Method for determining distribution of correlation degree of anonymous network traffic, correlation method and device

Abstract

This invention discloses a method, method, and apparatus for determining the correlation distribution of anonymous network traffic, belonging to the field of network security. The method includes the following steps: S11, establishing multiple pairs of communication sources and targets using an anonymous communication network for anonymous communication; S12, collecting the sending traffic of the communication sources and the receiving traffic of the targets under different anonymous network configurations; S13, extracting the time-series characteristics of the sending and receiving traffic under different anonymous network configurations; S14, using a traffic correlation algorithm based on matching the time-series characteristics of communication data volume, calculating the correlation distribution between the communicating parties and non-communicating parties under different anonymous network configurations; S15, calculating the center value of the correlation between the communicating parties and non-communicating parties under different anonymous network configurations. This invention can achieve more accurate and faster correlation results.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to a method, method and apparatus for determining the correlation distribution of anonymous network traffic. Background Technology

[0002] Anonymous network traffic correlation is an important research area in cybersecurity. It refers to the analysis and correlation of traffic data generated in anonymous network environments to identify and trace the source and destination of data flows within the network. This process involves breaking or bypassing the anonymity of traffic to achieve the tracking and auditing of network behavior. Anonymous network traffic correlation technology has application value in scenarios such as network attack attribution, malicious behavior tracking, and cybercrime evidence collection.

[0003] Existing methods for anonymized network traffic association can be broadly categorized into traffic feature matching, watermark modulation detection, artificial intelligence recognition, traffic fingerprinting, and proactive penetration tracing. Among traffic feature matching-based methods, matching schemes using temporal data volume features have gained attention and application. These schemes identify the communication relationship between the sender and receiver by comparing the changes in network data volume over time. To quantify the differences in network data volume over time between two traffic streams, methods such as Euclidean distance, Manhattan distance (L1 distance), dynamic time warp (DTW), and area difference between curve regions can be used. In addition, the Raptor method proposed by Sun Yixin et al. uses the Spearman similarity algorithm to quantify the similarity of the temporal envelopes of data volume between the sender and receiver. It has achieved excellent results in traffic association work on anonymous communication networks such as Tor, becoming a typical traffic association method based on temporal network data volume feature matching in recent years.

[0004] With the development of traffic obfuscation technology, criminals are using various communication feature obfuscation techniques to combat network traffic correlation techniques and evade network attribution and auditing. Among these, randomization obfuscation techniques disrupt the temporal characteristics of traffic data through methods such as random packet padding, randomized adjustment of transmission timing, and randomized adjustment of transmission intervals, thereby countering traffic correlation techniques based on matching data volume temporal characteristics. For example, the Tor network uses obfs4 obfuscation technology to achieve this function, and the Mixnet privacy platform achieves this by using packet fragmentation and encapsulation, randomization obfuscation, and multi-path concurrent transmission.

[0005] The dynamic uncertainty of the internet's state and the use of traffic obfuscation techniques blur the temporal characteristics of network flow data, increasing the randomness of traffic association quantification results and thus reducing their accuracy. Through practical experience in network traffic association, it has been found that despite these interferences, vulnerabilities in the traffic obfuscation mechanism and deficiencies in the implementation of obfuscation techniques mean that, although the accuracy of a single traffic collection association is low, the association quantification results can exhibit a regular distribution over multiple rounds of collection and association. This distribution is not only directly affected by the anonymized network configuration but also reflects the actual communication relationship between the parties to be associated. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, method and apparatus for measuring the correlation distribution of anonymous network traffic. This invention addresses the technical problem that the dynamic uncertainty of the Internet's state and the use of traffic obfuscation techniques lead to the ambiguity of the temporal characteristics of network flow data, resulting in low correlation accuracy of traffic correlation techniques based on the temporal characteristics matching of communication data.

[0007] The objective of this invention is achieved through the following solution:

[0008] A method for determining the correlation distribution of anonymous network traffic under different configurations includes the following steps:

[0009] S11, establish multiple communication sources and communication targets that use anonymous communication networks for anonymous communication;

[0010] S12, under different anonymous network configuration conditions, collect the sending traffic of the source and the receiving traffic of the target;

[0011] S13, extract the time-series characteristics of the data volume of the transmitted and received traffic under different anonymous network configuration conditions;

[0012] S14, using a traffic association algorithm based on the time-series characteristics of communication data volume, calculate the distribution of the association degree between the communicating parties and the non-communicating parties under different anonymous network configuration conditions;

[0013] S15, calculate the central value of the correlation between the communicating parties and the non-communicating parties under different anonymous network configurations.

[0014] Furthermore, in step S11, the establishment of multiple pairs of communication sources and communication targets using an anonymous communication network for anonymous communication specifically includes the following sub-steps:

[0015] First, determine the type of anonymous service network. Then, add client nodes that act as communicators to the anonymous communication network according to the determined type. The method of adding client nodes follows the usage method of the determined anonymous communication network and is performed in accordance with the relevant official documents. Finally, use the added clients to generate communication traffic and build multiple pairs of mutual communication source clients and communication target clients. In each pair, the source and target clients only communicate with each other and do not communicate with other clients.

[0016] Furthermore, in step S12, the collection of the source's transmission traffic and the target's reception traffic under different anonymous network configuration conditions specifically includes the following sub-steps: the collection of transmission traffic and reception traffic can be carried out manually or automatically. Manual collection involves manually running traffic capture tools at both the communication source and the communication target to collect traffic. Automatic collection involves writing traffic collection scripts or developing a system to collect traffic using a unified management, instruction distribution, distributed collection, and automatic traffic collection method.

[0017] Further, in step S13, the extraction of the data volume timing characteristics of transmitted and received traffic under different anonymous network configuration conditions specifically includes the following sub-steps:

[0018] For each anonymous network configuration, extract the time-series characteristics of all transmitted and received traffic. The time-series characteristics of communication data are extracted from the original collected traffic by removing the timestamp and the corresponding data packet length. In the data extraction example, the extracted time-series characteristic file has only two columns: the first column is the timestamp, and the second column is the data packet length. All other necessary information is written into the filename, which is formatted as: [source|destination]_{listening node}_{source IP}_{destination IP}_{source port}_{destination port}_{protocol}.txt.

