A Tor anonymous network traffic identification method based on multi-dimensional feature deep learning

Abstract

The present invention discloses a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning. The method includes: capturing and preliminarily screening data packets, classifying the data packets into a series of network flows; extracting the JA3 traffic fingerprint of each network flow, and matching it with the Tor JA3 traffic fingerprint library, and identifying it as a Tor network flow if it matches; for unmatched network flows, using statistical methods to extract its statistical features, and extracting the uplink and downlink directions of the data packets; sorting the data packets by timestamp, obtaining the time sequence of the data packets, and extracting the time sequence features; using the FFT algorithm to extract frequency domain features; using the CNN deep learning model to extract the content features of each data packet in the network flow, and then constructing a traffic data graph; using a heterogeneous graph neural network model to extract graph features from the traffic data graph; finally using a fully connected neural network to fuse statistical features, time domain features, frequency domain features and graph features for identification, and storing the identified JA3 traffic fingerprint of the Tor network flow in the Tor JA3 traffic fingerprint library.

Description

Technical Field

[0001] The present invention relates to network security technology, and in particular to a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent. As an anonymous communication system, the Tor (The Onion Router) network is widely used to protect user privacy and information security. However, since the Tor network can hide the user's real IP address and communication content, it is also used by some criminals to carry out illegal activities, such as spreading illegal information and trading illegal items. Therefore, identifying and monitoring Tor network traffic has become an important research topic in the field of network security.

[0003] The Tor network achieves anonymity of communication through multiple layers of encryption and multiple routing. After entering the Tor network, the user's traffic is encrypted multiple times and forwarded through multiple relay nodes, making it difficult for the outside world to track the source and destination of the communication. This high level of anonymity poses a huge challenge to traffic identification.

[0004] In view of the shortcomings of the prior art, the present invention proposes a Tor darknet traffic identification method based on multi-dimensional feature deep learning, aiming to improve the accuracy and efficiency of identification. The present invention uses a deep learning model to automatically extract effective features in the time domain, space domain and frequency domain from network traffic data, and combines the unique pattern of Tor traffic to establish an accurate identification model, thereby achieving efficient identification and monitoring of Tor traffic. Summary of the invention

[0005] In view of this, the present invention provides a method for identifying Tor anonymous communication network traffic, aiming to accurately and efficiently identify Tor anonymous communication network traffic from Internet traffic, providing law enforcement agencies, security researchers and users with efficient identification and monitoring of Tor anonymous communication network traffic, and balancing the contradiction between privacy protection and security supervision.

[0006] A Tor anonymous network traffic identification method based on multi-dimensional feature deep learning, the method comprising:

[0007] S100. Capture and preliminary screening of data packets;

[0008] S200. Classify the data packets into a series of network flows, and represent each network flow as X = {x1, x2, ..., x n}, where x iis the i-th traffic packet in the network flow, and n is the number of traffic packets in the network flow; for each network flow X, extract its JA3 traffic fingerprint and match it with the Tor-JA3 traffic fingerprint library. If the traffic fingerprint exists in the Tor-JA3 traffic fingerprint library, the network flow is a Tor network flow;

[0009] S300. For network flows that do not match the Tor traffic fingerprint library, use statistical methods to extract their statistical features, and extract the uplink and downlink directions of the data packets in these network flows;

[0010] S400. Based on S300, sort the data packets according to the timestamps, obtain the time sequence of the data packets, and extract the time domain features of these network flows;

[0011] S500. Based on S400, the FFT algorithm is used to further extract frequency domain features of the network flow;

[0012] S600. Based on S500, the CNN deep learning model is used to extract the content features of each data packet in the network flow, and the data packets constituting the network flow are used as nodes, and the content features of the data packets are used as node embedding vectors. The flow data graph of each network flow is constructed according to the time sequence of the data packets in S400 and the uplink and downlink directions of the data packets in S300 as the relationship; and the heterogeneous graph neural network model is used to extract the graph features of the flow data graph;

[0013] S700. Based on step S600, train and use a fully connected neural network to fuse the normalized statistical features in S300, the normalized time domain features in S400, the frequency domain features in S500, and the graph features in S600, and obtain the classification results of each network flow. For the identified Tor network flow, store the JA3 traffic fingerprint extracted in S200 into the Tor-JA3 traffic fingerprint library.

[0014] Further, in step S100, step S100 is specifically:

[0015] S110. Use Wireshark or TCPdump software to capture data packets, hereinafter referred to as "capturing packets";

[0016] S120. After all the data packets to be identified are captured, the relevant types of data packets are filtered out according to the following two rules: (1) non-TCP traffic; (2) non-SSL / TLS traffic;

[0017] S130. Store the filtered data packets as original files in pcap data format.

[0018] Further, in step S200, step S200 is specifically:

[0019] S210. Classify the data packets into M network flows, hereinafter referred to as "aggregate flows", according to the flow quintuple information of the data packets; the flow quintuple information includes: (1) source IP address; (2) destination IP address; (3) source port number; (4) destination port number; (5) protocol;

[0020] S220. Extract five parameters sent during the TLS handshake process in each network flow, and then extract the JA3 traffic fingerprint of each network flow, hereinafter referred to as "fingerprint extraction operation"; the five parameters sent during the TLS handshake process specifically include: (1) SSL / TLS version number; (2) supported cipher suites; (3) supported extensions; (4) supported elliptic curves; (5) supported elliptic curve point formats;

[0021] S230. Search the Tor-JA3 traffic fingerprint library for the JA3 traffic fingerprint of each network flow. If the JA3 traffic fingerprint exists in the Tor-JA3 traffic fingerprint library, the network flow is a Tor network flow.

