Website identification method and device, and electronic device

Abstract

The application provides a website identification method and device and electronic equipment. The method comprises the following steps: obtaining a plurality of data packets in an encrypted data stream; obtaining a webpage resource sequence by a webpage resource sequence algorithm according to attribute values of all the data packets; performing feature extraction on the webpage resource sequence to obtain a webpage resource feature; performing feature coding on the webpage resource feature to obtain a webpage resource feature vector; and obtaining a target website result and a possibility corresponding to the target website result by a trained classification model according to the webpage resource feature vector. The method improves the identification accuracy of the website.

Description

Technical Field

[0001] This application relates to the field of information security technology for computer systems, and in particular to a website identification method, device, and electronic device. Background Technology

[0002] Website fingerprinting, as a key method for network traffic identification, aims to identify websites corresponding to encrypted traffic, thereby helping network administrators to accurately implement network management strategies. Its main principle is to extract website features from multiple data streams, and then use these features to identify the website.

[0003] In related technologies, the main approach is to extract features from the encrypted data stream of a website, and then use a fingerprint recognition model trained using machine learning or deep learning methods to identify the encrypted website corresponding to the encrypted data stream. While these methods consider the data features of the encrypted data stream, they fail to consider its temporal characteristics. Furthermore, due to the randomness of webpage resource loading in real-world applications, ignoring temporal features severely impacts the accuracy of website identification. Therefore, these technologies suffer from low website identification accuracy. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a website identification method, apparatus and electronic device to solve the problem of low website identification accuracy described in the background art.

[0005] For the purposes described above, this application provides a website identification method, comprising:

[0006] Retrieve multiple data packets from an encrypted data stream;

[0007] Based on the attribute values ​​of all the data packets, a webpage resource sequence is obtained using a webpage resource sequence algorithm;

[0008] Feature extraction is performed on the webpage resource sequence to obtain webpage resource features;

[0009] The webpage resource features are encoded to obtain a webpage resource feature vector;

[0010] Based on the webpage resource feature vector, a trained classification model is used to obtain the target website result and the probability corresponding to the target website result.

[0011] Optionally, the data packets are classified into request data packets and response data packets;

[0012] Before obtaining the webpage resource sequence based on the attribute values ​​of all the data packets using the webpage resource sequence algorithm, the method further includes:

[0013] Iterate through all the data packets mentioned above;

[0014] In response to the data packet being a request data packet, the sum of its sequence number and data length is used as the first key value of the request data packet, and its acquisition time is used as the first attribute value of the request data packet;

[0015] In response to the data packet being a response data packet, its acknowledgment number is used as the second key value of the response data packet, and its number of bytes is used as the second attribute value of the response data packet.

[0016] Optionally, obtaining the webpage resource sequence based on the attribute values ​​of all the data packets using a webpage resource sequence algorithm includes:

[0017] Group request packets and response packets that have the same first key value and second key value into a packet group;

[0018] The first attribute value of the request data packet in each data packet group is used as the acquisition time of the web page resource element corresponding to that data packet group;

[0019] The second attribute values ​​of all response packets in the data packet group are added together to obtain the value of the web page resource element corresponding to the data packet group;

[0020] All the web page resource elements are sorted in ascending order of acquisition time to obtain the web page resource sequence.

[0021] Optionally, the step of extracting features from the webpage resource sequence to obtain webpage resource features includes:

[0022] Based on the webpage resource elements, multiple features are obtained through a predetermined distance definition algorithm;

[0023] Sort all the features according to the acquisition time to obtain the webpage resource features.

[0024] Optionally, the step of feature encoding the webpage resource features to obtain a webpage resource feature vector includes:

[0025] Obtain a preset webpage resource feature sequence; the preset webpage resource feature sequence includes at least one preset webpage resource feature element;

[0026] Determine sequentially whether each of the webpage resource feature elements corresponds to the first element of the webpage resource feature;

[0027] In response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, a 0 element is added to the webpage resource feature vector and the element after the first element of the webpage resource feature is taken as the first element of the webpage resource feature.

[0028] In response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, add a 1 element to the webpage resource feature vector.

