A dynamic low-overhead traffic obfuscation method based on packet length distribution

Abstract

The present invention discloses a dynamic low-overhead traffic obfuscation method based on data packet length distribution, and belongs to the technical field of defense against encrypted traffic fingerprint detection. The problem of insufficient dynamics and high resource overhead of the traditional traffic obfuscation method in the prior art is solved; the present invention combines the distribution-based data packet length mapping method and the segmentation and stacking-based data packet modification method, and finally proposes a dynamic low-overhead traffic obfuscation method based on data packet length distribution. For each data packet in a data packet sequence, the target data packet length is first obtained by the distribution-based data packet length mapping method, and then the data packet is modified to the target length by the segmentation and stacking-based data packet modification method, and finally the obfuscated data packet sequence is obtained. The present invention effectively avoids the operation of introducing padding data in the data packet modification process, reduces the additional bandwidth overhead, and can be applied to obfuscate traffic in an actual network environment.

Description

Technical Field

[0001] The present invention relates to a dynamic low-overhead traffic obfuscation method, in particular to a dynamic low-overhead traffic obfuscation method based on data packet length distribution, and belongs to the technical field of defense against encrypted traffic fingerprint detection. Background Art

[0002] Encrypted traffic fingerprint attacks use specific features in encrypted data packets for analysis to build models to identify users' network activities. In order to effectively defend against such attacks, researchers have developed a variety of traffic obfuscation methods that aim to disrupt the characteristic patterns of encrypted data packets, making it difficult for potential attackers to identify and analyze traffic through traditional machine learning classifiers.

[0003] In the prior art, traffic obfuscation methods can be divided into randomization methods, traffic mimicry, and methods based on deep learning adversarial technology from the perspective of implementation principles. Randomization (randomizer) traffic obfuscation methods refer to randomizing website traffic fingerprints by random filling, random delay adjustment, encryption, bit operations, etc., including some field features and flow statistical features. For example, the obfs series obfuscation protocols and Dust protocols implemented by the Tor network are designed to enhance the protection of user traffic. The Dust protocol uses a special half-handshake mechanism to negotiate keys outside of communication, thereby enhancing security. Traffic mimicry traffic obfuscation methods simulate user traffic into network traffic with different characteristics by filling and shaping message sequences, changing the characteristic fields of data packets, etc. For example, the buffered fixed length method (BUFLO) changes traffic characteristics by sending fixed-length data packets at regular intervals. Although it provides higher security, it comes at the cost of higher bandwidth consumption. Some researchers have improved the buffered fixed length method. , proposed a congestion-sensitive buffer fixed length method (CS-BUFLO), which effectively improves the privacy protection of users when using encrypted proxies such as the Tor network through dynamic rate adaptation, congestion sensitivity and flow filling optimization, and achieves lower bandwidth overhead and acceptable latency than the buffer fixed length method in actual network environments; the method based on deep learning adversarial technology mainly utilizes the vulnerable characteristics of deep learning algorithms to interfere with the accuracy of deep learning classifiers by generating specially made adversarial samples. The above-mentioned deep learning algorithms often exhibit certain linear behaviors, making them susceptible to adversarial samples. Some researchers have explored the possibility of applying adversarial machine learning technology in traffic analysis, and used the fast gradient sign method (FGSM) to generate adversarial samples, which effectively reduced the accuracy of CNN-based classifiers in traffic classification tasks. The researchers also proposed the use of generative adversarial networks (GANs) to generate network traffic that can mimic the traffic characteristics of specific applications. Generative adversarial network technology can automatically learn target traffic characteristics and use generative adversarial network models to generate deceptive traffic patterns.

