A method for positioning and identifying personal identification information based on static pollution

Abstract

The present invention relates to a method for locating and identifying personal identification information based on static contamination, and belongs to the field of network information security technology. This method uses input personal identification information as shared information, and uses the behavior of shared information flowing in the data to discover the association between different "service-locations", construct an information flow graph, and use the traversal algorithm of graph theory to locate and extract personal identification information. This method automatically and accurately locates and extracts personal identification information based on the input infection value. The present invention effectively solves the problem of accurately locating and extracting personal identification information in network traffic data, especially large-scale network traffic data, while overcoming the false positives caused by "excessive contamination", and can help automatically label large-scale sparse data sets, avoiding manual intervention and crowdsourcing feedback.

Description

Technical Field

[0001] The invention relates to a method for positioning and identifying personal identification information based on static pollution, and belongs to the technical field of network information security. Background Art

[0002] Personal identification information refers to information that can identify, distinguish or track an independent individual. It can be a single (or direct) piece of information or a combination of multiple (or indirect) pieces of information.

[0003] With the rapid development of network technology, the detection of privacy leakage of personal identification information in network traffic faces the challenge of big data. First, high-bandwidth network traffic brings large-scale network traffic data, and the difference between the number of positive and negative samples is large, resulting in data imbalance, which leads to the sparsity of data in the detection samples. Secondly, the detection method needs to overcome the dilemma of the extraction method of personal identification information in non-repetitive and unstructured data. Most of the network big data belongs to non-repetitive and unstructured data. The regular matching method, keyword semantic method and dictionary method currently used cannot obtain satisfactory detection results. In addition, the detection method also needs to exclude factors of artificial interference as much as possible, avoid interactive behaviors such as crowdsourcing feedback calibration data sets, and avoid building models through prior knowledge rules, thereby sacrificing the automation performance of the method. Finally, there is a lot of noise interference in real network traffic data, which affects the accuracy of the method detection results. In addition, in large-scale network traffic, the detection method of privacy leakage of personal identification information also faces the challenge of computing performance.

[0004] In short, the location and extraction of personal identification information requires the extraction of knowledge rules from sparse and unstructured data, artificial interference factors, etc., and it must have a strong ability to resist noise interference and efficient computing performance. Therefore, it is very difficult to accurately locate and extract personal identification information in large-scale network traffic data. Summary of the invention

[0005] The purpose of the present invention is to solve the technical problem of how to accurately locate and extract personal identification information in network traffic data, especially large-scale network traffic data, and creatively propose a method for locating and extracting personal identification information based on static pollution.

[0006] The innovation of the present invention is that it uses the input personal identification information as shared information, and uses the behavior of shared information flowing in the data to discover the association between different "service-locations", construct an information flow graph, and use the traversal algorithm of graph theory to locate and extract personal identification information. This method automatically and accurately locates and extracts personal identification information based on the input tainting value.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0008] A method for locating and identifying personal identification information based on static pollution comprises the following steps:

[0009] Step 1: Convert network traffic into a data set. The data set contains three dimensions: application service Domain, location Key, and personal identification information Value.

[0010] Step 2: Filter and reshape the data set output in step 1.

[0011] Step 3: Use the recursive contamination process to build an information flow graph, where the contamination process includes the inter-area routing process and the intra-area infection process.

[0012] Step 4: Use the Static Tainting Extraction Algorithm to locate and extract personal identification information.

[0013] So far, from step 1 to step 4, a method for locating and extracting personal identification information based on static contamination has been completed.

[0014] Beneficial Effects

[0015] Compared with the existing methods, the method of the present invention has the following advantages:

[0016] This method, for the first time, uses the flow of shared information in data to accurately locate and extract personal identification information. At the same time, it overcomes the false positives caused by "excessive pollution" and can help automatically annotate large-scale sparse data sets, avoiding manual intervention and crowdsourcing feedback. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the DK-V data mapping relationship within the domain;

[0018] Figure 2 is the shared information value adjacency matrix;

[0019] Figure 3 Information flow diagram for static pollution location extraction method;

[0020] Figure 4 This is a schematic diagram of the static pollution location extraction algorithm implementation;

[0021] Figure 5 Flowchart of the static pollution location extraction algorithm. DETAILED DESCRIPTION

[0022] The present invention is further described in detail below with reference to the accompanying drawings.

[0023] Step 1: Convert network traffic into a data set. The data set contains three dimensions: Domain, Key, and Value.

