Method, system, device, medium and product for anti-noise identification of encrypted website traffic

Abstract

The application discloses an encrypted website traffic anti-noise identification method, system, device, medium and product, and relates to the field of digital information transmission. The method comprises the following steps: obtaining encrypted traffic generated when a user accesses a website, and saving the encrypted traffic into a PCAP file containing multiple data packets according to a set rule; cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic; recombining the cleaned encrypted traffic based on the five-tuple information of the data packets to obtain multiple data streams; extracting website features from each data packet in each data stream to obtain website fingerprint extraction results; generating graph structure data based on the website fingerprint extraction results; performing a graph classification task on the graph structure data, and completing prediction of the user's access to the website according to the classification result. The application can effectively implement identification of website traffic on the premise that there is background noise.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of digital information transmission, and particularly relates to an encrypted website traffic anti-noise identification method, system, device, medium and product. BACKGROUND

[0002] Website traffic identification is a means that can effectively deal with privacy enhancement technology. With the application of machine learning and deep learning in website traffic identification field, website traffic identification technology has developed rapidly. However, the current research on website traffic identification is still unreasonable in setting. In the existing research on website traffic identification, most researchers will carry out research under the assumption of "no background noise" to simplify the difficulty of research topic and clarify the research goal. However, in the actual network environment, especially in the TLS / SSL network environment, background noise often exists, which significantly reduces the prediction accuracy of the research results based on such assumptions when applied, and limits the application and deployment of research results. For example, when background noise traffic exists in the TLS / SSL network environment, effective website traffic identification is a problem that cannot be ignored for promoting the deployment and application of website traffic identification technology in the TLS / SSL network environment.

[0003] The current website traffic identification technology mainly includes machine learning-based website traffic identification method and deep learning-based website traffic identification method. The machine learning-based website traffic identification method mainly identifies traffic by constructing a feature classifier sensitive to traffic data. Usually, these methods will use supervised machine learning algorithms such as support vector machine (SVM), K-nearest neighbor (KNN), etc. The key of these methods is to extract traffic features that can complete the classification task from the encrypted traffic of feature engineering. The challenges of machine learning-based website traffic identification method include the need for a large amount of manual feature selection to select the most effective feature combination, which is a great test of experts' professional knowledge and data analysis skills. Secondly, the feature combination selected manually is not robust and cannot cope with various scenarios.

[0004] The method of implementing website traffic identification using deep learning technology mainly includes website traffic identification based on traditional deep learning technology and website traffic identification based on graph representation.

[0005] The website traffic identification method based on traditional deep learning mainly includes two methods: one is to extract website fingerprints from side channel, and the other is to extract website fingerprints directly from encrypted payload. The researchers who extract website fingerprints from side channel believe that the encryption process of traffic only encrypts the payload information transmitted by the user, and does not encrypt the side channel information of the packet header. By taking advantage of the differences in side channel information exhibited by different websites, the identification of different websites can be realized. The researchers who extract features from encrypted payload believe that side channel information will change with the use of different network devices and network conditions, which will lead to poor generality of website traffic identification based on side channel. The encrypted payload does not fluctuate and change greatly with the use of different network devices and network conditions, so the website fingerprints extracted from the encrypted payload have higher robustness. The website traffic identification technology based on traditional deep learning has become the mainstream in the research of website traffic identification technology in recent years. The black box characteristics of deep learning technology is the main challenge faced by the current website traffic identification technology based on deep learning. The black box characteristics make it difficult to explain the website fingerprints extracted by deep learning technology.

[0006] Graph representation method is a method of representing objects and the relationship between objects by using non-Euclidean geometric data structure. When representing real scenes in data, it has incomparable advantages over traditional Euclidean space geometry. In the field of website traffic identification, using graph representation to represent encrypted traffic and using graph neural technology to realize website traffic identification has gradually become one of the research hotspots. However, it is still difficult to unify the way of representing encrypted traffic by using graph structure.

[0007] In the research of website traffic identification on data traffic containing background noise, Wang et al. proposed two solutions based on counting and classification. However, the experimental results show that these two solutions not only separate noise, but also delete a large amount of non-noise data nodes, which indicates that the method of purifying encrypted traffic cannot complete effective anti-noise website traffic identification.

[0008] Among the above-mentioned website traffic identification methods, most of them are carried out under the premise of no background noise. Although Wang et al. considered the existence of background noise, they did not propose a very effective solution. In the real network environment, due to the use of TLS / SSL encrypted traffic by a large number of network applications, the problem of background noise is almost unavoidable. Therefore, providing a method or system that can implement effective website traffic identification under the premise of background noise has become a technical problem to be solved in the field. SUMMARY

[0009] The purpose of the present application is to provide an encrypted website traffic anti-noise identification method, system, device, medium and product, which can effectively implement the identification of website traffic under the premise of background noise.

