Encrypted website traffic anti-noise identification method, system, device, medium and product

Abstract

The invention discloses an encrypted website traffic anti-noise identification method, system and device, a medium and a product, and relates to the field of digital information transmission. The method comprises the following steps: acquiring encrypted traffic generated when a user accesses a website, and storing the encrypted traffic as a PCAP file containing a plurality of data packets according to a set rule; cleaning a data packet in the PCAP file to obtain a cleaned encrypted traffic; performing data stream recombination on the cleaned encrypted traffic based on quintuple information of the data packet to obtain a plurality of data streams; respectively carrying out website feature extraction on each data packet in each data stream to obtain a website fingerprint extraction result; generating graph structure data based on the website fingerprint extraction result; and performing a graph classification task on the graph structure data, and completing prediction of user access sites according to a classification result. On the premise that background noise exists, website traffic identification can be effectively implemented. According to the method and the device, the website traffic can be effectively identified on the premise of background noise.

Description

Technical Field

[0001] The present application relates to the field of digital information transmission, and in particular to a method, system, device, medium and product for anti-noise identification of encrypted website traffic. Background Art

[0002] Website traffic identification is a means to effectively deal with privacy-enhancing technologies. With the application of machine learning and deep learning in the field of website traffic identification, website traffic identification technology has developed rapidly. However, the current research on website traffic identification still has unreasonable settings. In the existing research on website traffic identification, most researchers will conduct research under the assumption of "no background noise" to simplify the difficulty of the research topic and clarify the research objectives. In the actual network environment, especially in the TLS / SSL network environment, background noise often exists, which significantly reduces the prediction accuracy of research results based on such assumptions when applied, and limits the application and deployment of research results. For example, when background noise traffic exists in the TLS / SSL network environment, effective website traffic identification is an issue that cannot be ignored for promoting the deployment and application of website traffic identification technology in the TLS / SSL network environment.

[0003] At present, website traffic identification technologies mainly include website traffic identification methods based on machine learning and website traffic identification methods based on deep learning. Website traffic identification methods based on machine learning mainly identify traffic by building feature classifiers that are sensitive to traffic data. Usually, these methods use supervised machine learning algorithms, such as support vector machines (SVM), K-nearest neighbor (KNN), etc. The key to these methods is the need to extract traffic features that can complete classification tasks from encrypted traffic of feature engineering. The challenges faced by website traffic identification methods using machine learning include the need for a large amount of manual feature screening to select the most effective feature combination, which is a great test for the expert's professional knowledge and data analysis skills. Secondly, the manually selected feature combination is not robust and cannot cope with a variety of scenarios.

[0004] The methods of implementing website traffic identification using deep learning technology can be mainly divided into website traffic identification based on traditional deep learning technology and website traffic identification technology based on graph representation.

[0005] The website traffic identification methods based on traditional deep learning mainly include the traffic identification method of extracting website fingerprints from the side channel and the method of extracting website fingerprints directly from the encrypted payload. Researchers who extract website fingerprints from the side channel believe that the traffic encryption process only encrypts the payload information transmitted by the user, while the side channel information of the packet header is not encrypted. With the help of the differences in the side channel information of different websites, the identification task of different websites can be achieved. Researchers who use encrypted payloads to extract features believe that the side channel information will change with the devices used by network users and the network conditions, which will lead to poor versatility of website traffic identification based on side channels. The encrypted payload will not fluctuate and change greatly with the network conditions and network devices, so the website fingerprint extracted from the encrypted payload has higher robustness. Website traffic identification technology based on traditional deep learning has become the mainstream in the research of website traffic identification technology in recent years. The black box characteristics of deep learning technology are the main challenges faced by website traffic identification based on deep learning technology. The black box characteristics make it difficult to explain the website fingerprints extracted by deep learning technology.

[0006] The graph representation method is a method that uses non-Euclidean geometric data structures to represent objects and the connections between objects. When it comes to digitally expressing real-world scenarios, it has advantages that traditional Euclidean space geometry cannot match. In the field of website traffic identification, using graphs to represent encrypted traffic and using graph neural technology to achieve website traffic identification has gradually become one of the research hotspots. However, it is still difficult to achieve a unified approach to using graph structures to represent encrypted traffic.

[0007] In the study of website traffic identification for data traffic containing background noise, Wang et al. proposed two solutions: counting-based and classification-based. However, experimental results show that these two solutions also delete a large number of non-noise data nodes while separating noise, which means that the method of purifying encrypted traffic cannot achieve effective noise-resistant website traffic identification.