[0024] Furthermore, the present invention provides a specific implementation method of step 1, comprising the following steps:

[0025] Step 1.1: Collect traffic data from the network and save it in PCAP format.

[0026] Step 1.2: Determine whether the selected data packet is an HTTP request field. If so, use a regular expression to extract its feature information.

[0027] Among them, feature information extraction can be carried out in the following ways:

[0028] Step 1.2.1: Determine whether the information data packet contains the GET field of the HTTP protocol. If it contains the GET field, extract the characteristic information. If not, continue to select the next data;

[0029] Step 1.2.2: Use a "?" symbol to slice the GET field from left to right, select the part of the field before the "?" as the service field, and select the part of the field after the "?" as the key-value pair field to pre-process the data.

[0030] Step 1.2.3: Extract the accessed domain name or service IP address from the service field obtained in step 1.2.2 according to the regular expression rule;

[0031] Step 1.2.4: Use an "&" symbol to split the key-value pair field preprocessing data obtained in step 1.2.2 into several Key-Value data groups;

[0032] Assume that the application service accessed by the user is Domain(D), and the network traffic is transmitted through Protocol(P). If the personal identification information transmitted at position Key(K) is Value(V), then the network traffic transmitted by Protocol P is represented by the sample space: S p =(D,K,V), where S p It represents the network traffic transmitted by protocol P, and D, K, and V respectively identify the service, location, and information value.

[0033] The network traffic can be reduced and converted into a text format data set through protocol analysis technology, which is convenient for computer storage and calculation. Therefore, the problem of identifying personal identification information is transformed into the problem of determining whether V transmitted in position K is personal identification information.

[0034] Step 2: Filter and reshape the data set output in step 1.

[0035] Furthermore, the present invention provides a specific implementation method of step 2, comprising the following steps:

[0036] Step 2.1: Delete data entries that contain empty fields.

[0037] Step 2.2: According to the naming rules of domain names and IP addresses, filter out data groups that do not meet the rules.

[0038] Aggregate all third-level and higher domain names in the Domain field as third-level domain names, and remove first-level and second-level domain names; remove the port number from all IP addresses in the Domain field, and aggregate them according to the network number of the same Class C IP address.

[0039] Step 2.3: Delete the values ​​in the data group whose Value value is less than X characters, where X is a parameter set manually according to the actual situation and its value range is a natural number.

[0040] Step 2.4: Delete samples with less than Y records in the same Domain and Key in the data group, where Y is a parameter set manually according to actual conditions and its value range is a natural number.

[0041] Step 2.5: Convert the URL encoding of all symbols in the data group to UTF-8 encoding;

[0042] Step 2.6: Convert all uppercase letters in the data set to lowercase letters;

[0043] Step 2.7: Remove default values ​​and noise values ​​from the data set;

[0044] Step 2.8: Use the longest prefix matching algorithm to aggregate the values ​​in the same Domain and Value fields. That is, for the same Domain and Key data, if the string in the Value field is contained in other Value strings, merge them into a longer Value.

[0045] Step 3: Use the recursive contamination process to build an information flow graph. The contamination process includes: Inter-Area Routing and Intra-Area Infection.

[0046] Furthermore, the present invention provides a specific implementation method of step 3, comprising the following steps:

[0047] Assume that when a user accesses an application service, part of the information Value (V for short) is identified as personal identification information, and two user behavior associations are generated: (1) When a user accesses different application services, the same personal identification information will be shared in different service-locations (Domain-Key, DK for short), and this shared information is defined as shared values; (2) The same category of information is transmitted in the same service-location.

[0048] The service-location accessed by the user is defined as a domain Area, where different types of information transmitted represent different attributes of the user or object. Assuming that the number of service-locations accessed by the user is n, the corresponding domain is: Area = DK1, DK2, ..., DK n The set contains all DKs accessed by users, with a total of n elements. At the same time, the information transmitted in these domains can be represented as another set: Value = v1, v2, ..., v m . Among them, a total of m information is transmitted.

[0049] Finally, according to the DK and the information value transmitted in it, the DK-V data mapping relationship within the domain is established, such as Figure 1 As shown in Figure 2, the size of its sample space is the sum of the values ​​contained in each domain. Therefore, by using the DK-V data mapping relationship within the domain, we can construct an information flow graph through the two processes of intra-domain infection and inter-domain propagation.

