Dark web website identification method and device in multiple tab concurrent access scenario

Abstract

This invention discloses a method and apparatus for identifying dark web websites in scenarios with concurrent access across multiple tabs. The method includes: acquiring network traffic packets of a website being viewed and extracting directional sequence features from the network traffic packets; dividing the directional sequence features into multiple sub-sequence features based on a multi-sliding window, and inputting the multiple sub-sequence features into a neural network model to extract preset pattern features; analyzing the correlation of the preset pattern features using a target website identification model to obtain a probability calculation result of the target website being accessed; and obtaining the target website identification result from the website being identified based on the probability calculation result and a preset classification model. This invention can effectively extract key information of accessed dark web websites from obfuscated dark web traffic, achieve accurate website identification across multiple tabs, and exhibit good robustness in dynamic and defensive scenarios.

Description

Technical Field

[0001] This invention relates to the field of website identification technology for dark web traffic, and in particular to a method and apparatus for identifying dark web websites in scenarios with concurrent access across multiple tabs. Background Technology

[0002] Website fingerprinting is a combination of network traffic patterns, including the size and intervals of data packets during website visits. By analyzing user traffic, even encrypted traffic, fingerprints of different websites can be extracted, thus identifying the websites a user visits. Furthermore, it can be used to monitor and combat dark web crime.

[0003] Traditional methods for identifying encrypted traffic websites mainly fall into two categories:

[0004] (1) Website identification based on manually extracted traffic features. This type of method uses manually constructed features and machine learning algorithms to identify websites, such as k-NN classifiers, SVM, and random forests. This type of method requires expert knowledge to construct features, is costly, and is easily targeted and defended against.

[0005] (2) Website identification by automatically extracting traffic features. With the rise of deep learning, it has also been widely applied to the identification of dark web websites. For example, convolutional neural networks can automatically extract useful features from basic raw traffic to accurately identify websites. However, this type of method fails when users have multiple tabs open and when there is noise in the traffic from security measures.

[0006] To address the aforementioned methods for identifying dark web websites, various defenses have been proposed, aiming to eliminate the traffic patterns of specific websites and thus hide their fingerprints. BuFLO simulates the rate of traffic packet transmission to interfere with identification; however, other characteristics such as the total data volume and the number of input and output packets can still be exploited by existing website identification methods. Tamaraw and CS-BuFLO aggregate traffic of similar scale and added padding packets into a group, but they introduce significant latency when loading web pages, making them unsuitable for real-world deployments. To address these issues, some lightweight defenses have been proposed. WTF-PAD employs an adaptive padding mechanism to reduce overhead, padding packets only when channel occupancy is low. Front pads the header packets of the traffic sequence. However, these defenses are not effective against the dark web website identification method proposed in this invention.

[0007] To address the interference from defenses, a series of methods for identifying dark web websites in defense scenarios have been proposed. These methods mainly improve recognition capabilities by enhancing features and improving models, such as incorporating temporal information into features or using self-attention mechanisms to enhance model capabilities.

[0008] In reality, it's more common for Tor users to simultaneously open multiple tabs to access the dark web. Identifying these websites requires distinguishing between obfuscated dark web traffic. The dynamic nature of the number of tabs opened by Tor users and the time intervals between tabs makes solving this type of problem challenging. Furthermore, interference from defenses significantly increases the difficulty of identifying multi-tab dark web websites, and currently, no research has considered this issue. Summary of the Invention

[0009] The present invention aims to at least partially solve one of the technical problems in the related art.

[0010] To address the shortcomings of existing technologies, this invention proposes a website identification method for obfuscated dark web traffic in multi-tab scenarios. This method improves the accuracy of website identification without prior knowledge such as the number of websites visited, making it more suitable for scenarios where real users browse websites. It also ensures robustness under the interference of website fingerprinting defenses, is applicable to website identification of various encrypted traffic types, and has low overhead.

[0011] Another objective of this invention is to provide a device for identifying dark web websites in scenarios where multiple tabs are accessed concurrently.

[0012] To achieve the above objectives, this invention proposes a method for identifying dark web websites in scenarios with concurrent access across multiple tabs, comprising:

[0013] Obtain network traffic packets of the website to be identified being browsed, and extract the directional sequence features from the network traffic packets;

[0014] The directional sequence features are divided into multiple sub-sequence features based on a multi-sliding window, and the multiple sub-sequence features are input into a neural network model to extract preset pattern features;

[0015] The correlation of the preset pattern features is analyzed using the target website identification model to obtain the probability calculation result of the target website being visited;

[0016] Based on the probability calculation results and the preset classification model, the target website identification results are obtained from the websites to be identified.

