Cross-environment encrypted traffic access behavior identification method

Abstract

The invention discloses a cross-environment encrypted traffic access behavior identification method, and relates to the field of encrypted traffic access behavior identification. According to the method and the device, each TCP flow is associated with the domain name information in the log through flow preprocessing, the flow sample with burst characteristics is generated, the accuracy of encrypted flow analysis is improved by fusing the characteristics with the domain name information, and the network access behavior can be accurately identified and analyzed in an encrypted proxy environment.

Description

Technical Field

[0001] The present invention relates to the field of identification of encrypted traffic access behavior, and in particular to how to overcome the problem of feature drift in the case of environmental changes to improve the accuracy of cross-environment encrypted traffic access behavior identification; and specifically to a cross-environment encrypted traffic access behavior identification method. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and may not constitute prior art.

[0003] With the popularization of the Internet, the privacy protection of netizens has received increasing attention. Encrypted proxies such as Shadowsocks and V2Ray are widely used to conceal content transmission or anonymous access to ensure privacy security. On the other hand, the use of encrypted proxies also brings loopholes in network security supervision. Criminals use their anonymity to access illegal or sensitive websites abroad, publish and transmit illegal information, evade traffic review by domestic security departments, disrupt network order, and seriously threaten the security of national cyberspace. In this situation, it is particularly important to identify encrypted traffic access behavior.

[0004] Existing related technical solutions mainly use website fingerprint attack technology to classify and identify users' network access behaviors, and improve the recognition accuracy of encrypted traffic classification models through feature engineering, feature selection, model training, etc. However, these technologies are usually based on the situation that the training and test environments of the encrypted traffic access behavior recognition model are consistent. When the environment changes, that is, when the feature distribution of traffic samples used to train the encrypted traffic access behavior recognition model and the test phase is inconsistent, feature drift problems will occur, causing the model's encrypted traffic access behavior recognition performance to deteriorate. Therefore, how to overcome the feature drift problem in cross-environment identification of encrypted traffic access behavior, and improve the accuracy of cross-environment encrypted traffic access behavior recognition when the new environment changes diversely and it is impossible to obtain labeled training samples in the current new environment in real time, has become an urgent problem to be solved in the field of network security. Summary of the invention

[0005] The purpose of the present invention is to provide a cross-environment encrypted traffic access behavior identification method to address the problem of inconsistent feature distribution caused by changes in training and testing environments, which leads to decreased recognition performance. The method associates the access behavior between the source environment and the target environment based on domain name information, ensures the accuracy of encrypted traffic analysis, and improves the adaptability and generalization ability of the model in diversified network environments.

[0006] The technical solution of the present invention is as follows:

[0007] A method for identifying encrypted traffic access behavior across environments, comprising:

[0008] Step S1: Traffic preprocessing: Obtain traffic Pcap packets and corresponding encrypted proxy logs in the source environment and target environment, extract TCP streams from the original Pcap files visited by each website, and associate them with the domain names in the encrypted proxy log information, extract statistical features such as packet arrival time and packet size, and generate burst structure traffic samples;

[0009] Step S2: Identification of high-frequency public domain names: using samples and labels of the training website set to train a high-frequency public domain name classifier, screening out high-frequency public domain name information of multiple websites, and filtering out data of high-frequency public domain names associated with the data set that cannot represent access behavior;

[0010] Step S3: Calculate key domain names; use TF-IDF technology to calculate domain name information that can highly characterize the website to be identified; TF is used as a frequency filter to filter common domain names with high frequency, IDF gives a smaller weight to more common domain names and a larger weight to less common domain names, and TF is multiplied by IDF to obtain the importance of the current website to be identified by TF-IDF;

[0011] Step S4: cross-environment feature selection: select features in rounds, assign different weights to each dimension of features, train the cross-environment feature selection classifier, and obtain features that are constant or have little variation across environments as the best feature subset;

[0012] Step S5: Identify cross-environment website access behavior; input the best feature subset after cross-environment feature selection and the sample data set associated with the key domain name set into the classification model training to generate a cross-environment website access behavior classifier to classify the samples to be identified.

