A method and system for anti-evasion of tor app traffic analysis

Abstract

The application discloses an anti-characteristic-unstable Tor App traffic analysis method and system, first extracts basic characteristics and bidirectional statistics of traffic generated by a mobile phone App running on Tor as a candidate characteristic set, then selects a subset from the candidate characteristic set as the representation of the traffic, filters out the traffic of N specific application types by solving an application type combination optimization problem, selects N characteristic subsets from the candidate characteristic set, and iteratively selects a machine learning model and a characteristic set suitable for the specific application type by solving an optimal combination problem, so that the Tor App can be accurately identified. The application solves the problem of characteristic instability in Tor App traffic analysis caused by the instability of the mobile environment, the diversity of app work content and the increasing number of new apps running on Tor.

Description

TECHNICAL FIELD

[0001] The present application relates to network security technology, in particular to a Tor App traffic analysis method and system resistant to feature instability. BACKGROUND

[0002] Tor is designed to protect the privacy and security of users when accessing the network, and is one of the most popular anonymous communication systems. Tor can prevent eavesdroppers from associating users and their communication objects, and hide the real identity of the user. However, this feature has also been used by criminals to carry out network criminal activities. Tor traffic analysis is an important means to combat network criminal activities.

[0003] In recent years, some researchers have done a lot of work on traffic analysis in Tor anonymous networks. The research work is mainly based on traditional machine learning and deep learning-based PC platform website fingerprinting attacks, and Tor traffic analysis on mobile platforms. However, the development of mobile networks and the explosive growth of smartphones have changed the characteristics of network traffic, and this change in the mobile platform environment has brought greater challenges to Tor traffic analysis work. First, due to mobility, the originally relatively stable time and other characteristics will appear unstable in the mobile platform, such as unavailable or short effective time.

[0004] Second, the same app has different work content, for example, WeChat can send messages, voice and video calls. This will make the same app show different traffic patterns, making the selected fixed features not representative, resulting in incorrect analysis results.

[0005] Third, more apps rely on Tor to run, making it easy for carefully designed artificial features to fail, resulting in poor analysis results. These changes in the mobile network environment have led to the problem of feature instability in Tor traffic analysis.

[0006] Current Tor traffic analysis work on mobile platforms mainly uses fixed features and models extracted by artificial extraction, which cannot capture the problem of feature instability, resulting in low recognition accuracy; at the same time, feature instability requires the existing method to retrain the entire model, which is costly; the deep learning-based Tor traffic analysis method requires a large number of labeled data sets, which is time-consuming and needs to be updated frequently, which is not realistic for the general attacker.

[0007] Therefore, a Tor app traffic analysis method resistant to feature instability is needed. SUMMARY

[0008] The application aims to provide a Tor app traffic analysis method and system capable of solving the instability of dynamic network environment.

[0009] The application provides a Tor app traffic analysis method, which comprises the following steps:

[0010] Step (1), obtaining network traffic generated by a target application in a Tor network to form a target traffic set, saving the target traffic in a five-tuple format, extracting basic features of each target traffic, and uniformly designing common features including the number of entrance packets and the number of exit packets according to expert knowledge; extracting basic features including packet size and bidirectional statistics as a candidate feature set by using a candidate feature selection strategy; saving the Tor traffic data set in a traffic data set with 98 candidate features as a representation by using a data processing algorithm, and processing the Tor target traffic data set by using a source data set processing algorithm;

[0011] Step (2), selecting a subset from the candidate feature set obtained in step (1) as a representation of the traffic by using a confusion feature separation layer, taking the processed data as an analysis object, filtering out N kinds of traffic of specific application types by solving an application type combination optimization problem;

[0012] Step (3), selecting N subsets from the candidate feature set obtained in step (1) by using an optimal feature and model combination layer, receiving the traffic of specific application types from step (2), and iteratively selecting a machine learning model and a feature set suitable for the application type by solving a feature and model combination optimization problem to obtain an optimal classifier of the specific application type;

[0013] Step (4), using the optimal classifier of the specific application type obtained in step (3) to identify the Tor app traffic, obtaining the identification result of the app, and realizing the traffic analysis of the Tor app.

