Tor network flow sensing method based on impulse sequence response

Abstract

The invention provides a Tor network traffic sensing method based on impulse sequence response, which comprises the following steps of: capturing a data stream from a Tor network by using a packet capturing tool, and performing preliminary shunting by using quintuple information; performing fingerprint identification on the Tor network flow, extracting two characteristics of frequency domain entropy and direct current component of data flow in a window, and performing characterization; comparing entropy values of adjacent windows by using a dynamic window adjuster, and dynamically adjusting the sizes of the windows; inputting the feature matrix into a classifier to learn frequency domain features of the network traffic data; and the size of the training batch is flexibly adjusted according to the loss value. According to the invention, through the adaptive processing strategy, complex traffic characteristics in a Tor network environment are effectively handled, a classification decision can be made in time, and the processing accuracy and the response capability are significantly improved. The method shows wide application potential in Tor network traffic perception and management, especially in the aspects of traffic analysis, privacy protection, network security monitoring and anomaly detection.

Description

Technical Field

[0001] The present invention relates to the field of website fingerprint traffic perception, and in particular to a Tor network traffic perception method based on impulse sequence response. Background Art

[0002] With the popularity of the Internet and anonymous communication tools, the Tor network has become an important tool for users to hide their identities and protect their privacy. The Tor network, also known as The Onion Router, is a widely used distributed anonymous communication system. However, it also brings new challenges to network security, especially in terms of illegal activity detection and traffic management.

[0003] Although traditional Tor network traffic classification technology performs well in open networks, its accuracy and real-time performance are significantly reduced in the Tor network due to its encryption and jump routing mechanism.

[0004] In recent years, the development of deep learning technology has provided new ideas for traffic perception. For example, the AWF identification method proposed in the reference “V. Rimmer, D. Preuveneers, M. Juárez, T. van Goethem, and W. Joosen. Automated website fingerprinting through deep learning. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018. The Internet Society, 2018” uses a deep neural network to automatically extract features from the packet direction sequence; the reference “P. Sirinam, M. Imani, M. Juárez, and M. Wright. Deep fingerprinting: Undermining website fingerprinting defenses with deep learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, ON, Canada, October 15-19, 2018, pages 1928–1943. ACM, The DF recognition proposed in "2018" uses the packet direction sequence as input, but its convolutional neural network CNN is more complex than AWF and contains additional convolutional blocks; the Tik-Tok recognition proposed in "MS Rahman, P. Sirinam, N. Mathews, KG Gangadhara, and M. Wright. Tik-tok: The utility of packet timing in website fingerprinting attacks. Proc. Priv. Enhancing Technol, 2020 (3): 5–24, 2020" also uses a convolutional neural network CNN structure similar to DF. Unlike DF, the input of Tik-Tok is the product of the packet direction and the original time.

[0005] However, when dealing with complex traffic in the Tor network, these methods still have problems such as insufficient timeliness in extracting traffic features and low classification efficiency. At the same time, when facing defense measures such as adversarial machine learning and traffic segmentation, the recognition accuracy is low. Summary of the invention

[0006] Purpose of the invention: The technical problem to be solved by the present invention is to provide a Tor network traffic perception method based on impulse sequence response in view of the deficiencies of the prior art. It is specifically designed to efficiently identify and classify complex encrypted traffic in the Tor network. By extracting the frequency domain features of Tor traffic and inputting them into the convolutional neural network (CNN) classifier for learning, the present invention can dynamically adapt to traffic changes, flexibly adjust the size of the training batch, and ensure that the model can make timely classification decisions in a changing network environment.

[0007] The present invention dynamically improves the adaptability and accuracy of the model to network traffic through an adaptive processing mechanism. The method can quickly extract and learn traffic features, significantly improve the response speed while maintaining high accuracy, and is particularly suitable for real-time classification and analysis of Tor network traffic. This technology shows wide application potential in traffic analysis, privacy protection, network security monitoring and anomaly detection.

[0008] The present invention provides an impulse sequence response-based adaptive Tor website fingerprint traffic perception method, comprising the following steps:

[0009] Step 1: Use a packet capture tool to capture data flow from the Tor network, input the original data into the splitter, and perform preliminary splitting of the captured data based on the five-tuple information;

[0010] Step 2, input the preliminarily diverted data into the impulse response feature extractor. Most current Tor traffic perception methods focus on studying the various time domain features and related combinations of data packets, while ignoring the information implicit in their frequency domain features. The present invention innovatively introduces an impulse response feature extractor to extract and analyze the frequency domain features of data packets. After the data is input into the impulse response feature extractor, the initial window size is set, and the data in the window is preprocessed, and the preprocessing includes data standardization, fast Fourier transform FFT operation, using a dynamic window adjuster to extract frequency domain features, and constructing an input feature vector of a convolutional neural network;

[0011] Step 3, match the dimension of the feature vector constructed in step 2 with the input dimension of the convolutional neural network. If the dimension of the feature vector is smaller than the input dimension of the convolutional neural network, fill the dimension by zero padding. If the dimension of the feature vector is larger than the input dimension of the convolutional neural network, truncate the redundant feature dimension. If the dimension of the feature vector is equal to the input dimension of the convolutional neural network, directly input it.