[0004] However, the above-mentioned existing technologies still have the following problems: the randomized traffic obfuscation method randomly modifies the packet length, timing and other features of the traffic to deceive the detection method. However, the randomized traffic obfuscation method greatly relies on the researchers' prior knowledge of traffic features, and it takes a lot of manpower to migrate and expand different traffic. In addition, feature randomization often involves operations such as filling data packets and sending virtual data packets, which will bring large bandwidth overhead to network devices; the traffic mimicry traffic obfuscation method also requires a large number of data packet filling and construction of virtual data packets, making it difficult to effectively apply in a real network environment. In addition, obtaining the characteristics of the target traffic is often achieved through statistical methods or machine learning methods. Obtaining the characteristics of the target traffic is cumbersome and has a huge overhead, and it is almost impossible to do it in real time with data packet filling. At the same time, most Traffic mimicry and traffic obfuscation methods only map traffic features, but as long as the detector observes carefully enough and invests enough time, it is still possible to detect the disguise. In addition, since most traffic mimicry and traffic obfuscation methods require a large computational overhead for re-mimicry, they can only be deployed statically in actual network environments. If the target traffic is included in the banned list or the detector finds the mapping relationship between the original traffic and the target traffic, after taking ban measures, the traffic mimicry and traffic obfuscation methods will be completely ineffective and unable to make adaptive responses; the method based on deep learning adversarial technology mainly utilizes the vulnerability of deep learning algorithms, and constructs adversarial samples to confront the deep learning-based classifier, making it unable to correctly detect classified traffic. The method based on deep learning adversarial technology is mainly divided into adversarial machine learning (Adversarial Machine Learning) and adversarial machine learning (Adversarial Machine Learning). Machine Learning (AML) and Generative Adversarial Networks. Adversarial machine learning is a white-box method, that is, in order to generate perturbation vectors and construct adversarial samples, it is necessary to obtain the model structure and parameter information of the classifier being confronted, but the above conditions are almost impossible to meet in a real network environment. In general, it is not possible to pre-assume the type of deep learning network adopted by the detector, and it is even impossible to know whether the detector uses a deep learning network. Therefore, the deployment and use of the above methods in a real network environment are greatly limited. Secondly, the adversarial samples generated by adversarial machine learning have model migration problems, that is, when adversarial samples constructed for a certain deep learning model are migrated to other deep learning models, their adversarial ability will be greatly reduced. Since the detector only needs to use multiple different deep learning models for detection, the adversarial samples can be invalidated, which further limits the actual deployment capability of the adversarial machine learning method. In addition, the generated adversarial samples are samples in the feature space rather than real traffic. For the task of generating corresponding real network traffic based on samples in the feature space, the existing methods have not yet proposed a feasible solution. Therefore, although the method based on deep learning adversarial technology is adaptive, it requires prior information about the target classifier and has poor migration between different models.At the same time, although generative adversarial networks can automatically learn traffic characteristics, they need to retrain the model to adapt to different goals, and disguised traffic operations will still increase the burden on the equipment.

[0005] To sum up, the existing traffic obfuscation methods have problems such as insufficient dynamics, high re-obfuscation cost, large additional resource overhead, the need for packet padding and delayed packet sending. Some existing traffic obfuscation methods can only achieve obfuscation in the feature space and cannot confuse the actual traffic, thus losing the value of practical applications. Therefore, a traffic obfuscation method that is dynamic and avoids additional voluntary overhead is needed. Summary of the invention

[0006] A brief overview of the present invention is provided below in order to provide a basic understanding of certain aspects of the present invention. It should be understood that this overview is not an exhaustive overview of the present invention. It is not intended to identify key or important parts of the present invention, nor is it intended to limit the scope of the present invention. Its purpose is merely to present certain concepts in a simplified form as a prelude to a more detailed description discussed later.

[0007] In view of this, in order to solve the problems of insufficient dynamics and high resource overhead of traditional traffic obfuscation methods in the prior art, the present invention provides a dynamic low-overhead traffic obfuscation method based on data packet length distribution.

[0008] The technical solution is as follows: A dynamic low-overhead traffic obfuscation method based on data packet length distribution includes the following steps:

[0009] S1. According to the data packet sequence, data length sequence and original distribution, select the target distribution, traverse each length in the data length sequence and map it to obtain the mapped length;

[0010] S2. When the mapped length is less than each length, perform a split operation on the data packets in the data packet sequence, update the mapped length, and if the mapped length is still less than each length, repeat the split operation until the mapped length is greater than or equal to each length;

[0011] S3. When the mapped length is greater than or equal to each length, a stacking operation is performed on the data packets in the data packet sequence to obtain an obfuscated data packet sequence.