[0022] Optionally, the initial Tor-JA3 traffic fingerprint library can be selected by building a Tor environment in the local LAN and simulating the usage environment, while using Wireshark or TCPdump to capture packets and aggregate flows; the resulting Tor network flow is subjected to fingerprint extraction operations, and the resulting JA3 traffic fingerprint is the initial Tor-JA3 traffic fingerprint library.

[0023] Further, in step S300, step S300 is specifically:

[0024] S310. Extract 10 statistical features A of each network flow X by statistical method rawstatistic ={s1,s2,…s 10}, where n is the number of packets in the network flow. rawstatistic It includes the following 10 features: (1) the number of data packets in the network flow; (2) the average length of data packets in the network flow; (3) the median length of data packets in the network flow; (4) the maximum value of data packets in the network flow; (5) the minimum value of data packets in the network flow; (6) the standard deviation of the length of data packets in the network flow; (7) the uplink and downlink ratio of data packets in the network flow; (8) the TCP flag bit of the data packet transport layer; (9) the average length of the uplink header of the data packets in the network flow; (10) the average length of the downlink header of the data packets in the network flow;

[0025] S320. Count the characteristics A of each network flow in S310 rawstatistic Statistical features in iUse Min-Max standardization; the network flow statistical feature is the kth flow among all M network flows in pcap, and the statistical feature of the flow is recorded as The specific formula is:

[0026]

[0027] in, Features The normalized features obtained after Min-Max standardization can be used to obtain the normalized network flow statistical features. Facilitates use in subsequent processes;

[0028] S330. Extract the uplink and downlink directions of each data packet in each network flow and store them as an uplink sequence E Fwd ={x α ,x β ,…,x δ},|E Fwd |∈[0,n] and the descending sequence E bwd =C X E Fwd , where C X E Fwd It means taking E on X Fwd The complement of

[0029] Further, in step S400, step S400 is specifically:

[0030] S410. Sort the data packets in chronological order. Specifically, use the timestamps in the data packets to determine the order of the data packets;

[0031] S420. Store the data packets arranged in time sequence as time sequence E Time ={x1,x2,…x n};

[0032] S430. Extract the time domain feature A of each network flow X through the packet timestamp, timing and uplink and downlink direction attributes rawtime ={t1,t2,…t5}; A rawtime It includes the following five characteristics: (1) the duration of the network flow; (2) the average interval time between data packets in the network flow; (3) the average interval time between uplink packets in the network flow; (4) the average interval time between downlink packets in the network flow; (5) the time taken to establish a connection;

[0033] S440. For each network flow time domain feature A in S430 rawtime The time domain characteristics t iUse Min-Max standardization; the network flow statistical feature is the kth flow among all M network flows in pcap, and the statistical feature of the flow is recorded as The specific formula is:

[0034]

[0035] in, Features The normalized features obtained after Min-Max standardization can be used to obtain the normalized network flow statistical features. It is convenient for use in subsequent processes.

[0036] Further, in step S500, step S500 is specifically:

[0037] S510. For each network flow, determine the arrival time of the data packet according to the timestamp in the data packet in step S410, and set a fixed time window length l t , divide the duration T of the total network flow into time windows of fixed length according to l

[0038] Preferably, the time window l t The length can be 0.01s.

[0039] S520. For each network flow, determine the time window sequence, and count the number of nodes that fall in each time window w. i The number of packets tr i , and sort them in time window order to obtain the packet arrival number sequence

[0040] S530. For each network flow, according to the timing sequence E extracted in step S420 Time The lengths of the data packets in the network flow extracted in step S310 are sorted in order to form a data packet length sequence S fftsizeraw = {sr1,sr2,…,sr n}, where n is the number of packets in the network flow;

[0041] S540. For each network flow S ffttimeraw Using the FFT algorithm, the real and imaginary parts of each vector element are separated, and the obtained real and imaginary features are directly spliced ​​to achieve the frequency domain feature A of each network flow at the time level. rawtimefreq Extraction; for each network flow S fftsizerawUsing the FFT algorithm, the real and imaginary parts of each vector element are separated, and the obtained real and imaginary features are directly spliced ​​to achieve the frequency domain feature A at the length level of each network flow. rawsizefreq Extraction of

[0042] S550. Frequency domain features of splicing time level A rawtimefreq and the frequency domain feature A at the length level rawsizefreq , obtain the frequency domain feature A of each network flow freq ={A rawtimefreq ||A rawsizefreq}.

[0043] Further, in step S600, step S600 is specifically:

[0044] S610. For each network flow X={x1,x2,…,x n}, extract each packet x that constitutes X i The load portion x pi ;

[0045] S620. For each x pi , define the grayscale image length g, and convert x pi The binary data is converted into a g×g grayscale image G content Specifically, for x pi Binary bit data, each bit is converted into a pixel, and its bit information is used as the grayscale value of the pixel, and arranged in sequence into a g×g grayscale map G content ; If the length of the data packet exceeds g×g bytes, only the first g×g length of data is taken; if the length of the data packet is less than g×g bytes, the remaining g×g bytes are filled with 0 as padding;

[0046] Preferably, g can be selected as 32.

[0047] S630. Use CNN deep learning model to transform x pi Encoded as the content feature S of each data packet content .