[0012] Step 4, input the constructed feature vector and the corresponding index vector into a classifier based on a convolutional neural network to train the convolutional neural network. In the present invention, a BN preprocessing layer is innovatively introduced into the training model to process the input raw data to ensure that the input features remain stable and consistent during the training process. Batch Normalization (BN) is a regularization technology in deep learning, which is used to accelerate the training of neural networks and improve the generalization ability of the model. BN standardizes the input of each layer to make it have zero mean and unit variance. The convolutional neural network includes an application classification task, which analyzes the feature vector to identify the data stream accessed by the Tor network;

[0013] Step 5, use the back propagation algorithm combined with mixed precision to continuously optimize and update the weights during the training process, and use the judge to automatically terminate the training. Compared with traditional single-precision training, mixed precision combines the advantages of single-precision (FP32) and half-precision (FP16) floating-point numbers, taking into account both training efficiency and performance. In terms of the judge, since judging whether the convolutional neural network has converged solely from the improvement of training performance will bring large errors, resulting in overfitting or underfitting, the present invention introduces the two concepts of performance fluctuation and significance threshold of performance fluctuation. When the performance of the validation set fluctuates within a range for more than two consecutive epochs (in a neural network, an epoch refers to a training process in which all samples of the entire training data set pass through the neural network once), the judge makes a judgment, stops training and outputs the model, wherein the performance fluctuation represents the change in model performance in different epochs.

[0014] Step 1 contains the following steps:

[0015] Step 1-1: Use a packet grabber to capture raw data packets from the Tor network.

[0016] Step 1-2, divide the data stream according to the five-tuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol, and mark the category label.

[0017] Step 2 contains the following steps:

[0018] Step 2-1, determine the initial window size , and the timestamp belongs to [0, ] range of data packets to obtain the first window Data packets within the range, such as =40ms;

[0019] The timestamp refers to the time when the current original data packet is received or sent;

[0020] Step 2-2, extracting characteristic information of all original data packets in the first window, wherein the characteristic information includes a timestamp and a transmission direction of the original data packets;

[0021] The transmission direction of the original data packet refers to that the original data packet transmitted from the server to the client is represented as forward transmission, which is set to +1; the original data packet transmitted from the client to the server is represented as reverse transmission, which is set to -1;

[0022] Step 2-3, combining the timestamp of the data packet in the first window with the transmission direction feature to form an impulse sequence;

[0023] Step 2-4, performing a fast Fourier transform (FFT) operation on the impulse sequence of the first window, extracting two features, frequency domain entropy and DC component, and constructing a feature matrix using the two features;

[0024] Steps 2-5, = , get the second window , for timestamps belonging to ( , + ] range of data packets are extracted and the same operation is performed, that is, the timestamp is combined with the transmission direction characteristics to form an impulse sequence, and the fast Fourier transform FFT operation is performed to extract the frequency domain entropy and DC component characteristics; after the feature extraction is completed, the entropy value of the second window is compared with the entropy value of the first window. If the entropy value of the second window is greater than the entropy value of the first window, the size of the initial window is reduced by a certain proportion when processing the third window; otherwise, the size of the initial window is increased by a certain proportion, and all subsequent windows are processed in this way. The process is expressed by the following formula:

[0025]

[0026] in, For the The size of the window, In the example, take the value 40ms. For the The entropy value of the window, and is a preset adjustment factor used to control the magnitude of window resizing. =0.9, =1.1.

[0027] Step 2-6, after processing all windows, the frequency domain entropy and DC component features of each window are combined to form a feature vector with two rows and n columns, where n is the actual number of windows, that is, the dimension of the constructed feature vector. In the example, n=1900 can be set.

[0028] Step 3 includes the following steps:

[0029] Step 3-1, match the dimension n of the feature vector constructed in step 2 with the input dimension N of the convolutional neural network. If the vector dimension is smaller than the input dimension of the convolutional neural network, fill the dimension with zeros. If the vector dimension is larger than the input dimension of the convolutional neural network, cut off the redundant feature dimension. N is the input dimension of the convolutional neural network, which is a constant value. In this example, N=1800 is taken. Since n>N, only N feature dimensions are retained. Similarly, the feature vector constructed in step 2 is processed according to actual needs.

[0030] Step 3-2, input the adjusted feature vector into the convolutional neural network.

[0031] In step 3, the hierarchical structure of the convolutional neural network includes:

[0032] L1-1: Input data layer, used to receive the feature matrix to be processed, providing a basis for subsequent feature extraction and analysis;

[0033] L1-2: BN preprocessing layer;

[0034] Batch Normalization (BN) is a regularization technique in deep learning that is used to accelerate the training of neural networks and improve the generalization ability of the model. The BN preprocessing layer normalizes the input of each layer to make it have zero mean and unit variance. In this model, the BN layer is introduced to process the raw input data to ensure that the input features remain stable and consistent during the training process. The processing process of the BN preprocessing layer is:

[0035] For the original input feature matrix , the shape is ,in:

[0036] N is numerically equal to the total number of windows adjusted in step 2;

[0037] X[0] represents the frequency domain entropy feature;

[0038] X[1] represents the DC component characteristics.

[0039] For each dimension, the mean and variance are calculated separately, and the formula is:

[0040]

[0041]

[0042] in ; represents the mean of the features in the i-th row; represents the variance of the feature in the i-th row; is the original eigenvalue of the jth column and the ith row;

[0043] The features of each row are standardized using the formula:

[0044]

[0045] in, is a very small constant that prevents the denominator from being zero; represents the standardized eigenvalue of the jth column and the ith row;

[0046] Input the feature matrix processed by the BN preprocessing layer backward;

[0047] L1-3: The first convolution block; The first convolution block is used to extract low-level local spatial features from the input feature matrix, and reduce the dimension of the features through pooling, control the amount of calculation, and prevent overfitting, providing basic feature representation for subsequent convolution layers. Specifically include:

[0048] L1-301: 2D convolutional layer, which uses 32 convolution kernels of size 3x6 to convolve the input data to capture spatial features. The stride is set to 1 and the padding is set to 1 to maintain the feature map size.

[0049] L1-302: Batch normalization layer, which normalizes the output of the convolutional layer to speed up the training process and improve the generalization ability of the model.

[0050] L1-303: ReLU activation layer, where ReLU stands for Rectified Linear Unit, which is a commonly used activation function, especially in deep learning. The activation function is a function used to increase nonlinear factors in neural networks, enhance the expressive power of the model, and enable the network to learn complex features.

[0051] L1-304: Maximum pooling layer, which performs downsampling through a 1x3 pooling kernel to reduce the number of parameters and computation while retaining important features.

