A concept drift-resistant encrypted traffic identification method

Abstract

The present invention discloses a method for identifying encrypted traffic that is resistant to concept drift, and relates to the field of traffic identification. The present invention constructs an indicator system for environmental disturbance factors affecting concept drift. Focusing on common factors such as the operating system, network environment, and timeliness, the present invention analyzes the distribution of encrypted traffic packets in different environments. Based on the concept of "drift perception and incremental correction," the present invention utilizes a confusion-aware adversarial concept drift detection method (CACD) to detect concept drift in encrypted traffic behavior identification, and addresses the drift problem through an encrypted traffic behavior identification method updated through incremental learning. This method can continuously adapt to new concepts throughout the entire identification lifecycle, demonstrating high adaptability.

Description

Technical Field

[0001] The present invention relates to the field of traffic identification, and in particular to an encrypted traffic identification method resistant to concept drift. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and may not constitute prior art.

[0003] While network encrypted traffic ensures secure information transmission, it has also become a common method for criminals to evade cybersecurity scrutiny, further fueling various cybercriminal activities that could potentially impact social stability. Advances in encryption technology have made it difficult for many traditional monitoring and censorship methods to directly decrypt and analyze encrypted traffic. In this scenario, illegal activities can be concealed within legitimate encrypted communications, exploiting encryption to steal data, transmit attack commands, and spread malware, posing a significant challenge to existing network security protection systems. Therefore, accurately and efficiently identifying illegal encrypted traffic without compromising user privacy has become a critical and pressing issue in the field of network security.

[0004] Existing research on encrypted traffic identification primarily focuses on improving the performance of identification models in homogeneous "train-test" environments. However, these approaches often overlook the dynamic changes and diversity of network and application software environments, which can lead to the problem of "concept drift" in heterogeneous "train-test" environments. Concept drift refers to the fact that the characteristic distribution of encrypted traffic changes with changes in network topology, protocol evolution, user behavior, and software updates. The original trained model becomes ineffective in the new test environment, resulting in a significant decrease in the accuracy of the identification model.

[0005] Existing research has attempted to improve the accuracy of encrypted traffic identification through techniques such as feature engineering, machine learning, and deep learning. Researchers have explored various encrypted traffic classification methods and proposed improving classification performance through protocol-specific feature extraction and model training. However, these methods rely on static feature extraction and are unable to address the dynamic changes caused by concept drift. Summary of the Invention

[0006] The purpose of the present invention is to address the problems of low efficiency and insufficient precision in website behavior recognition under concept drift scenarios in the current existing technology, provide an encrypted traffic identification method that is resistant to concept drift, construct an index system of concept drift environment disturbance factors, and analyze the data packet distribution of encrypted traffic in different environments around common factors such as operating system, network environment, and timeliness; based on the idea of ​​"drift perception, incremental correction", the present invention uses a confusion-aware counter-concept drift detection method (CACD) to detect concept drift in encrypted traffic behavior recognition, and handles the drift problem through an encrypted traffic behavior recognition method updated through incremental learning. This method can continuously adapt to new concepts throughout the entire recognition life cycle and has high adaptability.

[0007] The technical solutions of the present invention are as follows:

[0008] A method for identifying encrypted traffic that resists concept drift, comprising:

[0009] Step S1: Data preprocessing: Obtain traffic Pcap packets and corresponding encrypted proxy logs under various network environments, extract TCP streams from the original Pcap files of each website access, and associate them with the domain names in the encrypted proxy log information. Generate network flow sequences based on host IP and port, extract multi-dimensional statistical features, and generate traffic samples.

[0010] Step S2: Network flow model training: Using the processed valid network flow samples, the random forest model is used to train and initialize the network flow recognition model to classify the network flow. A dynamic update mechanism is introduced. When concept drift is detected, the system can retrain the model based on real-time traffic data and gradually enhance the generalization ability of the model based on incremental learning methods.