[0013] Furthermore, the step S1 comprises:

[0014] Step S11: Obtain the traffic Pcap packets and corresponding encrypted proxy logs in the source environment and the target environment, traverse the Pcap packets to extract the TCP flow quintuple information, and associate it with the domain name information in the encrypted proxy log to generate flow-domain name association data in the format of [TCP quintuple 1: [url1], ...]; wherein the TCP quintuple refers to the source IP address, source port, destination IP address, destination port and transport layer protocol; url refers to the interactive domain name recorded in the encrypted proxy log when the network access behavior is performed through the encrypted proxy;

[0015] Step S12: traverse the data packet sequence and record the direction and size of each packet; when the direction changes or the packet size exceeds the specified threshold, add the current data packet as a burst to the result and record the data arrival time, and finally generate a burst structure traffic sample containing direction and size information; the format of the burst structure traffic sample is [[data packet arrival time, ±data packet size], ...], where ± represents the direction of the flow;

[0016] Step S13: Combined with the flow-domain name association data in step S11, the unique domain name information corresponding to each TCP flow and the burst structured data packet sequence are summarized to generate a traffic sample in the format of [flow arrival time, burst, flow associated domain name]. Since there are multiple visits to each website, multiple domain names appear in each visit, and each domain name is associated with one or more TCP flows, when organizing the data set, the domain name information is used to distinguish them. Under each visit, all the domain names that appear and the traffic characteristics corresponding to the domain names exist.

[0017] Furthermore, the step S2 comprises:

[0018] Step S21: traverse the original data sets in the source environment and the target environment respectively and perform statistics according to the same domain name to obtain the total number of occurrences of a single domain name, i.e., a domain name frequency table, and a collection of websites corresponding to a single domain name, i.e., a domain name website table;

[0019] Step S22: Calculate the total number of occurrences of all domain names in the source environment and the target environment S all_domain , the proportion of domain names appearing in the training website set TR domain , the proportion of domain names in all domain names HR domain , filter out TR domain Add the high-frequency public domain name set HostSet to the domain name that is greater than or equal to the threshold Th com ;

[0020] Step S23: Divide the website set into a training set and a validation set, which belongs to HostSet com is a positive sample, otherwise it is a negative sample, training high-frequency public domain name classifier Model ch , and continuously traverse the threshold interval to select the threshold and classifier with the best classification effect.

[0021] Furthermore, the S in step S22 all_domain ,TR domain , HR domain The calculation process is as follows:

[0022]

[0023]

[0024] Among them, N domain is the number of times the domain name appears in the data set, TD web is the number of websites corresponding to the domain name domain in the dataset, TD allweb is the total number of websites in the dataset.

[0025] Furthermore, the step S23 includes:

[0026] Step S231: traverse the websites in the training website set and execute step S232;

[0027] Step S232: traverse the domain names corresponding to the website, and when the domain name belongs to HostSet com When , the samples corresponding to the domain name are divided into training positive samples, otherwise they are divided into training negative samples;

[0028] Step S233: Perform the same operation as step S231 and step S232 on the websites in the verification website set to obtain verification positive and negative samples;

[0029] Step S234: Use the training samples to train the random forest model to obtain a high-frequency public domain name classifier, and obtain Model ch ;

[0030] Step S235: Traverse the threshold interval and use the verification sample to verify the Model ch Verify the classification effect and obtain F1 score The highest threshold is taken as Best Th .

[0031] Furthermore, the step S3 comprises:

[0032] Step S31: Count the frequency of each domain name in the sample, i.e., TF, and generate a corresponding domain name frequency dictionary tfdict for each sample i i , the structure is [domain name: TF]; save all the domain names in the data set and remove duplicate domain names to form the domain name set HostSet;

[0033] Step S32: Calculate the IDF of each domain name in the domain name set HostSet;

[0034] Step S33: Calculate the TF-IDF corresponding to each domain name in the domain name set HostSet;

[0035] Step S34: Combine with tfdict i and TF-IDF generate n×m two-dimensional matrices X, where n is the number of samples and m is the size of the domain name set HostSet. ijIndicates the TF-IDF corresponding to the domain name with subscript j in the domain name set HostSet of the i-th sample; select the median of all TF-IDFs in each column of the two-dimensional matrix as the final TF-IDF of each domain name in the domain name set HostSet, and add it to TF-IDF-LIST;

[0036] Step S35: traverse TF-IDF-LIST and filter out domain names that are not in the high-frequency public domain name set HostSet com The domain names in the search results are sorted in descending order, and the top 10 domain names are selected as the key domain name set.