[0029] Optionally, the step of obtaining the probability of the target network and the target website corresponding to the encrypted data stream based on the webpage resource feature vector and through a trained classification model includes:

[0030] Obtain the preset threshold of the trained classification model;

[0031] Based on the encrypted data stream, the trained classification model is used to obtain the website corresponding to the encrypted data stream and the probability of the website.

[0032] In response to determining that the probability of any website is greater than or equal to a preset threshold, the website is identified as the target website.

[0033] Output the results of the target website, and the probability corresponding to the results of the target website.

[0034] Optionally, the process of determining the preset threshold includes:

[0035] Obtain the first dataset; the first dataset includes at least one first webpage resource feature vector and its corresponding result website;

[0036] Set any value within the preset range as the threshold of the trained classification model;

[0037] Based on at least all the feature vectors of the first web page resources, a corresponding classification result is obtained through a trained classification model, and the precision and recall corresponding to the threshold are obtained based on the classification result; the precision represents the classification accuracy of the trained classification model; the recall represents the number of target websites identified by the trained classification model.

[0038] Based on the precision and the recall, the threshold score is calculated using the following formula:

[0039]

[0040] Wherein, F1score represents the threshold score, precision represents the accuracy, and recall represents the recall rate;

[0041] The threshold with the highest threshold score is used as the predetermined threshold.

[0042] Optionally, the training process of the classification model includes:

[0043] Obtain a second dataset; the second dataset includes at least one second webpage resource feature vector and its corresponding result website;

[0044] Based on the second dataset, the training website results are obtained through the classification model.

[0045] Upon determining that the training website result is the same as the website result, the training of the classification model is terminated.

[0046] Based on the same inventive concept, this application also provides a website identification device, comprising:

[0047] The acquisition module is configured to acquire multiple data packets from an encrypted data stream;

[0048] The first calculation module is configured to obtain a web page resource sequence based on the attribute values ​​of all the data packets using a web page resource sequence algorithm;

[0049] The second calculation module is configured to extract features from the webpage resource sequence to obtain webpage resource features;

[0050] The third calculation module is configured to perform feature encoding on the webpage resource features to obtain a webpage resource feature vector.

[0051] The matching module is configured to obtain the target website result and the probability corresponding to the target website result based on the webpage resource feature vector and a trained classification model.

[0052] Based on the same inventive concept, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the website identification method as described in any of the above.

[0053] As can be seen from the above, the website identification method provided in this application extracts features by comprehensively considering the order and size of data packets in the encrypted data stream, and then identifies the corresponding websites, which effectively improves the accuracy of website identification. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart illustrating one or more embodiments of the website identification method of this application;

[0056] Figure 2 This is a schematic diagram illustrating the webpage resource transmission sequence according to an embodiment of this application;

[0057] Figure 3 This is a schematic diagram of the closed-environment experimental results of one or more embodiments of this application;

[0058] Figure 4 This is a schematic diagram of the background traffic environment experimental results for one or more embodiments of this application;

[0059] Figure 5 This is a schematic diagram of the structure of a website identification device according to one or more embodiments of this application;

[0060] Figure 6 This is a schematic diagram of the hardware structure of an electronic device according to one or more embodiments of this application. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0062] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0063] As described in the background section, website fingerprinting, as an important method for network traffic identification, aims to identify websites corresponding to encrypted traffic, thereby helping network administrators to accurately implement network management strategies. Its main principle is to extract features from multiple data streams of the target website to obtain uniquely identifiable features (website fingerprints), and then use these features to identify the target website.

[0064] Specifically, in response to a user's request, the target website loads the necessary resources to generate the webpage. In practical applications, a webpage typically consists of an HTML document, CSS stylesheets, JavaScript files, and multiple resource files such as images and videos. Therefore, the resources called by the webpage loaded by the website based on the user's request can be considered a resource set. Since each website requires slightly different resources, this resource set should have a one-to-one correspondence with the website. Furthermore, the data stream generated during webpage loading will also differ.

[0065] When extracting features from encrypted data streams, since stable plaintext features, such as webpage content, DOM tree structure, and unencrypted data exchanged between the client and server (TLS handshake messages), cannot be obtained, it is necessary to extract other features of the data packets. Considering the transmission method of the encrypted data stream, it is mainly divided into two scenarios: tunnel transmission scenario and non-tunnel transmission scenario.