[0011] Step S3: Website access behavior characterization: extract the traffic characteristics of each website visit, generate a behavioral fingerprint, and describe the typical access pattern of the website; pair the network flow classification results with the website behavior characteristics to complete the website fingerprint in-depth identification;

[0012] Step S4: concept drift detection; set the adversarial standard window and the test window, perform adversarial label processing on the samples in the two windows, and then train the confusion classification model for adversarial concept drift detection. Use adaptive adversarial learning to automatically adjust the model structure and parameters.

[0013] Step S5: hierarchical incremental learning model update; when the concept drift reaches the drift threshold, the incremental learning update of the network flow concept model is triggered;

[0014] Step S6: Dynamic adjustment of the sliding window; automatically adjust the sliding window size according to traffic changes to improve the sensitivity and response speed of concept drift detection; when traffic changes drastically, the window is reduced to increase the detection frequency; after completing the model update, the adversarial standard window is slid to the current position of the window to be tested, and the window to be tested slides forward to enter the next round of concept drift detection; if no concept drift is detected, the window to be tested is directly slid forward to continue the next round of detection.

[0015] Furthermore, the step S1 includes:

[0016] Step S11: Obtain traffic Pcap packets and corresponding encrypted proxy logs under various network environments, including traffic data under different time periods, different operating systems, different bandwidth conditions, and through typical encrypted proxies; extract the TCP stream from the original Pcap file for each website access and associate it with the domain name in the encrypted proxy log information;

[0017] Step S12: Divide the encrypted proxy traffic into traffic samples in units of network flows, parse the original encrypted proxy traffic pcap file into a network flow sequence according to the host IP and port, obtain a network flow sample consisting of two tuples, and assign a two-dimensional label to the network flow; at the same time, sort the occurrence frequency of the network flow by visiting the monitoring website multiple times, retain the encrypted traffic samples containing all valid network flows, and delete the samples without valid network flows to ensure the validity of the traffic samples;

[0018] Step S13: Use Python's NumPy array to count the data packets of the network flow and extract 765-dimensional statistical features;

[0019] Step S14: Build a behavior fingerprint library for the longest public network flow sequence that remains relatively stable during multiple access rounds, and update it in real time.

[0020] Furthermore, the step S2 includes:

[0021] Step S21: Assume that the total number of training samples is M and the total number of features is V. Use the Bootstrap sampling method with replacement to select m samples.

[0022] Step S22: Randomly select v features from the m samples as the basis for node splitting, calculate the information gain of each dimension of the feature, and select the feature with the largest information gain as the feature for the current node splitting;

[0023] Step S23: Repeat the strategy of step S22 to form each node until the node cannot be split, completing the construction of a decision tree;

[0024] Step S24: Obtain W weak learners DT according to steps S21-S23 w (w=1,2,…,W), forming a random forest;

[0025] Step S25: Using a decision tree algorithm to consider the classification results of W decision trees, output as the final result.

[0026] Furthermore, the step S3 includes:

[0027] Step S31: Extract traffic characteristics of each website visit and generate a behavioral fingerprint to describe the typical access pattern of the website. Based on the extracted behavioral characteristics, the access patterns of different websites are classified and a behavioral fingerprint library is constructed. In future visits, the patterns can be compared with the fingerprint library to identify the user's behavior.

[0028] In order to characterize the unique behavior pattern of each website, several longest common network flow sequences that keep the relative order unchanged in multiple website visit rounds are extracted as the behavior pattern of website visit. The network flow sequence generated by the a-th visit to the website is expressed as n a is the total number of network flows generated by the a-th visit to the website, represents the i-th network flow in this visit; similarly, the total length of the b-th visit to the website is n b The network flow sequence is represented as assumed It's W a The first p network flow sequences of It's W b The first q network flow sequences are represented by LF(n a ,n b ) indicates W a With W b PWAB between;

[0029] Step S32: If the current network flow in the two website visits is the same during the current traversal process, that is, when When , the length of LF(p,q) can be extended by adding If the current network flow in the two website visits during the traversal is different, that is, when When , their longest common subsequence will not be expanded and is max(LF(p-1,q),LF(p,q-1));

[0030] Step S33: Generate a behavioral fingerprint by extracting the longest common network flow sequence in the website access traffic, and use the pattern importance (IoP) indicator to quantify the importance of each pattern; the system focuses on monitoring access behaviors with potential risks based on the IoP value;

[0031] Step S34: For a website's PWAB, select the top K representative PWABs with the IoP(PWAB) values ​​to characterize the website's access behavior pattern. Then, use the network flows that do not appear in the top K PWABs as PWABs to characterize the website's access behavior pattern. The website's access behavior pattern is characterized using [(PWAB1, IoP(PWAB1)), (PWAB2, IoP(PWAB2)), ...].