[0052] L1-305: Dropout layer randomly turns off some neurons at a dropout rate of 10% to reduce overfitting and improve the generalization performance of the model.

[0053] L1-4: The second convolutional block; The second convolutional block is used to deepen the extraction of spatial features. It further extracts richer and deeper spatial features based on the first convolutional block, and enhances the capture of abstract patterns through more channels to build a higher-level feature representation; specifically, it includes:

[0054] L1-401: 2D convolutional layer, increasing the depth to 64 channels, using a 3x6 convolution kernel to further extract features, with the same stride and padding as the previous layer.

[0055] L1-402: Batch normalization layer, which performs normalization again to maintain the stability of network training.

[0056] L1-403: Linear rectification function ReLU activation layer, continues to introduce nonlinear activation to enrich the expression of the model.

[0057] L1-404: Maximum pooling layer, using a 2x2 pooling kernel to further reduce the feature dimension and extract more abstract features.

[0058] L1-405: Dropout layer, which also uses a dropout rate of 10% to enhance the model's adaptability to new data.

[0059] L1-5: Output reshaping layer, the task of the output reshaping layer is to reshape the output feature maps of the first convolution block and the second convolution block, adjust the number of channels to 32, and prepare for the next one-dimensional convolution operation;

[0060] L1-6: The third convolution block; the task of the third convolution block is to extract features from the converted sequence data through one-dimensional convolution, focusing on the time series or sequence correlation in the input data and analyzing it in the time dimension; specifically including:

[0061] L1-601: One-dimensional convolution layer, which uses 128 convolution kernels of size 3 to perform one-dimensional convolution on the reshaped data to further extract sequence features.

[0062] L1-602: Batch normalization layer, normalizes the output of the one-dimensional convolutional layer to optimize the training process.

[0063] L1-603: Linear rectification function ReLU activation layer, which increases the nonlinearity of the network through the ReLU activation function.

[0064] L1-604: Maximum pooling layer, applying a pooling kernel of 3 for maximum pooling to reduce the feature dimension.

[0065] L1-605: Random Dropout layer, with a random dropout rate of 30% to further suppress overfitting.

[0066] L1-7: The fourth convolutional block; the task of the fourth convolutional block is to further extract high-level sequence features, capture more complex and abstract temporal patterns by deepening the feature extraction of one-dimensional sequences, and enhance the model's understanding of time dependencies; specifically, it includes:

[0067] L1-701: One-dimensional convolution layer, increase the depth of the convolution layer to 256, and use a convolution kernel of 3 to continue extracting features.

[0068] L1-702: Batch normalization layer, continue normalization processing.

[0069] L1-703: Linear rectification function ReLU activation layer, which enhances the expressiveness of the model through the ReLU activation function.

[0070] L1-704: Maximum pooling layer, again applying the pooling kernel of 3 for maximum pooling.

[0071] L1-705: Dropout layer, which performs random dropout at a rate of 30% to improve the generalization ability of the model.

[0072] L1-8: Global average pooling layer, the task of the global average pooling layer is to perform global average pooling on the output of the convolution block, and take the average value of the feature map of each channel as the representative feature of the channel;

[0073] L1-9: Fully connected convolutional layer. The task of the fully connected convolutional layer is to further mix and process the features in depth on the basis of global average pooling, enhance the expressiveness of the features, and prepare for the final classification. Specifically, it includes:

[0074] L1-901: One-dimensional convolution layer, which uses 512 convolution kernels of size 3 to convolve the output after global average pooling to further mix features.

[0075] L1-902: Batch normalization layer, normalizes the output of the convolutional layer.

[0076] L1-903: Linear rectification function ReLU activation layer, which increases the nonlinearity of the network through the ReLU activation function.

[0077] L1-10: Classification convolution layer. The task of the classification convolution layer is to extract the final classification features. This layer focuses on extracting the final features according to the classification task, ensuring that the output features meet the classification requirements and are mapped to a specific classification space, including:

[0078] L1-1001: One-dimensional convolution layer. The depth of the convolution layer is set according to the number of categories of the classification task, and a convolution kernel of 3 is used for the final feature extraction.

[0079] L1-1002: Batch normalization layer, which normalizes the output of the classification convolutional layer.

[0080] L1-1003: Linear rectification function ReLU activation layer, which enhances the expressiveness of the model through the ReLU activation function.

[0081] L1-11: Global average pooling 1D layer, the task of the global average pooling 1D layer is to perform global average pooling on the output of the classification convolution layer to obtain the global feature representation of each channel;

[0082] L1-12: Flatten layer. The task of the Flatten layer is to flatten the multi-dimensional features after global average pooling into a one-dimensional feature vector to prepare for subsequent input;

[0083] L1-13: Normalized exponential function Softmax layer. The task of the Softmax layer is to apply the softmax function to the feature vector flattened by the Flatten layer, converting the feature into a probability distribution for the final classification decision.

[0084] In step 4, the convolutional neural network is trained by the following steps:

[0085] Step 4-1, constructing a training data set: collecting raw traffic data from the Tor network, classifying the raw traffic data by visited websites, and randomly dividing the data into a training set, a validation set, and a test set. In the present invention, the training set, the validation set, and the test set can be divided according to a ratio of 8:1:1;

[0086] Step 4-2, execute the training process: design the cross entropy loss function for classification error measurement, then set the convolution kernel size, learning rate and other related parameters. In the example, the setting of the convolution kernel size has been explained in detail in the introduction to the structure of the convolutional neural network. The learning rate can be set to 0.0005, and finally execute the model training. Among them, the cross entropy loss function is also called logarithmic loss (Log Loss), which is one of the commonly used loss functions in machine learning, especially in binary and multi-classification problems. It measures the difference between the probability distribution predicted by the model and the probability distribution of the true label;

[0087] Step 4-3, performing mixed precision training. Compared with traditional single precision training, the present invention introduces mixed precision training. While maintaining numerical accuracy and stability, mixed precision training significantly improves computational efficiency and reduces memory overhead, and ensures the reliability of training through technologies such as gradient scaling. It is particularly suitable for efficient training of large neural networks. The steps include:

[0088] Step 4-3-1, during the training process, the forward propagation and calculation of the convolutional neural network are automatically converted to half-precision floating points. The half-precision processing process includes the processing of the convolution layer, pooling layer, and fully connected layer to improve computing efficiency and reduce memory usage; the processing of gradient calculation and weight update is maintained as single-precision floating point to ensure numerical stability and model accuracy.

