Network trace analysis method and system based on differential privacy

Abstract

The application provides a network trace analysis method and system based on differential privacy, relating to the technical field of trace analysis, the method comprising: based on a user group network trace set, configuring a first adjacent user network trace, performing differential privacy budget optimization in combination with an attack transaction set and an available information transaction set, generating a recommended differential privacy budget, and then generating an output constraint condition; when receiving a network trace query request, adding random noise to the network trace in combination with a preset random algorithm to generate output information for feedback; and when receiving a network trace analysis request, generating a high-frequency path node identifier for feedback. The application mainly solves the problems of user privacy leakage, inaccurate analysis results, and the inability to effectively identify and respond to network attacks in the prior art. It can effectively prevent the leakage of personal privacy data and ensure that the network privacy of users is fully protected.

Description

Technical Field

[0001] This application relates to the field of trace analysis technology, specifically to a network trace analysis method and system based on differential privacy. Background Technology

[0002] With the popularization and development of the internet, people increasingly rely on the internet for various activities, including searching for information, social interaction, and online shopping. These activities leave behind a large number of traces online, such as search history, browsing records, and social relationships. These traces can be used to analyze users' interests, behavioral habits, and social networks, thereby revealing users' personal privacy information. Traditional online trace analysis methods often lead to the leakage of user privacy. Attackers can analyze users' online traces to infer users' personal information, such as identity, location, and interests, and then carry out various malicious acts, such as identity theft and fraud. Therefore, how to protect users' online privacy has become an important issue.

[0003] However, in the process of implementing the technical solution of the invention in the embodiments of this application, it was found that the above-mentioned technology has at least the following technical problems:

[0004] Existing technologies can lead to user privacy leaks, inaccurate analysis results, and an inability to effectively identify and respond to cyberattacks. Summary of the Invention

[0005] This application primarily addresses the issues that existing technologies lead to user privacy leaks, inaccurate analysis results, and an inability to effectively identify and respond to cyberattacks.

[0006] In view of the above problems, this application provides a network trace analysis method and system based on differential privacy. In a first aspect, this application provides a network trace analysis method based on differential privacy, the method comprising: configuring a first neighboring user network trace for a first user network trace based on a network trace set of a user group, wherein the first neighboring user network trace and the first user network trace have only one path node deviation; performing differential privacy budget optimization by combining a network trace attack transaction set and an available information extraction transaction set to generate a recommended differential privacy budget; generating output constraints based on a first global sensitivity of the first neighboring user network trace and the first user network trace, combined with the recommended differential privacy budget; when a network trace query request is received, adding random noise to the first user network trace and the first neighboring user network trace based on the output constraints and a preset random algorithm to generate output information for feedback; and when a network trace analysis request is received, performing high-frequency trace analysis on the output information to generate high-frequency path nodes, and identifying the high-frequency path nodes before feedback.

[0007] Secondly, this application provides a network trace analysis system based on differential privacy. The system includes: a first neighboring user network trace configuration module, which configures first neighboring user network traces for a first user network trace based on a set of network traces for a user group, wherein the first neighboring user network trace and the first user network trace have one and only one path node deviation; a recommended differential privacy budget generation module, which combines a network trace attack transaction set and an available information extraction transaction set to perform differential privacy budget optimization and generate a recommended differential privacy budget; and an output constraint generation module, which is based on... The network traces of the first neighboring user and the first global sensitivity of the first user's network trace are combined with the recommended differential privacy budget to generate output constraints. An output information generation module is used, when a network trace query request is received, to add random noise to the first user's network trace and the first neighboring user's network trace based on the output constraints and a preset random algorithm to generate output information for feedback. A high-frequency path node identifier generation module is used, when a network trace analysis request is received, to perform high-frequency trace analysis on the output information, generate high-frequency path nodes, and identify the high-frequency path nodes before feedback.

[0008] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0009] This application provides a network trace analysis method and system based on differential privacy, relating to the field of trace analysis technology. The method includes: configuring network traces of first neighboring users based on a network trace set of user groups; performing differential privacy budget optimization by combining an attack transaction set and an available information extraction transaction set to generate a recommended differential privacy budget; generating output constraints; adding random noise to the network traces using a preset random algorithm to generate output information for feedback when a network trace query request is received; and generating high-frequency path node identifiers for feedback when a network trace analysis request is received.

[0010] This application primarily addresses the problems of existing technologies leading to user privacy leaks, inaccurate analysis results, and an inability to effectively identify and respond to cyberattacks. It can effectively prevent the leakage of personal privacy data and ensure that users' online privacy is fully protected.

