Method for generating network traffic general disturbance patch based on superposition and confusion

Abstract

The invention discloses a network traffic general disturbance patch generation method based on superposition and confusion, which comprises the following steps of: firstly defining an initial general disturbance patch, adding a current general disturbance patch into traffic when generating an anti-disturbance patch for the traffic, and then generating the anti-disturbance patch by using a differential evolution algorithm. And then, immediately carrying out dynamic superposition and real-time mixing on the generated anti-disturbance patch and the general disturbance patch, and updating the general disturbance patch. A final universal disturbance patch of the website is obtained in a mode of superimposing and confusing disturbance generated by each piece of flow of the website. The general disturbance patch generated by the method can still make most of the traffic misclassified when facing the classification of a classifier enhanced by adversarial training, and solves the problems that the current website fingerprint defense based on adversarial samples is difficult to resist the attack of the classifier enhanced by adversarial training, so that the privacy of a user is leaked, and the user experience is poor. And the user information security is threatened.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for generating a universal disturbance patch for network traffic based on superposition obfuscation. Background Art

[0002] With the growth of Internet usage, network privacy protection has become a common demand of Internet users. Tor, an anonymous network based on onion routing, has become one of the most popular Internet privacy enhancement technologies. However, the Tor network is vulnerable to website fingerprint attacks. Website fingerprint attacks are a type of traffic analysis attack that can allow local passive eavesdroppers to learn the websites that anonymous users are visiting, posing a great threat to the privacy security of network users.

[0003] In order to deal with the threat of website fingerprint attacks, many website fingerprint defense schemes have been proposed. Among them, website fingerprint defense based on adversarial samples has attracted widespread attention due to its superior performance and low bandwidth overhead. However, the adversarial perturbation generation method currently cannot achieve a satisfactory misclassification rate when faced with the classification of the classifier enhanced by adversarial training, and thus cannot effectively confuse the traffic, making it difficult to protect the privacy of users when visiting websites. Therefore, the current website fingerprint defense scheme based on adversarial samples has deficiencies in defense performance. Summary of the invention

[0004] In order to solve the above-mentioned problem that the current website fingerprint defense scheme based on adversarial samples has insufficient defense performance, the present invention discloses a method for generating a universal perturbation patch for network traffic based on superposition obfuscation. This method targets the network traffic generated when a Tor user visits a certain website W, and enhances the performance of the universal perturbation Δw by iteratively performing superposition obfuscation of the adversarial perturbation Δ and the universal perturbation Δw. When facing the classification of a classifier strengthened by adversarial training, most of the traffic can still be misclassified, thereby improving the practical application value of the website fingerprint defense scheme based on adversarial samples and realizing the protection of the privacy security of anonymous traffic users.

[0005] Technical solution: A general disturbance generation method for network traffic based on superposition obfuscation of the present invention comprises the following steps:

[0006] Step (1): Generate a single traffic anti-disturbance patch based on differential evolution algorithm

[0007] Since the packet size in Tor is a fixed value, we can ignore the packet size feature and represent network traffic as a sequence of "+1" and "-1" packets.

[0008] The universal perturbation patch is added to the current traffic to determine whether the current traffic is misclassified. If misclassification occurs, the universal perturbation patch is added to the next traffic and the judgment is continued; if misclassification does not occur, the differential evolution algorithm is used to optimize the L2 norm distance between the perturbed traffic and the template traffic. After multiple iterations, the adversarial perturbation patch for the current traffic is obtained.

[0009] The training objective function of the classifier used to determine whether the traffic after adding the universal perturbation patch is misclassified is:

[0010]

[0011] where x∈[x 1 ,x 2 ,…,x n ].

[0012] We give the following optimization objective function, namely:

[0013] Δ i =argmin Δ L 2 (x i +Δ w , x t )

[0014] Where M is the maximum number of packets allowed to be inserted into the adversarial perturbation patch, N represents the position range of the inserted packets, and Δw represents the current universal perturbation patch, which can be expressed as [<p1,±n1> ,<p2,±n2> …], which contains multiple<p,±n> For any two-tuple<pi,±ni> , pi represents the position where the data packet is inserted in the flow, ni represents the number of inserted data packets. L2 represents the L2 norm distance between two flows.