[0017] In addition, the method for identifying dark web websites in a scenario of concurrent access across multiple tabs according to the above embodiments of the present invention may also have the following additional technical features:

[0018] Furthermore, in one embodiment of the present invention, the classification model includes multiple binary classifiers, which are used to identify whether the target website is contained in the website to be identified.

[0019] Furthermore, in one embodiment of the present invention, the step of dividing the direction sequence features into multiple sub-sequence features based on multiple sliding windows includes: concatenating the direction sequence features to obtain flow loop features; and using multiple sliding windows to segment the flow loop features from different positions to obtain multiple sub-sequence features.

[0020] Furthermore, in one embodiment of the present invention, the neural network model includes a first analysis module and a second analysis module; the step of inputting multiple sub-sequence features into the neural network model to extract preset pattern features includes: inputting the multiple sub-sequence features into the convolutional layer and Batch Norm layer of the first analysis module to output a first local feature vector; concatenating the first local feature vector with the multiple sub-sequence features and inputting it into the max pooling layer of the first analysis module to output a first local pattern feature; inputting the first local pattern feature into the convolutional layer and Batch Norm layer of the second analysis module to output a second local feature vector; concatenating the second local feature vector with the second local feature vector and inputting it into the max pooling layer of the second analysis module to output a second local pattern feature.

[0021] Furthermore, in one embodiment of the present invention, the target website identification model includes a multi-head top-m attention layer; the step of analyzing the correlation of the preset pattern features using the target website identification model to obtain the probability calculation result of the target website being visited includes: obtaining a preset number of projection matrices based on the second local pattern features and the multi-head top-m attention layer; obtaining the output result of the preset number of heads based on the projection matrix and a first preset formula; obtaining the output result of the multi-head top-m attention layer based on the output result of the preset number of heads and a linear projection function, and using a second preset formula; and obtaining the probability calculation result of the target website being visited based on the output result of the multi-head top-m attention layer and preset network rules, and using a third preset formula.

[0022] To achieve the above objectives, another aspect of the present invention proposes a device for identifying dark web websites in scenarios with concurrent access across multiple tabs, comprising:

[0023] The initial feature acquisition module is used to acquire network traffic packets of the website to be identified being browsed, and extract directional sequence features from the network traffic packets;

[0024] The key feature extraction module is used to divide the direction sequence features into multiple sub-sequence features based on multiple sliding windows, and input the multiple sub-sequence features into a neural network model to extract preset pattern features;

[0025] The access probability calculation module is used to analyze the correlation of the preset pattern features using the target website identification model to obtain the probability calculation result of the target website being accessed.

[0026] The target website identification module is used to obtain the target website identification result in the website to be identified based on the probability calculation result and the preset classification model.

[0027] The method and apparatus for identifying dark web websites in scenarios with concurrent access across multiple tabs, as described in this invention, can achieve accurate identification even when the number of tabs opened by the user is unknown and dynamically changing. It is the first invention specifically designed for multi-tab website identification in real-world scenarios. Furthermore, this invention still achieves more robust website identification capabilities than existing methods against various web fingerprinting defenses because the top-m self-attention mechanism based on local traffic characteristics proposed in this invention can better eliminate the influence of noise. In summary, this invention is not only a multi-tab website identification method with practical application value, but also achieves robust identification that resists the effects of defenses and concept drift.

[0028] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0029] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0030] Figure 1 Threat models identified for general websites;

[0031] Figure 2 This is a flowchart illustrating a method for identifying dark web websites in a scenario of concurrent access across multiple tabs, according to an embodiment of the present invention.

[0032] Figure 3 This is an architecture diagram of a method for identifying dark web websites in a scenario of concurrent access across multiple tabs, according to an embodiment of the present invention.

[0033] Figure 4 This is a structural diagram of the local analysis module according to an embodiment of the present invention;

[0034] Figure 5 This is a structural diagram of the multi-head top-m attention mechanism in the website identification module according to an embodiment of the present invention;

[0035] Figure 6 This invention relates to a device for identifying dark web websites in scenarios where multiple tabs are accessed concurrently. Detailed Implementation

[0036] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0037] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0038] The following description, with reference to the accompanying drawings, describes a method and apparatus for identifying dark web websites in a scenario of concurrent access across multiple tabs, according to embodiments of the present invention.

