Network stream watermark detection method and system based on abstract feature extraction

Abstract

The present invention relates to the field of network security technology, and more particularly to a network flow watermark detection method and system based on abstract feature extraction. A watermark generation and injection module is deployed on the border routers of an internal network to inject watermarks into all incoming traffic. A fast binary comparison and filtering module, an abstract feature extraction module, and a support vector machine algorithm are deployed on the core routers of the internal network. The fast binary comparison and filtering module performs preliminary screening on all traffic flowing through the core routers to quickly identify traffic that may contain watermarks. The abstract feature extraction module extracts multi-dimensional abstract features from the rapidly filtered traffic, and these features together form a multi-dimensional feature vector. The support vector machine algorithm performs a final classification of traffic based on the extracted multi-dimensional feature vector to determine whether a watermark exists in a particular session's traffic. The present invention improves detection efficiency and robustness to network interference, and has high detection precision and accuracy.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network stream watermark detection method and system based on abstract feature extraction. Background Art

[0002] In the rapidly evolving digital environment, cybersecurity has become a critical issue concerning national security, economic development, and social stability. With the continuous advancement of information technology, cyberattack methods have also evolved, becoming increasingly sophisticated, covert, and persistent. Of particular concern is the rise of advanced persistent threat (APT) attacks, which pose unprecedented challenges to traditional network defense technologies. APT attacks are characterized by high targeting, with attackers often conducting extensive intelligence gathering and attack preparation against specific targets over extended periods of time. These attacks can persist for months or even years, continuously probing and attempting to breach the target's defenses. Attackers use a variety of techniques to conceal their activities, making detection extremely difficult. Furthermore, APT attacks typically unfold in multiple stages, including initial intrusion, privilege escalation, lateral movement within the network, and ultimately data exfiltration. Traditional signature-based detection methods and simple behavioral analysis techniques have proven inadequate in the face of these emerging threats. This inadequacy has led to an urgent need for the development of more effective and innovative network defense technologies. Network watermarking technology, as a promising active defense method, plays a crucial role in attack tracking.

[0003] Existing network stream watermark detection methods are almost all designed for the Internet environment. The specific parameters of their watermark injection and detection algorithms are also optimized based on various standard test data sets. Such algorithms naturally show insufficient adaptability in complex internal network environments, which is mainly reflected in the following two aspects:

[0004] First, operational efficiency is low. The topology and device configuration of internal networks are highly diverse, differing not only significantly from the internet but also significantly from one internal network to another. This places high demands on the scalability of watermarking algorithms, significantly impacting the efficiency of watermark injection and detection. In particular, some watermarking algorithms require complex calculations and modulation of multiple fields within a data packet to ensure accurate watermarking results. However, in internal network environments, the significant computational overhead can impact network stability, leading to increased latency and decreased throughput. Therefore, considering the unique characteristics of internal networks, network flow watermarking algorithms based on packet marking can be used for watermark injection on incoming traffic. These methods achieve extremely high injection efficiency and robustness by modifying packet content. For watermark detection on incoming traffic, techniques such as binary comparison can be used. This allows the detection payload to be widely deployed across a wide variety of network devices, large and small, throughout the internal network, significantly improving watermark detection efficiency while ensuring coverage.

[0005] Second, detection accuracy is low. Network traffic in the internet environment is typically large-scale, diverse, and rapidly changing, while traffic in internal networks is relatively stable, with predictable trends. Therefore, although the large number of firewalls, switches, routers, IDS, IPS, and other devices distributed within internal networks may filter and adjust data packets, resulting in the destruction of watermark information modulated based on traffic characteristics, several watermark detection algorithms based on machine learning models have demonstrated relatively better detection accuracy. Summary of the Invention

[0006] The present invention aims to solve the problem that the existing network watermark detection methods are mainly developed for the Internet environment and optimized for standard test data sets, and have obvious adaptability problems when facing complex internal networks. A network watermark detection method and system based on abstract feature extraction are proposed. Through fast binary comparison filtering, multi-dimensional abstract feature extraction and support vector machine algorithm, the detection efficiency and robustness to network interference are improved, and the detection precision and accuracy are high in real-time high-speed internal network environment.

