A DHT network sensitive content identification method based on semi-supervised learning

Abstract

The application discloses a DHT network sensitive content recognition method based on semi-supervised learning, obtains network data through crawling of a DHT network, manually labels part of the data, constructs a file metadata data set, adopts a bidirectional long short-term memory network model based on an attention mechanism to recognize sensitive content in view of the fact that effective information of seed information text is relatively dispersed, uses a data-driven learning algorithm to greatly reduce the demand for manual intervention and definition rules, and adopts a semi-supervised learning method based on labeled data and unlabeled data to simultaneously train, so as to effectively improve the training effect of the model on a small sample labeled data set in view of the problems of small data quantity, unbalanced data and many invalid samples in the training process of the DHT network data.

Description

Technical Field

[0001] This invention belongs to the field of computer network technology, specifically relating to a method for identifying sensitive content in DHT networks based on semi-supervised learning. Background Technology

[0002] BitTorrent, or BT for short, is the most popular peer-to-peer file-sharing protocol on the Internet. Once a user possesses the file's hash value (InfoHash), if an active node storing that file exists in the peer-to-peer network, the user can find that node and download the file through an addressing process. The more users downloading the same file, the faster the download speed. In its early design, BT network file downloads relied on Tracker (directory) servers, posing a risk of centralization. Therefore, BT introduced a download technology that does not rely on Tracker (directory) servers: DHT (Distributed Hash Table) addressing download. DHT is a distributed storage method where, without the need for a server, each client is responsible for a small range of routing and storing a small portion of data, thus enabling addressing and storage for the entire DHT network. From here on, we conceptually refer to both the BT network and the DHT network collectively as the DHT network. DHT network addressing uses the Kademlia algorithm. The BEP-09 protocol defines how to obtain the seed file (file metadata) through the file hash value, while the BEP-3 protocol defines how to obtain the source file from the seed file.

[0003] In recent years, with the rapid development of peer-to-peer file-sharing protocols, a large number of users have spread sensitive and harmful information through DHT networks. Currently, the discovery of sensitive information on DHT networks mainly relies on user reports and manual review, which suffers from insufficient timeliness and comprehensiveness. To address these issues, researchers have proposed some automated methods for discovering sensitive information on DHT networks. However, rule-based or traditional machine learning methods are not very effective with the messy data in DHT networks, and data-driven learning algorithms suffer from problems such as labeling difficulties, data imbalance, and invalid samples, which pose significant obstacles to model training. In summary, existing methods for discovering sensitive information on DHT networks mainly suffer from high model training costs, reducing the efficiency of discovering sensitive content in DHT networks. Summary of the Invention

[0004] In view of this, the present invention provides a method for identifying sensitive content in DHT networks based on semi-supervised learning, which achieves efficient identification and discovery of sensitive content in DHT networks.

[0005] This invention provides a method for sensitive content identification based on a semi-supervised learning DHT network, which specifically includes the following steps:

[0006] Step 1: Obtain DHT network data through web crawler, and annotate some of the data in the DHT network data to construct a DHT network file metadata dataset. Divide the DHT network file metadata dataset into training set, validation set and test set.

[0007] Step 2: Construct a DHT network sensitive content recognition model. The DHT network sensitive content recognition model includes an input layer, an embedding layer, an LSTM layer, an attention layer, and an output layer. The input layer is used to input text, the embedding layer is used to map the text to high-dimensional word vectors, the LSTM layer is used to obtain high-level features of word vectors from the output data of the embedding layer as output, the attention layer is used to calculate weight vectors and merge the high-level features of word vectors into sentence-level feature vectors based on the weight vectors, and the output layer is used to output the type of sentence-level feature vectors.

[0008] Step 3: Using the DHT network file metadata dataset constructed in Step 1, train the DHT network sensitive content recognition model based on semi-supervised learning.