[0008] Most of the above-mentioned methods for identifying website traffic are carried out under the premise of no background noise. Although Wang et al. took the existence of background noise into consideration, they did not propose a very effective solution. In the real network environment, since a large number of network applications use TLS / SSL encrypted traffic to transmit data, the problem of background noise is almost unavoidable. Therefore, providing a method or system that can implement effective website traffic identification under the premise of background noise has become a technical problem that needs to be solved in this field. Summary of the invention

[0009] The purpose of this application is to provide a method, system, device, medium and product for anti-noise identification of encrypted website traffic, which can effectively implement the identification of website traffic under the premise of background noise.

[0010] To achieve the above objectives, this application provides the following solutions:

[0011] In a first aspect, the present application provides a method for anti-noise identification of encrypted website traffic, comprising:

[0012] Acquire the encrypted traffic generated when the user visits the website, and save the encrypted traffic into a PCAP file containing multiple data packets according to the set rules;

[0013] Cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic;

[0014] Based on the five-tuple information of the data packet in the PCAP file, the cleaned encrypted traffic is reorganized to obtain multiple data streams; the five-tuple information includes the source IP, the destination IP, the source port, the destination port and the protocol type;

[0015] Extract website features from each data packet in each data stream to obtain website fingerprint extraction results;

[0016] Generate graph structure data based on the website fingerprint extraction result;

[0017] A graph classification task is performed on the graph structure data, and a prediction of the user's visited sites is completed based on the classification result.

[0018] Optionally, cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic specifically includes:

[0019] Determine the type of data packets in the PCAP file, delete the data packets generated in the LAN environment, and retain the data packets of TLS encrypted traffic to obtain the cleaned PCAP file;

[0020] Keep the first 1024 packets in the cleaned PCAP file;

[0021] Generates cleaned encrypted traffic based on the first 1024 packets retained.

[0022] Optionally, website feature extraction is performed on each data packet in each data stream to obtain a website fingerprint extraction result, which specifically includes:

[0023] Use 0 bytes to fill sensitive information in each data stream; the sensitive information includes: source IP, destination IP, source port, destination port and server name indication;

[0024] Convert the first 256 bytes of each data packet in each data stream filled with sensitive information into binary values;

[0025] The binary value is used as the website fingerprint extraction result, and the transmission direction information of each data packet is saved according to the transmission direction of the data packet in each data flow.

[0026] Optionally, the cleaned encrypted traffic is reassembled based on the five-tuple information of the data packet in the PCAP file to obtain multiple data streams, including:

[0027] The source IP in the five-tuple information is adjusted to the address of the local user, the source port is adjusted to the port of the local user, the target IP is adjusted to the address of the server, and the target port is adjusted to the port of the server to obtain the adjusted five-tuple information;

[0028] The adjusted five-tuple information is used as a data flow identifier, and the cleaned encrypted traffic is divided into multiple PCAP data flow files according to the data flow identifier to obtain multiple data flows.

[0029] Optionally, generating graph structure data based on the website fingerprint extraction result specifically includes:

[0030] For each data stream, the data packets in the data stream are taken as nodes, directed edges are set according to the transmission direction of the data packets in the data stream, and the head node and the tail node are connected by the directed edges according to the burst relationship of the data stream to obtain an initial graph structure;

[0031] For the cleaned encrypted traffic, a virtual master node is added to the initial graph structure;

[0032] A directed edge is established between the virtual master node and the first data packet of the data stream to obtain the graph structure data.

[0033] Optionally, a graph classification task is performed on the graph structure data, and a prediction of the user's visited sites is completed according to the classification result, specifically including:

[0034] For the graph structure data corresponding to each data flow, the node features are obtained from the node load through the autoencoder, and the connection relationship of the nodes remains unchanged to form a new encrypted traffic feature graph, and the decoder is used to limit the information of the new encrypted traffic feature graph to obtain a new encrypted traffic graph representation;

[0035] Perform graph-level feature extraction on the graph representation of the new encrypted traffic to obtain the full graph features of the entire encrypted traffic;

[0036] Two fully connected layers are used as classifiers to classify the full-image features to obtain classification results, and the user's visited sites are predicted based on the classification results.

[0037] In a second aspect, the present application provides an encrypted website traffic anti-noise identification system, comprising:

[0038] A traffic collection device, used to obtain the encrypted traffic generated when a user visits a website, and save the encrypted traffic into a PCAP file containing multiple data packets according to set rules;

[0039] A traffic cleaning device, connected to the traffic collection device, for cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic;

[0040] A traffic reassembly device, connected to the traffic cleaning device, for reassembling the cleaned encrypted traffic based on the five-tuple information of the data packet in the PCAP file to obtain multiple data streams; the five-tuple information includes the source IP, the destination IP, the source port, the destination port and the protocol type;

[0041] A website fingerprint extraction device is connected to the traffic reassembly device and is used to extract website features from each data packet in each data stream to obtain a website fingerprint extraction result;

[0042] The website prediction device is connected to the website fingerprint extraction device, and is used to generate graph structure data based on the website fingerprint extraction result, perform graph classification tasks on the graph structure data, and complete the prediction of user visit sites according to the classification results.

