Single-classification neural network model generation method, flow correlation method, anti-correlation analysis method and device

Abstract

The invention discloses a single-classification neural network model generation method, a traffic association method and an anti-association analysis method and device, and belongs to the field of network security, and the single-classification neural network model generation method comprises the steps: S1, constructing a communication data set containing multiple types of anonymous communication traffic; s2, arranging the communication data set into non-associated traffic and associated traffic; s3, constructing a structured non-associated data set according to the non-associated traffic information; s4, selecting a single-classification neural network model for a traffic association problem; and S5, training a single-classification neural network model based on the non-associated data set. According to the invention, the technical problem that the existing flow association model and algorithm are not universal when the flow association task is executed for different anonymous communication networks is solved; meanwhile, the invention provides a novel and universal technical scheme for resisting correlation analysis of the anonymous communication network.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more specifically, to a single-classification neural network model generation method, a traffic correlation method, an anti-correlation analysis method and a device. Background Art

[0002] Anonymous network traffic correlation is an important research direction in the field of network security. It refers to the analysis and correlation of traffic data generated in an anonymous network environment to identify and track the source and destination of data flows in the network. This process involves breaking or bypassing the anonymity of traffic to achieve tracking and auditing of network behavior. Anonymous network traffic correlation technology has application value in scenarios such as network attack tracing, malicious behavior tracking, and cybercrime forensics.

[0003] Existing anonymous network traffic association methods can be divided into statistics-based methods and model-based methods. They all need to abstract each data flow into a sequence of primitive features that describe the shape of the flow (e.g., sequence of packet size, time, direction, traffic bursts). Statistics-based methods use correlation coefficients or statistical distances to measure the similarity of inbound and outbound flow sequences. Flow pairs with the highest similarity are considered to be related. Model-based methods apply machine learning or deep learning models to associate data flows, directly putting inbound and outbound flow sequences together and inputting them into the model, and then training the model based on binary labels of "related" or "unrelated". A well-trained correlation model will output the correlation probability of the input flow pairs, and similarly, the flow pairs with the highest probability are considered to be related.

[0004] Since the anonymous communication related technologies were proposed, a large number of anonymous communication systems have been produced, including Tor, I2P, Freenet, NetCamo, Tarzan, etc. Among them, Tor, I2P, and Freenet account for about 90% of the entire market share. Since the official version of Tor was released in 2003, relying on the core technology "onion routing", it has become the most widely used and user-friendly low-latency anonymous communication system. Due to the highest utilization rate of the Tor network, traffic correlation technology has been basically based on the Tor network as a research object for a long time, making the attack model rigid and the input features limited. At present, the most advanced traffic correlation methods are generally only effective for Tor network traffic, such as Raptor by Sun et al., DeepCorr by Nasr et al., DeepCoFFEA by Oh et al., and sliding subset and traffic correlation methods by Lopes et al. At the same time, there are also a small number of traffic correlation methods for other specific categories of anonymous communication networks. In practice, the premise of using these methods is to first identify the category of the anonymous communication network used by the communication traffic to be associated, and then apply the corresponding traffic association method to perform the association action. This adds a traffic identification link to the traffic association task, thereby increasing the monitoring time requirement and making it more difficult to capture the network whereabouts of criminals. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a single-classification neural network model generation method, a traffic correlation method, an anti-correlation analysis method and a device to solve the technical problem that the existing traffic correlation model and algorithm cannot be universal when performing traffic correlation tasks for different anonymous communication networks. At the same time, a novel and universal anonymous communication network anti-correlation analysis technical solution is provided.

[0006] The object of the present invention is achieved through the following solutions:

[0007] A method for generating a single-classification neural network model comprises the following steps:

[0008] S1, construct a communication data set containing multiple types of anonymous communication traffic, which is used to jointly build non-correlated white noise based on the characteristics of multiple types of anonymous communication traffic. Non-correlated white noise is the common basic characteristics between traffic that has no communication relationship with each other in various anonymous communication networks;

[0009] S2, organizes the communication data set into non-associated traffic and associated traffic;

[0010] S3, constructing a structured non-correlated data set from the non-correlated traffic information;

[0011] S4, selects a single-class neural network model for traffic association problems;

[0012] S5, training a single-classification neural network model based on the non-correlated data set.

[0013] Furthermore, in step S1, the construction of a communication data set containing multiple types of anonymous communication traffic specifically includes the following sub-steps:

[0014] Establishing a pair of communication sources and communication targets that use different types of anonymous communication networks for communication, where a communication source communicates with a communication target only through one anonymous communication network;

[0015] Then, multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks are constructed. Sending-end monitoring and receiving-end monitoring facilities are respectively set up between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, so as to realize the monitoring and collection of the communication source traffic and the communication target traffic, and collect all the collected communication pair traffic to form a communication data set.