[0066] In tunnel transmission scenarios, data streams corresponding to the same webpage are transmitted within the same tunnel. In this case, relevant technologies mainly extract the webpage's fingerprint by considering features such as data packet size, time interval, and uplink / downlink data ratio. However, these features are affected by transmission mechanisms and network fluctuations, and therefore lack good accuracy and robustness.

[0067] In non-tunneling scenarios, websites simultaneously initiate multiple data streams to load resource files from different servers. In this case, relevant technologies primarily construct the webpage's fingerprint by parsing the original data streams and obtaining the resource object information contained in the original data packets. However, this method suffers from drawbacks such as difficulty in obtaining accurate information and susceptibility to network fluctuations, and still lacks good accuracy and robustness.

[0068] In summary, related technologies primarily extract features from non-sensitive information contained in data packets within the data stream to obtain website fingerprints and identify the corresponding websites. However, in practical applications, websites may simultaneously initiate multiple data streams to load resource files on different servers, or load multiple web pages simultaneously, resulting in multiple data streams of different web pages being transmitted on the same channel. In such cases, the content and order of data packets in the intercepted data stream are random. Therefore, it is first necessary to recombine all transmitted data using a four-tuple (source IP, destination IP, source port, destination port) dimension to distinguish the data streams, and then perform fingerprint identification on the small amount of data contained in each data stream to determine its corresponding website. Related technologies use data packet size features and / or plaintext features for fingerprint identification; when the data stream contains very little data, the number of features that can be extracted is also very small, making identification extremely difficult.

[0069] On the other hand, for encrypted data streams, the data packets within are first encrypted before transmission. The size of the encrypted data packets will vary, and most related technologies rely on fingerprinting based on the size characteristics and / or plaintext features of the data packets. Therefore, for encrypted data packets, related technologies typically first use algorithms to obtain the size and / or data content of the data packets before encryption, and then perform feature extraction and identification. Website identification using methods provided by these technologies has low accuracy.

[0070] Therefore, this application proposes a website identification method that, under the condition of data stream encryption, obtains more features by comprehensively considering the size and timing of the data, in order to identify websites.

[0071] The technical solutions of one or more embodiments of this application will be described in detail below through specific examples.

[0072] refer to Figure 1 The website identification method of one or more embodiments of this application includes the following steps:

[0073] Step S101: Obtain multiple data packets from the encrypted data stream.

[0074] In some embodiments, since multiple data packets for accessing web pages are transmitted through the same channel, it is first necessary to recombine the data packets in the channel along the four-tuple (source IP, destination IP, source port, destination port) dimension to identify multiple data packets belonging to the same encrypted data stream.

[0075] In some embodiments, since the data packets acquired are from an encrypted data stream, these data packets are fragmented, compressed, and encrypted using the Transport Layer Security (TLS) protocol. Because the original data packets are fragmented, compressed, and encrypted according to the maximum message length, compression algorithm, and encryption algorithm agreed upon in the protocol during data transmission, the changes between the fragmented, compressed, and encrypted data packets and the original data packets are relatively stable. In some embodiments, the size characteristics of the fragmented, compressed, and encrypted data packets can be used as the basis for fingerprint identification.

[0076] Step S102: Based on the attribute values ​​of all the data packets, obtain the web page resource sequence using the web page resource sequence algorithm.

[0077] In developing this application, the applicant discovered that related technologies primarily extract at least one of the plaintext features and size features of the data stream for fingerprint identification. Plaintext features include: webpage content, DOM tree structure, and unencrypted data (TLS handshake messages) exchanged between the client and server. However, in encrypted data streams, it is difficult to obtain plaintext features because the data packets are encrypted. Furthermore, fingerprint identification based solely on size features has a very low accuracy rate. Therefore, this application proposes a method that comprehensively considers both the size and temporal features of the data packets in the data stream. The website fingerprint determined by these size and temporal features is unique, significantly improving the accuracy of website identification.