[0048] Preferably, the structure of the CNN deep learning model can be the following three layers: (1) two-dimensional graph convolution layer; (2) maximum pooling layer; (3) fully connected layer;

[0049] S640. For each network flow X={x1,x2,…,x n}, forming a network flow graph G flow Among them, G flow The nodes are the data packets x that constitute the network flow i ,i∈[1,n];G flowThere are three types of edges: (1) the time series E extracted in step S420 Time ; (2) Uplink sequence E of the data packet extracted in step S330 Fwd ; (3) Downlink sequence E of the data packet extracted in step S330 bwd ;

[0050] S650. The content feature S of each data packet extracted in S630 is content As G flow The embedding vector of the corresponding data packet node in ;

[0051] S660. Define graph embedding length l g For each network flow X, obtain the corresponding network flow graph G obtained in S650 flow , and each network flow graph G corresponding to each network flow X flow Send it to the heterogeneous graph neural network model to perform the graph feature A corresponding to each network flow X graph Extraction; graph embedding length l g A graph Length;

[0052] Preferably, the graph embedding length l g It can be 128 dimensions. The structure of the heterogeneous graph neural network model can be the following six layers: (1) a graph convolution layer; (2) a multi-head attention mechanism layer; (3) a single-head attention mechanism layer; (4) a graph convolution layer; (5) a global pooling layer; (6) a fully connected layer.

[0053] Further, in step S700, step S700 is specifically:

[0054] S710. For each network flow X, the normalized statistical feature A corresponding to it in S320 statistic , the normalized time domain feature A in S440 time , frequency domain feature A in S550 freq and Figure feature A in S600 graph The final feature A of network flow X is concatenated into {A statisitc ||A time ||A freq ||A graph};

[0055] S720. Train a fully connected neural network model;

[0056] Further, in step S720, step S720 includes the following steps:

[0057] S721. Select an open source annotated Tor traffic dataset from the Internet or obtain the original dataset by building a self-built dataset. The process of building a self-built dataset consists of the following three steps:

[0058] (1) By setting up a Tor environment in the local area network and simulating the usage environment, Wireshark or TCPdump is used to capture packets and aggregate flows to obtain the original Tor traffic data and mark it;

[0059] (2) By setting up a clear network environment in the local area network, use Wireshark or TCPdump to capture packets and aggregate flows to obtain normal traffic raw data and mark them;

[0060] (3) The annotated Tor traffic raw data and the annotated normal traffic raw data are combined and cleaned as the original data set;

[0061] S722. The data set obtained in S721 is subjected to the data preprocessing process of S120-S600;

[0062] S723. Divide the data set preprocessed in S722 into a training set and a test set.

[0063] Preferably, the ratio of the training set to the test set can be 8:2;

[0064] S724. Perform supervised iterative training on the fully connected neural network using the training set divided in S723 as a training set and the test set divided in S723 as a test set;

[0065] Optionally, you can use early stopping to ensure that the model obtains better parameters. Stop training early when the loss value of the model on the dataset increases five times in a row; and save the model after every 10 rounds of training.

[0066] S730. Input the final feature A of the network flow X into the fully connected classifier trained in S720 to obtain the final classification result Y;

[0067] S740. For the part of the classification result Y that is judged to be the Tor network flow, the JA3 traffic fingerprint extracted in step S220 is stored in the Tor-JA3 traffic fingerprint library to facilitate subsequent judgment of new network flows. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A flow chart of a method for identifying Tor anonymous communication network traffic provided by the present invention;

[0069] Figure 2 A network flow graph for extracting network flow graph features therefrom provided by the present invention;

[0070] Figure 3 The CNN deep neural network structure for extracting data packet content features provided by the present invention;

[0071] Figure 4 The present invention provides a heterogeneous graph neural network structure for extracting network flow graph features. DETAILED DESCRIPTION

[0072] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementations. The following examples or drawings are used to illustrate the present invention, but are not used to limit the scope of the present invention.

[0073] See also Figure 1 , Figure 1 The flow chart of the identification method for Tor anonymous communication network traffic provided by this application includes:

[0074] S100. Use Wireshark to capture data packets, filter out non-TCP traffic and non-SSL / TLS traffic, and store the remaining traffic as a raw file in pcap data format.

[0075] In one embodiment, the step S100 includes the following steps:

[0076] S110. Use Wireshark software to capture data packets, hereinafter referred to as "capturing packets";

[0077] S120. Filter out non-TCP traffic and non-SSL / TLS traffic in S110;

[0078] Specifically, Tor traffic is data transmitted through the Tor network, which is designed to be anonymous and protect user privacy. Tor traffic is encapsulated on top of the TCP protocol and encrypted using SSL / TLS to ensure the security and privacy of the transmission. Therefore, non-TCP traffic and non-SSL / TLS traffic are not Tor traffic;

[0079] S130. Store the data packets filtered in S120 as original files in pcap data format.

[0080] S200. Classify the data packets into a series of network flows, and represent each network flow as X = {x1, x2, ..., x n}, where x i is the i-th traffic packet in the network flow, and n is the number of traffic packets in the network flow; for each network flow X, extract its JA3 traffic fingerprint and match it with the Tor-JA3 traffic fingerprint library. If the traffic fingerprint exists in the Tor-JA3 traffic fingerprint library, the network flow is a Tor network flow;

[0081] In one embodiment, step S200 includes the following steps:

[0082] S210. Read the original file in pcap data format, and classify the data packet into M network flows X={x1, x2, ..., x n}, hereinafter referred to as "flow aggregation"; the traffic five-tuple information includes: (1) source IP address; (2) destination IP address; (3) source port number; (4) destination port number; (5) protocol;

[0083] For example, if there are data packets with the following five types of consistent information in the original pcap file, they are considered as data packets in a network flow: (1) source IP address; (2) destination IP address; (3) source port number; (4) destination port number; (5) protocol. An example is ('10.133.24.72', '183.240.187.170', 35106, 50117, 6): the data packets with source IP address '10.133.24.72', destination IP address '183.240.187.170', source port number 35106, destination port number 50117, and protocol number 6, that is, the TCP protocol data packets are divided into a network flow.

