Application traffic identification method under SSR proxy based on machine learning

Abstract

The present invention proposes a method for identifying application traffic under SSR proxy based on machine learning. It is used to solve the problem of low accuracy of application traffic identification under SSR proxy in the prior art. The scheme includes: 1) collecting smartphone traffic data and preprocessing it to obtain a flow data set; 2) obtaining a set of time interval statistical feature vectors, a set of time interval distribution feature vectors, a set of data packet length statistical feature sets, a set of data packet length uniform distribution feature sets, a set of data packet length logarithmic distribution feature sets and a set of data packet length sequence feature sets of the flow data set, and combining them into a feature matrix; 3) using the feature matrix to obtain the training set and test set of the application under SSR proxy; 4) generating a multi-classification model based on the random forest algorithm, and using the model to obtain the application traffic identification result under SSR proxy. The present invention enables the model to more accurately identify the application traffic under SSR proxy, and effectively improves the recognition reliability.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and further relates to a traffic identification method, specifically a method for identifying application traffic under SSR (ShadowsocksR) proxy based on machine learning. It can be used by relevant departments to supervise vulnerable applications or aggressive malicious applications in a local area network, and to screen out potentially dangerous overseas application traffic to maintain network security. Background Art

[0002] The function of a virtual private network (VPN) is to establish a private network on a public network to achieve encrypted communication. It is widely used in enterprise networks. Common VPNs are implemented based on the IPSec protocol and are divided into two parts: the client and the server. Before the communication data is transmitted, the client and the server need to confirm the encryption key through key negotiation. Then the client encrypts the network layer payload of the data packet with the previously negotiated encryption key, encapsulates it and adds a new network layer header. After that, all the data communicated between the client and the server is encrypted, which has good security. This technology is generally used to securely access intranet services, but now some illegal network activists use this technology to encrypt and hide the real data information of their own data packets, so as to bypass the firewall. However, VPNs based on the IPSec protocol require both parties to first undergo a key negotiation session. This process has obvious characteristics, and the technology for identifying this VPN traffic is relatively mature. After that, illegal network activists use Shadowsocks SS VPN technology to carry out illegal network activities. SS VPN is a VPN based on the Socks5 protocol, which also includes two parts: the destination client and the server. When using SS VPN, the SS client will build a local Socks5 proxy on the user's computer or mobile phone. When browsing the network, the network traffic will be divided into the local Socks5 proxy. Then the SS client will encrypt the network layer data of the data packet through the pre-shared key between the SS server, and will also encapsulate and add a new network layer header, and then send it to the SS server. The SS server decrypts the data through the pre-shared key to obtain the original network layer data and the target server address, and forwards the original data packet to the target server. The target server then returns the response data packet to the SS server. The server encrypts the data packet through the same encryption process and forwards it to the SS client. The SS client decrypts and obtains the original data packet and distributes it to the corresponding application. Since SS VPN uses the pre-shared key to encrypt communication, the communication traffic is easily identified as a private protocol. Later, ShadowsocksR VPN appeared on the basis of SS VPN. The probability of this VPN being identified is lower and it is more widely used.

[0003] ShadowsocksR is also a VPN based on the encrypted Socks5 protocol, which can encrypt user communications and hide the user's identity. The communication principle and process are basically the same as SS VPN. Compared with SS VPN, ShadowsocksR VPN supports more encryption suites, increases the security of encrypted communications, and supports obfuscation functions, which can disguise communication data traffic as ordinary TLS traffic. Through packet forwarding, you can see that when using ShadowsocksR VPN to access the network, TLS handshake packets will appear, and from the appearance of the packets, there is no difference from ordinary TLS packets. Therefore, traffic using ShadowsocksR VPN is difficult to be identified by firewalls.

[0004] In today's networks, network traffic from smartphone applications accounts for an increasing proportion of all network traffic. In order to monitor vulnerable apps or malicious apps that may exist in the local area network and maintain the security of the local area network, the identification of app traffic under the ShadowsocksR proxy has become an urgent need for network security managers.

[0005] At present, most of the research on traffic identification at home and abroad focuses on the two scenarios of traffic identification of ordinary applications or identification of VPN traffic and non-VPN traffic. There is almost no research on traffic identification of applications under ShadowsocksR proxy. Traffic identification of applications under ShadowsocksR proxy is a multi-classification problem, which is more difficult than the binary classification problem of VPN traffic and non-VPN traffic identification. Compared with the traffic identification scenario of ordinary applications, there is less raw data from which features can be extracted, because after the ShadowsocksR proxy, the IP address and port of the target server that the application communicates with are all the same, and less entropy information can be extracted from it. In addition, the low accuracy of cross-device identification has always been a problem in the current research on application traffic identification.

[0006] Currently, there are only studies on ShadowSocks traffic identification, and only two types of ShadowSocks traffic and other traffic are classified. In 2016, Draper-Gil et al. extracted the time features of traffic, such as packet timestamp interval, and used KNN and C4.5 machine learning methods to identify ordinary traffic and VPN traffic respectively, with an accuracy of 84.6%. They also made the data set public, but they only identified the traffic type and did not associate the traffic with specific applications. In 2017, Deng et al. collected more than 2GB of Shadowsocks traffic and more than 10GB of non-Shadowsocks traffic, extracted more than 3,000 features, and used the random forest algorithm to build a classifier. The highest accuracy was 92%, but their method was vague in feature extraction, and the cross-device recognition effect was not described.

[0007] The existing network traffic identification technology is generally not very accurate in identifying ShadowSocks traffic and its application source. With the change of mobile terminal devices, the accuracy of traffic identification will also drop significantly. There is even a lack of research on application traffic identification under ShadowSocksR proxy. Summary of the invention

[0008] The purpose of the present invention is to propose a method for identifying application traffic under SSR proxy based on machine learning in view of the deficiencies of the above-mentioned prior art. The method is based on the machine learning random forest algorithm and is used to identify APP traffic under ShadowsocksR proxy, which can solve the problem of low accuracy of application recognition under ShadowsocksR proxy in existing research. It includes traffic collection, traffic segmentation, traffic filtering, feature extraction, and training and testing of random forest models, which can effectively improve the accuracy of APP traffic recognition under ShadowsocksR proxy.

[0009] In order to achieve the above object, the technical solution adopted by the present invention comprises the following steps:

[0010] (1) Obtain the traffic data of the smartphone and preprocess it according to the following steps:

[0011] (1a) Select TCP data packets from non-retransmitted data packets in the traffic data to form the original data set;

[0012] (1b) According to the arrival time of the data packets in the original data set, all data packets are sorted in ascending order to obtain the sorted original data set;

[0013] (1c) The data packets in the sorted original data set are grouped according to the following rules to obtain a burst data set B:

[0014] (1c1) taking the first data packet in the sorted original data set as the first data packet of the first data burst packet;

[0015] (1c2) traverse the data packets in the sorted original data set. If the time interval between the arrival time of the current data packet and the arrival time of the previous data packet is less than 1 second, the current data packet is divided into the data burst group where the previous data packet is located. Otherwise, a data burst group is created and the current data packet is used as the first data packet in the group.