[0050] The present invention proposes a method for constructing an information flow graph, which is specifically as follows:

[0051] Step A: Intra-Area Infection is the process of selecting similar information in DK.

[0052] Assume that the domain and information generated by user i are DK i and V i , the domain and information generated by user j are DK j and V j If DK i =DK j And V i ≠V j , that is, user i and user j access the same DK and transmit different information V. If V i Is personal identification information, that is, V i ∈PII, then V j It is also personal identification information, namely V j ∈PII, PII stands for personal identification information.

[0053] It follows that if there is a value that is personal identification information in a domain DK, then all the values ​​contained in this DK are personal identification information, that is, DK and the information Value it contains can be selected through intra-domain infection to form the set IAIDK = {DK∈PII|V∈PII,V∈DK}. The role of intra-domain infection is to extract the same category of information in each domain.

[0054] Step B: Inter-Area Routing: Intra-area infection is the establishment of inter-area relationships using intra-area shared values.

[0055] When users access different services, the same information is transmitted in the DK, which is defined as shared values. These shared values ​​enable DKs to establish associations with each other. There may be multiple shared values ​​in two DKs. The relationship between these DKs and shared values ​​is represented as an adjacency matrix, such as Figure 2 shown.

[0056] If the method uses n DKs as vertices, the vertex set N = {dk1, dk2, …, dk n}, then the relationship between the vertices is an edge set E. For example, E = {(dk1, dk2, v1), (dk1, dk6, v2), (dk2, dk3, v3), (dk2, dk9, v4), (dk7, dk9, v5), (dk3, dk9, v6), (dk3, dk4, v7), (dk4, dk9, v8), (dk4, dk7, v9), (dk4, dk5, v 10 ),(dk4,dk8,v 11 ),(dk5,dk6,v 12 ),(dk5,dk8,v 13 ),(dk6,dk7,v 14 ),...,(...,...,v m )}.

[0057] Therefore, an information flow graph IFG = (N, E) is established using the above relationship between vertices and edges, where N represents the nodes of the information flow graph and E represents the edges of the information flow graph. Figure 3 As shown. To concisely represent the information flow graph and make it easier to understand, it is assumed that there is only one shared value relationship between domains. However, in real-time traffic, there may be multiple shared values ​​between two DKs, and the weight of each edge of the information flow graph varies according to the strength of the relationship.

[0058] Step C: Set the constraint function CF (Constraint Function).

[0059] Personal identification information is extracted by controlling the scope of the infected information content within the domain and the direction of inter-domain propagation. Based on the prior knowledge of the type and format of personal identification information, the intra-domain infection can find the rules of personal identification information as constraint functions. For example, the range of characters, the length of the string, regular expressions, dictionaries, word meanings or string similarities, etc. The constraint function is set to avoid "over-infection".

[0060] In summary, the information flow graph consists of two processes: intra-domain infection and inter-domain propagation. Intra-domain infection introduces constraint functions to control the scope of infection, and inter-domain propagation introduces shared values ​​to control the direction of propagation.

[0061] Step 4: Use the Static Tainting Extraction Algorithm to locate and extract personal identification information.

[0062] The static pollution location extraction algorithm is designed based on the breadth-first search algorithm of the tree structure, such as Figure 4 shown.

[0063] Furthermore, the present invention provides a specific implementation method of step 4, comprising the following steps:

[0064] Step 4.1: Select a personal identification information in the data as the input infection information (Taintingvalue);

[0065] Step 4.2: Construct an information flow graph according to the input infection information. The information flow graph is constructed by executing two alternating cycle modes: intra-domain infection (step A) and inter-domain propagation (step B), and finally achieving the convergence of data search.

[0066] Step 4.3: The static pollution algorithm outputs two lists, including the personal identification information list ValueList and the personal identification information service location list DKList, such as Figure 5 shown.

[0067] Suppose V1 is selected as the infection information and used as the input of the static pollution extraction algorithm.

[0068] First, the first round of the algorithm Round1 is executed: In the initial case, the information list ValueList contains only one information V1, and the service-location list DKList is empty. The infected information V1 in the information list ValueList is used as a shared value, and the inter-domain propagation is performed to first search for two domains DK1 and DK2.

[0069] Execute the second round of the algorithm Round2: perform intra-domain propagation and search for information V2 from the DK1 domain. Perform inter-domain propagation with information V2 as the shared value to obtain the DK6 domain. For example, in the output result, ValueList = [V1, V2], DKList = [DK1, DK2, DK6].

