A few-sample web page fingerprint learning method, a terminal device, and a storage medium

By employing contrastive learning and data augmentation techniques, a contrastive network and a linear classifier are constructed, addressing the accuracy and adaptability issues of existing webpage fingerprinting methods in situations with limited samples. This enables fast and accurate webpage fingerprinting, making it suitable for practical applications.

CN116346437BActive Publication Date: 2025-11-04XIAMEN UNIV
View PDF 2 Cites 0 Cited by

Patent Information

Application Number
CN202310209945.3
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2023-03-07
Publication Date
2025-11-04
Estimated Expiration
2043-03-07

AI Technical Summary

Technical Problem

Existing deep learning-based web fingerprinting methods are difficult to efficiently utilize a small number of training samples in practical applications. They also have low accuracy when facing defenses against anonymous networks, long startup times, and are unable to adapt to changes in the user environment.

Method used

A contrastive learning approach is adopted, which constructs a contrastive network for data augmentation and feature extraction, and combines it with a linear classifier. The classifier is trained using a small number of traffic samples. The approach includes a data augmentation module, a feature extractor, and a projection head module, which shortens the startup time and improves robustness.

Benefits of technology

High-accuracy webpage fingerprinting was achieved with a small number of training samples, shortening the startup time and enhancing the adaptability and robustness of the method. It can maintain a high recognition accuracy under datasets with different distributions and defense measures.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN116346437B_ABST
    Figure CN116346437B_ABST
Patent Text Reader

Abstract

The application relates to a few-sample webpage fingerprint learning method, a terminal device and a storage medium, and the method comprises the following steps: assembling a pre-training data set and a few-sample data set; a comparison network is constructed, the comparison network comprises a data enhancement module, a feature extractor, a projection head module and a comparison loss module; the pre-training data set is used for training the comparison network, and a pre-training feature extractor is obtained; the original flow in the few-sample data set is subjected to the data enhancement module and the trained feature extractor, and the feature vectors of the enhanced flow of each sample in the few-sample data set are obtained; a linear classifier is constructed, the feature vectors are used as the input of the linear classifier, and the linear classifier is trained; the trained feature extractor and the trained linear classifier are combined to obtain a flow classification model, and the flow classification model is used for fingerprint identification of the flow of a webpage to be monitored. The application can quickly train a new classifier by collecting a small amount of flow, and the accuracy of webpage fingerprint identification is ensured.
Need to check novelty before this filing date? Find Prior Art

Description

TECHNICAL FIELD

[0001] The present application relates to the field of webpage monitoring, and in particular to a few-sample webpage fingerprint learning method, terminal device and storage medium. BACKGROUND

[0002] With the development of Internet technology, Web services continue to provide convenience for people's life, but the surge in data has also brought a series of network security and privacy protection problems. Anonymous network is originally a privacy protection technology, which encrypts network traffic in multiple layers to achieve communication anonymization, but it also makes it impossible for regulators to determine whether the target user has made illegal access in the Internet. Criminals often use anonymous networks such as Tor to secretly browse and spread undesirable or even illegal information, causing great threat to social order. Therefore, analysis techniques for anonymous communication traffic have developed rapidly, such as traffic correlation analysis techniques, flow watermarking techniques and webpage fingerprinting (WF) techniques. The first two techniques have the problems of difficult deployment and high cost, while the easily deployed WF technique does not require any decryption operation in the traffic identification process, and has become an effective method for webpage browsing supervision.

[0003] WF technology identifies the accessed webpage by statistically and analytically analyzing the pattern characteristics of encrypted traffic. The supervisor determines in advance a series of webpages to be monitored (such as a list of illegal webpages prohibited from access), then collects traffic samples of each monitored webpage, and extracts traffic characteristics as "traffic fingerprints" to train a webpage classifier, where each monitored webpage is regarded as a category. The monitor listens to the current network traffic of the user, and classifies it using the trained classifier, so as to determine whether the user has accessed a certain monitored webpage. Even in anonymous networks such as Tor, the webpage fingerprinting method can effectively identify whether the user has accessed a certain monitored webpage.

