A data stream identification method, device, equipment and storage medium
By extracting packet header and feature information, and using a target traffic identification model to identify Tor data streams, the problem of low identification accuracy in existing technologies is solved, and accurate identification of Tor data streams is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 南京中孚信息技术有限公司
- Filing Date
- 2022-11-30
- Publication Date
- 2026-07-31
AI Technical Summary
Existing technologies have low accuracy in identifying Tor data streams and cannot accurately identify network transmissions that are not limited to specific ports and protocol characteristics.
By extracting packet header information, including user IP, network IP, user port, network port, and protocol identifier, and combining it with feature information such as data length and arrival time, a pre-trained target traffic identification model is used for identification.
It improves the accuracy of Tor data stream identification, enabling accurate identification of Tor data streams and reducing the false identification rate.
Smart Images
Figure CN115811430B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer network security technology, and more specifically, to a data stream identification method, apparatus, device, and storage medium. Background Technology
[0002] Tor (Onion Routing), used on the dark web, has become the most widely used anonymous communication tool due to its low latency and high confidentiality. However, it is also heavily used for illicit applications. Therefore, it is necessary to accurately identify Tor data streams during network communication in order to control them in a timely manner.
[0003] Currently, Tor data streams are mainly identified based on specific port numbers and / or protocol characteristics.
[0004] However, communication transmission may not be limited to a specific port or a network transmission protocol with certain characteristics, resulting in low accuracy of existing technologies in identifying Tor data streams. Summary of the Invention
[0005] The purpose of this application is to address the shortcomings of the prior art by providing a data stream identification method, apparatus, device, and storage medium that can improve the accuracy of Tor data stream identification.
[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows:
[0007] In a first aspect, embodiments of this application provide a data stream identification method, the method comprising:
[0008] Based on the first header information of each received data packet, the data stream in which each data packet belongs is determined, and at least one data stream to be identified is obtained. Each data stream to be identified includes at least one data packet. The first header information of each data packet in the same data stream to be identified is consistent. The first header information includes: user IP, network IP, user port, network port and protocol identifier.
[0009] Based on the second header information of each data packet in the data stream to be identified, the feature information of the data stream to be identified is obtained. The second header information includes: data length and arrival time. The feature information of the data stream to be identified includes: run information, uplink payload information, downlink payload information, and time interval information of the data stream to be identified.
[0010] The feature information of the data stream to be identified is input into a pre-trained target traffic identification model to predict whether the data stream to be identified is an onion route data stream.
[0011] Optionally, obtaining the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified includes:
[0012] The payload length and arrival time of each data packet are obtained based on the second header information of each data packet in the data stream to be identified.
[0013] Based on the payload length, arrival time, and extraction strategies corresponding to various feature information of each data packet, the feature information of the data stream to be identified is extracted.
[0014] Optionally, the step of extracting the feature information of the data stream to be identified based on the payload length, arrival time, and extraction strategies corresponding to various feature information of each data packet includes:
[0015] From all data packets of the data stream to be identified, at least one first data packet associated with the run is selected, and the run information of the data stream to be identified is determined according to the payload length of each first data packet.
[0016] From all data packets of the data stream to be identified, at least one second data packet and one third data packet associated with the uplink message and downlink message respectively are selected. Based on the payload length of each second data packet and the payload length of each third data packet, the uplink payload information and downlink payload information of the data stream to be identified are determined.
[0017] The time interval information of the data stream to be identified is determined based on the arrival time of all data packets of the data stream to be identified.
[0018] Optionally, obtaining the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified includes:
[0019] The payload information of each data packet in the data stream to be identified is used for protocol identification to obtain protocol identification results, which include: identifiable and unidentifiable.
[0020] If the protocol identification result is unidentifiable, then randomness detection is performed on the data stream to be identified to obtain a random value, and the feature information of the data stream to be identified is obtained based on the random value and the second header information of each data packet.
[0021] Optionally, obtaining the feature information of the data stream to be identified based on the random value and the second header information of each data packet includes:
[0022] If the random value is greater than or equal to a preset threshold, the feature information of the data stream to be identified is obtained based on the random value and the second header information of each data packet.
[0023] Optionally, the method further includes:
[0024] If the data stream to be identified is an Onion Router data stream, then a reminder message is sent to a preset port, and the reminder message includes the user IP of the data stream to be identified.