[0032] Step S35: The feature vector of the website access behavior sample is described using PWAB. When generating the behavior recognition feature, the network flow sequence identified using the network flow conceptual model is matched with PWAB. If a match is found, the IoP of the matched common sequence is assigned to the dimension feature, otherwise it is 0. The above operation is repeated for the behavior traffic of each website in the monitoring list to form a feature vector of the encrypted traffic behavior. Finally, the behavior recognition classifier is trained using the KNN classifier.

[0033] Furthermore, the LF(n a ,n b ) is calculated as follows:

[0034]

[0035] Among them, LF(p,q) represents the sequence with sequence The current longest common sequence, if the length of the current longest network flow sequence is 0, there is no common sequence, so it is

[0036] Furthermore, the calculation process of IoP(PWAB) in step S33 is as follows:

[0037]

[0038] Where Count(PWAB) is the number of times PWAB appears, and label(f) is the label of network flow f.

[0039] Furthermore, the step S4 includes:

[0040] Step S41: Concept drift detection sets two sliding windows: the adversarial standard window and the test window; the adversarial standard sample S standard is the latest network flow concept sample in the current environment. Suppose there are n types of network flows, then S standard The category label set is {label i |i=1,2,3…,n}, the sample to be tested S comingHere is a network flow sample from another environment, whose original category label set is also {label i |i=1,2,3…,n}, change the original label label i Modified to anti_l i , so that the network flow label set is {anti_l i |i=1,2,3…,n};

[0041] Step S42: The sample to be tested S coming Combined with the adversarial standard sample to generate the confusing adversarial sample, the category label set of the confusing adversarial sample is {anti_l i , label i |i=1,2,3…,n}, and then divide the training set and test set into training and testing sets according to a certain ratio for the network flow classification model respectively. Finally, the network flow classification model is tested on the test sample S test The recognition performance is used as a quantitative indicator of the degree of concept drift;

[0042] Step S43: Based on the confusion classification model, the structure and parameters of the detection model are dynamically adjusted to automatically adapt to traffic changes in different environments, thereby improving the accuracy and response speed of drift detection;

[0043] Step S44: The F1-score of the recognition result is used as an indicator of the degree of concept drift. The larger the indicator value, the more obvious the concept drift phenomenon;

[0044] Step S45: If the F1-score is higher than the drift threshold, proceed to step S5; otherwise, proceed to step S6.

[0045] Furthermore, the calculation process of the concept drift degree indicator F1-score in step S44 is as follows:

[0046]

[0047] Precision is the prediction result of the model, which calculates the ratio of true positive samples in the classification results to the predicted positive samples; Recall is the prediction result of the model, which calculates the ratio of correctly predicted positive samples to the actual positive samples.

[0048] Furthermore, the step S5 includes:

[0049] Step S51: Random forest classifies network flows to calculate the correct network flows. Assume that the category set of network flows is {c y |y=1,2,…,Y}, random forest classifies the network flow f, where the classification result of each decision tree is T g(f)(1≤g≤G), for all decision tree classification results T g (f), calculate the decision tree vote count N(T g (f)), the confidence of each prediction category can be expressed as the proportion of the correct number of predictions made by the decision tree in the total number

[0050] Step S52: The final classification result of random forest is c max (0≤max≤Y)c max The confidence level is For correctly classified samples, calculate pb(c max ), determine pb(c max ) is less than the set confidence threshold ε. If it is less than ε or the classification result is incorrect, it means that the existing model is not confident enough in identifying the sample or cannot identify such concepts. Incremental sets are added to enable the classification model to learn new concepts.