[0014] Further, the specific process of step (1) is as follows:

[0015] Firstly, the target traffic in the target traffic set is saved in a five-tuple specific format: <time, source IP, destination IP, communication protocol, packet length>;

[0016] Then, the target traffic is extracted to obtain common features, which include packet size, direction, time, number of basic features, and statistical features obtained from multiple dimensions of the basic features;

[0017] Then, a set of common machine learning models is established, a model is selected from the model set, and the information gain technique is used to evaluate the features that contribute more under the model, and the step is repeated until all models in the model set are selected.

[0018] Finally, for the features selected according to the information gain technique, the repeated features and the features that have side effects on other models are removed, and the representative and diverse features are obtained as the candidate feature set.

[0019] Further, in the above process, 5511 common features are extracted from the target traffic using expert knowledge, including basic features such as packet size, direction, time, and number, and statistical features obtained from multiple dimensions of basic features; then, a set of common traditional machine learning models is established, and the traditional machine learning model set includes J48, Bayes (NB), K-NearestNeighbor (KNN), etc., a model is selected from the model set, and the information gain technique is used to evaluate the top 70 features that contribute most under the model, and the step is repeated until all models in the model set are selected. The top 70 features that contribute most are removed, that is, after selecting the feature, the information gain is reduced, and 98 representative and diverse features are obtained as the candidate feature set.

[0020] Further, the specific process of step (2) is as follows:

[0021] First, to separate the same type of applications with large cross in feature values, the confusion feature separation layer selects a subset from the candidate feature set as the representation of the traffic;

[0022] Then, a type similarity measurement standard is proposed to measure the possibility that a traffic F is generated from an application of type T:

[0023] The type similarity of F and T is calculated by S(F,T)=Pr(F∈T|F);

[0024] To calculate the type similarity of F, N type filters are constructed, denoted as FIL={fil1,fil2,...fil i ,...fil N}, each filter is directed to an application type, so that the filter fil i only filters out the application traffic of type T i , and excludes the traffic of other types;

[0025] The application type combination optimization problem is described as follows:

[0026]

[0027] st.ST i+ (F,T)∈(0,1),

[0028] ST i- (F,T)∈(0,1),

[0029] Z j ·ST i+ (F j ,T)≥S min ,

[0030] Z j ∈{0,1}

[0031] where Z j is a binary variable indicating whether the jth Tor flow belongs to type T i , N is the number of application types; S min is the minimum value of type similarity, and a filter fil i is considered valid only if it gives a type similarity higher than S i to flows F j belonging to T min ; ST i+ (F,T) is the similarity of a given Tor flow F to type T i given by filter fil i ; ST i- (F,T) is the type similarity given by other filters to non-type T i ;

[0032] In the application type combination optimization problem, a Tor flow only belongs to one type, and by solving the application type combination optimization problem, the expected filter fil i gives the value of the type similarity of the Tor flow belonging to type T i to T i as high as possible, and other filters as low as possible, so that the optimal feature and model combination layer can filter out the application flow only belonging to Ti, so that it no longer analyzes the flow of other application types.

[0033] Further, the specific process of step (3) is as follows:

[0034] The optimal feature and model combination layer receives the type flow T i filtered out from the easily confused feature separation layer, and constructs the most suitable classifier C i for the type flow; the classifier C iThe construction defines a feature and learning model combination optimization problem, and a traditional machine learning model set M = {M1, M2,..., M i ,...M H} is constructed, including K-NearestNeighbor (KNN), Bayes (NB) and other models; the FS i and M i represent the selected feature set and traditional machine learning model of the classifier C i respectively, the FS i is initialized with a candidate feature set, and the M i is selected from the constructed model set, so the feature and model combination optimization problem can be represented as:

[0035]

[0036] Wherein, M i (·) represents a classifier constructed with a model M i ;

[0037] To speed up the construction of the classifier C i , after determining a model, the information gain evaluation technology is used to sort the features in the FS i , and the information gain evaluation of each feature is iteratively performed and the last N irrelevant features, that is, the features with negative information gain, are removed until the information gain value no longer changes.

[0038] Further, the specific process of the step (4) is as follows:

[0039] (4.1) Training Tor app traffic analysis model: the server obtains a different target application Tor traffic dataset 1, saves the Tor traffic dataset 1 into a specific five-tuple format through the method in step (1), assigns a corresponding app label, extracts a candidate feature set, forms a Tor traffic dataset 2 represented by the labeled candidate feature set, inputs the Tor traffic set 2 into the confusion feature separation layer in step (2), trains to obtain N filters, and separates into N specific application type flows; input the N specific application type Tor flows into the optimal feature and model combination layer in step (3), and train the most suitable classifier C i for each application type.