[0011] The above description is merely an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0013] Figure 1 A schematic flowchart of a network trace analysis method based on differential privacy is provided for embodiments of this application;

[0014] Figure 2 This application provides a schematic flowchart of a method for generating network traces of the first neighboring user in a network trace analysis method based on differential privacy.

[0015] Figure 3 This application provides a schematic flowchart of a method for generating a recommended differential privacy budget in a network trace analysis method based on differential privacy.

[0016] Figure 4 A schematic diagram of the structure of a network trace analysis system based on differential privacy is provided for the embodiments of this application.

[0017] Figure labeling: First adjacent user network trace configuration module 10, recommended differential privacy budget generation module 20, output constraint generation module 30, output information generation module 40, high-frequency path node identifier generation module 50. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0019] This application primarily addresses the problems of existing technologies leading to user privacy leaks, inaccurate analysis results, and an inability to effectively identify and respond to cyberattacks. It can effectively prevent the leakage of personal privacy data and ensure that users' online privacy is fully protected.

[0020] To better understand the above technical solution, the following will provide a detailed description of the solution in conjunction with the accompanying drawings and specific implementation methods:

[0021] Example 1

[0022] like Figure 1The network trace analysis method based on differential privacy shown includes:

[0023] Based on the network trace set of a user group, configure a first neighboring user network trace for the first user network trace, wherein the first neighboring user network trace and the first user network trace have one and only one path node deviation.

[0024] Specifically, based on the network trace set of a user group, a first neighboring user network trace is configured for the network trace of a first user, wherein the first neighboring user network trace and the first user network trace have one and only one path node deviation. The process involves collecting and preprocessing the network trace data of the user group, including collecting data from various sources (such as server logs, network traffic data, etc.) and performing necessary cleaning and formatting. The process also includes identifying and extracting the first user network trace, including in-depth data analysis to identify network activity patterns related to specific users. Next, user network traces adjacent to the first user network trace are located, including comparing and analyzing network traces between different users to determine which users' traces have similar patterns or path deviations to the first user's trace. Finally, the first neighboring user network trace is configured for the first user network trace, including identifying the specific users adjacent to the first user network trace and configuring this information into relevant data structures or systems. This improves insights into user behavior while protecting user privacy and security. By identifying and configuring neighboring user network traces, it is possible to better understand the behavioral patterns and trends of user groups without disclosing detailed information about individual users.

[0025] Differential privacy budget optimization is performed by combining the network trace attack transaction set and the available information extraction transaction set to generate a recommended differential privacy budget;

[0026] Specifically, differential privacy budget optimization is performed by combining network trace attack transaction sets and usable information extraction transaction sets to generate a recommended differential privacy budget. The process involves collecting these transaction sets: First, network trace attack transaction sets and usable information extraction transaction sets need to be collected. These transaction sets may include network attack events, user behavior data, system logs, etc. Next, the two transaction sets are analyzed and compared. This helps determine which data is sensitive to privacy protection and which data is necessary for extracting useful information. Then, the differential privacy budget is determined based on the analysis and comparison results. The differential privacy budget refers to the degree of privacy loss that is acceptable to protect user privacy during data analysis and mining. Finally, the differential privacy budget is optimized based on the characteristics of the network trace attack transaction sets and usable information extraction transaction sets. This includes adjusting the intensity of noise addition and the degree of data obfuscation to extract as much useful information as possible while protecting privacy. Generate a recommended differential privacy budget: Based on the optimized differential privacy budget, generate a recommended differential privacy budget. This can be a specific value or a range, used to guide subsequent data analysis and mining work.

[0027] Based on the first neighboring user network trace and the first global sensitivity of the first user network trace, and combined with the recommended differential privacy budget, output constraints are generated.

[0028] Specifically, output constraints can be generated based on the first neighboring user network traces and the first global sensitivity of the first user network traces, combined with the recommended differential privacy budget. Output constraints refer to a series of rules and restrictions that need to be followed during data analysis and mining to ensure the accuracy and reliability of the results while protecting user privacy. Based on the first neighboring user network traces and the first global sensitivity of the first user network traces, the sensitivity and privacy protection requirements of data analysis and mining can be determined. By performing query operations on any two adjacent datasets, the maximum difference between the first neighboring user network trace dataset and the first user network trace dataset is calculated. The first global sensitivity is obtained by calculating the first norm distance of this maximum difference. The first global sensitivity refers to the similarity and correlation between the first neighboring user network traces and the first user network traces within the entire user group network trace set. If the first global sensitivity is high, it indicates a strong similarity and correlation between the first neighboring user network traces and the first user network traces, requiring more stringent privacy protection. Combining this with the recommended differential privacy budget can further constrain the data analysis and mining process. The recommended differential privacy budget refers to the degree of privacy loss that users are willing to accept to protect their privacy during data analysis and mining. Based on the recommended differential privacy budget, the intensity of noise addition and the degree of data obfuscation can be determined to extract as much useful information as possible while protecting privacy. Output constraints can be generated based on the first global sensitivity and the recommended differential privacy budget. The constraint is R = F(D) + Lap(a / b), where R is the constraint, F(D) is a random function, a is the first global sensitivity, and b is the recommended differential privacy budget. The magnitude of the constraint is directly proportional to the first global sensitivity and inversely proportional to the recommended differential privacy budget. Based on the first global sensitivity and the recommended differential privacy budget, the requirements for the accuracy and reliability of the results are determined.