[0010] To achieve the above purpose, the present application provides the following solutions:

[0011] In a first aspect, the present application provides an encrypted website traffic anti-noise identification method, comprising:

[0012] Obtaining encrypted traffic generated when a user accesses a website, and saving the encrypted traffic into a PCAP file containing multiple data packets according to a set rule;

[0013] Cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic;

[0014] Reorganizing the cleaned encrypted traffic into multiple data streams based on the five-tuple information of the data packets in the PCAP file, wherein the five-tuple information includes source IP, destination IP, source port, destination port and protocol type;

[0015] Extracting website features from each data packet in each data stream to obtain website fingerprint extraction results;

[0016] Generating graph structure data based on the website fingerprint extraction results;

[0017] Performing a graph classification task on the graph structure data, and completing the prediction of the user's access to the website according to the classification results.

[0018] Optionally, the cleaning of the data packets in the PCAP file to obtain the cleaned encrypted traffic specifically comprises:

[0019] Determining the type of the data packets in the PCAP file, deleting the data packets of the type generated in a local area network environment, and retaining the data packets of the type of TLS encrypted traffic to obtain the cleaned PCAP file;

[0020] Retaining the first 1024 data packets in the cleaned PCAP file;

[0021] Generating the cleaned encrypted traffic based on the retained first 1024 data packets.

[0022] Optionally, the website feature extraction from each data packet in each data stream to obtain the website fingerprint extraction results specifically comprises:

[0023] Padding sensitive information in each data stream with 0 bytes; the sensitive information includes source IP, destination IP, source port, destination port and server name indication;

[0024] Convert the first 256 bytes of each data packet in each data stream filled with sensitive information into a binary value;

[0025] Save the transmission direction information of each data packet according to the transmission direction of the data packet in each data stream, taking the binary value as the website fingerprint extraction result.

[0026] Optionally, the encrypted traffic after cleaning is recombined into multiple data streams based on the quintuple information of the data packet in the PCAP file, specifically including:

[0027] Adjust the source IP in the quintuple information to the address of the local user, adjust the source port to the port of the local user, adjust the target IP to the address of the server, and adjust the target port to the port of the server, to obtain the adjusted quintuple information;

[0028] Take the adjusted quintuple information as a data stream identifier, and divide the encrypted traffic after cleaning into multiple PCAP data stream files according to the data stream identifier, to obtain multiple data streams.

[0029] Optionally, generate graph structure data based on the website fingerprint extraction result, specifically including:

[0030] For each data stream, take the data packet in the data stream as a node, set a directed edge according to the transmission direction of the data packet in the data stream, and connect the first node and the last node using the directed edge according to the burst relationship of the data stream, to obtain an initial graph structure;

[0031] For the encrypted traffic after cleaning, add a virtual main node to the initial graph structure;

[0032] Establish a directed edge between the virtual main node and the first data packet of the data stream, to obtain the graph structure data.

[0033] Optionally, perform a graph classification task on the graph structure data, and complete the prediction of user access to the site according to the classification result, specifically including:

[0034] For the graph structure data corresponding to each data stream, obtain node features from node load using an autoencoder, the connection relationship of the nodes remains unchanged, form a new encrypted traffic feature graph, and use a decoder to limit the information of the new encrypted traffic feature graph, to obtain a graph representation of the new encrypted traffic;

[0035] Perform graph-level feature extraction on the graph representation of the new encrypted traffic, to obtain the whole graph feature of the encrypted traffic;

[0036] Use a two-layer fully connected layer as a classifier to classify the whole graph feature, to obtain a classification result, and complete the prediction of user access to the site according to the classification result.

[0037] In a second aspect, the present application provides an encrypted website traffic anti-noise identification system, comprising:

[0038] a traffic collection device configured to collect encrypted traffic generated when a user accesses a website, and save the encrypted traffic into a PCAP file containing a plurality of data packets according to a set rule;

[0039] a traffic cleaning device connected to the traffic collection device and configured to clean the data packets in the PCAP file to obtain cleaned encrypted traffic;

[0040] a traffic recombination device connected to the traffic cleaning device and configured to recombine the cleaned encrypted traffic into a plurality of data streams based on five-tuple information of the data packets in the PCAP file, wherein the five-tuple information includes source IP, destination IP, source port, destination port and protocol type;

[0041] a website fingerprint extraction device connected to the traffic recombination device and configured to extract website features from each data packet in each data stream to obtain website fingerprint extraction results;

[0042] a website prediction device connected to the website fingerprint extraction device and configured to generate graph structure data based on the website fingerprint extraction results, perform a graph classification task on the graph structure data, and complete prediction of the website accessed by the user according to a classification result.

[0043] In a third aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the encrypted website traffic anti-noise identification method according to any one of the above embodiments.

[0044] In a fourth aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the steps of the encrypted website traffic anti-noise identification method according to any one of the above embodiments.