[0016] (1c3) After all data packets are grouped, the burst data set B is obtained:

[0017] B = {burst1,burst2,...,burst r ,...,burst t}

[0018] Among them, burst r represents the rth data burst packet, r = 1, 2, ..., t, t is the total number of data burst packets created;

[0019] (1d) Use the burst data set B to obtain the streaming data set F:

[0020] (1d1) combining the data packets in the rth data burst packet with the same or opposite source IP address, destination IP address, source port number, and destination port number into the wth flow data;

[0021] (1d2) According to the timestamp size of the data packets in the wth flow data, arrange them in order from small to large to obtain the sorted flow data flow w ;

[0022] (1d3) Obtain the sorted flow data corresponding to all data burst packets to obtain the initial flow data set F':

[0023] F'={flow1,flow2,...,flow w ,...,flow e},

[0024] Among them, flow e represents the flow data after the data packets in the e-th flow data synthesized by the t-th data burst group are sorted;

[0025] (1e) among all the data packets of each sorted flow data in the initial flow data set F', the data packet with the same sending direction as the first data packet is taken as the output packet, and the remaining data packets are taken as the input packets, and the input packets in each sorted flow data are formed into an input packet set, the output packets are formed into an output packet set, and the input packets and the output packets together form a bidirectional packet set;

[0026] (1f) performing noise filtering on the initial flow data set F' to obtain the flow data set F;

[0027] F = {flow1,flow2,...,flow k ,...,flow x},

[0028] Among them, flow k represents the kth stream data packet, k = 1, 2, ..., x, x is the total number of stream data packets in F, and x ≤ e;

[0029] (2) Obtain the time interval statistical feature vector set CST of the streaming data set F:

[0030] (2a) Calculate the flow data packets separately k The statistical values ​​of the time interval sequence between adjacent data packets in the input packet set, the output packet set, and the bidirectional packet set are obtained to obtain the first eigenvectors corresponding to the three data packet sets;

[0031] (2b) Horizontally concatenate the first eigenvectors to obtain the flow data group flow k The time interval statistics eigenvector CST k ;

[0032] (2c) Take k = 1, 2, ..., x, and obtain the time interval statistical value feature vectors of all flow data groups, which are used to form the time interval statistical feature vector set CST of the flow data set F:

[0033] CST={CST1,CST2,...,CST k ,...,CST x};

[0034] (3) Obtain the time interval distribution feature vector CDT of the streaming data set F:

[0035] (3a) In (0,10 4 ], 11 logarithmic intervals are divided with base 10: (0,10 -6 ],(10 -6 ,10 -5 ],(10 -5 ,10 -4 ],(10-4 ,10 -3 ],…,(10 3 ,10 4 ]; Count the flow data groups separately k The number of time intervals between adjacent data packets in the input packet set, the output packet set, and the bidirectional packet set falls in each interval, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the second eigenvectors corresponding to the three data packet sets;

[0036] (3b) Horizontally concatenate the second eigenvectors to obtain the flow data group flow k The time interval distribution characteristic vector CDT k ;

[0037] (3c) Take k = 1, 2, ..., x, and obtain the time interval distribution feature vectors of all flow data groups, which are used to form the time interval distribution feature vector CDT of the flow data set F:

[0038] CDT={CDT1,CDT2,...,CDT k ,...,CDT x};

[0039] (4) Obtain the packet length statistical feature set CSL of the flow data set F:

[0040] (4a) Calculate the flow data packets separately k The lengths of all data packets in the input packet set, the output packet set, and the bidirectional packet set are calculated, and the statistical value of the data packet length is calculated to obtain the third eigenvectors corresponding to the three data packet sets;

[0041] (4b) The third eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length statistics vector CSL k ;

[0042] (4c) Take k = 1, 2, ..., x, and obtain the packet length statistics vectors of all flow data groups, which are used to form the packet length statistics feature set CSL of the flow data set F:

[0043] CSL={CSL1,CSL2,...,CSL k ,...,CSL x};

[0044] (5) Obtain the uniform distribution feature set CDL1 of the packet length of the stream data set F:

[0045] (5a) In the range of (0,2500], 25 intervals are evenly divided: (0,80], (80,160], …, (1960,2000]; the flow data packets are counted separately k The number of data packet lengths in the input packet set, the output packet set, and the bidirectional packet set that fall within the corresponding intervals, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the fourth eigenvectors corresponding to the three data packet sets;

[0046] (5b) The fourth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length uniform distribution feature vector CDL1 k ;

[0047] (5c) Take k = 1, 2, ..., x, and obtain the uniformly distributed feature vectors of the data packet lengths of all flow data packets, which are used to form the uniformly distributed feature vector set CDL1 of the flow data set F:

[0048] CDL1={CDL11,CDL12,...,CDL1 k ,...,CDL1 x};

[0049] (6) Obtain the logarithmic distribution feature set CDL2 of the data packet length of the flow data set F:

[0050] (6a) In (0,2 11 ], 11 logarithmic intervals are divided into (0,2 1 ],(2 1 ,2 2 ],(2 2 ,2 3 ],(2 3 ,2 4 ],…,(2 10 ,2 11 ]; Count the flow data groups separately k The number of data packet lengths in the input packet set, the output packet set, and the bidirectional packet set that fall within the corresponding intervals, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the fifth eigenvectors corresponding to the three data packet sets;

[0051] (6b) The fifth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The logarithmic distribution characteristic vector of the packet length CDL2 k ;

[0052] (6c) Take k = 1, 2, ..., x, and obtain the logarithmic distribution feature vectors of the data packet lengths of all flow data groups, which are used to form the logarithmic distribution feature vector set CDL2 of the data packet length of the flow data set F:

[0053] CDL2={CDL21,CDL22,...,CDL2 k ,...,CDL2 x};

[0054] (7) Obtain the packet length sequence feature set CSEL of the stream data set F:

[0055] (7a) In each data packet set, set m interval sets USEC:

[0056] USEC={USEC1,USEC2,...,USEC i ,...,USEC m}

[0057] Among them, USEC i represents the i-th interval, i=1,2,...,m; each interval contains q data packets, s represents the number of data packets contained in a data packet set;

[0058] (7b) Allocate the data packets in a data packet set into m intervals according to the order of appearance;