[0051] Step S53: Incremental learning adopts a hierarchical strategy and performs incremental learning for different encrypted traffic types to ensure that the characteristics of each type of traffic can be accurately identified by the model.

[0052] Furthermore, the tuple in step S12 includes: a timestamp, a packet size, and a direction;

[0053] The two-dimensional label in step S12 includes: website name and server domain name.

[0054] Compared with the existing technology, the beneficial effects of the present invention are:

[0055] This paper proposes a confusion-aware adversarial concept drift detection (CACD) method, which effectively addresses the existing problem of declining recognition model accuracy in dynamic network environments. Through incremental learning, this method can promptly update the model as encrypted traffic characteristics change, enabling real-time detection and response to concept drift, thereby maintaining efficient encrypted traffic recognition capabilities over the long term.

[0056] 2. This invention specifically extracts and optimizes features for widely used encryption proxies (such as Shadowsocks and V2Ray), significantly improving the efficiency of identifying such encrypted traffic. Compared to existing technologies that can only handle conventional encryption protocols, the traffic analysis method of this invention is more targeted and can effectively distinguish between legitimate and illegitimate traffic, greatly improving the detection system's sensitivity and ability to handle complex encrypted traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flow chart of an encrypted traffic identification method that is resistant to concept drift;

[0058] Figure 2 This is a flow chart of the data preprocessing process;

[0059] Figure 3 Draw a process flow chart for website access behavior;

[0060] Figure 4 Schematic diagram of the anti-obfuscation detection principle;

[0061] Figure 5 A real-time monitoring process flow chart for an encrypted traffic identification method resistant to concept drift. DETAILED DESCRIPTION

[0062] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0063] The features and performance of the present invention are further described in detail below with reference to the embodiments.

[0064] Example 1

[0065] See also Figure 1 , a method for identifying encrypted traffic that resists concept drift, specifically comprising the following steps:

[0066] Step S1: Data preprocessing. Obtain traffic Pcap packets and corresponding encrypted proxy logs from various network environments. Extract the TCP stream from the original Pcap file for each website access and associate it with the domain name in the encrypted proxy log information. Generate a network flow sequence based on the host IP and port, extract multidimensional statistical features, and generate traffic samples. Figure 2 The data preprocessing process is described, specifically:

[0067] Step S11: Obtain traffic Pcap packets and corresponding encrypted proxy logs under multiple different network environments, including traffic data under different time periods, different operating systems (such as Windows, Linux), different bandwidth conditions, and through typical encrypted proxies (such as Shadowsocks, V2Ray). Extract TCP flows from the original Pcap file of each website access and associate them with the domain names in the encrypted proxy log information;

[0068] Step S12: Divide the encrypted proxy traffic into traffic samples in units of network flows. Parse the original encrypted proxy traffic pcap file into a network flow sequence according to the host IP and port, obtain network flow samples composed of binary tuples (timestamp, packet size and direction), and assign two-dimensional labels (website name, server domain name) to the network flows. At the same time, sort the occurrence frequencies of the network flows by accessing the monitoring website multiple times, and retain the encrypted traffic samples containing all valid network flows, and delete the samples lacking valid network flows to ensure the effectiveness of the traffic samples;

[0069] Step S13: Use the NumPy array in Python to statistically analyze the packets of the network flows, and extract a total of 765-dimensional statistical features such as the packet sequence and packet size of the network flow packets;

[0070] Step S14: Build a behavior fingerprint library for the longest common network flow sequence that remains relatively stable during multiple access rounds and update it in real time.

[0071] Step S2: Network flow model training. Use the processed valid network flow samples to train and initialize the network flow recognition model through a random forest model to classify the network flows. Introduce a dynamic update mechanism. When concept drift is detected, the system can retrain the model according to the real-time traffic data and gradually enhance the generalization ability of the model based on the incremental learning method. Specifically:

[0072] Step S21: Assume that the total number of training samples is M and the total number of features is V. Use the Bootstrap sampling method to select m (m < M) samples with replacement;

[0073] Step S22: Randomly select v (v < V) features from these m samples as the basis for node splitting, calculate the information gain of each dimension of the feature respectively, and select the feature with the largest information gain as the feature for splitting the current node;

[0074] Step S23: Repeat the strategy in Step S22 to form each node until the node cannot be split, and complete the construction of a decision tree;

[0075] Step S24: Obtain W weak learners DT according to Steps S21 - Step S23 w(w=1,2,…,W), forming a random forest;

[0076] Step S25: Using a decision tree algorithm to consider the classification results of W decision trees, output as the final result.

