Method for identifying real-time interactive audio application traffic of mobile platform in encrypted tunnel

Abstract

The application discloses a kind of identification methods for real-time interactive audio application flow in encrypted tunnel, the method includes: for typical real-time interactive audio application, analyze the correlation atlas of decompilation code, dynamic debugging application, build application behavior and traffic characteristics;Based on the protocol level rule, the packet level hierarchical space-time representation is carried out to encrypted tunnel flow, and the application is identified using the Transformer classifier;Finally, based on the application behavior-traffic characteristics correlation atlas, the packet level and flow level characteristics of the application flow in the encrypted tunnel are extracted in window, a feature matrix is constructed, and an integrated learning model is used to make a behavior decision for each window, and finally a complete behavior description of the traffic sample is formed.The application can well identify the attribution application and application behavior of real-time interactive audio application flow in encrypted tunnel by combining application reverse analysis and behavior traffic characteristics analysis with mainstream machine learning classifiers, which is of great significance for strengthening network supervision and maintaining public opinion environment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a method for identifying real-time interactive audio application traffic of a mobile platform in an encrypted tunnel. BACKGROUND

[0002] The popularity of mobile intelligent devices has driven the rapid development of audio and video streaming media, and along with the increasingly prominent network social attributes, real-time interactive audio and video applications based on technical frameworks such as Webrtc are increasingly popular. Real-time interactive audio is a specialized scenario of real-time interactive audio and video, which reduces the hardware requirements such as network bandwidth while achieving the purpose of instant social discussion. In recent years, there have been many interactive audio live applications at home and abroad and they are widely popular, including Clubhouse, Spotify Live, Spoon and the like. Such applications mainly adopt a group discussion mode of single initiator-multi-discussion-multi-audience, and the application interface contains a large number of discussion groups classified by categories. After entering the discussion group, the user can listen to the discussion in the group and can apply to join the discussion. Meanwhile, the user can also create his own discussion group to invite other users to discuss.

[0003] In order to evade the restrictions of network supervision on discussion topics, some domestic users use proxy tools to bypass network border checks to join the discussion of real-time interactive audio platforms in foreign countries. These users use encrypted proxy tools based on the transformed Socks5 protocol, OpenVPN and the like to build encrypted tunnels on mobile devices to use overseas real-time interactive audio applications. The use of encrypted tunnels enables such overseas real-time interactive audio applications to effectively resist the examination of existing network supervision means in terms of traffic form. Due to the lack of supervision, harmful information on overseas real-time interactive audio platforms has been rampant and gradually penetrated into the domestic Internet environment. Therefore, it is of great significance to identify the real-time interactive audio application traffic under the encrypted proxy.

[0004] At present, the identification of interactive audio live in the encrypted proxy scenario is almost blank, so it is necessary to identify the real-time interactive audio application traffic of a mobile platform in an encrypted tunnel. SUMMARY

[0005] The application aims to solve the problems in the prior art and provides a method for identifying real-time interactive audio application traffic of a mobile platform in an encrypted tunnel, which identifies by fusing application communication mechanism reverse analysis and application behavior traffic characteristic analysis and combining machine learning models such as integrated learning and Transformer.

[0006] The technical solution for achieving the application is as follows: a method for identifying real-time interactive audio application traffic of a mobile platform in an encrypted tunnel, comprising the following steps:

[0007] Step 1, for real-time interactive audio application, the intermediate code is obtained by decompiling with Jadx tool and the program running logic is analyzed statically, the application is analyzed dynamically based on IDA Pro tool, the application behavior, application program API and application network traffic are associated gradually, the traffic characteristics corresponding to the application behavior are obtained, including flow level characteristics and packet level characteristics;

[0008] Step 2, for the captured real-time interactive audio traffic under the encrypted tunnel, the data packets with serial numbers 0 to N are intercepted, the IP protocol header field, TCP protocol header field and load information of each data packet are extracted;

[0009] Step 3, according to the protocol level, the hierarchical representation vectors of IP, TCP and load are generated in binary form row by row, and all the data packets form a representation matrix of the traffic sample;

[0010] Step 4, the sample traffic representation matrix generated in step 3 is used to identify the specific real-time interactive audio application to which the sample traffic belongs based on a Transformer classifier;

[0011] Step 5, the traffic attribution application identified in step 4 is used to further identify the specific application behavior corresponding to the encrypted proxy traffic of the specific application;

[0012] Step 6, the sample traffic is divided into M intervals according to the time window, and the features of the traffic in each interval are extracted to form a feature matrix using the correspondence between the application behavior and the traffic characteristics obtained in step 1;

[0013] Step 7, the feature matrix generated in step 6 is used to determine the application behavior corresponding to the sample traffic based on an ensemble learning model for each time window;

[0014] Step 8, the behavior recognition results of the sample traffic in each time window in step 7 are combined to form a complete application behavior description of the sample traffic.