[0007] In order to achieve the above purpose, the technical solutions adopted are:

[0008] A network stream watermark detection method based on abstract feature extraction, comprising:

[0009] Deploy a watermark generation and injection module on the border router of the internal network to inject watermarks into all incoming traffic;

[0010] The watermarked traffic is transmitted through the internal network environment, and a fast binary comparison filtering module, an abstract feature extraction module, and a support vector machine algorithm are deployed on the core router of the internal network.

[0011] The fast binary comparison filter module performs preliminary screening on all traffic flowing through the core router and quickly identifies traffic that may contain watermarks;

[0012] The abstract feature extraction module extracts multi-dimensional abstract features from the rapidly filtered traffic, and these features together form a multi-dimensional feature vector;

[0013] The support vector machine algorithm finally classifies the traffic based on the extracted multi-dimensional feature vector to determine whether a watermark exists in the traffic of a certain session.

[0014] According to the network flow watermark detection method based on abstract feature extraction of the present invention, the watermark generation and injection module is further responsible for embedding an adaptive watermark in all incoming network traffic. The watermark adopts a binary sequence pattern and is defined as follows:

[0015] W=[w1,w2,...,w n ],w n ∈{0,1}

[0016] Where n is the number of binary watermark bits, and the sequence represents that it comes from a certain network border router.

[0017] According to the network stream watermark detection method based on abstract feature extraction of the present invention, the watermark injection success rate model is further defined as follows:

[0018] P inject =P0-αT

[0019] Among them, P inject is the injection success rate, P0 is the basic success rate, α is the traffic influencing factor, and T is the network traffic.

[0020] According to the network stream watermark detection method based on abstract feature extraction of the present invention, in order to simulate the real internal network environment, a network noise interference model is introduced, which is defined as follows:

[0021] N=N0+βT

[0022] Where N is the noise level, N0 is the basic noise level, β is the noise growth factor, and T is the network traffic.

[0023] According to the network stream watermark detection method based on abstract feature extraction of the present invention, further, the fast binary comparison and filtering module is implemented as follows:

[0024] The sliding window method is used to search for the primary watermark in the data packet. For the data packet S and the binary watermark W, the matching function is defined as follows:

[0025]

[0026] where 1(·) is the indicator function, Represents an exclusive OR operation; if M(S,W)>0, it is determined that a binary watermark code exists in the data packet.

[0027] According to the network stream watermark detection method based on abstract feature extraction of the present invention, further, the abstract feature extraction module is implemented as follows:

[0028] Four features were selected to reflect different aspects of network traffic:

[0029] (1) Average packet interval

[0030]

[0031] This feature reflects the time pattern of packet arrival, which may be affected by watermark injection. n is the length of the data stream, t i Indicates the time when the packet arrives;

[0032] (2) Flow variance

[0033]

[0034] This feature reflects the traffic fluctuation caused by the watermark, x i is the i-th data packet, is the average value of the data packets;

[0035] (3) Sudden

[0036]

[0037] This feature is used to detect burst factors in traffic, which may be the result of watermark injection; x is a data packet;

[0038] (4) Frequency domain peak ratio

[0039]

[0040] By frequency domain analysis, we can reveal the periodic patterns that the watermark may carry. represents Fourier transform;

[0041] The above four features are combined to form a multidimensional feature vector: F = [f1, f2, f3, f4].

[0042] According to the network stream watermark detection method based on abstract feature extraction of the present invention, the decision function of the support vector machine algorithm is further defined as follows:

[0043]

[0044] where α i is the Lagrange multiplier, y i is the training sample label, x i is the support vector, b is the bias term, x is the multidimensional eigenvector, and K(·) is the radial basis function kernel.