[0015] The perturbation patch is in the form of a series of<location,±num> A list of two-tuples, specifically [<location1,±num1> ,<location2,±num2> ……]. The value of location indicates the location of the traffic where the data packet is inserted, num indicates the number of inserted data packets, and ± indicates the direction of inserting the data packet, i.e., “+1” or “-1”.<location,±num> The tuples are sorted from small to large according to the value of location.

[0016] Step (2), dynamic adversarial disturbance patch superposition;

[0017] Since a complete universal perturbation patch is ultimately required, after generating an adversarial perturbation patch for each flow, the adversarial perturbation patch obtained in step (1) needs to be added to the current universal perturbation patch to form a complete perturbation patch.

[0018] Step (3), real-time obfuscation of the traffic universal perturbation patch;

[0019] The universal perturbation patch obtained in step (2) is a perturbation patch formed by simply superimposing the adversarial perturbation patch generated by the current traffic with the universal perturbation patch of the previous stage.<location,±num> The binary groups are still disordered, so it is necessary to confuse the binary groups inside the perturbation patch in real time according to the insertion position of the patch, and sort them into new universal perturbation patches that conform to the actual insertion rules according to the insertion position.

[0020] By generating adversarial perturbation patches Δ for all traffic of website W in the dataset in turn, the universal perturbation patch Δw is continuously updated. After all traffic processing is completed, the final universal perturbation patch Δw is obtained.

[0021] Step (4), judging the effectiveness of the general traffic disturbance patch;

[0022] The final universal perturbation patch Δw of the website should meet the standard of misclassifying most of the traffic of the website in the data set. Therefore, it is necessary to set the corresponding threshold to make a judgment to evaluate the effectiveness of the universal perturbation patch. If after adding a universal perturbation patch to each traffic of the website, more than the threshold ratio of traffic is misclassified, it means that the perturbation patch is effective; otherwise, the universal perturbation patch of the website will be regenerated.

[0023] Furthermore, in step (1), a single traffic anti-disturbance patch is generated based on the differential evolution algorithm, and the specific process is as follows:

[0024] a) Define the initial universal perturbation patch Δw

[0025] When generating a disturbance patch for each flow, the current general disturbance patch needs to be inserted into the current flow first. After the classifier determines that no misclassification has occurred, the differential evolution algorithm is used to generate an adversarial disturbance patch. Therefore, it is necessary to define the initial value of the general disturbance patch to facilitate the generation of the adversarial disturbance patch for the first flow, and to perform the superposition and confusion of the general disturbance patch and the adversarial disturbance patch later. In this method, the value of the initial general disturbance patch is set to [<0,0>]. The optimization goal we give is:

[0026] Δ i =argmin Δ L 2 (xi +Δ w , x t )

[0027]

[0028] Where M is the maximum number of packets allowed to be inserted into the adversarial perturbation patch, N represents the position range of the inserted packets, and Δw represents the current universal perturbation patch, which can be expressed as [<p1,±n1> ,<p2,±n2> …], which contains multiple<p,±n> For any two-tuple<pi,±ni> , pi represents the position where the data packet is inserted in the flow, ni represents the number of inserted data packets. L2 represents the L2 norm distance between two flows.

[0029] b) Add the universal disturbance patch Δw to the current traffic

[0030] Assume that the current flow is xi (1≤i≤s), and the current general disturbance patch is Δw = [<location1,±num1> ,<location2,±num2> ……], where each<location,±num> The tuples are arranged in ascending order according to the value of location.

[0031] First, insert the universal perturbation patch Δw into the traffic xi. Use the forward and sequential packet insertion method to add interference packets to the traffic. Specifically, the data after location1 in the traffic is uniformly shifted back by |num1| positions, and |num1| "+1" or "-1" is added at location1 according to the sign of num1.<location1,±num1> Insertion. Then complete the above sequence<location2,±num2> ,<location3,±num3> ... until each of Δw is completed.<location,±num> After the insertion of the binary, a universal perturbation patch Δw is added to the traffic.