[0084] S220. Extract five parameters sent during the TLS handshake process in each network flow, and then extract the JA3 traffic fingerprint of each network flow, hereinafter referred to as "fingerprint extraction operation"; the five parameters sent during the TLS handshake process specifically include: (1) SSL / TLS version number; (2) supported cipher suites; (3) supported extensions; (4) supported elliptic curves; (5) supported elliptic curve point formats;

[0085] For example: If the SSL / TLS version number used in a certain network flow is TLS1.0, and it supports five cipher suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, and TLS_RSA_WITH_3DES_EDE_CBC_SHA, supports five extensions: Server Name Indication (SNI), EC Point Formats, Supported Groups (Elliptic Curves), and Session Ticket, supports five elliptic curves: secp256r1 (P-256), secp384r1 (P-384), and secp521r1 (P-521), and supports the uncompressed elliptic curve format, then these fields can be concatenated in the following format: <TLS version>,<Cipher suite list>,<Extension list>,<Elliptic curve list>,<Elliptic curve format list>; The concatenated network flow is: 769,49162-49172-136-135-57-56,0-11-10-35,23-24-25,0; Finally, the final JA3 digest can be obtained by encrypting this data stream with md5: 5d5cec9bfc1f5e9a3408a33f7503ed2f;

[0086] S230. Search for the JA3 traffic fingerprint of each network flow in the Tor-JA3 traffic fingerprint database. If the JA3 traffic fingerprint exists in the Tor-JA3 traffic fingerprint database, then the network flow is a Tor network flow. For the initial Tor-JA3 traffic fingerprint database, first set up a Tor environment in the local local area network and simulate the usage environment, and at the same time use Wireshark or TCPdump to capture and aggregate traffic; then perform fingerprint extraction operations on the obtained Tor network flows, and the obtained JA3 traffic fingerprints are the initial Tor-JA3 traffic fingerprint database.

[0087] S300. For network flows that do not match the Tor traffic fingerprint database, use statistical methods to extract their statistical feature A statistic , perform normalization operations, and extract the upstream and downstream directions of the data packets in these network flows;

[0088] In one embodiment, the step S300 includes the following steps:

[0089] S310. Extract 10 statistical features A of each network flow X by statistical method rawstatistic ={s1,s2,…s 10}, where n is the number of packets in the network flow. rawstatistic It includes the following 10 features: (1) the number of data packets in the network flow; (2) the average length of data packets in the network flow; (3) the median length of data packets in the network flow; (4) the maximum value of data packets in the network flow; (5) the minimum value of data packets in the network flow; (6) the standard deviation of the length of data packets in the network flow; (7) the uplink and downlink ratio of data packets in the network flow; (8) the TCP flag bit of the data packet transport layer; (9) the average length of the uplink header of the data packets in the network flow; (10) the average length of the downlink header of the data packets in the network flow;

[0090] For example, if a network flow contains 10 packets, then the number of packets in the network flow is n = 10, which is represented by X = {x1, x2, ..., x 10}; Among them, the TCP flag bits of these data packets are all ACK, the length of the uplink and downlink packet headers is 20 bytes, x1 is 500 bytes long, which is an uplink packet; x2 is 700 bytes long, which is a downlink packet; x3 is 650 bytes long, which is an uplink packet; x4 is 800 bytes long, which is an uplink packet; x5 is 550 bytes long, which is a downlink packet; then, x i .len is recorded as x i The packet length is: (1) the number of packets in the network flow is s1 = n = 5; (2) the average length of packets in the network flow is (3) The median length of the data packets in the network flow is s3 = 700; (4) The maximum value of the data packets in the network flow is s4 = max{x i .len}=800;(5)The minimum value of the data packet in the network flow s4=min{x i .len}=500; (6) Standard deviation of packet length in network flow (7) Ratio of uplink and downlink packets in network flow (8) The TCP flag bit of the data packet transport layer is 00010000. It is regarded as a binary number and converted to decimal 16. After calculating the decimal flag bit of the data packet in the network flow, s8 = 16. (9) The average length of the upstream header of the data packet in the network flow (10) Average length of downstream header of data packets in network flow Finally, you can get A rawstatistic ={5,640,700,800,500,106.7707825,1.5,16,650,625};

[0091] S320. Count the characteristics A of each network flow in S310 rawstatistic Features in i Min-Max normalization is used, where the network flow statistical feature is the kth flow among all M network flows in the pcap, and the statistical feature of the flow is recorded as The specific formula is:

[0092]

[0093] in, Features The normalized features obtained after Min-Max standardization can be used to obtain the normalized network flow statistical features. Facilitates use in subsequent processes;

[0094] For example, a pcap file contains three network flows, M = 3, and the number of packets s1 in the network flows is So

[0095] S330. Extract the uplink and downlink directions of each data packet in each network flow and store them as an uplink sequence E Fwd ={x α ,x β ,…,x δ},|E Fwd |∈[0,n] and the descending sequence E bwd =C X E Fwd , where C X E Fwd It means taking E on X Fwd The complement of

[0096] For example, in the example in S310, the E Fwd ={x1,x3,x4}; E bwd =C X E Fwd ={x2,x5};

[0097] S400. Based on S300, sort the data packets according to the timestamps, obtain the time sequence of the data packets, and extract the time domain features of these network flows;

[0098] In one embodiment, step S400 includes the following steps:

[0099] S410. Sort the data packets in chronological order. Specifically, use the timestamps in the data packets to determine the order of the data packets;

[0100] S420. Store the data packets arranged in time sequence as time sequence E Time ={x1,x2,…x n}.