[0009] Step 4: In actual use, input the obtained DHT network file metadata into the DHT network sensitive content recognition model trained in Step 3 to determine whether the type of DHT network file metadata is sensitive content.

[0010] Furthermore, the training of the DHT network sensitive content recognition model based on semi-supervised learning in step 3 includes the following steps: First, extract the unique feature vectors of the samples in the DHT network file metadata dataset. Then, input the samples in the DHT network file metadata dataset into the DHT network sensitive content recognition model to obtain sentence-level feature vectors. Next, fuse the unique feature vectors and the sentence-level feature vectors to obtain fused feature vectors. Finally, input the fused feature vectors into the DHT network sensitive content recognition model and complete the training in a semi-supervised learning manner.

[0011] Furthermore, the method for extracting the unique feature vector of samples in the DHT network file metadata dataset is as follows: extract the file length feature, publishing IP address feature, and propagation port feature of samples in the DHT network file metadata dataset; normalize the file length feature using the arctangent function; assign a value to each country as a country code starting from zero, and establish a mapping table between the publishing IP address feature and the country code; normalize the propagation port feature using linear normalization; then concatenate the processed file length feature, publishing IP address feature, and propagation port feature to obtain a three-dimensional vector as the unique feature vector; during training, a fully connected neural network is used to increase the dimensionality of the unique feature vector so that it has the same dimension as the sentence-level feature vector.

[0012] Furthermore, the method for fusing the unique feature vector with the sentence-level feature vector to obtain the fused feature vector is as follows: the unique feature vector and the sentence-level feature vector are added point by point according to their correlation dimensions.

[0013] Furthermore, the training of the DHT network sensitive content recognition model based on semi-supervised learning in step 3 also includes: using entropy regularization to select the category with the highest prediction probability in the unlabeled data as a pseudo-label, and using the pseudo-label as the target category of the unlabeled data.

[0014] Beneficial effects:

[0015] 1. This invention obtains network data by crawling the DHT network and manually annotates some of the data to construct a file metadata dataset. At the same time, considering the characteristics of the seed information text itself, such as the relatively scattered effective information, a bidirectional long short-term memory network model based on the attention mechanism is used for sensitive content identification. The data-driven learning algorithm greatly reduces the need for manual intervention in defining rules. In addition, to address the problems of small data volume, data imbalance and many invalid samples in the DHT network data training process, a semi-supervised learning method based on simultaneous training of labeled and unlabeled data is adopted to effectively improve the training effect of the model on small sample labeled datasets.

[0016] 2. This invention targets the unique attributes existing in DHT networks, including file length, the location of the peer IP address of the file being transmitted, and the port number of the transmission. It extracts unique vectors related to these unique attributes from the network data and fuses these unique vectors with the sentence-level feature vectors formed in the DHT network sensitive content recognition model to generate a fused feature vector. The fused feature vector is then used to train the model, which can further improve the model's recognition performance.

[0017] 3. This invention can further improve the training effect of semi-supervised learning models by using entropy regularization to select the category with the highest prediction probability in unlabeled data as the pseudo-label. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating the metadata content of a DHT network file.

[0019] Figure 2 This is a schematic diagram of heterogeneous data unique to DHT network file metadata.

[0020] Figure 3 This is a diagram illustrating the expanded content of the "files" field in the DHT network file metadata. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] This invention provides a semi-supervised learning-based method for sensitive content identification in DHT networks. The core idea is as follows: First, a large amount of real-world data collected by a DHT network crawler is imported, and some of this data is manually labeled. Then, a bidirectional long short-term memory network model based on an attention mechanism is constructed to identify files in the DHT network. To integrate unique heterogeneous data such as file directory structures and propagation IP ports in the DHT, a targeted feature fusion method is adopted. Finally, to address issues such as insufficient data volume, data imbalance, and invalid samples during training, a semi-supervised learning method that simultaneously uses labeled and unlabeled data for training is employed to improve the model's training performance on small-sample labeled datasets.

