A website fingerprinting defense method based on flow pre-domain confrontation confusion

Abstract

The application discloses a website fingerprint defense method based on flow pre-domain confrontation confusion. The method is used for network traffic generated by network users, fills virtual data packets in the network flow pre-domain based on the confrontation learning method, generates network flow confrontation samples, confuses network flow mode information, and successfully resists website fingerprint attacks based on deep neural networks. First, the non-sensitive website access flow of the network user is collected as a target flow set, then a certain non-sensitive flow in the target flow set is randomly selected, and virtual data packets are filled in the flow pre-domain based on the confrontation learning technology for sensitive flow, so that the sensitive flow and the non-sensitive flow cannot be distinguished by the discriminator, the sensitive flow mode tends to the non-sensitive flow, and the deep website fingerprint attack classifier is confused. The application can realize intelligent confusion of website flow, and solves the privacy protection problem of webpage access in an anonymous network.

Description

TECHNICAL FIELD

[0001] The application relates to network security technology, in particular to a website fingerprint defense method based on traffic pre-domain adversarial confusion. BACKGROUND

[0002] With the growth of Internet usage, network privacy protection has become a common demand of Internet users. The anonymous network Tor based on onion routing has become one of the most popular Internet privacy enhancement technologies. However, the Tor network is vulnerable to website fingerprint attacks. Website fingerprint attack is a traffic analysis attack, which can make a local passive eavesdropper know the website that an anonymous user is accessing, and poses a great threat to the privacy and security of network users. In the perspective of machine learning, website fingerprint attack can be modeled as a classification problem, and attackers, such as user Internet service providers and local system administrators, can classify different websites by using the differences in website traffic features accessed by users. Attackers extract feature information (such as packet size and packet sending time) of traffic, and identify the website to which the traffic belongs. Therefore, the performance of website fingerprint attack depends largely on the classifier algorithm and the extracted data features.

[0003] In order to cope with the threat of website fingerprint attack, many website fingerprint defense schemes have been proposed, which can mask or confuse the features of a sensitive traffic by filling virtual data packets. However, these defense methods only consider global traffic sequence statistical information, and lack personalized filling design for specific protected traffic. Therefore, the current proposed website fingerprint defense schemes have deficiencies in defense performance and pertinence. SUMMARY

[0004] The application aims to solve the deficiencies of the current proposed website fingerprint defense schemes in defense performance and pertinence. The method fills virtual data packets in the network traffic pre-domain based on the adversarial learning method, generates network traffic adversarial samples, confuses network traffic pattern information, successfully resists website fingerprint attacks based on deep neural networks, and protects the privacy and security of anonymous traffic users. The application provides a website fingerprint defense method based on traffic pre-domain adversarial confusion.

[0005] Technical scheme: The website fingerprint defense method based on traffic pre-domain adversarial confusion mainly fills virtual data packets in any network traffic w s based on the adversarial training method to make w s an adversarial sample w d that can resist website fingerprint attacks. The specific steps include the following steps:

[0006] Step (1), training a website fingerprint classifier

[0007] First, collect network traffic: use a packet capture tool to collect access traffic, convert the captured network traffic into a usable format, and label each network traffic with the corresponding website;

[0008] Then, extract the packet direction features in the network traffic: part of the data packets in the network traffic are sent by the client, and the other part is sent by the server. The sending direction of the data packets from the two senders is extracted;

[0009] Next, convert the obtained packet direction features into burst form, where the burst refers to a sequence of consecutive data packets in the same direction, and the data packet sending direction information in burst form consists of the number of data packets contained in each burst;

[0010] Finally, train the website fingerprint classifier using the website traffic burst data: the loss function of the website fingerprint classifier is the cross-entropy function to achieve high accuracy;

[0011] Step (2), select the target traffic trajectory

[0012] Access non-sensitive websites, extract a certain amount of network traffic from the collected non-sensitive network traffic data set, extract the direction information of the data packets in the network traffic, and construct a random traffic pool. Select a network trajectory with similar direction information distribution as the original trajectory from the random traffic pool as the target trajectory w t ;

[0013] Step (3), limit the filling range

[0014] According to the actual deployment requirements, determine the network traffic pre-domain information enrichment area, and divide the filling range of the virtual data packet. Here, the filling range is limited to the pre-domain information enrichment area. The pre-domain of the traffic contains more feature information, so the interference of the data packet filling to the website fingerprint attacker will be more effective, and at the same time, the total amount of filled data packets will be reduced, reducing the bandwidth consumption generated by the website fingerprint defense deployment;