[0101] For example, if a flow contains 5 data packets, then the number of data packets in the network flow is n = 5, expressed as X = {x1, x2, ..., x5}; among them, x1 is 500 bytes long, is an uplink packet, and has a timestamp of 1622547600; x2 is 700 bytes long, is a downlink packet, and has a timestamp of 1622547605; x3 is 650 bytes long, is an uplink packet, and has a timestamp of 1622547602; x4 is 800 bytes long, is an uplink packet, and has a timestamp of 1622547601; x5 is 550 bytes long, is a downlink packet, and has a timestamp of 1622547603; after sorting by timestamp, it can be stored as a time series E. Time ={x1,x4,x3,x5,x2}

[0102] S430. Extract the time domain feature A of each network flow X through the packet timestamp, timing and uplink and downlink direction attributes rawtime ={t1, t2, ... t5}. rawtime It includes the following five characteristics: (1) the duration of the network flow; (2) the average interval time between data packets in the network flow; (3) the average interval time between uplink packets in the network flow; (4) the average interval time between downlink packets in the network flow; (5) the time taken to establish a connection;

[0103] For example, in the example above, x i .tsp is recorded as x i The packet timestamp of |E Fwd | represents the set E Fwd The number of packets in the set, x[j] is the jth packet in the set, and we can get: (1) The duration of the network flow (2) Average interval between packets in a network flow (3) Average uplink packet interval time of data packets in network flow (4) Average downlink packet interval time of data packets in network flow (5) The time taken to establish the connection, that is, the time between the first uplink packet and the second uplink packet, t5 = x[1].tsp - x[0].tsp = 1; finally, we can get A rawtime ={5,1.25,1,2,1};

[0104] S440. For each network flow time domain feature A in S430 rawtime The time domain characteristics t iUse Min-Max standardization; the network flow statistical feature is the kth flow among all M network flows in pcap, and the statistical feature of the flow is recorded as The specific formula is:

[0105]

[0106] in, Features The normalized features obtained after Min-Max standardization can be used to obtain the normalized network flow statistical features. It is convenient for use in subsequent processes.

[0107] For example, a pcap file contains three network flows, M=3, and the duration t1 of the network flows in the network flow is So

[0108] S500. Based on S400, the frequency domain features of the network flows are further extracted using the FFT algorithm, and a normalization operation is performed;

[0109] In one embodiment, the step S500 includes the following steps:

[0110] S510. For each network flow, determine the arrival time of the data packet according to the timestamp in the data packet in step S410, and set a fixed time window length l t , divide the duration T of the total network flow into time windows of fixed length according to l

[0111] For example, for the example given in S410-S420 above, Set the fixed time window length l t is 2 seconds, then the number of time windows w1=[1622547600,1622547602), w2=[1622547602,1622547604), w3=[1622547604,1622547606);

[0112] S520. For each network flow, determine the time window sequence, and count the number of nodes that fall in each time window w. i The number of packets tr i , and sort them in time window order to obtain the packet arrival number sequence

[0113] For example, for the example mentioned above, the timestamps of the packets are combined to obtain tr1 = 2, tr2 = 2, tr3 = 1; S ffttimeraw ={2,2,1};

[0114] S530. For each network flow, according to the timing sequence E extracted in step S420 Time The lengths of the data packets in the network flow extracted in step S310 are sorted in order to form a data packet length sequence S fftsizeraw = {sr1,sr2,…,sr n}, where n is the number of packets in the network flow;

[0115] For example, for the example mentioned above, using the time series E Time The length of the data packet in the network flow extracted in the sorting step S310 can be obtained as S fftsizeraw ={500,800.650,550,700};

[0116] S540. For each network flow S ffttimeraw Using the FFT algorithm, the real and imaginary parts of each vector element are separated, and the obtained real and imaginary features are directly spliced ​​to achieve the frequency domain feature A of each network flow at the time level. rawtimefreq Extraction; for each network flow S fftsizeraw Using the FFT algorithm, the real and imaginary parts of each vector element are separated, and the obtained real and imaginary features are directly spliced ​​to achieve the frequency domain feature A at the length level of each network flow. rawsizefreq Extraction of

[0117] For example, for the example mentioned above, we can obtain (1) FFT (S ffttimeraw )={5.+0.j,0.5-0.8660254j,0.5+0.8660254j}, and then the real part and imaginary part of each obtained vector element can be separated, and the obtained real and imaginary features can be directly spliced ​​to obtain the frequency domain feature A of the network flow at the time level. rawtimefreq ={5,0,0.5,-0.8660254,0.5,0.8660254}; (2)FFT(S fftsizeraw)={320.+0.j,-0.72949017-15.38841769j,-34.27050983,+3.63271264j,-34.27050983,-3.63271264j,-0.72949017+15.38841769j}, and then the real part and the imaginary part of each obtained vector element can be separated, and the obtained real and imaginary features can be directly spliced ​​to obtain the frequency domain feature A of the network flow at the network flow length level. rawsizefreq ={3200+0j,-7.2949016-153.8841768j,-342.7050983+36.3271264j,-342.7050983-36.3271264j,-7.2949016+153.8841768j}

[0118] S550. Frequency domain features of splicing time level A rawtimefreq and the frequency domain feature A at the length level rawsizefreq , obtain the frequency domain feature A of each network flow freq ={A rawtimefreq ||A rawsizefreq};

[0119] For example, for the example mentioned above, the frequency domain feature A of the network flow freq ={A rawtimefreq ||A rawsizefreq}={5,0,0.5,-0.8660254,0.5,0.8660254,3200,0,-7.2949016,-153.8841768,-342.7050983,36.3271264,-342.7050983,-36.3271264,-7.2949016,153.8841768}.

