted as real samples by the discriminator D—are fed into Observer O. Observer O determines which category these fake samples belong to and feeds the result back to the generator G through gradient backpropagation.

[0067] During model training, the following loss function is used, combining the optimization objective formulas of WGAN-div and conditional generative adversarial networks: ; ; in, This represents the loss function of the discriminator. Let z represent the loss function of the generator, and z be random noise. Indicates the distribution of forged data. Represents the distribution of real data. It is a linear interpolation between real and fabricated data points (the corresponding distribution is denoted as...). ).

[0068] Since the model incorporates an observer model to assist training, the loss function of the generator G after the observer feeds back the results to the generator, based on the generator's loss function, is: ; It is the cross-entropy loss of observer O, whose input is the fake samples predicted as real samples by discriminator D, and the label is the target label corresponding to the fake sample. This represents the final loss function of the generator after observer-assisted training. This means minimizing the loss corresponding to the final loss function.

[0069] The specific training process is shown in the GAN model training algorithm. Note that there is a difference between generating statistical features and generating data packet-based feature sequences. When generating statistical features, the conditional information y only contains the target label c (one-hot encoded); when generating data packet-based feature sequences, the conditional information y consists of a target label c (one-hot encoded) and the corresponding statistical features. In step 5 of the GAN model training algorithm, when generating statistical features, the output of the model includes the effective length of the statistical features and invalid features are set to 0 accordingly; when generating data packet-based feature sequences, the statistical features include the effective length of the feature sequence, and invalid features are also set to 0.

[0070] GAN model training algorithm: Input: Batch size m, number of times the generator is trained per iteration, number of times the discriminator is trained k, discriminator D, generator G, observer O, maximum feature length d of the generator output, feature dimension m Output: The trained generator G.

[0071] S301: Loop through the specified number of iterations, then execute S302~S313.

[0072] S302: From Gaussian distribution Sample m noise samples .

[0073] S303: From the distribution of real data Sample m real samples and their corresponding conditional information .

[0074] S304: Generating fake samples .

[0075] S305: When generating statistical features, from Get the effective length of the output When generating the data packet feature sequence, from Obtain the effective length of the output. .

[0076] S306: Will tail Each element is set to 0, in the formula, This represents the feature dimension of the sample.

[0077] S307: From uniform distribution Medium sampling vector .

[0078] S308: In the formula, Let j represent the j-th vector.

[0079] S309: Based on the discriminator's loss function Update the discriminator D parameters.

[0080] S310: After the discriminator is trained k times, the generator is trained once, and S311~S313 are executed.

[0081] S311: Select the option that satisfies fake sample set , This indicates that the discriminator operates under given conditions. Below, regarding fake samples The output value.

[0082] S312: Input the model predictions and true labels of all samples into the cross-entropy loss function, and assign the result to... , .

[0083] S313: Update the generator G parameters based on the final loss function of the generator after training with observer assistance.

[0084] S314: Returns the generator after training is complete.

[0085] Given that GANs can only generate fixed-length features, this application designs a feature sequence based on sending behavior to enable the generation of variable-length traffic trajectories, and constructs corresponding traffic statistical features based on this sequence. This not only resolves the contradiction between GANs generating fixed-length features and the requirement for variable-length network traffic feature sequences, but also constructs a traffic representation with well-distributed data that is conducive to the generation model. Based on the designed feature construction method and the GAN-based traffic feature generation model, a multi-level network traffic feature generation process based on GAN is designed, such as... Figure 4 As shown.

[0086] The multi-level generation process is divided into three stages: traffic statistical feature generation, feature sequence generation based on sending behavior, and original traffic trajectory reconstruction based on probability statistical model.

[0087] First, in the traffic statistics feature generation stage, target labels and random noise z are used as input to generate traffic statistics features with effective length and based on packet windows. Post-processing then sets invalid location features to zero to ensure the rationality of the statistical features.

[0088] Secondly, in the feature sequence generation stage based on transmission behavior, the target label, random noise, and the generated statistical features are used as joint conditions to further generate the data packet feature sequence. At this point, the length information contained in the statistical features is extracted, and invalid position features in the data packet feature sequence are set to zero.