[0029] When a network trace query request is received, based on the output constraints, random noise is added to the network trace of the first user and the network trace of the first neighboring user using a preset random algorithm to generate output information for feedback.

[0030] Specifically, upon receiving a network trace query request, based on output constraints and a preset random algorithm, random noise is added to the network traces of the first user and the first neighboring user, generating output information for feedback. Receiving a network trace query request: When a network trace query request is received, the system begins processing the request. Determining output constraints: Based on the first global sensitivity of the first neighboring user's network trace and the first user's network trace, combined with a recommended differential privacy budget, output constraints are determined. These constraints will guide subsequent data analysis and mining. Adding random noise using a preset random algorithm: Based on the output constraints and a preset random algorithm, random noise is added to the network traces of the first user and the first neighboring user. This can be achieved by adding a certain degree of random noise to the original data to ensure privacy protection requirements. Generating output information: Based on the first user's network trace and the first neighboring user's network trace with added random noise, output information is generated. This information may include statistical analysis results, trend predictions, etc., to meet the needs of the query request. Providing feedback: The generated output information is returned to the initiator of the query request as feedback on the network trace query request. It can provide useful information to meet the needs of query requests while protecting user privacy.

[0031] When a network trace analysis request is received, high-frequency trace analysis is performed on the output information to generate high-frequency path nodes, and the high-frequency nodes are identified and then fed back.

[0032] Specifically, upon receiving a network trace analysis request, the system performs high-frequency trace analysis on the output information, generates high-frequency path node identifiers, and provides feedback. The process begins by: receiving the network trace analysis request; performing high-frequency trace analysis on the output information (which may include time-series analysis and pattern recognition to identify frequently occurring path nodes); generating high-frequency path node identifiers based on the analysis results (which may include node names, locations, and attributes to identify high-frequency path nodes in the network trace); and providing feedback to the requester by returning the generated high-frequency path node identifiers as feedback. This method identifies frequently occurring path nodes in the network trace analysis, providing useful information for further network behavior analysis and network attack detection. This differential privacy-based network trace analysis method can be applied to various network services, such as network security monitoring and network traffic analysis, to ensure network stability and security.

[0033] Furthermore, such as Figure 2As shown, the method of this application configures a first neighboring user network trace for a first user network trace based on the network trace set of a user group, wherein the first neighboring user network trace and the first user network trace have one and only one path node deviation, including:

[0034] The first network access node sequence obtained from the network trace of the first user is set as the baseline access node sequence.

[0035] Obtain the set of comparison access node sequences for the network trace set of the user group;

[0036] Traverse the set of comparison access node sequences and match the network trace of the comparison access node sequence that has one and only one path node deviation from the baseline access node sequence. This is set as the first adjacent user network trace.

[0037] When the set of comparison access node sequences lacks a network trace of a comparison access node sequence that has only one path node deviation from the baseline access node sequence, a path node is added, deleted, or replaced in the baseline access node sequence to generate the first neighboring user network trace.

[0038] Specifically, first, the network traces of the first user are obtained. This can be achieved through various methods, such as monitoring network traffic and tracking user clicks. From these network traces, the first network access node sequence can be extracted, which is a sequential list of path nodes accessed by the user in the network. This sequence is set as the baseline access node sequence for subsequent comparison and analysis. Next, a set of comparison access node sequences is obtained for the network trace set of the user group. Large-scale network monitoring and data collection are conducted to obtain a sufficient number of network trace samples. From these network traces, a set of comparison access node sequences can be extracted, which is a set of sequential lists of path nodes accessed by multiple users in the network. The set of comparison access node sequences is traversed, and network traces that deviate from the baseline access node sequence by exactly one path node are selected and set as the first adjacent user network traces. With the baseline access node sequence and the set of comparison access node sequences, the matching operation can begin. Each sequence in the set of comparison access node sequences is traversed and compared with the baseline access node sequence. If a sequence deviates from the reference sequence by exactly one path node (i.e., differs by only one node), the network trace of this sequence is set as the first neighboring user network trace. If the set of comparison access node sequences lacks a network trace for a comparison access node sequence that deviates from the reference access node sequence by exactly one path node, a path node is added, deleted, or replaced in the reference access node sequence to generate the first neighboring user network trace. If, during the comparison process, no comparison access node sequence is found to deviate from the reference access node sequence by exactly one path node, then the reference access node sequence needs to be modified to generate the first neighboring user network trace. Modification can be achieved by adding, deleting, or replacing a path node in the reference sequence. The newly generated network trace can then be used as the first neighboring user network trace for subsequent analysis and processing.