[0078] Specifically, in this step, the attribute values ​​of each data packet are determined. Data packets can be classified into request data packets and response data packets. The sum of the sequence number and data length in a request data packet equals the acknowledgment number of its corresponding response data packet, and one request data packet may correspond to multiple response data packets. Therefore, in some embodiments, request data packets and response data packets can be associated using the acknowledgment number, sequence number, and data length sum. In some embodiments, the attribute values ​​of the data packets can first be obtained as follows: in response to the data packet being a request data packet, the sum of its sequence number and data length is used as the first key value of the request data packet, and its acquisition time is used as the first attribute value of the request data packet; in response to the data packet being a response data packet, its acknowledgment number is used as the second key value of the response data packet, and its number of bytes is used as the second attribute value of the response data packet.

[0079] In some embodiments, request data packets and response data packets with the same first key value and second key value are grouped into data packet groups; the first attribute value of the request data packets in each data packet group is used as the acquisition time of the web page resource element corresponding to the data packet group; the second attribute values ​​of all response data packets in the data packet group are added together to obtain the value of the web page resource element corresponding to the data packet group; all the web page resource elements are sorted in ascending order of acquisition time to obtain the web page resource sequence.

[0080] In some embodiments, two key-value dictionaries (dicts) can be initialized first, named a request dictionary and a response dictionary. All data packets are traversed. In response to determining that a data packet is a request packet, the sequence number and data length of the request packet are saved as the key in the request dictionary, and its corresponding value is the acquisition time of the request packet. In response to determining that a data packet is a response packet, the response dictionary is traversed to check if the acknowledgment number of the response packet already has a corresponding key-value pair. In response to determining that the response packet does not have a corresponding key-value pair, the acknowledgment number is saved as the key in the response dictionary, and its corresponding value is the number of bytes in the response packet. In response to determining that the response packet has a corresponding key-value pair, its corresponding value is the cumulative sum of the number of bytes in the response packet and the original value. Through the above steps, the request packet and its response packet are associated, and the acquisition time of the request packet and the cumulative sum of the sizes of the corresponding response packets are obtained. The cumulative sum of the number of bytes in the response packets can be considered as the size of the resource requested by the corresponding request packet after compression and encryption.

[0081] In some embodiments, key-value pairs stored in the request dictionary and the response dictionary are associated through their keys, and the values ​​in the response dictionary are arranged in ascending order of their values ​​in the request dictionary to obtain a webpage resource sequence. The webpage resource sequence includes the temporal and size characteristics of the requested resources.

[0082] Step S103: Extract features from the webpage resource sequence to obtain webpage resource features.

[0083] In implementing this application, during the process of the website responding to user requests to retrieve resources and generate web pages, the order of resource transmission has the characteristics of overall order and partial randomness. Specifically, the overall resource transmission order follows the sequence of transmitting HTML documents first, then JS and CSS files, and finally images and videos. However, since the data transmission of files after the HTML document is mostly performed simultaneously by multiple threads, the transmission order of files of the same type is uncertain. Furthermore, the change in the transmission order of files of the same type is not significant. Figure 2As shown, taking one embodiment as an example, during two visits to the same website, the transmission of webpage resources follows the order of HTML documents first, then JS and CSS files, and finally images and videos. However, the transmission order of the file query-3.5.1.min.js changes among files of the same type. Therefore, although the order in which resources are loaded on the same webpage cannot be guaranteed to be completely consistent each time, the changes are not significant. The transmission order of resources on webpages from different websites is highly differentiated.

[0084] In implementing this application, the applicant selected 110 web pages for feature extraction. Responding to the determination that data packet size should be used as the basis for feature extraction, approximately 7000 features were extracted; responding to the determination that data packet size and ordered pairs should be used as the basis for feature extraction, approximately 22000 features were extracted. Through the above experiments, it can be seen that simultaneously using data packet size and temporal order as the basis for feature extraction can significantly increase the number of features, which is helpful for website fingerprinting.

[0085] In some embodiments, feature extraction can be performed using a predetermined distance-defined algorithm. In other embodiments, feature extraction can be performed using an N-gram algorithm. N-gram is an algorithm based on a statistical language model. Its basic idea is to perform a sliding window operation of size N on the content of the text according to bytes, forming multiple byte fragments of length N, and then assembling them into a sequence.

