A traffic shaping method and system based on deep learning and adversarial strategy

Abstract

The present invention discloses a traffic shaping method and system based on deep learning and adversarial strategies. The shaping method includes: monitoring network traffic in real time through a traffic monitor, capturing information of traffic data, and performing data preprocessing, extracting traffic features through the preprocessed traffic data, and training a DNN classifier; inputting the trained DNN classifier and traffic data into a patch generation module, preliminarily generating adversarial patches according to a dual simulated annealing algorithm with a multi-objective optimization algorithm, and optimizing the adversarial patches through an adaptive adjustment strategy and a bandwidth overhead adjustment strategy; patch injection: injecting the optimized adversarial patch into the original traffic data through an injection controller to shape the original traffic data. The present invention solves the problem that the adversarial capability and privacy security protection capability of IoT devices in the face of device identification and traffic analysis attacks need to be strengthened.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic shaping, and in particular to a traffic shaping method and system based on deep learning and adversarial strategy. Background Art

[0002] In the field of network security, network traffic analysis is a key technology that identifies and classifies network activities by analyzing network communication patterns. With the widespread use of encryption technology, user privacy has been better protected. However, website fingerprinting (WF) technology exploits side channel information such as the size, time interval, and direction of traffic, which is usually visible in encrypted connections, allowing attackers to infer users' browsing behavior. In order to improve the accuracy and robustness of WF technology, researchers have begun to use deep neural networks (DNNs) to automatically extract features from traffic. Although DNNs perform well in WF attacks, their vulnerability to adversarial examples has also attracted attention. Adversarial examples are inputs that cause DNNs to make incorrect decisions by adding carefully designed tiny perturbations to the input data. Therefore, there is an urgent need for a strategy to improve the adversarial ability and privacy security protection capabilities of IoT devices in the face of device identification and traffic analysis attacks. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] Based on the above problems, the present invention provides a traffic shaping method and system based on deep learning and adversarial strategies to solve the problem that the adversarial ability and privacy security protection ability of IoT devices when facing device identification and traffic analysis attacks need to be strengthened.

[0005] (II) Technical solution

[0006] Based on the above technical problems, the present invention provides a traffic shaping method based on deep learning and adversarial strategy, including:

[0007] S1. Monitor network traffic in real time through traffic monitors, capture traffic data information, and perform data preprocessing. Extract traffic features through preprocessed traffic data and train DNN classifiers.

[0008] S2. Input the trained DNN classifier and traffic data into the patch generation module, preliminarily generate adversarial patches according to the dual simulated annealing algorithm with a multi-objective optimization algorithm, and optimize the adversarial patches through an adaptive adjustment strategy and a bandwidth overhead adjustment strategy;

[0009] S3, patch injection: inject the optimized adversarial patch into the original traffic data through the injection controller to shape the original traffic data.

[0010] The present invention also discloses a traffic shaping system based on deep learning and adversarial strategies, including: a traffic monitor, a patch generator and an injection controller, which respectively run S1, S2, and S3 of the traffic shaping method based on deep learning and adversarial strategies.

[0011] The present invention also discloses a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, wherein the computer instructions enable a computer to execute the method.

[0012] (III) Beneficial effects

[0013] The above technical solution of the present invention has the following advantages:

[0014] (1) The present invention is a breakthrough network traffic shaping method, which is specially designed to resist website fingerprinting WF attacks based on deep neural network DNN. It takes advantage of the characteristic of DNN being sensitive to small input disturbances and injects a small amount of false data packets into real-time network traffic to change the traffic pattern, thereby interfering with WF attacks. It preliminarily generates adversarial patches by adding a dual simulated annealing algorithm with a multi-objective optimization algorithm, and optimizes the adversarial patches through adaptive adjustment strategies and bandwidth overhead adjustment strategies, so that it can generate efficient adversarial patches for different website traffic patterns. Through adaptive parameter adjustment, Minipatch technology has achieved important technical progress in protecting user privacy and resisting complex attacks in the field of network security. It thus improves the resistance and privacy security protection capabilities of IoT devices in the face of device identification and traffic analysis attacks.

[0015] (2) This invention significantly improves user privacy protection with extremely low bandwidth overhead by injecting adversarial patches into network traffic in real time. Its core innovation lies in its lightweight defense mechanism, which can achieve a protection success rate of more than 97% with a bandwidth overhead of no more than 5%. Compared with traditional WF defense methods, it is lighter but more efficient and more robust.