[0019] Further, in step S14, the flow association algorithm based on the time-series characteristics of communication data volume is used to calculate the distribution of the association degree between the communicating parties and the non-communicating parties under different anonymous network configuration conditions. This specifically includes the following sub-steps:

[0020] For any configuration combination, the sending and receiving time-series feature files of communicating clients are first grouped together to form a communication group; then, the sending and receiving time-series feature files of non-communicating clients are cross-paired to form non-communication groups. Based on a traffic association algorithm matching communication data volume time-series features, the data volume time-series features of each pair of sending traffic and receiving traffic in each communication group and non-communication group under each configuration are compared to calculate a value characterizing the degree of correlation between the two. This value is called the "correlation degree" and is expressed as:

[0021] Similarity(flow src ,flow trg ) = F CORR (T src ,T tsg ,S src ,S trg )

[0022] In the above formula, Similarity represents the degree of correlation, and flow src This indicates the traffic sent by the communication source to be associated, flow trg F represents the received traffic of the communication target to be associated. CORR T represents a specific traffic association algorithm. src T represents the timestamp vector of data packets sent in the traffic. trg S represents the timestamp vector of received traffic packets. src S represents the vector of packet sizes in the transmitted traffic. trg A vector representing the size of the data packets received;

[0023] Then, the sets of correlation degrees of communication groups and non-communication groups calculated for each configuration are summarized and organized to obtain the numerical distribution of correlation degrees between the communicating parties and non-communication parties under different anonymous network configuration conditions. The distribution is presented in multiple ways.

[0024] Further, in step S15, the calculation of the central value of the correlation between the communicating parties and the non-communicating parties under different anonymous network configuration conditions specifically includes the following sub-steps:

[0025] Using the distribution of correlation between the communicating parties and the non-communicating parties under different anonymous network configurations obtained in step S14, the central value of the correlation is calculated. The central value is defined according to the actual application situation, including using the arithmetic mean and median as the central value of the correlation.

[0026] An anonymous network traffic correlation method based on multi-round statistical feature approximation includes the following steps:

[0027] By utilizing the correlation distribution measurement method of anonymous network traffic under different configurations as described above, prior knowledge and data foundation for conducting traffic correlation determination are obtained; then, traffic correlation determination based on statistical feature approximation is performed under multiple rounds of sampling, and the central value of the correlation between the communicating parties and non-communicating parties under different anonymous network configurations is used to identify whether there is a communication relationship between the sending and receiving traffic to be correlated.

[0028] Furthermore, the traffic correlation determination based on statistical feature approximation under multi-round sampling utilizes the central value of the correlation between the communicating parties and non-communicating parties under different anonymity network configurations to identify whether there is a communication relationship between the proposed associated sending and receiving traffic. This specifically includes the following sub-steps:

[0029] S21, Based on the anonymous network configuration, determine the traffic correlation judgment threshold based on the correlation center value: The traffic correlation judgment threshold is used to compare with the traffic correlation of the two parties to be correlated, thereby identifying the communication correlation relationship between the two parties to be correlated. The judgment threshold is set as the arithmetic mean of the center value of the correlation of the two communicating parties and the center value of the correlation of the non-communicating parties.

[0030] S22, start a new round of traffic collection and extract the time-series characteristics of the communication data volume of the two parties to be associated: collect the sending traffic of the source and the receiving traffic of the target, and then extract the time-series characteristics of the data volume of the sending traffic and the receiving traffic.

[0031] S23, Calculate the correlation degree using a traffic correlation algorithm based on the data collected in this round: Based on the traffic and extracted data volume time-series characteristics collected in step S22, use a traffic correlation algorithm based on matching communication data volume time-series characteristics to calculate the correlation degree between the source's transmitted traffic and the target's received traffic. Then, use C... n This indicates that n is the number of rounds of data collection and processing in this round;

[0032] S24, Add the correlation score to the correlation score record queue: Add the correlation score calculated in step S23 to the correlation score record queue. Let Q represent the queue. If the current round is the first round of data collection and processing, i.e., the correlation score is C1, then create a new empty queue to record the correlation score. In this case, Q = [C1]. If the current round is not the first round, i.e., the correlation score is C... n If |(n≠1), then add the correlation degree to the tail of the queue, at which point Q=[C1,C2,...,C n ];

[0033] S25, Collection End Judgment: The collection end judgment is used to determine whether the current round of traffic collection and processing is the last round, that is, whether a new round of traffic collection and correlation calculation is needed. The basis for the collection end judgment is the preset maximum number of rounds. The current round number is compared with the preset round number. When the current round number reaches the preset round number, the traffic collection and correlation calculation process ends. The preset maximum number of rounds is a parameter specified based on past actual correlation experience.

[0034] S26, Calculate the central value of the correlation degree based on the correlation degree record queue: The central value is defined according to the actual application situation, including using the arithmetic mean and median as the central value of the correlation degree;

[0035] S27, Relevance Determination: Compare the central value of the correlation obtained in step S26 with the determination threshold. If the central value of the correlation is greater than or equal to the determination threshold, it is determined to be correlated; otherwise, it is determined to be uncorrelated.

[0036] Further, in step S21, setting the determination threshold as the arithmetic mean of the median value of the correlation between the communicating parties and the median value of the correlation between the non-communicating parties specifically includes the following sub-steps: In actual operation, the threshold is calculated in the following two cases:

[0037] Anonymous network configuration is visible to related parties: read the center value of the correlation between the communicating and non-communicating parties under the anonymous network configuration, and calculate their arithmetic mean as the judgment threshold;

[0038] Anonymous network configurations are not visible to related parties: Read the center value of the correlation between the communicating and non-communicating parties under the network configuration that makes the center value of the correlation between the communicating and non-communicating parties closest, and calculate their arithmetic mean as the judgment threshold.

[0039] An anonymous network traffic association device includes a processor and a memory, wherein the memory stores a computer program that executes the method described above when the computer program is loaded by the processor.

[0040] The beneficial effects of this invention include:

[0041] This invention proposes an anonymous network traffic association scheme based on multi-round statistical feature approximation. Under different anonymous network configurations, the key distribution features are defined and extracted by comprehensively considering the association results from multiple rounds. By increasing the number of association rounds for the traffic to be associated, and taking into account the influence of the anonymous network configuration, the statistical features of the association results are made to approximate the key distribution features of the association results that can correctly distinguish the actual communication association relationships. The association relationship of the traffic to be associated is then determined by threshold comparison.