[0023] This invention provides a method for sensitive content identification based on a semi-supervised learning DHT network, the process of which is as follows: Figure 1 As shown, it includes the following steps:

[0024] Step 1: Obtain DHT network data through web crawling, manually annotate some of the data in the DHT network data, construct the DHT network file metadata dataset, and divide the DHT network file metadata dataset into training set, validation set and test set.

[0025] For example, more than 30,000 DHT web file metadata entries were filtered out from the data obtained from web crawlers. DHT web file metadata mainly includes information such as file titles. The obtained file metadata parsing results are as follows: Figure 1 As shown in Tables 1 and 2, the scale of the crawled network data and training sample set are as follows.

[0026] Table 1 Data crawled from the DHT network

[0027]

[0028] Table 2 Training set, validation set, and test set

[0029]

[0030] DHT networks contain a lot of unique data that differs from traditional text content (such as file names), such as file directory structure, file length, IP address of the file being transmitted and its location, port, etc. Figure 2 As shown, the key technical focus of this invention is how to utilize the unique heterogeneous data in DHT network file metadata. The expanded form of the files field in the metadata is as follows: Figure 3 As shown.

[0031] Step 2: Compared to traditional text classification tasks, considering the unique characteristics of seed information text, such as significant differences in lexical and syntactic structures compared to traditional text, and the relatively dispersed effective information within the text, this invention constructs a DHT network sensitive content recognition model based on a bidirectional long short-term memory network model with an attention mechanism. The DHT network sensitive content recognition model includes an input layer, an embedding layer, an LSTM layer, an attention layer, and an output layer. The input layer is used to input the text; the embedding layer maps the text to high-dimensional word vectors; the LSTM layer uses BiLSTM to extract high-level features of the word vectors from the output data of the embedding layer as output features; the attention layer calculates weight vectors and merges the output features of the word vectors at each time step into a sentence-level feature vector based on the weight vectors; and the output layer outputs the sentence-level feature vector. The type.

[0032] Recognizing seed content in DHT networks can be viewed as a classification task combining text classification with traditional features. However, compared to traditional text classification tasks, DHT network text has many unique characteristics, such as significant differences in lexical and syntactic structures. Existing text classification models often rely on information extracted from lexical and syntactic resources for classification. Furthermore, unlike ordinary text where effective information is relatively concentrated, effective information in DHT network text is often more dispersed and can appear at any position within a sentence. In text classification, models typically encode words (tokens) based on context, then pool the sentence representation for further classification. Max pooling usually performs better in the final pooling stage, as conclusions can be drawn from just one or two key words in the sentence. However, for finer-grained analysis, the max pooling process may remove useful features. In such cases, attention can be used for sentence representation to improve analysis performance.

[0033] Therefore, based on the characteristics of DHT networks, this invention constructs a DHT network sensitive content recognition model, which adopts an attention-based bidirectional short-term memory network to automatically focus on words that play a decisive role in classification without using additional knowledge and natural language processing systems, thereby capturing the most important semantic information in the sentence.

[0034] Step 3: Using the DHT network file metadata dataset constructed in Step 1, train the DHT network sensitive content recognition model using a semi-supervised learning approach. The training process is as follows: First, extract the unique feature vectors of the samples in the DHT network file metadata dataset. Then, input the samples from the DHT network file metadata dataset into the DHT network sensitive content recognition model to obtain sentence-level feature vectors. Then, the unique feature vector and the sentence-level feature vector are combined. The fused feature vector is obtained by adding the dimensions of the point-by-point correlation. Finally, the fused feature vector is input into the DHT network sensitive content recognition model and trained in a semi-supervised learning manner.

[0035] Analysis of existing data reveals that sensitive data in DHT networks often exhibit characteristics such as similar file lengths, concentrated publication addresses, and infrequent propagation ports. Therefore, incorporating these unique features into the model will yield better recognition results. Since the data structure of these unique features differs from that of text data, heterogeneous data fusion processing is necessary.

