Network flow watermark detection method and system based on abstract feature extraction

Abstract

The invention relates to the technical field of network security, in particular to a network flow watermark detection method and system based on abstract feature extraction, and the method comprises the steps: deploying a watermark generation and injection module on a boundary router of an internal network, so as to carry out the watermark injection of all network access flows; a fast binary comparison filtering module, an abstract feature extraction module and a support vector machine algorithm are deployed on a core router of the internal network; the fast binary comparison filtering module is used for preliminarily screening all the flows flowing through the core router and quickly identifying the flows possibly containing watermarks; the abstract feature extraction module is used for extracting multi-dimensional abstract features from the rapidly filtered flow, and the features jointly form a multi-dimensional feature vector; and finally classifying the flow according to the extracted multi-dimensional feature vector by a support vector machine algorithm, and determining whether the watermark exists in the flow of a certain session. According to the method, the detection efficiency and the robustness to network interference are improved, and the method has relatively high detection precision and detection accuracy.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network stream watermark detection method and system based on abstract feature extraction. Background Art

[0002] In the rapidly developing digital environment, cybersecurity has become an important issue involving national security, economic development, and social stability. With the continuous advancement of information technology, the methods of cyber attacks have also developed, becoming more complex, covert, and persistent. Of particular concern is the rise of advanced persistent threat (APT) attacks, which pose unprecedented challenges to traditional network defense technologies. APT attacks are characterized by high targeting, and attackers often conduct extensive intelligence collection and attack preparation on specific targets over a long period of time. These attacks can last for months or even years, constantly probing and trying to break through the target's defenses. Attackers use a variety of technical means to hide their activities, making reconnaissance extremely difficult. In addition, APT attacks are usually carried out in multiple stages, including initial intrusion, privilege escalation, lateral movement within the network, and ultimately data leakage. In the face of these emerging threats, traditional feature-based detection methods and simple behavioral analysis techniques have proven to be insufficient. This insufficiency has prompted an urgent need to develop more effective and innovative network defense technologies. As a promising active defense method, network stream watermarking technology plays a vital role in attack tracking.

[0003] Existing network stream watermark detection methods are almost all designed for the Internet environment, and the specific parameters of their watermark injection and detection algorithms are also optimized based on various standard test data sets. Such algorithms naturally show insufficient adaptability in complex internal network environments, which is mainly reflected in the following two aspects:

[0004] First, the operation efficiency is low. The topology and equipment configuration of the internal network can be said to fully reflect the diversity. Not only are there huge differences with the Internet environment, but the differences between different internal networks are also very obvious. This places high demands on the scalability of the watermark algorithm, and will also greatly affect the injection and detection efficiency of the watermark. In particular, some watermark algorithms require complex calculations and modulations of multiple fields of the data packet to ensure the accuracy of the watermark results. However, in the internal network environment, a large amount of computing resource overhead may affect the stability of the network itself, leading to problems such as increased network latency and decreased throughput. Therefore, considering the particularity of the internal network, for the watermark injection of the incoming traffic, a network flow watermark algorithm based on packet marking technology can be used. This method achieves extremely high injection efficiency and strong robustness by modifying the content of the data packet; for the watermark detection of the incoming traffic, binary comparison and other technologies can be used to widely deploy the detection end load on different types of large and small network devices throughout the internal network, greatly improving the watermark detection efficiency while ensuring the coverage of the detection range.

[0005] Second, the detection accuracy is not high. Network traffic in the Internet environment is usually large in scale, diverse in variety, and fast in change, while the traffic in the internal network is relatively stable, and the change trend has a certain degree of predictability. Therefore, although the large number of firewalls, switches, routers, IDS, IPS and other devices distributed in the internal network may filter and adjust the data packets, resulting in the destruction of the watermark information modulated based on traffic characteristics, several watermark detection algorithms based on machine learning models have shown relatively better detection accuracy. Summary of the invention

[0006] The present invention aims to solve the problem that the existing network watermark detection methods are mainly developed for the Internet environment and optimized for standard test data sets, and there are obvious adaptability problems when facing internal complex networks. A network watermark detection method and system based on abstract feature extraction are proposed. Through fast binary comparison filtering, multi-dimensional abstract feature extraction and support vector machine algorithm, the detection efficiency and robustness to network interference are improved, and high detection precision and detection accuracy are achieved in real-time high-speed internal network environment.