[0016] Furthermore, in step S2, the communication data set is sorted into non-associated traffic and associated traffic, specifically including sub-steps:

[0017] In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic;

[0018] Then, the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is non-associated traffic; wherein, when constructing the non-communication group, the communication source traffic in the communication group is paired with all communication target traffic except the communication target that communicates with the communication source to form a non-communication group.

[0019] Furthermore, in step S3, the step of constructing a structured non-correlated data set from the non-correlated traffic information specifically includes the following sub-steps:

[0020] Non-correlated traffic information is extracted from non-correlated traffic to be used as input information for executing traffic correlation operations, and the extracted traffic information is organized in a structured manner while retaining the original non-correlated pairings to form a structured non-correlated data set.

[0021] Furthermore, in step S4, a single-classification neural network model is selected for the traffic association problem, which specifically includes the following sub-steps:

[0022] The non-correlated white noise is used as the target class, and the goal is to identify non-target classes different from the non-correlated white noise, that is, traffic pairs with a correlation relationship.

[0023] Further, in step S5, a single-classification neural network model is trained based on the non-correlated data set, specifically including the sub-steps of:

[0024] The input data is prepared by extracting non-correlated traffic information sequences from structured non-correlated data sets as input data for the model;

[0025] The model calculation output outputs the input data through a single-classification neural network operation as reconstructed data or discriminated values;

[0026] The loss function is used to measure the logical fit between input data and output data. The corresponding loss function is selected for different neural network types.

[0027] Parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

[0028] A traffic correlation method based on a single-classification neural network model, comprising:

[0029] Step 1), collecting the traffic data of both parties to be associated: collecting the traffic of the communication source and the communication target to be analyzed for traffic association through monitoring facilities;

[0030] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the single-classification neural network;

[0031] Step 3), using the single-classification neural network model as described in any of the above items to calculate and obtain output data: input the constructed traffic information sequence of the communication source and the communication target into the trained single-classification neural network model, and obtain output data through calculation of the model, and the output data represents the reconstruction or discrimination result of the model on the input data;

[0032] Step 4), using the input and output data to calculate the loss value based on the loss function: based on the loss function, the loss value between the input data and the model output data is calculated; the loss function is consistent with the loss function used in the training stage of the single-classification neural network; by calculating the loss function, the loss value is obtained;

[0033] Step 5) Identify the correlation by determining whether the loss value is greater than the judgment threshold: compare the calculated loss value with the preset judgment threshold; if the loss value is greater than the threshold, it means that the deviation of the intended associated traffic from the non-associated white noise is large, and it is determined to be "associated"; if the loss value is less than the threshold, it means that the deviation of the intended associated traffic from the non-associated white noise is small, and it is determined to be "unassociated".

[0034] An anti-correlation analysis method based on a single-classification neural network model, comprising:

[0035] Step 1), collecting traffic data of both communicating parties: in a specific anonymous communication network, collecting traffic data of a communication source and a communication target that are known to have a communication relationship; monitoring the sending / receiving traffic of the communication source and the receiving / sending traffic of the communication target respectively through the monitoring facilities at the sending end and the receiving end;

[0036] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the single-classification neural network;

[0037] Step 3), using a single-classification neural network model to calculate and obtain output data: input the constructed traffic information sequence of the communication source and the communication target into the trained single-classification neural network model as described in any of the above items, and obtain output data through calculation of the model, and the output data represents the reconstruction or discrimination result of the model on the input data;

[0038] Step 4), using the input and output data to calculate the loss value based on the loss function: based on the loss function, the loss value between the input data and the model output data is calculated; the loss function should be consistent with the loss function used in the training stage of the single-classification neural network; by calculating the loss function, the loss value is obtained;

[0039] Step 5), using the loss value to mark the anti-correlation capability of the anonymous communication network: using the loss value as an anti-correlation index; the smaller the loss value compared to the reference value, the smaller the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the better the anti-correlation capability; the larger the loss value compared to the reference value, the greater the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the weaker the anti-correlation capability.

[0040] A single-classification neural network model generation device includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, any of the methods described above is executed.

[0041] A traffic association device based on a single-classification neural network model comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method described above is executed.

[0042] An anti-correlation analysis device based on a single-classification neural network model comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method described above is executed.