[0077] Step S3: Website access behavior characterization. Extract traffic characteristics for each website visit to generate a behavioral fingerprint that describes the typical access pattern for that website. Pair the network flow classification results with the website behavior characteristics to complete in-depth website fingerprint identification. Figure 3 This paper describes the process of characterizing website access behavior, specifically:

[0078] Step S31: Extract traffic characteristics of each website visit and generate a behavioral fingerprint that describes the typical access pattern of the website. Based on the extracted behavioral characteristics, the access patterns of different websites are classified and a behavioral fingerprint library is constructed. During future visits, the patterns can be compared with those in the fingerprint library to identify the user's behavior.

[0079] In order to characterize the unique behavior pattern of each website, several longest common network flow sequences that keep the relative order unchanged in multiple website access rounds are extracted as the website access behavior patterns (Patterns of Website Access Behavior, PWAB). The network flow sequence generated by the a-th visit to the website is expressed as n a is the total number of network flows generated by the a-th visit to the website, Indicates the i-th network flow in this visit. Similarly, the total length of the b-th visit to the website is n b The network flow sequence is represented as assumed It's W a The first p network flow sequences of It's W b The first q network flow sequences are represented by LF(n a ,n b ) indicates W a With W b PWAB between;

[0080] LF(n a ,n b )The calculation process is:

[0081]

[0082] Where LF(p,q) represents the sequence with sequence The current longest common sequence, if the length of the current longest network flow sequence is 0, there is no common sequence, so it is

[0083] Step S32: If the current network flow in the two website visits is the same during the current traversal process, that is, when When , the length of LF(p,q) can be extended by adding If the current network flow in the two website visits during the traversal is different, that is, when When , their longest common subsequence will not be expanded and is max(LF(p-1,q),LF(p,q-1));

[0084] Step S33: Generate a behavioral fingerprint by extracting the longest common network flow sequence from the website access traffic, and use the importance of pattern (IoP) indicator to quantify the importance of each pattern. The system focuses on monitoring access behaviors with potential risks based on the IoP value;

[0085] The IoP(PWAB) calculation process is:

[0086]

[0087] Where Count(PWAB) is the number of times PWAB appears, label(f) is the label of network flow f;

[0088] Step S34: For a website's PWAB, select the top K representative PWABs with the highest IoP(PWAB) values ​​to characterize the website's visit behavior pattern. Then, use the network flows that do not appear in the top K PWABs as PWABs to characterize the website's visit behavior pattern. The website's visit behavior pattern can be characterized using [(PWAB1, IoP(PWAB1)), (PWAB2, IoP(PWAB2)), ...];

[0089] Step S35: The feature vector of the website access behavior sample is described using PWAB. When generating the behavior recognition feature, the network flow sequence identified using the network flow conceptual model is matched with the PWAB. If a match is found, the IoP of the matching common sequence is assigned to the dimension feature; otherwise, it is assigned to 0. This process is repeated for each website's behavior traffic on the monitoring list, forming a feature vector for the encrypted traffic behavior. Finally, the behavior recognition classifier is trained using the KNN classifier.