[0043] In a third aspect, the present application provides a computer device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method for anti-noise identification of encrypted website traffic described in any one of the above.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described methods for anti-noise identification of encrypted website traffic.

[0045] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned methods for anti-noise identification of encrypted website traffic.

[0046] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0047] The present application provides a method, system, device, medium and product for anti-noise identification of encrypted website traffic. By cleaning the data packets in the generated PCAP file to obtain the cleaned encrypted traffic, the capacity of the collected encrypted traffic can be reduced as much as possible, and the interference of irrelevant traffic on website traffic identification can be reduced; by reorganizing the data stream of the cleaned encrypted traffic based on the five-tuple information of the data packet in the PCAP file, multiple data streams are obtained, the data stream information of the encrypted traffic (i.e., the performance of noise) is taken into account, and website features are extracted from each data packet in each data stream to obtain website fingerprint extraction results, and graph structure data is generated based on the website fingerprint extraction results, which fully reduces the impact of noise traffic, and then the graph structure data is classified. The prediction of user visit sites is completed according to the classification results, and the identification of website traffic is effectively implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 An application environment diagram of the method for anti-noise identification of encrypted website traffic provided by an embodiment of the present application;

[0050] Figure 2 A flowchart of a method for anti-noise identification of encrypted website traffic provided by an embodiment of the present application;

[0051] Figure 3 Another application environment diagram of an encrypted website traffic anti-noise identification method provided by an embodiment of the present application;

[0052] Figure 4 A schematic diagram comparing encrypted traffic without noise and encrypted traffic with noise provided in an embodiment of the present application; wherein: Figure 4 (a) is a schematic diagram of encrypted traffic without noise (i.e., clean encrypted traffic). Figure 4 (b) is a schematic diagram of encrypted traffic containing other application traffic (i.e., encrypted traffic containing noise);

[0053] Figure 5 The overall framework diagram of the model provided for one embodiment of the present application;

[0054] Figure 6 A comparison chart of encrypted traffic prediction results without noise and with fixed-ratio noise provided in an embodiment of the present application;

[0055] Figure 7 A graph showing changes in prediction accuracy of a model provided in another embodiment of the present application as noise ratio changes;

[0056] Figure 8 A prediction result diagram after deleting a module in a model provided in an embodiment of the present application;

[0057] Fig. 9 A schematic diagram of the structure of an encrypted website traffic anti-noise identification system provided in an embodiment of the present application;

[0058] Fig.10 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0060] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0061] The method for anti-noise identification of encrypted website traffic provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be set up separately, integrated on the server 104, or placed on the cloud or other servers. The terminal 102 can send the encrypted traffic generated when the user visits the website to the server 104. After the server 104 receives the encrypted traffic generated when the user visits the website, for the encrypted traffic generated when the user visits the website, the server 104 saves the encrypted traffic into a PCAP file containing multiple data packets according to the set rules. The data packets in the PCAP file are cleaned to obtain the cleaned encrypted traffic. Based on the five-tuple information of the data packet in the PCAP file, the cleaned encrypted traffic is reorganized to obtain multiple data streams. The website feature is extracted for each data packet in each data stream to obtain the website fingerprint extraction result. The graph structure data is generated based on the website fingerprint extraction result. The graph classification task is performed on the graph structure data, and the prediction of the user's visit site is completed according to the classification result. The server 104 can feedback the obtained prediction result of the user's visit site to the terminal 102. In addition, in some embodiments, the method for anti-noise identification of encrypted website traffic can also be implemented independently by the server 104 or the terminal 102. For example, the terminal 102 can directly process the encrypted traffic generated when the user visits the website, or the server 104 can obtain the encrypted traffic generated when the user visits the website from the data storage system and process the encrypted traffic generated when the user visits the website.

[0062] The terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers, or may be a cloud server.

[0063] In an exemplary embodiment, Figure 2 As shown, a method for anti-noise identification of encrypted website traffic is provided. The method is executed by a computer device, and can be executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the method is applied to Figure 1 The server 104 in the example is used as an example to illustrate, including the following steps 200 to 205. Figure 2 As shown, the method for anti-noise identification of encrypted website traffic:

[0064] Step 200: Obtain the encrypted traffic generated when the user visits the website, and save the encrypted traffic into a PCAP file containing multiple data packets according to the set rules.

[0065] Step 201: Clean the data packets in the PCAP file to obtain cleaned encrypted traffic.