[0039] Figure 2 This is a flowchart of a method for identifying dark web websites in a scenario of concurrent access across multiple tabs, according to an embodiment of the present invention.

[0040] like Figure 1 As shown, the method includes, but is not limited to, the following steps:

[0041] S1, Obtain network traffic packets of the website to be identified being browsed, and extract the directional sequence features from the network traffic packets;

[0042] S2, based on multiple sliding windows, the direction sequence features are divided into multiple sub-sequence features, and the multiple sub-sequence features are input into the neural network model to extract the preset pattern features;

[0043] S3, use the target website identification model to analyze the correlation of preset pattern features to obtain the probability calculation result of the target website being visited.

[0044] S4, based on the probability calculation results and the preset classification model, obtains the target website identification results among the websites to be identified.

[0045] The following describes in detail, with reference to the accompanying drawings, the method for identifying dark web websites in a scenario of concurrent access across multiple tabs according to an embodiment of the present invention.

[0046] As an example, this invention presents a threat model. Users hide their online activities through privacy protection mechanisms such as the Tor browser, and they can open multiple browser pages to load multiple pages from different websites simultaneously. Therefore, a single browsing session may contain encrypted traffic from multiple websites. Furthermore, the user's browser or Tor relay nodes may have defensive measures deployed, making it impossible to fully preserve the traffic patterns of a single website. In this invention, website fingerprinting is used to infer the websites a user browses to analyze their online behavior. The perpetrator can deploy multiple traffic collection points to record the user's encrypted traffic, and even obtain traffic before entering the Tor network. It is worth noting that delaying or discarding user network traffic packets is not within the scope of this invention.

[0047] Compared to traditional multi-tab website recognition models, Figure 1 Threat models identified for general websites, such as Figure 1 As shown. The model of this invention is designed for more realistic scenarios, and is also more challenging. First, it considers the possibility that users may have deployed defenses. Therefore, the traffic patterns of a single website may be affected by these anti-identification measures. Second, it considers that the number of web pages a user opens may be dynamically changing and unknown in advance, while previous identification strategies all assumed that users always open a fixed number of web pages, so their models could be trained and tested in scenarios with the same number of web pages, which limits their application in reality.

[0048] This invention addresses two scenarios: a closed world and an open world. In a closed world, it assumes that a user will only browse a small set of websites, referred to as monitored websites, such as the 100 most frequently visited websites by Alexa. In this case, the observer can collect training data from all websites. In an open world, a user can browse any website, therefore the observer can only obtain training data from a subset of websites.

[0049] The following describes a model for a method to identify dark web websites in a scenario where multiple tabs are accessed concurrently.

[0050] Previous multi-tab website identification methods required prior knowledge of the number of opened web pages. To address this issue, this invention treats website identification in multi-tab scenarios as a multi-label classification problem. Due to interference between different websites and noise introduced by defense mechanisms, training only a single classifier to solve this problem is extremely difficult. Therefore, this invention constructs a multi-classifier architecture to solve the above multi-label classification problem. Each classifier calculates the probability of a specific website being visited in a specific scenario. Finally, this invention integrates the results of each classifier to output the set of all websites visited in each browsing session. Furthermore, since local patterns of a website can still be extracted from multiple short traffic sequences, a new model, Trans-WF, is designed for each classifier. This model can construct robust fingerprints for specific websites based on these local patterns.

[0051] Furthermore, Figure 3 This is an architecture diagram of a method for identifying dark web websites in a scenario of concurrent access across multiple tabs, as proposed in this invention. Table 1 shows the meaning of the labels.

[0052] Table 1

[0053]

[0054]

[0055] Example 1:

[0056] S11: Eavesdropping on Tor users who open multiple tabs to access dark web websites and extracting the direction sequence of traffic as features;

[0057] S12, the extracted directional sequence features are input into multiple binary classifiers, each of which is used to identify whether the obfuscated traffic contains the target website;

[0058] S13, the directional sequence is divided into multiple sub-sequences based on a multi-sliding window.