[0045] Furthermore, the present invention also proposes a network stream watermark detection system based on abstract feature extraction, which is used to implement the network stream watermark detection method based on abstract feature extraction as described above. The system includes a watermark generation and injection module, a fast binary comparison and filtering module, an abstract feature extraction module, and a support vector machine classification module, wherein:

[0046] The watermark generation and injection module is deployed on the border router of the internal network to inject watermarks into all incoming traffic;

[0047] The fast binary comparison filtering module is deployed on the core router of the internal network to perform preliminary screening of all traffic flowing through the core router and quickly identify traffic that may contain watermarks;

[0048] The abstract feature extraction module is deployed on the core router of the internal network and extracts multi-dimensional abstract features from the fast filtered traffic. These features together form a multi-dimensional feature vector.

[0049] The support vector machine classification module is deployed on the core router of the internal network. It performs the final classification of traffic based on the extracted multi-dimensional feature vectors to determine whether there is a watermark in a certain session traffic.

[0050] The beneficial effects achieved by adopting the above technical solution are:

[0051] This paper proposes a network stream watermark detection method based on abstract feature extraction. This method utilizes multi-stage watermark processing, a support vector machine algorithm, and fast binary comparison filtering. Testing in simulated network environments demonstrates that it achieves over 99.6% accuracy and near 100% precision under various network conditions, effectively reducing resource waste and unnecessary interference caused by false positives. Overall, this method boasts good injection efficiency and low hardware performance pressure; maintains high detection accuracy under varying traffic levels; and exhibits strong robustness in complex internal network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention. The drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0053] Figure 1 1 is a flow chart of a network stream watermark detection method based on abstract feature extraction according to an embodiment of the present invention;

[0054] Figure 2 This is a flow chart of fast binary comparison filtering according to an embodiment of the present invention;

[0055] Figure 3 is a flowchart of an abstract feature extraction according to an embodiment of the present invention;

[0056] Figure 4 is a support vector machine classification flow chart of an embodiment of the present invention;

[0057] Figure 5 is a simulation network topology diagram of an embodiment of the present invention;

[0058] Figure 6 This is the impact of the traffic rate on the detection accuracy and processing delay in the embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the accompanying drawings of specific embodiments of the present invention to clearly and completely describe the exemplary embodiments of the present invention. Unless otherwise defined, technical or scientific terms used in the present invention should be given the common meanings understood by people with ordinary skills in the relevant field.

[0060] This embodiment discloses a network stream watermark detection method based on abstract feature extraction, such as Figure 1 As shown, it includes the following steps:

[0061] Step S101: On the border router of the internal network, the watermark generation and injection module embeds the binary sequence watermark code into the traffic data packet; in this process, the number of injected data packets of the same session flow is adaptive, and the real-time strategy for selecting data packet watermark injection is adjusted according to the current network traffic situation to reduce the performance impact on the normal operation of network equipment.

[0062] Specifically, the watermark injection process is performed on all incoming traffic at the border router of the internal network. This not only ensures the coverage of the watermark, but also increases the security of the watermark itself and provides a larger time window for subsequent further detection. The watermark generation and injection module is responsible for embedding adaptive watermarks in all incoming traffic. It uses a simple and effective binary sequence pattern, which is defined as follows:

[0063] W=[w1,w2,...,wn ],w n ∈{0,1} (1)

[0064] Here, n is the number of binary watermark bits. Assume n = 16 and choose W = [1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0] as the base binary watermark. This sequence indicates it originates from a specific network edge router and is very convenient for injection into blank spaces in data packets. Unless the packet is sent back to the attack source, it is unlikely to be noticed by the attacker.

[0065] Taking into account the impact of actual network traffic rate on watermark injection, the injection success rate P inject As the traffic rate increases, it decreases. A dynamic injection success rate model is designed and defined as follows:

[0066] P inject =P0-αT (2)

[0067] Among them, P0 is the basic success rate, T is the network traffic, and α is the traffic influencing factor; this model reflects the watermark injection errors that may occur under high-rate traffic conditions.

[0068] To further simulate the complexity of the real internal network environment, a network noise interference model is introduced. The noise level N increases with the increase of traffic rate. The model is defined as follows:

[0069] N=N0+βT (3)

[0070] Among them, N0 is the basic noise level and β is the noise growth factor; this noise interference model helps to detect the robustness of the watermark detection system under interference conditions.