[0016] (3) The present invention adopts black-box feedback optimization, which does not require the internal information of the target DNN model, enhancing the practicality and feasibility of deployment; the present invention also exhibits excellent cross-model transferability, providing it with potential as a general defense framework. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The features and advantages of the present invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present invention in any way. In the accompanying drawings:

[0018] Figure 1 It is an overall operation framework diagram of an embodiment of the present invention;

[0019] Figure 2 A schematic diagram of a process of generating a patch according to an embodiment of the present invention;

[0020] Figure 3 A schematic diagram of a patch generation method according to an embodiment of the present invention;

[0021] Figure 4 A schematic diagram of adaptive limit adjustment according to an embodiment of the present invention;

[0022] Figure 5 A schematic diagram of a flow chart of a bandwidth overhead adjustment method according to an embodiment of the present invention;

[0023] Figure 6 A schematic diagram of a procedure of a bandwidth overhead adjustment method according to an embodiment of the present invention;

[0024] Figure 7 is a flow chart of a patch injection method according to an embodiment of the present invention;

[0025] Figure 8 A schematic diagram of a patch generation method according to an embodiment of the present invention;

[0026] Figure 9 A schematic diagram for comparing experimental results of an embodiment of the present invention;

[0027] Figure 10 Schematic diagram of a heat map matrix of the adversarial strategy transfer rate according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0029] Minipatch works based on the concept of adversarial patches, which are special input perturbations that only fine-tune local parts of the data to mislead DNN classifiers. These patches are generated by a carefully designed algorithm to significantly reduce the ability of attackers to identify users visiting websites without significantly increasing network traffic. Minipatch takes advantage of the fact that DNNs are sensitive to small input perturbations and injects a small number of false packets into real-time network traffic to change traffic patterns, thereby interfering with WF attacks.

[0030] The embodiment of the present invention is a traffic shaping system based on deep learning and adversarial strategy, which is the core of realizing efficient defense against DNN-based WF attacks and includes the following key components:

[0031] 1. Traffic monitor: It is responsible for real-time monitoring of network traffic and capturing information such as the direction, size, and timestamp of data packets. The traffic monitor uses advanced data capture tools and network interfaces to accurately obtain traffic data and provide raw materials for subsequent processing.

[0032] 2. Patch generator: used to receive traffic data provided by the monitor and generate adversarial patches based on these data; the patch generator uses a dual annealing (DA) algorithm to calculate the optimal patch parameters, including the location, length and direction of the patch; the patch generator includes a patch generation module, an injection location calculation module and a quantity optimization module.

[0033] 3. Injection controller: responsible for injecting the generated adversarial patches into network traffic in real time; the injection controller must accurately synchronize the real-time state of the traffic and the injection timing of the patch to ensure that the patch can be seamlessly integrated into the user's actual traffic.

[0034] 4. Evaluation module: used to evaluate the traffic after the patch is injected to determine its effectiveness in combating WF attacks; this evaluation module simulates the attacker’s classifier to test whether the traffic perturbation effectively reduces the identifiability of the website.

[0035] The traffic shaping method of the above system, such as Figure 1 As shown, the ellipse represents the original data, the hollow arrow represents the input, the solid arrow represents the output, the rectangle represents the processing module, and the rounded rectangle represents the output, including: monitoring the network traffic in real time through the traffic monitor, capturing the information of the traffic data, and performing data preprocessing, extracting traffic features through the preprocessed traffic data, and training the DNN classifier; inputting the trained DNN classifier and the traffic data into the patch generator to initially generate an adversarial patch; inputting the adversarial patch and the traffic data into the injection position calculation module, and the position calculation module calculates the best injection position; inputting the adversarial patch, traffic data, and injection position into the quantity optimization module to optimize the number of patches; combining the adversarial patch, injection position and the optimized number of patches, injecting them into the original traffic data through the injection controller, and shaping the original traffic data; performing classification tests on the data before and after shaping through the trained DNN classifier, and comparing the results through the evaluation module to evaluate the shaping effect of the traffic data. The specific steps are as follows:

[0036] S1. Monitor network traffic in real time through a traffic monitor, capture traffic data information, and perform data preprocessing. Extract traffic features through the preprocessed traffic data and train a DNN classifier. The steps include:

[0037] First, the traffic data of IoT devices is received and preprocessed.

[0038] Traffic feature extraction is the process of extracting key information from network data to identify traffic patterns of different websites. Its selection focuses on the direction, size and time interval of data packets, as these attributes play a key role in WF attacks. Minipatch converts these features into fixed-length vectors so that deep learning models can process them.

[0039] The purpose of traffic feature vectorization is to convert traffic data into a format suitable for processing by machine learning models. In Minipatch, traffic features are usually represented by a sequence of packet directions, where +1 represents an outbound packet and -1 represents an inbound packet. This representation method allows deep neural networks (DNNs) to learn traffic patterns of different websites and classify them. In order to adapt to the input requirements of the DNN model, the traffic sequence is padded to a fixed length.