[0059] Specifically, the system collects network traffic packets during user website browsing, extracts the direction sequences from these packets, and uses +1 to represent outgoing traffic packets and -1 to represent incoming traffic packets. The extracted direction sequences are then fed in parallel into multiple classifiers. The traffic segmentation module uses a sliding window approach to divide the collected complete direction sequences into multiple segments, while preserving the integrity of the local traffic patterns in each segment. Based on a multi-binary classifier architecture, each classifier is used to identify whether the obfuscated traffic contains the target website.

[0060] Understandably, given the non-uniformity of local traffic patterns, directly dividing the entire directional sequence into non-overlapping segments of equal size is inappropriate, as it may disrupt specific local patterns. Furthermore, simply increasing the segment size does not guarantee good results, as this reduces the number of local traffic patterns. Website patterns are typically related to HTML elements of web pages, and traffic packets related to HTML elements usually concentrate in a smaller traffic sequence, forming a unique local traffic pattern. To ensure the capture of every complete local segment, multiple sliding windows are used to segment the traffic sequence from different positions. This way, even if a segment is disrupted in one sliding window, it can still be captured in another. To ensure that all captured sequences are of the same length, the original segments are concatenated before segmentation, forming a traffic loop. Within the same sliding window, segments do not overlap, while traffic sequences between different sliding windows can overlap.

[0061] Specifically, to ensure the integrity of local traffic, this invention utilizes multiple sliding windows to segment the traffic from different starting positions. This way, even if a local traffic pattern is disrupted in one sliding window, it can still be extracted in another. Specifically, (d, y) represents a user's browsing sample, where d is a direction sequence of length l, and y is the label vector of that sample. If this sample contains the i-th monitored website, then y... i =1, otherwise y i =0. Define w and n as the size and number of sliding windows, respectively. Before segmentation, this invention copies the original sequence to form a loop, ensuring that all segments have the same length. The starting position of the i-th sliding window is the i-th element in sequence d, and the set of extracted flow segments is represented as... Each segment is unique. The final set of all segment sequences generated by the n sliding windows is S = {W1, ..., W...} n The segmented sequences extracted by different sliding windows can overlap.

[0062] S14, extracting key local patterns from subsequences based on convolutional neural networks.

[0063] As an example, the local analysis module accurately extracts the local features of each directional sequence segment in the segmented set S obtained from S13 as the local pattern of the monitored website. Since the packet sequence positions representing different local traffic patterns are not fixed, and traffic packets from other websites or defense traffic packets can cause noise interference, existing linear transformation-based models are not well-suited for this problem because they are sensitive to packet position and noise. Considering that convolutional neural networks can still obtain relatively stable embedding vectors for changing inputs and have good robustness to noise, this invention utilizes convolutional neural networks to extract local features.

[0064] Specifically, such as Figure 4 As shown, the convolutional neural network structure of the local analysis module contains L blocks, each block containing two one-dimensional convolutional layers, two batch normalized layers with ReLU activation function, and one max pooling layer. Furthermore, we added the following two mechanisms to further enhance the capabilities of our model: A1, residual connections: connecting intermediate outputs from lower layers with outputs from higher layers to prevent gradient vanishing; A2, dropout: randomly discarding some units of the neural network during training to avoid overfitting.

[0065] Furthermore, the flow of the local analysis module in this specific embodiment will be described in detail below. The input of the first block is a segment s from the segment set S obtained by segmentation in S13, where s∈{-1,1}. w The output of the first block serves as the input to the second block, and so on. Within each block, the input first passes through two convolutional layers and two batch normalization layers to extract local features. These local feature vectors, i.e., the output of the last batch normalization layer, are concatenated with the original input and then fed into a max-pooling layer to extract the most representative features while filtering out some noise. Specifically, let x be the block input, and the block output B(x) be calculated using the following equation:

[0066] B(x)=Dropout(MaxPool(F(F(x))+x)),

[0067] Here, F(x) contains a convolutional layer and a batch normalization layer with ReLU as the activation function, that is:

[0068] F(x) = ReLU(BN(Conv1d(x))).

[0069] This invention utilizes a convolutional neural network to extract the traffic pattern of each segment. Since the packet sequence positions representing different local traffic patterns are not fixed, and there is noise interference from unrelated sequences of traffic from other websites within the same segment, and considering the good robustness of convolutional neural networks to inputs with positional biases, this invention uses a convolutional neural network to extract local features.

[0070] S15, based on Transformer analysis of the correlation between different local traffic patterns, calculates the probability that the obfuscated traffic contains the target website.