[0043] The beneficial effects of the present invention include:

[0044] The present invention solves the technical problem that the existing traffic association models and algorithms cannot be universal when performing traffic association tasks for different anonymous communication networks, and provides a traffic association method based on non-correlated white noise and a single-classification neural network model, and also provides a novel and universal anonymous communication network anti-correlation analysis technical solution. The "non-correlated white noise" in the method of the present invention refers to the common basic characteristics between traffic that has no communication relationship with each other in various anonymous communication networks. The present invention co-constructs non-correlated white noise based on the characteristics of multiple types of anonymous communication traffic, calculates the characteristic distance between the intended associated communication traffic and the non-correlated white noise, and uses threshold comparison and reverse judgment to identify the correlation, thereby obtaining a universal traffic association method with cross-anonymous network categories; extracts non-correlated white noise from non-correlated traffic by training a single-classification neural network, realizes the high-dimensional and automatic extraction of non-correlated common features, improves the accuracy of non-correlated white noise extraction, and also ensures the operability of the method. Furthermore, the size of the characteristic distance between the associated traffic with known communication relationships and the unassociated white noise in a specific anonymous communication network can characterize the strength of the anti-correlation ability of the anonymous communication network, becoming a novel, cross-network universal anonymous communication network anti-correlation analysis technology. This method helps to maintain the technical advantages of network monitoring and prevent and combat cybercrime. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0046] Figure 1 Generate training steps for single-class neural network models;

[0047] Figure 2 Collect samples for various types of anonymous communication traffic;

[0048] Figure 3 A method for obtaining non-associated traffic;

[0049] Figure 4 It is a general framework for single-class neural network models;

[0050] Figure 5 Train a single-class neural network model to calculate the loss function;

[0051] Figure 6 It is a flow chart of traffic association based on single-classification neural network model;

[0052] Figure 7 To obtain the association result by comparing the loss value with the judgment threshold;

[0053] Figure 8 This is a flowchart of anti-correlation evaluation based on a single-class neural network model;

[0054] Fig. 9 The loss value is used to indicate the quality of anti-correlation. DETAILED DESCRIPTION

[0055] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0056] The specific implementation process of the present invention is as follows:

[0057] The technical solution of the present invention includes three aspects: generation and training technology of a single-classification neural network model, traffic correlation technology based on a single-classification neural network model, and anti-correlation evaluation technology based on a single-classification neural network model, which are described in detail as follows:

[0058] 1. Generative training technology for single-class neural network models:

[0059] The generation and training steps of a single-class neural network model are as follows: Figure 1 As shown. It includes the following steps in sequence:

[0060] 1) Construct a communication dataset containing various types of anonymous communication traffic

[0061] Specifically, the present invention co-builds non-correlated white noise based on the characteristics of multiple types of anonymous communication traffic, so it is necessary to construct a communication data set containing multiple types of anonymous communication traffic. To construct a communication data set, it is first necessary to build a communication source and a communication target pair that use different types of anonymous communication networks for communication. A communication source only communicates with one communication target through one anonymous communication network. Construct multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks. Between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, set up the sending end monitoring and receiving end monitoring facilities respectively to realize the monitoring and collection of the communication source traffic and the communication target traffic. Collect all the collected communication pair traffic to form a communication data set.

[0062] Figure 2 Demonstrates various types of anonymous communication traffic collection examples. Figure 2 In the figure, various anonymous communication networks including but not limited to Tor, I2P, and Freenet are shown. Each anonymous communication network has several communication sources and communication targets. The communication source using Tor communication is represented by t 1 to n , the communication target is denoted as T 1 To T n The communication source using I2P communication is denoted as i 1 to i n , the communication target is represented as I 1 to I n The communication source using Freenet communication is denoted as f 1 to f n , the communication target is represented by F 1 To F n These communication sources and communication targets communicate one-to-one through their respective anonymous communication networks. For example, the communication source t 1 Communicate with target T through Tor network 1 To communicate, the communication source i 1 Communicate with target I through I2P network 1 To communicate, the communication source f 1 Communication target F through Freenet network 1 to communicate.

[0063] In each communication pair, a sending-end monitoring facility and a receiving-end monitoring facility are respectively set between the communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target. These monitoring facilities are used to collect the traffic of the communication source and the traffic of the communication target. Specifically, the sending-end monitoring facility monitors the sending / receiving traffic of the communication source, while the receiving-end monitoring facility monitors the receiving / transmitting traffic of the communication target. Through these monitoring facilities, comprehensive communication data can be collected to construct a communication data set containing multiple types of anonymous communication traffic.

[0064] The construction process of this communication dataset ensures that the traffic characteristics of each anonymous communication network are accurately captured, thus providing a solid data foundation for the subsequent generation of uncorrelated white noise.

[0065] 2) Organize the communication data set into non-correlated traffic and related traffic

[0066] In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic; then the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is the non-associated traffic. When constructing a non-communication group, the communication source traffic in the communication group is paired with all the communication target traffic except the communication target that communicates with the communication source, forming a non-communication group.

[0067] Figure 3 The method of dividing non-communication groups to obtain non-correlated traffic is shown. Each communication group (such as t 1 -T 1 ,t 2 -T 2 , ...) are matched with their corresponding communication target flows to form associated flows. When constructing a non-communication group, for example, the communication source t 1 The traffic will be transmitted to all other communication targets T 2 ...T n ,I 1 ...I n 、F 1 ...F n The traffic of each node is paired separately to form non-correlated traffic. All non-correlated traffic is constructed in this way. This method can generate a large amount of non-correlated traffic, providing a rich data source across anonymous network types for the construction of non-correlated white noise.