[0025] Optionally, before inputting the feature information of the data stream to be identified into a pre-trained target traffic identification model to identify whether the data stream to be identified is an onion routing data stream, the method further includes:
[0026] Multiple sample data packets included in each sample data stream are obtained from multiple preset application terminals; based on the second header information of each sample data packet in each sample data stream, the feature information of each sample data stream is obtained;
[0027] The labels of each sample data stream are determined based on the identifiers of each preset application terminal;
[0028] Training samples are constructed based on the feature information and labels of each sample data stream;
[0029] The training samples are input into the initial traffic identification model for training to obtain the target traffic identification model.
[0030] Secondly, embodiments of this application also provide a data stream identification device, the device comprising:
[0031] The first determining module is used to determine the data stream in which each data packet is located based on the first header information of each received data packet, and to obtain at least one data stream to be identified. Each data stream to be identified includes at least one data packet. The first header information of each data packet in the same data stream is consistent. The first header information includes: user IP, network IP, user port, network port and protocol identifier.
[0032] The second determining module is used to obtain the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified. The second header information includes: data length and arrival time. The feature information of the data stream to be identified includes: run information, uplink payload information, downlink payload information, and time interval information of the data stream to be identified.
[0033] The identification module is used to input the feature information of the data stream to be identified into a pre-trained target traffic identification model to identify whether the data stream to be identified is an onion route data stream.
[0034] Optionally, the second determining module is specifically used to obtain the payload length and arrival time of each data packet in the data stream to be identified based on the second header information of each data packet; and to extract the feature information of the data stream to be identified based on the payload length, arrival time and extraction strategies corresponding to various feature information of each data packet.
[0035] Optionally, the second determining module is further configured to: filter at least one first data packet associated with a run from all data packets of the data stream to be identified; determine the run information of the data stream to be identified based on the payload length of each first data packet; filter at least one second data packet and one third data packet associated with an uplink message and a downlink message respectively from all data packets of the data stream to be identified; determine the uplink payload information and the downlink payload information of the data stream to be identified based on the payload length of each second data packet and the payload length of each third data packet; and determine the time interval information of the data stream to be identified based on the arrival time of all data packets of the data stream to be identified.
[0036] Optionally, the second determining module is further configured to perform protocol identification on the payload information of each data packet in the data stream to be identified, and obtain a protocol identification result, wherein the protocol identification result includes: identifiable and unidentifiable; if the protocol identification result is unidentifiable, then randomness detection is performed on the data stream to be identified to obtain a random value, and feature information of the data stream to be identified is obtained based on the random value and the second header information of each data packet.
[0037] Optionally, the second determining module is further configured to, if the random value is greater than or equal to a preset threshold, obtain the feature information of the data stream to be identified based on the random value and the second header information of each data packet.
[0038] Optionally, the device includes: a transmitting module;
[0039] The sending module is used to send a reminder message to a preset port if the data stream to be identified is an Onion routing data stream. The reminder message includes the user IP of the data stream to be identified.
[0040] Optionally, the device further includes:
[0041] The acquisition module is used to acquire multiple sample data packets included in each sample data stream from multiple preset application terminals;
[0042] The second determining module is further configured to obtain feature information of each sample data stream based on the second header information of each sample data packet in each sample data stream;
[0043] The second determining module is further configured to determine the label of each sample data stream based on the identifier of each preset application terminal;
[0044] A construction module is used to construct training samples based on the feature information and labels of each sample data stream;
[0045] The training module is used to input the training samples into the initial traffic identification model for training, so as to obtain the target traffic identification model.
[0046] Thirdly, embodiments of this application provide an electronic device, including: a processor, a storage medium, and a bus. The storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the data stream identification method described in the first aspect.
[0047] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the data stream identification method described in the first aspect.
[0048] The beneficial effects of this application are:
[0049] This application provides a data flow identification method, apparatus, device, and storage medium. The method includes: determining the data flow of each data packet based on the first header information of each received data packet to obtain at least one data flow to be identified, wherein each data flow to be identified includes at least one data packet, and the first header information of each data packet in the same data flow to be identified is consistent; obtaining feature information of the data flow to be identified based on the second header information of each data packet in the data flow to be identified; and inputting the feature information of the data flow to be identified into a pre-trained target traffic identification model to predict whether the data flow to be identified is an onion routing data flow.