[0040] (4.2) Tor flow application type identification: input the 98 candidate feature sets represented by the to-be-identified flow deep features to-be-identified Tor app flow set obtained in step (1) into the trained filter and classifier in steps (2) and (3), identify the app result of the Tor flow, and realize the Tor app flow analysis.

[0041] The application also discloses a system for anti-feature-unstable Tor App traffic analysis method, comprising a target traffic candidate feature extraction module, an obfuscated feature separation layer module, an optimal feature and model combination module and a Tor app traffic recognition module.

[0042] The candidate feature extraction module extracts common packet size and other basic features and statistical features of multiple dimensions of the basic features from the target traffic by using expert knowledge, obtains 98 final features including entry packet quantity as candidate features through information gain technology, and obtains a candidate feature set.

[0043] The obfuscated feature separation layer module separates Tor app traffic with large cross feature values, filters out N types of traffic of specific application types by solving a type combination optimization problem.

[0044] The optimal feature and model combination module receives the specific application type traffic filtered out by the obfuscated feature separation layer, solves a feature and model combination optimization problem for the specific application type traffic, and obtains an optimal classifier of the specific application type.

[0045] The Tor app traffic recognition module recognizes the Tor app traffic by using the trained optimal classifier of the specific application type, obtains an app classification result of the traffic, and realizes Tor app traffic analysis.

[0046] The application also discloses a computer storage medium, which stores a program suitable for the anti-feature-unstable Tor App traffic analysis method.

[0047] Advantages: The application proposes an anti-feature-unstable Tor app traffic analysis method aiming at the instability of a network environment, the diversity of app work content and the increasing Tor app running on Tor, solves the problem of feature instability in Tor app traffic analysis, extracts 5511 features including packet size and other basic features and bidirectional statistics by using expert knowledge, designs a candidate feature extraction strategy to extract 98 representative and diverse features to solve the vulnerability of specific features, selects a feature subset from the candidate feature set as traffic representation by the obfuscated feature separation layer, inputs the same app traffic with large cross feature values into N filters, separates the traffic into N types of traffic, and facilitates subsequent app classification, and receives N types of traffic by the optimal feature and model combination layer, designs a classifier for the traffic, and realizes high-accuracy Tor app classification. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1This is a schematic diagram of the overall process of the present invention;

[0049] Figure 2 This is a schematic diagram of a system according to an embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of the process of training a Tor app traffic analysis model in one embodiment of the present invention;

[0051] Figure 4 This is a schematic diagram of the process for analyzing traffic from an unknown Tor app in one embodiment of the present invention;

[0052] Figure 5 This is an experimental effect diagram from one embodiment of the present invention;

[0053] Figure 6 This is a schematic diagram of the confusion matrix result in one embodiment of the present invention. Detailed Implementation

[0054] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0055] This invention discloses a Tor app traffic analysis system resistant to feature instability. It employs a confounding feature separation layer and an optimal feature and model combination layer to achieve a Tor app traffic analysis method resistant to feature instability. First, the Tor traffic dataset of the target application is obtained and saved in a specific format. Using expert knowledge, 5511 features, including basic features such as packet size and bidirectional statistics, are extracted. A candidate feature extraction strategy is designed to extract 98 representative and diverse features to address the vulnerability of specific features. The Tor traffic dataset is then processed using a data processing algorithm to save traffic data represented by these 98 candidate features. The confounding feature separation layer uses the processed data as the analysis object and selects a subset of features from the candidate feature set as the true traffic representation. Traffic from similar apps with significant overlap in feature values ​​is input into N filters and separated into N types of traffic for subsequent app classification. The optimal feature and model combination layer receives the N types of traffic and designs a classifier for them to achieve high-accuracy Tor app classification.