[0032] c) Adversarial perturbation patch generation

[0033] After adding the universal perturbation patch Δw to the current traffic xi, the auxiliary classifier M trained in advance to correctly classify the traffic of website W is used to classify it and determine whether xi is misclassified at this time.

[0034] If misclassification occurs, it means that the current general perturbation patch is effective, and there is no need to generate an adversarial perturbation patch, and the adversarial perturbation patch Δ is set to empty; if no misclassification occurs, the differential evolution algorithm is used to set the optimization target to the L2 norm distance between xi and xt after adding Δw. By minimizing the optimization target, the adversarial perturbation patch Δ that can make xi.

[0035] Assuming xi={a1,a2,a3……as}, xt={b1,b2,b3……bs}, the L2 norm distance l between the two can be expressed as:

[0036]

[0037] Furthermore, the specific process of superimposing the dynamic countermeasure disturbance patch in step (2) is as follows:

[0038] Since a universal perturbation patch needs to be obtained in the end, after generating an adversarial perturbation patch for a traffic each time, it needs to be superimposed with the current universal perturbation patch to form a complete perturbation patch.

[0039] Assuming that the current general perturbation patch Δw = [<4,-3>,<7,5>] and the adversarial perturbation patch Δ = [<1,3>,<5,9>], the superimposed perturbation patch is [<4,-3>,<7,5>,<1,3>,<5,9>].

[0040] Furthermore, the specific process of real-time obfuscation of the universal traffic disturbance patch in step (3) is as follows:

[0041] In the actual process of inserting virtual data packets, data packets can only be inserted into the traffic in the order of position from small to large. As shown in step (2), in the universal perturbation patch Δw,<location,±num> The binary tuples are sorted from small to large according to the value of location, but this order no longer exists after the two are superimposed. Therefore, after superimposing the adversarial perturbation patch and the universal perturbation patch, it is necessary to reorder all the binary tuples in the perturbation patch according to the size of location to generate a new universal perturbation patch Δw. The reordering confuses the order of the binary tuples inside the perturbation patch, increases the diversity and practicality of the universal perturbation patch, and obtains an effective perturbation patch that conforms to the actual data packet insertion operation.

[0042] Δw=[<4,-3>,<7,5>]

[0043] Δ=[<1,3>,<5,9>]

[0044] Δw=sort(Δw+Δ)

[0045] =sort([<4,-3>,<7,5>,<1,3>,<5,9>])

[0046] =[<1,3>,<4,-3>,<5,9>,<7,5>]

[0047] After sorting, the updated universal perturbation patch Δw = [<1,3>,<4,-3>,<5,9>,<7,5>] is obtained.

[0048] This superposition obfuscation operation is performed until every flow in the dataset is processed and the final universal perturbation patch Δw is obtained.

[0049] Furthermore, the specific process of judging the effectiveness of the universal traffic disturbance patch in step (4) is as follows:

[0050] The universal perturbation patch of the website is inserted into each flow of the website in the dataset using a forward and sequential packet insertion method. All the traffic of the website is classified using the pre-trained classifier M. The judgment condition is as follows, where X is a traffic dataset consisting of part of the traffic of a certain website W, and η is the threshold:

[0051]

[0052] Assume that the effectiveness threshold we set is 95%, that is, if more than 95% of the total traffic of the website is misclassified, then the perturbation patch is effective and can be used as an actual defense scenario; otherwise, a general perturbation patch for the website will be regenerated.

[0053] The universal perturbation patch Δw generated through all the above steps can still misclassify most of the traffic when classified by the classifier enhanced by adversarial training. It has good performance in confusing traffic features and can better protect the user's network privacy.