[0004] Early WF identification methods are based on traditional machine learning methods, using Support Vector Machine (SVM), Random Forest (RF), k-Nearest Neighbor (kNN), etc. to train the classifier. These methods usually manually extract features from traffic, such as packet length, total number of transmitted packets, and the proportion of received and transmitted packets to the total number of packets. However, anonymous networks often use WF defense methods such as injecting virtual packets, fixing packet size, or delaying packet transmission to obscure web browsing traffic features, thereby reducing the accuracy of web fingerprint identification. Once important traffic features are obscured, the performance of traditional machine learning WF will be greatly reduced. For example, the WTPAD defense detects continuous bursts of delays and hides time gaps by adding virtual packets, which can reduce the accuracy of web identification. Therefore, a practical web fingerprint identification method not only needs to be good at extracting "traffic fingerprints", but also needs to be able to resist the interference of anonymous networks and WF defense methods.

[0005] In recent years, deep learning has been widely used in web fingerprint identification. Web fingerprint identification methods based on deep learning can automatically extract features from traffic, rather than relying on manually specified features, which greatly improves the accuracy and robustness of identification. Even in the face of WF-protected network traffic, such methods can accurately identify the monitored web page. The most popular Deep Fingerprinting (DF) and Var-CNN methods can train the classifier using a large number of web traffic samples, and then accurately identify the accessed web page. For example, the DF method collects more than 500 training traffic samples for each monitored page, and can achieve 96% accuracy in web fingerprint identification. However, as the number of monitored pages increases, the time and resource consumption of collecting training samples is huge. Such WF methods not only rely on a large number of training traffic samples, but also make two assumptions to simplify the real situation:

[0006] 1. Bootstrap Time is Negligible: Bootstrap time refers to the time required to obtain a complete classifier, including the total time of collecting enough traffic samples and training the classifier. The larger the training traffic demand, the longer the WF method bootstrap time. Due to the dynamic changes of network environment and the timely updates of web page content, the "traffic fingerprint" of a website is time-sensitive, and longer bootstrap time often has a negative impact on the accuracy of WF identification. Existing research shows that when the supervisor uses the classifier trained ten days ago to identify the user traffic for WF, its accuracy decreases from 80% to 30%. Existing deep learning WF methods essentially ignore the impact of the time interval between collecting training traffic and monitoring user traffic on WF performance; if a large amount of training traffic is collected frequently as a trade-off, although a real-time effective classifier can be trained, it is difficult to deploy in practical application scenarios.

[0007] 2. User Environment is Replicable: It is assumed that the supervisor can replicate the user settings (including Tor browser version, user network environment, etc.) and filter background traffic, so that the training traffic of the classifier and the actual traffic of the user have the same distribution. However, in the actual application environment, the Tor browser version used by the user and the network conditions will change constantly, and the existing WF identification method is difficult to adapt to the difference in traffic distribution. For example, when training and testing WF methods using traffic collected from different Tor browser versions, the identification accuracy is only 12%. However, in practical applications, it is difficult for the supervisor to capture the user settings and the time of updating the monitored web page, not to mention the cost of re-collecting and training traffic.

[0008] Although existing deep learning-based WF identification methods have achieved an accuracy of more than 95% in experimental environments, it is difficult to maintain high accuracy at a reasonable cost in reality. In order to make such WF methods applicable and land, the most direct solution is to reduce the number of training traffic, overcoming the adverse effects of long bootstrap time and traffic distribution difference on supervision. However, when the number of training samples for each monitored page is reduced to 10, the accuracy of DF and Var-CNN methods is less than 50%; if the influence of WTPAD defense is superimposed, both methods are almost ineffective, with an accuracy of 10%. Therefore, simply reducing the number of training samples is not feasible, and it is urgent to study how to efficiently use a small amount of training data to ensure the accuracy of WF methods. SUMMARY

[0009] To solve the above problems, the present application provides a few-sample web fingerprint learning method, terminal equipment and storage medium.