[0050] The data stream identification method provided in this application can obtain characteristic information representing the type of the data stream by analyzing the attributes of the data packets included in the data stream to be identified, such as the data length and arrival time carried in the packet header information. This characteristic information can accurately represent the true information of the data stream to be identified. Based on this, the characteristic information of the data stream to be identified is input into a target traffic identification model. The target traffic identification model is then used to analyze and process the characteristic information of the data stream to be identified, thereby accurately predicting whether the data stream to be identified is an Onion routing data stream, i.e., a Tor data stream. It can be seen that this can improve the accuracy of Tor data stream identification. Attached Figure Description
[0051] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0052] Figure 1 A flowchart illustrating the model training phase provided in this application embodiment;
[0053] Figure 2 A flowchart of the model application stage provided in this application embodiment;
[0054] Figure 3 A flowchart illustrating a data stream identification method provided in an embodiment of this application;
[0055] Figure 4 A flowchart illustrating another data stream identification method provided in this application embodiment;
[0056] Figure 5 A flowchart illustrating another data stream identification method provided in this application embodiment;
[0057] Figure 6 A flowchart illustrating another data stream identification method provided in an embodiment of this application;
[0058] Figure 7 This is a schematic diagram of the structure of a data stream identification device provided in an embodiment of this application;
[0059] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0060] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0061] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0062] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0063] Before providing a detailed explanation of the embodiments of this application, the application scenario of this application will first be introduced. Specifically, this application scenario can be the identification of data stream types in a network communication environment. This application classifies data stream types into Tor data streams and non-Tor data streams. Non-Tor data streams can be understood as data streams with specific application protocols, such as the application protocol corresponding to Tencent Video, the application protocol corresponding to WeChat, etc. Conversely, data streams with protocol types that are not specific application protocols may be Tor data streams. Non-specific application protocols may include, for example, HTTPS (Hypertext Transfer Protocol Secure), TCP (Transmission Control Protocol), etc.
[0064] Understandably, the Tor network was originally designed to protect privacy and prevent users from being tracked on the Internet, but it has been widely used for illegal applications. Therefore, how to accurately identify Tor data streams is an urgent problem to be solved.
[0065] Based on the aforementioned issues, this application uses deep learning to identify data streams, thereby identifying Tor data streams and enabling timely control over them.
[0066] The following examples in this application mainly include two stages: the model training stage and the model application stage. Figure 1 A flowchart of the model training phase is provided for an embodiment of this application, such as... Figure 1 As shown, the basic process of the model training phase can include collecting sample data, labeling sample categories, extracting feature information, and model training. For example, an electronic device can collect a preset number of sample data according to actual needs; label each sample data according to its source, using label 0 to represent Tor data stream categories and label 1 to represent non-Tor data stream categories; extract feature information from the sample data; and input the feature information and labels corresponding to each sample data into the initial traffic recognition model for training. It should be noted that the specific content of the model training phase can be found in the relevant example sections below, and will not be described further here.
[0067] Figure 2 A flowchart of the model application stage is provided for an embodiment of this application, such as Figure 2As shown, the basic process of the model application stage may include extracting feature information of the data stream to be identified, online prediction, and result reporting. For example, an electronic device can automatically classify data packets according to their header information to obtain multiple data streams, each of which can be called the data stream to be identified. Feature information of the data stream to be identified is extracted based on its data length, and this feature information is then input into the application... Figure 1 The target traffic identification model trained in this way is used for online prediction. When the prediction result indicates that the data stream to be identified is a Tor data stream, an alert message can be sent to a preset port, i.e., the result is reported. It should be noted that the specific content of the model application stage can be referred to the relevant example section below, and will not be described here.
[0068] As can be seen, this application analyzes and processes the feature information of the data stream to be identified using a pre-trained target traffic identification model, based on the feature information of the data stream to be identified, to identify the type of the data stream to be identified, i.e. whether it is a Tor data stream. This can effectively solve the problem that the traditional method of relying on protocol features cannot accurately identify Tor data streams, and also solve the problem that the traditional method of relying on specific ports cannot accurately identify Tor data streams. In other words, this application can improve the accuracy of Tor data stream identification.