[0090] Step S4: Concept drift detection. Set the adversarial standard window and the test window, perform adversarial label processing on the samples in the two windows, and then train a confusion classification model for adversarial concept drift detection. Adaptive adversarial learning is used to automatically adjust the model structure and parameters. Figure 4 The principle of anti-obfuscation detection is described, specifically:

[0091] Step S41: Concept drift detection sets two sliding windows: the adversarial standard window and the test window; the adversarial standard sample S standard is the latest network flow concept sample in the current environment. Suppose there are n types of network flows, then S standard The category label set is {label i |i=1,2,3…,n}, the sample to be tested S coming Here is a network flow sample from another environment, whose original category label set is also {label i |i=1,2,3…,n}, change the original label label i Modified to anti_l i , so that the network flow label set is {anti_l i |i=1,2,3…,n};

[0092] Step S42: The sample to be tested S coming Combined with the adversarial standard sample to generate the confusing adversarial sample, the category label set of the confusing adversarial sample is {anti_l i , label i |i=1,2,3…,n}, and then divide the training set and test set into training and testing sets according to a certain ratio for the network flow classification model respectively. Finally, the network flow classification model is tested on the test sample S test The recognition performance is used as a quantitative indicator of the degree of concept drift;

[0093] Step S43: Based on the confusion classification model, the structure and parameters of the detection model are dynamically adjusted to automatically adapt to traffic changes in different environments, thereby improving the accuracy and response speed of drift detection;

[0094] Step S44: The F1-score of the recognition result is used as an indicator of the degree of concept drift. The larger the indicator value, the more obvious the concept drift phenomenon;

[0095]

[0096] Precision is the ratio of true positive samples to predicted positive samples in the classification results. Recall is the ratio of correctly predicted positive samples to actual positive samples in the classification results.

[0097] Step S45: If the F1-score is higher than the drift threshold, proceed to step S5; otherwise, proceed to step S6.

[0098] Step S5: Hierarchical incremental learning model update. When the concept drift reaches the drift threshold, the incremental learning update of the network flow concept model is triggered. Specifically:

[0099] Step S51: Random forest classifies network flows to calculate the correct network flows. Assume that the category set of network flows is {c y |y=1,2,…,Y}, random forest classifies the network flow f, where the classification result of each decision tree is T g (f)(1≤g≤G), for all decision tree classification results T g (f), calculate the decision tree vote count N(T g (f)), the confidence of each prediction category can be expressed as the proportion of the correct number of predictions made by the decision tree in the total number

[0100] Step S52: The final classification result of random forest is c max (0≤max≤Y)c max The confidence level is For correctly classified samples, calculate pb(c max ), determine pb(c max ) is less than the set confidence threshold ε. If it is less than ε or the classification result is incorrect, it means that the existing model is not confident enough in identifying the sample or cannot identify such concepts. Incremental sets are added to enable the classification model to learn new concepts.

[0101] Step S53: Incremental learning adopts a hierarchical strategy, and performs incremental learning for different encrypted traffic types such as SSL / TLS and Shadowsocks to ensure that the characteristics of each type of traffic can be accurately identified by the model.

[0102] Step S6: Dynamically adjust the sliding window. The sliding window size is automatically adjusted based on traffic changes to improve the sensitivity and response speed of concept drift detection. When traffic fluctuates dramatically, the window size is reduced to increase detection frequency. After the model update is complete, the adversarial standard window is slid to the current position of the test window, and the test window slides forward to enter the next round of concept drift detection. If no concept drift is detected, the test window slides forward to continue the next round of detection. Figure 5 A real-time monitoring process of encrypted traffic identification method resistant to concept drift is described.

[0103] The above-described embodiments merely represent specific implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of protection of the present application. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the technical concept of the present application, and all such variations and improvements fall within the scope of protection of the present application.

[0104] This background section is provided to generally present the context of the invention, and the work of the presently named inventors, the work to the extent described in this background section, and aspects of the description in this section that did not constitute prior art at the time of filing are neither explicitly nor implicitly admitted to be prior art to the present invention.