[0042] This invention utilizes the statistical regularities of multi-round traffic association quantification results to optimize the single-round traffic association model using a statistical feature approximation method. This overcomes the dynamic uncertainties inherent in the state of the internet itself and, to a certain extent, eliminates interference from traffic obfuscation techniques, significantly improving the discrimination accuracy and precision of traffic association algorithms based on the temporal characteristics of communication data volume matching. Furthermore, this invention fully considers the impact of different anonymity network configurations on the distribution patterns of association quantification results, adjusting the association determination threshold according to the actual network configuration, thus achieving more accurate and faster association results. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 A model for the association of anonymous network traffic;

[0045] Figure 2 The steps for determining the correlation distribution of anonymous network traffic under different configurations;

[0046] Figure 3 Examples are built for communication sources and communication targets;

[0047] Figure 4 For traffic correlation system architecture;

[0048] Figure 5 Screenshot of data extraction example;

[0049] Figure 6 Divided into communication groups and non-communication groups;

[0050] Figure 7 Examples of the correlation distribution between communicating parties and non-communicating parties under different anonymity network configurations;

[0051] Figure 8 A process for determining traffic correlation based on statistical feature approximation under multiple rounds of sampling;

[0052] Figure 9a The accuracy of traffic association performance (network configuration unknown) approximating the median of association degree across multiple rounds;

[0053] Figure 9b The accuracy of traffic association effect (network configuration unknown) approximating the median of association degree in multiple rounds;

[0054] Figure 10a The accuracy of traffic association performance (network configuration known) approximating the median of association degree across multiple rounds;

[0055] Figure 10b The accuracy of traffic association results approximating the median of association degree across multiple rounds (network configuration known). Detailed Implementation

[0056] All features disclosed in all embodiments of this specification, or steps in all methods or processes implied in the disclosure, may be combined and / or extended or replaced in any way, except for mutually exclusive features and / or steps.

[0057] To address the problems mentioned in the background, this invention proposes an anonymous network traffic association method based on multi-round statistical feature approximation. Under different anonymous network configurations, the key distribution features are defined and extracted by comprehensively considering the association results from multiple rounds. By increasing the number of association rounds for the traffic to be associated, and considering the influence of anonymous network configuration, the statistical features of the association results are made to approximate the key distribution features of the association results that can correctly distinguish the actual communication association relationships. The association relationship of the traffic to be associated is then determined through threshold comparison. This invention utilizes the statistical regularity of the multi-round traffic association quantification results and optimizes the single-round traffic association model with a statistical feature approximation method. This overcomes the dynamic uncertainty of the Internet's own state and, to a certain extent, eliminates the interference of traffic obfuscation techniques, significantly improving the discrimination accuracy and precision of traffic association algorithms based on the temporal feature matching of communication data volume. Furthermore, this invention fully considers the influence of different anonymous network configurations on the distribution regularity of the association quantification results, adjusting the calculated association judgment threshold according to the actual network configuration, thus achieving more accurate and faster association results. This invention helps maintain the technical advantage of network monitoring and prevent and combat cybercrime.

[0058] The traffic association application scenario model of this invention is as follows: Figure 1 As shown. The technology of this invention is applied to, for example... Figure 1 The diagram illustrates an anonymous network traffic association scenario. Communication sources 1, 2, 3 up to i and communication targets 1, 2, 3 up to k utilize an anonymous service network including relays 1, 2, 3 up to j to conduct anonymous communication. This scenario requires the installation of sender-end monitoring and receiver-end monitoring facilities between the communication sources and the ingress relay nodes, and between the egress relay nodes and the communication targets, respectively, to monitor the traffic at both the communication source and target ends. Figure 1 In the scenario shown, a transmitting end monitoring facility is deployed between source 1 and relay 1. This facility can be deployed at the exit of source 1, the corresponding entry of relay 1, or the traffic forwarding device between the two. Here, it is uniformly represented by the midpoint of the line connecting source 1 and relay 1, denoted as transmit 11. Similarly, there are transmitting end monitoring points transmit 21, transmit 34, and transmit i7 (but in actual implementation, this limitation does not apply). A receiving end monitoring facility is deployed between relay 3 and target 1. This facility can be deployed at the corresponding exit of relay 3, the entry of target 1, or the traffic forwarding device between the two. Here, it is uniformly represented by the midpoint of the line connecting relay 3 and target 1, denoted as receive 31. Similarly, there are receiving end monitoring points receive 62, receive 63, and receive 9k. During the external communication process between these communication source nodes and communication target nodes, network traffic at the corresponding locations can be captured through transmitting end monitoring and receiving end monitoring. The goal of anonymous network traffic association is to identify the source node and target node that are communicating. For example, in Figure 1In this process, it is necessary to identify, through traffic information association, that source 2 is communicating with target 3, while source i is communicating with target 1.

[0059] In a further specific embodiment, the technical solution of the present invention mainly includes the following two aspects:

[0060] 1. Determination of the correlation distribution of anonymous network traffic under different configurations

[0061] The steps for determining the correlation distribution of anonymous network traffic under different configurations are as follows: Figure 2 As shown, the purpose of this part is to obtain the prior knowledge and data foundation for later traffic correlation determination.

[0062] The steps are as follows:

[0063] (1) Establish multiple pairs of communication sources and communication targets that use anonymous communication networks for anonymous communication.

[0064] This step primarily involves setting up the experimental environment for determining the correlation distribution. First, determine the type of anonymous service network being studied, such as Tor, I2P, or Mixnet networks. Then, add client nodes (acting as communicators) to the anonymous communication network according to the determined type. The method for adding client nodes follows the usage instructions of the chosen anonymous communication network and can be performed according to the relevant official documentation. Finally, use the added clients to generate communication traffic, constructing multiple pairs of communicating source and target clients. Within each pair, the source and target clients only communicate with each other and not with other clients.

[0065] For example, using a Mixnet network to build an anonymous communication system, adding 20 servers to the Mixnet network can create 10 pairs of communication sources and targets that utilize the Mixnet obfuscation network for anonymous communication. Figure 3 As shown.

[0066] exist Figure 3In the source-destination client architecture shown, each row contains a pair of source and destination clients that communicate anonymously with each other via the Mixnet network. Each pair of source and destination clients only communicates with each other and not with other clients. Generally, communication includes uplink traffic (the communication data stream from the communication source to the communication destination) and downlink traffic (the communication data stream from the communication destination to the communication source). Because the traffic association algorithm based on the timing characteristics of communication data volume involved in this invention only requires traffic data in one direction to work, this paper only uses uplink traffic as an example for explanation. When using the method of this invention to perform traffic association between source and destination clients using downlink traffic, the principle is the same as when using uplink traffic for traffic association; only the data sender and receiver interchange, i.e., intercepting the sent traffic from the communication destination and intercepting the received traffic from the communication source.

[0067] (2) Collect the source's transmission traffic and the target's reception traffic under different anonymous network configurations.

[0068] Regarding anonymous network configuration conditions: Different anonymous networks have their own unique configuration options. The settings of these options will affect the relevance of communication within the anonymous network to varying degrees. Therefore, the timing characteristics of the data volume of transmitted and received traffic differ under different anonymous network configuration conditions. Consequently, it is necessary to collect the transmitted traffic of the source and the received traffic of the target under different anonymous network configuration conditions.

[0069] For different anonymous networks, there are many configurations related to associativity. Traversing all configurations would be time-consuming and costly to analyze. It is advisable to filter based on the specific needs of the task. For example, the main configuration items related to associativity for Tor, I2P, and Mixnet networks are shown in Tables 1, 2, and 3, respectively.