[0040] S2. Input the trained DNN classifier and traffic data into the patch generation module to preliminarily generate adversarial patches. Preliminary adversarial patches are generated according to the dual simulated annealing algorithm with a multi-objective optimization algorithm, and parameters are optimized through adaptive adjustment strategy and bandwidth overhead adjustment strategy.

[0041] The patch generator generates adversarial patches using a dual annealing algorithm and calculates optimal patch parameters, including the location, length, and direction of the patch;

[0042] The generation of adversarial patches is the core of Minipatch technology, which aims to create fake data packets that can mislead DNN classifiers. These patches are generated through a carefully designed algorithm, with the goal of significantly reducing the ability of attackers to identify users visiting websites without significantly increasing network traffic. The generation of adversarial patches can be expressed as the following optimization problem:

[0043] (1)

[0044] in, d ω is the perturbation applied to the site ω, d is the current patch vector, oh is the target weight, f is the target classifier, which is used to balance the misclassification rate and transferability. F Inject function for patch, Defined as f Correctly classified as oh The traffic data set is smaller than X ω In addition, in this optimization problem, the actual network traffic data length is m x Taken from The quartile number of the medium traffic data length is the 75th percentile number of all values ​​in the sample arranged from small to large.

[0045] Minipatch uses the Dual Simulated Annealing (DA) algorithm to solve the above optimization problem. The DA algorithm is a meta-heuristic optimization algorithm that simulates the physical annealing process and finds the global optimal solution to the problem by combining random search and local optimization. In Minipatch, the DA algorithm is used to solve an optimization problem, the goal is to minimize the probability label of the correct classification under the premise of satisfying the constraints.

[0046] The DA algorithm is different from the simulated annealing algorithm (SA) in that it pays more attention to the combination of global search and local search. It adopts more complex temperature scheduling strategies, such as adaptive temperature adjustment, to dynamically adjust the temperature drop rate according to the progress of the search process. Due to the combination of global search and local search, it can usually improve the search efficiency while ensuring the quality of the solution.

[0047] The workflow of the DA algorithm is as follows: First, the algorithm starts at a higher temperature, when the search space is larger and the algorithm can explore multiple regions in the solution space. As the algorithm proceeds, the temperature gradually decreases, the search space gradually shrinks, and the algorithm begins to perform a more detailed search in the local area. When the predetermined number of iterations is reached or the quality of the solution is no longer significantly improved, the search process terminates. The dual simulated annealing algorithm for patch generation includes:

[0048] Step 1: Given the initial temperature and initial solution;

[0049] Step 2: Generate a new solution based on the current temperature;

[0050] Step 3, calculating the increment ΔE of the evaluation function;

[0051] Step 4: Determine whether ΔE<0. If so, accept the new solution and go to step 6. Otherwise, go to step 5.

[0052] Step 5: Determine whether , if yes, accept the new solution and go to step 6, otherwise, go to step 6;

[0053] Step 6: Whether sufficient search has been performed at the current temperature, if so, proceed to step 7; otherwise, return to step 2 and continue searching;

[0054] Step 7: Whether the termination condition is met, if so, the optimal solution is output; otherwise, the temperature decays and returns to step 2; the termination condition is the predetermined number of iterations or the quality of the solution is no longer significantly improved.

[0055] In Minipatch, the parameters of the DA algorithm include initial temperature, cooling rate, access parameter, and acceptance parameter. The initial temperature determines the search range at the beginning of the algorithm, the cooling rate controls how fast the temperature drops, and the access parameter and acceptance parameter affect the acceptance probability of the new solution. In each step of the search, the DNN classifier is used to evaluate the performance of the current solution, that is, the impact of the adversarial patch on the recognition accuracy of the classifier. According to the evaluation results, the parameters of the DA algorithm are adaptively adjusted. Through the DA algorithm, Minipatch is able to generate customized adversarial patches for each website. These patches are injected in real-time traffic, effectively changing the traffic pattern to counter WF attacks.

[0056] The perturbation output by the algorithm is a one-dimensional vector. The number of patches α is fixed and the perturbation The encoding is converted into an array δ=(p1, β1, ..., pα, βα). During the annealing process, the temperature T(t) is controlled by the following formula:

[0057] (2)

[0058] The probability of accepting a new solution in the algorithm, Pr(t), is calculated based on the energy change ΔE of the current solution and the current temperature T(t). This acceptance criterion is a variant of the Metropolis criterion in the simulated annealing algorithm, which decides whether to accept a new solution based on energy change and temperature.

[0059] (3)

[0060] If the energy of the new solution is lower than the energy of the current solution (i.e., ΔE < 0), the new solution is always accepted (Pr(t) = 1); if the energy change ΔE of the new solution is between 0 and T(t) / t (1- q a ), the acceptance probability is determined by the Metropolis criterion, which contains a function based on ΔE, temperature T(t) and acceptance parameter q a The calculated exponential term. If the energy of the new solution is higher than the energy of the current solution (i.e., ΔE>T(t) / t(1- q a ), then the probability of the new solution being accepted is 0, which means that the new solution will usually not be accepted.