[0010] The specific scheme is as follows:

[0011] A few-sample web fingerprint learning method, comprising the following steps:

[0012] S1: Collect raw traffic of monitored web pages to form a pre-training data set, and set the label of each raw traffic as the category of the corresponding web page;

[0013] S2: Construct a contrast network, the contrast network includes a data enhancement module, a feature extractor, a projection head module, and a contrast loss module; the data enhancement module performs data enhancement processing on the input raw traffic to obtain enhanced traffic, the feature extractor extracts a feature vector from the enhanced traffic, the projection head module maps the feature vector output by the feature extractor to the contrast loss module, and the contrast loss module calculates a contrast loss based on the output of the projection head; the pre-training data set is used to train the contrast network, and the trained feature extractor is used as a pre-trained feature extractor;

[0014] S3: Collect a small number of raw traffic compared with the pre-training data set to form a small sample data set, and set the label of each raw traffic as the category of the corresponding web page;

[0015] S4: Process the raw traffic in the small sample data set through the data enhancement module and the pre-trained feature extractor obtained in step S2 to obtain a feature vector of the enhanced traffic of each sample in the small sample data set;

[0016] S5: Construct a linear classifier, use the feature vector obtained in step S4 as the input of the linear classifier, train the linear classifier, and obtain a trained linear classifier;

[0017] S6: Combine the pre-trained feature extractor obtained in step S2 and the trained linear classifier obtained in step S5 to obtain a traffic classification model, and perform web fingerprint identification on the traffic of the web page to be monitored through the traffic classification model.

[0018] Further, the data enhancement includes an injection operation, and the injection operation injects +1 or -1 randomly into any position sequence number of the raw traffic.

[0019] Further, the data enhancement includes a removal operation, and the removal operation randomly selects a certain position sequence number of the raw traffic and deletes the corresponding data packet.

[0020] Further, the output of the projection head module is normalized and limited on a unit hypersphere, and the unit hypersphere enables the contrast loss module to measure the distance in the projection space by using the inner product.

[0021] A small sample web fingerprint learning terminal device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described above in the embodiments of the application when executing the computer program.

[0022] A computer readable storage medium stores a computer program, and the computer program, when executed by a processor, implements the steps of the method of the embodiments of the application.

[0023] The application adopts the above technical solution, introduces contrast learning for the first time, and can quickly train a new classifier by collecting a small amount of traffic in the face of different distribution data sets, not only shortens the starting time of the WF, but also relieves the constraint of user environment replication. Therefore, the application has good robustness and adaptability, breaks the simplification assumption of the existing WF method, and is conducive to the deployment of practical application. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 A flowchart of an embodiment of the application is shown.

[0025] Figure 2 A structure diagram of the contrast network in the pre-training stage of the embodiment is shown.

[0026] Figure 3 A network structure diagram of the small sample training stage and the test stage in the embodiment is shown. DETAILED DESCRIPTION

[0027] To further illustrate the embodiments, the application provides drawings. These drawings are part of the disclosure of the application, mainly used to illustrate the embodiments, and can be used to explain the operating principle of the embodiments in conjunction with the related description of the specification. With reference to these contents, those skilled in the art should understand other possible implementations and advantages of the application.

[0028] The application will be further described in conjunction with the drawings and specific embodiments.

[0029] Embodiment one:

[0030] The embodiment of the application provides a small sample web fingerprint learning method, as shown in the figure, the method comprises the following steps: Figure 1 The method comprises the following steps:

[0031] S1: Collect the original traffic of the monitored web page to form a pre-training data set, and set the label of each original traffic as the category of the corresponding web page.

[0032] In web fingerprinting, a supervisor usually represents the network traffic as a sequence of tuples of the form <±packetsize>. Here, the size of packetsize is the length of each packet, and the sign before packetsize indicates the direction of the packet: a positive sign "+" indicates outgoing or sent, and a negative sign "-" indicates incoming or received. To reduce information leakage, anonymous communication systems like Tor fix the size of packets, and thus packetsize is usually set to 1. This embodiment also labels the network traffic as a sequence of the form <+1,+1,-1,+1,...>.

[0033] S2: Construct a contrast network, the contrast network includes a data enhancement module, a feature extractor, a projection head module and a contrast loss module; the data enhancement module performs data enhancement processing on the input original traffic to obtain enhanced traffic, the feature extractor extracts a feature vector from the enhanced traffic, the projection head module maps the feature vector output by the feature extractor to the contrast loss module, and the contrast loss module calculates a contrast loss based on the output of the projection head; a pre-training data set is used to train the contrast network, and the trained feature extractor is used as a pre-trained feature extractor.