[0045] In a fifth aspect, the present application provides a computer program product comprising a computer program, wherein the computer program is executable by a processor to implement the steps of the encrypted website traffic anti-noise identification method according to any one of the above embodiments.

[0046] According to the embodiments provided in the present application, the following technical effects are disclosed:

[0047] The application provides an encrypted website traffic anti-noise identification method, system, device, medium and product. The encrypted traffic after cleaning is obtained by cleaning the data packets in the generated PCAP file, so that the capacity of the collected encrypted traffic can be reduced as much as possible, and the interference of irrelevant traffic on website traffic identification is reduced. The encrypted traffic after cleaning is recombined into multiple data streams based on the quintuple information of the data packets in the PCAP file, the data stream information (i.e. the performance of noise) of the encrypted traffic is considered, the website feature of each data packet in each data stream is extracted, the website fingerprint extraction result is obtained, the graph structure data is generated based on the website fingerprint extraction result, the influence of noise traffic is sufficiently reduced, then the graph classification task is performed on the graph structure data, and the prediction of user access to the website is completed according to the classification result, and the identification of website traffic is effectively implemented. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0049] Figure 1 An application environment diagram of an encrypted website traffic anti-noise identification method provided by an embodiment of the present application is shown in the figure.

[0050] Figure 2 A flowchart of an encrypted website traffic anti-noise identification method provided by an embodiment of the present application is shown in the figure.

[0051] Figure 3 Another application environment diagram of an encrypted website traffic anti-noise identification method provided by an embodiment of the present application is shown in the figure.

[0052] Figure 4 A comparison diagram of encrypted traffic without noise and encrypted traffic with noise provided by an embodiment of the present application is shown in the figure, wherein Figure 4 (a) is a diagram of encrypted traffic without noise (i.e. clean encrypted traffic), Figure 4 (b) is a diagram of encrypted traffic with other application traffic (i.e. encrypted traffic with noise).

[0053] Figure 5 A model overall framework diagram provided by an embodiment of the present application is shown in the figure.

[0054] Figure 6 A comparison diagram of encrypted traffic without noise and encrypted traffic with fixed proportion of noise provided by an embodiment of the present application is shown in the figure.

[0055] Figure 7 A model provided for another embodiment of the present application predicts the change of accuracy rate with the change of noise ratio;

[0056] Figure 8 A prediction result diagram after deleting a module in a model provided for an embodiment of the present application;

[0057] Figure 9 A structural diagram of an encrypted website traffic anti-noise identification system provided for an embodiment of the present application;

[0058] Figure 10 A structural diagram of a computer device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0060] In order to make the above objectives, characteristics and advantages of the present application more apparent, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0061] The encrypted website traffic anti-noise identification method provided by the embodiments of the present application can be applied to, for example Figure 1The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be set up separately, or integrated on the server 104, or placed on the cloud or other servers. The terminal 102 can send the encrypted traffic generated when the user accesses the website to the server 104, and the server 104 receives the encrypted traffic generated when the user accesses the website. For the encrypted traffic generated when the user accesses the website, the server 104 saves the encrypted traffic into a PCAP file containing multiple data packets according to the set rules. The data packets in the PCAP file are cleaned to obtain the cleaned encrypted traffic. Based on the five-tuple information of the data packets in the PCAP file, the cleaned encrypted traffic is reorganized into multiple data streams. The website feature extraction is performed on each data packet in each data stream respectively to obtain the website fingerprint extraction result. The graph structure data is generated based on the website fingerprint extraction result. The graph classification task is performed on the graph structure data, and the prediction of the user accessing the website is completed according to the classification result. The server 104 can feed back the prediction result of the user accessing the website to the terminal 102. In addition, in some embodiments, the encrypted website traffic noise-resistant identification method can also be implemented by the server 104 or the terminal 102 alone, such as the terminal 102 can directly process the encrypted traffic generated when the user accesses the website, or the server 104 can obtain the encrypted traffic generated when the user accesses the website from the data storage system and process the encrypted traffic generated when the user accesses the website.

[0062] Among them, the terminal 102 can be but not limited to various desktop computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers, and can also be a cloud server.

[0063] In an exemplary embodiment, as Figure 2 shown, an encrypted website traffic noise-resistant identification method is provided, which is executed by a computer device, specifically can be executed by a terminal or a server, etc. Computer device alone, or by the terminal and the server together, in the embodiment of the application, take the server 104 in Figure 1 as an example to illustrate, including the following steps 200 to step 205. Among them, as Figure 2 shown, the encrypted website traffic noise-resistant identification method method:

[0064] Step 200: Obtain encrypted traffic generated when a user accesses a website, and save the encrypted traffic into a PCAP file containing multiple data packets according to a set rule.

[0065] Step 201: Clean the data packets in the PCAP file to obtain cleaned encrypted traffic.