[0089] Finally, a probabilistic statistical model is used to reconstruct the original traffic trajectory from the generated feature sequence based on sending behavior. Specifically, a probabilistic statistical model is established using the time interval information of the data packets contained in each sending behavior unit. During the reconstruction of the original traffic trajectory, the probabilistic model generates a corresponding number of time intervals based on the number of data packets in the sending behavior, thereby reconstructing a tuple of an occurrence behavior into a sequence of tuples containing time intervals and directions. For example, for a sending behavior unit containing 3 data packets, if the time intervals generated by the probabilistic model are 0.1s, 0.3s, and 0.2s respectively, then in the final reconstructed traffic trajectory, the sending times of these 3 data packets will be sequentially spaced at the above durations, thus completely reproducing the dynamic changes of network flow in the time dimension.

[0090] (3) Probability and statistical model The original flow trajectory reconstruction process based on a probabilistic statistical model uses the Beta distribution to establish the probabilistic statistical model. The Beta distribution consists of two positive real shape parameters. and The control, whose probability density function is: ; in It is a Beta function, defined as: ; in, This represents the nucleus that determines the distribution pattern. This represents the integral form of the Beta function. The analytical formula for calculating the normalization constant; The traffic trajectory generation method for covert communication in this application is implemented through the following steps. Step 1: Input the tuple sequence T of the user-provided traffic trajectory (which should include the labeled label c) into Module 1, and extract the data packet feature sequence based on the sending behavior. .

[0091] Step 2, extract the... The input is fed into module two, which extracts the traffic statistics feature matrix based on the packet window.

[0092] Step 3, The matrix input is fed into module three to train the generator. and .

[0093] Step 4: Input T into module 3 to construct the probability and statistics model Beta.

[0094] Step 5, based on the label c entered by the user, use the following steps sequentially. , Together with Beta, we generate a sequence of tuples representing traffic trajectories.

[0095] In step 3, the model training can be performed simultaneously without any specific order, using Algorithm 3 for all steps. In training , Previously, it was necessary to use the matrix, As input features, the observer models are pre-trained respectively. , ; train In Algorithm 3, the conditional information y contains the label c, and the generator output is... Includes valid length and statistical characteristics and according to deal with The observer model is ; train In Algorithm 3, the conditional information y includes the label c and the matrix, and the generator output is... Include And process according to the length information contained in the matrix. The observer model is ; In step 4, a probability model is established for each label. For each label's corresponding time T, time intervals shorter than a specified time threshold are extracted and used to fit the probability model to obtain the probability density function. Finally, the probability model set Beta for each label is obtained; In step 5, the user-specified label c and the first randomly sampled noise are combined. Input to the first generator The output is the traffic statistics features generated by the model. ; The user-specified label c and the randomly sampled second noise Traffic statistics features generated by the model Input to The output is the data packet feature sequence generated by the model. ; Combine the user-specified label c with the data packet feature sequence generated by the model. The input is the probability model set Beta, and the output is... .

[0096] In this embodiment, a pre-trained deep learning classification model for observer O uses the DF model architecture proposed by Sirinam P, which is a deep learning classifier based on convolutional neural networks. Figure 5As shown, the Data Foundation (DF) consists of two parts: a convolutional network for extracting high-dimensional features and a fully connected network for performing the classification task. The convolutional network comprises four basic convolutional blocks, each containing two one-dimensional convolutions, batch normalization, a ReLU activation function, and one max pooling and Dropout operation. The convolutional kernel size is 8, with a stride of 1, and the max pooling window size is 8, with a stride of 4. The output channels of the two convolutional layers in the basic convolutional blocks are 32, 64, 128, and 256 in the four iterations, respectively. The fully connected network consists of two layers of neurons, each with 512 units. Finally, a Prediction layer outputs the classification result.

[0097] The method designed in this application focuses solely on spoofing traffic behavior patterns, that is, it only considers statistical characteristics such as packet load size, time interval, and quantity, without paying attention to the packet content itself. Specifically, the goal of this application is to evade detection by classification models based on traffic behavior patterns, without considering classification models based on packet content. This is because adversarial methods based on traffic behavior patterns and adversarial methods based on packet content are two parallel research directions, and only when the adversarial method and the classification model belong to the same category can they effectively evade detection.

[0098] The method proposed in this application is applicable to traffic pattern spoofing between two communicating hosts. That is, it uses a generative model to learn the behavior pattern of specific traffic, uses the trained model to generate traffic trajectories, guides the communication behavior between the communicating hosts, and makes the generated traffic conform to the specific behavior pattern, thereby avoiding the detection of the traffic classifier.