[0036] During training, the process of extracting the unique feature vectors of samples in the DHT network file metadata dataset is as follows:

[0037] For the file length feature, the arctangent function is used for data normalization. Since the file length is always greater than 0, the data can be mapped to the range of 0 to 100. The specific calculation formula is as follows:

[0038]

[0039] For the IP address characteristics, the country of origin is queried via the interface, and a unique numerical code is assigned to each country starting from 0, obtaining a mapping table between IP addresses and countries. For the propagation port characteristics, since the port value is a number in the range of 1 to 65535, it can be mapped to the range of 0 to 100 through linear normalization. The specific calculation formula is as follows:

[0040]

[0041] The three types of features are then concatenated to obtain a three-dimensional vector. During training, a fully connected neural network is used to increase the dimensionality of the three-dimensional vector, resulting in a sentence-level feature vector. Unique feature vectors with the same dimensions.

[0042] Combine unique feature vectors with sentence-level feature vectors The method for point-wise correlation dimension addition and fusion is to perform point-wise correlation dimension addition and fusion on the two feature vectors with the same dimension.

[0043] The main technical approaches to solving few-shot learning problems include: model fine-tuning-based methods, data augmentation-based methods, and transfer learning-based methods. Model fine-tuning-based methods are simple to operate but may lead to overfitting. Transfer learning-based methods, while supplementing additional knowledge, suffer from high complexity. Among data augmentation methods, unlabeled data-based methods, although potentially introducing noise, are relatively convenient as they do not require parameter tuning.

[0044] Therefore, this invention employs a semi-supervised learning-based algorithm, using both labeled and unlabeled data to train the DHT network sensitive content recognition model. For unlabeled data, entropy regularization is used to select the category with the highest predicted probability as its pseudo-label, which is then used as the real label. Furthermore, for unlabeled data, the category with the highest predicted probability at each weight update is selected as its pseudo-label and used as the real label.

[0045] The pseudo-label is the target category for unlabeled data. It is usually selected as the category with the highest predicted probability for each unlabeled sample, and the selection formula is as follows:

[0046]

[0047] in, i For the first i Types, express x Is the category the first? i Types, 1 represents x The category is number i Types, 0 indicates x The category is not the first i Types, These are the input sample values.

[0048] In the fine-tuning phase with dropout, pseudo-labels are used, and the pre-trained network is trained in a supervised manner. For unlabeled data, pseudo-labels are recalculated with each weight update and used for the same loss function calculation as in the supervised learning task (i.e., the pseudo-labels are recalculated with each weight update and used as the true labels in the loss function calculation). Since the total amount of labeled and unlabeled data differs significantly in few-shot learning, and the training balance between them is crucial for the network, the overall loss function is designed as follows:

[0049]

[0050] Where n is the mini-batch size of labeled data in the network. It is the mini-batch size of unlabeled data. It is the output result of m samples in labeled data. Let m be the true labels of the m samples in the labeled data. Output results of m samples in unlabeled data. is the true label of m samples in the unlabeled data. In the formula above, It is the balance coefficient, which determines the impact of unlabeled data on the final result. If If it's too large, it will interfere with training on labeled data. If the size is too small, it may be unable to learn knowledge from unlabeled data. Therefore, a simulated annealing process is used to control... The size of the value is adjusted to avoid poor local minima, so that the pseudo-labels of the unlabeled data are as similar as possible to the real labels, as shown in the following formula:

[0051]

[0052] in, t The iteration round number is less than the total number of rounds. The balance coefficient is set to 0 when it is greater than 0. Less than At that time, the balance coefficient is increased according to the increase of the number of wheels, and when it is greater than the number of wheels... At that time, the balance coefficient is set to a fixed upper limit value.

[0053] Step 4: In actual use, inputting the acquired DHT network file metadata into the DHT network sensitive content recognition model trained in Step 3 will determine whether the current DHT network file metadata is sensitive content.