[0120] S600. Based on S500, a CNN deep learning model is used to provide

[0121] Take its content characteristics;

[0122] In one embodiment, the step S600 includes the following steps:

[0123] S610. For each network flow X={x1,x2,…,x n}, extract each packet x that constitutes X i The load portion x pi ;

[0124] S620. For each x pi , define the grayscale image length g, and convert xpi The binary data is converted into a g×g grayscale image G content Specifically, for x pi Binary bit data, each bit is converted into a pixel, and its bit information is used as the grayscale value of the pixel, and arranged in sequence into a g×g grayscale map G content ; If the length of the data packet exceeds g×g bytes, only the first g×g length of data is taken; If the length of the data packet is less than g×g bytes, then the less than g×g bytes are taken.

[0125] Fill the section with 0 as padding;

[0126] For example, in the example mentioned above, for a data packet x1 in a network flow X, the length is 500 bytes;

[0127] Define g = 32, extract each byte of x1, and use the 8 bits of the byte as the gray value of 1 pixel. Arrange the generated gray value pixels from left to right and from top to bottom in byte order; since 500 is less than g × g =

[0128] If the number is 1024 bytes, the remaining 524 bytes will be padded with 0s.

[0129] S630. Use CNN deep learning model to transform x pi Encoded as the content feature S of each data packet content .

[0130] For example, in one embodiment, as mentioned above, the following example may be constructed: Figure 3 The CNN deep learning model of the data packet x1 can be obtained through a two-dimensional graph convolution layer, a maximum pooling layer and a fully connected layer.

[0131] Content characteristics of package x1;

[0132] S640. For each network flow X={x1,x2,…,x n}, forming a network flow graph G flow Among them, G flow The nodes are the data packets x that constitute the network flow i ,i∈[1,n];G flow There are three types of edges: (1) the time series E extracted in step S420 Time ; (2) Uplink sequence E of the data packet extracted in step S330 Fwd ; (3) Downlink sequence E of the data packet extracted in step S330 bwd ;

[0133] For example, in one embodiment, as mentioned above, the following example may be constructed: Figure 2The network flow diagram of

[0134] S650. The content feature S of each data packet extracted in S630 is content As G flow The corresponding data packet

[0135] The embedding vector of the node.

[0136] S660. Define graph embedding length l g For each network flow X, obtain the corresponding network flow graph G obtained in S650 flow , and each network flow graph G corresponding to each network flow X flow Send it to the heterogeneous graph neural network model to perform the graph feature A corresponding to each network flow X graph Extraction; graph embedding length l g A graph Length;

[0137] For example, in one embodiment, g is 128-dimensional; for the example mentioned above, we can construct a Figure 4 The heterogeneous graph neural network consists of six layers: (1) a graph convolution layer; (2) a multi-head attention mechanism layer; (3) a single-head attention mechanism layer; (4) a graph convolution layer; (5) a global pooling layer; (6) a fully connected layer; and the network flow graph G of each network flow X is converted into flow Send it to the heterogeneous graph neural network and get a length of l g The graph feature A graph .

[0138] S700. Based on step S600, train and use a fully connected neural network to fuse the normalized statistical features in S300, the normalized time domain features in S400, the frequency domain features in S500, and the graph features in S600, and obtain the classification results of each network flow. For the identified Tor network flow, store the JA3 traffic fingerprint extracted in S200 into the Tor-JA3 traffic fingerprint library.

[0139] In one embodiment, the step S700 includes the following steps:

[0140] S710. For each network flow X, the normalized statistical feature A corresponding to it in S320 statistic , the normalized time domain feature A in S440 time , frequency domain feature A in S550 freq and Figure feature A in S600 graph The final feature A of network flow X is concatenated into {A statistic ||A time||A freq ||A graph};

[0141] S720. Train a fully connected neural network model;

[0142] Further, in step S720, step S720 includes the following steps:

[0143] S721. Select an open source annotated Tor traffic dataset from the Internet or obtain the original dataset by building a self-built dataset. The process of building a self-built dataset consists of the following three steps:

[0144] (1) By setting up a Tor environment in the local area network and simulating the usage environment, Wireshark or TCPdump is used to capture packets and aggregate flows to obtain the original Tor traffic data and mark it;

[0145] (2) By setting up a clear network environment in the local area network, use Wireshark or TCPdump to capture packets and aggregate flows to obtain normal traffic raw data and mark them;

[0146] (3) The annotated Tor traffic raw data and the annotated normal traffic raw data are combined and cleaned as the original data set;

[0147] S722. The data set obtained in S721 is subjected to the data preprocessing process of S120-S600;

[0148] S723. Divide the data set preprocessed in S722 into a training set and a test set.

[0149] Preferably, the ratio of training set to test set is 8:2;

[0150] S724. Perform supervised iterative training on the fully connected neural network using the training set divided in S723 as a training set and the test set divided in S723 as a test set;

[0151] During the training process, the early stopping method is used to ensure that the model obtains better parameters. The training is stopped early when the loss value of the model on the data set increases five times in a row; and the model is saved after every 10 rounds of training.