[0071] Step S102: The watermarked traffic is transmitted through the internal network environment, which may be through CDN, cloud platform, VPN tunnel, etc. At this stage, the traffic may be affected by various network conditions such as delay and packet loss.

[0072] Step S103: Deploy a fast binary comparison and filtering module on the core routers of the internal network to perform a preliminary screening of all traffic flowing through the core routers. Although this detection process has a certain false positive rate, it can efficiently identify session traffic that may carry watermarks and eliminate the vast majority of irrelevant traffic, significantly reducing the amount of data required for subsequent in-depth analysis and effectively lowering the method's computational overhead.

[0073] Specifically, the fast binary comparison filter module, typically deployed on core routers, serves as the first filter on the watermark detection side. This module's primary function is to quickly identify traffic that may contain watermarks, significantly reducing the amount of data requiring in-depth analysis. This is crucial for processing massive amounts of data in high-speed networks.

[0074] The sliding window method is used to search for the primary watermark in the data packet. For the data packet S and the binary watermark W, the matching function is defined as follows:

[0075]

[0076] where 1(·) is the indicator function, Represents an exclusive OR operation; if M(S,W)>0, it is determined that a binary watermark code exists in the data packet.

[0077] This method allows the detection of the presence of session watermarks in the presence of a small number of errors, which is very important for combating fluctuations and network errors that may occur during network transmission. At the same time, since this method only requires simple bit operations, it has very high computational efficiency and can be stably implemented in high-speed networks. The fast binary comparison filtering process is as follows: Figure 2 shown.

[0078] This quick filtering step can significantly reduce the amount of data required for subsequent extraction of abstract features for in-depth analysis, thereby improving the operational efficiency and scalability of the watermark detection payload. The output of this module will serve as the input to the next step of the abstract feature extraction module.

[0079] In step S104, the traffic initially screened by fast binary comparison is sent to the abstract feature extraction module, which extracts four predefined key features from the traffic: average packet interval, traffic variance, burstiness, and frequency domain peak ratio. These features together form a multidimensional feature vector that comprehensively captures the impact of the watermark on the multidimensional abstract characteristics of the traffic.

[0080] Specifically, the abstract feature extraction module, deployed on the core router, is responsible for extracting multi-dimensional abstract features from the rapidly filtered session flows. This step is crucial for accurately identifying watermarked traffic because it can capture the subtle effects of the injected watermark on network traffic.

[0081] Four main characteristics were chosen to reflect different aspects of network traffic:

[0082] (1) Average packet interval

[0083]

[0084] This feature reflects the time pattern of packet arrival, which may be affected by watermark injection. n is the length of the data stream, t i Indicates the time when the packet arrives.

[0085] (2) Flow variance

[0086]

[0087] This feature reflects the traffic fluctuation caused by the watermark, x i is the i-th data packet, is the average value of packets.

[0088] (3) Sudden

[0089]

[0090] This feature is used to detect burst factors in traffic, which may be the result of watermark injection. x is the data packet.

[0091] (4) Frequency domain peak ratio

[0092]

[0093] Frequency domain analysis can reveal the periodic patterns that the watermark may carry. represents the Fourier transform.

[0094] Abstract feature extraction process Figure 3 As shown, these features together form a multidimensional feature vector: F = [f1, f2, f3, f4]. This multidimensional feature extraction allows the presence of watermarks to be detected from multiple perspectives, improving detection accuracy. This allows for in-depth processing of quickly filtered suspicious session traffic without significantly impacting hardware performance. The extracted multidimensional feature vector is then fed into a support vector machine algorithm for final judgment.

[0095] Step S105: Perform a final judgment on the extracted multi-dimensional feature vector using a support vector machine algorithm to determine whether a watermark exists in the session traffic.

[0096] Specifically, the support vector machine algorithm is the core of the decision-making process to determine the existence of watermarks, and the traffic is finally classified based on the extracted multi-dimensional features. The radial basis function (RBF) kernel is used, which is defined as follows:

[0097] K(x i ,x j )=exp(-γ||x i -x j || 2 ) (9)

[0098] Among them, γ is the core function parameter that controls the curvature of the decision boundary, and the decision function of the support vector machine algorithm is defined as:

[0099]

[0100] Among them, α i is the Lagrange multiplier, y i is the training sample label, x i is the support vector, b is the bias term, and x is the multidimensional feature vector output in step S104.