[0012] Furthermore, in S1, for a data packet sequence packet, its data length sequence is lengths, and the data packet length obeys the original distribution D. In the initialization phase, an empty buffer queue buffer is created to cache the data of all data packets, and a distribution is selected as the target distribution D. target , determine the target distribution D targetFor the corresponding probability p, then traverse each length length in the data length sequence lengths, and perform mapping LengtMap on each length length to obtain the mapped length length with probability p target .

[0013] Further, in S2, if length target < length, perform a splitting operation on the data packet packet, that is, take out the data with length length from the buffer queue buffer through the Dequeue function target and encapsulate it into a new data packet packet new , and put the new data packet packet new into the new data packet sequence packets new , update the length length to the remaining length length - length that needs to be sent of the data packet packet target and perform mapping on it to update the mapped length length target , if there is still length target < length, repeat the above operations until length target ≥ length.

[0014] Further, in S3, if length target ≥ length, perform a stacking operation on the data packet packet, that is, take out the data with length length from the buffer queue buffer through the Dequeue function target and encapsulate it into a new data packet packet new , and put the new data packet packet new into the new data packet sequence packets new , after traversing all lengths length, if there is still data in the buffer queue buffer, then encapsulate all the remaining data into a data packet packet new and put it into the new data packet sequence packets through the Append function new That is, the confused data packet sequence is obtained.

[0015] The beneficial effects of the present invention are as follows: the present invention adopts the operations of segmentation and stacking to avoid the operation of introducing padding data in the process of modifying the data packet, reduces the additional bandwidth overhead as much as possible, and uses the data packet length distribution to map the data packet length. The diversity of distribution can provide extremely strong mapping diversity, so that the traffic obfuscation method proposed by the present invention has strong obfuscation dynamics, and it is more difficult for attackers to find the regularity of the traffic after obfuscation, thereby making it impossible for attackers to obtain privacy information from the traffic; the present invention can modify the data packet length without introducing additional bandwidth overhead and low computing time overhead, so that the overall resource overhead of the traffic obfuscation method proposed by the present invention is very low, and can be deployed in an actual network environment; since the target data packet length is obtained by using a distribution-based data packet length mapping method, the present invention only needs to switch the target distribution to change the characteristic value after obfuscation. If the input target distribution is the data packet length distribution of other websites, then the present invention can become a mimetic method. If the input target distribution is a mathematical distribution controlled by parameters, the obfuscation result can be adjusted at any time by modifying the parameters, such as setting the parameters as a function of time. The traffic after obfuscation in the above manner can hardly be detected by the encrypted traffic fingerprint detection method. Therefore, the ability to adjust the target distribution at any time provides the present invention with extremely strong dynamics and flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 A flowchart of a dynamic low-overhead traffic obfuscation method based on packet length distribution is provided;

[0018] Figure 2 A schematic diagram of a flow chart of a distribution-based packet length mapping method;

[0019] Figure 3 A code diagram of a distribution-based packet length mapping method;

[0020] Figure 4 A flow chart of a traffic obfuscation method based on packet length distribution;

[0021] Figure 5 A schematic flow chart of an embodiment of a dynamic low-overhead traffic obfuscation method based on data packet length distribution;

[0022] Figure 6 A code diagram of a dynamic low-overhead traffic obfuscation method based on packet length distribution. DETAILED DESCRIPTION

[0023] In order to make the technical solutions and advantages of the embodiments of the present invention more clearly understood, the exemplary embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0024] refer to Figure 1-Figure 6 The present embodiment is described in detail, a dynamic low-overhead traffic obfuscation method based on data packet length distribution, specifically comprising the following steps:

[0025] S1. According to the data packet sequence, data length sequence and original distribution, select the target distribution, traverse each length in the data length sequence and map it to obtain the mapped length;

[0026] S2. When the mapped length is less than each length, perform a split operation on the data packets in the data packet sequence, update the mapped length, and if the mapped length is still less than each length, repeat the split operation until the mapped length is greater than or equal to each length;

[0027] S3. When the mapped length is greater than or equal to each length, a stacking operation is performed on the data packets in the data packet sequence to obtain an obfuscated data packet sequence.