[0039] Furthermore, the method of this application combines the network trace attack transaction set and the usable information extraction transaction set to perform differential privacy budget optimization, generating a recommended differential privacy budget, including:

[0040] Obtain historical differential privacy processing logs, wherein the historical differential privacy processing logs include simulated differential attack rate, data deviation rate before and after processing, historical differential privacy budget record value, and global sensitivity record value;

[0041] The historical differential privacy budget record value and the global sensitivity record value are used as mapping inputs, and the simulated differential breach rate is used as the mapping output to configure a simulated differential breach rate prediction network.

[0042] Using the historical differential privacy budget record value and the global sensitivity record value as the mapping input, and the data deviation rate before and after processing as the mapping output, configure a data deviation rate prediction network before and after processing;

[0043] The first differential privacy budget is generated by randomly assigning values ​​based on the preset range of the differential privacy budget.

[0044] Based on the simulated differential attack rate prediction network and the data deviation rate prediction network before and after processing, the first differential privacy budget and the first global sensitivity are processed to generate the first simulated differential attack rate prediction value and the first data deviation rate prediction value before and after processing.

[0045] When the first simulated differential breach rate prediction value is less than or equal to the breach rate threshold, and the first data deviation rate prediction value before and after processing is less than or equal to the deviation rate threshold, the first differential privacy budget is set as the recommended differential privacy budget.

[0046] The random algorithm for differential privacy processing of the historical differential privacy processing logs is the same as the preset random algorithm.

[0047] Specifically, the process involves: acquiring historical differential privacy processing logs, including simulated differential breach rate, data deviation rate before and after processing, historical differential privacy budget records, and global sensitivity records. Configuring a simulated differential breach rate prediction network: using historical differential privacy budget records and global sensitivity records as mapping inputs. These inputs are processed using an algorithm or model to generate a predicted simulated differential breach rate. Configuring a data deviation rate prediction network before and after processing: using historical differential privacy budget records and global sensitivity records as mapping inputs. These inputs are processed using another algorithm or model to generate a predicted data deviation rate before and after processing. Generating a first differential privacy budget: assigning values ​​to the differential privacy budget using a random algorithm based on a preset range. This random algorithm is the same as the preset random algorithm, ensuring both randomness and privacy protection. Processing the first differential privacy budget and global sensitivity: inputting the first differential privacy budget and the first global sensitivity into the simulated differential breach rate prediction network and the data deviation rate prediction network before and after processing. Through processing by these two networks, a first simulated differential breach rate prediction and a first pre-processing data deviation rate prediction are generated. A recommended differential privacy budget is determined: if the first simulated differential breach rate prediction is less than or equal to a preset breach rate threshold, and the first pre-processing data deviation rate prediction is less than or equal to a preset deviation rate threshold, then the first differential privacy budget is set as the recommended differential privacy budget. These thresholds are standards used to determine whether the budget meets privacy protection requirements.

[0048] Furthermore, the method of this application also includes:

[0049] When the first simulated differential attack rate prediction value is greater than the attack rate threshold, or / and the first data deviation rate prediction value before and after processing is greater than the deviation rate threshold, a second differential privacy budget is generated by randomly assigning a value according to the preset range of the differential privacy budget. The second differential privacy budget is different from the first differential privacy budget.

[0050] Based on the simulated differential attack rate prediction network and the data deviation rate prediction network before and after processing, the second differential privacy budget and the first global sensitivity are processed to generate the second simulated differential attack rate prediction value and the second data deviation rate prediction value before and after processing.

[0051] When the second simulated differential breach rate prediction value is less than or equal to the breach rate threshold, and the second pre- and post-processing data deviation rate prediction value is less than or equal to the deviation rate threshold, the second differential privacy budget is set as the recommended differential privacy budget.

[0052] Otherwise, continue updating the second differential privacy budget.