[0101] The support vector machine classification process is as follows Figure 4 As shown in Figure 2, this module is also deployed on the core router and is tightly coupled with the abstract feature extraction module to improve the efficiency of watermark detection. The output of the support vector machine algorithm will determine whether to trigger an alarm.

[0102] Step S106: If the support vector machine algorithm determines that a session flow carries a watermark, the flow data is immediately copied and recorded, and an alarm is issued. This alarm contains detailed five-tuple information of the session flow, such as source IP, destination IP, and timestamp, providing valuable clues for subsequent security analysis.

[0103] Step S107: Regardless of whether the traffic is judged as an attack, all traffic entering the internal network should be continuously monitored. This continuous monitoring ensures that even if an attacker attempts to evade detection through a long-term low-intensity attack, it can still be detected in time.

[0104] Step S108: To maintain the effectiveness of the classifier, the support vector machine algorithm is regularly trained and updated using the latest watermarked and non-watermarked traffic samples of the internal network entrance. This adaptive approach ensures that the classifier can respond to changing network conditions and attack patterns.

[0105] Corresponding to the above method, this embodiment also proposes a network stream watermark detection system based on abstract feature extraction, which includes a watermark generation and injection module, a fast binary comparison and filtering module, an abstract feature extraction module, and a support vector machine classification module, wherein:

[0106] The watermark generation and injection module is deployed on the border router of the internal network to inject watermarks into all incoming traffic.

[0107] The fast binary comparison filtering module is deployed on the core router of the internal network to perform preliminary screening of all traffic flowing through the core router and quickly identify traffic that may contain watermarks.

[0108] The abstract feature extraction module is deployed on the core router of the internal network and extracts multi-dimensional abstract features from the fast filtered traffic. These features together constitute a multi-dimensional feature vector.

[0109] The support vector machine classification module is deployed on the core router of the internal network. It performs the final classification of traffic based on the extracted multi-dimensional feature vectors to determine whether there is a watermark in a certain session traffic.

[0110] To verify the effectiveness and superiority of this solution, the following is a further explanation based on experimental data:

[0111] (1) Simulation network topology

[0112] In order to fully evaluate the advantages and disadvantages of the method of the present invention, a test environment simulating a real internal network structure was designed. Its network topology includes the complete chain from attacker to victim, as well as various key components in the internal network. The simulated network topology is as follows: Figure 5 shown.

[0113] The attack source is the starting point of the entire topology, including the attack host that simulates the APT attack and the NAT device that hides the internal network structure, simulating the actual attack scenario more realistically.

[0114] The watermark injection end is deployed on the edge devices of the internal network, including firewalls, gateways, etc., to ensure full coverage of incoming traffic.

[0115] The traffic link is composed of multiple core routers, simulating the key infrastructure in the intranet, and combined with the content delivery network (CDN) to refer to the content acceleration services commonly used in large-scale network systems.

[0116] Multiple layers of security equipment are deployed in the internal network, including firewalls, honeypots, and intrusion detection / prevention systems (IDS / IPS). These devices simulate common network security measures and provide additional security protection for the watermark detection end.

[0117] A watermark detection terminal is deployed on the core router 2 which is closer to the victim's LAN to achieve full traffic detection.

[0118] The victim's LAN is the endpoint of the entire topology, including internal firewalls, switches, servers, and hosts. This is an abstraction of a typical enterprise department network architecture and serves as an ideal environment to evaluate the final effect of the watermarking method.

[0119] (2) Performance evaluation indicators

[0120] In order to comprehensively evaluate the performance level of the method of the present invention, the following standard indicators are formulated:

[0121] ①Accuracy:

[0122]

[0123] ②Accuracy:

[0124]

[0125] ③Recall rate:

[0126]

[0127] ④F1 score:

[0128]

[0129] The meanings of the test result data such as TP, FP, FN, and TN are shown in Table 1.