[0086] In some embodiments, the following steps are repeated until the length of the sliding window exceeds a first predetermined value: a sliding window operation is performed on the web page resource element through a sliding window with a length of a second predetermined value to obtain multiple features with dimensions of the second predetermined value; the second predetermined value is less than or equal to the first predetermined value; in response to determining that the sliding window operation has ended, the value of the second predetermined value plus one is taken as the second predetermined value.

[0087] For example, when the first predetermined value is 3 and the second predetermined value is 1, the web page resource elements are operated on sequentially through sliding windows of length 1 to 3 to obtain multiple features of dimensions 1 to 3, and all the obtained features are arranged in chronological order.

[0088] Taking one embodiment of this application as an example, the web page resource sequence in this embodiment is (500, 1000, 2000), with a first predetermined value of 3 and a second predetermined value of 1, and the resulting feature is [(500)(1000)(2000)(500, 1000)(1000, 2000)(500, 1000, 2000)].

[0089] Since the size of a data packet may change within a certain range during data packet transmission, in some embodiments, before obtaining multiple features through a predetermined distance definition algorithm, the values ​​of all the web page resource elements can be multiplied by a predetermined change threshold coefficient to obtain the corresponding change threshold; the values ​​within the change threshold are then added to the web page resource elements as changed web page resource elements.

[0090] Using the above embodiments as an example, the predetermined change threshold coefficients are 0.9 and 1.1. Therefore, taking webpage resource element 500 as an example, its change thresholds are 450 and 550. We can consider the features of (500, 1000) and (450, 1000) to be the same. Thus, the webpage resource element increases to (450, 500, 550, 900, 1000, 1100, 1800, 2000, 2200). Its features are increased to [(450)(500)(550)(900)(1000)(1100)(1800)(2000)(2200)(450,500)(500,550)(900,1000)(1000,1100)(1100,1800)(1800,2000)(2000,2200)(450,500,550)(500,550,900)(550,900,1000)(1000,1100,1800)(1800,2000,2200)].

[0091] In some embodiments, one or more values ​​within a change threshold can be added to the webpage resource element, and its corresponding features will also increase accordingly. The specific methods and steps are similar to the examples above and will not be repeated here.

[0092] Step S104: Perform feature encoding on the webpage resource features to obtain the webpage resource feature vector.

[0093] In some embodiments, the step of obtaining a webpage resource feature vector includes: acquiring a preset webpage resource feature sequence; the preset webpage resource feature sequence includes at least one preset webpage resource feature element; sequentially determining whether the webpage resource feature element corresponds to the first element of the webpage resource feature; in response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, adding a 0 element to the webpage resource feature vector and taking the element after the first element of the webpage resource feature as the first element of the webpage resource feature; in response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, adding a 1 element to the webpage resource feature vector.

[0094] Taking one embodiment as an example, during the training phase, if one webpage resource sequence is (500, 1000, 2000) and another is (500, 1000, 3000), then a preset webpage resource feature sequence is established as (500, 1000, 2000, 3000). The webpage resource feature vector corresponding to the first sequence is (1, 1, 1, 0), and the webpage resource feature vector corresponding to the second sequence is (1, 1, 0, 1). Therefore, in some embodiments, during the testing phase, the webpage resource feature vector is encoded according to the preset webpage resource feature sequence (500, 1000, 2000, 3000) to obtain the corresponding webpage resource feature vector.

[0095] Step S105: Based on the webpage resource feature vector, obtain the target website result and the probability corresponding to the target website result through the trained classification model.

[0096] In some embodiments, a random forest model is selected as the classification model described above. Different classification models serve the same purpose and are all within the scope of protection of this application. A random forest model is a classifier based on the Bagging algorithm, containing multiple decision trees, and its output class is determined by the mode of the classes output by individual trees. In this application, the ratio of the number of individual trees whose output class is the classification result to the total number of individual trees is used as the probability of the classification result.