[0069] The following is a collection of... Figure 2 The data stream identification method mentioned in this application is illustrated with examples. Figure 3 This is a flowchart illustrating a data stream identification method provided in an embodiment of this application. Figure 3 As shown, the method may include:
[0070] S301. Based on the first header information of each received data packet, determine the data stream to which each data packet belongs, and obtain at least one data stream to be identified.
[0071] Each of the data streams to be identified includes at least one data packet. The first header information of all data packets in the same data stream is consistent, including: user IP, network IP, user port, network port, and protocol identifier. The user can be understood as the source, that is, the end that sends the data packet, and the network can be understood as the destination, that is, the end that receives the data packet.
[0072] For example, the aforementioned electronic device receives data packets in real time. After receiving a data packet, the electronic device can extract the header portion of the data packet and obtain the first header information in the header portion. Based on the user IP, network IP, user port, network port, and protocol identifier in the first header information and the pre-established correspondence between the first header information and the data stream, the electronic device determines the data stream to which the data packet belongs. The electronic device can perform the processing described above on each received data packet, so that each data packet corresponds to a data stream, and the electronic device can obtain at least one data stream.
[0073] For example, if the number of data packets in a data stream reaches a preset number (e.g., 20), the data packet can be used as the data packet to be identified and processed in the following steps.
[0074] S102. Obtain the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified.
[0075] The second header information includes data length and arrival time. The feature information of the data stream to be identified includes run information, uplink payload information, downlink payload information, and time interval information of the data stream to be identified.
[0076] This section uses a data stream to be identified as an example. The header of each data packet in the data stream is extracted, and second header information, including the data length, is obtained from the header of each data packet. After obtaining the data length and arrival time of each data packet, the average and standard deviation of the data length and arrival time of each data packet can be calculated according to various feature calculation strategies. This yields features used to characterize the category of the data stream to be identified, such as run-length information, uplink payload information, downlink payload information, and time interval information. Other types of features may also be included, but this application does not limit their inclusion.
[0077] In other words, the feature information of the data stream to be identified can be used to more accurately characterize the category of the data stream to be identified. Then, the target traffic identification model can be used to identify the feature information to obtain the category of the data stream to be identified.
[0078] S103. Input the feature information of the data flow to be identified into the pre-trained target traffic identification model to identify whether the data flow to be identified is an onion route data flow.
[0079] For example, the run information, uplink load information, downlink load information, and time interval information included in the feature information of the data stream to be identified can be sorted in a preset order to obtain input data. The input data is then input into the target traffic identification model. After analyzing and processing the input data, the target traffic identification model can predict whether the data stream to be identified is an onion route data stream. The prediction result output by the target traffic identification model includes whether the data stream to be identified is an onion route data stream, i.e., a Tor data stream, or whether the data stream to be identified is a non-Tor data stream.
[0080] In summary, the data stream identification method provided in this application can obtain characteristic information representing the type of the data stream by analyzing the attributes of the data packets included in the data stream to be identified, such as the data length carried in the packet header information. This characteristic information can accurately represent the true information of the data stream to be identified. Based on this, the characteristic information of the data stream to be identified is input into the target traffic identification model, and the target traffic identification model is used to analyze and process the characteristic information of the data stream to be identified, thereby accurately predicting whether the data stream to be identified is an Onion routing data stream, i.e., a Tor data stream. It can be seen that this can improve the accuracy of Tor data stream identification.
[0081] Figure 4 This is a flowchart illustrating another data stream identification method provided in an embodiment of this application. Figure 4 As shown, optionally, the feature information of the data stream to be identified, obtained based on the second header information of each data packet in the data stream to be identified, includes:
[0082] S401. Based on the second header information of each data packet in the data stream to be identified, obtain the data length and arrival time of each data packet.
[0083] S402. Extract the feature information of the data stream to be identified based on the data length, arrival time, and extraction strategies corresponding to various feature information of each data packet.
[0084] As described above, each data packet in the data stream to be identified includes a header portion, from which second header information can be obtained. The data length included in the second header information can consist of payload length, checksum length, arrival time, etc.