[0054] Beneficial effects of the present invention:

[0055] 1. Aiming at the problem that the universal perturbation patch generated by the existing website fingerprint defense based on adversarial samples cannot effectively resist adversarial training, the present invention selects different template traffic xt for each website, uses the differential evolution algorithm, minimizes the L2 norm distance between the traffic xi and the template traffic xt to generate an adversarial perturbation patch Δ, and iteratively superimposes and confuses the adversarial perturbation patch Δ with the universal perturbation patch Δw, and finally obtains the universal perturbation patch Δw that can still misclassify most of the traffic when facing the classification of the classifier enhanced by adversarial training, thereby improving the practical application value of the website fingerprint defense solution based on adversarial samples and realizing the protection of the privacy security of anonymous traffic users.

[0056] 2. The present invention uses a differential evolution algorithm to quickly generate disturbance patches that can cause traffic misclassification.

[0057] 3. The present invention adopts a method based on superimposing confusion between the adversarial perturbation patch and the universal perturbation patch, iteratively merges and rearranges the adversarial perturbation patch and the universal perturbation patch, and continuously updates the universal perturbation patch until the traffic in the data set generates an adversarial perturbation patch. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a schematic diagram of the overall process of the present invention;

[0059] Figure 2 Schematic diagram of generating a single traffic adversarial disturbance patch based on differential evolution algorithm;

[0060] Figure 3 Schematic diagram of real-time confusion of dynamic adversarial perturbation patch superposition and traffic general perturbation patch. DETAILED DESCRIPTION

[0061] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0062] In this embodiment, for a traffic data set {x1, x2, x3...xs} consisting of part of the traffic of a certain website W, a classifier M is first trained to correctly classify the traffic category of the website W, and a template traffic xt is selected for the website W, and the initial universal perturbation patch Δw is defined as empty. When generating an adversarial perturbation patch for a traffic xi, the current universal perturbation patch Δw needs to be added to the traffic xt. i After that, determine whether misclassification occurs. If misclassification occurs, skip x i , add Δw to x i+1 After that, a judgment is made; if no misclassification occurs, the L2 norm distance between the traffic xi after the disturbance patch is inserted and the template traffic xt is used as the optimization target, and the differential evolution algorithm is used to generate the adversarial disturbance patch Δ for the traffic xi. Immediately afterwards, the generated adversarial disturbance patch Δ is superimposed and confused with the universal disturbance patch Δw to obtain the updated universal disturbance patch Δw. Starting from the first traffic x1, until every traffic in the data set is processed, the final universal disturbance patch Δw is obtained. The final universal disturbance, after being judged for its effectiveness, can be used as a universal disturbance patch that can be used on the website. The overall process is as follows: Figure 1 shown.

[0063] The specific steps of this embodiment are:

[0064] Step (1), generating a single traffic anti-disturbance patch based on a differential evolution algorithm;

[0065] Since the packet size in Tor is a fixed value, we can ignore the packet size feature and represent network traffic as a sequence of "+1" and "-1" packets.

[0066] Add the universal perturbation patch to the current traffic to determine whether the current traffic is misclassified. If misclassification occurs, add the universal perturbation patch to the next traffic and continue to determine; if misclassification does not occur, use the differential evolution algorithm to optimize the L2 norm distance between the perturbed traffic and the template traffic. After multiple iterations, the adversarial perturbation patch for the current traffic is obtained. The generation process of the adversarial perturbation patch is as follows: Figure 2 shown.

[0067] Step (2), dynamic adversarial disturbance patch superposition;

[0068] Since a complete universal perturbation patch is ultimately required, after generating an adversarial perturbation patch for each flow, the adversarial perturbation patch obtained in step (1) needs to be added to the current universal perturbation patch to form a complete perturbation patch.

[0069] Step (3), real-time obfuscation of the traffic universal perturbation patch;

[0070] The universal perturbation patch obtained in step (2) is a perturbation patch formed by simply superimposing the adversarial perturbation patch generated by the current traffic with the universal perturbation patch of the previous stage.<location,±num> The binary groups are still disordered, so it is necessary to confuse the binary groups inside the disturbance patch in real time according to the insertion position of the patch, and sort them into new universal disturbance patches that conform to the actual insertion rules according to the insertion position. The real-time obfuscation process of dynamic adversarial disturbance patch superposition and traffic universal disturbance patch is as follows: Figure 3 shown.