[0066] Step 202: Reorganize the cleaned encrypted traffic into multiple data streams based on the five-tuple information of the data packets in the PCAP file. The five-tuple information includes source IP, destination IP, source port, destination port, and protocol type.

[0067] Step 203: Extract website features from each data packet in each data stream to obtain website fingerprint extraction results.

[0068] Step 204: Generate graph structure data based on the website fingerprint extraction results.

[0069] Step 205: Perform a graph classification task on the graph structure data, and complete prediction of the user's access to the website according to the classification results.

[0070] Implementing steps 201 to 205 described above can effectively implement website traffic identification under the premise of background noise. In addition, the present application can also minimize the capacity of the collected encrypted traffic and reduce the interference of irrelevant traffic on website traffic identification.

[0071] In another exemplary embodiment of the present application, in order to facilitate subsequent processing, the above step 200 is replaced by steps 301 to 302 as follows:

[0072] Step 301: The traffic collection device collects traffic from a local area network environment using network probes such as tshark, tcpdump, etc.

[0073] Step 302: The traffic collection device saves a large amount of collected traffic into multiple PCAP files according to certain rules. The set rules include source IP information of the data packets, which is used to divide encrypted traffic generated by different users. The set rules can also include transmission time of the traffic. Since a user accesses a website, he / she will generate a traffic transmission mode different from the background traffic bandwidth in a short time, which presents a wave crest in the time-transmission rate graph. Therefore, each wave crest is divided to generate multiple PCAP files, and each file corresponds to encrypted traffic generated by a user accessing a website once.

[0074] In another exemplary embodiment of the present application, in order to minimize the capacity of the collected encrypted traffic and reduce the interference of irrelevant traffic on website traffic identification, the above step 201 is replaced by steps 401 to 402 as follows.

[0075] Step 401: For the data packets in the PCAP file, determine the type of the data packets, delete the data packets generated in the LAN environment, and only retain the data packets of the TLS encrypted traffic.

[0076] Step 402: For each cleaned PCAP file, only the first 1024 data packets are retained at most, and the data packets after 1024 are deleted.

[0077] After completing the above steps 401 to 402, a cleaned encrypted traffic is obtained. This cleaned encrypted traffic is recorded as T, T = {p1, p2, ..., p n-1 ,p n}(n≤1024). Where, p i It represents i data packets, i = 1, 2, ..., n.

[0078] In another exemplary embodiment of the present application, after the data stream reassembly is completed, the data packets of the same data stream are organized together so as to facilitate the subsequent aggregation and representation of the data packets according to the same data stream identifier.

[0079] Based on this, the above step 202 is replaced by the following steps 501 to 502. Among them:

[0080] Step 501: For the encrypted traffic T processed in step 402, all data packets p from the encrypted traffic T are i Extract the five-tuple information, and adjust the source IP and source port to the address and port of the local user, and the destination IP and destination port to the address and port of the server, and use the adjusted five-tuple information as the data flow identifier.

[0081] Step 502: Divide the data packets with the same data flow identifier into multiple PCAP data flow files, thereby obtaining multiple data flows. The data flow is represented by F i ={p i1 ,p i2 ,…,p i(k-1) ,p ik}. In the formula, F i represents the i-th data flow in the encrypted traffic, p ij represents the jth data packet in the i-th data stream, where j = 1,,2,...,k.

[0082] In another exemplary embodiment of the present application, when extracting features from each data packet, sensitive information such as source IP, destination IP, source port, destination port, and server name indication (SNI) may be present in each data packet. The presence of this sensitive information will affect the training process of the model. In order not to affect the training process of the model, these fields will be padded with 0 bytes before feature extraction to cover up the sensitive information in the original data packet. The second step is to convert the first 256 bytes of the data packet into binary values ​​as the feature vector of the data packet, and save the transmission direction information of each data packet according to the transmission direction of the data packet. Based on this, the above step 203 is replaced by the following steps 601 to 602.

[0083] in:

[0084] Step 601: Sensitive information is masked with zero bytes. Because IP addresses and port numbers vary across regions and users, this information is directly masked with 0x00. Regarding SNI information, since it is no longer transmitted in clear text under the ESNI and ECH protocols, this information is directly masked in anticipation of future use. The first 256 bytes are retained, and each byte is converted to an integer value and divided by 255 for data normalization.

[0085] Step 602: Since the distinction between uplink and downlink data packets is beneficial to website traffic identification, uplink packets and downlink packets are distinguished based on whether the source IP of each data packet is the user IP or the server IP, and the direction of the data packet is retained based on the uplink and downlink of the data packet.

[0086] In another exemplary embodiment of this application, after processing the encrypted traffic generated by a user visiting a website, multiple different data streams are generated. Therefore, each data stream is generally first merged into a local subgraph structure. The multiple subgraph structures are then connected together using virtual nodes to generate a graph structure to represent the encrypted traffic. Based on this, the above step 204 is replaced by the following steps 701-702.