[0089] Step 4-3-2, manage gradient scaling through initialization: During the back-propagation process, dynamically adjust the scaling factor to prevent gradient overflow (i.e., the gradient value is too large, resulting in numerical instability); if the gradient overflows, the scaling factor will be reduced; if the gradient is stable, the scaling factor will remain unchanged or increase appropriately.

[0090] Step 4-3-3, use the adaptive moment estimation Adam optimizer and dynamically adjust the learning rate at the beginning of each epoch; the learning rate is adjusted in an exponential decay manner according to the current epoch number and the total epoch number; among them, the adaptive moment estimation Adam optimizer dynamically adjusts the learning rate by calculating the first-order moment estimate of the gradient (that is, the mean of the gradient) and the second-order moment estimate (that is, the uncentered variance of the gradient), thereby achieving more efficient network training.

[0091] Step 4-4, training monitoring: By regularly evaluating the performance of the convolutional neural network on the validation set during the training process, if the performance shows stable fluctuations for more than two consecutive epochs, that is, when the performance tends to be stable, it is judged that the convolutional neural network has converged. At this time, training is stopped to avoid overfitting and save computing resources. The judgment process is expressed by the following formula:

[0092]

[0093] in is the performance index of the kth epoch, is the significance threshold of performance fluctuation, which can be 0.05 in this example. The smaller the significance threshold, the more convergent the final model is. M is the epoch number threshold for continuous no significant fluctuation, which can be 10 in this example. The larger the value of M, the more convergent the final model is. The judgment standard is to find such an epoch value k that the fluctuation value of each epoch is less than 1 in the M consecutive epochs starting from k. .

[0094] The present invention also provides an electronic device, comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the described method.

[0095] The present invention also provides a storage medium storing a computer program or instruction. When the computer program or instruction is run on a computer, the steps of the method described are executed.

[0096] The present invention has the following beneficial effects: when extracting features, the frequency domain information of the data packet features is innovatively extracted, so as to realize more accurate network traffic pattern recognition and provide another idea for the feature extraction of the data packet; a new sliding window based on frequency domain entropy is designed, so as to realize more precise feature capture and change detection when extracting the data packet features; in the model training process, mixed precision training is adopted to realize the optimization of computational efficiency and memory usage, thereby improving the training performance; a BN (Batch Normalization) preprocessing layer is introduced into the convolutional neural network structure to process the input raw data, so as to ensure that the input features maintain stability and consistency during the training process, so as to realize the acceleration of the training convergence speed and the improvement of the model accuracy; in terms of the judge, performance fluctuation and its significance threshold are introduced to judge the training process, and compared with the traditional performance improvement judgment method, this method is more sensitive and accurate, and helps to avoid overfitting or underfitting. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 It is a diagram of the frequency domain feature extraction of the present invention.

[0098] Figure 2 The present invention is a flowchart of the steps of the method.

[0099] Figure 3 Extraction graph for website fingerprint traffic features.

[0100] Figure 4 This is the structure diagram of the adaptive one-dimensional convolutional neural network.

[0101] Figure 5 This is the adaptive one-dimensional convolutional neural network training process of the present invention. DETAILED DESCRIPTION

[0102] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, and the advantages of the above aspects of the present invention will become more clear.

[0103] This embodiment provides a Tor network traffic perception method based on impulse sequence response, such as Figure 2 As shown in the figure. The method first collects network traffic and preliminarily divides the network flow according to the five-tuple. Then, the data set is processed by multi-level preprocessing, a dynamic time window is introduced and the initial time window size is set. In this process, some data packets of the data flow are intercepted from the window, and frequency domain features are extracted from them, including entropy and DC components. Entropy is used to measure the uncertainty of information in the window. Then, by comparing the entropy values ​​of adjacent windows, the size of the next window is dynamically adjusted to optimize the window size and more effectively capture the frequency domain features of the data packet.

[0104] The feature input matrix is ​​constructed using the extracted frequency domain features and frequency domain labels, and the matrix is ​​input into the convolutional neural network for training. During the training process, mixed precision technology is used to improve training efficiency and reduce memory consumption. At the same time, the size of the training batch is dynamically adjusted according to the loss value.

[0105] The method of this embodiment specifically includes the following steps:

[0106] Step 1: Use a packet capture tool to capture data flow from the Tor network, input the original data into the splitter, and perform preliminary splitting of the captured data based on the five-tuple information;

[0107] Step 2, input the preliminarily diverted data into the impulse response feature extractor. Most current Tor traffic perception methods focus on studying the various time domain features and related combinations of data packets, while ignoring the information implicit in its frequency domain features. After the data is input into the impulse response feature extractor, the initial window size is set, and the data in the window is preprocessed. The preprocessing includes data standardization, fast Fourier transform FFT operation, extraction of frequency domain features using a dynamic window adjuster, and construction of the input feature vector of the convolutional neural network;

[0108] Step 3, match the dimension of the feature vector constructed in step 2 with the input dimension of the convolutional neural network. If the dimension of the feature vector is smaller than the input dimension of the convolutional neural network, fill the dimension by zero padding. If the dimension of the feature vector is larger than the input dimension of the convolutional neural network, truncate the redundant feature dimension. If the dimension of the feature vector is equal to the input dimension of the convolutional neural network, directly input it.