[0066] Step 202: Based on the five-tuple information of the data packet in the PCAP file, the cleaned encrypted traffic is reassembled to obtain multiple data streams. The five-tuple information includes source IP, destination IP, source port, destination port and protocol type.

[0067] Step 203: Extract website features from each data packet in each data stream to obtain a website fingerprint extraction result.

[0068] Step 204: Generate graph structure data based on the website fingerprint extraction result.

[0069] Step 205: Perform a graph classification task on the graph structure data, and complete the prediction of the user's visited sites based on the classification results.

[0070] By implementing the above steps 201 to 205, the identification of website traffic can be effectively implemented under the premise of background noise. In addition, the present application can also reduce the capacity of the collected encrypted traffic as much as possible, and reduce the interference of irrelevant traffic on the identification of website traffic.

[0071] In another exemplary embodiment of the present application, in order to facilitate subsequent processing, the above step 200 is replaced by the following steps 301 to 302:

[0072] Step 301: The traffic collection device will use network probes such as tshark, tcpdump, etc. to collect traffic from the local area network environment.

[0073] Step 302: The traffic collection device saves the collected large amount of traffic into multiple PCAP files according to certain rules. The set rules include the source IP information of the data packet, which is used to divide the encrypted traffic generated by different users. The set rules can also include the transmission time of the traffic. When users visit a website, they will generate a traffic transmission mode different from the background traffic bandwidth in a short period of time, which will show a peak in the time-transmission rate graph. Therefore, each peak will be divided to generate multiple PCAP files, each file corresponding to the encrypted traffic generated by a user visiting the website once.

[0074] In another exemplary embodiment of the present application, in order to reduce the volume of the collected encrypted traffic as much as possible and reduce the interference of irrelevant traffic on website traffic identification, the above step 201 is replaced by the following steps 401 to 402. Among them:

[0075] Step 401: For the data packets in the PCAP file, determine the type of the data packets, delete the data packets generated in the LAN environment, and only retain the data packets of the TLS encrypted traffic.

[0076] Step 402: For each PCAP file after cleaning, only the first 1024 data packets are retained at most, and the data packets after 1024 are deleted.

[0077] After completing the above steps 401 to 402, a cleaned encrypted traffic is obtained. This cleaned encrypted traffic is recorded as T, T = {p1, p2, ..., p n-1 ,p n}(n≤1024). In the formula, p i It represents i data packets, i=1,2,...,n.

[0078] In another exemplary embodiment of the present application, after the data stream reassembly is completed, the data packets of the same data stream are organized together so as to facilitate the subsequent aggregation and representation of the data packets according to the same data stream identifier.

[0079] Based on this, the above step 202 is replaced by the following steps 501 to 502. Among them:

[0080] Step 501: For the encrypted traffic T processed in step 402, all data packets p of the encrypted traffic T are i The five-tuple information is extracted and adjusted so that the source IP and source port are the address and port of the local user, the target IP and target port are adjusted to the address and port of the server, and the adjusted five-tuple information is used as the data flow identifier.

[0081] Step 502: Divide the data packets with the same data flow identifier into multiple PCAP data flow files, thereby obtaining multiple data flows. The data flow is represented by F i ={p i1 ,p i2 ,…,p i(k-1) ,p ik}. In the formula, F i represents the i-th data flow in the encrypted traffic, p ij represents the jth data packet in the i-th data stream, j = 1,, 2, ..., k.

[0082] In another exemplary embodiment of the present application, when extracting features from each data packet, each data packet contains sensitive information such as source IP, destination IP, source port, destination port, and server name indication (SNI). The presence of these sensitive information will affect the training process of the model. In order not to affect the training process of the model, these fields will be filled with 0 bytes before feature extraction to cover the sensitive information in the original data packet. The first 256 bytes of the data packet are then converted into binary values ​​as feature vectors of the data packet, and the transmission direction information of each data packet is saved according to the transmission direction of the data packet. Based on this, the above step 203 is replaced by the following steps 601 to 602.

[0083] in:

[0084] Step 601: Cover sensitive information with zero bytes. Since IP addresses and port numbers may change with different regions and users, 0x00 is used to directly cover this part of information. For SNI information, since there is no SNI information transmitted in plain text under the ESNI and ECH protocols, considering that the protocol may be used in the future, this part of information is directly covered. The first 256 bytes are retained, and each byte is converted into an integer value and divided by 255 to complete data normalization.

[0085] Step 602: Since the distinction between uplink and downlink data packets is beneficial to website traffic identification, uplink packets and downlink packets are distinguished according to whether the source IP of each data packet is the user IP or the server IP, and the direction of the data packet is retained according to the uplink and downlink of the data packet.