[0087] in:

[0088] Step 701: For each data flow F i ={p i1 ,p i2 ,…,p i(k-1) ,p ik}, arrange them in a row according to the data packet collection time, set directed edges according to the transmission direction of the data packet, and set the uplink packet to p i(j-1) →p ij , downlink packet is set to p ij →pi(j-1) , and according to the burst relationship of the data flow, the first node and the last node of the burst structure are connected by directed edges to obtain the initial graph structure. Among them, the data packets in the data flow are used as nodes

[0089] Step 702: For the encrypted traffic T, add a virtual master node p to the initial graph structure obtained in step 701 client , as all data streams F i In step 701, for data stream F i During processing, since each node represents the direction of the data packet by establishing a directed edge with the previous node in the same data stream, the direction of the first data packet in the data stream is omitted. Therefore, a non-directional virtual main node is added to the data stream and a directed edge is established with the first node in the initial graph structure to represent the direction of the first node.

[0090] After completing the above steps, we get the graph structure representation of the encrypted traffic (i.e., graph structure data), which is denoted as H = (V, E). Where V = {q1, q2, ..., q n-1 ,q n},q i Represents the normalized i-th byte information. E represents the generated directed edge set.

[0091] In another exemplary embodiment of the present application, in order to obtain a more accurate classification result, the above step 205 is replaced by the following steps 801 to 803.

[0092] Step 801: For each encrypted traffic graph data, firstly, the node features are obtained from the node load through the autoencoder, and the connection relationship of the nodes remains unchanged to form a new encrypted traffic feature graph representation, which is recorded as p i ', p i =Encoder(p i ). Secondly, the decoder is used to restrict the new encrypted traffic feature graph so that important information is not lost when extracting features. The result is recorded as p i ”, p i ”=Decoder(p i '), the feature collection is restricted by the mean square error, which is expressed as Where Loss1 represents the loss function value. Encoder(*) represents the autoencoder, and Decoder(*) represents the decoder.

[0093] Form a new graph structure encrypted traffic, denoted as H 1 , H 1=(V',E), where V' = Encoder(V) = Encoder(p1,p2,…,p n-1 n ).

[0094] Step 802: performing graph-level feature extraction on the newly formed graph structure encrypted traffic H 1 to obtain the representation of the entire encrypted traffic. Firstly, local node features are aggregated through multiple graph convolution operations, denoted as H (i+1) =GAT(H (i) )(i∈{0,1}), where H (i+1) represents the aggregation result, H (i) represents the i-th newly formed graph structure encrypted traffic, and GAT(*) represents the graph convolution operation. Secondly, in order to prevent the homogenization of local features after multiple graph convolution operations, multi-scale feature fusion is used to splice multi-scale features, and the spliced result is H concat : H concat =[H 1 ,H 2 ,H 3 ]. Where H 2 represents the 2nd newly formed graph structure encrypted traffic, and H 3 represents the 3rd newly formed graph structure encrypted traffic. Finally, the feature representation of the entire graph, i.e., the whole graph feature, is extracted by a max-pooling layer function MAX. The whole graph feature is h graph , h graph =MAX(H concat ).

[0095] Step 803: classifying the extracted whole graph feature h graph (which is the encrypted traffic feature). Here, two fully connected layers are used as a classifier to classify the encrypted traffic, and the classification result is output graph , output graph =softmax(W2·ReLU(W1·h graph +b1)+b20, where W1 represents the coefficient matrix of the first fully connected layer, b1 represents the offset of the first fully connected layer, and ReLU is the activation function of the first fully connected layer. Similarly, W2 and b2 are the coefficient matrix and offset of the second fully connected layer, and the output graph is obtained by using the softmax function to activate, which represents the predicted category of the encrypted traffic.

[0096] The application also provides a method for classifying encrypted traffic, comprising the steps of: Figure 3 ​The application scenario shown in the application scenario, the application of the above-mentioned encrypted website traffic anti-noise identification method. Specifically: the communication between the user accessing the website and the plurality of servers generates encrypted traffic, the network administrator collects encrypted traffic, the network administrator realizes website fingerprint classification through the trained classification model, and predicts the target site accessed by the user to realize website traffic identification.

[0097] Based on the application scenario as shown in Figure 3 The implementation process of the encrypted website traffic anti-noise identification method provided by the application includes: 1) recombining the data stream of the TLS / SSL website encrypted traffic by means of five-tuple information. 2) Using graph structure to represent encrypted traffic to solve the parallel transmission of data stream in TLS / SSL network environment and reduce the influence of background noise. 3) At the same time, using the side channel information and encrypted payload information of the data packet as the node features in the graph structure, and using the uplink and downlink direction of the data packet as the basis for establishing the data edge in the graph, so as to complete the construction of the data graph. 4) Using multi-scale feature fusion graph neural network to realize the classification task of graph structure website fingerprint, and realizing website traffic identification.