Claims

1. A method for identifying encrypted traffic with resistance to concept drift, characterized in that: include: Step S1: data preprocessing; Obtain traffic Pcap packets and corresponding encrypted proxy logs under various network environments, extract TCP streams from the original Pcap files for each website access, and associate them with the domain names in the encrypted proxy log information. Generate network flow sequences based on host IP and port numbers, extract multi-dimensional statistical features, and generate traffic samples. Step S2: Network flow model training: Using the processed valid network flow samples, the random forest model is used to train and initialize the network flow recognition model to classify the network flow. A dynamic update mechanism is introduced. When concept drift is detected, the system can retrain the model based on real-time traffic data and gradually enhance the generalization ability of the model based on incremental learning methods. Step S3: Website access behavior characterization: extract the traffic characteristics of each website visit, generate a behavioral fingerprint, and describe the typical access pattern of the website; pair the network flow classification results with the website behavior characteristics to complete the website fingerprint in-depth identification; Step S4: concept drift detection; set the adversarial standard window and the test window, perform adversarial label processing on the samples in the two windows, and then train the confusion classification model for adversarial concept drift detection. Use adaptive adversarial learning to automatically adjust the model structure and parameters. Step S5: hierarchical incremental learning model update; when the concept drift reaches the drift threshold, the incremental learning update of the network flow concept model is triggered; Step S6: Dynamic adjustment of the sliding window; automatically adjust the sliding window size according to traffic changes to improve the sensitivity and response speed of concept drift detection; when traffic changes drastically, the window is reduced to increase the detection frequency; after completing the model update, the adversarial standard window is slid to the current position of the window to be tested, and the window to be tested slides forward to enter the next round of concept drift detection; if no concept drift is detected, the window to be tested is directly slid forward to continue the next round of detection.

2. The encrypted traffic identification method against concept drift according to claim 1 is characterized in that: The step S1 includes: Step S11: Obtain traffic Pcap packets and corresponding encrypted proxy logs under various network environments, including traffic data under different time periods, different operating systems, different bandwidth conditions, and through typical encrypted proxies; extract the TCP stream from the original Pcap file for each website access and associate it with the domain name in the encrypted proxy log information; Step S12: Divide the encrypted proxy traffic into traffic samples in units of network flows, parse the original encrypted proxy traffic pcap file into a network flow sequence according to the host IP and port, obtain a network flow sample consisting of two tuples, and assign a two-dimensional label to the network flow; at the same time, sort the occurrence frequency of the network flow by visiting the monitoring website multiple times, retain the encrypted traffic samples containing all valid network flows, and delete the samples without valid network flows to ensure the validity of the traffic samples; Step S13: Use Python's NumPy array to count the data packets of the network flow and extract 765-dimensional statistical features; Step S14: Build a behavior fingerprint library for the longest public network flow sequence that remains relatively stable during multiple access rounds, and update it in real time.

3. The encrypted traffic identification method against concept drift according to claim 2 is characterized in that: The step S2 includes: Step S21: Assume that the total number of training samples is M and the total number of features is V. Use the Bootstrap sampling method with replacement to select m samples. Step S22: Randomly select v features from the m samples as the basis for node splitting, calculate the information gain of each dimension of the feature, and select the feature with the largest information gain as the feature for the current node splitting; Step S23: Repeat the strategy of step S22 to form each node until the node cannot be split, completing the construction of a decision tree; Step S24: Obtain W weak learners according to steps S21-S23 , forming a random forest; Step S25: Using a decision tree algorithm to consider the classification results of W decision trees, output as the final result.

4. The encrypted traffic identification method against concept drift according to claim 3 is characterized in that: The step S3 includes: Step S31: Extract traffic characteristics of each website visit and generate a behavioral fingerprint to describe the typical access pattern of the website. Based on the extracted behavioral characteristics, the access patterns of different websites are classified and a behavioral fingerprint library is constructed. In future visits, the patterns can be compared with the fingerprint library to identify the user's behavior. In order to characterize the unique behavior pattern of each website, several longest common network flow sequences that keep the relative order unchanged in multiple website visit rounds are extracted as the behavior pattern of website visit. The network flow sequence generated by the a-th visit to the website is expressed as , is the total number of network flows generated by the a-th visit to the website, represents the i-th network flow in this visit; similarly, the total length of the b-th visit to the website is The network flow sequence is represented as ,assumed yes The first p network flow sequences of yes The first q network flow sequences of , with LF( )express and PWAB between them; PWAB represents the behavior pattern of website visits; Step S32: If the current network flow in the two website visits is the same during the current traversal process, that is, when hour, The length can be expanded. Add at the end of ; If the current network flow in the two website visits during the traversal process is different, that is, when When , their longest common subsequence will not be expanded and will be ; Step S33: Generate a behavioral fingerprint by extracting the longest common network flow sequence in the website access traffic, and use the pattern importance index (IoP) to quantify the importance of each pattern. The system focuses on monitoring access behaviors with potential risks based on the IoP value. Step S34: PWAB selection for a certain website The PWABs with good representativeness in the top K are used to describe the website access behavior pattern, and the network flows that do not appear in the top K PWABs are used as PWABs to describe the website access behavior pattern. To portray; Step S35: The feature vector of the website access behavior sample is described using PWAB. When generating the behavior recognition feature, the network flow sequence identified using the network flow conceptual model is matched with PWAB. If a match is found, the IoP of the matched common sequence is assigned to the dimension feature, otherwise it is 0. The above operation is repeated for the behavior traffic of each website in the monitoring list to form a feature vector of the encrypted traffic behavior. Finally, the behavior recognition classifier is trained using the KNN classifier.