[0086] In another exemplary embodiment of the present application, after processing the encrypted traffic generated by a user visiting a website, multiple different data flow information will be generated. Therefore, each data flow will generally be merged into a local subgraph structure, and multiple subgraph structures will be connected together through virtual nodes to generate a graph structure to complete the representation of the encrypted traffic. Based on this, the above step 204 is replaced by the following steps 701 to 702.

[0087] in:

[0088] Step 701: For each data flow F i ={p i1 ,p i2 ,…,p i(k-1) ,p ik}, arrange the data packets in a row according to their collection time, set directed edges according to the transmission direction of the data packets, and set the upstream packets to p i(j-1) →p ij , the downlink packet is set to p ij →pi(j-1) According to the burst relationship of the data flow, the head node and the tail node of the burst structure are connected by directed edges to obtain the initial graph structure.

[0089] Step 702: For the encrypted traffic T, add a virtual master node p to the initial graph structure obtained in step 701 client , as all data streams F i In step 701, for data stream F i During processing, since each node represents the direction of the data packet by establishing a directed edge with the previous node in the same data stream, the direction of the first data packet in the data stream is omitted. Therefore, a non-directional virtual main node is added to the data stream and a directed edge is established with the first node in the initial graph structure to represent the direction of the first node.

[0090] After completing the above steps, we get the graph structure representation of the encrypted traffic (i.e., graph structure data), denoted as H = (V, E). Where V = {q1, q2, …, q n-1 ,q n}, q i Represents the normalized i-th byte information. E represents the generated directed edge set.

[0091] In another exemplary embodiment of the present application, in order to obtain a more accurate classification result, the above step 205 is replaced by the following steps 801 to 803. Among them:

[0092] Step 801: For each encrypted traffic graph data, firstly, the node features are obtained from the node load through the autoencoder, and the connection relationship of the nodes remains unchanged to form a new encrypted traffic feature graph representation, which is recorded as p i ',p i '=Encoder(p i ). Secondly, the decoder is used to restrict the new encrypted traffic feature graph so that important information is not lost during feature extraction. The result is recorded as p i ”,p i ”=Decoder(p i '), using the mean square error to limit feature collection, expressed as Where Loss1 represents the loss function value. Encoder(*) represents the autoencoder, and Decoder(*) represents the decoder.

[0093] The newly formed graph structure encryption traffic is formed, denoted as H 1 , H 1=(V',E), where V' = Encoder(V) = Encoder(p1,p2,…,p n-1 ,p n ).

[0094] Step 802: Encrypt the traffic H for the newly formed graph structure 1 Perform graph-level feature extraction to obtain the representation of the entire encrypted traffic. First, multiple graph convolution operations are performed to achieve local node feature aggregation, denoted as H (i+1) =GAT(H (i) )(i∈{0,1}), where H (i+1) represents the pooled result, H (i) represents the i-th newly formed graph structure encryption flow, and GAT(*) represents the graph convolution operation. Secondly, in order to prevent the homogenization of local features after multiple graph convolution operations, multi-scale feature fusion is used to perform multi-scale feature splicing, and the splicing result is H concat :H concat =[H 1 ,H 2 ,H 3 ]. Where H 2 represents the second newly formed graph structure encrypted traffic, H 3 It represents the encrypted traffic of the third newly formed graph structure. Finally, the feature representation of the entire graph, i.e., the full-graph feature, is extracted through the maximum pooling layer function MAX. The full-graph feature is h graph ,h graph =MAX(H concat ).

[0095] Step 803: extract the full-image feature h graph Here, two fully connected layers are used as classifiers to classify encrypted traffic, and the classification result is output graph , output graph =softmax(W2·ReLU(W1·h graph +b1)+b20, where W1 represents the coefficient matrix of the first fully connected layer, b1 represents the offset of the first fully connected layer, and the ReLU function is the activation function of the first fully connected layer. Similarly, W2 and b2 are the coefficient matrix and offset of the second fully connected layer, and the output is obtained by using the softmax function activation. graph , represents the predicted category of encrypted traffic.

[0096] The present application also provides a Figure 3The application scenario shown in the figure applies the above-mentioned encrypted website traffic anti-noise identification method. Specifically: users visit websites and communicate with multiple servers to generate encrypted traffic, network administrators collect encrypted traffic, and network administrators implement website fingerprint classification through trained classification models, predict the target site visited by users, and implement website traffic identification.

[0097] Based on Figure 3 In the application scenario shown, the implementation process of the method for anti-noise identification of encrypted website traffic provided by the present application includes: 1) Reorganizing the data stream of TLS / SSL website encrypted traffic with the help of five-tuple information. 2) Using a graph structure to represent encrypted traffic to solve the problem of parallel transmission of data streams in the TLS / SSL network environment and reduce the impact of background noise. 3) Using the side channel information and encrypted payload information of the data packet as node features in the graph structure at the same time, and using the uplink and downlink directions of the data packet as the basis for establishing data edges in the graph, thereby completing the construction of the data graph. 4) Using a graph neural network with multi-scale feature fusion to realize the classification task of graph structure website fingerprints and realize website traffic identification.