[0053] Specifically, when the first simulated differential breach rate prediction is greater than the breach rate threshold, and / or the first pre- and post-processing data deviation rate prediction is greater than the deviation rate threshold, this means the current differential privacy budget may be insufficient to meet privacy protection requirements. A second differential privacy budget is generated by randomly assigning values ​​within a preset range based on the differential privacy budget: since the first budget may be insufficient, a new, higher differential privacy budget needs to be generated, i.e., the second differential privacy budget. It is ensured that the second differential privacy budget is different from the first differential privacy budget, thus attempting to provide higher privacy protection. Based on the simulated differential breach rate prediction network and the pre- and post-processing data deviation rate prediction network, the second differential privacy budget and the first global sensitivity are processed: using the second differential privacy budget and the first global sensitivity as inputs, the two prediction networks are processed. This generates the second simulated differential breach rate prediction and the second pre- and post-processing data deviation rate prediction. When the second simulated differential breach rate prediction is less than or equal to the breach rate threshold, and the second pre- and post-processing data deviation rate prediction is less than or equal to the deviation rate threshold, this means the second differential privacy budget may be a suitable budget that can provide sufficient privacy protection. Set the second differential privacy budget as the recommended differential privacy budget: Since the second differential privacy budget meets the conditions, it is set as the recommended differential privacy budget. Otherwise, continue updating the second differential privacy budget: If the second differential privacy budget does not meet the conditions, then different budgets need to be tried until a suitable budget is found.

[0054] Furthermore, such as Figure 3 As shown, the method of this application also includes:

[0055] If the recommended differential privacy budget still does not appear after the number of differential privacy budget updates reaches the preset number, the differential privacy budget solution set is backtracked.

[0056] Configure a fitness function, traverse the differential privacy budget solution set to perform calculations, and generate a fitness evaluation value set, wherein the fitness function is a minimization optimization function;

[0057] Based on the fitness evaluation value set from smallest to largest, a preset number of head solutions are selected from the differential privacy budget solution set;

[0058] Based on a preset perturbation step size range, the preset number of head solutions are randomly perturbed to generate a differential privacy budget extended solution set;

[0059] Differential privacy budget optimization is performed based on the expanded solution set of the differential privacy budget to generate the recommended differential privacy budget.

[0060] Specifically, if a recommended differential privacy budget still hasn't appeared after a preset number of updates, it means the randomly generated differential privacy budget failed to meet the conditions. The process involves: 1. Backtracking the differential privacy budget solution set: Returning to the previous solution set and reconsidering possible solutions. 2. Configuring the fitness function: To select a suitable solution from the differential privacy budget solution set, an evaluation criterion is needed, which is the fitness function. This fitness function is a minimization optimization function used to evaluate the quality of each solution. 3. Iterating through the differential privacy budget solution set to generate a fitness evaluation value set: Using the fitness function to evaluate the quality of each differential privacy budget solution and generating a fitness evaluation value set. 4. Selecting a preset number of top solutions from the differential privacy budget solution set in ascending order of fitness evaluation values: To find the best solution, the solution with the smallest fitness evaluation value is selected. Here, "preset number of top solutions" refers to the top N solutions with the smallest fitness evaluation values. 5. Randomly perturbing the preset number of top solutions based on a preset perturbation step size interval to generate an expanded differential privacy budget solution set: To find better solutions, the selected solutions are randomly perturbed. The perturbation range is a preset perturbation step size interval. The perturbed solution set is called the differential privacy budget augmented solution set. Differential privacy budget optimization is performed based on the augmented solution set to generate a recommended differential privacy budget: differential privacy budget optimization is performed using the new augmented solution set. The optimized solution is the recommended differential privacy budget we are looking for.

[0061] Furthermore, the method of this application also includes:

[0062]

[0063] Where, fit represents the fitness evaluation value of any solution, p1 represents the predicted value of the simulated differential capture rate, p2 represents the predicted value of the data deviation rate before and after processing, and p 10 The threshold representing the capture rate, p 20 Characterize the deviation rate threshold.

[0064] Specifically, the fitness function is used to evaluate the quality or fitness of a solution. In differential privacy budget optimization problems, the fitness function is often used to compare the effectiveness of different budget schemes. The simulated differential breach rate prediction and the predicted data bias rate before and after processing are obtained through historical differential privacy processing logs and a prediction network.

[0065] Furthermore, the method of this application, upon receiving a network trace analysis request, performs high-frequency trace analysis on the output information, generates high-frequency path nodes, identifies the high-frequency path nodes, and then feeds them back, including:

[0066] Based on the output information, the trigger frequency information of several path nodes is statistically analyzed;

[0067] Path nodes whose trigger frequency information is greater than or equal to the trigger frequency threshold are identified, and the high-frequency path node identifiers are generated and then fed back.