[0109] Step 4: Input the constructed feature vector and the corresponding index vector into a classifier based on a convolutional neural network to train the convolutional neural network. The convolutional neural network includes an application classification task, and the feature vector is analyzed to identify the data flow accessed by the Tor network;

[0110] Step 5, use the back propagation algorithm combined with mixed precision to continuously optimize and update the weights during the training process, and use the judge to automatically terminate the training. Compared with traditional single-precision training, mixed precision combines the advantages of single-precision (FP32) and half-precision (FP16) floating-point numbers, taking into account both training efficiency and performance. In terms of the judge, since judging whether the convolutional neural network has converged solely from the improvement of training performance will bring large errors, resulting in overfitting or underfitting, the present invention introduces the two concepts of performance fluctuation and significance threshold of performance fluctuation. When the performance of the validation set fluctuates within a range for more than two consecutive epochs (in a neural network, an epoch refers to a training process in which all samples of the entire training data set pass through the neural network once), the judge makes a judgment, stops training and outputs the model, wherein the performance fluctuation represents the change in model performance in different epochs.

[0111] In this embodiment, the feature extraction step diagram is as follows: Figure 3 As shown in the detailed steps, step 1 and step 2 include the following sub-steps:

[0112] Step 1 contains the following steps:

[0113] Step 1-1: Use a packet grabber to capture raw data packets from the Tor network.

[0114] Step 1-2, divide the data flow according to the five-tuple (source IP address, destination IP address, source port number, destination port number, transport layer protocol) and mark the category label.

[0115] Step 2 contains the following steps:

[0116] Step 2-1, determine the initial window size , and the timestamp belongs to [0, ] range of data packets to obtain the first window Data packets within the range, such as =40ms;

[0117] The timestamp refers to the time when the current original data packet is received or sent;

[0118] Step 2-2, extracting characteristic information of all original data packets in the first window, wherein the characteristic information includes a timestamp and a transmission direction of the original data packets;

[0119] The transmission direction of the original data packet refers to that the original data packet transmitted from the server to the client is represented as forward transmission, which is set to +1; the original data packet transmitted from the client to the server is represented as reverse transmission, which is set to -1;

[0120] Step 2-3, combining the timestamp of the data packet in the first window with the transmission direction feature to form an impulse sequence;

[0121] Step 2-4, performing a fast Fourier transform (FFT) operation on the impulse sequence of the first window, extracting two features, frequency domain entropy and DC component, and constructing a feature matrix using the two features;

[0122] Steps 2-5, = , get the second window , for timestamps belonging to ( , + ] range of data packets are extracted and the same operation is performed, that is, the timestamp is combined with the transmission direction characteristics to form an impulse sequence, and the fast Fourier transform FFT operation is performed to extract the frequency domain entropy and DC component characteristics; after the feature extraction is completed, the entropy value of the second window is compared with the entropy value of the first window. If the entropy value of the second window is greater than the entropy value of the first window, the size of the initial window is reduced by a certain proportion when processing the third window; otherwise, the size of the initial window is increased by a certain proportion, and all subsequent windows are processed in this way. The process is expressed by the following formula:

[0123]

[0124] in, For the The size of the window, is the initial window size, which is set to 40ms in the example. For the The entropy value of the window, and is a preset adjustment factor used to control the magnitude of window resizing. =0.9, =1.1, assuming the entropy value of the second window Greater than the entropy value of the first window , then take = , .

[0125] Step 2-6, after processing all windows, the two features of each window, namely the frequency domain entropy and the DC component feature, are combined to form a feature vector with two rows and n columns, where n is the actual number of windows, that is, the dimension of the constructed feature vector. In this example, it can be assumed that n=1900.

[0126] Step 3 includes the following steps:

[0127] Step 3-1, match the dimension n of the feature vector constructed in step 2 with the input dimension N of the convolutional neural network. If the vector dimension is smaller than the input dimension of the convolutional neural network, fill the dimension by zero padding. If the vector dimension is larger than the input dimension of the convolutional neural network, truncate the redundant feature dimension. Where n is the number of windows obtained in step 2, n=1900, and N is the input dimension of the convolutional neural network, which is a constant value. In this example, N=1800 is taken. Since n>N, only N feature dimensions are retained. Similarly, the feature vector constructed in step 2 is processed according to actual needs;

[0128] In this embodiment, if Figure 4 As shown in the figure, the classification module of adaptive website fingerprint traffic perception contains a convolutional neural network, and the hierarchical structure of the convolutional neural network is as follows:

[0129] L1-1: Input data layer, responsible for receiving the original feature matrix to be processed, providing a basis for subsequent feature extraction and analysis.

[0130] L1-2: BN preprocessing layer

[0131] Batch Normalization (BN) is a regularization technique in deep learning that is used to accelerate the training of neural networks and improve the generalization ability of the model. BN normalizes the input of each layer to make it have zero mean and unit variance. In this model, the BN layer is introduced to process the raw input data to ensure that the input features remain stable and consistent during the training process. The processing process is as follows:

[0132] For the original input feature matrix , the shape is ,in:

[0133] N represents the input dimension of the convolutional neural network in step 3, which is numerically equal to the total number of windows adjusted in step 2;

[0134] X[0] represents the frequency domain entropy feature;

[0135] X[1] represents the DC component characteristics.

[0136] For each dimension, the mean and variance are calculated separately, which can be expressed by the following formula:

[0137]

[0138]

[0139] in ; represents the mean of the features in the i-th row; represents the variance of the feature in the i-th row; is the original eigenvalue of the jth column and the ith row;

[0140] Standardizing the features of each row can be expressed as follows:

[0141]

[0142] in, is a very small constant that prevents the denominator from being zero; represents the standardized eigenvalue of the jth column and the ith row;

[0143] Input the feature matrix processed by the BN preprocessing layer backward;

[0144] L1-3: The first convolutional block

[0145] L1-301: 2D convolutional layer, which uses 32 convolution kernels of size 3x6 to convolve the input data to capture spatial features. The stride is set to 1 and the padding is set to 1 to maintain the feature map size.