[0061] In the local search phase, the L-BFGS-B algorithm is used. The characteristic of L-BFGS-B is that it uses limited memory and is implemented in Python's SciPy library.

[0062] In order to make the generated disturbance transferable, a multi-objective optimization algorithm is added to DA. f other A collection of other models that are similar to the original model f Different, used to assess mobility; E transfer is the effectiveness or effect of adversarial perturbations on different models. E misclassification is the misclassification effect of adversarial perturbation on the model. In the multi-objective optimization process, the optimization E transfer Maximize it while taking into account the misclassification energy E misclassification To balance these two objectives, a weighted sum is used to combine them, and the result of the combination is the energy of the solution above. The algorithm process is as follows:

[0063] Step 1: Define the objective function: Assume there is a decision vector x ∈ X ,in X is the decision space. We need to optimize k The goal can be expressed as f 1( x ), f 2( x ),…, f k ( x ).

[0064] Step 2: Establish the objective function vector: objective function vector F ( x ) can be expressed as: F ( x )=( f 1( x ), f 2( x ),…, f k ( x )).

[0065] Step 3: Define the Pareto dominance relationship: For two solutions x 1 and x 2. If for all i =1,2,…, k Both f i ( x 1)≤ f i ( x 2) And there is at least one j Make f j( x 1)< f j ( x 2), then x 1 Pareto dominance x 2. means solution x 1 is better than at least one target x 2, and at least x 2 are equal.

[0066] Step 4: Set constraints: decision vector x A series of constraints need to be satisfied, which can be expressed as a set of inequalities and equations:

[0067] g i ( x )≤0, i =1,2,…, m

[0068] h j ( x )=0, j =1,2,…, p

[0069] in, g i ( x ) is an inequality constraint, h j ( x ) is an equality constraint.

[0070] Step 5: Construct a multi-objective optimization problem: The multi-objective optimization problem can be expressed as:

[0071] minimize F ( x )=( f 1( x ), f 2( x ),…, f k ( x )) x ∈ X

[0072] g i ( x )≤0, i =1,2,…, mh j ( x )=0, j =1,2,…, p

[0073] Step 6. Pareto Frontier: Pareto Frontier P * is the set of all Pareto efficient solutions, namely:

[0074]

[0075] Compared with SA, DA has the following differences: Combination of global search and local search: DA pays more attention to the combination of global search and local search. In the early stage of the algorithm, global search is mainly performed to avoid falling into the local minimum. As the temperature decreases, the proportion of local search is gradually increased so that a fine search can be performed in a certain area of ​​the solution space. SA focuses mainly on global search, and ensures the exploratory nature of the algorithm through sufficiently high temperature and appropriate cooling strategies, but pays less attention to local search. Temperature scheduling: DA will adopt more complex temperature scheduling strategies, such as adaptive temperature adjustment, and dynamically adjust the temperature drop rate according to the progress of the search process. SA usually adopts a predetermined cooling schedule, and the temperature decreases linearly or exponentially at a fixed rate. Search efficiency: DA combines global search and local search, and the double annealing algorithm can usually improve the search efficiency while ensuring the quality of the solution. SA may spend more time on global search, especially in complex optimization problems, which may lead to lower search efficiency.

[0076] According to the above description, the specific method of S2 patch generation is as follows Figure 2-3 As shown, the following steps are included:

[0077] S201, random starting point and by a, N, M β Constraint; Initial Energy Yes, Yes transfer ，E b ; Let the current iteration number t=1, access step i=1;

[0078] in, is the current adversarial patch vector, is the best adversarial patch vector, α is the number of patches, N, M β For injection and package boundaries, E is the current patch vector d The corresponding energy, E for E transfer and E misclassification The weighted sum of E transferis the current patch vector d The corresponding migration energy, E misclassification is the current patch vector d The corresponding misclassification energy, E b is the best patch vector d b The corresponding energy is used to keep track of the best solution found so far (a combination of misclassification and transferability), is the DNN classifier f ω The traffic vector set of correctly classified website ω, Φ is the patch injection function, where: ,

[0079] Then formula (1) is to solve E b The optimal solution of δ when it takes the minimum value.