[0070] Execute the third round of the algorithm: Perform intra-domain infection and search for information V3 and V4 from the DK2 domain. Perform inter-domain propagation with information V3 as the shared value to obtain domain DK3. For example, in the output result, ValueList = [V1, V2, V3, V4], DKList = [DK1, DK2, DK6, DK3].

[0071] Then, the third round (Round 4) of the algorithm is executed: intra-domain infection is performed, and information V3 and V4 are searched from the DK2 domain. Then, inter-domain propagation is performed with information V4 as the shared value, and domain DK9 is obtained. For example, in the output result, ValueList = [V1, V2, V3, V4], DKList = [DK1, DK2, DK6, DK3, DK9].

[0072] In this way, each element in the information list ValueList is sequentially used as a shared value, and the loop mode repeatedly executes intra-domain infection and inter-domain propagation.

[0073] Each process of alternating intra-domain infection and inter-domain propagation is defined as a round of algorithm execution.

[0074] Finally, after multiple rounds of convergence (e.g., 15 times), the information list ValueList and the service location list DKlist are output. For example, ValueList = [V1, V2, V3, V4, V 12 ,V 14 ,V6,V7,V5,V8,V9,V 15 ,V 10 ,V 13 ,V 11 ], service location list DKlist = [DK1, DK2, DK6, DK3, DK9, DK7, DK5, DK4, DK8]. The order of elements in the list is listed in the order of search.

[0075] So far, from step 1 to step 4, a method for locating and extracting personal identification information based on static contamination has been completed.

Claims

1. A method for locating and identifying personal identification information based on static pollution, characterized in that: The steps include: Step 1: Convert network traffic into a data set. The data set contains three dimensions: application service Domain, location Key, and personal identification information Value. Domain is referred to as D, location Key is referred to as K, and personal identification information Value is referred to as V. Step 1.1: Collect traffic data from the network; Step 1.2: Determine whether the selected data packet is an HTTP request field. If so, use a regular expression to extract its feature information; The user accesses the application service Domain and transmits network traffic through the protocol Protocol; if the information transmitted at location K is personal identification information V, the network traffic transmitted by the protocol Protocol is represented as the sample space: S p =(D,K,V), where S p Represents network traffic transmitted using protocol P; Step 2: Filter and reshape the data set output in step 1; Step 3: Use the recursive contamination process to build an information flow graph, where the contamination process includes the inter-domain propagation process and the intra-domain infection process; When a user accesses an application service, part of the information is identified as personal identification information V, which results in two user behavior associations: (1) When a user accesses different application services, the same personal identification information will be shared in different service-location Domain-Keys, referred to as DKs. This shared information is defined as shared values; (2) The same category of information is transmitted in the same service-location; The service-location accessed by the user is defined as the domain Area, where different types of information transmitted represent different attributes of the user or object; assuming that the number of service-locations accessed by the user is n, the corresponding domain is: Area = DK1, DK2, ..., DK n The set contains the DKs accessed by all users, with a total of n elements. At the same time, the information transmitted in these domains is represented by another set: Value = V1, V2, ..., V m ; Among them, a total of m information is transmitted; Finally, according to the DK and the information Value transmitted in it, the intra-domain DK-V data mapping relationship is established, and its sample space size is the sum of the values ​​contained in each domain; using the intra-domain DK-V data mapping relationship, through the two processes of intra-domain infection and inter-domain propagation, an information flow graph is constructed, where the intra-domain infection introduces a constraint function to control the scope of infection, and the inter-domain propagation introduces a shared value to control the direction of propagation; Step 4: Use the static pollution extraction algorithm to locate and extract personal identification information; Step 4.1: Select a personal identification information in the data as the input infection information; Step 4.2: Construct an information flow graph according to the input infection information; the information flow graph construction process is to achieve the convergence of data search by executing two alternating cycle modes of intra-domain infection and inter-domain propagation; The method of constructing an information flow diagram is as follows: Step A: Intra-domain infection, is the process of selecting similar information in DK; Assume that the domain and information generated by user i are DK i and V i , the domain and information generated by user j are DK j and V j ; If DK i =DK j And V i ≠V j , that is, user i and user j access the same DK and transmit different information V; if V i Is personal identification information, that is, V i ∈PII, then V j It is also personal identification information, namely V j ∈PII, PII stands for personal identification information; If there is a value that is personal identification information in a domain DK, then all the values ​​contained in this DK are personal identification information, that is, DK and the information Value it contains are selected through intra-domain infection to form a set IAIDK = {DK∈PII|V∈PII,V∈DK}; the role of intra-domain infection is to extract the same category of information in each domain; Step B: inter-domain propagation,Intra-domain infection is the inter-domain relationship established by,using the shared values ​​within the domain; When users access different services, the same information is transmitted in the DK. This information is defined as shared values. These shared values ​​are used to establish associations between DKs. There are multiple shared values ​​in two DKs. The relationships and shared values ​​between these DKs are represented as an adjacency matrix. If the method uses n DKs as vertices, the vertex set N = {dk1, dk2, …, dk n }, then the relationship between the vertices is an edge set E; Using the above relationship between vertices and edges, an information flow graph IFG = (N, E) is established, where N represents the node of the information flow graph and E represents the edge of the information flow graph; Step C: Set constraint function; The personal identification information is extracted by controlling the scope of the infection information content within the domain and the direction of inter-domain propagation; based on the prior knowledge of the type and format of the personal identification information, the infection within the domain can find the rules of the personal identification information as a constraint function; Step 4.3: The static pollution algorithm outputs two lists, including the personal identification information list ValueList and the personal identification information service location list DKList; Select V1 as the infection information and use it as the input of the static pollution extraction algorithm; First, the first round of the algorithm is executed: in the initial case, the information list ValueList contains only one V1, and the service-location list DKList is empty; V1 in the information list ValueList is used as a shared value, and the inter-domain propagation is performed to first search for two domains DK1 and DK2; Execute the second round of the algorithm: perform intra-domain infection and search for V from the DK1 domain 2； Perform inter-domain propagation with V2 as the shared value to obtain domain DK6; The third round of the algorithm is to perform intra-domain infection and search for V3 and V4 from the DK2 domain. Inter-domain propagation is performed using V3 as the shared value to obtain domain DK3. Then, the third round of the algorithm is executed: intra-domain infection is performed, and V3 and V4 are searched from domain DK2; then inter-domain propagation is performed with V4 as the shared value, and domain DK9 is obtained; In this way, each element in the information list ValueList is used as a shared value in sequence, and the loop mode repeatedly executes intra-domain infection and inter-domain propagation; Each process of alternating intra-domain infection and inter-domain propagation is defined as a round of algorithm execution; Finally, after multiple rounds of convergence, the information list ValueList and the service location list DKlist are output. The order of the elements in the list is listed in the order of search.