[0056] Example 1

[0057] like Figure 1 As shown, the Tor App traffic analysis method against feature instability in this embodiment includes the following steps:

[0058] Step (1), obtaining the network traffic generated by the target application under the Tor network to form a target traffic set, and saving the target traffic in a five-tuple format, extracting the basic features and commonly used features of each target traffic; then using a candidate feature selection strategy to extract a candidate feature set from the basic features and commonly used features, and using a data processing algorithm to process the data of the target traffic set into traffic data characterized by 98 candidate features. Specifically as follows:

[0059] First, save the target traffic into a specific format, containing five-tuple information of time, source IP, destination IP, communication protocol and packet length. Then extract 5511 features from the target traffic using expert knowledge, including basic features such as packet size, direction, time, and number, and statistical features obtained from multiple dimensions of basic features. The feature extraction method in this embodiment combines commonly used feature extraction methods, such as maximum feature extraction method (extracting the maximum value of packet size and packet duration), minimum feature extraction method (extracting the minimum value of packet size and packet duration), etc. A total of 5511 features are obtained;

[0060] Next, a set of commonly used traditional machine learning models is established, including models such as J48, Bayes (NB), K-Nearest Neighbor (KNN). From the model set, select a model and use information gain technology to evaluate the top 70 features that contribute the most under the model; repeat this step until all models in the set have selected the top 70 features that contribute the most;

[0061] Finally, among all the features obtained, remove the repeated features and the features that have side effects on other models, that is, after selecting the feature, the information gain decreases, and 98 representative and diverse features are obtained as a candidate feature set.

[0062] The original data set processing algorithm is used to save the Tor traffic data set into traffic data characterized by 98 candidate features. The specific 98 features are shown in the following table.

[0063]

[0064] The detailed process of the original data set processing algorithm is as follows:

[0065]

[0066] Step (2), select a subset from the candidate feature set obtained in step (1) as the representation of the traffic through the confusion feature separation layer, and solve the application type combination optimization problem. The same app traffic with a lot of cross in the feature value is input into N filters, and N specific application type traffic is filtered out. Specifically as follows:

[0067] First, a subset of the candidate feature set is selected as the representation of the traffic by the obfuscated feature separation layer, and then a type similarity measure is proposed to measure the likelihood that a traffic F is generated by an application belonging to type T. The type similarity of F to T is calculated by S(F,T) = Pr(F e T | F) in this embodiment;

[0068] To calculate the type similarity of F, N type filters are constructed, denoted as FIL = {fil1, fil2,...fil i ,...fil N}, each of which is directed to an application type; for a traffic F, ST i+ (F,T) represents the type similarity of F to type T given the filter fil i ; ST i (F,T) represents the type similarity of F to non-type T given the filter fil i- ; ST i (F,T) represents the type similarity of F to non-type T given the filter fil

[0069]

[0070] st.ST i+ (F,T) e (0,1),

[0071] ST i- (F,T) e (0,1),

[0072] Z j • ST i+ (F j ,T) > S min ,

[0073] Z j e {0,1}.

[0074] Step (3), select N subsets from the candidate feature set obtained in step (1) by the optimal feature and model combination layer, receive the traffic of a specific application type from step (2), and iteratively select a machine learning model and a feature set suitable for the application type by solving a feature and model combination optimization problem to obtain the optimal classifier for the specific application type, as follows:

[0075] The optimal feature and model combination layer receives the type traffic T i filtered by the obfuscated feature separation layer, and constructs the most suitable classifier C i for the type traffic. The construction of the classifier C i is defined as solving a feature and learning model combination optimization problem. A set of traditional machine learning models M = {M1, M2,... Mi ,...M H}, including K-Nearest Neighbor (KNN), Models such as Bayes (NB)

[0076] This embodiment uses FS i Mi and Mi represent classifier C, respectively. i The selected feature set and traditional machine learning model. FS i Initialize with candidate feature set, M i Choose from the constructed set of models. Therefore, this feature and model combination optimization problem can be expressed as:

[0077]

[0078] Among them, M i (·) indicates that model M i The constructed classifier. To accelerate classifier C... i After constructing and determining a model, information gain evaluation techniques are used to evaluate the FS. i The features in the data are sorted; the information gain of each feature is evaluated iteratively and the last N irrelevant features, that is, features with negative information gain, are removed until the information gain value no longer changes.

[0079] Step (4): Use the optimal classifier for the specific application type obtained in step (3) to identify the Tor app traffic, obtain the app identification results, and realize the traffic analysis of the Tor app.

[0080] Example 2:

[0081] like Figure 2 As shown, the Tor App traffic analysis system resistant to feature instability in this embodiment includes the following modules: target traffic candidate feature extraction module 100, obfuscated feature separation module 200, optimal feature and model combination module 300, and Tor app traffic identification module 400.