[0070] Table 1: Key Configuration Items Related to Tor Network Connectivity

[0071]

[0072]

[0073] Table 2: Key Configuration Items Related to I2P Network Associativity

[0074] Serial Number name illustrate 1 RouterInfo Router metadata, such as public key, contact address, participation protocol, etc. 2 In- / Outbound tunnels Number of tunnels used by the router to receive and send messages 3 lookup time Searching for routers or rental sets 4 Tunnel length Number of participating routers in each tunnel 5 Tunnel lifespan Duration of the tunnel 6 Tunnel participation The frequency or number of routers participating in tunneling 7 Bandwidth limits Router bandwidth upper and lower limits 8 Congestion control Strategies for flow control and avoiding network congestion 9 Transport obfuscation Methods for obfuscating content during data transmission 10 Message padding A strategy of populating messages to increase the ability to resist traffic analysis. 11 Path selection Method for selecting router paths in a tunnel 12 Profile management Used to determine which routers to interact with and how to interact with them. 13 Network size Number of active routers in the network

[0075] Table 3: Key Configuration Items Related to the Associativity of Mixnet Networks

[0076]

[0077]

[0078] for Figure 3 In the example of anonymous communication using the Mixnet anonymous communication network, we can select three configuration items that are of general interest in applications: MessageSendingRate, DesiredRateParameter, and MessageSize, to conduct experimental observations. We will explore all possible values ​​for these parameters in the experimental design and collect sending and receiving traffic under different configuration combinations. The configuration settings for this example are shown in Table 4. According to the settings, each configuration parameter has three possible variations, resulting in a total of 27 sets of parameters. Therefore, in this example, we need to capture sending and receiving traffic under each of these 27 sets of parameters.

[0079] Table 4: Configuration Setting Examples

[0080] Serial Number variable unit Setting value 1 MessageSendingRate 1 / s 5 / 10 / 20 2 DesiredRateParameter 1 / s 5 / 10 / 20 3 MaxMessageSize bit 2048 / 10240 / 20480

[0081] Sending and receiving traffic can be collected manually or automatically. Manual collection involves running traffic capture tools such as tcpdump and wireshark at both the communication source and destination. Automatic collection involves writing traffic collection scripts or developing a system that uses unified management, command distribution, distributed collection, and automatic traffic collection. Figure 4 This paper demonstrates a top-level architecture for a traffic correlation system that can automate communication traffic data collection and traffic correlation analysis.

[0082] The traffic association system consists of a traffic association client, a traffic association service, and a listening service installed on each anonymous communication client. The traffic association service is the backend of the entire traffic association system. It receives requests from traffic association clients (not anonymous communication clients), parses the traffic collection information listed in the request, such as the source and destination IPs to be monitored, and sends the monitoring instructions in parallel to the listening service installed on each anonymous communication client. The listening service then performs the actual sending or receiving of traffic and pushes the collected traffic back to the traffic association service after the collection process is complete.

[0083] (3) Extract the time-series characteristics of data volume of transmitted and received traffic under different anonymous network configurations.

[0084] For each anonymous network configuration, extract the time-series characteristics of all transmitted and received traffic. Under a specific anonymous network configuration, the number of transmitted and received traffic pairs corresponds to the number of source-to-target pairs, thus requiring the extraction of the corresponding time-series characteristic files for transmitted and received traffic. The time-series characteristic of communication data volume refers to the change in the total length of data packets per unit time over the entire traffic acquisition period. Therefore, extracting the time-series characteristics of communication data volume requires extracting timestamps and corresponding data packet lengths from the original acquired traffic.

[0085] Data extraction sample screenshots are as follows Figure 5 As shown.

[0086] In the data extraction example, the extracted time-series feature file has only two columns: the first column is the timestamp, and the second column is the length of the data packet. To reduce the size of the data file, all other necessary information is written into the filename.

[0087] For example, the file name could be: src_172.28.1.33_None_8.211.5.35_None_3999_tcp.txt.

[0088] Its format is:

[0089] [Source|Destination]_{Monitoring Node}_{Source IP}_{Destination IP}_{Source Port}_{Destination Port}_{Protocol}.txt

[0090] for Figure 3 In the example shown, for each of the 27 configuration groups, there are 10 pairs of communication sources and communication targets. Therefore, a total of 20 time-series feature files will be extracted for each configuration group.

[0091] (4) Using a traffic association algorithm based on the time-series characteristics of communication data volume, the distribution of the association degree between the communicating parties and the non-communicating parties under different anonymous network configurations is calculated.

[0092] For any configuration combination, first, the sending and receiving timing characteristic files of clients that communicate with each other are grouped together to form a communication group; then, the sending and receiving timing characteristic files of clients that do not communicate with each other are cross-paired to form non-communication groups. Figure 3 The example shown illustrates the grouping of a specific configuration combination as follows: Figure 6 As shown.

[0093] A traffic association algorithm based on matching the timing characteristics of communication data volume compares the timing characteristics of the data volume of each pair of transmitted traffic with those of the received traffic in each communication group and non-communication group under each configuration, calculating a value characterizing the degree of correlation between the two. In this invention, this value is referred to as the "correlation degree". This traffic association method can be generally expressed as:

[0094] Similarity(flow src ,flow trg ) = F CORR (T src ,T trg ,S src ,S trg )

[0095] In the above formula, Similarity represents the degree of correlation, and flow src This indicates the traffic sent by the communication source to be associated, flow trg F represents the received traffic of the communication target to be associated. CORR T represents a specific traffic association algorithm (e.g., "Raptor") src The timestamp vector of the data packets representing the transmitted traffic (read from the time-series feature file), T trg S represents the timestamp vector of received traffic packets (read from the time-series feature file). src S represents the packet size vector of the transmitted traffic (read from the time-series feature file). trg A vector representing the size of the received data packets (read from the timing profile file).

[0096] Depend on Figure 6 As can be seen, in each configuration, the communication group contains 10 pairs of communication samples, from which 10 correlation scores can be calculated; the non-communication group contains 90 pairs of communication samples, from which 90 correlation scores can be calculated. In this example, to obtain a greater number of communication group correlation scores, the experiment was repeated 10 times for each configuration. Therefore, a total of 100 communication group correlation scores and 900 non-communication group correlation scores can be obtained under each configuration.

[0097] By summarizing and organizing the sets of correlation scores for communication groups and non-communication groups under each configuration, we can obtain the numerical distribution of correlation scores between communicating parties and non-communicating parties under different anonymous network configurations. The distribution can be presented using various methods, such as numerical expressions, numerical sequences, or graphical representations.