[0015] Step (4), fill data packets

[0016] Fill part of the virtual data packets in the original trajectory w s , the virtual data packets are composed of useless data, so that the bursts contained in the original trajectory tend to the target trajectory w t , the pre-domain features of the target trajectory are matched with the original trajectory to become a new original trajectory w s ;

[0017] Step (5), judge the performance of the filled trajectory

[0018] The probability of prediction error of the website fingerprint classifier is compared with a threshold to determine whether the filling is successful, and the specific content is: judging whether the filling in step (3) is effective to interfere with the website fingerprint classifier based on the deep network trained in step (1), if the interference is unsuccessful, returning to step (3), if the interference is successful, outputting the trajectory w of defense success d , and ending the process.

[0019] Further, in step (1), a packet capture tool is used to collect network access traffic, the captured network traffic is converted into a usable format, and each network traffic is labeled with the corresponding website; network traffic bursts are used as training data to train a deep learning network as a website fingerprint classifier for subsequent use; the website fingerprint classifier is composed of an input layer, a convolutional layer, a fully connected layer and a Softmax layer, the input layer obtains website fingerprint information, the convolutional layer extracts and filters the website fingerprint information, the fully connected layer classifies the extracted website fingerprint features, and the Softmax layer outputs the classification result, and the classifier loss function is cross-entropy function, that is:

[0020]

[0021] Where p is the true probability distribution of website fingerprint classification, q is the probability distribution predicted by the website fingerprint classifier; x i is the i-th in the website fingerprint category.

[0022] Further, the specific process of step (2) is:

[0023] A certain amount of network traffic trajectories are extracted from a non-sensitive network traffic data set, the direction information in the network traffic data packet is extracted, and the burst information in the network traffic forms a random traffic pool;

[0024] The distance between the network traffic burst in the random traffic pool and the original trajectory is calculated in sequence, which is used as a basis for measuring the degree of similarity of the distribution information; a network trajectory with similar direction information distribution as the original trajectory is selected from the random traffic pool as the target trajectory w t ;

[0025] The original trajectory is denoted as w s ={s1, s2,..., sn} n , the target trajectory is denoted as w t ={t1, t2,..., tn} n , where s and t are single bursts of the two flows respectively, n is the number of bursts, and the distribution distance between the flows is composed of two items:

[0026]

[0027]

[0028] d(w s , w t ) is the Manhattan distance between the flows, l(w s , w t ) is the kl divergence of the original trajectory and the target trajectory through the website fingerprint classifier, where p is the real probability distribution of the website fingerprint classification, and q is the probability distribution predicted by the website fingerprint classifier; x i is the i-th in the website fingerprint category;

[0029] D = γd(w s , w t ) + (1-γ)l(w s , w t )

[0030] The flow distance D is composed of two types of distances multiplied by the corresponding coefficients γ.

[0031] Further, the specific process of filling the data packet in step (4) is:

[0032] Calculate the burst difference between the original trajectory w s and the target trajectory w t , if the burst difference is negative, fill a certain amount of data packet for the current burst; if the difference is positive, do not fill the operation;

[0033]

[0034] Where t i is the i-th burst of the target trajectory, s i is the i-th burst of the original trajectory; d(t i , s i ) represents the Manhattan distance between the two bursts;

[0035] The single burst filling amount calculation formula is:

[0036]

[0037] If the single burst of the target trajectory is greater than that of the original trajectory, gradually fill according to the Manhattan distance of the two until the website fingerprint classifier cannot distinguish.

[0038] Beneficial effects: The present application aims at the problem that the existing website fingerprint defense only considers global traffic sequence statistical information, lacks personalized filling design for specific protected traffic, and combines the adversarial sample generation technology and the traffic pre-domain filling scheme to select a target trajectory in the random traffic pool according to the traffic sequence distribution distance, mask the original traffic characteristics by bidirectional filling of virtual data packets, confuse the classifier of the website fingerprint attacker, and effectively protect the privacy security of the anonymous traffic user. The present application uses the adversarial sample generation technology to intentionally add subtle interference in the data set to cause misclassification of the deep website fingerprint attack and enhance the interference performance of the filling scheme. The virtual data packet filling is only performed on the first few seconds of the traffic, that is, the traffic pre-domain, so as to avoid the large bandwidth consumption caused by filling the whole length of the traffic and enhance the deployability. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is the overall flowchart of the present application;

[0040] Figure 2 is the data packet filling flowchart in the present application. DETAILED DESCRIPTION

[0041] The technical scheme of the present application will be described in detail below, but the protection scope of the present application is not limited to the described embodiments.