[0098] Based on the above description, Figure 4 The difference between the encrypted traffic with noise and clean traffic on the proposed map is shown in the proposed encrypted traffic representation method. This also shows that the influence of the existence of noise traffic on the encrypted traffic is local. Figure 5 After the modeling process shown, the final predicted website results are obtained.

[0099] In order to verify the effectiveness of this application in implementing website traffic identification, noise-free traffic and data containing a certain noise ratio collected in a real TLS / SSL network environment can be used for verification.

[0100] For example, this application designed three different experiments to verify the website traffic identification ability of this application.

[0101] Mainly include:

[0102] 1. Effectiveness experiment. (1) Three baseline experiments are tested for the traffic data set without noise: Deep Fingerprinting (DF), graph-based decentralized application identification (DAPP), Robust Fingerprinting (RF), and the application's ability to infer the target site when identifying website traffic. (2) For traffic data with a certain amount of noise, the effectiveness of the baseline experiment and the application in implementing the ability to identify website traffic are tested. The experimental results are shown in Tables 1 and 2. Table 1 is the experimental results without noise, and Table 2 shows the results obtained on a data set with a fixed proportion of noise. At the same time, the results of each experiment are compared, such as Figure 6 shown.

[0103] Table 1 Experimental results without noise

[0104] Model Name Accuracy Accuracy Recall F1 value DF 93.77 94.26 93.77 93.70 DAPP 97.13 97.32 97.13 97.12 RF 96.00 96.63 96.30 96.29 This application 98.52 98.64 98.52 98.51

[0105] Table 2 Results obtained on a dataset containing fixed ratio noise

[0106] Model Name Accuracy Accuracy Recall F1 value DF 41.02 31.32 41.02 34.23 DAPP 81.95 84.20 81.95 82.16 RF 91.02 91.29 91.02 90.83 This application 93.43 94.10 93.43 93.49

[0107] From the comparison of experimental results, it can be seen that the effectiveness of this application for website traffic identification in TLS / SSL network environment is higher than that of the baseline function experiment, whether on noisy or non-noisy data sets.

[0108] It can be further seen that compared with noise-free data, the accuracy of each model decreases when there is noise. Regardless of whether it is in a noisy scenario or a non-noise scenario, the results of the model of the present application obtain a relatively high prediction accuracy, which proves that the present application has a higher ability to resist noise interference than other models.

[0109] 2. Robustness experiment. In order to verify that the model of this application can also initiate effective website traffic identification in TLS / SSL networks with different noise ratios, this embodiment adopts a quantitative research method to study the change in accuracy of the model as the noise ratio increases. In the experimental setting, this embodiment merges data sets containing different proportions of noise (20%, 40%, 60%) according to the traffic mixing method, verifies it on the noise data set, and discusses the change results of different models.

[0110] from Figure 7It can be seen from the bar graph and the results of Tables 3 and 4 that, by comparing DF and the method of the present application, CNN is very sensitive to the influence of noise, which is consistent with the judgment that CNN performance deteriorates in noisy scenarios because noise nodes destroy the local structure of the data. Although DF uses more data packets compared to the present application, the information utilization of each data packet is very low, resulting in DF being unable to distinguish between noise data packets and ordinary data packets, resulting in a decrease in accuracy.

[0111] Table 3 Robustness Experiment Table 1

[0112]

[0113] Table 4 Robustness Experiment Table 2

[0114]

[0115] Comparing DAPP and the method of the present application, although both use graph structures to represent encrypted traffic and use GNN as a classifier, there is a gap in the results due to the difference in the method of constructing the graph. Compared with the method of the present application, DAPP focuses on constructing the graph by representing the transmission mode of traffic through the graph structure. DAPP uses the length of the data packet as the node feature, and combines it into a graph structure representation of the flow based on the burst structure during the traffic transmission process. This method has great limitations, because there are a large number of resource files with small capacity in the process of web page data loading, or a large amount of small capacity data transmitted in JSON format. Since these flows contain only very few data packet interactions, these data flows are similar in data packet length and burst structure, resulting in low differentiation of these short flows under the DAPP method, and the model of the present application is more effective in distinguishing data flows because it takes into account the load characteristics, so in comparison, the method provided by the present application is better.