[0068] 3) Constructing a structured non-correlated dataset from non-correlated traffic information

[0069] Extract non-correlated traffic information from non-correlated traffic to construct a structured non-correlated data set. The extracted traffic information is the input information for performing traffic correlation operations, including but not limited to packet size sequence, packet timestamp sequence, packet direction sequence, etc. The extracted traffic information is organized in a structured manner while retaining the original non-correlated pairing to form a structured non-correlated data set.

[0070] Table 1 shows an example of a structured non-correlated dataset. In the table, C1 represents traffic feature 1 (e.g., packet size), C2 represents traffic feature 2 (e.g., packet timestamp), u identifies traffic as uplink, and d identifies traffic as downlink. Each row in the table represents a non-correlated pairing, e.g., communication source t 1 and communication target T 2 Constitute a non-associated pairing. Correspondingly, the communication source t 1 The flow information sequence is recorded as [C1 t1 u ; C1 t1 d ; C2 t1 u ; C2 t1 d ], communication target T 2 The flow information sequence is recorded as [C1 T2 u ; C1 T2 d ; C2 T2 u ; C2 T2 d ]. Each traffic information sequence contains the packet size and timestamp information for both the uplink and downlink directions. By structuring these traffic information, the non-correlated datasets can be easily used for training and testing subsequent single-classification neural network models.

[0071] Table 1: Examples of structured non-associative datasets

[0072]

[0073] 4) Selecting a single-class neural network model for traffic association problems

[0074] The single classification problem is a special type of classification problem, in which the training data mainly comes from one category (called the "target class" or "positive class"), and the goal is to identify abnormal data that is different from this category (called the "non-target class" or "negative class"). In the present invention, non-correlated white noise is used as the target class, and the goal is to identify non-target classes that are different from non-correlated white noise, that is, traffic pairs with an associated relationship. The present invention uses a single classification neural network to solve the single classification problem.

[0075] Select a suitable single-class neural network model, including but not limited to autoencoders, variational autoencoders, deep support vector data descriptions, generative adversarial networks, etc. Figure 4 The general framework of the single-class neural network model shown in the figure abstracts the common elements and processes of general single-class neural networks, including input layer, feature extractor, latent space, reconstruction / discrimination module, and output layer. Each module can be concretized according to specific model selection and requirements to build a single-class neural network model suitable for specific applications.

[0076] For example, for ordinary autoencoders, the feature extractor is the encoder network (convolutional layer, fully connected layer, etc.); the latent space is the encoded representation; the reconstruction module is the decoder network (deconvolutional layer, fully connected layer, etc.); the output layer is the reconstructed data. For deep support vector data description, the feature extractor is the feature extraction network; the latent space is the feature representation; the discriminant module is to calculate the distance from the center point; and the output layer is the anomaly score.

[0077] 5) Training a single-class neural network model based on a non-correlated dataset

[0078] Based on the structured non-correlated data set that has been constructed, the selected single-class neural network model is trained. The training process is generally divided into the following steps: input data preparation, model calculation output, loss function calculation, and parameter adjustment. The relationship between the steps is as follows: Figure 5 As shown. The input data is prepared by extracting a non-correlated traffic information sequence from a structured non-correlated data set as the input data of the model; the model calculation output outputs the input data through a single-classification neural network operation as reconstructed data or a discriminated value; the loss function L(x,y) is used to measure the logical fit between the input data and the output data, and the corresponding loss function is selected for different neural network types; the parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

[0079] For example, if the autoencoder is selected as a single-class neural network, the loss function L is used to measure the difference between the input data and the reconstructed data. The mean square error can be used as the loss function, and the calculation formula is:

[0080]

[0081] Among them, x is the input traffic information sequence, y is the reconstructed traffic information sequence, and n is the length of the sequence.

[0082] When adjusting the parameters of the neural network through the back-propagation algorithm to minimize the loss function, the network weights can be updated using stochastic gradient descent (SGD) or other optimization algorithms, such as the Adam optimizer. During the training process, the training data set is used for multiple iterations. In each iteration, a batch of non-correlated traffic pairs is input into the model, the loss is calculated, and the parameters are updated. The above process is repeated until the model converges, that is, the loss function no longer decreases significantly.

[0083] 2. Traffic correlation technology based on single-classification neural network model:

[0084] The traffic association process based on the single-class neural network model is as follows: Figure 6 As shown. It includes the following steps in sequence:

[0085] 1) Collect the traffic data of the two parties to be associated. The traffic of the communication source and the communication target to be analyzed for traffic association is collected through the monitoring facilities. The sending end monitoring facility is responsible for monitoring the sending / receiving traffic of the communication source, and the receiving end monitoring facility is responsible for monitoring the receiving / sending traffic of the communication target, ensuring that the traffic data of the two parties to the communication is fully and accurately captured.