[0130] Table 1 Printing test result matrix

[0131]

[0132] In addition to these standard metrics, a processing delay model is proposed to consider the impact of network traffic on the performance of the watermark detection hardware device:

[0133] D=D0(1+λT 2 ) (15)

[0134] Where D is the actual processing delay, D0 is the basic delay, T is the network traffic, and λ is the delay growth factor. This model reflects the trend that the processing delay of the watermark detection device may increase nonlinearly as the network traffic increases.

[0135] These metrics allow for a comprehensive evaluation of the method's performance under different network conditions, including detection accuracy, efficiency, and scalability. This provides an important basis for optimizing prototype system parameters and evaluating the method's applicability in actual network environments.

[0136] (3) Performance analysis

[0137] Through the simulation network topology designed in (1), the APT attack scenario is simulated and simulation experiments are conducted using MATLAB to test the actual performance of the network flow watermark detection method based on abstract feature extraction under different network conditions. The main parameters of the network conditions of the simulation environment are as follows:

[0138] The simulation test used five different traffic rates: 2, 4, 6, 8, and 10 Gbps. In each simulation, 100,000 network session flows were generated, and 1% of these sessions were adaptively watermarked using the 16-bit binary sequence [1010101010101010]. A noise interference model was introduced throughout the network transmission process, with the noise level increasing with increasing traffic rate. The support vector machine algorithm used was a radial basis function (RBF) kernel. To verify the effectiveness of the method, 70% of the data was used for training and 30% for testing.

[0139] Table 2 Detection performance and processing delay at different traffic levels

[0140]

[0141]

[0142] The results of the simulation experiment based on the above parameter settings are shown in Table 2. The performance evaluation indicators are analyzed item by item:

[0143] ①Accuracy:

[0144] The method maintains extremely high accuracy (>99.6%) at all traffic levels. This demonstrates that the method is able to effectively distinguish between watermarked and unwatermarked traffic. The stability of the accuracy reflects the robustness of the method in the face of different network rates.

[0145] ②Accuracy:

[0146] The accuracy of all watermarks was extremely close to 100%, which means that the method produced almost no false positives. In other words, all traffic that the system identified as containing a watermark actually carried a watermark. The experimental results show that this method has a high reliability in watermark identification.

[0147] ③Recall rate:

[0148] The recall rate fluctuated between 65% and 72%. This indicates that the system can detect approximately two-thirds of watermarked traffic, but some watermarked traffic remains unrecognized. The fluctuation in recall rate may be related to the increase in noise caused by increased traffic. The relatively low recall rate may be an area for future improvement of this method.

[0149] ④F1 score:

[0150] The F1 score remained between 78% and 84%, indicating that the method achieved a good balance between precision and recall. This metric comprehensively reflects the overall performance of the system and shows that the system can maintain stable detection results under different traffic conditions.

[0151] (4) Impact of changes in the network environment

[0152] Figure 6 This figure shows the impact of increasing traffic rate on detection accuracy and processing latency, demonstrating the performance of the network watermark detector under network conditions ranging from 2 to 10 Gbps. The accuracy, represented by the blue line, is very high at all traffic levels, approaching 100%. This demonstrates that the method can effectively distinguish between watermarked and unwatermarked session traffic regardless of flow rate, demonstrating the robustness of the watermark algorithm.

[0153] In contrast, the processing delay represented by the red line shows a significant nonlinear growth as the traffic rate increases. At 2Gbps, the processing delay is minimal, approximately 0.6ms, and at 4Gbps, the processing delay increases slightly to approximately 2ms. However, at 6Gbps, the delay reaches around 11ms, showing a significant increase. A sharp increase is observed at 8Gbps, with the delay jumping to 37ms, and the largest increase is observed at 10Gbps, with the delay reaching 75ms. This clearly shows that the processing delay increases exponentially with the increase in communication traffic rate. Although a delay of 75ms at 10Gbps traffic is still acceptable for many network services, this growth trend means that performance bottlenecks may be encountered in higher-rate traffic environments.