[0071] By generating adversarial perturbation patches Δ for all traffic of website W in the dataset in turn, the universal perturbation patch Δw is continuously updated. After all traffic processing is completed, the final universal perturbation patch Δw is obtained. ;

[0072] Step (4): Determine the effectiveness of the traffic general disturbance patch

[0073] The final universal perturbation patch Δw of the website should meet the standard of misclassifying most of the traffic of the website in the data set. Therefore, it is necessary to set the corresponding threshold to make a judgment to evaluate the effectiveness of the universal perturbation patch. If after adding a universal perturbation patch to each traffic of the website, more than the threshold ratio of traffic is misclassified, it means that the perturbation patch is effective; otherwise, the universal perturbation patch of the website will be regenerated.

[0074] The detailed process of the algorithm is:

[0075]

[0076]

[0077] Algorithm explanation:

[0078] Assume that there is a site W that needs to be protected, and part of its traffic constitutes a traffic data set X = {x1, x2, x3...xs}. Now it is necessary to generate an adversarial perturbation patch for each traffic in the data set, and iteratively superimpose and confuse the adversarial perturbation patch and the universal perturbation patch, and continuously update the universal perturbation patch. The final universal perturbation patch Δw can still misclassify most of the traffic when facing the classification of the classifier enhanced by adversarial training. At the beginning, the universal perturbation patch Δw of website W is set to 0.

[0079] First, we need to generate an adversarial perturbation patch for the first traffic x1 in the data set. Run the differential evolution algorithm to obtain an adversarial perturbation patch Δ that can minimize the L2 norm distance between x1 and the template traffic xt. Superimpose and confuse the adversarial perturbation patch Δ with the universal perturbation patch Δw to obtain a new universal perturbation patch Δw. Then, we start generating adversarial perturbation patches for x2.

[0080] Before generating the adversarial perturbation patch for x2, first determine whether the universal perturbation patch Δw can misclassify x2. If it can, it means that Δw is effective for x2, and the adversarial perturbation patch Δ is set to empty; if not, Δw is added to x2, and x2=x2+Δw is updated. Then, the differential evolution algorithm is used to minimize the L2 norm distance between x2 and xt, generate the adversarial perturbation patch Δ, and superimpose and confuse the adversarial perturbation patch Δ with the universal perturbation patch Δw to obtain a new universal perturbation patch Δw. Then, the perturbation patch generation for x3 begins.

[0081] According to the above process, after the disturbance patch generation is completed for the last flow xs, the final universal disturbance patch Δw is obtained and the process ends.

[0082] The final Δw is a universal perturbation patch that can still misclassify most traffic when using a classifier that has been enhanced through adversarial training. Therefore, this perturbation patch can effectively resist adversarial training and improve the practical application value of current website fingerprint defense based on adversarial samples.

[0083] Example:

[0084] This implementation is based on the above technical solution and uses Tor, one of the most popular Internet privacy enhancement technologies, as a carrier for traffic generation and acquisition to perform website fingerprint obfuscation defense.

[0085] Step 1: Generate a single traffic anti-disturbance patch based on the differential evolution algorithm

[0086] The specific process is:

[0087] a) Define the initial universal perturbation patch Δw

[0088] When generating a disturbance patch for each flow, the current general disturbance patch needs to be inserted into the current flow first. After the classifier determines that no misclassification has occurred, the differential evolution algorithm is used to generate an adversarial disturbance patch. Therefore, it is necessary to define the initial value of the general disturbance patch to facilitate the generation of the adversarial disturbance patch for the first flow, and to perform the superposition and confusion of the general disturbance patch and the adversarial disturbance patch later. In this method, the value of the initial general disturbance patch is set to [<0,0>]. The optimization goal we give is:

[0089] Δ i =argmin Δ L 2 (x i +Δ w , x t )

[0090]

[0091] Where M is the maximum number of packets allowed to be inserted into the adversarial perturbation patch, N represents the position range of the inserted packets, and Δw represents the current universal perturbation patch, which can be expressed as [<p1,±n1> ,<p2,±n2> …], which contains multiple<p,±n> For any two-tuple<pi,±ni> , pi represents the position where the data packet is inserted in the flow, ni represents the number of inserted data packets. L2 represents the L2 norm distance between two flows.