[0059] (7c) counting the representative length of the data packets in each interval to obtain the data packet length sequence feature vector;

[0060] (7d) Count the flow data groups separately k The length sequence feature vectors of the data packets in the input packet set, the output packet set, and the bidirectional packet set are obtained to obtain the sixth feature vectors corresponding to the three data packet sets;

[0061] (7e) The sixth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length sequence feature vector CSEL k ;

[0062] (7f) Take k = 1, 2, ..., x, and obtain the data packet length sequence feature vectors of all flow data packets, which are used to form the data packet length sequence feature set CSEL of the flow data set F:

[0063] CSEL = {CSEL1, CSEL2, ..., CSEL k ,...,CSEL x};

[0064] (8) Obtain the feature matrix C of the streaming data set F:

[0065] (8a) For the feature set obtained in steps (2)-(7), the time interval statistical feature vector CST k , time interval distribution characteristic vector CDT k , Packet length statistics vector CSL k , Packet length uniform distribution feature vector CDL1 k , Data packet length logarithmic distribution characteristic vector CDL2 k And the packet length sequence feature vector CSEL k Perform horizontal splicing to obtain flow data grouping flow k The temporary eigenvector TC k ;

[0066] The temporary feature vectors of all the flow data groups in the flow data set F are obtained respectively, and the temporary feature vector set TC is obtained:

[0067] TC={TC1,TC2,...,TC k ,...,TC x};

[0068] (8b) The temporary feature vectors in the temporary feature vector set TC are horizontally spliced ​​to obtain the stream data flow k The eigenvector C k ; The horizontal splicing rules are as follows:

[0069] When k = 1, take the temporary eigenvector TC k+1 ,TC k+2 With TC k For horizontal splicing,

[0070] When 1<k<x, the temporary eigenvector TC k-1 TC k+1 With TC k For horizontal splicing,

[0071] When k = x, take the temporary eigenvector TC k-1 TC k-2 With TC k Perform horizontal splicing;

[0072] (8c) All the obtained eigenvectors C1, C2, ..., C k ,...,C x Perform vertical splicing to obtain the feature matrix C of the stream data set F, that is, the processed data set; each row of data in the data set represents a feature vector corresponding to a stream data, and each column of data represents a feature;

[0073] (9) Obtain the application training set TR and traffic test set TE under the ShadowsocksR proxy software:

[0074] (9a) Randomly select no less than 80% of the feature vectors from the feature matrix C of the flow data set F as the feature vector training set TR', and the remaining feature vectors constitute the flow test set TE;

[0075] (9b) adding corresponding application labels L to the feature vectors in the feature vector training set TR', and combining all feature vectors and the label L of each feature vector to form the training set TR;

[0076] (10) Using the training set TR as the input of the random forest algorithm, a multi-classification model is generated based on the random forest algorithm;

[0077] (11) The application traffic test set TE under the ShadowsocksR proxy software is used as the input of the multi-classification model for testing, and the application label corresponding to each feature vector in TE is obtained, that is, the identification result of the application traffic.

[0078] Compared with the prior art, the present invention has the following advantages:

[0079] First, because the innovative length sequence feature adopted by the present invention can reflect more information, for the different operation behaviors of different applications under the ShadowsocksR proxy, the sequence feature can clearly reflect the difference in the generation order of the data packet sizes corresponding to these behaviors, thereby facilitating the distinction of the application to which the traffic belongs, and better completing the identification.

[0080] Second, previous traffic identification solutions based on machine learning only consider the current flow data features for model classification. At this time, if the characteristics of the current flow data of an application change due to network fluctuations or other reasons, resulting in a significant difference from the flow data characteristics of the application under normal circumstances, the model will not be able to correctly identify it. To solve this problem, the present invention comprehensively considers the characteristics of multiple continuous flow data when using the model to identify flow data. Even if the characteristics of one of the flows have changed that is not conducive to model recognition, the characteristics of the adjacent flow data of the same type that have not changed can still be referenced, thereby effectively improving the recognition accuracy and reliability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 It is a flow chart of the implementation of the present invention;

[0082] Figure 2 It is a schematic diagram of an application scenario of the present invention. DETAILED DESCRIPTION

[0083] The present invention will be further described in detail below in conjunction with the accompanying drawings.

[0084] Example 1: Reference Figure 1 and Figure 2 The method for identifying application traffic under SSR proxy based on machine learning proposed by the present invention specifically includes the following steps:

[0085] Step 1. Obtain the traffic data of the smartphone and pre-process it as follows:

[0086] (1a) Select TCP data packets from non-retransmitted data packets in the traffic data to form the original data set;

[0087] (1b) According to the arrival time of the data packets in the original data set, all data packets are sorted in ascending order to obtain the sorted original data set;

[0088] (1c) The data packets in the sorted original data set are grouped according to the following rules to obtain a burst data set B:

[0089] (1c1) taking the first data packet in the sorted original data set as the first data packet of the first data burst packet;

[0090] (1c2) traverse the data packets in the sorted original data set. If the time interval between the arrival time of the current data packet and the arrival time of the previous data packet is less than 1 second, the current data packet is divided into the data burst group where the previous data packet is located. Otherwise, a data burst group is created and the current data packet is used as the first data packet in the group.

[0091] (1c3) After all data packets are grouped, the burst data set B is obtained:

[0092] B = {burst1,burst2,...,burst r ,...,burst t}

[0093] Among them, burst r represents the rth data burst packet, r = 1, 2, ..., t, t is the total number of data burst packets created;

[0094] (1d) Use the burst data set B to obtain the streaming data set F:

[0095] (1d1) combining the data packets in the rth data burst packet with the same or opposite source IP address, destination IP address, source port number, and destination port number into the wth flow data;

[0096] (1d2) According to the timestamp size of the data packets in the wth flow data, arrange them in order from small to large to obtain the sorted flow data flow w ;

[0097] (1d3) Obtain the sorted flow data corresponding to all data burst packets to obtain the initial flow data set F':

[0098] F'={flow1,flow2,...,flow w ,...,flow e},

[0099] Among them, flow e represents the flow data after the data packets in the e-th flow data synthesized by the t-th data burst group are sorted;

[0100] (1e) among all the data packets of each sorted flow data in the initial flow data set F', the data packet with the same sending direction as the first data packet is taken as the output packet, and the remaining data packets are taken as the input packets, and the input packets in each sorted flow data are formed into an input packet set, the output packets are formed into an output packet set, and the input packets and the output packets together form a bidirectional packet set;

[0101] (1f) Perform noise filtering on the initial flow data set F' to obtain the flow data set F:

[0102] F = {flow1,flow2,...,flow k ,...,flow x},

[0103] Among them, flow k represents the kth stream data packet, k = 1, 2, ..., x, x is the total number of stream data packets in F, and x ≤ e;

[0104] This embodiment performs noise filtering on the initial flow data set F', by respectively judging the number of input packets and output packets contained in each sorted flow data in the initial flow data set F' to remove the flow data grouping composed of data packets generated by the background APP of the smart phone or the mobile phone operating system, if the number is less than the preset threshold number, the current sorted flow data is filtered out from the flow data set F, otherwise, it is retained; and the flow data set F is obtained. The threshold here can be set based on experience, and is mainly used to filter out flow data with fewer data packets, because if a flow data contains too few data packets, it is likely that the data packets are generated by the background APP of the smart phone or the mobile phone operating system, and these data packets are noise traffic for the data packets generated by the APP currently running on the smart phone, and should be filtered out.