[0015] Compared with the prior art, the present application has the following advantages:

[0016] 1) By performing intermediate code static analysis and application program dynamic debugging analysis on typical real-time interactive audio applications, the communication mechanism reverse knowledge of the target application is obtained more comprehensively, and the specific mechanism of application traffic generation is clarified.

[0017] 2) For traffic attribution application identification, a binary representation form based on packet protocol level rules is adopted, which not only retains the time and space characteristics of the traffic data packet, but also scientifically solves the problems of uniformization and deviation standardization of the traffic data representation matrix.

[0018] 3) For the behavior decision problem of real-time interactive audio application traffic under the encrypted tunnel, based on the fusion analysis of application reverse knowledge and application traffic characteristics, the key features of the sample traffic are scientifically and accurately extracted and a unified feature representation matrix is formed, and the integrated learning model is combined to efficiently realize the decision of the corresponding behavior of the sample traffic.

[0019] Overall, the application can well identify the attribution application and application behavior of real-time interactive audio application traffic in the encrypted tunnel by fusing application communication mechanism reverse analysis and application behavior traffic characteristic analysis, and combining the mainstream machine learning classifier at the present stage, which has important significance for strengthening network service supervision and maintaining social public opinion stability.

[0020] The application will be further described below with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 The figure is a flowchart of the application for identifying real-time interactive audio application traffic of mobile platforms in an encrypted tunnel. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and not to limit the present application.

[0023] Figure 1 The figure is a flowchart of the application for identifying real-time interactive audio application traffic of mobile platforms in an encrypted tunnel. The method comprises the following steps:

[0024] Step 1, for typical real-time interactive audio applications, use Jadx tool to decompile to obtain intermediate code and statically analyze program running logic, use IDA Pro tool to dynamically debug and analyze the application, gradually associate application behavior, application program API and application network traffic, obtain traffic characteristics corresponding to application behavior, including flow level characteristics and packet level characteristics;

[0025] Among them, the typical real-time interactive audio application refers to the real-time interactive audio application developed based on WebRTC_SDK and Agora_SDK two types of real-time audio and video frameworks.

[0026] Here, the corresponding relationship between the original real-time interactive audio traffic and the application behavior is analyzed, and the traffic characteristics obtained are the original traffic characteristics under the non-encrypted proxy scenario.

[0027] Here, the traffic characteristics corresponding to the application behavior are flow-level characteristics and packet-level characteristics, the flow-level characteristics include the number of flows, the duration of the flow, the interval of the flow generation, the order of the flow generation, the transmission resource of the flow, the flow rate, the packet-level characteristics include the packet rate, the number of uplink packets, the number of downlink packets, the ratio of uplink and downlink packets, the mean inter-packet delay, the standard deviation of the inter-packet delay, and the proportion of the number of MSS packets.

[0028] Step 2, for the captured real-time interactive audio traffic under the encrypted tunnel, the data packets with serial numbers from 0 to N are intercepted, and the IP protocol header field, the TCP protocol header field, and the payload information of each data packet are extracted.

[0029] Here, the extracted payload information is TCP payload information, that is, all information including the application layer protocol field and the application layer payload.

[0030] Here, the complete payload information is not used to represent the traffic data packet, but the first 100 bytes of the TCP payload data are intercepted for representation, and the insufficient part is filled with 0.

[0031] Here, the data packets with serial numbers from 0 to N are specifically: for each group of traffic samples, the data packets with serial numbers from 0 to 500 arranged in time sequence are intercepted.

[0032] Step 3, according to the protocol hierarchy according to the data packet serial number, generate the hierarchical representation vectors of IP, TCP, and payload in binary form line by line, and all data packets form the representation matrix of the traffic sample;

[0033] Here, when performing binary hierarchical representation, if the data packet does not exist corresponding IP or TCP header field, the corresponding binary bits are represented as -1, otherwise they are represented as 0 or 1.

[0034] Here, when performing traffic representation, the IP address and port number information contained in the protocol header field need to be fuzzed, and the corresponding binary position is -1.

[0035] Step 4, using the sample traffic representation matrix generated in step 3, based on the Transformer classifier, identify the specific real-time interactive audio application to which the sample traffic belongs.

[0036] Step 5, using the traffic attribution application identified in step 4, further identify the specific application behavior corresponding to the specific application encryption proxy traffic.

[0037] Step 6, divide the sample traffic into M intervals according to the time window, and use the correspondence between the application behavior and the traffic characteristics obtained in step 1 to extract the characteristics of the traffic in each interval to form a feature matrix.

[0038] Here, the interval number M is determined by the traffic sample duration and the time window size, wherein the time window size is 100 ms, and the sample traffic duration is determined by the actual traffic capture duration.