[0152] S730. Input the final feature A of the network flow X into the fully connected classifier trained in S720 to obtain the final classification result Y;

[0153] S740. For the part of the classification result Y that is judged to be the Tor network flow, the JA3 traffic fingerprint extracted in step S220 is stored in the Tor-JA3 traffic fingerprint library to facilitate subsequent judgment of new network flows.

[0154] It should be noted that, for the above method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and processes involved are not necessarily required by the present application.

[0155] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of complete software embodiments or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0156] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent replacements for some of the technical features therein.

Claims

1. A Tor anonymous network traffic identification method based on multi-dimensional feature deep learning, characterized in that: The following steps are involved: S100. Capture and preliminary screening of data packets; S200. Classify the data packets into a series of network flows, and represent each network flow as X = {x1, x2, ..., x n }, where x i is the i-th traffic packet in the network flow, and n is the number of traffic packets in the network flow; for each network flow X, extract its JA3 traffic fingerprint and match it with the Tor-JA3 traffic fingerprint library. If the traffic fingerprint exists in the Tor-JA3 traffic fingerprint library, the network flow is a Tor network flow; S300. For network flows that do not match the Tor traffic fingerprint library, use statistical methods to extract their statistical features, and extract the uplink and downlink directions of the data packets in these network flows; S400. Based on S300, sort the data packets according to the timestamps, obtain the time sequence of the data packets, and extract the time domain features of these network flows; S500. Based on S400, the frequency domain features of the network flow are further extracted using the FFT algorithm; S600. Based on S500, the CNN deep learning model is used to extract the content features of each data packet in the network flow, and the data packets constituting the network flow are used as nodes, and the content features of the data packets are used as node embedding vectors. The flow data graph of each network flow is constructed according to the time sequence of the data packets in S400 and the uplink and downlink directions of the data packets in S300 as the relationship; and the heterogeneous graph neural network model is used to extract the graph features of the flow data graph; S700. Based on step S600, train and use a fully connected neural network to fuse the normalized statistical features in S300, the normalized time domain features in S400, the frequency domain features in S500 and the graph features in S600, and obtain the classification results of each network flow; for the identified Tor network flow, store the JA3 traffic fingerprint extracted in S200 into the Tor-JA3 traffic fingerprint library.

2. According to claim 1, a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning is characterized in that: The step S100 includes the following steps: S110. Use Wireshark or TCPdump software to capture data packets, hereinafter referred to as "capturing packets"; S120. After all the data packets to be identified are captured, the relevant types of data packets are filtered out according to the following two rules: (1) non-TCP traffic; (2) non-SSL / TLS traffic; S130. Store the filtered data packets as original files in pcap data format.

3. According to claim 1, a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning is characterized in that: The step S200 includes the following steps: S210. The data packets are classified into M network flows through the five-tuple information of the data packets, hereinafter referred to as "flow aggregation"; the five-tuple information of the flow includes: (1) source IP address; (2) destination IP address; (3) source port number; (4) destination port number; (5) protocol; S220. Extract the five parameters sent during the TLS handshake process in each network flow, and then extract the JA3 traffic fingerprint of each network flow, hereinafter referred to as "fingerprint extraction operation"; the five parameters sent during the TLS handshake process specifically include: (1) SSL / TLS version number; (2) supported cipher suites; (3) supported extensions; (4) supported elliptic curves; (5) supported elliptic curve point formats; S230. Search the Tor-JA3 traffic fingerprint library for the JA3 traffic fingerprint of each network flow; if the JA3 traffic fingerprint exists in the Tor-JA3 traffic fingerprint library, the network flow is a Tor network flow.

4. According to claim 1, a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning is characterized in that: The step S300 includes the following steps: S310. Extract 10 statistical features A of each network flow X by statistical method rawstatistic ={s1,s2,…s 10 }, where n is the number of packets in the network flow; A rawstatistic It includes the following 10 features: (1) the number of data packets in the network flow; (2) the average length of data packets in the network flow; (3) the median length of data packets in the network flow; (4) the maximum value of data packets in the network flow; (5) the minimum value of data packets in the network flow; (6) the standard deviation of the length of data packets in the network flow; (7) the uplink and downlink ratio of data packets in the network flow; (8) the TCP flag bit of the data packet transport layer; (9) the average length of the uplink header of the data packets in the network flow; (10) the average length of the downlink header of the data packets in the network flow; S320. Count the characteristics A of each network flow in S310 rawstatixtic Statistical features in i Use Min-Max standardization; the network flow statistical feature is the kth flow among all M network flows in pcap, and the statistical feature of the flow is recorded as The specific formula is in, Features The normalized features obtained after Min-Max standardization are the normalized network flow statistical features. Facilitates use in subsequent processes; S330. Extract the uplink and downlink directions of each data packet in each network flow and store them as an uplink sequence E Fwd ={x α ,x β ,…,x δ },|E Fwd |∈[0,n] and the descending sequence E bwd =C X E Fwd , where C X E Fwd It means taking E on X Fwd The complement of .

5. According to claim 1, a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning is characterized in that: The step S400 includes the following steps: S410 sorts the packets in chronological order; specifically, the order of the packets is determined using the timestamps in the packets; S420. Store the data packets arranged in time sequence as time sequence E Time ={x1,x2,…x n }; S430. Extract the time domain feature A of each network flow X through the packet timestamp, timing and uplink and downlink direction attributes rawtime ={t1,t2,…t5}; A rawtime It includes the following five characteristics: (1) the duration of the network flow; (2) the average interval time between data packets in the network flow; (3) the average interval time between uplink packets in the network flow; (4) the average interval time between downlink packets in the network flow; (5) the time taken to establish a connection; S440. For each network flow time domain feature A in S430 rawtime The time domain characteristics t i Use Min-Max standardization; the network flow statistical feature is the kth flow among all M network flows in pcap, and the statistical feature of the flow is recorded as The specific formula is in, Features The normalized features obtained after Min-Max standardization are the normalized network flow statistical features. It is convenient for use in subsequent processes.