2. A method for locating and identifying personal identification information based on static pollution as claimed in claim 1, characterized in that: In step 1.2, feature information extraction is performed in the following manner: Step 1.2.1: Determine whether the information data packet contains the GET field of the HTTP protocol. If it contains the GET field, extract the characteristic information. If not, continue to select the next data; Step 1.2.2: Use a "?" symbol to slice the GET field from left to right, select the part of the field before the "?" as the service field, and select the part of the field after the "?" as the key-value pair field to pre-process the data; Step 1.2.3: Extract the accessed domain name or service IP address from the service field obtained in step 1.2.2 according to the regular expression rule; Step 1.2.4: Use an "&" symbol to split the key-value pair field preprocessing data obtained in step 1.2.2 into several Key-Value data groups.

3. A method for locating and identifying personal identification information based on static pollution as claimed in claim 1, characterized in that: Step 2 includes the following steps: Step 2.1: Delete the data entries containing empty fields; Step 2.2: According to the naming rules of domain names and IP addresses, filter out data groups that do not meet the rules; Aggregate all third-level and higher domain names in the Domain field as third-level domain names, and remove first-level and second-level domain names; remove the port number from all IP addresses in the Domain field, and aggregate them according to the network number of the same Class C IP address; Step 2.3: Delete the values ​​in the data group whose Value value is less than X characters, where X is a parameter set manually according to the actual situation and its value range is a natural number; Step 2.4: Delete samples with less than Y records in the same Domain and Key in the data group, where Y is a parameter set manually according to actual conditions, and its value range is a natural number; Step 2.5: Convert the URL encoding of all symbols in the data group to UTF-8 encoding; Step 2.6: Convert all uppercase letters in the data set to lowercase letters; Step 2.7: Remove default values ​​and noise values ​​from the data set; Step 2.8: Use the longest prefix matching algorithm to aggregate the values ​​in the same Domain and Value fields. That is, if the string of the Value field in the same Domain and Key data is contained in other Value strings, merge them.

Images