[0007] To achieve the above purpose, the technical solution adopted is:

[0008] A network stream watermark detection method based on abstract feature extraction, comprising:

[0009] Deploy watermark generation and injection modules on the border routers of the internal network to inject watermarks into all incoming traffic;

[0010] The watermarked traffic is transmitted through the internal network environment, and the fast binary comparison filtering module, abstract feature extraction module and support vector machine algorithm are deployed on the core router of the internal network;

[0011] The fast binary comparison filter module performs preliminary screening of all traffic flowing through the core routers and quickly identifies traffic that may contain watermarks;

[0012] The abstract feature extraction module extracts multi-dimensional abstract features from the fast filtered traffic, and these features together form a multi-dimensional feature vector;

[0013] The support vector machine algorithm finally classifies the traffic based on the extracted multi-dimensional feature vectors to determine whether a watermark exists in a certain session traffic.

[0014] According to the network flow watermark detection method based on abstract feature extraction of the present invention, further, the watermark generation and injection module is responsible for embedding the adaptive watermark in all incoming network traffic. The watermark adopts a binary sequence mode and is defined as follows:

[0015] W=[w1,w2,...,w n ],w n ∈{0,1}

[0016] Where n is the number of binary watermark bits, and the sequence represents that it comes from a certain network border router.

[0017] According to the network stream watermark detection method based on abstract feature extraction of the present invention, further, the watermark injection success rate model is defined as follows:

[0018] P inject =P0-αT

[0019] Among them, P inject is the injection success rate, P0 is the basic success rate, α is the traffic influencing factor, and T is the network traffic.

[0020] According to the network stream watermark detection method based on abstract feature extraction of the present invention, further, in order to simulate the real internal network environment, a network noise interference model is introduced, and the model is defined as follows:

[0021] N=N0+βT

[0022] Where N is the noise level, N0 is the basic noise level, β is the noise growth factor, and T is the network traffic.

[0023] According to the network stream watermark detection method based on abstract feature extraction of the present invention, further, the fast binary comparison filtering module is implemented as follows:

[0024] The sliding window method is used to search for the primary watermark in the data packet. For the data packet S and the binary watermark W, the matching function is defined as follows:

[0025]

[0026] where 1(·) is the indicator function, Represents an XOR operation; if M(S,W)>0, it is determined that there is a binary watermark code in the data packet.

[0027] According to the network stream watermark detection method based on abstract feature extraction of the present invention, further, the abstract feature extraction module implementation process is:

[0028] Four features were selected to reflect different aspects of network traffic:

[0029] (1) Average packet interval

[0030]

[0031] This feature reflects the time pattern of packet arrival, which may be affected by watermark injection. n is the length of the data stream, t i Indicates the time point when the packet arrives;

[0032] (2) Flow variance

[0033]

[0034] This feature reflects the traffic fluctuation caused by the watermark, x i is the ith data packet, is the average value of the data packets;

[0035] (3) Sudden

[0036]

[0037] This feature is used to detect burst factors in traffic, which may be the result of watermark injection; x is a data packet;

[0038] (4) Frequency domain peak ratio

[0039]

[0040] The frequency domain analysis reveals the periodic patterns that the watermark may carry. represents Fourier transform;

[0041] The above four features are combined to form a multi-dimensional feature vector: F = [f1, f2, f3, f4].

[0042] According to the network stream watermark detection method based on abstract feature extraction of the present invention, the decision function of the support vector machine algorithm is further defined as follows:

[0043]

[0044] where α i is the Lagrange multiplier, y i is the training sample label, x i is the support vector, b is the bias term, x is the multidimensional feature vector, and K(·) is the radial basis function kernel.