[0071] Understandably, the website identification module analyzes the correlation of local features across different segments to determine the probability of a single website being visited in the current session. The attention mechanism in the Transformer architecture is suitable for solving this problem. The attention mechanism calculates the correlation between a query and a set of key-value pairs, where the query vector, key vector, and value vector are all obtained from the input vector through different matrix projections. The workflow of the attention mechanism is as follows: First, the weight of each value vector is calculated based on the query vector and the corresponding key vector. Then, the weighted sum of all value vectors is calculated as the correlation between different queries and key-value pairs. When the above method is applied to different segments of the same sequence, it is called a self-attention mechanism, which can transform the original sequence into a representation that can represent its internal correlations. Using the self-attention mechanism, local feature vectors are taken as input, and the output is used as the fingerprint of the monitored website. Specifically, X is defined as the input matrix with dimensions b*d. m b is the batch size; define W Q W K W V These are the parameter matrices used for projection, with dimension d. m *d, where d is the dimension of the output vector, and these projection matrices will be learned and updated during training; Q, K, and V are defined as the query matrix, key matrix, and value matrix, respectively.

[0072] The workflow of the attention mechanism is as follows: A1. Calculate the Q, K, and V matrices using the input matrix and projection matrix. The specific calculation formulas are as follows:

[0073] Q = XW Q K = XW K V = XW V ,

[0074] A2. Calculate the output using the attention function. The attention function calculates the dot product of each query vector and all key vectors, and then divides by... The values ​​are normalized using a normalization method, and then the softmax function is applied to obtain the weight of each value vector and calculate a weighted sum of the value vectors. The specific calculation formula is as follows:

[0075]

[0076] However, due to noise from traffic from other websites and defense traffic, directly applying the aforementioned attention mechanism to multi-tab scenarios is not a good choice. Specifically, the above mechanism includes a fully connected attention layer, so the output vector depends on the correlation between this input vector and the local feature vectors of all other inputs. Noisy traffic inevitably impairs the accuracy of the output. To address this issue, this invention proposes an improved attention layer: top-m self-attention. Unlike the basic attention mechanism, which calculates a weighted sum for all values, the top-m attention layer only calculates the output vector based on the m largest weight values ​​calculated from the query and key. Since the traffic of the monitoring website itself has low correlation with traffic from other websites and defenses, the segmented local features extracted from them will also have small weight values ​​based on the attention mechanism. The top-m self-attention mechanism can filter out these small weight values, thereby filtering out noise. Specifically, the calculation method of top-m is as follows:

[0077]

[0078]

[0079] Here, Γ is a selection operation for the maximum m elements at the row granularity, and ∈ is a very small constant.

[0080] like Figure 5 As shown, the website identification module of this invention uses multiple top-m attention layers in parallel to form a multi-head top-m attention layer. This allows each classifier, Trans-WF, to calculate the correlation of local features extracted by different sliding windows, thereby obtaining a more accurate fingerprint for each website. Its workflow is as follows:

[0081] A1. For the i-th head, define... These are the projection matrices for this head, and they are all d*d. h d-dimensional matrix, and d h This is the dimension of the head output vector. Let h be the number of heads, and d be... h = d / h. The output of the i-th head can be calculated using the following equation:

[0082]

[0083] Furthermore, each head can be computed independently and in parallel.

[0084] A2. The results from each head are connected and passed through a linear projection function to obtain the output of the attention layer. Specifically, W is defined as follows: OThis is the weight matrix, which is hd h Given a d-dimensional matrix, where Λ(X) is the output of a multi-head top-m attention layer, it can be calculated using the following equation:

[0085] Λ(X)=Concat(head1,...,head h W O

[0086] A3. After calculating the output of the attention layer, a normalization layer and a multilayer perceptron are used to identify the probability of a specific target website appearing. Residual connection and Dropout mechanisms are also introduced to avoid gradient vanishing and overfitting problems. Specifically, LN is defined as the normalization layer calculation, g and b are defined as the gain and bias parameters, μ and σ are defined as the expectation and variance of X, ⊙ is defined as the multiplication between corresponding elements at the same position of two vectors, ∈ is defined as a very small constant to avoid division by zero, and the MLP uses the softmax function. Then, the result Φ(X) of the target website can be calculated using the following equation:

[0087] Φ(X)=MLP(LN(X+Dropout(Λ(X)))),

[0088]

[0089] This embodiment uses the Transformer-based target website identification module to calculate the probability of a specific website being visited during a user's browsing activity. To eliminate interference from traffic from other websites and defense traffic, only highly correlated traffic segments are considered, and their correlation is calculated as the fingerprint of a specific monitored website, thereby filtering out noisy traffic. Furthermore, by jointly capturing the correlation of local patterns extracted from multiple sliding windows, a more accurate website fingerprint is obtained.