[0098] for Figure 3The example shown uses the Raptor traffic association algorithm to obtain the correlation degree. The core of Raptor traffic association technology lies in matching the temporal variation characteristics of data size in the sending end traffic with those in the receiving end traffic, and calculating SpearmanRank ∈ [0,1] based on the Spearman similarity algorithm. A value close to 0 indicates a low correlation degree, and a value close to 1 indicates a high correlation degree. In this experiment, SpearmanRank is used as the correlation degree, and the determination of whether a communication relationship exists between two clients directly depends on the magnitude of the correlation degree. After performing correlation calculations on all communication pairs and non-communication pairs, the distribution of the correlation degree is plotted as shown in the image. Figure 7 As shown.

[0099] The vertical axis in the graph represents the correlation degree value, and the horizontal axis is represented in the following format:

[0100] (MessageSendingRate, DesiredRateParameter, MaxMessageSize)Corr=[1|0]

[0101] Corr = 1 indicates two communicating parties, represented by blue boxes; Corr = 0 indicates two non-communicating parties, represented by red boxes. The bottom horizontal line, bottom rectangle horizontal line, red middle line, and numbers, top rectangle horizontal lines, and top horizontal lines of each box represent the minimum, first quartile, median, third quartile, and maximum values ​​of a distribution, respectively. There are 27 configuration combinations in the diagram, representing both communicating and non-communicating scenarios. Therefore, there are a total of 54 boxes and 27 pairs of red-blue distributions in the diagram.

[0102] Depend on Figure 7 As can be seen, in this example, no matter how the three parameters are configured, the correlation value of the communicating parties is generally significantly higher than that of the non-communicating parties. Therefore, this difference in the correlation distribution can be used to determine whether there is a communication relationship between the traffic of two clients.

[0103] (5) Calculate the central value of the correlation between the communicating parties and the non-communicating parties under different anonymous network configurations.

[0104] Using the distribution of correlation between the communicating and non-communicating parties under different anonymity network configurations obtained in the previous step, the central value of the correlation is calculated. The specific concept of the central value can be defined according to the actual application; for example, the arithmetic mean, median, etc., can be used as the central value of the correlation. Figure 3 In the illustrated example, this invention uses the median as the central value of the correlation. This value can be directly calculated for both communicating and non-communicating parties under different anonymity network configurations. Figure 7 Read it from the middle, which is the red number on the short red line.

[0105] 2. Determination of flow correlation based on statistical feature approximation under multiple rounds of sampling

[0106] The process for determining traffic correlation based on statistical feature approximation under multiple rounds of sampling is as follows: Figure 8 As shown, the purpose of this section is to use the central value of the correlation between the communicating parties and non-communicating parties under different anonymous network configurations obtained in the previous section to identify whether there is a communication relationship between the sent and received traffic to be associated.

[0107] The steps are as follows:

[0108] (1) Determine the traffic correlation threshold based on the correlation center value according to the anonymous network configuration.

[0109] The traffic correlation determination threshold is a threshold used to distinguish the communication correlation between two parties by comparing their traffic correlation with that of the parties to be correlated. This invention defines the determination threshold as the arithmetic mean of the median value of the correlation between the communicating parties and the median value of the correlation between the non-communicating parties.

[0110] Because the center values ​​of the communicating parties and non-communicating parties may differ under different network configurations (e.g., Figure 7 However, network configurations are not necessarily visible to traffic stakeholders. Therefore, in practice, threshold calculations are performed in the following two scenarios:

[0111] 1) Anonymous network configuration visible to related parties: Read the center value of the correlation between the communicating and non-communicating parties under the anonymous network configuration, and calculate their arithmetic mean as the judgment threshold.

[0112] 2) Anonymous network configuration is not visible to related parties: Read the center value of the correlation between the communicating and non-communicating parties under the network configuration that makes the center value of the correlation between the communicating and non-communicating parties the closest, and calculate their arithmetic mean as the judgment threshold.

[0113] for Figure 3 In the example shown, if the related party is aware of the anonymous network configuration, such as MessageSendingRate, DesiredRateParameter, and MaxMessageSize being 5, 20, and 2048 respectively, then the judgment threshold should be: Without knowing the anonymous network configuration, by observation Figure 7 It can be seen that the correlation center values ​​of the communicating and non-communicating parties are closest when the configuration is 20, 5, and 20480, respectively, which are 0.39 and 0.13. Therefore, the judgment threshold is taken as:

[0114] (2) Initiate a new round of traffic collection and extract the time-series characteristics of the communication data volume between the two parties to be associated.

[0115] To perform traffic correlation, it is necessary to collect the transmission traffic of the communication source and the reception traffic of the communication target, and extract their data volume and time-series characteristics respectively.

[0116] Regarding traffic acquisition, both transmitted and received traffic can be acquired manually or automatically. Manual acquisition involves running traffic capture tools such as tcpdump and wireshark at both the communication source and destination. Automatic acquisition involves writing traffic acquisition scripts or developing a system that uses unified management, command distribution, distributed acquisition, and automatic traffic collection.

[0117] Regarding the extraction of time-series characteristics of communication data volume: The time-series characteristics of communication data volume refer to the change in the total length of data packets per unit time over the entire traffic collection period. Therefore, the extraction of time-series characteristics of communication data volume requires extracting timestamps and corresponding data packet lengths from the raw collected traffic. A screenshot of a data extraction example is shown below. Figure 5 As shown in the data extraction example, the extracted time-series feature file has only two columns: the first column is the timestamp, and the second column is the length of the data packet. To reduce the size of the data file, all other necessary information is written into the filename.

[0118] For example, the file name could be: src_172.28.1.33_None_8.211.5.35_None_3999_tcp.txt.

[0119] Its format is:

[0120] [Source|Destination]_{Monitoring Node}_{Source IP}_{Destination IP}_{Source Port}_{Destination Port}_{Protocol}.txt

[0121] (3) Calculate the correlation degree using the traffic correlation algorithm based on the data collected in this round.

[0122] Based on the traffic and extracted data time-series characteristics collected in the previous step, a traffic correlation algorithm based on matching communication data time-series characteristics is used to calculate the correlation degree between the source's transmitted traffic and the target's received traffic. For Figure 3 The example shown uses Raptor traffic correlation technology to calculate the correlation degree. The calculated correlation degree is represented by C. n This indicates that n is the number of rounds of data collection and processing in this round.

[0123] (4) Add the correlation value to the correlation record queue.

[0124] The correlation score calculated in the previous step is added to the correlation score recording queue. This invention uses Q to represent the queue. If the current round is the first round of data collection and processing, i.e., the correlation score is C1, then a new empty queue is created to record the correlation score; in this case, Q = [C1]. If the current round is not the first round, i.e., the correlation score is C... n If |(n≠1), then add the correlation degree to the tail of the queue, at which point Q=[C1,C2,...,C n ].