[0045] Furthermore, the present invention also proposes a network stream watermark detection system based on abstract feature extraction, which is used to implement the network stream watermark detection method based on abstract feature extraction as mentioned above. The system comprises a watermark generation and injection module, a fast binary comparison and filtering module, an abstract feature extraction module and a support vector machine classification module, wherein:

[0046] The watermark generation and injection module is deployed on the border router of the internal network to inject watermarks into all incoming traffic;

[0047] The fast binary comparison filtering module is deployed on the core router of the internal network to perform preliminary screening of all traffic flowing through the core router and quickly identify traffic that may contain watermarks;

[0048] The abstract feature extraction module is deployed on the core router of the internal network to extract multi-dimensional abstract features from the fast filtered traffic. These features together constitute a multi-dimensional feature vector.

[0049] The support vector machine classification module is deployed on the core router of the internal network. It performs the final classification of traffic according to the extracted multi-dimensional feature vectors to determine whether there is a watermark in a certain session traffic.

[0050] The beneficial effects achieved by adopting the above technical solution are:

[0051] The present invention proposes a network flow watermark detection method based on abstract feature extraction. The method adopts watermark multi-level processing, support vector machine algorithm and fast binary comparison filtering. It has been proved by simulation network environment test that it can achieve an accuracy rate of more than 99.6% and a precision rate close to 100% under different network conditions, which can effectively reduce the waste of resources and unnecessary interference caused by false alarms. In general, the method has good injection efficiency and low pressure on hardware performance; it can maintain high detection accuracy under different traffic levels; and it has strong robustness in internal complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention, wherein the drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0053] Figure 1 It is a flowchart of a network stream watermark detection method based on abstract feature extraction according to an embodiment of the present invention;

[0054] Figure 2 is a fast binary comparison filtering flow chart of an embodiment of the present invention;

[0055] Figure 3 is an abstract feature extraction flow chart of an embodiment of the present invention;

[0056] Figure 4 is a support vector machine classification flow chart of an embodiment of the present invention;

[0057] Figure 5 is a simulation network topology diagram of an embodiment of the present invention;

[0058] Figure 6 This is the impact of the flow rate of the embodiment of the present invention on the detection accuracy and processing delay. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings of specific embodiments of the present invention to clearly and completely describe the exemplary scheme of the embodiment of the present invention. Unless otherwise defined, the technical terms or scientific terms used in the present invention should be the common meanings understood by people with ordinary skills in the field.

[0060] This embodiment discloses a network stream watermark detection method based on abstract feature extraction, such as Figure 1 As shown, it includes the following steps:

[0061] Step S101, on the border router of the internal network, the watermark generation and injection module embeds the binary sequence watermark code into the traffic data packet; in this process, the number of injected data packets of the same session flow is adaptive, and the real-time strategy for selecting data packet watermark injection is adjusted according to the current network traffic situation to reduce the performance impact on the normal operation of network equipment.

[0062] Specifically, the watermark injection process is performed on all incoming traffic on the border router of the internal network, which not only ensures the coverage of the watermark, but also increases the security of the watermark itself, and provides a larger time window for subsequent further detection. The watermark generation and injection module is responsible for embedding adaptive watermarks in all incoming traffic, using a simple and effective binary sequence mode, defined as follows:

[0063] W=[w1,w2,...,wn ],w n ∈{0,1} (1)

[0064] Where n is the number of binary watermark bits. Assume that n = 16 and select W = [1,0,1,0,1,0,1,0,1,0,1,0,1,0] as the binary basic watermark. This sequence represents that it comes from a certain network border router and is very convenient to inject into the blank space of the data packet. Unless the data packet is sent back to the source of the attack, it is not easy to be noticed by the attacker.

[0065] Considering the impact of actual network traffic rate on watermark injection, the injection success rate P inject As the traffic rate increases, it decreases. A dynamic injection success rate model is designed and the model is defined as follows:

[0066] P inject =P0-αT (2)

[0067] Among them, P0 is the basic success rate, T is the network traffic, and α is the traffic influencing factor; this model reflects the watermark injection errors that may occur under high-rate traffic conditions.