[0092] b) Add the universal disturbance patch Δw to the current traffic

[0093] Assume that the current flow is xi (1≤i≤s), and the current general disturbance patch is Δw = [<location1,±num1> ,<location2,±num2> ……], where each<location,±num> The tuples are arranged in ascending order according to the value of location.

[0094] First, insert the universal perturbation patch Δw into the traffic xi. Use the forward and sequential packet insertion method to add interference packets to the traffic. Specifically, the data after location1 in the traffic is uniformly shifted back by |num1| positions, and |num1| "+1" or "-1" is added at location1 according to the sign of num1.<location1,±num1> Insertion. Then complete the above sequence<location2,±num2> ,<location3,±num3> ... until each of Δw is completed.<location,±num> After the insertion of the binary, a universal perturbation patch Δw is added to the traffic.

[0095] c) Adversarial perturbation patch generation

[0096] After adding the universal perturbation patch Δw to the current traffic xi, the auxiliary classifier M trained in advance to correctly classify the traffic of website W is used to classify it and determine whether xi is misclassified at this time.

[0097] If misclassification occurs, it means that the current general perturbation patch is effective, and there is no need to generate an adversarial perturbation patch, and the adversarial perturbation patch Δ is set to empty; if no misclassification occurs, the differential evolution algorithm is used to set the optimization target to the L2 norm distance between xi and xt after adding Δw. By minimizing the optimization target, the adversarial perturbation patch Δ that can make xi.

[0098] Assuming xi={a1,a2,a3……as}, xt={b1,b2,b3……bs}, the L2 norm distance l between the two can be expressed as:

[0099]

[0100] Step 2: Dynamic adversarial perturbation patch superposition

[0101] The specific process is:

[0102] Since a universal perturbation patch needs to be obtained in the end, after generating an adversarial perturbation patch for a traffic each time, it needs to be superimposed with the current universal perturbation patch to form a complete perturbation patch.

[0103] Assuming that the current general perturbation patch Δw = [<4,-3>,<7,5>] and the adversarial perturbation patch Δ = [<1,3>,<5,9>], the superimposed perturbation patch is [<4,-3>,<7,5>,<1,3>,<5,9>].

[0104] Step 3: Traffic general perturbation patch real-time obfuscation

[0105] The specific process is:

[0106] In the actual process of inserting virtual data packets, data packets can only be inserted into the traffic in the order of position from small to large. As shown in step (2), in the universal perturbation patch Δw,<location,±num> The binary tuples are sorted from small to large according to the value of location, but this order no longer exists after the two are superimposed. Therefore, after superimposing the adversarial perturbation patch and the universal perturbation patch, it is necessary to reorder all the binary tuples in the perturbation patch according to the size of location to generate a new universal perturbation patch Δw. The reordering confuses the order of the binary tuples inside the perturbation patch, increases the diversity and practicality of the universal perturbation patch, and obtains an effective perturbation patch that conforms to the actual data packet insertion operation.

[0107] Δw=[<4,-3>,<7,5>]

[0108] Δ=[<1,3>,<5,9>]

[0109] Δw=sort(Δw+Δ)

[0110] =sort([<4,-3>,<7,5>,<1,3>,<5,9>])

[0111] =[<1,3>,<4,-3>,<5,9>,<7,5>]

[0112] After sorting, the updated universal perturbation patch Δw = [<1,3>,<4,-3>,<5,9>,<7,5>] is obtained.

[0113] This superposition obfuscation operation is performed until every flow in the dataset is processed and the final universal perturbation patch Δw is obtained.