[0085] One example is that the payload length can be extracted from the data length. After obtaining the payload length of each data packet in the data stream to be identified, the data packets corresponding to various data length features can be obtained according to the payload length of each data packet in the data stream to be identified and the extraction strategy corresponding to various data length feature information. Then, the feature information of various data length features can be calculated according to the payload length of the data packets corresponding to various data length features.
[0086] Another example is that after obtaining the arrival time of each data packet in the data stream to be identified, the data packets corresponding to various time features can be obtained according to the arrival time of each data packet in the data stream to be identified and the extraction strategy corresponding to various time feature information. Then, the feature information of various time features can be calculated according to the time length of the data packets corresponding to various time features.
[0087] Furthermore, the feature information of the data stream to be identified can be composed of feature information of various data length features and feature information of various time features.
[0088] Optionally, the above-mentioned extraction of feature information of the data stream to be identified based on the payload length of each data packet and the extraction strategy corresponding to various feature information includes: filtering at least one first data packet associated with run from all data packets of the data stream to be identified, and determining the run information of the data stream to be identified based on the payload length of each first data packet; filtering at least one second data packet and one third data packet associated with uplink and downlink messages respectively from all data packets of the data stream to be identified, and determining the uplink payload information and downlink payload information of the data stream to be identified based on the payload length of each second data packet and the payload length of each third data packet; and determining the time interval information of the data stream to be identified based on the arrival time of all data packets of the data stream to be identified.
[0089] One example is that data packets in a data stream to be identified can be divided into data packets belonging to a first run and data packets belonging to a second run based on the directionality of the data packets (e.g., from end A to end B, or from end B to end A). The first run is used to indicate from end A to end B, and the second run is used to indicate from end B to end A. Here, the first run is used as an example for explanation. The payload length of the data packets belonging to the first run (first data packets) is obtained, the payload lengths of each first data packet are added together, and the total payload length obtained by the sum is used as the run information of the data stream to be identified.
[0090] Another example involves acquiring at least one second data packet and one third data packet associated with the uplink and downlink messages, respectively, from the first 20 data packets of the data stream to be identified. Based on the payload length of each second data packet, the average uplink payload length, maximum uplink payload length, and minimum uplink payload length are obtained; that is, the uplink payload information includes the average uplink payload length, maximum uplink payload length, and minimum uplink payload length. Similarly, based on the payload length of each third data packet, the average downlink payload length, maximum downlink payload length, and minimum downlink payload length are obtained; that is, the uplink payload information includes the average downlink payload length, maximum downlink payload length, and minimum downlink payload length.
[0091] For example, the arrival time of the message is extracted from the header information of the first 20 data packets of the data stream to be identified, and then the average time interval, maximum time interval, minimum time interval and other information included in the average time interval information are obtained.
[0092] Figure 5 This is a flowchart illustrating another data stream identification method provided in an embodiment of this application. Figure 5 As shown, optionally, the feature information of the data stream to be identified, obtained based on the second header information of each data packet in the data stream to be identified, includes:
[0093] S501. Perform protocol identification on the payload information of each data packet in the data stream to be identified, and obtain the protocol identification result.
[0094] The protocol identification results are categorized as either identifiable or unidentifiable. Identifiable means the result includes a specific application protocol, such as the application protocol for Tencent Video or WeChat. Unidentifiable means the result does not contain a protocol type, or in other words, the data stream to be identified cannot be identified as a specific application protocol; that is, the protocol of the data stream to be identified may be a non-application protocol, such as HTTPS or TCP.
[0095] In one example, an electronic device is pre-configured with a DPI (Deep Packet Inspection) module. Each data packet in the data stream to be identified is input into the DPI module. The DPI module extracts the data portion of each data packet, and then performs protocol identification on the payload information in the data portion of each data packet, and outputs the protocol identification result.
[0096] If the protocol identification result is identifiable, the data stream to be identified is directly filtered, that is, the data to be identified is forwarded, and no further feature extraction is performed on the data stream to be identified; if the protocol identification result is unidentifiable, then further feature extraction is required on the data stream to be identified.
[0097] S502. If the protocol identification result is that it cannot be identified, then randomness detection is performed on the data stream to be identified to obtain a random value, and the feature information of the data stream to be identified is obtained based on the random value and the second header information of each data packet.