[0098] Based on the above description, Figure 4 It is given that the encrypted traffic containing noise and clean encrypted traffic is different on the graph built by the application under the encrypted traffic representation method proposed by the application. At the same time, it also shows that under the method provided by the application, the influence of noise traffic on encrypted traffic is local. After completing the modeling process as shown in Figure 5 The final predicted website result is obtained.

[0099] In order to verify the effectiveness of the application in implementing website traffic identification, the data collected in the real TLS / SSL network environment without noise and containing a certain noise ratio can be used for verification.

[0100] For example, the application designs three different experiments to verify the website traffic identification ability of the application.

[0101] Mainly include:

[0102] 1. Effectiveness experiment. (1) For the flow data set without noise, three baseline experiments are tested respectively: Deep Fingerprinting (DF), Decentralized Applications (DAPP), Robust Fingerprinting (RF), and the ability of the application to speculate the target site when identifying website traffic. (2) For the flow data set with noise, the effectiveness of the baseline experiment and the ability of the application to implement website traffic identification is tested respectively. The experimental results are shown in Tables 1 and 2, Table 1 is the experimental result without noise, and Table 2 represents the results obtained on the data set with a fixed proportion of noise. At the same time, the comparison of the results of each experiment is shown in Table 3. Figure 6

[0103] Table 1 Experimental results without noise

[0104] Model name Accuracy Precision Recall F1 value DF 93.77 94.26 93.77 93.70 DAPP 97.13 97.32 97.13 97.12 RF 96.00 96.63 96.30 96.29 The present application 98.52 98.64 98.52 98.51

[0105] Table 2 Results obtained on the data set with a fixed proportion of noise

[0106] Model name Accuracy Precision Recall F1 value DF 41.02 31.32 41.02 34.23 DAPP 81.95 84.20 81.95 82.16 RF 91.02 91.29 91.02 90.83 The present application 93.43 94.10 93.43 93.49

[0107] From the comparison of the experimental results, it can be seen that the application for website traffic identification in the TLS / SSL network environment has higher effectiveness than the baseline function experiment, whether on the data set with noise or without noise.

[0108] It can be further seen that compared with noise-free data, the accuracy of each model decreases when there is noise. Whether in the noise scenario or the non-noise scenario, the results of the application model obtain a relatively high prediction accuracy, which proves that the application has higher anti-noise interference ability compared with other models.

[0109] 2. Robustness experiment. In order to verify that the model of the application can also initiate effective website traffic identification in the TLS / SSL network containing different noise ratios, the embodiment adopts a quantitative research method to study the accuracy rate change of the model as the noise ratio increases. In the experimental setup, the embodiment combines data sets containing different proportions of noise (20%, 40%, 60%) according to the flow mixing method, and verifies on the noise data set, and discusses the change results of different models.

[0110] From Figure 7 ​As can be seen from the bar chart and the results in Table 3 and Table 4, by comparing DF and the method of the present application, CNN is very sensitive to noise, which is consistent with the judgment that the performance of CNN is reduced due to the local structure of data being destroyed by noise nodes in a noisy scene, although DF uses more data packets than the method of the present application, but the utilization of information for each data packet is very low, which leads to DF being unable to distinguish between noise data packets and ordinary data packets, thereby causing the accuracy to decrease.

[0111] Table 3 Robustness Experiment Table One

[0112]

[0113] Table 4 Robustness Experiment Table Two

[0114]

[0115] By comparing DAPP and the method of the present application, although both use graph structure to represent encrypted traffic and use GNN as a classifier, but due to the difference in the method of constructing the graph, there is a gap in the results. Compared with the method of the present application, DAPP focuses on representing the transmission mode of traffic through graph structure. DAPP uses packet length as node features, and combines the graph structure representation of the flow based on the burst structure in the traffic transmission process. This method has great limitations. Because there are a large number of small capacity resource files in the web data loading process, or a large number of small capacity data transmitted in JSON format. Because these flows contain only a very small number of packet interactions, these data flows are similar in packet length and burst structure, resulting in low discrimination of these short flows under the method of DAPP. The model of the present application is more effective in distinguishing data flows because it considers the payload feature, so the method provided by the present application has better effect.

[0116] By comparing RF and the method of the present application, RF uses statistics on the number of uplink packets and downlink packets in different time periods. Because whether it is background noise or normal resource loading traffic, the number of uplink packets is always less than the number of downlink packets. This results in the number of uplink packets and downlink packets in a certain time period changing proportionally in a noisy scenario, so RF has higher robustness than the previous two methods. However, as the noise ratio increases, the collected traffic pattern is dominated by noise data, and the inability of RF to distinguish between noise and non-noise data also leads to a decrease in the performance of the model.