[0105] Step 2. Get the time interval statistical feature vector set CST of the streaming data set F:

[0106] (2a) Calculate the flow data packets separately k The statistical values ​​of the time interval sequence between adjacent data packets in the input packet set, output packet set, and bidirectional packet set are used to obtain the first eigenvectors corresponding to the three data packet sets; the statistical values ​​of the time interval sequence between adjacent data packets include: mean, minimum, maximum, absolute difference, absolute median, standard deviation, variance, skew, kurtosis, 10% percentile, 20% percentile, 30% percentile, 40% percentile, 50% percentile, 60% percentile, 70% percentile, 80% percentile, 90% percentile. The percentile calculation method here is: take the ωth time interval value in the time interval sequence of the data packet set, according to Get the percentile per%; represents rounding up, Set1 represents a time interval value sequence of a data packet set, per represents an arbitrary number, and per is taken as 10, 20, 30, ..., 90 to obtain the required percentiles respectively.

[0107] (2b) Horizontally concatenate the first eigenvectors to obtain the flow data group flow k The time interval statistics eigenvector CST k ;

[0108] (2c) Take k = 1, 2, ..., x, and obtain the time interval statistical value feature vectors of all flow data groups, which are used to form the time interval statistical feature vector set CST of the flow data set F:

[0109] CST={CST1,CST2,...,CST k ,...,CST x};

[0110] Step 3. Get the time interval distribution feature vector CDT of the streaming data set F:

[0111] (3a) In (0,10 4 ], 11 logarithmic intervals are divided with base 10: (0,10 -6 ],(10 -6 ,10 -5 ],(10 -5 ,10 -4 ],(10 -4 ,10 -3 ],…,(10 3 ,10 4 ]; Count the flow data groups separately kThe number of time intervals between adjacent data packets in the input packet set, the output packet set, and the bidirectional packet set falls in each interval, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the second eigenvectors corresponding to the three data packet sets;

[0112] (3b) Horizontally concatenate the second eigenvectors to obtain the flow data group flow k The time interval distribution characteristic vector CDT k ;

[0113] (3c) Take k = 1, 2, ..., x, and obtain the time interval distribution feature vectors of all flow data groups, which are used to form the time interval distribution feature vector CDT of the flow data set F:

[0114] CDT={CDT1,CDT2,...,CDT k ,...,CDT x};

[0115] Step 4. Obtain the packet length statistical feature set CSL of the flow data set F:

[0116] (4a) Calculate the flow data packets separately k The lengths of all data packets in the input packet set, the output packet set, and the bidirectional packet set are calculated, and the statistical values ​​of the data packet lengths are calculated to obtain the third eigenvectors corresponding to the three data packet sets; the statistical values ​​of the data packet lengths include: mean value, minimum value, maximum value, absolute difference, absolute median difference, standard deviation, variance, skew, kurtosis, 10% percentile, 20% percentile, 30% percentile, 40% percentile, 50% percentile, 60% percentile, 70% percentile, 80% percentile, 90% percentile; the percentile calculation method here is: take the ωth time interval value in the time interval sequence of the data packet set, according to Get the percentile per%; represents round up, Set2 represents a length value sequence of a data packet set, per represents an arbitrary number, and per is taken as 10, 20, 30, ..., 90 to calculate the required percentile.

[0117] (4b) The third eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length statistics vector CSL k ;

[0118] (4c) Take k = 1, 2, ..., x, and obtain the packet length statistics vectors of all flow data groups, which are used to form the packet length statistics feature set CSL of the flow data set F:

[0119] CSL={CSL1,CSL2,...,CSL k ,...,CSL x};

[0120] Step 5. Obtain the packet length uniform distribution feature set CDL1 of the flow data set F:

[0121] (5a) In the range of (0,2500], 25 intervals are evenly divided: (0,80], (80,160], …, (1960,2000]; the flow data packets are counted separately k The number of data packet lengths in the input packet set, the output packet set, and the bidirectional packet set that fall within the corresponding intervals, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the fourth eigenvectors corresponding to the three data packet sets;

[0122] (5b) The fourth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length uniform distribution feature vector CDL1 k ;

[0123] (5c) Take k = 1, 2, ..., x, and obtain the uniformly distributed feature vectors of the data packet lengths of all flow data packets, which are used to form the uniformly distributed feature vector set CDL1 of the flow data set F:

[0124] CDL1={CDL11,CDL12,...,CDL1 k ,...,CDL1 x};

[0125] Step 6. Obtain the data packet length logarithmic distribution feature set CDL2 of the flow data set F:

[0126] (6a) In (0,2 11 ], 11 logarithmic intervals are divided into (0,2 1 ],(2 1 ,2 2 ],(2 2 ,2 3 ],(2 3 ,2 4 ],…,(2 10 ,2 11 ]; Count the flow data groups separately k The number of data packet lengths in the input packet set, the output packet set, and the bidirectional packet set that fall within the corresponding intervals, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the fifth eigenvectors corresponding to the three data packet sets;

[0127] (6b) The fifth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The logarithmic distribution characteristic vector of the packet length CDL2 k ;

[0128] (6c) Take k = 1, 2, ..., x, and obtain the logarithmic distribution feature vectors of the data packet lengths of all flow data groups, which are used to form the logarithmic distribution feature vector set CDL2 of the data packet length of the flow data set F:

[0129] CDL2={CDL21,CDL22,...,CDL2 k ,...,CDL2 x};

[0130] Step 7. Get the packet length sequence feature set CSEL of the flow data set F:

[0131] (7a) In each data packet set, set m interval sets USEC:

[0132] USEC={USEC1,USEC2,...,USEC i ,...,USEC m}

[0133] Among them, USEC i represents the i-th interval, i=1,2,...,m; each interval contains q data packets, s represents the number of data packets contained in a data packet set;

[0134] (7b) Allocate the data packets in a data packet set into m intervals according to the order of appearance;

[0135] (7c) Count the representative length of the data packets in each interval to obtain the characteristic vector of the data packet length sequence; this is achieved as follows: sequentially take the data packet that appears the most times in each sub-interval and use its length as the representative length of the data packet in the sub-interval; divide the number of data packets contained in the data packet set by m and round up to obtain the number of data packets that should be contained in each sub-interval; when the number of data packets contained in the data packet set is not enough to be divided into m sub-intervals according to the number of data packets that should be contained in each sub-interval, that is, when one or more of the latter sub-intervals do not contain data packets, the representative length of the data packets in the sub-intervals that are not allocated with data packets is set to 0.