[0080] S202: Determine whether the current number of iterations t is less than or equal to the maximum number of iterations M t If yes, calculate the current temperature T and go to step S203. Otherwise, output d w is the optimal perturbation vector d b ,Finish;

[0081] Where T0 is the initial temperature, q v For access parameters;

[0082] S203: Determine whether access step i is less than or equal to , if so, then the neighboring points , go to step S204; otherwise, end the loop and go to step S211;

[0083] represents the neighboring points or candidate solutions, which are new patch vectors generated during the simulated annealing process;

[0084] S204: Determine whether access step i is less than or equal to , if so, then ;otherwise, ;

[0085] Π[ q v , T , d ] represents generating a new neighboring solution according to the access distribution in the simulated annealing algorithm, Π is the point access function, q v is the access parameter, T is the current temperature, dis the dimension of the solution;

[0086] S205, based on and Calculate misclassification energy E' misclassification ,based on and f other Calculation of mobility energy E' transfer , and then calculate the new energy: ;

[0087] E' misclassification represents the misclassified part of the new energy, E' transfer represents the migratory part of the new energy, f other represents a collection of other models used to evaluate transferability, w represents the target weight used to balance the misclassification rate and transferability;

[0088] S206: Determine whether E' < E or E' Better meet the Pareto criterion (Pareto criterion), then accept As , Current Energy E , E transfer ← E' , E' transfer , go to step S207; otherwise, go to step S209;

[0089] S207: Determine whether E' < E b , according to the Pareto criterion, if , then δ b ← δ', E b ← E' , go to step S208; otherwise, go to step S208;

[0090] S208: Determine whether The success rate exceeds the success threshold τ. If so, then output d b , go to step S210; otherwise, go to step S210;

[0091] S209, determine whether E'-E ≤ Pr(t), and Pr(t)>rand(0,1), if so, accept As , Current Energy E , E transfer ← E' , E' transfer , go to step S210; otherwise, go to step S210; Pr() is the Pareto criterion function, and rand() is the random function;

[0092] S210, proceed from arrive Local search, updated according to the Pareto criterion, repeat steps S205 to S209, i = i + 1, return to step S203;

[0093] S211, t=t+1, return to step S202;

[0094] Minipatch also optimizes these parameters through adaptive adjustment strategies and bandwidth overhead adjustment strategies to achieve the highest perturbation efficiency. Parameter tuning and overhead adjustment are achieved by solving the following optimization problems:

[0095] (4)

[0096] Among them, δ w is an adversarial patch for website w, is the DNN classifier f w The set of traffic vectors of correctly classified website w, is the flow vector after applying the patch δ, and y is the correct classification label of the original flow.

[0097] The processing steps are as follows:

[0098] Step 1. Initialization: Set an initial boundary of the number and length of patches (α and M β ), these bounds define the search space;

[0099] Step 2, initial node generation: The current boundary is used to generate two child nodes: corresponding to the case of reducing the number of patches and reducing the length of patches, that is, and .

[0100] Step 3, perturbation generation and evaluation of initial nodes: For each node, generate perturbations using the perturbation function and evaluate their performance under a given success threshold τ;

[0101] Step 4: Adjust the search space: According to the evaluation results of the initial solution, adjust the search space, that is, increase or decrease α and M β to explore different patch configurations;

[0102] Step 5, binary search: perform binary search, each iteration divides the current search space into two parts;

[0103] Step 6: Evaluate child nodes: Generate adversarial patches for each child node and evaluate their success rate and bandwidth overhead.

[0104] Step 7: Select the best child node: Select the child node with the most potential to continue searching based on the success rate and bandwidth overhead;

[0105] Step 8, Iteration: Repeat the above process until the termination condition is met, at which point the perturbations in the success set will be used to determine the optimal solution;

[0106] Step 9, termination condition: The algorithm terminates when any of the following conditions is met: the maximum number of iterations is reached; the success rate of the current solution has met the preset success threshold τ; the adjustment of the search space no longer produces a better solution;

[0107] Step 10, optimal solution selection: Select the perturbation with the highest efficiency (i.e., the shortest patch length and the least number under the premise of satisfying the success rate) as the optimal solution from the successful set.

[0108] Figure 4 We show that using α=2 and M β = 8. The process is based on the success rate (SR) and efficiency (EFF), with a success threshold of τ = 0.9.

[0109] According to the above description, if Figure 5-6 As shown, the specific methods include:

[0110] A1. Create a tried patch parameter set V and a successful patch parameter set Vs, both of which are empty sets at the beginning, and create a current layer node set ;

[0111] A2. Determine whether the number of nodes in the current layer node set L is greater than 0. If so, proceed to step A3; otherwise, proceed to step A7;

[0112] A3. For each node in L , respectively use α , M β The patch generation algorithm generates d ω ,Will d ω Add to set V; judge d ω Is the success rate greater than or equal to the success threshold? t If so, then dω Add to the set Vs, otherwise, remove the corresponding node from L;

[0113] A4. Initialize an empty set C for storing child nodes;

[0114] A5. For each node in L ,like α >1, then add a new child node to set C; if M β >1, then add a new child node to set C;

[0115] A6. Replace the current layer node set L with the child node set C for the next round of search;

[0116] A7. Determine whether the number of patch parameter set Vs is greater than 0. If so, select an optimal patch parameter from Vs. d ω As output; otherwise, select the optimal patch parameters from V d ω as output.