[0068] In order to further simulate the complexity of the real internal network environment, a network noise interference model is introduced. The noise level N increases with the increase of traffic rate. The model is defined as follows:

[0069] N=N0+βT (3)

[0070] Where N0 is the basic noise level and β is the noise growth factor. This noise interference model helps to detect the robustness of the watermark detection system under interference conditions.

[0071] Step S102: The watermarked traffic is transmitted through the internal network environment, which may be through CDN, cloud platform, VPN tunnel and other services. At this stage, the traffic may be affected by various network conditions such as delay and packet loss.

[0072] Step S103: deploy a fast binary comparison filter module on the core router of the internal network to perform preliminary screening on all traffic flowing through the core router. Although there is a certain false alarm rate in this detection process, it can efficiently identify session traffic that may carry watermarks and exclude most irrelevant traffic, greatly reducing the amount of data that needs to be analyzed in depth later, and effectively reducing the computational overhead of the method.

[0073] Specifically, the fast binary comparison filter module is generally deployed on the core router and is the first filter on the watermark detection end. The main function of this module is to quickly identify traffic that may contain watermarks, thereby greatly reducing the amount of data that needs to be analyzed in depth. This is crucial for processing massive amounts of data in high-speed networks.

[0074] The sliding window method is used to search for the primary watermark in the data packet. For the data packet S and the binary watermark W, the matching function is defined as follows:

[0075]

[0076] where 1(·) is the indicator function, Represents an XOR operation; if M(S,W)>0, it is determined that there is a binary watermark code in the data packet.

[0077] This method allows the detection of the presence of session watermarks in the presence of a small number of errors, which is very important for combating fluctuations and network errors that may occur during network transmission. At the same time, since this method only requires simple bit operations, it has very high computational efficiency and can be stably implemented in high-speed networks. The fast binary comparison filtering process is as follows Figure 2 shown.

[0078] Through this fast filtering step, the amount of data that needs to be extracted for in-depth analysis can be significantly reduced, thereby improving the operating efficiency and scalability of the watermark detection payload. The output of this module will serve as the input of the next step of the abstract feature extraction module.

[0079] Step S104: The traffic preliminarily screened by fast binary comparison will be sent to the abstract feature extraction module, which extracts four predefined key features from the traffic: average packet interval, traffic variance, burstiness, and frequency domain peak ratio. These features together constitute a multi-dimensional feature vector, which fully captures the impact of watermarks on the multi-dimensional abstract features of traffic.

[0080] Specifically, the abstract feature extraction module is responsible for extracting multi-dimensional abstract features from the fast filtered session flows, and the module is deployed on the core router. This step is crucial for accurately identifying the traffic carrying watermarks, because it can capture the subtle effects of the injected watermarks on network traffic.

[0081] Four main features were chosen to reflect different aspects of network traffic:

[0082] (1) Average packet interval

[0083]

[0084] This feature reflects the time pattern of packet arrival, which may be affected by watermark injection. n is the length of the data stream, t i Indicates the time when the packet arrives.

[0085] (2) Flow variance

[0086]

[0087] This feature reflects the traffic fluctuation caused by the watermark, x i is the ith data packet, is the average value of packets.

[0088] (3) Sudden

[0089]

[0090] This feature is used to detect burst factors in traffic, which may be the result of watermark injection. x is the data packet.

[0091] (4) Frequency domain peak ratio

[0092]

[0093] Frequency domain analysis can reveal the periodic patterns that the watermark may carry. represents Fourier transform.

[0094] Abstract feature extraction process Figure 3 As shown in the figure, these features together form a multi-dimensional feature vector: F = [f1, f2, f3, f4]. Through this multi-dimensional feature extraction, the existence of watermarks can be captured from multiple angles, improving the accuracy of detection. In this way, the suspicious session traffic that has been quickly filtered can be deeply processed without affecting the performance of the hardware device itself as much as possible, and then the extracted multi-dimensional feature vector is input into the support vector machine algorithm for final judgment.

[0095] Step S105: Perform a final judgment on the extracted multi-dimensional feature vector using a support vector machine algorithm to determine whether a watermark exists in the session traffic.