[0028] Furthermore, in S1, for a data packet sequence packets, the data length sequence is lengths, and the data packet length obeys the original distribution D. In the initialization phase, an empty buffer queue buffer is created to cache the data of all data packets, and a distribution is selected as the target distribution D. target , determine the target distribution D target The corresponding probability p, then traverse the length length of each length in the data length sequence lengths, and map each length length to Lengt h Map gets the length of the mapped value with probability p target ;

[0029] Specifically, the traffic features used by the existing encrypted traffic fingerprint detection methods are mainly divided into two categories: the spatial features of the traffic, i.e., the relevant features of the packet length sequence, and the temporal features of the traffic, i.e., the relevant features of the packet interval time sequence. Among them, the spatial features of the traffic are highly correlated with the traffic packet length distribution, while in a real network environment, the temporal features of the traffic are greatly affected by the traffic packet length sequence;

[0030] The present invention combines a distribution-based packet length mapping method and a packet modification method based on segmentation and stacking, and finally proposes a dynamic low-overhead traffic obfuscation method based on packet length distribution. For each packet in a packet sequence, first obtain the target packet length through the distribution-based packet length mapping method, and then use the packet modification method based on segmentation and stacking to modify the packet to the target length;

[0031] Reference Figure 3 , the steps of the distribution-based packet length mapping method are as follows: For the traffic of any website, use the calculated probability distribution of the packet lengths of the traffic of one website as the original distribution D, and select the packet length distribution of the traffic of another website or a mathematical distribution generated by specifying parameters as the target distribution D target , for the original packet pkt with length L, retrieve the probability p corresponding to it in the original distribution D through the GetProb function, and then in the target distribution D target retrieve the packet length L after mapping with the same probability p through the GetProb function new and output, the mapping Lengt h The Map process is expressed as: Lengt h Map: D×D target ×L→L new , keys() is used to obtain all possible packet length values in the target distribution. Dtarget is essentially a dictionary, where the keys are packet length values and the values are the probabilities corresponding to the packet lengths;

[0032] Further, in S2, if length target < length, perform a segmentation operation on the packet packet, that is, take out the data with length length from the buffer queue buffer through the Dequeue function and encapsulate it into a new packet packet target , put the new packet packet new into the new packet sequence packets through the Append function new , update the length length to the remaining length length - length that needs to be sent of the packet packet new , and perform mapping on it to update the mapped length length target , if there is still length target < length, repeat the above operations until length target ≥ length. target ≥length.

[0033] Further, in S3, if lengthtarget ≥ length, perform a stacking operation on the data packet packet, that is, retrieve data with a length of length from the buffer queue bufer through the Dequeue function target and encapsulate it into a new data packet packet new , and put the new data packet packet new into the new data packet sequence packets new , after traversing all lengths length, if there is still data in the buffer queue buffer, then encapsulate all the remaining data into a data packet packet new and put it into the new data packet sequence packets through the Append function new that is, obtain the obfuscated data packet sequence;

[0034] Specifically, the steps of the data packet modification method based on splitting and stacking are as follows: For a data packet sequence packets, packets = [P1, P2,..., P n , its data length sequence is lengths, lengths = [L1, L2,..., L n , its original distribution is D, and the target distribution is D target , maintain a buffer queue buffer. First, put all the data packet data into the buffer queue buffer. For the first length L1, perform a mapping Lengt h Map to obtain the first mapped length L'1, L'1 = Lengt h Map(D, D target , L1). If L1 < L'1, stack the data packets, that is, extract data with a length of L'1 from one or more subsequent data packets in the data buffer queue buffer, stack them into a new data packet P'1 with a length of L'1 and send it out. If L1 > L'1, split the data packets, that is, use the first L'1 part of the first data packet P1 as the new data packet P'1 and send it out. Map the remaining length L1 - L'1 of the first data packet P1 with Lengt h Map to obtain a new length L”1, L”1 = Lengt h Map(D, D', L1 - L'1), and repeat the above operations until the data packets do not need to be split again;