[0125] (5) Data collection end determination

[0126] The purpose of the end-of-collection determination is to determine whether the current round of traffic collection and processing is the last round, i.e., whether a new round of traffic collection and correlation calculation is needed. The basis for the end-of-collection determination is a pre-set maximum number of rounds. The current round number is compared with the preset number of rounds. When the current round number reaches the preset number of rounds, the traffic collection and correlation calculation process ends. Essentially, this means that the number of elements in the current correlation record queue has met the requirements of the traffic correlation determination task.

[0127] In the method of this invention, the preset maximum number of rounds is a parameter specified based on past practical experience. For Figure 3 In the example shown, after experimentation, the maximum number of preset rounds can be set to 10, because the experimental results show that when there are 10 correlations in the correlation record queue, it is sufficient to obtain traffic correlation results with a very high accuracy and precision.

[0128] (6) Calculate the correlation central value based on the correlation record queue.

[0129] Based on the existing sequence of association records, the central value of the association degree is calculated. The specific concept of the central value can be defined according to the actual application; for example, the arithmetic mean, median, or other numerical values ​​can be used as the central value of the association degree. Figure 3 In the example shown, this invention uses the median as the central value of the correlation degree. Therefore, the median of all elements in the correlation degree queue is calculated here as the central value result of this step.

[0130] (7) Relevance determination

[0131] Compare the central value of the correlation obtained in the previous step with the decision threshold. If the central value of the correlation is greater than or equal to the decision threshold, it is determined to be correlated; otherwise, it is determined to be uncorrelated.

[0132] for Figure 3In the example shown, it is first assumed that the related parties cannot know the configuration of the anonymous network in advance, so the judgment threshold is set to 0.26 according to step 1. After multiple rounds of data collection, extraction, analysis and testing, the anonymous network traffic correlation effect is obtained by using the median as the center value and approximating the statistical characteristics of multiple rounds, as shown below. Figure 9a and Figure 9b As shown.

[0133] In the graph, Accuracy refers to the proportion of communicating (or non-communicating) parties correctly identified as related (or unrelated). Precision refers to the proportion of parties identified as related (or unrelated) that are actually communicating (or non-communicating). The horizontal axis represents the preset number of rounds. The graph shows the accuracy and precision of the association results for all proposed related communication pairs under different preset number of rounds. As can be seen from the graph, after 10 rounds of traffic collection and analysis, based on the median, the accuracy of traffic association between communicating parties improved from 0.9 to 1, and the precision improved from below 0.4 to 1. For non-communicating parties, the accuracy improved from approximately 0.825 to 1, and the precision improved slightly from a high level close to 1 to 1, achieving a significant improvement in association performance.

[0134] If the anonymous network configuration has already been obtained by the related party, such as MessageSendingRate, DesiredRateParameter, and MaxMessageSize being known to be 5, 20, and 2048 respectively, then according to step 1, the judgment threshold is set to 0.445. After multiple rounds of data collection, extraction, analysis, and testing, using the median as the center value, the anonymous network traffic correlation effect approximating the statistical characteristics of multiple rounds is obtained as follows: Figure 10a and Figure 10b As shown.

[0135] As shown in the figure, considering the anonymous network configuration, adaptively adjusting the judgment threshold based on the network configuration can significantly improve the association accuracy and precision. Moreover, after only two rounds of traffic collection and analysis, the traffic association accuracy and precision of the communicating parties quickly converge to 1. Therefore, the focus on network configuration and its inclusion in the traffic association model in the method of this invention is highly beneficial for improving the association effect.

[0136] It should be noted that, within the scope of protection defined in the claims of this invention, the following embodiments can be combined and / or extended or replaced in any logical manner from the above specific embodiments, such as the disclosed technical principles, disclosed technical features or implicitly disclosed technical features.

[0137] Example 1

[0138] A method for determining the correlation distribution of anonymous network traffic under different configurations includes the following steps:

[0139] S11, establish multiple communication sources and communication targets that use anonymous communication networks for anonymous communication;

[0140] S12, under different anonymous network configuration conditions, collect the sending traffic of the source and the receiving traffic of the target;

[0141] S13, extract the time-series characteristics of the data volume of the transmitted and received traffic under different anonymous network configuration conditions;

[0142] S14, using a traffic association algorithm based on the time-series characteristics of communication data volume, calculate the distribution of the association degree between the communicating parties and the non-communicating parties under different anonymous network configuration conditions;

[0143] S15, calculate the central value of the correlation between the communicating parties and the non-communicating parties under different anonymous network configurations.

[0144] Example 2

[0145] Based on Example 1, step S11, which involves establishing multiple pairs of communication sources and targets using an anonymous communication network for anonymous communication, specifically includes the following sub-steps:

[0146] First, determine the type of anonymous service network. Then, add client nodes that act as communicators to the anonymous communication network according to the determined type. The method of adding client nodes follows the usage method of the determined anonymous communication network and is performed in accordance with the relevant official documents. Finally, use the added clients to generate communication traffic and build multiple pairs of mutual communication source clients and communication target clients. In each pair, the source and target clients only communicate with each other and do not communicate with other clients.

[0147] Example 3

[0148] Based on Example 1, in step S12, the collection of the sending traffic of the communication source and the receiving traffic of the target under different anonymous network configuration conditions specifically includes the following sub-steps: The collection of sending traffic and receiving traffic can be carried out manually or automatically. Manual collection involves manually running traffic capture tools at the communication source and communication target to collect traffic; automatic collection involves writing traffic collection scripts or developing a system to collect traffic using a unified management, instruction distribution, distributed collection, and automatic traffic collection method.

[0149] Example 4

[0150] Based on Example 1, step S13, which involves extracting the data volume timing characteristics of transmitted and received traffic under different anonymous network configuration conditions, specifically includes the following sub-steps:

[0151] For each anonymous network configuration, extract the time-series characteristics of all transmitted and received traffic. The time-series characteristics of communication data are extracted from the original collected traffic by removing the timestamp and the corresponding data packet length. In the data extraction example, the extracted time-series characteristic file has only two columns: the first column is the timestamp, and the second column is the data packet length. All other necessary information is written into the filename, which is formatted as: [source|destination]_{listening node}_{source IP}_{destination IP}_{source port}_{destination port}_{protocol}.txt.