[0117] 3. Ablation experiment. In order to verify the effectiveness of each structure of the model of the present application (abbreviation of method), an ablation experiment of each part of the model is set in this embodiment. In the experiment of this embodiment, the experimental results of the complete model are used as the baseline, and by means of subtraction, each module is deleted one by one, and by measuring the change in the experimental effect after not using a certain module, the contribution of the module is discussed by comparing with the effect of the baseline model.

[0118] Since the model of the present application mainly involves three different modules, namely multi-scale feature fusion design, graph attention neural network and decoder-encoder design. In setting up the control, by removing some modules in the overall model structure, and by training on the same data set to judge the contribution of the module.

[0119] Table 5 ablation experiment result table

[0120]

[0121]

[0122] In Table 5, MF is used to represent the multi-scale feature fusion module in the overall model, AE is used to represent the autoencoder module used in the model, and GAT is used to represent the graph convolution operation module with attention mechanism used in the model.

[0123] After setting up the ablation experiment comparison strategy, the accuracy results are obtained by using each model to experiment under 40% noise data, and compared with the final model (Full Model) using all three modules.

[0124] When the MF module is removed, as shown in Figure 8 , the accuracy of the model has a large decline, which proves that the multi-scale feature fusion module contributes the most to the model. This is more in line with the foregoing analysis, that is, after multiple convolutions, the information of several nodes close to each other is similar, the local nodes are homogenized, thereby causing the distinguishability of the nodes to be reduced after multiple convolutions. From the results, the autoencoder and GAT modules also have a gain effect on the classification task. In addition to being able to obtain features from the load, the autoencoder also plays a role in reducing the computational amount of the model. In the case where all modules are used, the model effect obtained is the best. This also proves the effectiveness of each module of the model.

[0125] In summary, the application reads the original collected encrypted traffic, cleans the traffic and constructs a graph structure to represent the encrypted traffic, and finally uses a graph neural network to realize the prediction of the accessed website. The application fully considers the data flow information of the encrypted traffic and the form of noise, which is beneficial to the autoencoder to obtain node features from the data packet, and the graph structure is constructed by recombining the data flow to fully reduce the influence of noise traffic, thereby facilitating subsequent model calculation to improve the perception ability of the model to non-noise traffic. Finally, the graph classification task is realized by using a graph neural network model to complete the website traffic identification in the website TLS network environment.

[0126] Based on the same inventive concept, the embodiments of the application also provide an encrypted website traffic anti-noise identification system for implementing the encrypted website traffic anti-noise identification method described above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme described in the above method, so the specific limitations in one or more encrypted website traffic anti-noise identification system embodiments provided below can refer to the limitations of the encrypted website traffic anti-noise identification method in the above, which will not be repeated here.

[0127] In one exemplary embodiment, as shown in Figure 9 An encrypted website traffic anti-noise identification system is provided, comprising:

[0128] A traffic collection device is configured to collect encrypted traffic generated when a user accesses a website, and save the encrypted traffic into a PCAP file containing a plurality of data packets according to a set rule. It can be seen that the device is mainly responsible for collecting traffic from the network environment, and dividing it into a plurality of PCAP traffic files according to the user and the time.

[0129] A traffic cleaning device is connected with the traffic collection device, and is configured to clean the data packets in the PCAP file to obtain cleaned encrypted traffic. It can be seen that the device is mainly responsible for cleaning the generated PCAP file, deleting non-encrypted traffic data and retaining sufficient encrypted traffic, and deleting redundant encrypted traffic.

[0130] A traffic recombination device is connected with the traffic cleaning device, and is configured to recombine the cleaned encrypted traffic based on the five-tuple information of the data packets in the PCAP file to obtain a plurality of data streams. The five-tuple information includes source IP, destination IP, source port, destination port and protocol type.

[0131] A website fingerprint extraction device is connected with the traffic recombination device, and is configured to extract website features from each data packet in each data stream to obtain website fingerprint extraction results.

[0132] The website prediction device is connected with the website fingerprint extraction device, and is configured to generate graph structure data based on the website fingerprint extraction result, perform a graph classification task on the graph structure data, and complete prediction of user access to the website according to a classification result.

[0133] In an exemplary embodiment, a computer device, which can be a server or a terminal, has an internal structure diagram as shown in the figure. Figure 10 The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store video tag processing data. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through network connection. The computer program is executed by the processor to implement an encryption website traffic anti-noise identification method.

[0134] Those skilled in the art can understand that Figure 8 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0135] In an exemplary embodiment, a computer device is also provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0136] In an exemplary embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0137] In an exemplary embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0138] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0139] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments of each method. In the embodiments provided in the present application, any reference to memory, database or other medium can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc.