[0068] Specifically, based on the output information, the trigger frequency information of several path nodes is statistically analyzed. This includes the statistics of the trigger frequency of path nodes. This is typically done by analyzing system output information, such as logs and event records, to identify and record the trigger count of each path node. Path nodes with trigger frequencies greater than or equal to a trigger frequency threshold are then identified: this includes setting and applying the threshold. Only when the trigger frequency of a path node exceeds or equals the set trigger frequency threshold will it be identified as a high-frequency path node. High-frequency path node identifiers are then generated and fed back: this step involves providing feedback to the identified high-frequency path nodes. The specific form of feedback can vary, such as informing relevant personnel through logs, warnings, or notifications. This feedback helps in understanding system behavior, identifying potential problems or bottlenecks, and allowing for corresponding optimizations or adjustments.

[0069] Example 2

[0070] Based on the same inventive concept as the differential privacy-based network trace analysis method described in the foregoing embodiments, such as Figure 4 As shown, this application provides a network tracking analysis system based on differential privacy, the system comprising:

[0071] The first adjacent user network trace configuration module 10 configures the first adjacent user network trace for the first user network trace based on the network trace set of the user group. The first adjacent user network trace and the first user network trace have one and only one path node deviation.

[0072] The recommended differential privacy budget generation module 20 is used to combine the network trace attack transaction set and the available information extraction transaction set to perform differential privacy budget optimization and generate a recommended differential privacy budget.

[0073] The output constraint generation module 30 generates output constraints based on the first neighboring user network trace and the first global sensitivity of the first user network trace, combined with the recommended differential privacy budget.

[0074] The output information generation module 40 is used to generate output information for feedback when a network trace query request is received, based on the output constraints and combined with a preset random algorithm, to add random noise to the first user's network trace and the first neighboring user's network trace.

[0075] The high-frequency path node identifier generation module 50 is used to perform high-frequency path analysis on the output information when a network trace analysis request is received, generate high-frequency path nodes, identify the high-frequency nodes, and then provide feedback.

[0076] Furthermore, the system also includes:

[0077] The node sequence set access comparison module is used to obtain the first network access node sequence of the first user's network trace, which is set as the baseline access node sequence; obtain the comparison access node sequence set of the network trace set of the user group; traverse the comparison access node sequence set and match the network trace of the comparison access node sequence that has only one path node deviation from the baseline access node sequence, which is set as the first adjacent user network trace; when the comparison access node sequence set lacks a network trace of the comparison access node sequence that has only one path node deviation from the baseline access node sequence, add, delete, or replace a path node in the baseline access node sequence to generate the first adjacent user network trace.

[0078] Furthermore, the system also includes:

[0079] The processing log acquisition module is used to obtain historical differential privacy processing logs, wherein the historical differential privacy processing logs include simulated differential attack rate, data deviation rate before and after processing, historical differential privacy budget record value, and global sensitivity record value; a simulated differential attack rate prediction network is configured with the historical differential privacy budget record value and the global sensitivity record value as mapping inputs and the simulated differential attack rate as mapping output; a data deviation rate prediction network is configured with the historical differential privacy budget record value and the global sensitivity record value as mapping inputs and the data deviation rate before and after processing as mapping outputs; and randomization is performed according to a preset range of differential privacy budget. The system assigns values ​​to generate a first differential privacy budget. Based on the simulated differential breach rate prediction network and the data deviation rate prediction network before and after processing, the first differential privacy budget and the first global sensitivity are processed to generate a first simulated differential breach rate prediction value and a first data deviation rate prediction value before and after processing. When the first simulated differential breach rate prediction value is less than or equal to the breach rate threshold, and the first data deviation rate prediction value before and after processing is less than or equal to the deviation rate threshold, the first differential privacy budget is set as the recommended differential privacy budget. The random algorithm for differential privacy processing in the historical differential privacy processing logs is the same as the preset random algorithm.

[0080] Furthermore, the system also includes:

[0081] The second differential privacy budget update module is used to generate a second differential privacy budget by randomly assigning values ​​according to a preset range of the differential privacy budget when the first simulated differential breach rate prediction value is greater than the breach rate threshold, or / and the first pre- and post-processing data deviation rate prediction value is greater than the deviation rate threshold. The second differential privacy budget is different from the first differential privacy budget. Based on the simulated differential breach rate prediction network and the pre- and post-processing data deviation rate prediction network, the module processes the second differential privacy budget and the first global sensitivity to generate a second simulated differential breach rate prediction value and a second pre- and post-processing data deviation rate prediction value. When the second simulated differential breach rate prediction value is less than or equal to the breach rate threshold, and the second pre- and post-processing data deviation rate prediction value is less than or equal to the deviation rate threshold, the module sets the second differential privacy budget to the recommended differential privacy budget; otherwise, it continues to update the second differential privacy budget.