[0146] L1-302: Batch normalization layer, which normalizes the output of the convolutional layer to speed up the training process and improve the generalization ability of the model.

[0147] L1-303: ReLU activation layer, where ReLU stands for Rectified Linear Unit, which is a commonly used activation function, especially in deep learning. The activation function is a function used to increase nonlinear factors in neural networks, enhance the expressive power of the model, and enable the network to learn complex features.

[0148] L1-304: Maximum pooling layer, which performs downsampling through a 1x3 pooling kernel to reduce the number of parameters and computation while retaining important features.

[0149] L1-305: Dropout layer randomly turns off some neurons at a dropout rate of 10% to reduce overfitting and improve the generalization performance of the model.

[0150] L1-4: The second convolutional block

[0151] L1-401: 2D convolutional layer, increasing the depth to 64 channels, using a 3x6 convolution kernel to further extract features, with the same stride and padding as the previous layer.

[0152] L1-402: Batch normalization layer, which performs normalization again to maintain the stability of network training.

[0153] L1-403: Linear rectification function ReLU activation layer, continues to introduce nonlinear activation to enrich the expression of the model.

[0154] L1-404: Maximum pooling layer, using a 2x2 pooling kernel to further reduce the feature dimension and extract more abstract features.

[0155] L1-405: Dropout layer, which also uses a dropout rate of 10% to enhance the model's adaptability to new data.

[0156] L1-5: Output reshaping layer, which reshapes the output feature map of the convolution layer and adjusts the number of channels to 32 to prepare for the subsequent one-dimensional convolution operation.

[0157] L1-6: The third convolutional block

[0158] L1-601: One-dimensional convolution layer, which uses 128 convolution kernels of size 3 to perform one-dimensional convolution on the reshaped data to further extract sequence features.

[0159] L1-602: Batch normalization layer, normalizes the output of the one-dimensional convolutional layer to optimize the training process.

[0160] L1-603: Linear rectification function ReLU activation layer, which increases the nonlinearity of the network through the ReLU activation function.

[0161] L1-604: Maximum pooling layer, applying a pooling kernel of 3 for maximum pooling to reduce the feature dimension.

[0162] L1-605: Random Dropout layer, with a random dropout rate of 30% to further suppress overfitting.

[0163] L1-7: The fourth convolutional block

[0164] L1-701: One-dimensional convolution layer, increase the depth of the convolution layer to 256, and use a convolution kernel of 3 to continue extracting features.

[0165] L1-702: Batch normalization layer, continue normalization processing.

[0166] L1-703: Linear rectification function ReLU activation layer, which enhances the expressiveness of the model through the ReLU activation function.

[0167] L1-704: Maximum pooling layer, again applying the pooling kernel of 3 for maximum pooling.

[0168] L1-705: Dropout layer, which performs random dropout at a rate of 30% to improve the generalization ability of the model.

[0169] L1-8: Global average pooling layer, which performs global average pooling on the output of the convolution block and takes the average value of the feature map of each channel as the representative feature of the channel.

[0170] L1-9: Fully connected convolutional layer

[0171] L1-901: One-dimensional convolution layer, which uses 512 convolution kernels of size 3 to convolve the output after global average pooling to further mix features.

[0172] L1-902: Batch normalization layer, normalizes the output of the convolutional layer.

[0173] L1-903: Linear rectification function ReLU activation layer, which increases the nonlinearity of the network through the ReLU activation function.

[0174] L1-10: Classification convolutional layer

[0175] L1-1001: One-dimensional convolution layer. The depth of the convolution layer is set according to the number of categories of the classification task, and a convolution kernel of 3 is used for the final feature extraction.

[0176] L1-1002: Batch normalization layer, which normalizes the output of the classification convolutional layer.

[0177] L1-1003: Linear rectification function ReLU activation layer, which enhances the expressiveness of the model through the ReLU activation function.

[0178] L1-11: Global average pooling 1D layer, which performs global average pooling on the output of the classification convolutional layer to obtain the global feature representation of each channel.

[0179] L1-12: Flatten layer, which flattens the multi-dimensional features after global average pooling into a one-dimensional feature vector to prepare for the input of the fully connected layer.

[0180] L1-13: Normalized exponential function Softmax layer, which applies the softmax function to the flattened feature vector to convert the features into probability distribution for the final classification decision.

[0181] In this embodiment, if Figure 5 As shown, the convolutional neural network is trained through the following steps:

[0182] Step 4-1, construct a training data set: collect raw traffic data from the Tor network, classify the raw traffic data by visited websites, and randomly divide it into training set, validation set and test set. In this example, the training set, validation set and test set are divided according to 8:1:1;

[0183] Step 4-2, execute the training process: design the cross entropy loss function for classification error measurement, then set the convolution kernel size, learning rate and other related parameters. In the example, the setting of the convolution kernel size has been explained in detail in the introduction to the structure of the convolutional neural network. The learning rate can be set to 0.0005, and finally execute the model training. Among them, the cross entropy loss function is also called logarithmic loss (Log Loss), which is one of the commonly used loss functions in machine learning, especially in binary and multi-classification problems. It measures the difference between the probability distribution predicted by the model and the probability distribution of the true label;

[0184] Step 4-3, performing mixed precision training. Compared with traditional single precision training, the present invention introduces mixed precision training. While maintaining numerical accuracy and stability, mixed precision training significantly improves computational efficiency and reduces memory overhead, and ensures the reliability of training through technologies such as gradient scaling. It is particularly suitable for efficient training of large neural networks. The steps include:

[0185] Step 4-3-1, during the training process, the forward propagation and calculation of the convolutional neural network are automatically converted to half-precision floating points. The half-precision processing mainly includes the processing of the convolution layer, pooling layer, and fully connected layer to improve computing efficiency and reduce memory usage; the processing of gradient calculation and weight update is maintained as single-precision floating point to ensure numerical stability and model accuracy.