[0096] Specifically, the support vector machine algorithm is the decision core for determining the existence of watermarks, and the traffic is finally classified according to the extracted multi-dimensional features. The radial basis function (RBF) kernel is used, which is defined as follows:

[0097] K(x i ,x j )=exp(-γ||x i -x j || 2 ) (9)

[0098] Among them, γ is the core function parameter that controls the curvature of the decision boundary, and the decision function of the support vector machine algorithm is defined as:

[0099]

[0100] Among them, α i is the Lagrange multiplier, y i is the training sample label, x i is the support vector, b is the bias term, and x is the multidimensional feature vector output in step S104.

[0101] The support vector machine classification process is as follows Figure 4 As shown in Figure 2, this module is also deployed on the core router and is tightly coupled with the abstract feature extraction module to improve the efficiency of watermark detection. The output of the support vector machine algorithm will determine whether to trigger an alarm.

[0102] Step S106: If the support vector machine algorithm determines that a session flow carries a watermark, the flow data is immediately copied and recorded and an alarm is issued. This alarm contains detailed five-tuple information of the session flow, such as source IP, target IP, timestamp, etc., providing valuable clues for subsequent security analysis.

[0103] Step S107: Regardless of whether the traffic is judged as an attack, all traffic entering the internal network should be continuously monitored. This continuous monitoring ensures that even if an attacker attempts to evade detection through a long-term low-intensity attack, it can still be detected in time.

[0104] Step S108: In order to maintain the effectiveness of the classifier, the latest watermark and non-watermark traffic samples of the internal network entrance are used to regularly train and update the support vector machine algorithm. This adaptive method ensures that the classifier can respond to changing network conditions and attack patterns.

[0105] Corresponding to the above method, this embodiment also proposes a network stream watermark detection system based on abstract feature extraction, which includes a watermark generation and injection module, a fast binary comparison and filtering module, an abstract feature extraction module and a support vector machine classification module, wherein:

[0106] The watermark generation and injection module is deployed on the border router of the internal network to inject watermarks into all incoming traffic.

[0107] The fast binary comparison filtering module is deployed on the core router of the internal network to perform preliminary screening of all traffic flowing through the core router and quickly identify traffic that may contain watermarks.

[0108] The abstract feature extraction module, deployed on the core router of the internal network, extracts multi-dimensional abstract features from the fast filtered traffic, which together constitute a multi-dimensional feature vector.

[0109] The support vector machine classification module is deployed on the core router of the internal network. It performs the final classification of traffic according to the extracted multi-dimensional feature vectors to determine whether there is a watermark in a certain session traffic.

[0110] In order to verify the effectiveness and superiority of this solution, the following is a further explanation based on experimental data:

[0111] (1) Simulation network topology

[0112] In order to comprehensively evaluate the advantages and disadvantages of the method of the present invention, a test environment simulating a real internal network structure is designed. Its network topology contains the complete chain from the attacker to the victim, as well as various key components in the internal network. The simulated network topology is as follows: Figure 5 shown.

[0113] The attack source is the starting point of the entire topology, including the attack host that simulates the APT attack and the NAT device that hides the internal network structure, simulating the actual attack scenario more realistically.

[0114] The watermark injection end is deployed on the edge devices of the internal network, including firewalls, gateways, etc., to ensure full coverage of incoming traffic.

[0115] The traffic link is composed of multiple core routers, simulating the key infrastructure in the intranet, combined with the content distribution network (CDN) to refer to the content acceleration services commonly found in large-scale network systems.

[0116] Multiple layers of security devices are deployed in the internal network, including firewalls, honeypots, and intrusion detection / prevention systems (IDS / IPS). These devices simulate common network security protection measures and provide additional security protection for the watermark detection end.

[0117] A watermark detection terminal is deployed on the core router 2 which is closer to the victim's LAN to achieve full traffic detection.

[0118] The victim's LAN is the endpoint of the entire topology, including internal firewalls, switches, servers, and hosts. This is an abstraction of a typical enterprise department network architecture and serves as an ideal environment to evaluate the final effect of the watermarking method.