[0116] Comparing RF and the method of this application, RF uses statistics on the number of uplink packets and downlink packets in different time periods. Since the number of uplink packets is often less than the number of downlink packets regardless of background noise or normal resource loading traffic. This also results in the number of uplink packets and downlink packets showing proportional changes in a certain time period in a noisy scenario, so RF has higher robustness than the first two methods. However, as the proportion of noise increases, the collected traffic pattern shifts from being dominated by non-noise data to being dominated by noise data, and RF’s inability to distinguish between the noise part and non-noise data also leads to a decline in the performance of the model.

[0117] 3. Ablation experiment. In order to verify the effectiveness of each structure of the model (abbreviation of the method) of this application, an ablation experiment on each part of the model is set up in this embodiment. In the experiment of this embodiment, this embodiment uses the experimental results of the complete model as the baseline, deletes modules one by one by doing subtraction, and discusses the contribution of the module by measuring the changes in the experimental effect after not using a certain module and comparing it with the effect of the baseline model.

[0118] Since the model of this application mainly involves three different modules, namely multi-scale feature fusion design, graph attention neural network and decoder encoder design, in setting comparison, some modules are removed from the overall model structure and trained on the same dataset to determine the contribution of the modules.

[0119] Table 5 Ablation experiment results

[0120]

[0121]

[0122] In Table 5, MF is used to represent the multi-scale feature fusion module in the overall model, AE is used to represent the autoencoder module used in the model, and GAT is used to represent the graph convolution operation module with attention mechanism used in the model.

[0123] After setting up the ablation experiment comparison strategy, the accuracy results were obtained by using each model to conduct experiments under 40% noise data, and compared with the final model (Full Model) used by all three modules.

[0124] When the MF module is removed, Figure 8 As shown in the figure, the accuracy of the model has dropped significantly, which proves that the multi-scale feature fusion module contributes the most to the model. This is more in line with the above analysis, that is, after multiple convolutions, the information of several nodes close to each other is similar, and the local nodes are homogenized, resulting in the reduction of node distinguishability after multiple convolutions. From the results, the autoencoder and GAT modules also have a gain effect on the classification task. In addition to obtaining features from the load, the autoencoder also has the function of reducing the amount of model calculation. When all modules are used, the obtained model effect is the best. This also proves the effectiveness of each module of the model.

[0125] In summary, this application is to read the original collected encrypted traffic, clean the traffic and construct a graph structure to represent the encrypted traffic, and finally use the graph neural network to predict the visited website. This application fully considers the data flow information of the encrypted traffic and the manifestation of noise, which is conducive to the autoencoder to obtain node features from the data packet, and adopts the method of constructing a graph structure by reorganizing the data flow to fully reduce the impact of the noise traffic, which is conducive to the subsequent model calculation to improve the model's perception of non-noise traffic. Finally, the graph classification task is realized with the help of the graph neural network model to complete the website traffic identification in the TLS network environment of the website.

[0126] Based on the same inventive concept, the embodiment of the present application also provides an encrypted website traffic anti-noise identification system for implementing the encrypted website traffic anti-noise identification method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more encrypted website traffic anti-noise identification system embodiments provided below can refer to the limitations of the encrypted website traffic anti-noise identification method above, and will not be repeated here.

[0127] In an exemplary embodiment, Fig. 9 As shown, an encrypted website traffic anti-noise identification system is provided, including:

[0128] The traffic collection device is used to obtain the encrypted traffic generated when users visit the website, and save the encrypted traffic into a PCAP file containing multiple data packets according to the set rules. It can be seen that the device is mainly responsible for collecting traffic from the network environment and dividing it into multiple PCAP traffic files according to users and time.

[0129] The traffic cleaning device is connected to the traffic collection device and is used to clean the data packets in the PCAP file to obtain the cleaned encrypted traffic. It can be seen that the device is mainly responsible for cleaning the generated PCAP file, deleting non-encrypted traffic data, retaining sufficient encrypted traffic, and deleting redundant encrypted traffic.

[0130] The traffic reassembly device is connected to the traffic cleaning device and is used to reassemble the cleaned encrypted traffic based on the five-tuple information of the data packet in the PCAP file to obtain multiple data streams. The five-tuple information includes source IP, destination IP, source port, destination port and protocol type.

[0131] The website fingerprint extraction device is connected to the traffic reassembly device and is used to extract website features from each data packet in each data stream to obtain a website fingerprint extraction result.

[0132] The website prediction device is connected to the website fingerprint extraction device, and is used to generate graph structure data based on the website fingerprint extraction result, perform graph classification tasks on the graph structure data, and complete the prediction of user visit sites according to the classification results.

[0133] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store video tag processing data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for anti-noise identification of encrypted website traffic is implemented.