[0154] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0155] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0156] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0157] Those skilled in the art will appreciate that all or part of the steps in the above method can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiment can be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.

[0158] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A network stream watermark detection method based on abstract feature extraction, characterized in that: Include: Deploy a watermark generation and injection module on the border router of the internal network to inject watermarks into all incoming traffic; The watermarked traffic is transmitted through the internal network environment, and a fast binary comparison filtering module, an abstract feature extraction module, and a support vector machine algorithm are deployed on the core router of the internal network. The fast binary comparison filter module performs preliminary screening on all traffic flowing through the core router and quickly identifies traffic that may contain watermarks; The abstract feature extraction module extracts multi-dimensional abstract features from the rapidly filtered traffic, and these features together form a multi-dimensional feature vector; The support vector machine algorithm finally classifies the traffic based on the extracted multi-dimensional feature vector to determine whether a watermark exists in the traffic of a certain session.

2. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The watermark generation and injection module is responsible for embedding adaptive watermarks in all incoming traffic. The watermark adopts a binary sequence pattern and is defined as follows: W=[w1,w2,...,w n ],In n ∈{0,1} Where n is the number of binary watermark bits, and the sequence represents that it comes from a certain network border router.

3. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The watermark injection success rate model is defined as follows: P inject =P0-αT Among them, P inject is the injection success rate, P0 is the basic success rate, α is the traffic influencing factor, and T is the network traffic.

4. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: In order to simulate the real internal network environment, a network noise interference model is introduced, which is defined as follows: N=N0+βT Where N is the noise level, N0 is the basic noise level, β is the noise growth factor, and T is the network traffic.

5. The network stream watermark detection method based on abstract feature extraction according to claim 2 is characterized in that: The implementation process of the fast binary comparison filter module is as follows: The sliding window method is used to search for the primary watermark in the data packet. For the data packet S and the binary watermark W, the matching function is defined as follows: where 1(·) is the indicator function, Represents an exclusive OR operation; if M(S,W)>0, it is determined that a binary watermark code exists in the data packet.

6. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The implementation process of the abstract feature extraction module is as follows: Four features were selected to reflect different aspects of network traffic: (1) Average packet interval This feature reflects the time pattern of packet arrival, which may be affected by watermark injection. n is the length of the data stream, t i Indicates the time when the packet arrives; (2) Flow variance This feature reflects the traffic fluctuation caused by the watermark, x i is the i-th data packet, is the average value of the data packets; (3) Sudden This feature is used to detect burst factors in traffic, which may be the result of watermark injection; x is a data packet; (4) Frequency domain peak ratio By frequency domain analysis, we can reveal the periodic patterns that the watermark may carry. represents Fourier transform; The above four features are combined to form a multidimensional feature vector: F = [f1, f2, f3, f4].

7. The network stream watermark detection method based on abstract feature extraction according to claim 1 is characterized in that: The decision function of the support vector machine algorithm is defined as follows: where α i is the Lagrange multiplier, y i is the training sample label, x i is the support vector, b is the bias term, x is the multidimensional eigenvector, and K(·) is the radial basis function kernel.

8. A network stream watermark detection system based on abstract feature extraction, characterized in that: The system is used to implement the network stream watermark detection method based on abstract feature extraction as described in any one of claims 1 to 7, comprising a watermark generation and injection module, a fast binary comparison and filtering module, an abstract feature extraction module, and a support vector machine classification module, wherein: The watermark generation and injection module is deployed on the border router of the internal network to inject watermarks into all incoming traffic; The fast binary comparison filtering module is deployed on the core router of the internal network to perform preliminary screening of all traffic flowing through the core router and quickly identify traffic that may contain watermarks; The abstract feature extraction module is deployed on the core router of the internal network and extracts multi-dimensional abstract features from the fast filtered traffic. These features together form a multi-dimensional feature vector. The support vector machine classification module is deployed on the core router of the internal network. It performs the final classification of traffic based on the extracted multi-dimensional feature vectors to determine whether there is a watermark in a certain session traffic.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory, wherein: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images