[0082] Furthermore, the system also includes:

[0083] A differential privacy budget generation module is used to backtrack the differential privacy budget solution set when the differential privacy budget has been updated a preset number of times and the recommended differential privacy budget still has not appeared; configure a fitness function, traverse the differential privacy budget solution set for calculation, and generate a fitness evaluation value set, wherein the fitness function is a minimization optimization function; select a preset number of head solutions from the differential privacy budget solution set in ascending order based on the fitness evaluation value set; randomly perturb the preset number of head solutions based on a preset perturbation step size interval to generate a differential privacy budget expanded solution set; perform differential privacy budget optimization based on the differential privacy budget expanded solution set to generate the recommended differential privacy budget.

[0084] Furthermore, the system also includes:

[0085] The identification feedback module is used to count the trigger frequency information of several path nodes based on the output information; identify the path nodes whose trigger frequency information is greater than or equal to the trigger frequency threshold, generate the high-frequency path node identification, and then provide feedback.

[0086] Through the detailed description of the differential privacy-based network trace analysis method described above, those skilled in the art can clearly understand the differential privacy-based network trace analysis system in this embodiment. As the system disclosed in the embodiment corresponds to the device disclosed in the embodiment, the description is relatively simple, and relevant parts can be referred to the method section.

[0087] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network trace analysis method based on differential privacy, characterized in that, include: Based on the network trace set of a user group, configure a first neighboring user network trace for the first user network trace, wherein the first neighboring user network trace and the first user network trace have one and only one path node deviation. Differential privacy budget optimization is performed by combining the network trace attack transaction set and the available information extraction transaction set to generate a recommended differential privacy budget; Based on the first neighboring user network trace and the first global sensitivity of the first user network trace, and combined with the recommended differential privacy budget, output constraints are generated. When a network trace query request is received, based on the output constraints, random noise is added to the first user's network trace and the first neighboring user's network trace using a preset random algorithm to generate output information for feedback. When a network trace analysis request is received, high-frequency trace analysis is performed on the output information to generate high-frequency path nodes, and the high-frequency path nodes are identified and then fed back.

2. The method as described in claim 1, characterized in that, Based on the network trace set of a user group, a first neighboring user network trace is configured for the first user network trace, wherein the first neighboring user network trace and the first user network trace have one and only one path node deviation, including: The first network access node sequence obtained from the network trace of the first user is set as the baseline access node sequence. Obtain the set of comparison access node sequences for the network trace set of the user group; Traverse the set of comparison access node sequences and match the network trace of the comparison access node sequence that has one and only one path node deviation from the baseline access node sequence. This is set as the first adjacent user network trace. When the set of comparison access node sequences lacks a network trace of a comparison access node sequence that has a deviation of only one path node from the baseline access node sequence, a path node is added, deleted, or replaced in the baseline access node sequence to generate the first neighboring user network trace.

3. The method as described in claim 1, characterized in that, Differential privacy budget optimization is performed by combining the network trace attack transaction set and the usable information extraction transaction set to generate a recommended differential privacy budget, including: Obtain historical differential privacy processing logs, wherein the historical differential privacy processing logs include simulated differential attack rate, data deviation rate before and after processing, historical differential privacy budget record value, and global sensitivity record value; The historical differential privacy budget record value and the global sensitivity record value are used as mapping inputs, and the simulated differential breach rate is used as the mapping output to configure a simulated differential breach rate prediction network. Using the historical differential privacy budget record value and the global sensitivity record value as the mapping input, and the data deviation rate before and after processing as the mapping output, configure a data deviation rate prediction network before and after processing; The first differential privacy budget is generated by randomly assigning values ​​based on the preset range of the differential privacy budget. Based on the simulated differential attack rate prediction network and the data deviation rate prediction network before and after processing, the first differential privacy budget and the first global sensitivity are processed to generate the first simulated differential attack rate prediction value and the first data deviation rate prediction value before and after processing. When the first simulated differential breach rate prediction value is less than or equal to the breach rate threshold, and the first data deviation rate prediction value before and after processing is less than or equal to the deviation rate threshold, the first differential privacy budget is set as the recommended differential privacy budget. The random algorithm for differential privacy processing of the historical differential privacy processing logs is the same as the preset random algorithm.

4. The method as described in claim 3, characterized in that, Also includes: When the first simulated differential attack rate prediction value is greater than the attack rate threshold, or / and the first data deviation rate prediction value before and after processing is greater than the deviation rate threshold, a second differential privacy budget is generated by randomly assigning a value according to the preset range of the differential privacy budget. The second differential privacy budget is different from the first differential privacy budget. Based on the simulated differential attack rate prediction network and the data deviation rate prediction network before and after processing, the second differential privacy budget and the first global sensitivity are processed to generate the second simulated differential attack rate prediction value and the second data deviation rate prediction value before and after processing. When the second simulated differential breach rate prediction value is less than or equal to the breach rate threshold, and the second pre- and post-processing data deviation rate prediction value is less than or equal to the deviation rate threshold, the second differential privacy budget is set as the recommended differential privacy budget. Otherwise, continue updating the second differential privacy budget.