[0097] In some embodiments, the threshold can be set considering both precision and recall. Precision reflects the accuracy of the identification results, while recall reflects the number of targets that the decision tree can identify. When the threshold is set lower, the recall is higher, but the precision is lower; when the threshold is set higher, the recall is lower, but the precision is higher.

[0098] In the implementation of this application, the applicant sets a threshold score calculation method, comprehensively considering recall and precision, to select a threshold. In some embodiments, the predetermined threshold is obtained by the following method: obtaining a second dataset; the second dataset includes multiple second web page resource features and their corresponding result websites; setting any value within the threshold range as the threshold of the trained classification model; obtaining the corresponding classification result based on all the second web page resource features using the trained classification model, and obtaining the precision and recall corresponding to the threshold based on the classification result; the precision represents the classification accuracy of the trained classification model; the recall represents the number of target websites identified by the trained classification model; and the threshold score is calculated based on the precision and the recall using the following formula: Wherein, F1score represents the threshold score, precision represents the accuracy, and recall represents the recall rate; the threshold with the highest threshold score is used as the predetermined threshold.

[0099] In some embodiments, the training steps of the random forest model include: acquiring a dataset; the dataset includes at least one web resource feature vector and its corresponding result website; obtaining the training website result through the classification model based on the dataset; and determining that the training website result is the same as the website result, and determining that the training of the classification model has ended.

[0100] Figure 3 The experimental results of the algorithm provided in this application under closed environment are shown in the figure. It can be seen that, under closed environment, the method provided in this application has higher accuracy and recall, and the computation time is very short. Figure 4 The algorithm and related technologies provided in this application provide experimental results of the threshold score in an environment with background traffic.

[0101] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0102] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0103] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides a website identification device.

[0104] refer to Figure 5 The website identification device includes:

[0105] Acquisition module 11 is configured to acquire multiple data packets from an encrypted data stream;

[0106] The first calculation module 12 is configured to obtain a web page resource sequence based on the attribute values ​​of all the data packets using a web page resource sequence algorithm;

[0107] The second calculation module 13 is configured to extract features from the web page resource sequence to obtain web page resource features;

[0108] The third calculation module 14 is configured to perform feature encoding on the web page resource features to obtain a web page resource feature vector.

[0109] The matching module 15 is configured to obtain the target website result and the probability corresponding to the target website result by using a trained classification model based on the webpage resource feature vector.

[0110] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0111] The apparatus described above is used to implement the corresponding website identification method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0112] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the website identification method described in any of the above embodiments.

[0113] Figure 6 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0114] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0115] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0116] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0117] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0118] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0119] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0120] The electronic devices described above are used to implement the corresponding website identification methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0121] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0122] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0123] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0124] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A website identification method, characterized in that, include: Retrieve multiple data packets from an encrypted data stream; the data packets are classified into request data packets and response data packets; Based on the attribute values ​​of all the data packets, a webpage resource sequence is obtained using a webpage resource sequence algorithm; Feature extraction is performed on the webpage resource sequence to obtain webpage resource features; The webpage resource features are encoded to obtain a webpage resource feature vector; Based on the webpage resource feature vector, the target website result and the probability corresponding to the target website result are obtained through a trained classification model; Before obtaining the webpage resource sequence based on the attribute values ​​of all the data packets using the webpage resource sequence algorithm, the method further includes: Iterate through all the data packets mentioned above; In response to the data packet being a request data packet, the sum of its sequence number and data length is used as the first key value of the request data packet, and its acquisition time is used as the first attribute value of the request data packet; In response to the data packet being a response data packet, its acknowledgment number is used as the second key value of the response data, and its number of bytes is used as the second attribute value of the response data packet; The step of obtaining the webpage resource sequence based on the attribute values ​​of all the data packets using a webpage resource sequence algorithm includes: Group request packets and response packets that have the same first key value and second key value into a packet group; The first attribute value of the request data packet in each data packet group is used as the acquisition time of the web page resource element corresponding to that data packet group; The second attribute values ​​of all response packets in the data packet group are added together to obtain the value of the web page resource element corresponding to the data packet group; All the web page resource elements are sorted in ascending order of acquisition time to obtain the web page resource sequence; The step of encoding the webpage resource features to obtain a webpage resource feature vector includes: Obtain a preset webpage resource feature sequence; the preset webpage resource feature sequence includes at least one preset webpage resource feature element; Determine sequentially whether each of the webpage resource feature elements corresponds to the first element of the webpage resource feature; In response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, a 0 element is added to the webpage resource feature vector and the element after the first element of the webpage resource feature is taken as the first element of the webpage resource feature. In response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, add a 1 element to the webpage resource feature vector.