[0186] Step 4-3-2, manage gradient scaling through initialization: During the back-propagation process, dynamically adjust the scaling factor to prevent gradient overflow (i.e., the gradient value is too large, resulting in numerical instability); if the gradient overflows, the scaling factor will be reduced; if the gradient is stable, the scaling factor will remain unchanged or increase appropriately.

[0187] Step 4-3-3, use the adaptive moment estimation Adam optimizer and dynamically adjust the learning rate at the beginning of each epoch; the learning rate is adjusted in an exponential decay manner according to the current epoch number and the total epoch number; among them, the adaptive moment estimation Adam optimizer dynamically adjusts the learning rate by calculating the first-order moment estimate of the gradient (that is, the mean of the gradient) and the second-order moment estimate (that is, the uncentered variance of the gradient), thereby achieving more efficient network training.

[0188] Step 4-4, training monitoring: By regularly evaluating the performance of the convolutional neural network on the validation set during the training process, if the performance shows stable fluctuations for more than two consecutive epochs, that is, when the performance tends to be stable, it is judged that the convolutional neural network has converged. At this time, training is stopped to avoid overfitting and save computing resources. The judgment process is expressed by the following formula:

[0189]

[0190] in is the performance index of the kth epoch, is the significance threshold of performance fluctuation, which can be 0.05 in this example. The smaller the significance threshold, the more convergent the final model is. M is the epoch number threshold for continuous no significant fluctuation, which can be 10 in this example. The larger the value of M, the more convergent the final model is. The judgment standard is to find such an epoch value k that the fluctuation value of each epoch is less than 1 in the M consecutive epochs starting from k. .

[0191] In the actual test, a public dataset commonly used to evaluate the Tor network traffic identification performance is used. This dataset contains 95 websites, each with 1,000 unprotected traces for closed-world evaluation. This dataset is called the Undefended dataset.

[0192] In addition, the Undefended dataset was processed using the WTF-PAD method (reference: M. Juárez, M. Imani, M. Perry, C. Díaz, and M. Wright. Toward an efficient website fingerprinting defense. InComputer Security - ESORICS 2016 - 21st European Symposium on Research inComputer Security, Heraklion, Greece, September 26-30,2016, Proceedings, PartI, volume 9878 of Lecture Notes in Computer Science, pages 27–46. Springer,2016.). The processed dataset is called the WTF-PAD dataset. WTF-PAD is a zero-latency defense and has been shown to be effective against website fingerprinting based on traditional machine learning classifiers, reducing its accuracy to less than 69%.

[0193] For the recognition of the two data sets, the method of this embodiment shows higher accuracy than previous similar methods. For example, compared with the AWF method mentioned above, its recognition accuracy for the Undefended data set is 94.32%, and its recognition accuracy for the WTF-PAD data set is 52.67%. The recognition accuracy of the method of this embodiment for the Undefended data set is 94.67%, and the recognition accuracy for the WTF-PAD data set is 88.74%, showing higher stability.

[0194] The present invention provides a Tor network traffic perception method based on impulse sequence response. There are many methods and ways to implement the technical solution. The above is only a preferred implementation of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the protection scope of the present invention. All components not specified in this embodiment can be implemented by existing technologies.

Claims

1. A Tor network traffic perception method based on impulse sequence response, characterized in that: The following steps are involved: Step 1: Capture data flow from the Tor network, input the original data into the splitter, and perform preliminary splitting on the captured data; Step 2, inputting the preliminarily diverted data into an impulse response feature extractor, setting an initial window size, and preprocessing the data in the window, wherein the preprocessing includes data standardization, fast Fourier transform (FFT) operation, extracting frequency domain features using a dynamic window adjuster, and constructing an input feature vector of a convolutional neural network; Step 3, match the dimension of the feature vector constructed in step 2 with the input dimension of the convolutional neural network. If the dimension of the feature vector is smaller than the input dimension of the convolutional neural network, fill the dimension by zero padding. If the dimension of the feature vector is larger than the input dimension of the convolutional neural network, truncate the redundant feature dimension. If the dimension of the feature vector is equal to the input dimension of the convolutional neural network, directly input it. Step 4, input the constructed feature vector and the corresponding index vector into a classifier based on a convolutional neural network to train the convolutional neural network; Step 5: Use the back-propagation algorithm combined with mixed precision to continuously optimize and update the weights during the training process, and use the judge to automatically terminate the training.

2. The method according to claim 1, characterized in that Step 1 contains the following steps: Step 1-1, use a packet grabber to capture the original data packets from the Tor network; Step 1-2, divide the data stream according to the five-tuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol, and mark the category label.

3. The method according to claim 2, characterized in that Step 2 contains the following steps: Step 2-1, determine the initial window size , and the timestamp belongs to [0, ] range of data packets to obtain the first window Data packets within the scope; The timestamp refers to the time when the current original data packet is received or sent; Step 2-2, extract the first window The characteristic information of all original data packets in the data packet includes a timestamp and a transmission direction of the original data packet; The transmission direction of the original data packet refers to that the original data packet transmitted from the server to the client is represented as forward transmission, which is set to +1; the original data packet transmitted from the client to the server is represented as reverse transmission, which is set to -1; Step 2-3, combining the timestamp of the data packet in the first window with the transmission direction feature to form an impulse sequence; Step 2-4, performing a fast Fourier transform (FFT) operation on the impulse sequence of the first window, extracting two features, frequency domain entropy and DC component, and constructing a feature matrix using the two features; Steps 2-5, = , get the second window , for timestamps belonging to ( , + ] range of data packets are extracted, the timestamp is combined with the transmission direction characteristics to form an impulse sequence, and the fast Fourier transform FFT operation is performed to extract the frequency domain entropy and DC component characteristics; feature After the extraction is completed, the entropy values ​​of the second window are compared with those of the first window. If the entropy value of the second window is greater than that of the first window, the size of the initial window is reduced by a certain proportion when processing the third window; otherwise, the size of the initial window is increased by a certain proportion. The process is expressed by the following formula: ， in, For the The size of the window, For the The entropy value of the window, and It is a preset adjustment factor used to control the magnitude of window resizing; Step 2-6, after processing all windows, the frequency domain entropy and DC component features of each window are combined to form a feature vector with two rows and n columns, where n is the actual number of windows, that is, the dimension of the constructed feature vector.