[0119] (2) Performance evaluation indicators

[0120] In order to comprehensively evaluate the performance level of the method of the present invention, the following standard indicators are formulated:

[0121] ①Accuracy:

[0122]

[0123] ②Accuracy:

[0124]

[0125] ③Recall rate:

[0126]

[0127] ④F1 score:

[0128]

[0129] The meanings of the test result data such as TP, FP, FN, and TN are shown in Table 1.

[0130] Table 1 Printing test result matrix

[0131]

[0132] In addition to these standard metrics, a processing delay model is proposed to consider the impact of network traffic on the performance of the watermark detection hardware device:

[0133] D=D0(1+λT 2 ) (15)

[0134] Where D is the actual processing delay, D0 is the basic delay, T is the network traffic, and λ is the delay growth factor. This model reflects the trend that the processing delay of the watermark detection device may increase nonlinearly as the network traffic increases.

[0135] Through these metrics, the performance of the method under different network conditions can be comprehensively evaluated, including detection accuracy, efficiency, and scalability. This provides an important basis for optimizing prototype system parameters and evaluating the applicability of the method in actual network environments.

[0136] (3) Performance analysis

[0137] Through the simulated network topology designed in (1), the APT attack scenario is simulated, and simulation experiments are carried out using MATLAB to test the actual performance of the network flow watermark detection method based on abstract feature extraction under different network conditions. The main parameters of the network conditions of the simulation environment are as follows:

[0138] The simulation test process uses 5 different traffic rates: 2, 4, 6, 8 and 10Gbps. In each simulation, 100,000 network session flows are generated, and 1% of the sessions are injected with adaptive watermarks based on a 16-bit binary sequence [1010101010101010]. A noise interference model is introduced throughout the network transmission process, and the noise level increases with the increase of traffic rate. The support vector machine algorithm used is the radial basis function (RBF) kernel. In order to verify the specific effect of the method, 70% of the data is used for training and 30% for testing.

[0139] Table 2 Detection performance and processing delay at different traffic levels

[0140]

[0141]

[0142] The results of the simulation experiment based on the above parameter settings are shown in Table 2. The performance evaluation indicators are analyzed item by item:

[0143] ①Accuracy:

[0144] The method maintains extremely high accuracy (>99.6%) at all traffic levels. This shows that the method can effectively distinguish between watermarked and non-watermarked traffic. The stability of accuracy reflects the robustness of the method in the face of different network rates.

[0145] ②Accuracy:

[0146] The accuracy of all watermarks is extremely close to 100%, which means that the method produces almost no false positives. In other words, all traffic that is judged by the system to contain watermarks does carry watermarks. The experimental results show that the method has high reliability in watermark identification.

[0147] ③Recall rate:

[0148] The recall rate fluctuates between 65%-72%. This indicates that the system can detect about 2 / 3 of the watermarked traffic, but some watermarked traffic is still not recognized. The fluctuation of the recall rate may be related to the increase in noise caused by the increase in traffic. The relatively low recall rate may be an area for future improvement of the method.

[0149] ④F1 score:

[0150] The F1 score remains between 78% and 84%, indicating that the method has achieved a good balance between precision and recall. This metric comprehensively reflects the overall performance of the system, indicating that the system can maintain stable detection effects under different traffic conditions.

[0151] (4) Impact of changes in the network environment

[0152] Figure 6 The effect of increasing traffic rate on detection accuracy and processing delay is shown, reflecting the performance of the network flow watermark detection end under network conditions varying from 2 to 10Gbps. The accuracy represented by the blue line is very high at all traffic levels, close to 100%, which shows that this method can well distinguish between watermarked and non-watermarked session traffic regardless of the flow rate, reflecting the robustness of the watermark algorithm.

[0153] In contrast, the processing delay represented by the red line shows a significant nonlinear growth as the traffic rate increases. At 2Gbps, the processing delay is minimal, approximately 0.6ms, and at 4Gbps, the processing delay increases slightly to approximately 2ms. However, at 6Gbps, the delay reaches around 11ms, showing a significant increase. A sharp increase is observed at 8Gbps, with the delay jumping to 37ms, and the largest increase is observed at 10Gbps, with the delay reaching 75ms. This clearly shows that the processing delay increases exponentially as the communication traffic rate increases. Although a delay of 75ms is still acceptable for many network services at 10Gbps traffic, this growth trend means that performance bottlenecks may be encountered in higher-rate traffic environments.