[0090] S16 integrates all classifiers to identify the set of dark web sites accessed by Tor users through multiple tabs.

[0091] Specifically, the results from different website classifiers are integrated, sorted in descending order, and finally output as the set of websites predicted for the user's browsing in this session.

[0092] The method for identifying dark web websites in scenarios with concurrent access across multiple tabs, according to embodiments of the present invention, treats website identification in multi-tab scenarios as a multi-tab classification problem and designs a model architecture containing multiple binary classifiers, overcoming the limitation of existing methods requiring the number of accessed web pages. For each classifier, our proposed Trans-WF model can identify a specific website without relying on the clean traffic patterns from a single website. By collecting large-scale traffic data from both closed and open worlds in multi-tab scenarios, the method proposed in this invention can improve the accuracy of identification and maintain a certain degree of robustness against various defense mechanisms. In summary, this method can be better applied to multi-tab website identification in real-world scenarios.

[0093] Example 2:

[0094] To achieve the above embodiments, such as Figure 6 As shown, this embodiment also provides a dark web website identification device 10 for scenarios with concurrent access across multiple tabs. The device 10 includes an initial feature acquisition module 100, a key feature extraction module 200, an access probability calculation module 300, and a target website identification module 400.

[0095] The initial feature acquisition module 100 is used to acquire network traffic packets of the website to be identified being browsed and extract directional sequence features from the network traffic packets;

[0096] The key feature extraction module 200 is used to divide the direction sequence features into multiple sub-sequence features based on multiple sliding windows, and input the multiple sub-sequence features into a neural network model to extract preset pattern features;

[0097] The access probability calculation module 300 is used to analyze the correlation of preset pattern features using the target website identification model in order to obtain the probability calculation result of the target website being accessed.

[0098] The target website identification module 400 is used to obtain the target website identification results in the website to be identified based on the probability calculation results and the preset classification model.

[0099] The classification model includes multiple binary classifiers, which are used to identify whether the target website is contained in the website to be identified.

[0100] Furthermore, the aforementioned key feature extraction module 200 is also used for:

[0101] The flow loop features are obtained by concatenating the directional sequence features;

[0102] Multiple subsequence features are obtained by segmenting the flow loop features from different positions using multiple sliding windows.

[0103] Furthermore, the aforementioned neural network model includes a first analysis module and a second analysis module; the aforementioned key feature extraction module 200 is also used for:

[0104] Multiple sub-sequence features are input into the convolutional layer and Batch Norm layer of the first analysis module, and the first local feature vector is output. The first local feature vector is concatenated with the multiple sub-sequence features and then input into the max pooling layer of the first analysis module, and the first local pattern feature is output.

[0105] The first local pattern feature is input into the convolutional layer and the Batch Norm layer of the second analysis module, and the output is the second local feature vector. The second local feature vector is then concatenated with the second local feature vector and input into the max pooling layer of the second analysis module, and the output is the second local pattern feature.

[0106] Furthermore, the aforementioned target website identification model includes a multi-head top-m attention layer; the aforementioned access probability calculation module 300 is also used for:

[0107] Based on the second local pattern features and the multi-head top-m attention layer, the projection matrix of the preset number of heads is obtained, and the output results of the preset number of heads are obtained based on the projection matrix and the first preset formula;

[0108] Based on the output results of a predetermined number of heads and the linear projection function, the output results of the multi-head top-m attention layer are obtained using a second predetermined formula;

[0109] Based on the output of the multi-head top-m attention layer and the preset network rules, the probability of the target website being visited is calculated using the third preset formula.

[0110] The dark web website identification device for concurrent access scenarios across multiple tabs, according to embodiments of the present invention, treats website identification in multi-tab scenarios as a multi-tab classification problem and designs a model architecture containing multiple binary classifiers, overcoming the limitation of existing methods requiring the number of accessed web pages. For each classifier, our proposed Trans-WF model can identify a specific website without relying on the clean traffic patterns from a single website. By collecting large-scale traffic data from both closed and open worlds in multi-tab scenarios, the method proposed in this invention can improve the accuracy of identification and maintain a certain degree of robustness against various defense mechanisms.