[0034] Step S2 is a pre-training phase, which is used to obtain a pre-trained feature extractor that can quickly adapt to a new data set, and to prepare for the subsequent phase. The data enhancement module effectively expands the number of traffic samples, and the feature extractor and the projection head are both neural networks that are iteratively updated by the contrast loss module. The detailed processes of the modules are shown in Figure 2

[0035] The data enhancement module is used to add possible network traffic interference to the original traffic t, and two data enhancement operations, injection and removal, are designed. The injection operation randomly injects +1 or -1 into any position sequence number of the original traffic t, and is used to simulate the addition of possible background traffic (such as access traffic generated by other tabs of a browser). In contrast, the removal operation randomly selects a position sequence number of the original traffic and deletes the corresponding packet. The removal operation simulates the phenomenon of packet loss and packet retransmission due to network congestion or transmission errors to some extent. The introduction of realistic interference in the original traffic enhances the ability of the network to reasonably infer the context of the traffic, makes the model more robust to dynamic network conditions, and thus reduces the impact of the long start-up time on the WF identification method.

[0036] For any input original traffic t, two traffic and inherit the label of t are obtained after the data enhancement operation. The two enhanced traffic are the results of the injection operation and the removal operation, respectively. Therefore, for a set of original traffic-label pairs {t k ,y k} k=1…M ​2M length of enhanced traffic-label pairs for subsequent training can be generated wherein, and is the traffic t k (k = 1…M) are two enhanced traffic obtained by data augmentation. Since the label of the enhanced traffic is unchanged,

[0037] The feature extractor Enc(·) and the projection head Proj(·) are two neural network models, and the model structure thereof can be selected according to the application scenario. Commonly used models include CNN and ResNet, etc. In this embodiment, the DF and MLP structures are respectively preferred as the neural network models of the two. The feature extractor is responsible for extracting the feature vector from the enhanced traffic That is, the two enhanced samples of will be input into the feature extractor to obtain a pair of feature vectors. Compared with the feature extractor, the projection head Proj(·) is a smaller neural network, which is responsible for mapping the feature vector output by the feature extractor into the space for calculating the contrast loss. Among them, the output e = Proj(r) of the projection head is normalized and limited on the unit hypersphere, and the unit hypersphere enables the contrast loss module to measure the distance in the projection space by using the inner product. Therefore, after the enhanced traffic-label pair passes through the feature extractor and the projection head, a feature vector with a size of S is obtained, which corresponds to 2M vector-label pairs in the projection space In this embodiment, S = 128 is preferred according to the model and the experimental environment.

[0038] Then, the contrast loss is calculated according to the output of the projection head. From the 2M vector-label pairs in the projection space, a feature vector The contrast loss module attempts to reduce the distance between and the vectors (traffic) with the same label in the entire training batch. Conversely, the distance between and the traffic with different label categories among the 2M feature vectors in the entire training batch will be pulled away. Therefore, after the contrast loss is calculated, the traffic samples from the same class will have a positive relationship and will be gathered together; at the same time, the negative relationship will push away the traffic from different websites in the projection space.

[0039]

[0039] S3: Collect a small number of original traffic compared with the pre-training data set to form a small sample data set, and set the label of each original traffic as the category of the corresponding webpage.

[0040] The small sample data set and the pre-training data set can have different data distributions (i.e., a brand new data set can be used), and N labeled traffic is collected for each monitored webpage for training (the number N of small samples is usually less than 20).

[0041] S4: The original traffic in the few-shot dataset is processed by the data augmentation module and the pre-trained feature extractor obtained in step S2 to obtain the feature vector of the augmented traffic of each sample in the few-shot dataset.

[0042] Step S4 is a few-shot training phase, as shown in Figure 3 , in order to increase the diversity of training samples, the original traffic in the few-shot dataset also needs to be subjected to data augmentation operation, and then input into the pre-trained feature extractor obtained in the pre-training phase to generate the corresponding feature vector. Among them, all the structures and parameters of the pre-trained feature extractor remain unchanged (marked with * in Figure 3 ).

[0043] S5: Construct a linear classifier, use the feature vector obtained in step S4 as the input of the linear classifier, train the linear classifier, and obtain the trained linear classifier.

[0044] Use the feature vector generated by the above steps to train a linear classifier, which can be used in the test phase and actual use phase for classification and identification of the monitored web traffic. The test phase omitted in this embodiment.

[0045] S6: Combine the pre-trained feature extractor obtained in step S2 and the trained linear classifier obtained in step S5 to obtain a traffic classification model, and use the traffic classification model to identify the web fingerprint of the monitored web traffic (such as the test phase in Figure 3 ).