[0136] (7d) Count the flow data groups separately k The length sequence feature vectors of the data packets in the input packet set, the output packet set, and the bidirectional packet set are obtained to obtain the sixth feature vectors corresponding to the three data packet sets;

[0137] (7e) The sixth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length sequence feature vector CSEL k ;

[0138] (7f) Take k = 1, 2, ..., x, and obtain the data packet length sequence feature vectors of all flow data packets, which are used to form the data packet length sequence feature set CSEL of the flow data set F:

[0139] CSEL = {CSEL1, CSEL2, ..., CSEL k ,...,CSEL x};

[0140] Step 8. Get the feature matrix C of the streaming dataset F:

[0141] (8a) For the feature set obtained in steps (2)-(7), the time interval statistical feature vector CST k , time interval distribution characteristic vector CDT k , Packet length statistics vector CSL k , Packet length uniform distribution feature vector CDL1 k , Data packet length logarithmic distribution characteristic vector CDL2 k And the packet length sequence feature vector CSEL k Perform horizontal splicing to obtain flow data grouping flow k The temporary eigenvector TC k ;

[0142] The temporary feature vectors of all the flow data groups in the flow data set F are obtained respectively, and the temporary feature vector set TC is obtained:

[0143] TC={TC1,TC2,...,TC k ,...,TC x};

[0144] (8b) The temporary feature vectors in the temporary feature vector set TC are horizontally spliced ​​to obtain the stream data flow k The eigenvector C k ; The horizontal splicing rules are as follows:

[0145] When k = 1, take the temporary eigenvector TC k+1 TC k+2 With TC k For horizontal splicing,

[0146] When 1<k<x, the temporary eigenvector TC k-1 TCk+1 With TC k For horizontal splicing,

[0147] When k = x, take the temporary eigenvector TC k-1 TC k-2 With TC k Perform horizontal splicing;

[0148] The splicing rules formulated here are mainly based on the consideration that smartphone users do not switch applications frequently. k When considering the category, the characteristics of its previous and subsequent stream data should also be taken into consideration.

[0149] (8c) All the obtained eigenvectors C1, C2, ..., C k ,...,C x Perform vertical splicing to obtain the feature matrix C of the stream data set F, that is, the processed data set; each row of data in the data set represents a feature vector corresponding to a stream data, and each column of data represents a feature;

[0150] Step 9. Get the application training set TR and traffic test set TE under the ShadowsocksR proxy software:

[0151] (9a) Randomly select no less than 80% of the feature vectors from the feature matrix C of the flow data set F as the feature vector training set TR', and the remaining feature vectors constitute the flow test set TE;

[0152] (9b) adding corresponding application labels L to the feature vectors in the feature vector training set TR', and combining all feature vectors and the label L of each feature vector to form the training set TR;

[0153] Step 10. Use the training set TR as the input of the random forest algorithm and generate a multi-classification model based on the random forest algorithm;

[0154] Step 11. Use the application traffic test set TE under the ShadowsocksR proxy software as the input of the multi-classification model for testing, and obtain the application label corresponding to each feature vector in TE, that is, the identification result of the application traffic.

[0155] Embodiment 2: The implementation steps of this embodiment are the same as those of Embodiment 1. With regard to some of the settings and parameters, the preferred values ​​are given to further describe the technical solution of the present invention as follows:

[0156] Step 1) Obtain smartphone traffic data and preprocess the smartphone traffic data:

[0157] Step 1a) You need to turn on the hotspot of the computer with a wireless network card and connect the smartphone used in the experiment to the hotspot. Turn on the ShadowsocksR proxy on the smartphone and run the applications Telegram, Youtube, Twitter and Instagram respectively. When running an application, you must clear all the applications that can be closed in the background. At this time, all the traffic generated by the smartphone will flow through the computer with the hotspot turned on. By turning on WireShark packet capture on the computer with the hotspot turned on, you can obtain all the traffic of the corresponding application that turns on the ShadowsocksR proxy on the smartphone, set conditions, and use Wireshark software to obtain non-retransmitted TCP data packets. Save the obtained traffic in different pcap files according to the application, so that when extracting the feature vector of the training set later, you can add the corresponding correct label to the feature vector.

[0158] Step 1b) Sort the data packets in the original data set in ascending order according to the arrival time. Take the first data packet as the first data packet of a data burst group, traverse the data packets in the currently sorted original data set, and if the arrival time interval between the current data packet and the previous data packet is less than 1 second, then divide the current data packet into the data burst group where the previous data packet is located, otherwise take the current data packet as the first data packet in a new data burst group. All data burst groups constitute a burst data set BurstDataSet, that is:

[0159] BurstDataSet={burst1,burst2,...,burst r ,...,burst t}

[0160] Among them, burst r represents the rth data burst packet, r = 1, 2, ..., t, t is the total number of data burst packets created;

[0161] When the time interval between the arrival of two packets exceeds 1 second, it can be considered that the smartphone user has switched applications or performed different operations within the same application. This segmentation of traffic makes the granularity of traffic grouping finer based on the traffic generated by one behavior of one application.

[0162] Step 1c) traverse the burst data set BurstDataSet obtained in the previous step, and for a data burst packet, synthesize the data packets with the same or opposite source IP address, destination IP address, source port number, and destination port number into flow data, and arrange all the data packets in the order of timestamp size from small to large; all the synthesized flow data together constitute the initial flow data set F';

[0163] Step 1d) After step 1c, the obtained flow data group contains a set of bidirectional data packets for communication between the smartphone application and a target IP address. The data packets in the flow data group with the same sending direction as the first data packet are taken as output packets, and the remaining data packets are taken as input packets. All data packets in the entire flow data group are taken as bidirectional packets. When the number of data packets contained in the input packet or output packet in the flow data is less than 8, the current flow data is filtered out to obtain the flow data set FlowDataSet:

[0164] FlowDataSet={flow1,flow2,...,flow k ,...,flow x}

[0165] flow k is the kth stream data, and x is the total number of the filtered stream data. In this example, x=58493 is set.