[0086] 2) Construct the communication source flow information sequence and the communication target flow information sequence

[0087] The collected traffic data of the communication source and the communication target are organized into a traffic information sequence. The traffic information sequence should be consistent with the content and format of the traffic information sequence in the structured non-associative data set used in the training phase of the single-classification neural network.

[0088] For example, if the traffic information sequence of the communication source in the structured non-associative dataset is recorded as [C1 tn u ; C1 tn d ; C2 tn u ; C2 tn d ], the traffic information sequence of the communication target is recorded as [C1 TN u ; C1 TN d ; C2 TN u ; C2 TN d ], C1 represents traffic feature 1 (e.g., packet size), C2 represents traffic feature 2 (e.g., packet timestamp), u indicates that the traffic is uplink, and d indicates that the traffic is downlink. In this step, the collected traffic data of the communication source and communication target should also be organized into the same content and format as the above traffic information sequence.

[0089] 3) Use the single-classification neural network model to calculate the output data

[0090] The constructed traffic information sequence of the communication source and communication target is input into the trained single-classification neural network model, and the output data is obtained through the calculation of the model. The output data represents the reconstruction or discrimination result of the model on the input data.

[0091] For example, the trained single-class neural network is an autoencoder, then the traffic information sequence to be associated [C1 tn u ; C1 tn d ; C2 tn u ; C2 tn d ] and [C1 TN u ; C1 TN d ; C2 TN u ; C2 TN d ] Input the autoencoder model to obtain the reconstructed traffic information sequence [C1^ tn u ; C1^ tn d ; C2^ tn u ; C2^ tn d ] and [C1^ TN u ; C1^ TN d ; C2^ TN u ; C2^ TN d ].

[0092] 4) Calculate the loss value based on the loss function using input and output data

[0093] The loss value between the input data and the model output data is calculated based on the loss function. The loss function should be consistent with the loss function used in the training phase of the single-class neural network. By calculating the loss function, the loss value is obtained.

[0094] For example, if mean square error is selected as the loss function during the training phase, then the formula for calculating the loss value in this step is: ,in

[0095]

[0096] 5) Identify the correlation by determining whether the loss value is greater than the judgment threshold

[0097] The calculated loss value is compared with the preset judgment threshold. If the loss value is greater than the threshold, it means that the deviation of the proposed associated traffic from the non-associated white noise is large, so it is judged as "associated"; if the loss value is less than the threshold, it means that the deviation of the proposed associated traffic from the non-associated white noise is small, so it is judged as "unassociated". In this way, the single-classification neural network model is used to identify the traffic correlation between the communication source and the communication target. Figure 7 It shows that the association results are obtained by comparing the loss value with the decision threshold.

[0098] For example, if the calculated loss value between the input and the output is 0.5 and the preset threshold is 0.1, since 0.5 is greater than 0.1, the proposed associated traffic is determined to be associated.

[0099] 3. Anti-correlation evaluation technology based on single-classification neural network model:

[0100] The anti-correlation evaluation process based on the single-class neural network model is as follows: Figure 8 As shown. It includes the following steps in sequence:

[0101] 1) Collect traffic data of both parties in communication

[0102] In a specific anonymous communication network, the traffic data of the communication source and the communication target with known communication relationship is collected. Through the sending and receiving end monitoring facilities, the sending / receiving traffic of the communication source and the receiving / receiving traffic of the communication target are monitored respectively.

[0103] For example, collect traffic data of known communication pairs t1 and T1 in the Tor network, and record the size, timestamp, and direction information of their sent / received data packets.

[0104] 2) Construct the communication source flow information sequence and the communication target flow information sequence

[0105] The collected traffic data of the communication source and the communication target are organized into a traffic information sequence. The traffic information sequence should be consistent with the content and format of the traffic information sequence in the structured non-associative data set used in the training phase of the single-classification neural network.

[0106] For example, if the traffic information sequence of the communication source in the structured non-associative dataset is recorded as [C1 tn u ; C1 tn d ; C2 tn u ; C2 tn d ], the traffic information sequence of the communication target is recorded as [C1 TN u ; C1TN d ; C2 TN u ; C2 TN d ], C1 represents traffic feature 1 (such as packet size), C2 represents traffic feature 2 (such as packet timestamp), u indicates that the traffic is uplink, and d indicates that the traffic is downlink. In this step, the collected traffic data of the communication source and communication target should be sorted into [C1 t1 u ; C1 t1 d ; C2 t1 u ; C2 t1 d ] and [C1 T1 u ; C1 T1 d ; C2 T1 u ; C2 T1 d ].

[0107] 3) Use the single-classification neural network model to calculate the output data

[0108] The constructed traffic information sequence of the communication source and communication target is input into the trained single-classification neural network model, and the output data is obtained through the calculation of the model. The output data represents the reconstruction or discrimination result of the model on the input data.