5. The method as described in claim 4, characterized in that, Also includes: If the recommended differential privacy budget still does not appear after the preset number of differential privacy budget updates, the differential privacy budget solution set is backtracked. Configure a fitness function, traverse the differential privacy budget solution set to perform calculations, and generate a fitness evaluation value set, wherein the fitness function is a minimization optimization function; Based on the fitness evaluation value set from smallest to largest, a preset number of head solutions are selected from the differential privacy budget solution set; Based on a preset perturbation step size range, the preset number of head solutions are randomly perturbed to generate a differential privacy budget extended solution set; Differential privacy budget optimization is performed based on the expanded solution set of the differential privacy budget to generate the recommended differential privacy budget.

6. The method as described in claim 5, characterized in that, The fitness function is: Where, fit represents the fitness evaluation value of any solution, p1 represents the predicted value of the simulated differential capture rate, p2 represents the predicted value of the data deviation rate before and after processing, and p 10 The threshold representing the capture rate, p 20 Characterize the deviation rate threshold.

7. The method as described in claim 1, characterized in that, Upon receiving a network trace analysis request, high-frequency trace analysis is performed on the output information to generate high-frequency path nodes. These high-frequency path nodes are then identified and fed back, including: Based on the output information, the trigger frequency information of several path nodes is statistically analyzed; Path nodes whose trigger frequency information is greater than or equal to the trigger frequency threshold are identified, and the high-frequency path node identifiers are generated and then fed back.

8. A network tracking analysis system based on differential privacy, characterized in that, include: The first adjacent user network trace configuration module configures the first adjacent user network trace for the first user network trace based on the network trace set of the user group. The first adjacent user network trace and the first user network trace have one and only one path node deviation. A recommended differential privacy budget generation module is used to combine the network trace attack transaction set and the available information extraction transaction set to perform differential privacy budget optimization and generate a recommended differential privacy budget. The output constraint generation module generates output constraints based on the first neighboring user network trace and the first global sensitivity of the first user network trace, combined with the recommended differential privacy budget. The output information generation module is used to generate output information for feedback when a network trace query request is received, based on the output constraints and combined with a preset random algorithm, to add random noise to the first user's network trace and the first neighboring user's network trace. A high-frequency path node identifier generation module is used to perform high-frequency path analysis on the output information when a network trace analysis request is received, generate high-frequency path nodes, identify the high-frequency path nodes, and then provide feedback.

9. The system as described in claim 8, characterized in that, It also includes a node sequence set access comparison module, the execution steps of which include: The first network access node sequence obtained from the network trace of the first user is set as the baseline access node sequence. Obtain the set of comparison access node sequences of the network trace set of the user group; traverse the set of comparison access node sequences, and match the network trace of the comparison access node sequence that has only one path node deviation from the baseline access node sequence, and set it as the first adjacent user network trace. When the set of comparison access node sequences lacks a network trace of a comparison access node sequence that has a deviation of only one path node from the baseline access node sequence, a path node is added, deleted, or replaced in the baseline access node sequence to generate the first neighboring user network trace.

10. The system as described in claim 8, characterized in that, It also includes a log acquisition processing module, which performs the following steps: Obtain historical differential privacy processing logs, wherein the historical differential privacy processing logs include simulated differential attack rate, data deviation rate before and after processing, historical differential privacy budget record value, and global sensitivity record value; The historical differential privacy budget record value and the global sensitivity record value are used as mapping inputs, and the simulated differential breach rate is used as the mapping output to configure a simulated differential breach rate prediction network. Using the historical differential privacy budget record value and the global sensitivity record value as the mapping input, and the data deviation rate before and after processing as the mapping output, configure a data deviation rate prediction network before and after processing; The first differential privacy budget is generated by randomly assigning values ​​based on the preset range of the differential privacy budget. Based on the simulated differential attack rate prediction network and the data deviation rate prediction network before and after processing, the first differential privacy budget and the first global sensitivity are processed to generate the first simulated differential attack rate prediction value and the first data deviation rate prediction value before and after processing. When the first simulated differential breach rate prediction value is less than or equal to the breach rate threshold, and the first data deviation rate prediction value before and after processing is less than or equal to the deviation rate threshold, the first differential privacy budget is set as the recommended differential privacy budget. The random algorithm for differential privacy processing of the historical differential privacy processing logs is the same as the preset random algorithm.

Images