[0098] For example, when the protocol identification result is unidentifiable, meaning the protocol of the data stream to be identified is not a specific application protocol, then a randomness test is performed on the data stream to be identified. It's important to understand that the encryption algorithm used in Tor data streams causes the data in the corresponding packets to exhibit a random state, and this randomness is greater than that exhibited by non-Tor data streams. Therefore, after performing a randomness test on the data packets to be identified, the characteristic information of the data stream to be identified is obtained based on the obtained random value and the second header information of each data packet in the data stream to be identified.
[0099] Optionally, obtaining the feature information of the data stream to be identified based on the random value and the second header information of each data packet includes: if the random value is greater than or equal to a preset threshold, then obtaining the feature information of the data stream to be identified based on the random value and the second header information of each data packet.
[0100] It should be understood that the larger the random value, the more chaotic the data packets in the data stream to be identified; conversely, the smaller the random value, the less chaotic the data packets in the data stream to be identified.
[0101] One example involves comparing the random value corresponding to the data stream to be identified with a preset threshold. If the comparison result indicates that the random value is greater than or less than the preset threshold, it proves that the data stream to be identified is likely a Tor data stream, and it needs to be identified using a target traffic identification model based on the feature information of the data stream. If the comparison result indicates that the random value is less than the preset threshold, it proves that the data stream to be identified is a non-Tor data stream, and the data stream to be identified is directly filtered, i.e., forwarded based on the network IP.
[0102] As can be seen, this application can use protocol identification to perform the first filtering of the data stream to be identified, and can also use randomness detection to perform the second filtering of the data stream to be identified. Finally, it combines the target traffic identification model to identify the data stream to be identified that has a higher probability of being a Tor data stream. This can greatly reduce the false identification rate while improving efficiency.
[0103] Optionally, the method further includes: if the data stream to be identified is an Onion route data stream, then sending a reminder message to a preset port.
[0104] The notification message includes the user's IP address in the data stream to be identified, which makes it easier for staff to find the source of the Tor data stream based on the user's IP address.
[0105] Figure 6 This is a flowchart illustrating another data stream identification method provided in an embodiment of this application. Figure 6As shown, optionally, before inputting the feature information of the data stream to be identified into the pre-trained target traffic identification model to identify whether the data stream to be identified is an onion route data stream, the method further includes:
[0106] S601. Obtain multiple sample data packets included in each sample data stream from multiple preset application terminals.
[0107] S602. Based on the second header information of each sample data packet in each sample data stream, obtain the feature information of each sample data stream.
[0108] This involves capturing packets from multiple preset application endpoints according to actual needs, and obtaining multiple sample data packets output by each preset application endpoint. For example, multiple sample data packets output by each preset application endpoint can be obtained based on a preset number of data packets. Assuming the preset number of data packets is 20, then only 20 sample data packets need to be captured from each preset application endpoint to obtain the sample data stream corresponding to each preset application endpoint.
[0109] This section uses a sample data stream as an example to illustrate the process. The payload length carried in the second header information of each sample data packet in the sample data stream is obtained. Then, based on the payload length of each sample data packet, the characteristic information of the sample data stream can be obtained. This characteristic information may include the run information, uplink payload information, downlink payload information, and time interval information of the sample data stream.
[0110] S603. Determine the label of each sample data stream based on the identifier of each preset application terminal.
[0111] S604. Construct training samples based on the feature information and labels of each sample data stream.
[0112] The preset application terminals may include Tencent, WeChat, and Tor terminals. For example, the label for the sample data streams corresponding to Tencent and WeChat terminals can be set to 1, and the label for the sample data streams corresponding to Tor terminals can be set to 0. Label 0 represents Tor data streams, and label 1 represents non-Tor data streams. The feature information and labels of each sample data stream are associated to obtain the training samples corresponding to each sample data stream; that is, each training sample includes feature information and the corresponding label.
[0113] S605. Input the training samples into the initial traffic identification model for training to obtain the target traffic identification model.
[0114] The training samples corresponding to each sample data stream can be input into the initial traffic identification model. Taking a single training sample as an example, the feature information in this training sample is used as the input to the initial traffic identification model, and the label in the training sample is used as the output. The initial traffic identification model is then trained, and the target traffic identification model is obtained when the training stopping condition is met.