[0046] The monitored web page can be used for the test phase as shown in Figure 3 , and can also be used for classification and identification in actual use, both of which use the same operation mode.

[0047] Experimental results

[0048] In order to comprehensively verify the performance and characteristics of this embodiment, experiments are selected from two datasets Wang100 and DF95 with different distributions collected under different versions of anonymous networks. The detailed information of the datasets is as follows:

[0049] • The Wang100 dataset is collected using Tor version 3.X, containing 100 monitored websites, and each website has 90 traffic samples.

[0050] • The DF95 dataset is collected using Tor version 6.X, containing 95 monitored websites, and each website has 100 traffic samples.

[0051] In subsequent experiments, DF95 is used as a pre-training dataset for the pre-training phase; Wang100 is used as a small sample dataset for the small sample training phase and the test phase. Among them, the number of training samples of each monitored webpage in the support set is N = 5, 10, 15 or 20; in the query set, the number of traffic for testing of each monitored webpage is 20, which is randomly selected from the small sample dataset. Table 1 and Table 2 record the performance of the embodiment in the absence of any WF defense and in response to the WTFPAD defense, and the same environment is compared with the existing TF method. The performance index is the accuracy of webpage fingerprint identification, defined as the ratio of the number of correctly classified and identified webpages to the total number of webpages to be tested:

[0052]

[0053] The experimental results show that the embodiment method has rapid adaptability, and uses less training data to complete the webpage fingerprint identification of the anonymous network, shortens the startup time, and can support different distributed datasets, and is better than the existing TF method in each experimental environment.

[0054] √ Without using WF defense measures

[0055] Under the condition that only N = 20 training samples are collected for each monitored page, the present application can quickly adapt to two different datasets DF95 and Wang100, and obtain an identification accuracy of 87.7%. For the N = 5 experimental scenario, the present application can also obtain an accuracy greater than 80%, which is better than the existing TF method.

[0056] √ Using WTFPAD defense

[0057] The identification performance of the present application decreases slightly, but is still effective, showing good robustness. Under the condition that only N = 20 training samples are collected for each monitored page, the present application still has an accuracy close to 70%, which is significantly higher than the TF method.

[0058] Table 1

[0059]

[0060]

[0061] The embodiment of the present application introduces contrastive learning in the field of webpage fingerprint identification, so that the supervisor can collect only a small amount of training traffic samples, use data enhancement, contrastive network and deep learning model to construct a feature extractor and a webpage classifier, and ensure the accuracy of webpage fingerprint identification.

[0062] In the pre-training stage, the embodiment of the present application obtains an efficient feature extractor considering the global characteristics of encrypted traffic by constructing a contrast network. The feature extractor can quickly adapt to different data sets, alleviating the constraints on user environment replication, and facilitating practical application deployment. In the few-shot training stage, only a small amount of traffic samples need to be collected and a linear classifier is trained, so that the user traffic can be accurately identified in the test stage, the startup time of the WF method is shortened, and the practicability is enhanced.

[0063] The embodiment of the present application can accurately identify web fingerprints and shorten the startup time of the WF method under the condition of a small amount of training data. For example, when there are only 5 training samples for each monitored page, the embodiment can correctly identify more than 80% of the user web traffic; while the accuracy of the typical deep learning WF method is already far below 50%. Even in the face of WF defense traffic samples, the web identification accuracy of the embodiment method is more than 65%.

[0064] The embodiment of the present application has good robustness and adaptability to traffic from different distributions. When the few-shot training stage and the pre-training stage use completely different distribution traffic data sets, only 15 training traffic samples need to be collected for each monitored web page, and the embodiment can retrain the classifier to correctly identify more than 85% of the user web traffic, complete the web fingerprint identification task under a small amount of data, and effectively alleviate the constraints on user environment replication.

[0065] Embodiment two:

[0066] The present application also provides a few-shot web fingerprint learning terminal device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to realize the steps in the above method embodiments of the first embodiment of the present application.

[0067] Further, as an executable solution, the few-shot web fingerprint learning terminal device can be a desktop computer, a notebook, a palm computer, and a cloud server, etc. The few-shot web fingerprint learning terminal device can include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the above-mentioned composition structure of the few-shot web fingerprint learning terminal device is only an example of the few-shot web fingerprint learning terminal device, and does not constitute a limitation on the few-shot web fingerprint learning terminal device, and can include more or fewer components than the above, or combine certain components, or different components, for example, the few-shot web fingerprint learning terminal device can also include an input / output device, a network access device, a bus, etc., and the embodiments of the present application do not limit this.