[0039] Step 7: Based on the feature matrix generated in step 6, the application behavior corresponding to the sample traffic is determined by the integrated learning model for each time window.

[0040] In steps 1 and 7, the real-time interactive audio application behavior includes creating an interactive audio live broadcast, destroying an interactive audio live broadcast, joining an interactive audio live broadcast, exiting an interactive audio live broadcast, conducting an audio interactive discussion, and audio interactive member change.

[0041] Step 8: Based on the behavior recognition result of the sample traffic for each time window in step 7, the complete application behavior description of the sample traffic is formed.

[0042] Here, the complete behavior description of the sample traffic refers to which behavior of the application behavior described in step 7 is performed by the application at which time point in the entire sample traffic duration, and the application behavior not belonging to the behavior category is not identified.

[0043] The application can well recognize the attribution application and application behavior of the real-time interactive audio application traffic in the encryption tunnel by fusing application communication mechanism reverse analysis and application behavior traffic characteristic analysis, and combining the mainstream machine learning classifier at the present stage, which has important significance for strengthening network service supervision and maintaining social public opinion stability.

[0044] The basic principles, main features and advantages of the present application are shown and described above. It should be understood by those skilled in the art that the present application is not limited by the above examples, and the above examples and descriptions in the specification are only to illustrate the principles of the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the claimed present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for identifying real-time interactive audio application traffic on a mobile platform within an encrypted tunnel, characterized in that, Includes the following steps: Step 1: For real-time interactive audio applications, use the Jadx tool to decompile and obtain intermediate code and statically analyze the program's running logic. Then, use the IDA Pro tool to dynamically debug and analyze the application, gradually associating application behavior, application APIs, and application network traffic to obtain the traffic characteristics corresponding to the application behavior, including stream-level characteristics and packet-level characteristics. Step 2: For the captured real-time interactive audio traffic under the encrypted tunnel, extract the data packets numbered 0 to N, and extract the IP protocol header fields, TCP protocol header fields, and payload information of each data packet; Step 3: Based on the packet sequence number and according to the protocol layer, generate hierarchical representation vectors for IP, TCP, and load in binary form, row by row. All packets form a representation matrix of traffic samples. Step 4: Using the sample traffic representation matrix generated in Step 3, identify the specific real-time interactive audio application to which the sample traffic belongs based on the Transformer classifier. Step 5: Using the traffic attribution application identified in Step 4, further identify the specific application behavior corresponding to the encrypted proxy traffic of a specific application. Step 6: Divide the sample traffic into M intervals according to the time window, and use the correspondence between application behavior and traffic characteristics obtained in Step 1 to extract the features of traffic in each interval to form a feature matrix. Step 7: Using the feature matrix generated in Step 6, make a judgment on the application behavior corresponding to the sample traffic based on the ensemble learning model in each time window; Step 8: Using the behavior recognition results of the sample traffic in step 7 for each time window, combine them to form a complete application behavior description of the sample traffic.

2. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, The real-time interactive audio application in step 1 refers to a real-time interactive audio application developed based on two types of real-time audio and video frameworks: WebRTC_SDK and Agora_SDK.

3. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, In step 1, the traffic characteristics corresponding to the application behavior are flow-level characteristics and packet-level characteristics. Flow-level characteristics include the number of flows, flow duration, flow generation interval, flow generation order, flow transmission resources, and flow rate. Packet-level characteristics include packet rate, number of uplink packets, number of downlink packets, ratio of uplink to downlink packets, mean inter-packet delay, standard deviation of inter-packet delay, and percentage of MSS packets.

4. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, Step 1 analyzes the correspondence between raw real-time interactive audio traffic and application behavior, and the obtained traffic characteristics are the raw traffic characteristics under unencrypted proxy scenarios.

5. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, The load information mentioned in step 2 is TCP load information, which includes all information such as application layer protocol fields and application layer load.

6. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, In step 2, when representing the data packet, the complete payload information is not used. Instead, the first 100 bytes of the TCP payload data are extracted for representation, and zeros are added if necessary.

7. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, In step 2, N is 500.

8. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, In step 3, when performing binary hierarchical representation, if the data packet does not have a corresponding IP or TCP header field, the corresponding binary bits are all represented as -1; otherwise, they are all represented as 0 or 1.

9. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, Step 3, when performing traffic characterization, requires obfuscating the IP address and port number information contained in the protocol header field, setting the corresponding binary position to -1.

10. The method for identifying real-time interactive audio application traffic on a mobile platform in an encrypted tunnel according to claim 1, characterized in that, The real-time interactive audio application behaviors described in steps 1 and 7 include creating interactive audio live streams, destroying interactive audio live streams, joining interactive audio live streams, leaving interactive audio live streams, conducting audio interactive discussions, and changes in audio interactive members.

Images