[0111] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0112] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A dark web website identification method in a multiple tab concurrent access scenario, characterized in that, The method comprises the following steps: obtaining network traffic packets of a website to be identified, and extracting direction sequence features in the network traffic packets; dividing the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows, and inputting the plurality of subsequence features into a neural network model to extract preset pattern features; analyzing the correlation of the preset pattern features by using a target website identification model to obtain a probability calculation result of a target website being accessed; obtaining a target website identification result in the website to be identified based on the probability calculation result and a preset classification model, wherein the classification model comprises a plurality of binary classifiers, and the binary classifiers are used to identify whether the target website is included in the website to be identified; the target website identification model comprises a multi-head top-m attention layer; the target website identification model is used to analyze the correlation of the preset pattern features to obtain the probability calculation result of the target website being accessed, which comprises: obtaining a projection matrix of a first preset number of heads based on a second local pattern feature and the multi-head top-m attention layer, and obtaining output results of the first preset number of heads based on the projection matrix and a first preset formula; obtaining an output result of the multi-head top-m attention layer based on the output results of the first preset number of heads and a linear projection function, and using a second preset formula; obtaining the probability calculation result of the target website being accessed based on the output result of the multi-head top-m attention layer and a preset network rule, and using a third preset formula.

2. The method of claim 1, wherein, the direction sequence features are divided into a plurality of subsequence features based on a plurality of sliding windows, which comprises: concatenating the direction sequence features to obtain a traffic loop feature; segmenting the traffic loop feature from different positions by using a plurality of sliding windows to obtain a plurality of subsequence features.

3. The method of claim 1, wherein, the neural network model comprises a first analysis module and a second analysis module; the plurality of subsequence features are input into the neural network model to extract the preset pattern features, which comprises: inputting the plurality of subsequence features into a convolution layer and a Batch Norm layer of the first analysis module to output a first local feature vector, and inputting the first local feature vector and the plurality of subsequence features into a max-pooling layer of the first analysis module after connection to output a first local pattern feature; inputting the first local pattern feature into a convolution layer and a Batch Norm layer of the second analysis module to output a second local feature vector, and inputting the second local feature vector and the second local feature vector into a max-pooling layer of the second analysis module after connection to output a second local pattern feature.

4. A dark web website identification apparatus in a multiple tab concurrent access scenario, characterized in that, comprise: an initial feature acquisition module configured to obtain network traffic packets of a website to be identified, and extract direction sequence features in the network traffic packets; a key feature extraction module configured to divide the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows, and input the plurality of subsequence features into a neural network model to extract preset pattern features; an access probability calculation module configured to analyze the correlation of the preset pattern features by using a target website identification model to obtain a probability calculation result of a target website being accessed; The target website identification module is configured to obtain a target website identification result of the target website in the website to be identified based on the probability calculation result and a preset classification model. The classification model includes a plurality of binary classifiers, and the binary classifiers are configured to identify whether the target website is included in the website to be identified. The target website identification model includes a multi-head top-m attention layer. The access probability calculation module is further configured to: obtain a projection matrix of a first preset number of heads based on the second local pattern feature and the multi-head top-m attention layer, and obtain an output result of the first preset number of heads based on the projection matrix and a first preset formula; obtain an output result of the multi-head top-m attention layer based on the output result of the first preset number of heads and a linear projection function and by using a second preset formula; obtain the probability calculation result of the target website being accessed based on the output result of the multi-head top-m attention layer and a preset network rule and by using a third preset formula.

5. The apparatus of claim 4, wherein, The key feature extraction module is further configured to: splice the direction sequence feature to obtain a traffic loop feature; segment the traffic loop feature from different positions to obtain a plurality of subsequence features by using a plurality of sliding windows.

6. The apparatus of claim 4, wherein, The neural network model includes a first analysis module and a second analysis module. The key feature extraction module is further configured to: input the plurality of subsequence features into a convolution layer and a Batch Norm layer of the first analysis module, and output a first local feature vector; and input the first local feature vector and the plurality of subsequence features after being connected into a max-pooling layer of the first analysis module, and output a first local pattern feature; input the first local pattern feature into a convolution layer and a Batch Norm layer of the second analysis module, and output a second local feature vector; and input the second local feature vector and the second local feature vector after being connected into a max-pooling layer of the second analysis module, and output a second local pattern feature.

Images