2. The website identification method according to claim 1, characterized in that, The step of extracting features from the webpage resource sequence to obtain webpage resource features includes: Based on the webpage resource elements, multiple features are obtained through a predetermined distance definition algorithm; Sort all the features according to the acquisition time to obtain the webpage resource features.

3. The website identification method according to claim 1, characterized in that, The step of obtaining the target website result and the probability corresponding to the target website result through a trained classification model based on the webpage resource feature vector includes: Obtain the preset threshold of the trained classification model; Based on the encrypted data stream, the trained classification model is used to obtain the website corresponding to the encrypted data stream and the probability of the website. In response to determining that the probability of any website is greater than or equal to a preset threshold, the website is identified as the target website. Output the results of the target website, and the probability corresponding to the results of the target website.

4. The website identification method according to claim 3, characterized in that, The process of determining the preset threshold includes: Obtain the first dataset; the first dataset includes at least one first webpage resource feature vector and its corresponding result website; Set any value within the preset range as the threshold of the trained classification model; Based on at least all the feature vectors of the first web page resources, a corresponding classification result is obtained through a trained classification model, and the precision and recall corresponding to the threshold are obtained based on the classification result; the precision represents the classification accuracy of the trained classification model; the recall represents the number of target websites identified by the trained classification model. Based on the precision and the recall, the threshold score is calculated using the following formula: ； in, Indicates the threshold score. This indicates the accuracy. Indicates the recall rate; The threshold with the highest threshold score is used as the predetermined threshold.

5. The website identification method according to claim 4, characterized in that, The training process of the classification model includes: Obtain a second dataset; the second dataset includes at least one second webpage resource feature vector and its corresponding result website; Based on the second dataset, the training website results are obtained through the classification model. Upon determining that the training website result is the same as the website result, the training of the classification model is terminated.

6. A website identification device, characterized in that, include: The acquisition module is configured to acquire multiple data packets from an encrypted data stream; The data packets are classified into request data packets and response data packets; The first calculation module is configured to obtain a web page resource sequence based on the attribute values ​​of all the data packets using a web page resource sequence algorithm; The second calculation module is configured to extract features from the webpage resource sequence to obtain webpage resource features; The third calculation module is configured to perform feature encoding on the webpage resource features to obtain a webpage resource feature vector. The matching module is configured to obtain the target website result and the probability corresponding to the target website result based on the webpage resource feature vector through a trained classification model; The website identification device is further configured as follows: Iterate through all the data packets mentioned above; In response to the data packet being a request data packet, the sum of its sequence number and data length is used as the first key value of the request data packet, and its acquisition time is used as the first attribute value of the request data packet; In response to the data packet being a response data packet, its acknowledgment number is used as the second key value of the response data, and its number of bytes is used as the second attribute value of the response data packet; The first computing module is specifically configured as follows: Group request packets and response packets that have the same first key value and second key value into a packet group; The first attribute value of the request data packet in each data packet group is used as the acquisition time of the web page resource element corresponding to that data packet group; The second attribute values ​​of all response packets in the data packet group are added together to obtain the value of the web page resource element corresponding to the data packet group; All the web page resource elements are sorted in ascending order of acquisition time to obtain the web page resource sequence; The third computing module is specifically configured as follows: Obtain a preset webpage resource feature sequence; the preset webpage resource feature sequence includes at least one preset webpage resource feature element; Determine sequentially whether each of the webpage resource feature elements corresponds to the first element of the webpage resource feature; In response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, a 0 element is added to the webpage resource feature vector and the element after the first element of the webpage resource feature is taken as the first element of the webpage resource feature. In response to determining that any webpage resource feature element is the same as the first element of the webpage resource feature, add a 1 element to the webpage resource feature vector.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.

Images