[0117] S3, patch injection: inject the optimized adversarial patch into the original traffic data through the injection controller to shape the original traffic data;

[0118] The patch injection function needs to be able to shape network traffic in real time, which means it must be able to quickly determine the injection point and insert the false data packet (patch) into the traffic without affecting normal data transmission. Due to the dynamic nature of network traffic, the patch injection function must be able to adapt to changes in traffic, including different packet sizes, transmission rates, and burst modes. When injecting false packets, the patch injection function cannot destroy the integrity of the original packet sequence, and it also needs to maintain the priority of data transmission to ensure that the user experience is not affected.

[0119] The injection process is as follows:

[0120] Step 1, patch sorting: Sort all patches according to their intended injection locations to determine the order of injection. This is usually based on the injection point and direction of the patch.

[0121] Step 2, Traffic Location: Determine the exact location in the traffic trace where the patch should be injected. This may involve analyzing the pattern of the traffic trace to find the best injection point, such as the tail of the traffic trace or the gap in a specific packet sequence.

[0122] Step 3, patch injection: actually inject the patch data packet into the traffic. This requires ensuring that the injected data packet does not destroy the integrity of the original traffic and at the same time achieves the purpose of disrupting fingerprint recognition.

[0123] Each perturbation patch in the adversarial vector δ is injected into the tail of the data packet in the same direction, so that the perturbation can adapt to the different traffic characteristics of the same device while minimizing the delay. Figure 7-8 As shown, the specific steps are as follows:

[0124] S301, for each index i of the disturbance vector δ, i from 1 to α, the original flow x is β i The position of the tail of the most recent packet with the same direction is pi';

[0125] S302, if the injection position pi' is between (p1', ···, p α '), then remove the repeated patches δi from the perturbation vector δ, let x' ← x, and sort δ in the reverse order of pi';

[0126] S303, for each patch in δ , the data packet (x p1 ',···,x n-|βi | ') Move to position pi' + | βi |, inject at position pi' of x'| β i | direction is sign ( β i ) of false data packets, p i is the current data packet sequence, n is the maximum number of sequences, x p1 ' and x n-|βi | ' is the data packet corresponding to the subscript sequence;

[0127] S304, after processing each patch in δ, output x', that is, the flow data after disturbance / patch injection.

[0128] S4. Perform classification tests on the data before and after shaping through the trained DNN classifier, and compare the results through the evaluation module to evaluate the shaping effect on the traffic data.

[0129] The performance of several existing DNN models for network traffic identification, such as AWF, DF, and Var-CNN, are three different deep neural network (DNN) models that are designed for website fingerprinting (WF) attacks to automatically identify and classify users' network traffic patterns.

[0130] The experiment mainly uses Keras based on the TensorFlow framework to build the neural network and uses the Pandas library to process the data. The environment of this experiment is AMD Ryzen 3700X CPU, NVIDIA RTX 4070Ti 12G GPU and 32G memory. It is configured and run under the Windows 10 operating system.

[0131] The experiment is based on the public WF dataset Shriam, which contains website access traffic records of users using the Tor network. The traffic data in these datasets are used to train and test DNN models, as well as to generate and evaluate adversarial patches for Minipatch.

[0132] In terms of Minipatch configuration, four different sets of The combination of the two types of data packets is used to inject up to 8, 32, 128 and 512 packets respectively. The median length of the network traffic data Xω is taken as the patch injection position p i boundaries.

[0133] The evaluation indicators mainly include the perturbation success rate (SR) and bandwidth overhead (BWO). The perturbation success rate measures the ability of Minipatch to reduce the accuracy of the DNN model, while the bandwidth overhead focuses on the impact of the adversarial patch on the original traffic size.

[0134] The experimental results are as follows Figure 9 As shown in the figure, Minipatch can still effectively reduce the recognition accuracy of the DNN model when injecting a small number of false data packets, with a perturbation success rate of more than 97%, and the impact of the adversarial patch on the original traffic size is controlled below 5%, demonstrating its efficient defense performance.

[0135] In terms of perturbation transferability, adversarial perturbations computed for a given DNN model will be transferred between models. This feature is essential for WF defense because we will use a white-box model to create its adversarial perturbations and then apply them to unknown black-box models. We first generate perturbation patches for each DNN model and apply them to different recognition models separately. We then evaluate the success rate for each model.

[0136] Figure 10The results are presented in the form of a heatmap matrix. Comparing the three DNN models, we observe that the perturbations generated for DF have the highest transferability, achieving 89.7% and 91.1% success rates for AWF and Var-CNN respectively on the Sirinam dataset. In contrast, the perturbations calculated for AWF are much less transferable between models, indicating that DNNs with simple structures are not suitable for white-box models generated by Minipatch.