[0082] The candidate feature extraction module 100 will use expert knowledge to extract common basic features such as packet size and statistical features of multiple dimensions of basic features from the target traffic, and obtain the final 98 features including the number of ingress packets as candidate features through information gain technology.

[0083] The obfuscation feature separation module 200 separates Tor app traffic with large overlap in feature values ​​and filters out traffic of specific application types by solving the type combination optimization problem.

[0084] The optimal feature and model combination module 300 receives the application type specific traffic filtered by the confusion feature separation layer, solves the feature and model combination optimization problem, and obtains the optimal classifier for the specific application type;

[0085] The Tor app traffic recognition module 400 uses the classifier obtained by the above three modules to recognize the Tor app traffic, obtains the app classification result of the traffic, and realizes Tor app traffic analysis.

[0086] Embodiment 3:

[0087] In the above embodiments 1 and 2, as shown in Figure 3 , the process of training the Tor app traffic analysis model is as follows: the server obtains a different target application Tor traffic dataset 1, saves the Tor traffic dataset into a specific five-tuple format by the method described in S101, assigns a corresponding app label, extracts a candidate feature set, and forms a Tor traffic dataset 2 with labeled candidate features using a source dataset processing algorithm; input the Tor traffic set 2 into the confusion feature separation layer in S102, train N filters, and separate into N specific application type traffic; input the N specific application type Tor traffic into the optimal feature and model combination layer described in S103, and train the most suitable classifier C i for each application type.

[0088] Based on the above embodiments, as shown in Figure 4 , the unknown Tor app traffic recognition process is as follows: input the 98 candidate feature set represented by the to-be-recognized traffic deep feature to-be-recognized Tor app traffic set obtained by S101 into the trained filter and classifier in S102 and S103, recognize the app result of the Tor traffic, and realize Tor app traffic analysis.

[0089] The experimental results show that on the three mobile app datasets used for testing, the specific experimental results are as shown in Figure 5 : Mei is the current best Tor app traffic analysis method, MH 2 F is the technical solution of the present application. The three datasets are Mei, Peel collected by predecessors and the dataset He collected by the present application.

[0090] At the same time, in order to prove that the technical solution of the present application can effectively classify the same app and overcome the feature instability problem, the confusion matrix is used to evaluate the proposed scheme, and the specific results are as shown in Figure 6 .

[0091] Figure 6 (a)、 Figure 6 (b) and Figure 6(c) Confusion matrix results on the previously collected datasets Mei, Peel and the collected dataset He of the present application, respectively. For convenience, the actual app names are replaced by the letters a, b, c, etc. Figure 6 The darker the color, the more concentrated in the middle, the better the result.

[0092] As can be seen from the above examples, the technical scheme of the present application can achieve a high accuracy recognition rate, which is better than the best existing technical scheme.

Claims

1. A method for analyzing Tor App traffic that is resistant to fingerprinting, the method comprising: The method comprises the following steps: Step (1), obtaining network traffic generated by a target application in a Tor network to form a target traffic set, saving the target traffic in a five-tuple format, extracting basic features and common features of each target traffic, and using a candidate feature selection strategy to extract a candidate feature set from the basic features and common features; Step (2), selecting a subset from the candidate feature set obtained in step (1) as a representation of the traffic through an obfuscated feature separation layer, filtering out N specific application type traffics by solving an application type combination optimization problem; the specific process of step (2) is as follows: First, select a subset from the candidate feature set as a representation of the traffic; Then, a flow F is measured by a type similarity measure generated from the likelihood of belonging to a T-type application, here by computing the type similarity of the flow F with T; To compute the type similarity of the type , N different types of filters are constructed, denoted as , each filter is oriented to one application type; The application type combination optimization problem is described as follows: ； ； ； ； ； in, It is a binary variable representing whether the j-th Tor traffic belongs to type [type name missing]. N represents the number of application types; This represents the minimum value of type similarity, considered a filter. Only for those belonging to flow Given a type similarity higher than Valid for a period of time; Indicates filter Given Tor flow With type Similarity; Indicates the NAND type given by other filters. Type similarity; In the application type combination optimization problem, a Tor flow belongs to only one type. By solving the application type combination optimization problem, the desired filter is optimized. Give to the type Tor traffic and Use the highest possible type similarity value for the filters, and the lowest possible value for the other filters; Step (3), selecting N subsets from the candidate feature set obtained in step (1) through an optimal feature and model combination layer, receiving specific application type traffics from step (2), and iteratively selecting a machine learning model and a feature set suitable for the application type by solving a feature and model combination optimization problem to obtain an optimal classifier for the specific application type; Step (4), using the optimal classifier for the specific application type obtained in step (3) to identify Tor app traffic and obtain an app identification result, thereby achieving Tor app traffic analysis.