[0154] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0155] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0156] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0157] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0158] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A network stream watermark detection method based on abstract feature extraction, characterized in that: Include: Deploy a watermark generation and injection module on the border router of the internal network to inject watermarks into all incoming traffic; The watermarked traffic is transmitted through the internal network environment, and the fast binary comparison filtering module, abstract feature extraction module and support vector machine algorithm are deployed on the core router of the internal network; The fast binary comparison filter module performs preliminary screening of all traffic flowing through the core routers and quickly identifies traffic that may contain watermarks; The abstract feature extraction module extracts multi-dimensional abstract features from the fast filtered traffic, and these features together form a multi-dimensional feature vector; The support vector machine algorithm finally classifies the traffic based on the extracted multi-dimensional feature vectors to determine whether a watermark exists in a certain session traffic.

2. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The watermark generation and injection module is responsible for embedding adaptive watermarks in all incoming traffic. The watermark adopts a binary sequence mode and is defined as follows: In=[in1,in2,...,in n ],In n ∈{0,1} Where n is the number of binary watermark bits, and the sequence represents that it comes from a certain network border router.

3. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The watermark injection success rate model is defined as follows: P inject =P0-αT Among them, P inject is the injection success rate, P0 is the basic success rate, α is the traffic influencing factor, and T is the network traffic.

4. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: In order to simulate the real internal network environment, a network noise interference model is introduced, which is defined as follows: N=N0+βT Where N is the noise level, N0 is the basic noise level, β is the noise growth factor, and T is the network traffic.

5. The network stream watermark detection method based on abstract feature extraction according to claim 2 is characterized in that: The implementation process of the fast binary comparison filter module is as follows: The sliding window method is used to search for the primary watermark in the data packet. For the data packet S and the binary watermark W, the matching function is defined as follows: where 1(·) is the indicator function, Represents an XOR operation; if M(S,W)>0, it is determined that there is a binary watermark code in the data packet.

6. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The implementation process of the abstract feature extraction module is as follows: Four features were selected to reflect different aspects of network traffic: (1) Average packet interval This feature reflects the time pattern of packet arrival, which may be affected by watermark injection. n is the length of the data stream, t i Indicates the time point when the packet arrives; (2) Flow variance This feature reflects the traffic fluctuation caused by the watermark, x i is the ith data packet, is the average value of the data packets; (3) Sudden This feature is used to detect burst factors in traffic, which may be the result of watermark injection; x is a data packet; (4) Frequency domain peak ratio The frequency domain analysis reveals the periodic patterns that the watermark may carry. represents Fourier transform; The above four features are combined to form a multi-dimensional feature vector: F = [f1, f2, f3, f4].

7. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The decision function of the support vector machine algorithm is defined as follows: where α i is the Lagrange multiplier, y i is the training sample label, x i is the support vector, b is the bias term, x is the multidimensional feature vector, and K(·) is the radial basis function kernel.

8. A network stream watermark detection system based on abstract feature extraction, characterized in that: The system is used to implement the network stream watermark detection method based on abstract feature extraction as described in any one of claims 1 to 7, comprising a watermark generation and injection module, a fast binary comparison and filtering module, an abstract feature extraction module and a support vector machine classification module, wherein: The watermark generation and injection module is deployed on the border router of the internal network to inject watermarks into all incoming traffic; The fast binary comparison filtering module is deployed on the core router of the internal network to perform preliminary screening of all traffic flowing through the core router and quickly identify traffic that may contain watermarks; The abstract feature extraction module is deployed on the core router of the internal network to extract multi-dimensional abstract features from the fast filtered traffic. These features together constitute a multi-dimensional feature vector. The support vector machine classification module is deployed on the core router of the internal network. It performs the final classification of traffic according to the extracted multi-dimensional feature vectors to determine whether there is a watermark in a certain session traffic.

9. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images