6. According to claim 1, a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning is characterized in that: The step S500 includes the following steps: S510. For each network flow, determine the arrival time of the data packet according to the timestamp in the data packet in step S410, and set a fixed time window length l t , divide the duration T of the total network flow into fixed-length time windows w1, w2, …, w p , S520. For each network flow, determine the time window sequence, and count the number of nodes that fall in each time window w. i The number of packets tr i , and sort them according to the time window order to obtain the packet arrival number sequence S ffttimeraw ={tr1,tr2,…,tr p }, S530. For each network flow, according to the timing sequence E extracted in step S420 Time The lengths of the data packets in the network flow extracted in step S310 are sorted in order to form a data packet length sequence S fftsizeraw = {sr1,sr2,…,sr n }, where n is the number of packets in the network flow; S540. For each network flow S ffttimeraw Using the FFT algorithm, the real and imaginary parts of each vector element are separated, and the obtained real and imaginary features are directly spliced ​​to achieve the frequency domain feature A of each network flow at the time level. rawtimefreq Extraction; for each network flow S fftsizeraw Using the FFT algorithm, the real and imaginary parts of each vector element are separated, and the obtained real and imaginary features are directly spliced ​​to achieve the frequency domain feature A at the length level of each network flow. rawtimefreq Extraction of S550. Frequency domain features of splicing time level A rawtimefreq and the frequency domain feature A at the length level rawsizefreq , obtain the frequency domain feature A of each network flow freq ={A rawtimefreq ||A rawsizefreq }.

7. According to claim 1, a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning is characterized in that: The step S600 includes the following steps: S610. For each network flow X={x1,x2,…,x n }, extract each packet x that constitutes X i The load portion x pi ; S620. For each x pi , define the grayscale image length g, and convert x pi The binary data is converted into a g×g grayscale image G content ; Specifically, for x pi Binary bit data, each bit is converted into a pixel, and its bit information is used as the grayscale value of the pixel, and arranged in sequence into a g×g grayscale map G content ; If the length of the data packet exceeds g×g bytes, only the first g×g length of data is taken; if the length of the data packet is less than g×g bytes, the remaining g×g bytes are padded with 0 as padding; S630. Use CNN deep learning model to transform x pi Encoded as the content feature S of each data packet content ; S640. For each network flow X={x1,x2,…,x n }, forming a network flow graph G flow Among them, G flow The nodes are the data packets x that constitute the network flow i ,i∈[1,n];G flow There are three types of edges: (1) the time series E extracted in step S420 Time ; (2) Uplink sequence E of the data packet extracted in step S330 Fwd ; (3) Downlink sequence E of the data packet extracted in step S330 bwd ; S650. The content feature S of each data packet extracted in S630 is content As G flow The embedding vector of the corresponding data packet node in ; S660. Define graph embedding length l g For each network flow X, obtain the corresponding network flow graph G obtained in S650 flow , and each network flow graph G corresponding to each network flow X flow Send it to the heterogeneous graph neural network model to perform the graph feature A corresponding to each network flow X graph Extraction; graph embedding length l g A graph The length of the heterogeneous graph neural network model is as follows: (1) a graph convolution layer; (2) a multi-head attention mechanism layer; (3) a single-head attention mechanism layer; (4) a graph convolution layer; (5) a global pooling layer; (6) a fully connected layer.

8. According to claim 1, a Tor anonymous network traffic identification method based on multi-dimensional feature deep learning is characterized in that: The step S700 includes the following steps: S710. For each network flow X, the normalized statistical feature A corresponding to it in S320 statistic , the normalized time domain feature A in S440 time , frequency domain feature A in S550 freq and Figure feature A in S600 graph The final feature A of network flow X is concatenated into {A statistic ||A time ||A freq ||A graph }; S720. Train a fully connected neural network model; S730. Input the final feature A of the network flow X into the fully connected classifier trained in S720 to obtain the final classification result Y; S740. For the part of the classification result Y that is judged to be the Tor network flow, the JA3 traffic fingerprint extracted in step S220 is stored in the Tor-JA3 traffic fingerprint library to facilitate subsequent judgment of new network flows.

9. The Tor anonymous network traffic identification method based on multi-dimensional feature deep learning according to claim 8 is characterized in that: The step S720 includes the following steps: S721. Select an open source annotated Tor traffic dataset from the Internet or obtain the original dataset by building a self-built dataset. The process of building a self-built dataset consists of the following three steps: (1) By setting up a Tor environment in the local area network and simulating the usage environment, Wireshark or TCPdump is used to capture packets and aggregate flows to obtain the original Tor traffic data and mark it; (2) By setting up a clear network environment in the local area network, use Wireshark or TCPdump to capture packets and aggregate flows to obtain normal traffic raw data and mark them; (3) The annotated Tor traffic raw data and the annotated normal traffic raw data are combined and cleaned as the original data set; S722. The data set obtained in S721 is subjected to the data preprocessing process of S120-S600; S723. Divide the data set preprocessed in S722 into a training set and a test set; S724. Use the training set divided in S723 as a training set and the test set divided in S723 as a test set to perform supervised iterative training on the fully connected neural network.

Images