[0152] Example 5

[0153] Based on Example 1, in step S14, the traffic association algorithm based on the time-series characteristics of communication data volume is used to calculate the distribution of the association degree between the communicating parties and the non-communicating parties under different anonymous network configuration conditions. This specifically includes the following sub-steps:

[0154] For any configuration combination, the sending and receiving time-series feature files of communicating clients are first grouped together to form a communication group; then, the sending and receiving time-series feature files of non-communicating clients are cross-paired to form non-communication groups. Based on a traffic association algorithm matching communication data volume time-series features, the data volume time-series features of each pair of sending traffic and receiving traffic in each communication group and non-communication group under each configuration are compared to calculate a value characterizing the degree of correlation between the two. This value is called the "correlation degree" and is expressed as:

[0155] Similarity(flow src ,flow trg ) = F CORR (T src ,T trg ,S src ,S trg )

[0156] In the above formula, Similarity represents the degree of correlation, and flow src This indicates the traffic sent by the communication source to be associated, flow trg F represents the received traffic of the communication target to be associated. CORR T represents a specific traffic association algorithm. src T represents the timestamp vector of data packets sent in the traffic. trg S represents the timestamp vector of received traffic packets. src S represents the vector of packet sizes in the transmitted traffic. trg A vector representing the size of the data packets received;

[0157] Then, the sets of correlation degrees of communication groups and non-communication groups calculated for each configuration are summarized and organized to obtain the numerical distribution of correlation degrees between the communicating parties and non-communication parties under different anonymous network configuration conditions. The distribution is presented in multiple ways.

[0158] Example 6

[0159] Based on Example 1, step S15, which calculates the central value of the correlation between the communicating parties and the non-communicating parties under different anonymous network configurations, specifically includes the following sub-steps:

[0160] Using the distribution of correlation between the communicating parties and the non-communicating parties under different anonymous network configurations obtained in step S14, the central value of the correlation is calculated. The central value is defined according to the actual application situation, including using the arithmetic mean and median as the central value of the correlation.

[0161] Example 7

[0162] An anonymous network traffic correlation method based on multi-round statistical feature approximation includes the following steps:

[0163] Using the correlation distribution measurement method of anonymous network traffic under different configurations described in Example 1, prior knowledge and data foundation for carrying out traffic correlation determination are obtained; then, traffic correlation determination based on statistical feature approximation under multiple rounds of sampling is performed, and the central value of the correlation between the communicating parties and non-communicating parties under different anonymous network configurations is used to identify whether there is a communication relationship between the sending and receiving traffic to be correlated.

[0164] Example 8

[0165] Based on Example 7, the traffic correlation determination based on statistical feature approximation under multi-round sampling utilizes the central value of the correlation between the communicating parties and non-communicating parties under different anonymous network configurations to identify whether there is a communication relationship between the sent and received traffic to be correlated. This specifically includes the following sub-steps:

[0166] S21, Based on the anonymous network configuration, determine the traffic correlation judgment threshold based on the correlation center value: The traffic correlation judgment threshold is used to compare with the traffic correlation of the two parties to be correlated, thereby identifying the communication correlation relationship between the two parties to be correlated. The judgment threshold is set as the arithmetic mean of the center value of the correlation of the two communicating parties and the center value of the correlation of the non-communicating parties.

[0167] S22, start a new round of traffic collection and extract the time-series characteristics of the communication data volume of the two parties to be associated: collect the sending traffic of the source and the receiving traffic of the target, and then extract the time-series characteristics of the data volume of the sending traffic and the receiving traffic.

[0168] S23, Calculate the correlation degree using a traffic correlation algorithm based on the data collected in this round: Based on the traffic and extracted data volume time-series characteristics collected in step S22, use a traffic correlation algorithm based on matching communication data volume time-series characteristics to calculate the correlation degree between the source's transmitted traffic and the target's received traffic. Then, use C... n This indicates that n is the number of rounds of data collection and processing in this round;

[0169] S24, Add the correlation score to the correlation score record queue: Add the correlation score calculated in step S23 to the correlation score record queue. Let Q represent the queue. If the current round is the first round of data collection and processing, i.e., the correlation score is C1, then create a new empty queue to record the correlation score. In this case, Q = [C1]. If the current round is not the first round, i.e., the correlation score is C... n If |(n≠1), then add the correlation degree to the tail of the queue, at which point Q=[C1,C2,...,C n ];

[0170] S25, Collection End Judgment: The collection end judgment is used to determine whether the current round of traffic collection and processing is the last round, that is, whether a new round of traffic collection and correlation calculation is needed. The basis for the collection end judgment is the preset maximum number of rounds. The current round number is compared with the preset round number. When the current round number reaches the preset round number, the traffic collection and correlation calculation process ends. The preset maximum number of rounds is a parameter specified based on past actual correlation experience.

[0171] S26, Calculate the central value of the correlation degree based on the correlation degree record queue: The central value is defined according to the actual application situation, including using the arithmetic mean and median as the central value of the correlation degree;

[0172] S27, Relevance Determination: Compare the central value of the correlation obtained in step S26 with the determination threshold. If the central value of the correlation is greater than or equal to the determination threshold, it is determined to be correlated; otherwise, it is determined to be uncorrelated.

[0173] Example 9

[0174] Based on Example 8, in step S21, setting the determination threshold as the arithmetic mean of the median value of the correlation between the communicating parties and the median value of the correlation between the non-communicating parties specifically includes the following sub-steps: In actual operation, the threshold is calculated in the following two cases:

[0175] Anonymous network configuration is visible to related parties: read the center value of the correlation between the communicating and non-communicating parties under the anonymous network configuration, and calculate their arithmetic mean as the judgment threshold;

[0176] Anonymous network configurations are not visible to related parties: Read the center value of the correlation between the communicating and non-communicating parties under the network configuration that makes the center value of the correlation between the communicating and non-communicating parties closest, and calculate their arithmetic mean as the judgment threshold.

[0177] Example 10

[0178] An anonymous network traffic association device includes a processor and a memory, wherein the memory stores a computer program that, when loaded by the processor, executes the method described in Embodiment 1 or Embodiment 7.

[0179] The units described in the embodiments of the present invention can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0180] According to one aspect of the present invention, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described above.

[0181] In another aspect, embodiments of the present invention also provide a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