[0166] Step 2) Get the time interval statistical feature vector set CST of the flow data set FlowDataSet:

[0167] Step 2a) Calculate a flow data packet flow k The statistical values ​​of the time interval sequence between adjacent data packets in the input packet set, output packet set, and bidirectional packet set: mean, minimum, maximum, absolute difference, absolute median difference, standard deviation, variance, skew, kurtosis, 10% percentile, 20% percentile, 30% percentile, 40% percentile, 50% percentile, 60% percentile, 70% percentile, 80% percentile, 90% percentile, and the feature vectors obtained from the three data packet sets are horizontally spliced ​​to obtain the time interval statistical value feature vector CST k ,The time interval statistics feature vectors corresponding to the flow dataset FlowDataSet constitute the time interval statistics feature vector set CST.

[0168] Step 3) Get the time interval distribution feature vector CDT of the flow data set FlowDataSet:

[0169] Step 3a) Take (0,10 4] is the range, and 11 logarithmic intervals are divided with 10 as the base, (0,10 -6 ],(10 -6 ,10 -5 ],(10 -5 ,10 -4 ],(10 -4 ,10 -3 ],…,(10 3 ,10 4 ] Count the flow data groups separately k The number of time intervals between adjacent data packets in the input packet set, output packet set, and bidirectional packet set that fall in each interval is calculated, and the number of values ​​is arranged in the order of the intervals to which they belong. The feature vectors obtained from the three data packet sets are horizontally spliced ​​to obtain the time interval distribution feature vector CDT k ,The time interval distribution feature vectors corresponding to the flow dataset FlowDataSet constitute the time distribution feature vector set CST.

[0170] Step 4) Get the data packet length statistical feature set CSL of the flow data set FlowDataSet:

[0171] Step 4a) Count the flow data of the flow data set FlowDataSet respectively k The lengths of all packets in the input packet set, output packet set, and bidirectional packet set are calculated, and the packet length statistics are calculated: mean, minimum, maximum, absolute difference, absolute median difference, standard deviation, variance, skew, kurtosis, 10% percentile, 20% percentile, 30% percentile, 40% percentile, 50% percentile, 60% percentile, 70% percentile, 80% percentile, 90% percentile; the feature vectors obtained from the three packet sets are horizontally spliced ​​to get the flow k The statistical value vector CSL k , the packet length statistical value feature vectors corresponding to the flow data set FlowDataSet constitute the packet length statistical feature set CSL.

[0172] Step 5) Get the data packet length uniform distribution feature set CDL1 of the flow data set FlowDataSet:

[0173] Step 5a) Take the range (0,2500] and divide it into 25 intervals evenly, (0,80], (80,160], …, (1960,2000], and count the flow data flow respectively kThe number of data packet lengths in the input packet set, output packet set, and bidirectional packet set that fall within the corresponding intervals is arranged in the order of the intervals, and the feature vectors obtained from the three data packet sets are horizontally spliced ​​to obtain the uniformly distributed feature vector CDL1 of the data packet length. k , the data packet length uniform distribution feature vectors corresponding to the flow data set FlowDataSet constitute the data packet length uniform distribution feature vector set CDL1.

[0174] Step 6) Obtain the data packet length logarithmic distribution feature set CDL2 of the flow data set FlowDataSet:

[0175] Step 6a) Take (0,2 11 ] bit range, divided into 11 logarithmic intervals (0,2 1 ],(2 1 ,2 2 ],(2 2 ,2 3 ],(2 3 ,2 4 ],…,(2 10 ,2 11 ] Count the flow data groups separately k The number of data packet lengths in the input packet set, output packet set, and bidirectional packet set that fall within the corresponding intervals is arranged in the order of the intervals to which they belong. The feature vectors obtained from the three data packet sets are horizontally spliced ​​to obtain the data packet length logarithmic distribution feature vector CDL2 k The logarithmic distribution feature vectors of the data packet lengths corresponding to the flow data set FlowDataSet constitute the data packet length logarithmic distribution feature set CDL2.

[0176] Step 7) Get the data packet length sequence feature set CSEL of the flow data set FlowDataSet:

[0177] Step 7a) The length of the data packets contained in a stream data can reflect the characteristics of the application operation behavior corresponding to the stream data in the order of appearance. For a data packet set, set m interval sets USEC:

[0178] USEC={USEC1,USEC2,...,USEC i ,...,USEC m}

[0179] Among them, USEC i represents the i-th interval, i=1,2,...,m; each interval contains q data packets, s represents the number of data packets contained in a data packet set;

[0180] Sequentially take the length of the packet that appears most times in each sub-interval as the representative length of the packet in that interval. When the number of packets contained in the packet set is small, one or more of the later sub-intervals may not contain packets. In this case, the representative length of the interval packet that is not assigned to a packet is set to 0. Here m = 10, which is the optimal value obtained after multiple debugging. Count the representative length of the packet in each interval set to obtain the characteristic vector of the packet length sequence. Count the flow data packets separately. k The data packet length sequence features of the input packet set, output packet set, and bidirectional packet set are horizontally spliced ​​to obtain the data packet length sequence feature vector CSEL k The data packet length sequence feature vectors corresponding to the flow data set FlowDataSet constitute a data packet length feature sequence feature set CSEL.

[0181] Step 8) Get the feature matrix C of the flow data set FlowDataSet:

[0182] Step 8a) The feature vector CST in the time interval statistical feature vector set CST is k , the characteristic vector CDT in the time interval distribution characteristic vector set CDT k , the feature vector CSL in the packet length statistical feature set CSL k , the feature vector CDL1 in the feature set CDL1 with uniform distribution of packet length k , the feature vector CDL2 in the feature set CDL2 of the logarithmic distribution of packet length k , the feature vector CSEL in the packet length sequence feature set CSEL k Perform horizontal splicing to obtain flow data flow k The temporary eigenvector TC k .

[0183] Step 8b) Considering that smartphone users do not switch applications frequently, determine the current flow data flow k When the flow is classified, its front and back flow data characteristics should also be taken into account. k-1 The temporary eigenvector TC k-1 and flow k+1 The temporary eigenvector TC k+1 with flow k The temporary eigenvector TC k Horizontal splicing, finally get the flow data flow k The eigenvector C k , when k = 0, take flowk+1 with flow k+2 The temporary feature vector and flow k The temporary feature vectors of flow are concatenated horizontally. k When it is the last flow data in the current flow data set, take flow k-1 with flow k-2 The temporary feature vector and flow k The temporary feature vectors of C1, C2, C3, ..., C k , …, C x Perform vertical splicing to obtain the feature matrix C of the flow data set FlowDataSet. This feature matrix C is the processed data set, in which each row of data represents a feature vector corresponding to a flow data, and each column of data represents a feature.