[0109] For example, if the trained single-class neural network is an autoencoder, then the traffic information sequence [C1 t1 u ; C1 t1 d ; C2 t1 u ; C2 t1 d ] and [C1 T1 u ; C1 T1 d ; C2 T1 u ; C2 T1 d ] Input the autoencoder model to obtain the reconstructed traffic information sequence [C1^ t1 u ; C1^ t1 d ; C2^ t1 u ; C2^ t1 d ] and [C1^T1 u ; C1^ T1 d ; C2^ T1 u ; C2^ T1 d ].

[0110] 4) Calculate the loss value based on the loss function using input and output data

[0111] The loss value between the input data and the model output data is calculated based on the loss function. The loss function should be consistent with the loss function used in the training phase of the single-class neural network. By calculating the loss function, the loss value is obtained.

[0112] For example, if mean square error is selected as the loss function during the training phase, then the formula for calculating the loss value in this step is: ,in ,

[0113]

[0114] 5) Using loss value to mark the anti-correlation ability of anonymous communication network

[0115] The loss value is used as an anti-correlation indicator. The smaller the loss value, the smaller the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the better the anti-correlation ability; the larger the loss value, the greater the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the weaker the anti-correlation ability. In this way, the anti-correlation of a specific anonymous communication network can be evaluated. Because different anonymous communication networks are compared with the same non-correlated white noise, this technology provides a universal anti-correlation evaluation scheme across network categories. Fig. 9 The advantages and disadvantages of using loss value to mark anti-correlation are demonstrated.

[0116] For example, if t1 and T1 use the Tor network to communicate with a loss value of 0.03, and another pair of communication t2 and T2 use the I2P network to communicate with a loss value of 0.07, then the traffic characteristics of t1 and T1 are closer to non-correlated white noise, indicating that the Tor network has a stronger anti-correlation ability.

[0117] It should be noted that within the scope of protection defined in the claims of the present invention, the following embodiments can be combined and / or expanded or replaced in any logical way from the above specific implementation methods, such as disclosed technical principles, disclosed technical features or implicitly disclosed technical features.

[0118] Example 1

[0119] A method for generating a single-classification neural network model comprises the following steps:

[0120] S1, construct a communication data set containing multiple types of anonymous communication traffic, which is used to jointly build non-correlated white noise based on the characteristics of multiple types of anonymous communication traffic. Non-correlated white noise is the common basic characteristics between traffic that has no communication relationship with each other in various anonymous communication networks;

[0121] S2, organizes the communication data set into non-associated traffic and associated traffic;

[0122] S3, constructing a structured non-correlated data set from the non-correlated traffic information;

[0123] S4, selects a single-class neural network model for traffic association problems;

[0124] S5, training a single-classification neural network model based on the non-correlated data set.

[0125] Example 2

[0126] On the basis of Example 1, in step S1, the construction of a communication data set containing multiple types of anonymous communication traffic specifically includes the following sub-steps:

[0127] Establishing a pair of communication sources and communication targets that use different types of anonymous communication networks for communication, where a communication source communicates with a communication target only through one anonymous communication network;

[0128] Then, multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks are constructed. Sending-end monitoring and receiving-end monitoring facilities are respectively set up between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, so as to realize the monitoring and collection of the communication source traffic and the communication target traffic, and collect all the collected communication pair traffic to form a communication data set.

[0129] Example 3

[0130] On the basis of Embodiment 1, in step S2, the communication data set is sorted into non-associated traffic and associated traffic, specifically including sub-steps:

[0131] In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic;

[0132] Then, the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is non-associated traffic; wherein, when constructing the non-communication group, the communication source traffic in the communication group is paired with all communication target traffic except the communication target that communicates with the communication source to form a non-communication group.

[0133] Example 4

[0134] On the basis of Example 1, in step S3, the step of constructing a structured non-correlated data set from the non-correlated traffic information specifically includes the following sub-steps:

[0135] Non-correlated traffic information is extracted from non-correlated traffic to be used as input information for executing traffic correlation operations, and the extracted traffic information is organized in a structured manner while retaining the original non-correlated pairings to form a structured non-correlated data set.

[0136] Example 5

[0137] On the basis of Example 1, in step S4, a single-classification neural network model is selected for the traffic association problem, which specifically includes the following sub-steps:

[0138] The non-correlated white noise is used as the target class, and the goal is to identify non-target classes different from the non-correlated white noise, that is, traffic pairs with a correlation relationship.

[0139] Example 6

[0140] On the basis of Example 1, in step S5, a single-classification neural network model is trained based on the non-correlated data set, specifically including the sub-steps of:

[0141] The input data is prepared by extracting non-correlated traffic information sequences from structured non-correlated data sets as input data for the model;

[0142] The model calculation output outputs the input data through a single-classification neural network operation as reconstructed data or discriminated values;

[0143] The loss function is used to measure the logical fit between input data and output data. The corresponding loss function is selected for different neural network types.