[0114] Step 4: Determine the effectiveness of the traffic general disturbance patch

[0115] The specific process is:

[0116] The universal perturbation patch of the website is inserted into each flow of the website in the dataset using a forward and sequential packet insertion method. All the traffic of the website is classified using the pre-trained classifier M. The judgment condition is as follows, where X is a traffic dataset consisting of part of the traffic of a certain website W, and η is the threshold:

[0117]

[0118] Assume that the effectiveness threshold we set is 95%, that is, if more than 95% of the total traffic of the website is misclassified, then the perturbation patch is effective and can be used as an actual defense scenario; otherwise, a general perturbation patch for the website will be regenerated.

[0119] Through this superposition obfuscation operation, until every flow in the data set is processed, the final universal perturbation patch Δw is obtained. We generate a universal perturbation patch pool for the websites W1, W2...Wn that need to be protected in advance. When a user visits the website Wi, we select the universal perturbation patch of Wi from the pool and insert virtual data packets into the user traffic according to the universal perturbation patch to confuse the characteristics of the traffic. This universal perturbation patch Δw can still misclassify most of the traffic when classified by the classifier enhanced by adversarial training. It has good performance in obfuscating traffic characteristics and can better protect the user's network privacy.

[0120] The above embodiments show that the present invention generates a universal disturbance patch for website traffic by superimposing obfuscation, thereby improving the ability of the disturbance patch to resist adversarial training and avoiding the risk of user communication information leakage. On this basis, the present invention uses a differential evolution algorithm to quickly generate an adversarial disturbance patch; and uses the adversarial disturbance patch and the universal disturbance patch to continuously superimpose obfuscation to continuously update the universal disturbance patch until all adversarial disturbance patches are generated for the traffic in the data set, and the final universal disturbance patch is obtained. The universal disturbance patch generated by the present invention can still cause most of the traffic to be misclassified when facing the classification of the classifier enhanced by adversarial training, thereby improving the practical application value of the website fingerprint defense solution based on adversarial samples and enhancing the deployability of the solution; a sequential and forward data packet insertion method that conforms to the actual situation is designed, so that the disturbance can be used in the real world, solving the privacy protection problem of anonymous network users.

[0121] The present invention selects different template traffic xt for each website, uses a differential evolution algorithm, minimizes the L2 norm distance between the traffic xi and the template traffic xt to generate an adversarial perturbation patch Δ, and iteratively superimposes and confuses the adversarial perturbation patch Δ with a universal perturbation patch Δw, and finally obtains a universal perturbation patch Δw that can still misclassify most of the traffic when facing the classification of a classifier enhanced by adversarial training, thereby improving the practical application value of a website fingerprint defense solution based on adversarial samples and realizing the protection of the privacy security of anonymous traffic users.

[0122] The technical means disclosed in the scheme of the present invention are not limited to the technical means disclosed in the above-mentioned implementation mode, but also include technical schemes composed of any combination of the above technical features.

Claims

1. A method for generating a universal disturbance patch for network traffic based on superposition obfuscation, characterized in that: The following steps are involved: Step (1) generating a single traffic anti-disturbance patch based on a differential evolution algorithm; Step (2) Dynamically superimpose the perturbation patches. Since a complete universal perturbation patch is ultimately required, after generating the perturbation patch for each traffic, the perturbation patch obtained in step (1) needs to be added to the current universal perturbation patch to form a complete perturbation patch. Step (3), real-time obfuscation of the universal traffic disturbance patch; performing real-time obfuscation on the binary groups inside the disturbance patch according to the insertion position of the patch, and sorting them into new universal disturbance patches that conform to the actual insertion rules according to the insertion position; Step (4), judging the effectiveness of the universal traffic disturbance patch, requires setting a corresponding threshold to make a judgment, so as to evaluate the effectiveness of the universal disturbance patch.