[0140] The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a blockchain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0141] The technical features of the above embodiments can be combined arbitrarily. In order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, but as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0142] The principles and implementations of the present application are described in the specific examples used herein, and the above examples are only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation and application range will be changed. Therefore, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method for anti-noise recognition of encrypted website traffic, characterized in that, The encrypted website traffic anti-noise identification method comprises the following steps: Obtaining encrypted traffic generated when a user accesses a website, and saving the encrypted traffic into a PCAP file containing multiple data packets according to a set rule; Cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic; Recombining the cleaned encrypted traffic into multiple data streams based on the five-tuple information of the data packets in the PCAP file, wherein the five-tuple information comprises a source IP, a destination IP, a source port, a destination port and a protocol type; Extracting website features from each data packet in each data stream to obtain website fingerprint extraction results; Generating graph structure data based on the website fingerprint extraction results, comprising: taking the data packets in each data stream as nodes, setting directed edges according to the transmission direction of the data packets in the data stream, and connecting the first node and the last node by the directed edges according to the burst relationship of the data stream to obtain an initial graph structure; adding a virtual main node to the initial graph structure based on the cleaned encrypted traffic; and establishing a directed edge between the virtual main node and the first data packet of the data stream to obtain the graph structure data; Performing a graph classification task on the graph structure data and completing prediction of the website accessed by the user according to the classification result.

2. The method of claim 1, wherein, Cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic, specifically comprising: Determining the type of the data packets in the PCAP file, deleting the data packets of the type generated in a local area network environment, and retaining the data packets of the type of TLS encrypted traffic to obtain a cleaned PCAP file; Retaining the first 1024 data packets in the cleaned PCAP file; Generating cleaned encrypted traffic based on the retained first 1024 data packets.

3. The method of claim 2, wherein, Extracting website features from each data packet in each data stream to obtain website fingerprint extraction results, specifically comprising: Padding sensitive information in each data stream with 0 bytes, wherein the sensitive information comprises a source IP, a destination IP, a source port, a destination port and a server name indication; Converting the first 256 bytes of each data packet in each data stream after padding the sensitive information into binary values; Taking the binary values as website fingerprint extraction results and saving the transmission direction information of each data packet according to the transmission direction of the data packets in each data stream.

4. The method of claim 1, wherein, Recombining the cleaned encrypted traffic into multiple data streams based on the five-tuple information of the data packets in the PCAP file, specifically comprising: Adjusting the source IP in the five-tuple information to the address of a local user, adjusting the source port to the port of the local user, adjusting the target IP to the address of a server and adjusting the target port to the port of the server to obtain adjusted five-tuple information; Taking the adjusted five-tuple information as a data stream identifier, dividing the cleaned encrypted traffic into multiple PCAP data stream files according to the data stream identifier, and obtaining multiple data streams.

5. The method of claim 1, wherein, Performing a graph classification task on the graph structure data and completing prediction of the website accessed by the user according to the classification result, specifically comprising: For the graph structure data corresponding to each data stream, node features are obtained from node load by a self-encoder, the connection relationship of the nodes is unchanged, a new encrypted traffic feature graph is formed, and a decoder is used to limit the information of the new encrypted traffic feature graph, to obtain a new graph representation of encrypted traffic; For the graph representation of the new encrypted traffic, graph-level feature extraction is performed to obtain the whole graph feature of the encrypted traffic; A two-layer fully connected layer is used as a classifier to classify the whole graph feature to obtain a classification result, and the prediction of the user's access to the website is completed according to the classification result.

6. A system for encrypted website traffic anti-noise recognition, the system comprising: The system is used to implement the encrypted website traffic noise-resistant identification method of any one of claims 1-5; the encrypted website traffic noise-resistant identification system comprises: A traffic collection device is configured to obtain encrypted traffic generated when a user accesses a website, and save the encrypted traffic into a PCAP file containing multiple data packets according to a set rule; A traffic cleaning device is connected with the traffic collection device and configured to clean the data packets in the PCAP file to obtain cleaned encrypted traffic; A traffic recombination device is connected with the traffic cleaning device and configured to recombine the cleaned encrypted traffic into multiple data streams based on five-tuple information of the data packets in the PCAP file; the five-tuple information includes source IP, destination IP, source port, destination port, and protocol type; A website fingerprint extraction device is connected with the traffic recombination device and configured to extract website features from each data packet in each data stream to obtain website fingerprint extraction results; A website prediction device is connected with the website fingerprint extraction device and configured to generate graph structure data based on the website fingerprint extraction results, perform graph classification tasks on the graph structure data, and complete the prediction of the user's access to the website according to the classification results.

7. A computer device comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the encrypted website traffic noise-resistant identification method of any one of claims 1-5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the steps of the encrypted website traffic noise-resistant identification method of any one of claims 1-5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the encrypted website traffic noise-resistant identification method of any one of claims 1-5.

Images