[0144] Parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

[0145] Example 7

[0146] A traffic correlation method based on a single-classification neural network model, comprising:

[0147] Step 1), collecting the traffic data of both parties to be associated: collecting the traffic of the communication source and the communication target to be analyzed for traffic association through monitoring facilities;

[0148] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the single-classification neural network;

[0149] Step 3), using any one of the single-classification neural network models described in Example 1 to Example 6 to calculate output data: input the constructed traffic information sequence of the communication source and the communication target into the trained single-classification neural network model, and obtain output data through calculation of the model, the output data represents the reconstruction or discrimination result of the model on the input data;

[0150] Step 4), using the input and output data to calculate the loss value based on the loss function: based on the loss function, the loss value between the input data and the model output data is calculated; the loss function is consistent with the loss function used in the training stage of the single-classification neural network; by calculating the loss function, the loss value is obtained;

[0151] Step 5) Identify the correlation by determining whether the loss value is greater than the judgment threshold: compare the calculated loss value with the preset judgment threshold; if the loss value is greater than the threshold, it means that the deviation of the intended associated traffic from the non-associated white noise is large, and it is determined to be "associated"; if the loss value is less than the threshold, it means that the deviation of the intended associated traffic from the non-associated white noise is small, and it is determined to be "unassociated".

[0152] Example 8

[0153] An anti-correlation analysis method based on a single-classification neural network model, comprising:

[0154] Step 1), collecting traffic data of both communicating parties: in a specific anonymous communication network, collecting traffic data of a communication source and a communication target that are known to have a communication relationship; monitoring the sending / receiving traffic of the communication source and the receiving / sending traffic of the communication target respectively through the monitoring facilities at the sending end and the receiving end;

[0155] Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the single-classification neural network;

[0156] Step 3), using a single-classification neural network model to calculate and obtain output data: input the constructed traffic information sequence of the communication source and the communication target into the trained single-classification neural network model of any one of Embodiments 1 to 6, and obtain output data through calculation of the model, the output data represents the reconstruction or discrimination result of the model on the input data;

[0157] Step 4), using the input and output data to calculate the loss value based on the loss function: based on the loss function, the loss value between the input data and the model output data is calculated; the loss function should be consistent with the loss function used in the training stage of the single-classification neural network; by calculating the loss function, the loss value is obtained;

[0158] Step 5), using the loss value to mark the anti-correlation capability of the anonymous communication network: using the loss value as an anti-correlation index; the smaller the loss value compared to the reference value, the smaller the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the better the anti-correlation capability; the larger the loss value compared to the reference value, the greater the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the weaker the anti-correlation capability.

[0159] Example 9

[0160] A single-classification neural network model generation device includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, a method as described in any one of Examples 1 to 6 is executed.

[0161] Example 10

[0162] A traffic association device based on a single-classification neural network model includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method described in Example 7 is executed.

[0163] Embodiment 11

[0164] An anti-correlation analysis device based on a single-classification neural network model includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method described in Example 8 is executed.

[0165] The units involved in the embodiments of the present invention may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, limit the units themselves.

[0166] According to one aspect of an embodiment of the present invention, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in the above various optional implementations.

[0167] As another aspect, an embodiment of the present invention further provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

Claims

1. A method for generating a single-classification neural network model, characterized in that: The following steps are involved: S1, construct a communication data set containing multiple types of anonymous communication traffic, which is used to jointly build non-correlated white noise based on the characteristics of multiple types of anonymous communication traffic. Non-correlated white noise is the common basic characteristics between traffic that has no communication relationship with each other in various anonymous communication networks; S2, organizes the communication data set into non-associated traffic and associated traffic; S3, constructing a structured non-correlated data set from the non-correlated traffic information; S4, selects a single-class neural network model for traffic association problems; S5, training a single-class neural network model based on the non-correlated data set.

2. The single-classification neural network model generation method according to claim 1, characterized in that: In step S1, the construction of a communication data set containing multiple types of anonymous communication traffic specifically includes the following sub-steps: Establishing a pair of communication sources and communication targets that use different types of anonymous communication networks for communication, where a communication source communicates with a communication target only through one anonymous communication network; Then, multiple pairs of communication sources and communication targets that communicate with each other using different types of anonymous communication networks are constructed. Sending-end monitoring and receiving-end monitoring facilities are respectively set up between any communication source and the entrance relay node of the anonymous communication network it uses, and between the exit relay node of the anonymous communication network it uses and the corresponding communication target, so as to realize the monitoring and collection of the communication source traffic and the communication target traffic, and collect all the collected communication pair traffic to form a communication data set.