2. According to claim 1, a method for generating a universal disturbance patch for network traffic based on superposition obfuscation is characterized in that: The specific process of generating a single traffic anti-disturbance patch based on the differential evolution algorithm in step (1) is as follows: a) Define the initial universal perturbation patch Δw, and set the value of the initial universal perturbation patch to [<0,0>]; the optimization objective is given as: D i =argmin Δ L2(x i +D w ,x t ) Where M is the maximum number of packets allowed to be inserted into the adversarial perturbation patch, N represents the position range of the inserted packets, and Δw represents the current universal perturbation patch, which can be expressed as [<p1,±n1> ,<p2,±n2> …], which contains multiple<p,±n> For any two-tuple<pi,±ni> , pi represents the position where the data packet is inserted in the flow, ni represents the number of inserted data packets; L2 represents the L2 norm distance between two flows; b) Add the universal disturbance patch Δw to the current traffic Assume that the current flow is xi (1≤i≤s), and the current general disturbance patch is Δw = [<location1,±num1> ,<location2,±num2> ……], where each<location,±num> The tuples are arranged in ascending order according to the value of location; First, insert the universal disturbance patch Δw into the traffic xi; use the forward and sequential packet insertion method to add interference packets to the traffic; specifically, shift the data after location1 in the traffic uniformly by |num1| positions, and add |num1| "+1" or "-1" at location1 according to the sign of num1, to complete<location1,±num1> Insertion; then complete in the above order<location2,±num2> ,<location3,±num3> ... until each of Δw is completed.<location,±num> After the insertion of the binary, the universal perturbation patch Δw is added to the traffic; c) Adversarial perturbation patch generation After adding the universal perturbation patch Δw to the current traffic xi, the auxiliary classifier M trained in advance to correctly classify the traffic of website W is used to classify it and determine whether xi is misclassified at this time; If misclassification occurs, it means that the current general perturbation patch is effective, and there is no need to generate an adversarial perturbation patch, and the adversarial perturbation patch Δ is set to empty; if no misclassification occurs, the differential evolution algorithm is used to set the optimization target to the L2 norm distance between xi and xt after adding Δw; by minimizing the optimization target, the adversarial perturbation patch Δ that can make xi Assuming xi={a1,a2,a3……as}, xt={b1,b2,b3……bs}, the L2 norm distance l between the two is expressed as:

3. According to claim 1, a method for generating a universal disturbance patch for network traffic based on superposition obfuscation is characterized in that: The specific process of superimposing the dynamic countermeasure disturbance patch in step (2) is as follows: Assuming that the current general perturbation patch Δw = [<4,-3>,<7,5>] and the adversarial perturbation patch Δ = [<1,3>,<5,9>], the superimposed perturbation patch is [<4,-3>,<7,5>,<1,3>,<5,9>].

4. According to claim 1, a method for generating a universal disturbance patch for network traffic based on superposition obfuscation is characterized in that: The specific process of real-time obfuscation of the universal traffic disturbance patch in step (3) is as follows: Δw=[<4,-3>,<7,5>] Δ=[<1,3>,<5,9>] Δw=sort(Δw+Δ) =sort([<4,-3>,<7,5>,<1,3>,<5,9>]) ＝[<1,3>,<4,-3>,<5,9>,<7,5>] After sorting, the updated universal perturbation patch Δw = [<1,3>,<4,-3>,<5,9>,<7,5>] is obtained; through this superposition confusion operation, until every flow in the data set is processed, the final universal perturbation patch Δw is obtained.

5. According to the method for generating a universal disturbance patch for network traffic based on superposition obfuscation in claim 1, it is characterized in that: The specific process of judging the effectiveness of the universal traffic disturbance patch in step (4) is as follows: insert the universal disturbance patch Δw of the website into each traffic of the website in the data set by using a forward and sequential data packet insertion method; use a pre-trained classifier M to classify all the traffic of the website; the judgment condition is as follows, where X is a traffic data set consisting of part of the traffic of a certain website W, and η is a threshold: That is, if after adding a universal perturbation patch to each flow of the website, more than a threshold proportion of the flow is misclassified, it means that the perturbation patch is effective; otherwise, the universal perturbation patch for the website will be regenerated.

Images