5. The encrypted traffic identification method against concept drift according to claim 4 is characterized in that: The LF( ) is calculated as follows: in, Representative sequence and The current longest common sequence, if the length of the current longest network flow sequence is 0, there is no common sequence, so it is .

6. The encrypted traffic identification method against concept drift according to claim 4 is characterized in that: The calculation process of IoP(PWAB) in step S33 is as follows: in, is the number of times PWAB appears, is the label of network flow f.

7. The encrypted traffic identification method against concept drift according to claim 4 is characterized in that: The step S4 comprises: Step S41: Concept drift detection sets two sliding windows: the anti-standard window and the test window; the anti-standard sample is the latest network flow concept sample in the current environment. Suppose there are n types of network flows, then The category label set is , the sample to be tested Here is a network flow sample from another environment, and its original category label set is also , the original label Modified to , so that the network flow label set is ; Step S42: The sample to be tested Combined with the adversarial standard sample to generate the confusing adversarial sample, the category label set of the confusing adversarial sample is Then, the training set and test set are divided into two parts according to a certain ratio for training and testing of network flow classification model respectively. Finally, the network flow classification model is tested on the test samples. The recognition performance is used as a quantitative indicator of the degree of concept drift; Step S43: Based on the confusion classification model, the structure and parameters of the detection model are dynamically adjusted to automatically adapt to traffic changes in different environments, thereby improving the accuracy and response speed of drift detection; Step S44: The F1-score of the recognition result is used as an indicator of the degree of concept drift. The larger the indicator value, the more obvious the concept drift phenomenon; Step S45: If the F1-score is higher than the drift threshold, proceed to step S5; otherwise, proceed to step S6.

8. The encrypted traffic identification method against concept drift according to claim 7 is characterized in that: The calculation process of the concept drift degree indicator F1-score in step S44 is as follows: Precision is the prediction result of the model, which calculates the ratio of true positive samples in the classification results to the predicted positive samples; Recall is the prediction result of the model, which calculates the ratio of correctly predicted positive samples to the actual positive samples.

9. The encrypted traffic identification method against concept drift according to claim 7, characterized in that: The step S5 comprises: Step S51: Random forest classifies network flows to calculate the correct network flows. Assume that the category set of network flows is { }, Random Forest classifies the network flow f, where the classification result of each decision tree is , for all decision tree classification results , calculate the decision tree vote count for each class , the confidence of each prediction category can be expressed as the proportion of the correct number of decision tree predictions in the total number ; Step S52: The final classification result of random forest is The confidence level is , for correctly classified samples, calculate ,determination Is it less than the set confidence threshold? , if less than Or if the classification result is incorrect, it means that the existing model is not confident enough in identifying the sample or cannot identify such concepts. In this case, an incremental set is added to enable the classification model to learn new concepts. Step S53: Incremental learning adopts a hierarchical strategy and performs incremental learning for different encrypted traffic types to ensure that the characteristics of each type of traffic can be accurately identified by the model.

10. The encrypted traffic identification method against concept drift according to claim 1, characterized in that: The binary data in step S12 includes: a timestamp, a packet size, and a direction; The two-dimensional label in step S12 includes: website name and server domain name.

Images