[0099] For example, a stealth file transfer module can be added to a traditional file transfer system. Using the method proposed in this paper, the target traffic behavior patterns in a corresponding network traffic environment are learned. During file transfer, the rhythm of data transmission is controlled based on the traffic trajectory generated by the model. This mimics the target traffic behavior patterns, evades detection by the traffic classifier, and achieves the goal of stealth transmission.

[0100] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for generating traffic trajectories for covert communication, characterized in that, Includes the following steps: From the traffic trajectory given by the user, the data packet feature sequence is extracted based on the sending behavior; Traffic statistics features are extracted from the data packet feature sequence based on the data packet window; A GAN-based traffic feature generation model is trained based on the aforementioned data packet feature sequences and traffic statistics features; A probabilistic statistical model is built based on the user-provided traffic trajectory; Based on the user-input tags, the trained GAN-based traffic feature generation model and the constructed probabilistic statistical model are used sequentially to generate traffic trajectories for covert communication.

2. The traffic trajectory generation method for covert communication according to claim 1, characterized in that: The process of extracting the data packet feature sequence based on sending behavior includes: representing the traffic trajectory as a tuple sequence; extracting the tuple sequence of sent data packets and the tuple sequence of received data packets from the tuple sequence of the traffic trajectory; then calculating the time interval of the data packets based on the timestamps to form the tuple sequence of sent data packets based on sending behavior and the tuple sequence of received data packets based on sending behavior, respectively, as follows: ； In the formula, Represents the input sequence. The threshold representing the time interval. Indicates the first The timestamp of the first data packet of the sending action. The absolute value of represents the first The number of data packets per sending action. The sign indicates the direction of the original data packet. This indicates the number of transmission actions contained in the input sequence. Indicate the merge rules; Merge the transmitted tuple sequence based on transmission behavior with the received tuple sequence based on transmission behavior, and sort them according to timestamps to obtain the original traffic trajectory tuple sequence based on transmission behavior. Based on the tuple sequence of sending actions, the time interval between sending actions is calculated according to the timestamps to obtain the data packet feature sequence, as expressed by the following formula: ； In the formula, Indicates the relationship with the first The time interval between each sending action and the previous sending action.

3. The traffic trajectory generation method for covert communication according to claim 2, characterized in that: The traffic statistics features extracted based on the packet window include: dividing the data distribution of the number of packets included in the sending behavior in the packet feature sequence into intervals to form categories, and then converting the packet feature sequence into a category-based feature sequence, as shown below: ； In the formula, Indicates by The derived category label, where j represents the number of intervals divided; Then, based on the number of tuples contained in the category-based feature sequence, the category-based feature sequence is divided into n segments of equal number, and 2+j statistical features are extracted from each segment. The statistical features include the average and variance of all time intervals in the segment, as well as the number of occurrences of each category from category 1 to category j, forming a statistical feature matrix.

4. The traffic trajectory generation method for covert communication according to claim 3, characterized in that: The process of segmenting the category-based feature sequence further includes setting a minimum value of the number of tuples contained in the segment as a threshold m, and determining the length of the category-based feature sequence in relation to... Relationship, If the length of the category-based feature sequence is greater than or equal to If so, it is evenly divided into n segments, each segment contains K / n tuples, and the number of tuples in each segment is rounded up; If the length of the category-based feature sequence is less than Then, each segment is filled sequentially, each segment contains m tuples, and 0 is filled in the positions of the statistical feature matrix where no tuples are filled.

5. The traffic trajectory generation method for covert communication according to claim 1, characterized in that: The GAN-based traffic feature generation model includes a generator, a discriminator, and an observer. The generator is a multilayer perceptron, which takes conditional information y and random noise z as input and outputs a fake sample G(z|y) generated with the conditional information y as guidance. When generating traffic statistics features, the conditional information y is a target label c, and the generator output G(z|y) consists of the traffic statistics features and their lengths. When generating the data packet feature sequence, the conditional information y consists of a target label c and the corresponding traffic statistics features, and the generator output G(z|y) is the data packet feature sequence. The discriminator is a multilayer perceptron, whose inputs are real sample x and fake sample G(z|y), and whose output is the logarithm of the probability of judging that the input is a real sample; The observer is a pre-trained deep learning classification model. Its input is fake samples that the discriminator predicts to be real samples. The observer judges the category of the fake samples and feeds the results back to the generator through gradient backpropagation.