2. The anti-evasion Tor App traffic analysis method of claim 1, wherein: The specific process of step (1) is as follows: First, save the target traffic in the target traffic set in a five-tuple specific format: <time, source IP, destination IP, communication protocol, packet length>; Then, extract common features from the target traffic, including packet size, direction, time, number of basic features, and statistical features obtained from multiple dimensions of the basic features; Next, establish a common machine learning model set, select a model from the model set, and use information gain technology to evaluate the features that contribute most to the model, and repeat the step until all models in the model set have selected corresponding features; Finally, for the features selected according to the information gain technology, remove duplicate features and features that have side effects on other models, and obtain representative and diverse features as a candidate feature set.

3. The process of obtaining a candidate feature set according to claim 2, wherein: Using expert knowledge, 5511 common features are extracted from the target traffic; and using information gain technology, the top 70 features with the greatest contribution are selected, and the step is repeated until all models in the model set have selected the corresponding top 70 features; Finally, for the top 70 features with the greatest contribution, remove duplicate features and features that have side effects on other models, and obtain 98 representative and diverse features as a candidate feature set.

4. The anti-evasion Tor App traffic analysis method of claim 1, wherein: The specific process of step (3) is as follows: receiving the type of traffic filtered by the pre-receiving filter and building the most appropriate classifier for the type of traffic ; the building of the classifier is defined as a feature and learning model combination optimization problem, building a set of traditional machine learning models ; using and to represent the selected feature set and traditional machine learning model of the classifier , initialized with a candidate feature set, selected from the built model set, thus, this feature and model combination optimization problem can be represented as: ； wherein, represents a classifier constructed with a model representing a classifier constructed with a model To speed up the construction of the classifier , after a model is determined, information gain evaluation technique is used to sort the features in , iteratively perform information gain evaluation of each feature and remove the non-relevant features, that is, the features with negative information gain, until the information gain value no longer changes.

5. The anti-evasion Tor App traffic analysis method of claim 1, wherein: The specific process of step (4) is as follows: (4.1) Training a Tor app traffic analysis model The server obtains a different target application Tor traffic dataset 1, saves the Tor traffic dataset 1 into a specific five-tuple format, assigns a corresponding app label, extracts a candidate feature set, and forms a labeled candidate feature representation Tor traffic dataset 2; inputs the Tor traffic dataset 2 to the confusion feature separation layer to obtain N filters through training, and separates the Tor traffic into N specific application types; and inputs the N specific application type Tor traffic into the optimal classifier of the specific application type obtained in step (3) . (4.2) Tor traffic application type identification The identified Tor app traffic set represented by the 98 candidate feature set obtained in step (1) is input into the trained filter and classifier to identify the Tor traffic app result, thereby achieving Tor app traffic analysis.

6. A system for implementing the anti-evasion-resistant Tor App traffic analysis method according to any one of claims 1 to 5, characterized in that: The method comprises a target traffic candidate feature extraction module, a confusion feature separation layer module, an optimal feature and model combination module, and a Tor app traffic identification module. The candidate feature extraction module extracts basic features and statistical features of multiple dimensions of the basic features from the target traffic by using expert knowledge, and obtains a candidate feature set by using an information gain technique. The confusion feature separation layer module separates Tor app traffic with large cross feature values, filters out N specific application type traffics by solving a type combination optimization problem, and obtains an optimal classifier of the specific application type. The optimal feature and model combination module receives the specific application type traffic filtered out by the confusion feature separation layer, solves a feature and model combination optimization problem for the specific application type traffic, and obtains an optimal classifier of the specific application type. The Tor app traffic identification module identifies the Tor app traffic by using the trained optimal classifier of the specific application type, obtains an app classification result of the traffic, and realizes Tor app traffic analysis.

7. A computer storage medium, characterized in that: The computer storage medium stores a program suitable for a Tor App traffic analysis method resistant to feature instability, and the program is executed to realize the Tor App traffic analysis method resistant to feature instability according to any one of claims 1 to 5.

Images