4. The method according to claim 3, characterized in that: Step 3 includes the following steps: Step 3-1, match the dimension n of the feature vector constructed in step 2 with the input dimension N of the convolutional neural network. If the vector dimension is smaller than the input dimension of the convolutional neural network, fill the dimension by zero padding. If the vector dimension is larger than the input dimension of the convolutional neural network, truncate the redundant feature dimension. Step 3-2, input the adjusted feature vector into the convolutional neural network.

5. The method according to claim 4, characterized in that In step 3, the hierarchical structure of the convolutional neural network includes: L1-1: Input data layer, used to receive the feature matrix to be processed, providing a basis for subsequent feature extraction and analysis; L1-2: BN preprocessing layer. The BN preprocessing layer is used to standardize the input of each layer. The processing process of the BN preprocessing layer is: For the original input feature matrix , the shape is ,in: N is numerically equal to the total number of windows adjusted in step 2; X[0] represents the frequency domain entropy feature; X[1] represents the DC component characteristics; For each dimension, the mean and variance are calculated separately, and the formula is: ， ， in ; represents the mean of the features in the i-th row; represents the variance of the i-th row feature; is the original eigenvalue of the jth column and the ith row; The features of each row are standardized using the formula: ， in, is a constant that prevents the denominator from being zero; represents the normalized eigenvalue of the jth column and the ith row; Input the feature matrix processed by the BN preprocessing layer backward; L1-3: the first convolutional block; The first convolution block is used to extract low-level local spatial features from the input feature matrix and reduce the dimension of the features through pooling, thereby controlling the amount of calculation and preventing overfitting. L1-4: the second convolutional block; The second convolutional block is used to deepen the extraction of spatial features. It further extracts richer and deeper spatial features based on the first convolutional block, and enhances the capture of abstract patterns through more channels to construct a higher-level feature representation. L1-5: output reshaping layer; The task of the output reshaping layer is to reshape the output feature maps of the first convolution block and the second convolution block, adjust the number of channels to 32, and prepare for the subsequent one-dimensional convolution operation; L1-6: the third convolutional block; The task of the third convolutional block is to extract features from the converted sequence data through one-dimensional convolution, focusing on the temporal or serial correlation in the input data and analyzing it in the time dimension; L1-7: the fourth convolutional block; The task of the fourth convolutional block is to further extract high-level sequence features, by deepening the feature extraction of one-dimensional sequences to capture more complex and abstract temporal patterns and improve the model's understanding of temporal dependencies; L1-8: global average pooling layer; The task of the global average pooling layer is to perform global average pooling on the output of the convolution block, and take the average value of the feature map of each channel as the representative feature of the channel; L1-9: fully connected convolutional layers; The task of the fully connected convolutional layer is to further deeply mix and process the features on the basis of global average pooling, enhance the expressiveness of the features, and prepare for the final classification; L1-10: classification convolution layer; The task of the classification convolution layer is to extract the final classification features; L1-11: global average pooling 1D layer; The task of the global average pooling 1D layer is to perform global average pooling on the output of the classification convolutional layer to obtain the global feature representation of each channel; L1-12: Flatten layer; The task of the Flatten layer is to flatten the multi-dimensional features after global average pooling into a one-dimensional feature vector to prepare for subsequent input; L1-13: Normalized exponential function Softmax layer; The task of the Softmax layer is to apply the softmax function to the feature vector flattened by the Flatten layer to convert the features into probability distribution for the final classification decision.

6. The method according to claim 5, characterized in that In step 4, the convolutional neural network is trained by the following steps: Step 4-1, construct a training data set: collect raw traffic data from the Tor network, classify the raw traffic data by visited websites, and randomly divide it into training set, validation set and test set; Step 4-2, perform the training process: design the cross entropy loss function for classification error measurement, then set the convolution kernel size and learning rate, and finally perform model training; Step 4-3, perform mixed precision training, including: Step 4-3-1, during the training process, the forward propagation and calculation of the convolutional neural network are automatically converted to half-precision floating points. The half-precision processing process includes the processing of the convolution layer, pooling layer, and fully connected layer; the processing of gradient calculation and weight update is kept as single-precision floating points; Step 4-3-2, manage gradient scaling through initialization: During backpropagation, dynamically adjust the scaling factor to prevent gradient overflow; Step 4-3-3, use the adaptive moment estimation Adam optimizer and dynamically adjust the learning rate at the beginning of each epoch; the learning rate is adjusted in an exponential decay manner according to the current epoch number and the total epoch number; the adaptive moment estimation Adam optimizer dynamically adjusts the learning rate by calculating the first-order moment estimation and the second-order moment estimation of the gradient; Step 4-4, training monitoring: By regularly evaluating the performance of the convolutional neural network on the validation set during the training process, if the performance shows stable fluctuations for more than two consecutive epochs, that is, when the performance tends to be stable, it is judged that the convolutional neural network has converged, and the training is stopped at this time. The judgment process is expressed by the following formula: ， in is the performance index of the kth epoch, is the significance threshold of performance fluctuation, and M is the epoch number threshold without significant fluctuation.

7. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 6.

8. A storage medium, characterized in that: A computer program or instruction is stored, and when the computer program or instruction is run on a computer, the steps of the method according to any one of claims 1 to 6 are executed.

Images