[0042] The present application combines the adversarial sample generation technology and the pre-domain traffic filling method to confuse the website fingerprint traffic characteristics of the user. First, the traffic is captured for the classifier training set and the target traffic set, and then a website fingerprint classifier with a certain classification accuracy is trained. When a network traffic needs to be protected, a target trajectory with similar distribution to the protected traffic is selected in the previously collected target traffic set, and multiple data packet fillings are performed within the limited traffic pre-domain filling range until the classifier cannot accurately classify the category of the protected traffic. The present application can mask the original traffic characteristics by bidirectional filling of virtual data packets, confuse the classifier of the website fingerprint attacker, and protect the privacy security of the anonymous traffic user.

[0043] The present application realizes effective traffic filling by the following technical features, and further confuses the classifier of the website fingerprint attacker:

[0044] 1. The present application limits the data packet filling range to the traffic pre-domain, so that the filling bandwidth consumption is effectively reduced, and the deployability of the scheme is increased.

[0045] 2. The present application uses the adversarial sample generation technology to formulate an effective filling scheme and improve the defense performance.

[0046] As shown in FIG. 1, the present application is a website fingerprint defense method based on pre-domain adversarial confusion, which includes the following steps:

[0047] Step (1), training website fingerprint classifier

[0048] Collect network traffic, extract packet direction features in network traffic, and then convert the obtained packet direction features into burst form, where the burst refers to a sequence of continuous packets in the same direction, and the packet sending direction information in burst form is composed of the number of packets contained in each burst;

[0049] Then, the website traffic burst data is used to train the website fingerprint classifier: the loss function of the website fingerprint classifier is the cross-entropy function Loss;

[0050]

[0051] Where p is the real probability distribution of website fingerprint classification, q is the probability distribution predicted by the website fingerprint classifier; x i is the i-th in the website fingerprint category;

[0052] Step (2), selecting a target traffic track

[0053] Access non-sensitive websites, extract a certain amount of network traffic from the collected non-sensitive network traffic data set, extract the direction information of the packets in the network traffic, and form a random traffic pool; select a network track with similar direction information distribution as the original track from the random traffic pool as the target track w t ;

[0054] The original track is denoted as w s ={s1, s2,..., s n}, and the target track is denoted as w t ={t1, t2,..., t n}, where s and t are single bursts of the two flows, respectively, and the distribution distance between the flows is composed of two items:

[0055]

[0056]

[0057] d(w s , w t ) is the Manhattan distance between the flows, l(w s , w t ) is the kl divergence of the original track and the target track through the website fingerprint classifier, where p is the real probability distribution of website fingerprint classification, q is the probability distribution predicted by the website fingerprint classifier; x i is the i-th in the website fingerprint category;

[0058] D=γd(w s , w t) + (1 - γ)l(w s , w t )

[0059] The distance D between the flows is composed of two types of distances multiplied by the corresponding coefficient γ.

[0060] Step (3), defining the filling range

[0061] According to the actual deployment requirements, the network flow pre-domain information enrichment area is determined, and the filling range of the virtual data packet is divided.

[0062] Step (4), filling the data packet

[0063] Part of the virtual data packet is filled in the original trajectory w s , and the virtual data packet is composed of useless data, so that the burst contained in the original trajectory w s tends to the target trajectory w t , and the pre-domain feature of the target trajectory is fitted with the original trajectory to become a new original trajectory w s .

[0064] The burst difference between the original trajectory w s and the target trajectory w t is calculated, if the burst difference is negative, a certain amount of data packet is filled for the current burst; if the difference is positive, no filling operation is performed.

[0065]

[0066] Where t i is the i-th burst of the target trajectory, s i is the i-th burst of the original trajectory, and d(t i , s i ) represents the Manhattan distance between the two bursts.

[0067] The single burst filling amount calculation formula is:

[0068]

[0069] If the single burst of the target trajectory is greater than that of the original trajectory, then gradually fill according to the Manhattan distance of the two until the website fingerprint classifier cannot distinguish.