[0184] Step 9) Obtain the application training set TR and test set TE under ShadowsocksR VPN proxy

[0185] Step 9a) more than 80% of the feature vectors randomly selected from the feature matrix C of the flow data set FlowDataSet are used as the feature vector training set TR', and the remaining feature vectors constitute the flow test set TE;

[0186] TR'={C1,C2,...,C v ,...,C z}

[0187] Among them, C v represents the vth eigenvector in TR', and z represents the total number of eigenvectors.

[0188] Step 9b) For the feature vector C v Add the corresponding application labels L, L∈{label0,label1,label2,label3}, where label0, label1, label2, label3 represent the applications Telegram, YouTube, Twitter, and Instagram, respectively. The z feature vectors and the label L of each feature vector form the training set TR.

[0189] Step 10) Obtain a multi-classification model M based on the random forest algorithm:

[0190] The training set TR is used as the input of the random forest algorithm to build a multi-classification model M.

[0191] Step 11) Get the identification results of the application traffic:

[0192] The application traffic test set TE under the ShadowsocksR VPN proxy is used as the input of the multi-classification model M for testing, and the application Telegram, Youtube, Twitter, and Instagram labels corresponding to each feature vector in TE are obtained, that is, the recognition results.

[0193] The present invention proposes innovative length sequence features, which can reflect the differences in the order of packet issuance of different operating behaviors of different applications under the SSR proxy, so that the model based on the random forest algorithm can more accurately identify the application traffic under the ShadowsocksR proxy. In addition, this method comprehensively considers the features of multiple continuous stream data for model classification. Compared with model classification that only considers the features of the current stream data, even if the features of the current stream data have changed for some reason, the recognition accuracy of the model can still be improved by referring to the surrounding stream data of the same type.

[0194] Parts of the present invention that are not described in detail belong to common knowledge among those skilled in the art.

[0195] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Obviously, for professionals in this field, after understanding the content and principles of the present invention, they may make various modifications and changes in form and details without departing from the principles and structures of the present invention. However, these modifications and changes based on the ideas of the present invention are still within the scope of protection of the claims of the present invention.