[0068] Further, as an executable solution, the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), and the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor or the like, and the processor is a control center of the few-sample web fingerprint learning terminal device, and connects various parts of the few-sample web fingerprint learning terminal device through various interfaces and lines.

[0069] The memory can be used to store the computer program and / or modules, and the processor realizes various functions of the few-sample web fingerprint learning terminal device by running or executing the computer program and / or modules stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data created according to the use of the mobile phone, and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state memory devices.

[0070] The application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the steps of the method provided in the embodiments of the application.

[0071] The module / unit integrated in the few-sample webpage fingerprint learning terminal equipment can be stored in a computer readable storage medium if it is realized in the form of a software function unit and sold or used as an independent product. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware. The computer program can be stored in a computer readable storage medium. When the computer program is executed by a processor, the steps of the above-mentioned various method embodiments can be implemented. The computer program includes computer program code, which can be in the form of source code, object code, an executable file, or some intermediate form, etc. The computer readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), and a software distribution medium, etc.

[0072] Although the present application is specifically shown and described in conjunction with preferred embodiments, it should be understood that various changes in form and detail can be made without departing from the spirit and scope of the application as defined in the appended claims.

Claims

1. A few-sample webpage fingerprint learning method, characterized in that, Includes the following steps: S1: Collect raw traffic from the monitored web pages to form a pre-training dataset, and assign a label to each raw traffic item as the category of its corresponding web page; S2: Construct a contrast network, which includes a data augmentation module, a feature extractor, a projection head module, and a contrast loss module. The data augmentation module performs data augmentation on the input raw traffic to obtain augmented traffic. The feature extractor extracts feature vectors from the augmented traffic. The projection head module maps the feature vectors output by the feature extractor to the contrast loss module. The contrast loss module calculates the contrast loss based on the output of the projection head. The contrast network is trained using a pre-trained dataset, and the trained feature extractor is used as the pre-trained feature extractor. Data augmentation includes injection operations, which randomly inject +1 or -1 into any position number in the original traffic; Data augmentation includes a removal operation, which randomly selects a position number in the original traffic and deletes its corresponding data packet. For any input original traffic t, the data augmentation operation results in two augmented traffic packets, each inheriting the label of t. These two augmented traffic packets are the results of the injection and removal operations, respectively. For a set of original traffic-label pairs {t} of length M... k ,y k } k=1…M This generates 2M length augmented traffic-label pairs for subsequent training. in, and It is the flow rate t k (k=1…M) Two augmented traffic streams obtained after data augmentation, y k It is the flow rate t k The tag, It is to increase traffic. The labels, k and l, both represent serial numbers; The output of the projection head module is normalized and constrained to a unit hypersphere, which allows the contrast loss module to use the inner product to measure distances in the projection space. When calculating the contrast loss based on the output of the projector, a feature vector is randomly selected from 2M vector-label pairs in the projection space. The comparison loss module attempts to narrow down The distance between vectors with the same label in the entire training batch, and conversely, The distance between traffic flows that are different from their label category in the 2M feature vectors of the entire training batch will be increased; S3: Collect a small number of raw traffic samples compared to the pre-trained dataset to form a few-sample dataset, and assign a label to each raw traffic sample as the category of its corresponding webpage; S4: After processing the original traffic in the few-sample dataset through the data augmentation module and the pre-trained feature extractor obtained in step S2, the feature vector of the augmented traffic of each sample in the few-sample dataset is obtained. S5: Construct a linear classifier. Use the feature vector obtained in step S4 as the input of the linear classifier to train the linear classifier and obtain the trained linear classifier. S6: Combine the pre-trained feature extractor obtained in step S2 and the trained linear classifier obtained in step S5 to obtain a traffic classification model. Use the traffic classification model to perform webpage fingerprinting on the webpage to be monitored.

2. A few-sample webpage fingerprint learning terminal device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the method as described in claim 1.

3. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the steps of the method as described in claim 1.

Citation Information

Patent Citations

  • Network intrusion detection method

    CN110070141A

  • Method for improving anonymous network webpage fingerprint monitoring capability by using data enhancement

    CN113641935A