[0070] Step (5), judging the performance of the filled trajectory

[0071] Whether the filling in step (3) effectively interferes with the website fingerprint classifier based on deep network trained in step (1) is judged, if the interference is unsuccessful, it returns to step (3), if the interference is successful, the output is the defense successful trajectory w d , and the process is ended.

[0072] Embodiment

[0073] The other steps of the embodiment are the same as above, but the virtual data packet filling algorithm is as shown in Figure 2 , and is specifically as follows:

[0074] Algorithm 1 Virtual data packet filling algorithm

[0075] Input: initial traffic sequence w s , target traffic burst form sample set T = {item1, item2, …, item n}, random traffic pool size N, website fingerprint classifier M.

[0076] Output: defense traffic sequence w s ′.

[0077] 1) Select N traffic samples from the target traffic sample pool T to form a random traffic pool T r ;

[0078] 2) Convert the initial traffic sequence w s to burst form w b ;

[0079] 3) Create an empty traffic sequence w m , and the distance of the traffic sequence from the original traffic w m ;

[0080] 4) d m = 0;

[0081] 5) for item i in T r do / *traverse the random traffic pool* /

[0082] 6) Calculate the distance d of item i and w b ;

[0083] 7) If d > d m

[0084] 8) w m = item i ; / *get the sample with the largest distance from w b in the random traffic pool* /

[0085] 9) end if

[0086] 10) end for

[0087] 11) while M correctly classifies w b do

[0088] 12) to the original trajectory wb Add part of the target trajectory w m feature;

[0089] 13) end while

[0090] 14) Using w m Obscuring w b Part of the outbreak, obtaining a new sequence w b ′;

[0091] 15) w b Convert ' to cell form w s and output;

[0092] Explanation of the above virtual packet stuffing algorithm

[0093] Suppose there is a group of sites that need protection, and each site has a traffic instance w. s The defense method needs to address w s Padded data packets to form a defended traffic sequence w s ′.

[0094] w s It is a sequence composed of data packet direction characteristics. Data packets can be considered to have two directions: outgoing direction, which refers to the direction in which the client sends data packets to the server, and incoming direction, which refers to the direction in which the server sends data packets to the client. Representing the outgoing direction as +1 and the incoming direction as -1, we can... s It is represented as an array consisting of +1 and -1. s It can be converted into a burst form, i.e., w s ={b1, b2, ..., b n}, where n is the burst number. b i It is the length of the i-th burst.

[0095] To give w s Adding perturbation requires selecting a certain number of traffic instances from a pre-collected traffic set to form a random traffic pool. The traffic in the pool is also bursty, and this can be achieved by calculating the ratio of the traffic in the pool to the initial traffic w. s The distance is used to select the flow sequence with the largest distance. m The distance calculation formula is:

[0096] Let the original trajectory be w. s ={s1, s2, ..., s n Let w be the target trajectory. t ={t1, t2, ..., t n}, where s and t are individual bursts of two flows, and the distribution distance between the flows consists of two items:

[0097]

[0098]

[0099] d(w s w t ) represents the Manhattan distance between flows; l(w) s w t Let be the k-L divergence between the original trajectory and the target trajectory through the website fingerprint classifier, where p is the true probability distribution of the website fingerprint classification, and q is the probability distribution predicted by the website fingerprint classifier; x i It is the i-th fingerprint in the website fingerprint category;

[0100] D=γd(w s w t )+(1-γ)l(w s w t )

[0101] The distance D between flows is composed of two types of distances multiplied by the corresponding coefficient γ.

[0102] At the same time with w m A sudden occlusion of part of w s The sudden occurrence of the burst interferes with the attacker's classifier. The burst difference between the original trajectory and the target trajectory is calculated. If the burst difference is negative, a certain amount of data packets are added to the current burst; if the difference is positive, no padding is performed.

[0103]

[0104] Among them, t i For the i-th burst of the target trajectory, s i d(t) represents the i-th burst of the original trajectory. i s i () represents the Manhattan distance between two incidents.

[0105] The formula for calculating the single burst filling volume is:

[0106]

[0107] If a single burst in the target trajectory is larger than a single burst in the original trajectory, the fingerprint is gradually filled in based on the Manhattan distance between the two until the website fingerprint classifier can no longer distinguish them.

[0108] In the detailed feature injection process, w s Each of the sudden events in the sudden event format will be related to w m Matching bursts in the data, if it can be made possible by padding the data packets, w s The single burst feature is close to w mIf yes, fill the partial data packet; if no, skip and continue matching the next burst.