[0115] Figure 7 This is a schematic diagram of the structure of a data stream identification device provided in an embodiment of this application. Figure 7 As shown, the device includes:
[0116] The first determining module 701 is used to determine the data stream in which each data packet is located based on the first header information of each received data packet, and to obtain at least one data stream to be identified. Each data stream to be identified includes at least one data packet. The first header information of each data packet in the same data stream is consistent. The first header information includes: user IP, network IP, user port, network port and protocol identifier.
[0117] The second determining module 702 is used to obtain the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified. The second header information includes: data length and arrival time. The feature information of the data stream to be identified includes: run information, uplink payload information, downlink payload information, and time interval information of the data stream to be identified.
[0118] The identification module 703 is used to input the feature information of the data flow to be identified into the pre-trained target traffic identification model to identify whether the data flow to be identified is an onion route data flow.
[0119] Optionally, the second determining module 702 is specifically used to obtain the payload length and arrival time of each data packet based on the second header information of each data packet in the data stream to be identified; and to extract the feature information of the data stream to be identified based on the payload length, arrival time and extraction strategies corresponding to various feature information of each data packet.
[0120] Optionally, the second determining module 702 is further configured to: filter at least one first data packet associated with a run from all data packets of the data stream to be identified; determine the run information of the data stream to be identified based on the payload length of each first data packet; filter at least one second data packet and one third data packet associated with an uplink message and a downlink message respectively from all data packets of the data stream to be identified; determine the uplink payload information and the downlink payload information of the data stream to be identified based on the payload length of each second data packet and the payload length of each third data packet; and determine the time interval information of the data stream to be identified based on the arrival time of all data packets of the data stream to be identified.
[0121] Optionally, the second determining module 702 is further specifically used to perform protocol identification on the payload information of each data packet in the data stream to be identified, and obtain the protocol identification result, which includes: identifiable and unidentifiable; if the protocol identification result is unidentifiable, then randomness detection is performed on the data stream to be identified to obtain a random value, and the feature information of the data stream to be identified is obtained based on the random value and the second header information of each data packet.
[0122] Optionally, the second determining module 702 is further specifically used to obtain the feature information of the data stream to be identified based on the random value and the second header information of each data packet if the random value is greater than or equal to a preset threshold.
[0123] Optionally, the device includes: a transmitting module;
[0124] This sending module is used to send a reminder message to a preset port if the data stream to be identified is an Onion Router data stream. The reminder message includes the user IP of the data stream to be identified.
[0125] Optionally, the device further includes:
[0126] The acquisition module is used to acquire multiple sample data packets included in each sample data stream from multiple preset application terminals;
[0127] The second determining module 702 is further configured to obtain the feature information of each sample data stream based on the second header information of each sample data packet in each sample data stream;
[0128] The second determining module 702 is also used to determine the label of each sample data stream based on the identifier of each preset application terminal;
[0129] The building module is used to construct training samples based on the feature information and labels of each sample data stream;
[0130] The training module is used to input training samples into the initial traffic identification model for training, thereby obtaining the target traffic identification model.
[0131] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.
[0132] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SoC).
[0133] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 8 As shown, the electronic device may include a processor 801, a storage medium 802, and a bus 803. The storage medium 802 stores machine-readable instructions executable by the processor 801. When the electronic device is running, the processor 801 communicates with the storage medium 802 via the bus 803, and the processor 801 executes the machine-readable instructions to perform the steps of the above method embodiment. The specific implementation and technical effects are similar and will not be described in detail here.
[0134] Optionally, this application also provides a computer-readable storage medium storing a computer program, which, when run by a processor, executes the steps of the above-described method embodiments.
[0135] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0136] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0137] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.
[0138] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0139] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0140] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need further definition and explanation in subsequent figures. The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.