[0137] For the algorithm using multi-objective optimization, according to the above transfer rate data, the algorithm will place more weight on the disturbance generated by DF. Experiments show that the transfer rates of the disturbances after multi-objective optimization between the three models are 92.7%, 96.3%, and 94.7%, respectively, and the average transfer rate is 94.6%. Its transferability is better than the disturbance generated based on a single model.

[0138] Table 1

[0139]

[0140] In subsequent experiments, we compared Minipatch with four adversarial WF defense methods: Mockingbird, Blind, AWA, and Dolos. The results in Table 1 show that Minipatch substantially outperforms other adversarial WF defense methods in terms of bandwidth overhead and perturbation success rate. And the bandwidth overhead is less than one-fifth of that of other methods. This is very meaningful for real-world deployment.

[0141] Finally, it should be noted that the above-mentioned control method can be converted into software program instructions, which can be implemented by using a control system including a processor and a memory, or by computer instructions stored in a non-transitory computer-readable storage medium. The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0142] In summary, the above-mentioned traffic shaping system based on deep learning and adversarial strategy has the following beneficial effects:

[0143] (1) The present invention is a breakthrough network traffic shaping method, which is specially designed to resist website fingerprinting WF attacks based on deep neural network DNN. It takes advantage of the characteristic of DNN being sensitive to small input disturbances and injects a small amount of false data packets into real-time network traffic to change the traffic pattern, thereby interfering with WF attacks. It preliminarily generates adversarial patches by adding a dual simulated annealing algorithm with a multi-objective optimization algorithm, and optimizes the adversarial patches through adaptive adjustment strategies and bandwidth overhead adjustment strategies, so that it can generate efficient adversarial patches for different website traffic patterns. Through adaptive parameter adjustment, Minipatch technology has achieved important technical progress in protecting user privacy and resisting complex attacks in the field of network security. It thus improves the resistance and privacy security protection capabilities of IoT devices in the face of device identification and traffic analysis attacks.

[0144] (2) This invention significantly improves user privacy protection with extremely low bandwidth overhead by injecting adversarial patches into network traffic in real time. Its core innovation lies in its lightweight defense mechanism, which can achieve a protection success rate of more than 97% with a bandwidth overhead of no more than 5%. Compared with traditional WF defense methods, it is lighter but more efficient and more robust.

[0145] (3) The present invention adopts black-box feedback optimization, which does not require the internal information of the target DNN model, enhancing the practicality and feasibility of deployment; the present invention also exhibits excellent cross-model transferability, providing it with potential as a general defense framework.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the embodiments of the present invention are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations shall fall within the scope defined by the appended claims.

Claims

1. A traffic shaping method based on deep learning and adversarial strategy, characterized in that: include: S1. Monitor network traffic in real time through traffic monitors, capture traffic data information, and perform data preprocessing. Extract traffic features through preprocessed traffic data and train DNN classifiers. S2. Input the trained DNN classifier and traffic data into the patch generation module, preliminarily generate adversarial patches according to the dual simulated annealing algorithm with a multi-objective optimization algorithm, and optimize the adversarial patches through an adaptive adjustment strategy and a bandwidth overhead adjustment strategy; S3, patch injection: inject the optimized adversarial patch into the original traffic data through the injection controller to shape the original traffic data; The S2 includes: S201, random starting point and by α, N, M β Constraint; Initial Energy E, E transfer ，E b ; Let the current iteration number t=1, and the access step i=1; Convert the generation of adversarial patches into solving an optimization problem, let: in, is the current adversarial patch vector, is the best adversarial patch vector, α is the number of patches, N and M β are injection and package boundaries, E is the current patch vector δ The corresponding energy, E for E transfer and E misclassification The weighted sum of E transfer is the current patch vector δ The corresponding migration energy, E misclassification is the current patch vector δ The corresponding misclassification energy, E b is the best patch vector δ b The corresponding energy, is the DNN classifier f ω The set of traffic vectors of correctly classified website ω, Φ is the patch injection function; S202: Determine whether the current number of iterations t is less than or equal to the maximum number of iterations M t If yes, calculate the current temperature T and go to step S203. Otherwise, output δ ω is the best patch vector δ b ,Finish; Where T0 is the initial temperature, q v To access the parameters, δ ω is the perturbation vector applied to the site ω; S203: Determine whether access step i is less than or equal to , if so, then the neighboring points , proceed to step S204; represents a neighboring point or a candidate solution, which is a new patch vector generated during the simulated annealing process; otherwise, the loop ends and enters step S211; S204: Determine whether access step i is less than or equal to , if so, then ;otherwise, ;Π[ q v , T , d ] represents generating a new neighboring solution according to the access distribution in the simulated annealing algorithm, Π is the point access function, q v is the access parameter, T is the current temperature, d is the dimension of the solution; S205, based on and Calculate misclassification energy E' misclassification ,based on and f other Calculation of mobility energy E' transfer , and then calculate the new energy: ; E' misclassification represents the misclassified part of the new energy, E' transfer represents the migratory part of the new energy, f other represents a collection of other models used to evaluate transferability, w represents the target weight used to balance the misclassification rate and transferability; S206: Determine whether E' < E or E' Better meet the Pareto criterion, if so, accept As , Current Energy E , E transfer ← E' , E' transfer , go to step S207; otherwise, go to step S209; S207: Determine whether E' < E b , according to the Pareto criterion, if , then δ b ← δ', E b ← E' , go to step S208; otherwise, go to step S208; S208: Determine whether The success rate exceeds the success threshold τ. If so, then output δ b , go to step S210; otherwise, go to step S210; S209, determine whether E'-E ≤ Pr(t) and Pr(t)>rand(0,1), if so, accept As , Current Energy E , E transfer ← E' , E' transfer , go to step S210; otherwise, go to step S210; Pr() is the Pareto criterion function, and rand() is the random function; S210, proceed from arrive Local search, updated according to the Pareto criterion, repeat steps S205 to S209, i = i + 1, return to step S203; S211, t=t+1, return to step S202.