[0054] To verify the effectiveness of the proposed semi-supervised learning-based DHT network sensitive content recognition method, the following experiments were conducted. The FastText model (a fast text classifier developed by Facebook) was used as the baseline model for comparison. The batch size was also 32, and the model was trained for 10 epochs. The loss decreased from the initial 0.30 to 0.066, and the F1 score increased from 0.945 in the first epoch to 0.956. The final F1 score on the test set was 0.960. The training results of the model are shown in Table 3.

[0055] Table 3 Model Results

[0056]

[0057] The model performance after incorporating DHT network-specific features such as file length, IP address location, and port number is shown in Table 4.

[0058] Table 4. Model performance after feature fusion

[0059]

[0060] The relearned model achieved certain improvements on both the validation and test sets using a semi-supervised learning method, as shown in Table 5.

[0061] Table 5. Model performance after semi-supervised learning

[0062]

[0063] In summary, the above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for sensitive content identification based on a semi-supervised learning DHT network, characterized in that, Specifically, the following steps are included: Step 1: Obtain DHT network data through web crawler, and annotate some of the data in the DHT network data to construct a DHT network file metadata dataset. Divide the DHT network file metadata dataset into training set, validation set and test set. Step 2: Construct a DHT network sensitive content recognition model. The DHT network sensitive content recognition model includes an input layer, an embedding layer, an LSTM layer, an attention layer, and an output layer. The input layer is used to input text, the embedding layer is used to map the text to high-dimensional word vectors, the LSTM layer is used to obtain high-level features of word vectors from the output data of the embedding layer as output, the attention layer is used to calculate weight vectors and merge the high-level features of word vectors into sentence-level feature vectors based on the weight vectors, and the output layer is used to output the type of sentence-level feature vectors. Step 3: Using the DHT network file metadata dataset constructed in Step 1, train the DHT network sensitive content recognition model based on semi-supervised learning. Step 4: In actual use, input the obtained DHT network file metadata into the DHT network sensitive content recognition model trained in Step 3 to determine whether the type of DHT network file metadata is sensitive content. Step 3, which involves training the DHT network sensitive content recognition model using a semi-supervised learning approach, includes the following steps: First, extract the unique feature vectors of samples from the DHT network file metadata dataset. Then, input the samples from the DHT network file metadata dataset into the DHT network sensitive content recognition model to obtain sentence-level feature vectors. Next, fuse the unique feature vectors with the sentence-level feature vectors to obtain fused feature vectors. Finally, input the fused feature vectors into the DHT network sensitive content recognition model and complete the training using a semi-supervised learning approach. The method for extracting the unique feature vectors of samples in the DHT network file metadata dataset is as follows: extract the file length feature, publishing IP address feature, and propagation port feature of the samples in the DHT network file metadata dataset; normalize the file length feature using the arctangent function; assign a value to each country as a country code starting from zero, and establish a mapping table between the publishing IP address feature and the country code; normalize the propagation port feature using linear normalization; then concatenate the processed file length feature, publishing IP address feature, and propagation port feature to obtain a three-dimensional vector as the unique feature vector; during training, a fully connected neural network is used to increase the dimensionality of the unique feature vector so that it has the same dimension as the sentence-level feature vector.

2. The DHT network sensitive content identification method according to claim 1, characterized in that, The method for fusing the unique feature vector and the sentence-level feature vector to obtain the fused feature vector is as follows: the unique feature vector and the sentence-level feature vector are correlated point by point and their dimensions are added together.

3. The DHT network sensitive content identification method according to claim 1, characterized in that, Step 3, which involves training the DHT network sensitive content recognition model using semi-supervised learning, further includes: using entropy regularization to select the category with the highest prediction probability in the unlabeled data as a pseudo-label, and using this pseudo-label as the target category of the unlabeled data.

Images