[0109] The above embodiments show that the application interferes with the classifier of the website fingerprint attacker by filling a small amount of virtual data packets in the network traffic, and avoids the risk of leakage of user communication information. On this basis, the application uses an adversarial sample generation technology to enhance the interference performance of the filling scheme; uses a pre-domain filling technology to reduce the bandwidth overhead caused by the deployment of the defense and enhance the deployability. The application enhances the pertinence of the defense technology, realizes the personalized protection of the traffic, realizes the balance between the protection performance and the bandwidth consumption, and solves the privacy protection problem of the anonymous network user.

Claims

1. A method for website fingerprint defense based on traffic pre-domain adversarial confusion, characterized in that: The method comprises the following steps: Step (1), training a website fingerprint classifier Collect network traffic, extract packet direction features in network traffic, and then convert the obtained packet direction features into burst form, where the burst refers to a sequence of continuous packets in the same direction, and the packet sending direction information in burst form is composed of packet directions contained in each burst; Next, train the website fingerprint classifier using website traffic burst data: the loss function of the website fingerprint classifier is the cross-entropy function; Step (2), selecting a target traffic track Access a non-sensitive website, extract a certain amount of network traffic from the collected non-sensitive network traffic data set, extract the direction information of the network traffic data packets, and form a random traffic pool; In the random traffic pool, a network trajectory similar to the original trajectory direction information distribution is selected as the target trajectory w t ; Step (3), limiting the filling range According to the actual deployment requirements, determine the network traffic front domain information enrichment area, and divide the filling range of the virtual data packet; Step (4), filling data packets In the original trajectory w s fill part of the virtual data packets, virtual data packets are composed of useless data, so that the original trajectory w s contains the burst tends to target trajectory w t , the front domain characteristics of the target trajectory and the original trajectory are fitted to become a new original trajectory w s ; Step (5), judging the performance of the filled track The judgment step (3) whether the filling is effective to interfere with the website fingerprint classifier based on deep network trained in step (1), if the interference is unsuccessful, return to step (3), if the interference is successful, output the trajectory w as the defense success d , and end the process.

2. The method of claim 1, wherein the method is characterized by: In step (1), the network access traffic is collected using a packet capture tool, the captured network traffic is converted into a usable format, and each network traffic is labeled with the corresponding website; network traffic bursts are used as training data to train a deep learning network as a website fingerprint classifier for subsequent use; the loss function of the website fingerprint classifier is the cross-entropy function, that is: where p is the true probability distribution of the website fingerprint category, q is the predicted probability distribution of the website fingerprint classifier; x i is the i-th website fingerprint category.

3. The method of claim 1, wherein the method is characterized by: The specific process of step (2) is: Extract a certain amount of network traffic track from the non-sensitive network traffic data set, extract the direction information of the network traffic data packets, and form a random traffic pool with the burst information in the network traffic. The distance between the network traffic burst in the random traffic pool and the original trajectory is calculated in sequence, which is used as the basis for measuring the degree of similarity of the distribution information; a network trajectory with similar direction information distribution as the original trajectory is selected from the random traffic pool as the target trajectory w t ; The original trajectory is denoted as w s = {s1, s2, …, s n}, and the target trajectory is denoted as w t = {t1, t2, …, t n}, where s and t are single bursts of the two flows, respectively, and the distribution distance between the two flows is composed of two items: d(w s ,w t ) is the Manhattan distance between flows, l(w s ,w t ) is the kl divergence of the original trajectory and the target trajectory through the website fingerprint classifier, where p is the true probability distribution of the website fingerprint classification, q is the probability distribution predicted by the website fingerprint classifier; x i is the i-th in the website fingerprint category; D = γd(w s ,w t ) + (1 - γ)l(w s ,w t ) The distance D between the flows is composed of two types of distances multiplied by the corresponding coefficient γ.

4. The method of claim 1, wherein the method further comprises: The specific process of filling data packets in step (4) is: Calculate the original trajectory w s The burst difference between the target trajectory w t If the burst difference is negative, fill a certain amount of data packets for the current burst; if the difference is positive, do not fill the operation; where t i is the i-th burst of the target trajectory, s i is the i-th burst of the original trajectory; d(t i ,s i ) represents the Manhattan distance between the two bursts. The single burst filling amount calculation formula is: If the single burst of the target track is greater than that of the original track, gradually fill according to the Manhattan distance of the two until the website fingerprint classifier cannot distinguish.

Images