[0035] The traditional operation of modifying the data packet length is expressed as: Once a certain traditional data packet length L p is mapped to the traditional target length L' p , then the original data packet pkt needs to be modified. If L p > L'p , then the final length of the data packet is L p -L' p The data is discarded if L p <L' p , then fill the data packet, but the above operation does not take into account the availability in the real network environment, that is, directly discarding the data packet may cause the network protocol to fail, thus affecting the actual user experience, and filling the data packet often adds a lot of additional bandwidth overhead. In addition, if filling is performed, it is necessary to determine whether the content belongs to the original data or the filling data, which increases the complexity of data packet processing;

[0036] Theoretically, the packet modification method based on segmentation and stacking does not introduce any additional padding data, and the time complexity is O(n), and the resource overhead is very small. Even in the actual network environment, encapsulating new packets may introduce additional header information, but this overhead can also be ignored;

[0037] refer to Figure 4 , new length is the length after mapping target , data_sender is a data processing thread, responsible for calling the LengthMap function to map the length and taking out the length from the buffer target The data is processed and remapping is decided. Modify is the modification process and prob is the probability value corresponding to the original length.

[0038] refer to Figure 5 , the original length of the data packet L1 is the length length, and the target data packet length L2 is the length after mapping target ;

[0039] refer to Figure 6 ,packet new ←MakePackey(data) means encapsulating into a new data packet new process, buffer.NotEmpty() indicates that there is still data in the buffer queue buffer.

[0040] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative, not restrictive, with respect to the scope of the present invention, which is defined by the appended claims.

Claims

1. A dynamic low-overhead traffic obfuscation method based on packet length distribution, characterized in that: The following steps are involved: S1. According to the data packet sequence, data length sequence and original distribution, select the target distribution, traverse each length in the data length sequence and map it to obtain the mapped length; S2. When the mapped length is less than each length, perform a split operation on the data packets in the data packet sequence, update the mapped length, and if the mapped length is still less than each length, repeat the split operation until the mapped length is greater than or equal to each length; S3. When the mapped length is greater than or equal to each length, a stacking operation is performed on the packets in the packet sequence to obtain a sequence of packets after obfuscation; In S1, for a data packet sequence packets, the data length sequence is lengths, and the data packet length follows the original distribution D. In the initialization phase, an empty buffer queue buffer is created to cache the data of all data packets, and a distribution is selected as the target distribution D. target , determine the target distribution D target The corresponding probability p, then traverse the length length of each length in the data length sequence lengths, map each length length LengthMap to obtain the mapped length length with probability p target .

2. A dynamic low-overhead traffic obfuscation method based on data packet length distribution according to claim 1, characterized in that: In S2, if length target <length, perform a split operation on the data packet, that is, take out a packet with a length of length from the buffer queue buffer through the Dequeue function target The data is encapsulated into a new data packet new , use the Append function to append the new data packet to the new Put new data packets into the sequence packets new , update the length length to the remaining length length-length of the data packet packet to be sent target And map it, update the length after mapping target If length still exists target <length, repeat the above operation until length target ≥length.

3. A dynamic low-overhead traffic obfuscation method based on data packet length distribution according to claim 2, characterized in that: In S3, if length target ≥length, perform a stacking operation on the data packet packet, that is, take out a packet with a length of length from the buffer queue buffer through the Dequeue function target The data is encapsulated into a new data packet new , use the Append function to append the new data packet to the new Put new data packets into the sequence packets new After traversing all lengths, if there is still data in the buffer queue, all the remaining data will be encapsulated into a data packet. new And put it into a new data packet sequence packets through the Append function new That is, the obfuscated data packet sequence is obtained.

Images