2. The traffic shaping method based on deep learning and adversarial strategy according to claim 1, characterized in that: The S2 also optimizes parameters through adaptive adjustment strategy and bandwidth overhead adjustment strategy, which is converted into: Among them, f w is a DNN classifier, is the traffic vector after applying the current patch vector δ, and y is the correct classification label of the original traffic.

3. The traffic shaping method based on deep learning and adversarial strategy according to claim 2 is characterized in that: The adaptive adjustment strategy and bandwidth overhead adjustment strategy include: A1. Create a tried patch parameter set V and a successful patch parameter set Vs, both of which are empty sets at the beginning, and create a current layer node set , α is the number of patches, N and M β The boundaries of injection and package respectively; A2. Determine whether the number of nodes in the current layer node set L is greater than 0. If so, proceed to step A3; otherwise, proceed to step A7; A3. For each node in the current layer node set L , respectively use α , M β The patch generation algorithm generates δ ω ,Will δ ω Add to the tried patch parameter set V; judge δ ω Is the success rate greater than or equal to the success threshold τ? If so, δ ω Add it to the successful patch parameter set Vs, otherwise, remove the corresponding node from the current layer node set L; A4. Initialize an empty child node set C; A5. For each node in the current layer node set L ,like α >1, then add a new child node To the child node set C; if M β >1, then add a new child node To the child node set C; A6. Replace the current layer node set L with the child node set C for the next round of search; A7. Determine whether the number of successful patch parameter sets Vs is greater than 0. If so, select an optimal patch parameter from Vs. δ ω As output; otherwise, select the optimal patch parameter from the tried patch parameter set V δ ω as output.

4. The traffic shaping method based on deep learning and adversarial strategy according to claim 1, characterized in that: The S3 includes: S301, for each index i of the disturbance vector δ, i from 1 to α, the original flow x is β i The position of the tail of the most recent packet with the same direction is p i '; S302, if the injection position p i 'In (p1', · · ·, p α '), then the repeated patches δ are removed from the perturbation vector δ i , let the disturbed flow x' ← x, according to p i Sort the perturbation vector δ in reverse order of '; S303, for each patch in the perturbation vector δ , the data packet (x p1 ',···,x n-|βi | ') Move to position p i '+ | β i |, at the position p of the disturbed flow x' i 'Injection| β i | direction is sign ( β i ) of false data packets; p i is the current data packet sequence, n is the maximum number of sequences, x p1 ' and x n-|βi | ' is the data packet corresponding to the subscript sequence; S304 , after processing each patch in the disturbance vector δ, output the disturbed flow x′.

5. The traffic shaping method based on deep learning and adversarial strategy according to claim 1, characterized in that: The S3 also includes: S4. Perform classification tests on the data before and after shaping through the trained DNN classifier, and compare the results through the evaluation module to evaluate the shaping effect on the traffic data.

6. A traffic shaping system based on deep learning and adversarial strategy, characterized in that: include: The traffic monitor, patch generator and injection controller respectively run S1, S2, and S3 of the traffic shaping method based on deep learning and adversarial strategy described in any one of claims 1-5.

7. The traffic shaping system based on deep learning and adversarial strategy according to claim 6, characterized in that: Also includes: Evaluation module.

8. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which enable a computer to execute the method according to any one of claims 1 to 5.

Images