Claims

1. A method for identifying application traffic under SSR proxy based on machine learning, characterized in that: include: (1) Obtain the traffic data of the smartphone and preprocess it according to the following steps: (1a) Select TCP data packets from non-retransmitted data packets in the traffic data to form the original data set; (1b) According to the arrival time of the data packets in the original data set, all data packets are sorted in ascending order to obtain the sorted original data set; (1c) The data packets in the sorted original data set are grouped according to the following rules to obtain a burst data set B: (1c1) taking the first data packet in the sorted original data set as the first data packet of the first data burst packet; (1c2) traverse the data packets in the sorted original data set. If the time interval between the arrival time of the current data packet and the arrival time of the previous data packet is less than 1 second, the current data packet is divided into the data burst group where the previous data packet is located. Otherwise, a data burst group is created and the current data packet is used as the first data packet in the group. (1c3) After all data packets are grouped, the burst data set B is obtained: B={burst1,burst2,...,burst r ,...,burst t } Among them, burst r represents the rth data burst packet, r = 1, 2, ..., t, t is the total number of data burst packets created; (1d) Use the burst data set B to obtain the streaming data set F: (1d1) combining the data packets in the rth data burst packet with the same or opposite source IP address, destination IP address, source port number, and destination port number into the wth flow data; (1d2) According to the timestamp size of the data packets in the wth flow data, arrange them in order from small to large to obtain the sorted flow data flow w ; (1d3) Obtain the sorted flow data corresponding to all data burst packets to obtain the initial flow data set F': F'={flow1,flow2,...,flow w ,...,flow e }, Among them, flow e represents the flow data after the data packets in the e-th flow data synthesized by the t-th data burst group are sorted; (1e) among all the data packets of each sorted flow data in the initial flow data set F', the data packet with the same sending direction as the first data packet is taken as the output packet, and the remaining data packets are taken as the input packets, and the input packets in each sorted flow data are formed into an input packet set, the output packets are formed into an output packet set, and the input packets and the output packets together form a bidirectional packet set; (1f) Noise filtering is performed on the initial flow data set F', which is to remove the flow data grouping composed of data packets generated by the background APP of the smart phone or the mobile phone operating system by respectively judging the number of input packets and output packets contained in each sorted flow data in the initial flow data set F'. If the number is less than a preset threshold number, the current sorted flow data is filtered out from the flow data set F, otherwise, it is retained; the flow data set F is obtained: F={flow1,flow2,...,flow k ,...,flow x }, Among them, flow k represents the kth stream data packet, k = 1, 2, ..., x, x is the total number of stream data packets in F, and x ≤ e; (2) Obtain the time interval statistical feature vector set CST of the streaming data set F: (2a) Calculate the flow data packets separately k The statistical values ​​of the time interval sequence between adjacent data packets in the input packet set, the output packet set, and the bidirectional packet set are obtained to obtain the first eigenvectors corresponding to the three data packet sets; (2b) Horizontally concatenate the first eigenvectors to obtain the flow data group flow k The time interval statistics eigenvector CST k ; (2c) Take k = 1, 2, ..., x, and obtain the time interval statistical value feature vectors of all flow data groups, which are used to form the time interval statistical feature vector set CST of the flow data set F: CST={CST1,CST2,...,CST k ,...,CST x }; (3) Obtain the time interval distribution feature vector CDT of the streaming data set F: (3a) In (0,10 4 ], 11 logarithmic intervals are divided with base 10: (0,10 -6 ],(10 -6 ,10 -5 ],(10 -5 ,10 -4 ],(10 -4 ,10 -3 ],…,(10 3 ,10 4 ]; Count the flow data groups separately k The number of time intervals between adjacent data packets in the input packet set, the output packet set, and the bidirectional packet set falls in each interval, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the second eigenvectors corresponding to the three data packet sets; (3b) Horizontally concatenate the second eigenvectors to obtain the flow data group flow k The time interval distribution characteristic vector CDT k ; (3c) Take k = 1, 2, ..., x, and obtain the time interval distribution feature vectors of all flow data groups, which are used to form the time interval distribution feature vector CDT of the flow data set F: CDT={CDT1,CDT2,...,CDT k ,...,CDT x }; (4) Obtain the packet length statistical feature set CSL of the flow data set F: (4a) Calculate the flow data packets separately k The lengths of all data packets in the input packet set, the output packet set, and the bidirectional packet set are calculated, and the statistical value of the data packet length is calculated to obtain the third eigenvectors corresponding to the three data packet sets; (4b) The third eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length statistics vector CSL k ; (4c) Take k = 1, 2, ..., x, and obtain the packet length statistics vectors of all flow data groups, which are used to form the packet length statistics feature set CSL of the flow data set F: CSL={CSL1,CSL2,...,CSL k ,...,CSL x }; (5) Obtain the uniform distribution feature set CDL1 of the packet length of the stream data set F: (5a) In the range of (0,2500], 25 intervals are evenly divided: (0,80], (80,160], …, (1960,2000]; the flow data packets are counted separately k The number of data packet lengths in the input packet set, the output packet set, and the bidirectional packet set that fall within the corresponding intervals, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the fourth eigenvectors corresponding to the three data packet sets; (5b) The fourth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length uniform distribution feature vector CDL1 k ; (5c) Take k = 1, 2, ..., x, and obtain the uniformly distributed feature vectors of the data packet lengths of all flow data packets, which are used to form the uniformly distributed feature vector set CDL1 of the flow data set F: CDL1={CDL11,CDL12,...,CDL1 k ,...,CDL1 x }; (6) Obtain the logarithmic distribution feature set CDL2 of the data packet length of the flow data set F: (6a) In (0,2 11 ], 11 logarithmic intervals are divided into (0,2 1 ],(2 1 ,2 2 ],(2 2 ,2 3 ],(2 3 ,2 4 ],…,(2 10 ,2 11 ]; Count the flow data groups separately k The number of data packet lengths in the input packet set, the output packet set, and the bidirectional packet set that fall within the corresponding intervals, and the number of values ​​is arranged in the order of the intervals to which they belong, to obtain the fifth eigenvectors corresponding to the three data packet sets; (6b) The fifth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The logarithmic distribution characteristic vector of the packet length CDL2 k ; (6c) Take k = 1, 2, ..., x, and obtain the logarithmic distribution feature vectors of the packet lengths of all flow data groups, which are used to form the set CDL2 of the logarithmic distribution feature vectors of the packet lengths of the flow data set F: CDL2={CDL21,CDL22,...,CDL2 k ,...,CDL2 x }; (7) Obtain the packet length sequence feature set CSEL of the stream data set F: (7a) In each data packet set, set m interval sets USEC: USEC={USEC1,USEC2,...,USEC i ,...,USEC m } Among them, USEC i represents the i-th interval, i = 1, 2, ..., m; each interval contains q data packets, s represents the number of data packets contained in a data packet set; (7b) Allocate the data packets in a data packet set into m intervals according to the order of appearance; (7c) Count the representative length of the data packets in each interval to obtain the data packet length sequence feature vector; this is achieved as follows: sequentially take the data packet that appears the most times in each sub-interval, and use its length as the representative length of the data packet in the sub-interval; divide the number of data packets contained in the data packet set by m and round it up to obtain the number of data packets that should be contained in each sub-interval; when the number of data packets contained in the data packet set is not enough to be divided into m sub-intervals according to the number of data packets that should be contained in each sub-interval, that is, when one or more of the latter sub-intervals do not contain data packets, set the representative length of the data packets in the sub-intervals that are not allocated with data packets to 0; (7d) Count the flow data groups separately k The length sequence feature vectors of the data packets in the input packet set, the output packet set, and the bidirectional packet set are obtained to obtain the sixth feature vectors corresponding to the three data packet sets; (7e) The sixth eigenvector is horizontally spliced ​​to obtain the flow data group flow k The packet length sequence feature vector CSEL k ; (7f) Take k = 1, 2, ..., x, and obtain the data packet length sequence feature vectors of all flow data packets, which are used to form the data packet length sequence feature set CSEL of the flow data set F: CSEL={CSEL1,CSEL2,...,CSEL k ,...,RUSE x }; (8) Obtain the feature matrix C of the streaming data set F: (8a) For the feature set obtained in steps (2)-(7), the time interval statistical feature vector CST k , time interval distribution characteristic vector CDT k , Packet length statistics vector CSL k , Packet length uniform distribution feature vector CDL1 k , Data packet length logarithmic distribution characteristic vector CDL2 k And the packet length sequence feature vector CSEL k Perform horizontal splicing to obtain flow data grouping flow k The temporary eigenvector TC k ; The temporary feature vectors of all the flow data groups in the flow data set F are obtained respectively, and the temporary feature vector set TC is obtained: TC={TC1,TC2,...,TC k ,...,TC x }; (8b) The temporary feature vectors in the temporary feature vector set TC are horizontally spliced ​​to obtain the stream data flow k The eigenvector C k ; The horizontal splicing rules are as follows: When k = 1, take the temporary eigenvector TC k+1 TC k+2 With TC k For horizontal splicing, When 1<k<x, the temporary eigenvector TC k-1 TC k+1 With TC k For horizontal splicing, When k = x, take the temporary eigenvector TC k-1 TC k-2 With TC k Perform horizontal splicing; (8c) All the obtained eigenvectors C1, C2, ..., C k ,...,C x Perform vertical splicing to obtain the feature matrix C of the stream data set F, that is, the processed data set; each row of data in the data set represents a feature vector corresponding to a stream data, and each column of data represents a feature; (9) Obtain the application training set TR and traffic test set TE under the ShadowsocksR proxy software: (9a) Randomly select no less than 80% of the feature vectors from the feature matrix C of the flow data set F as the feature vector training set TR', and the remaining feature vectors constitute the flow test set TE; (9b) adding corresponding application labels L to the feature vectors in the feature vector training set TR', and combining all feature vectors and the label L of each feature vector to form the training set TR; (10) Using the training set TR as the input of the random forest algorithm, a multi-classification model is generated based on the random forest algorithm; (11) The application traffic test set TE under the ShadowsocksR proxy software is used as the input of the multi-classification model for testing, and the application label corresponding to each feature vector in TE is obtained, that is, the identification result of the application traffic.

2. The method according to claim 1, characterized in that: The statistical values ​​of the time interval sequence between adjacent data packets in step (2a) and the statistical values ​​of the data packet length in step (4a) include: mean, minimum, maximum, absolute difference, absolute median difference, standard deviation, variance, skew, kurtosis, 10% percentile, 20% percentile, 30% percentile, 40% percentile, 50% percentile, 60% percentile, 70% percentile, 80% percentile, 90% percentile.

3. The method according to claim 2, characterized in that: The percentile is calculated in the statistical value of the time interval sequence between adjacent data packets as follows: take the ωth time interval value in the time interval sequence of the data packet set, and calculate it according to Get the percentile per%; represents round up, Set1 represents a sequence of time interval values ​​of a set of data packets, and per represents an arbitrary number.

4. The method according to claim 2, characterized in that: The percentile in the data packet length statistics is calculated by taking the ωth time interval value in the time interval sequence of the data packet set, and calculating the percentile according to Get the percentile per%; represents rounding up, Set2 represents a sequence of length values ​​of a data packet set, and per represents an arbitrary number.

Images