Claims
1. A data stream identification method, characterized by, The method includes: Based on the first header information of each received data packet, the data stream in which each data packet belongs is determined, and at least one data stream to be identified is obtained. Each data stream to be identified includes at least one data packet. The first header information of each data packet in the same data stream to be identified is consistent. The first header information includes: user IP, network IP, user port, network port and protocol identifier. Based on the second header information of each data packet in the data stream to be identified, the feature information of the data stream to be identified is obtained. The second header information includes: data length and arrival time. The feature information of the data stream to be identified includes: run information, uplink payload information, downlink payload information, and time interval information of the data stream to be identified. The feature information of the data stream to be identified is input into a pre-trained target traffic identification model to predict whether the data stream to be identified is an onion route data stream. The step of obtaining the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified includes: Based on the second header information of each data packet in the data stream to be identified, the payload length and arrival time of each data packet are obtained; Based on the directionality of all data packets in the data stream to be identified, at least one first data packet belonging to the first run is selected, the payload length of each first data packet is obtained, the payload lengths of each first data packet are added together, and the total payload length obtained by the addition is used as the run information of the data stream to be identified. From all data packets in the data stream to be identified, at least one second data packet and one third data packet associated with the uplink message and downlink message respectively are selected; based on the payload length of each second data packet, the average uplink payload length, the maximum uplink payload length, and the minimum uplink payload length are obtained; based on the payload length of each third data packet, the average downlink payload length, the maximum downlink payload length, and the minimum downlink payload length are obtained. The time interval information of the data stream to be identified is determined based on the arrival time of all data packets of the data stream to be identified.
2. The method of claim 1, wherein, The step of obtaining the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified includes: The payload information of each data packet in the data stream to be identified is used for protocol identification to obtain protocol identification results, which include: identifiable and unidentifiable. If the protocol identification result is unidentifiable, then randomness detection is performed on the data stream to be identified to obtain a random value, and the feature information of the data stream to be identified is obtained based on the random value and the second header information of each data packet.
3. The method of claim 2, wherein, The step of obtaining the feature information of the data stream to be identified based on the random value and the second header information of each data packet includes: If the random value is greater than or equal to a preset threshold, the feature information of the data stream to be identified is obtained based on the random value and the second header information of each data packet.
4. The method of claim 1, wherein, The method further includes: If the data stream to be identified is an Onion Router data stream, then a reminder message is sent to a preset port, and the reminder message includes the user IP of the data stream to be identified.
5. The method of claim 1, wherein, Before inputting the feature information of the data stream to be identified into the pre-trained target traffic identification model to identify whether the data stream to be identified is an onion route data stream, the method further includes: Obtain multiple sample data packets from each sample data stream from multiple preset application terminals; Based on the second header information of each sample data packet in each sample data stream, the feature information of each sample data stream is obtained; The labels of each sample data stream are determined based on the identifiers of each preset application terminal; Training samples are constructed based on the feature information and labels of each sample data stream; The training samples are input into the initial traffic identification model for training to obtain the target traffic identification model.
6. A data flow identification apparatus characterized by comprising: The device includes: The first determining module is used to determine the data stream in which each data packet is located based on the first header information of each received data packet, and to obtain at least one data stream to be identified. Each data stream to be identified includes at least one data packet. The first header information of each data packet in the same data stream is consistent. The first header information includes: user IP, network IP, user port, network port and protocol identifier. The second determining module is used to obtain the feature information of the data stream to be identified based on the second header information of each data packet in the data stream to be identified. The second header information includes: data length and arrival time. The feature information of the data stream to be identified includes: run information, uplink payload information, downlink payload information, and time interval information of the data stream to be identified. The identification module is used to input the feature information of the data stream to be identified into a pre-trained target traffic identification model to identify whether the data stream to be identified is an onion routing data stream. The second determining module is specifically configured to: obtain the payload length and arrival time of each data packet based on the second header information of each data packet in the data stream to be identified; filter at least one first data packet belonging to the first run based on the directionality of all data packets in the data stream to be identified, obtain the payload length of each first data packet, add the payload lengths of each first data packet together, and use the total payload length obtained by the sum as the run information of the data stream to be identified; filter at least one second data packet and one third data packet associated with uplink messages and downlink messages respectively from all data packets in the data stream to be identified; obtain the average uplink payload length, the maximum uplink payload length, and the minimum uplink payload length based on the payload length of each second data packet; obtain the average downlink payload length, the maximum downlink payload length, and the minimum downlink payload length based on the payload length of each third data packet; and determine the time interval information of the data stream to be identified based on the arrival time of all data packets in the data stream to be identified, wherein the time interval information includes the average time interval, the maximum time interval, and the minimum time interval.
7. An electronic device, comprising: include: The electronic device includes a processor, a storage medium, and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the data stream identification method as described in any one of claims 1-5.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the data stream identification method as described in any one of claims 1-5.