3. The single-classification neural network model generation method according to claim 1, characterized in that: In step S2, the communication data set is sorted into non-associated traffic and associated traffic, specifically including sub-steps: In the communication data set, the communication source and communication target traffic pairs that communicate with each other are first grouped together to form a communication group, and the communication group traffic is the associated traffic; Then, the communication source and communication target traffic pairs that do not communicate with each other are grouped together to form a non-communication group, and the non-communication group traffic is non-associated traffic; wherein, when constructing the non-communication group, the communication source traffic in the communication group is paired with all communication target traffic except the communication target that communicates with the communication source to form a non-communication group.

4. The single-classification neural network model generation method according to claim 1, characterized in that: In step S3, the step of constructing a structured non-correlated data set from the non-correlated traffic information specifically includes the following sub-steps: Non-correlated traffic information is extracted from non-correlated traffic to be used as input information for executing traffic correlation operations, and the extracted traffic information is organized in a structured manner while retaining the original non-correlated pairings to form a structured non-correlated data set.

5. The single-classification neural network model generation method according to claim 1, characterized in that: In step S4, a single-classification neural network model is selected for the traffic association problem, which specifically includes the following sub-steps: The non-correlated white noise is used as the target class, and the goal is to identify non-target classes different from the non-correlated white noise, that is, traffic pairs with a correlation relationship.

6. The single-classification neural network model generation method according to claim 1, characterized in that: In step S5, a single-classification neural network model is trained based on the non-correlated data set, specifically including the following sub-steps: The input data is prepared by extracting non-correlated traffic information sequences from structured non-correlated data sets as input data for the model; The model calculation output outputs the input data through a single-classification neural network operation as reconstructed data or discriminated values; The loss function is used to measure the logical fit between input data and output data. The corresponding loss function is selected for different neural network types. Parameter adjustment is to adjust the parameters of the neural network through the back propagation algorithm, and minimize the loss function through the optimization algorithm.

7. A traffic correlation method based on a single-classification neural network model, characterized in that: include: Step 1), collecting the traffic data of both parties to be associated: collecting the traffic of the communication source and the communication target to be analyzed for traffic association through monitoring facilities; Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the single-classification neural network; Step 3), using the single-classification neural network model described in any one of claims 1 to 6 to calculate and obtain output data: input the constructed traffic information sequence of the communication source and the communication target into the trained single-classification neural network model, and obtain output data through calculation of the model, the output data represents the reconstruction or discrimination result of the model on the input data; Step 4), using the input and output data to calculate the loss value based on the loss function: calculating the loss value between the input data and the model output data based on the loss function; The loss function is consistent with the loss function used in the training phase of the single-class neural network; By calculating the loss function, the loss value is obtained; Step 5) Identify the correlation by determining whether the loss value is greater than the determination threshold: compare the calculated loss value with the preset determination threshold; if the loss value is greater than the threshold, it means that the deviation of the proposed associated traffic from the non-associated white noise is large, and it is determined to be "associated"; if the loss value is less than the threshold, it means that the deviation of the proposed associated traffic from the non-associated white noise is small, and it is determined to be "unassociated". 8.An anti-correlation analysis method based on a single-classification neural network model, characterized in that: include: Step 1), collecting traffic data of both communicating parties: in a specific anonymous communication network, collecting traffic data of a communication source and a communication target that are known to have a communication relationship; monitoring the sending / receiving traffic of the communication source and the receiving / sending traffic of the communication target respectively through the monitoring facilities at the sending end and the receiving end; Step 2), constructing a communication source flow information sequence and a communication target flow information sequence: arranging the collected flow data of the communication source and the communication target into a flow information sequence; the flow information sequence is consistent with the content and format of the flow information sequence in the structured non-correlated data set used in the training phase of the single-classification neural network; Step 3), using a single-classification neural network model to calculate and obtain output data: input the constructed traffic information sequence of the communication source and the communication target into the trained single-classification neural network model of any one of claims 1 to 6, and obtain output data through calculation of the model, the output data represents the reconstruction or discrimination result of the model on the input data; Step 4), using the input and output data to calculate the loss value based on the loss function: calculating the loss value between the input data and the model output data based on the loss function; The loss function should be consistent with the loss function used in the training phase of the single-class neural network; By calculating the loss function, the loss value is obtained; Step 5), using the loss value to mark the anti-correlation capability of the anonymous communication network: using the loss value as an anti-correlation index; the smaller the loss value compared to the reference value, the smaller the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the better the anti-correlation capability; the larger the loss value compared to the reference value, the greater the difference between the traffic characteristics of the anonymous communication network and the non-correlated white noise, and the weaker the anti-correlation capability.

9. A single-classification neural network model generation device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method according to any one of claims 1 to 6 is executed.

10. A flow correlation device based on a single-classification neural network model, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method according to claim 7 is executed.

11. An anti-correlation analysis device based on a single-classification neural network model, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method according to claim 8 is executed.

Images