[0134] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0135] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0136] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0137] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0138] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0139] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0140] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0141] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0142] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for anti-noise identification of encrypted website traffic, characterized in that: The encrypted website traffic anti-noise identification method comprises: Acquire the encrypted traffic generated when the user visits the website, and save the encrypted traffic into a PCAP file containing multiple data packets according to the set rules; Cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic; Based on the five-tuple information of the data packet in the PCAP file, the cleaned encrypted traffic is reorganized to obtain multiple data streams; the five-tuple information includes the source IP, the destination IP, the source port, the destination port and the protocol type; Extract website features from each data packet in each data stream to obtain website fingerprint extraction results; Generate graph structure data based on the website fingerprint extraction result; A graph classification task is performed on the graph structure data, and a prediction of the user's visited sites is completed based on the classification result.

2. The method for anti-noise identification of encrypted website traffic according to claim 1, characterized in that: Clean the data packets in the PCAP file to obtain the cleaned encrypted traffic, which specifically includes: Determine the type of data packets in the PCAP file, delete the data packets generated in the LAN environment, and retain the data packets of TLS encrypted traffic to obtain the cleaned PCAP file; Keep the first 1024 packets in the cleaned PCAP file; Generates cleaned encrypted traffic based on the first 1024 packets retained.

3. The method for anti-noise identification of encrypted website traffic according to claim 2, characterized in that: The website features are extracted for each data packet in each data stream to obtain the website fingerprint extraction results, including: Use 0 bytes to fill sensitive information in each data stream; the sensitive information includes: source IP, destination IP, source port, destination port and server name indication; Convert the first 256 bytes of each data packet in each data stream filled with sensitive information into binary values; The binary value is used as the website fingerprint extraction result, and the transmission direction information of each data packet is saved according to the transmission direction of the data packet in each data flow.

4. The method for anti-noise identification of encrypted website traffic according to claim 1, characterized in that: Based on the five-tuple information of the data packet in the PCAP file, the cleaned encrypted traffic is reassembled to obtain multiple data streams, including: The source IP in the five-tuple information is adjusted to the address of the local user, the source port is adjusted to the port of the local user, the target IP is adjusted to the address of the server, and the target port is adjusted to the port of the server to obtain the adjusted five-tuple information; The adjusted five-tuple information is used as a data flow identifier, and the cleaned encrypted traffic is divided into multiple PCAP data flow files according to the data flow identifier to obtain multiple data flows.

5. The method for anti-noise identification of encrypted website traffic according to claim 1, characterized in that: Generating graph structure data based on the website fingerprint extraction result specifically includes: For each data stream, the data packets in the data stream are taken as nodes, directed edges are set according to the transmission direction of the data packets in the data stream, and the head node and the tail node are connected by the directed edges according to the burst relationship of the data stream to obtain an initial graph structure; For the cleaned encrypted traffic, a virtual master node is added to the initial graph structure; A directed edge is established between the virtual master node and the first data packet of the data stream to obtain the graph structure data.

6. The method for anti-noise identification of encrypted website traffic according to claim 5, characterized in that: Performing a graph classification task on the graph structure data and completing a prediction of the user's visited sites based on the classification results, specifically including: For the graph structure data corresponding to each data flow, the node features are obtained from the node load through the autoencoder, and the connection relationship of the nodes remains unchanged to form a new encrypted traffic feature graph, and the decoder is used to limit the information of the new encrypted traffic feature graph to obtain a new encrypted traffic graph representation; Perform graph-level feature extraction on the graph representation of the new encrypted traffic to obtain the full graph features of the entire encrypted traffic; Two fully connected layers are used as classifiers to classify the full-image features to obtain classification results, and the user's visited sites are predicted based on the classification results.

7. An encrypted website traffic anti-noise identification system, characterized in that: The system is used to implement the method for anti-noise identification of encrypted website traffic according to any one of claims 1 to 6; the system for anti-noise identification of encrypted website traffic comprises: A traffic collection device, used to obtain the encrypted traffic generated when a user visits a website, and save the encrypted traffic into a PCAP file containing multiple data packets according to set rules; A traffic cleaning device, connected to the traffic collection device, for cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic; A traffic reassembly device, connected to the traffic cleaning device, for reassembling the cleaned encrypted traffic based on the five-tuple information of the data packet in the PCAP file to obtain multiple data streams; the five-tuple information includes the source IP, the destination IP, the source port, the destination port and the protocol type; A website fingerprint extraction device is connected to the traffic reassembly device and is used to extract website features from each data packet in each data stream to obtain a website fingerprint extraction result; The website prediction device is connected to the website fingerprint extraction device, and is used to generate graph structure data based on the website fingerprint extraction result, perform graph classification tasks on the graph structure data, and complete the prediction of user visit sites according to the classification results.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method for anti-noise identification of encrypted website traffic described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for anti-noise identification of encrypted website traffic described in any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method for anti-noise identification of encrypted website traffic described in any one of claims 1 to 6 are implemented.

Images