Claims

1. A method for determining the correlation distribution of anonymous network traffic under different configurations, characterized in that, Includes the following steps: S11, establish multiple communication sources and targets that use anonymous networks for anonymous communication; S12, under different anonymous network configuration conditions, collect the transmission traffic of the communication source and the reception traffic of the communication target; S13, extract the time-series characteristics of the data volume of the transmitted and received traffic under different anonymous network configuration conditions; S14, using a traffic association algorithm based on matching the timing characteristics of communication data volume, calculates the distribution of correlation between communicating parties and non-communicating parties under different anonymous network configurations. Specifically, for any configuration combination, first, the sending and receiving timing characteristic files of communicating clients are grouped together to form a communication group; then, the sending and receiving timing characteristic files of non-communicating clients are cross-paired to form a non-communication group. The traffic association algorithm based on matching the timing characteristics of communication data volume compares the timing characteristics of the data volume of each pair of sending traffic and receiving traffic in each communication group and non-communication group under each configuration, and calculates a value representing the degree of correlation between the two. This value is called the "correlation degree" and is expressed as: S In the above formula, S Indicates the degree of relevance. This indicates the traffic sent by the communication source to be associated. This indicates the traffic received by the communication target to be associated. This represents a specific traffic association algorithm. A timestamp vector representing the data packets sent. A timestamp vector representing the data packets of the received traffic. A vector representing the size of data packets sent. A vector representing the size of the data packets received; Then, the sets of correlation degrees of communication groups and non-communication groups calculated for each configuration are summarized and organized to obtain the numerical distribution of correlation degrees between the communicating parties and non-communication parties under different anonymous network configuration conditions. The distribution is presented in multiple ways; S15, the central values ​​of correlation degrees between the communicating parties and non-communication parties under different anonymous network configuration conditions are calculated respectively. Specifically, using the distribution of the correlation between the communicating parties and the non-communicating parties under different anonymous network configurations obtained in step S14, the central value of the correlation is calculated; the central value is defined according to the actual application situation, including using the arithmetic mean and median as the central value of the correlation.

2. The method for determining the correlation distribution of anonymous network traffic under different configurations according to claim 1, characterized in that, In step S11, the construction of multiple pairs of communication sources and communication targets using anonymous networks for anonymous communication specifically includes the following sub-steps: First, determine the type of anonymous network, and then add client nodes that act as communicators to the anonymous network according to the determined type; finally, use the added clients to generate communication traffic and construct multiple pairs of communication source clients and communication target clients that communicate with each other. The communication source and communication target clients in each pair only communicate with each other and do not communicate with other clients.

3. The method for determining the correlation distribution of anonymous network traffic under different configurations according to claim 1, characterized in that, In step S12, the collection of the sending traffic of the communication source and the receiving traffic of the target under different anonymous network configuration conditions specifically includes the following sub-steps: The collection of sending traffic and receiving traffic can be carried out manually or automatically. Manual collection involves manually running traffic capture tools at the communication source and communication target to collect traffic. Automatic collection involves writing traffic collection scripts or developing a system to collect traffic using a unified management, instruction distribution, distributed collection, and automatic traffic collection method.

4. The method for determining the correlation distribution of anonymous network traffic under different configurations according to claim 1, characterized in that, In step S13, the extraction of the data volume timing features of the transmitted and received traffic under different anonymous network configuration conditions specifically includes the following sub-steps: for each group of anonymous network configurations, extract the data volume timing features of all transmitted and received traffic under it; The time-series feature extraction of communication data volume extracts the timestamp and the corresponding data packet length from the original collected traffic; In the data extraction example, the extracted time-series feature file has only two columns: the first column is the timestamp, and the second column is the length of the data packet. All other information is written into the file name, which is in the format: [source|destination]_{IP of the node being monitored}_{source IP}_{destination IP}_{source port}_{destination port}_{protocol}.txt.

5. An anonymous network traffic correlation method based on multi-round statistical feature approximation, characterized in that, Includes the following steps: Using the correlation distribution measurement method of anonymous network traffic under different configurations as described in claim 1, prior knowledge and data foundation for conducting traffic correlation determination are obtained; then, traffic correlation determination based on statistical feature approximation is performed under multiple rounds of sampling, and the central value of the correlation between the communicating parties and non-communicating parties under different anonymous network configurations is used to identify whether there is a communication relationship between the sent traffic and received traffic to be correlated.

6. The anonymous network traffic association method based on multi-round statistical feature approximation according to claim 5, characterized in that, The traffic correlation determination based on statistical feature approximation under multi-round sampling utilizes the central value of the correlation between the communicating parties and non-communicating parties under different anonymity network configurations to identify whether a communication relationship exists between the sent and received traffic to be correlated. This specifically includes the following sub-steps: S21, Based on the anonymous network configuration, determine the traffic correlation judgment threshold based on the correlation center value: The traffic correlation judgment threshold is used to compare with the traffic correlation of the two parties to be correlated, thereby identifying the communication correlation relationship between the two parties to be correlated. The judgment threshold is set as the arithmetic mean of the center value of the correlation of the two communicating parties and the center value of the correlation of the non-communicating parties. S22, start a new round of traffic collection and extract the time-series characteristics of the communication data volume of the two parties to be associated: collect the sending traffic of the communication source and the receiving traffic of the communication target, and then extract the time-series characteristics of the data volume of the sending traffic and the receiving traffic. S23, Calculate the correlation degree based on the data collected in this round using a traffic correlation algorithm: Based on the traffic collected in step S22 and the time-series characteristics of the extracted data volume, use a traffic correlation algorithm based on matching the time-series characteristics of communication data volume to calculate the correlation degree between the source's transmitted traffic and the target's received traffic. Then, use the calculated correlation degree... It means that, among them This refers to the round number of data collection and processing in this round; S24, Add the correlation score to the correlation score record queue: Add the correlation score calculated in step S23 to the correlation score record queue, using... This represents a queue; if the current round is the first round of data collection and processing, then the relevance is... Then, a new empty queue is created to record the correlation. If the current round is not the first round, i.e., the correlation is... If so, the correlation is added to the tail of the queue. ; S25, Collection End Judgment: The collection end judgment is used to determine whether the current round of traffic collection and processing is the last round, that is, whether a new round of traffic collection and correlation calculation is needed. The basis for the collection end judgment is the preset maximum number of rounds. The current round number is compared with the preset round number. When the current round number reaches the preset round number, the traffic collection and correlation calculation process ends. The preset maximum number of rounds is a parameter specified based on past actual correlation experience. S26, Calculate the central value of the correlation degree based on the correlation degree record queue: The central value is defined according to the actual application situation, including using the arithmetic mean and median as the central value of the correlation degree; S27, Relevance Determination: Compare the central value of the correlation obtained in step S26 with the determination threshold. If the central value of the correlation is greater than or equal to the determination threshold, it is determined to be correlated; otherwise, it is determined to be uncorrelated.

7. The anonymous network traffic association method based on multi-round statistical feature approximation according to claim 6, characterized in that, In step S21, setting the threshold as the arithmetic mean of the median value of the correlation between the communicating parties and the median value of the correlation between the non-communicating parties specifically includes the following sub-steps: In actual operation, the threshold is calculated in the following two cases: Anonymous network configuration is visible to related parties: read the center value of the correlation between the communicating and non-communicating parties under the anonymous network configuration, and calculate their arithmetic mean as the judgment threshold; Anonymous network configurations are not visible to related parties: Read the center value of the correlation between the communicating and non-communicating parties under the network configuration that makes the center value of the correlation between the communicating and non-communicating parties closest, and calculate their arithmetic mean as the judgment threshold.

8. An anonymous network traffic correlation device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when loaded by the processor, executes the method as described in claim 1 or claim 5.

Images