6. The traffic trajectory generation method for covert communication according to claim 5, characterized in that: The loss function of the discriminator The following formula represents: ； In the formula, This indicates that the discriminator can distinguish between real samples. and condition information The output, Represents the distribution of real data. The discriminant's average output value for real samples is represented by z, where z represents random noise. This indicates that the generator operates given random noise z and conditional information. The fake samples generated at that time This indicates that the discriminator can detect a given fake sample. and condition information The output, This represents the average output value of the discriminator for fake samples. Indicates the distribution of forged data. This represents a linear interpolation between real and fabricated data points. The corresponding distribution is denoted as , This indicates that the discriminator is in the interpolation The gradient with respect to the input, Indicates gradient Take the p-norm, This means averaging the p-norm of the gradient over all interpolated samples. express The hyperparameter weights of the item; The generator's loss function The following formula represents: ； The process by which the observer feeds back the results to the generator is represented by the following formula: ； In the formula, This represents the cross-entropy loss of the observer. This represents the final loss function of the generator after observer-assisted training. This means minimizing the loss corresponding to the final loss function. The hyperparameter weights represent the observer loss.

7. The traffic trajectory generation method for covert communication according to claim 5, characterized in that: The training of the GAN-based traffic feature generation model includes the following steps: S301: Loop through the specified number of iterations, then execute S302~S313; S302: From Gaussian distribution Sample m noise samples. S303: From the distribution of real data Sample m real samples and their corresponding conditional information; S304: Generate fake samples ; S305: When generating statistical features, from Get the effective length of the output When generating the data packet feature sequence, from Obtain the effective length of the output. ; S306: Will Tail Each element is set to 0, in the formula, Represents the feature dimension of the sample; S307: From uniform distribution Medium sampling vector ; S308: In the formula, Represents the j-th vector; S309: Based on the discriminator's loss function Update the discriminator D parameter; S310: After the discriminator is trained k times, the generator is trained once, and S311~S313 are executed; S311: Select the option that satisfies fake sample set , This indicates that the discriminator operates under given conditions. Below, regarding fake samples The output value; S312: Input the model predictions and true labels of all samples into the cross-entropy loss function, and assign the result to... ; S313: Update the generator parameters based on the final loss function of the generator after training with observer assistance; S314: Returns the generator after training is complete.

8. The traffic trajectory generation method for covert communication according to claim 1, characterized in that: The construction of the probabilistic statistical model based on the user-given traffic trajectory includes: establishing a probabilistic statistical model using a Beta distribution, wherein the probability density function of the probabilistic statistical model is... for: ； In the formula, Represents a random variable. This represents the first shape parameter of the Beta distribution. This represents the second shape parameter of the Beta distribution. The kernel function represents the distribution pattern. It is a Beta function, defined as: ； in, This represents the integral form of the Beta function, where t represents the integration variable. The analytical formula for calculating the normalization constant. express The corresponding gamma function value, express The corresponding gamma function value, Indicates parameters The corresponding gamma function value; A probability model is established for each tag. For the traffic trajectory corresponding to each tag, the time intervals that are less than a specified time threshold are extracted and used to fit the probability model to obtain α and β in the probability density function. Finally, the probability model set Beta for each tag is obtained.

9. The traffic trajectory generation method for covert communication according to claim 1, characterized in that: The generation of traffic tracing for covert communication includes: The user-specified label and randomly sampled first noise are input into the first generator, and the traffic statistics features generated by the model are output. The user-specified label, randomly sampled second noise, and traffic statistics features generated by the model are input into the second generator, which outputs a data packet feature sequence generated by the model. The user-specified tags and the data packet feature sequence generated by the model are input into the probabilistic model set of the probabilistic statistical model, and the output is a traffic trajectory for covert communication.

10. The traffic trajectory generation method for covert communication according to claim 3, characterized in that: The division of intervals into categories follows these steps: For intervals where the number of a single data packet accounts for more than 10% of the overall data distribution, they are classified into a separate category. The numerical intervals of the remaining data packets are sequentially accumulated and merged. For the set of intervals whose proportion after accumulation does not exceed q×10%, they are divided into q subcategories, where q is a positive integer. The following constraints must be met during the division process: each subcategory consists of consecutive adjacent intervals of data packet quantity, and the sample size dispersion of the q subcategories is minimized.

Images