[0037] Furthermore, the calculation process of TF in step S31 is as follows:

[0038]

[0039] Among them, c domain is the number of times the domain name domian appears in the current sample, ∑ domian∈dataset C domain is the sum of the number of occurrences of all domain names in the current sample;

[0040] The calculation process of IDF in step S32 is as follows:

[0041]

[0042] where c web_Host is the number of websites containing the domain name in HostSet, c web_domian is the number of websites that contain domian;

[0043] The calculation process of TF-IDF in step S33 is:

[0044] TF-IDF domain =TF domain ×TDF domain .

[0045] Furthermore, the step S4 comprises:

[0046] Step S41: obtaining samples of the current website to be identified from the source environment data set as training positive samples; obtaining samples of other websites as training negative samples, and generating a training set;

[0047] Step S42: obtaining samples of the current website to be identified from the target environment data set as test positive samples; obtaining samples of other websites as test negative samples to generate a training set;

[0048] Step S43: Eliminate the high-frequency public domain name HostSet in the training set and the test set comDomain names and corresponding features, using the trained high-frequency public domain name classifier Model ch The features are further filtered to retain non-high-frequency public domain name features;

[0049] Step S44: Train the random forest model and calculate the false positive rate FPR of each feature in the validation set basic ;

[0050] Step S45: Set the maximum false positive rate to FPR max , and according to FPR basic Dynamically update FPR max ;

[0051] Step S46: Initialize feature score list f score , record the score of each feature and set the negative score neg score = -1000 to mark the selected features; traverse each feature in rounds, and calculate the feature score after all feature combinations in the first round cur , add each feature score to the record;

[0052] Step S47: For each feature, calculate its feature score under the non-selection condition ri , use score ri and score cur Update the feature score list f by the difference score , and select features based on FPR and recall;

[0053] Step S48: Iteratively filter the features with the highest scores, update the feature scores and mark the selected features as negative scores, gradually accumulate the optimal feature combination; and fine-tune the feature scores in all rounds to avoid the situation where the feature scores are equal. Finally, sort the feature scores from high to low to generate the best feature subset.

[0054] Furthermore, the FPR in step S44 basic The calculation process is as follows:

[0055]

[0056] Among them, FP is the number of negative samples that are incorrectly predicted as positive, and TN is the number of negative samples that are correctly predicted as negative;

[0057] The dynamic update process in step S45 is as follows:

[0058] FPR max =min(FPR max , FPR basic ×ratio)

[0059] Here, ratio is a preset scaling factor used to adjust the calculation of FPR.

[0060] Furthermore, the step S5 comprises:

[0061] Step S51: extracting features from the source environment data and the target environment data to generate 18-dimensional features including the sum of the data packet size in the receiving direction, the sum of the data packet size in the sending direction, and the total number of changes in the flow transmission direction;

[0062] Step S52: Select samples associated with the key domain name set, and select the best feature subset through a cross-environment feature selection process;

[0063] Step S53: Divide the training set and the n-shot learning sample set, and use the training set to input the training model for preliminary training to generate a classification model;

[0064] Step S54: Use the n-shot learning idea to fine-tune the model, enhance the generalization ability of the model, and generate a final classifier to identify the test samples.

[0065] Compared with the prior art, the present invention has the following beneficial effects:

[0066] 1. The present invention associates each TCP flow with the domain name information in the log through traffic preprocessing, and then generates a traffic sample with burst characteristics. The feature fusion of domain name information improves the accuracy of encrypted traffic analysis and ensures that network access behavior can be accurately identified and analyzed in an encrypted proxy environment.

[0067] 2. The present invention uses a high-frequency domain name classifier to select high-frequency domain names across environments, updates the threshold through classification effects, and more effectively filters out samples in the data set that cannot represent access behavior, reduces the interference of noise data, and improves the accuracy and efficiency of traffic analysis.

[0068] 3. The present invention uses a high-frequency public domain name identification module and a cross-environment feature selection module to screen and train the optimal feature subset in different environments, and combines a cross-environment website fingerprint recognition classifier to realize cross-environment encrypted traffic access behavior recognition, thereby enhancing the system's adaptability and generalization capabilities in diversified network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A flow chart of a method for identifying encrypted traffic access behavior across environments;

[0070] Figure 2 This is the flow chart of traffic preprocessing;

[0071] Figure 3 This is a diagram of how the dataset is organized;

[0072] Figure 4 Generate a process flow chart for the set of high-frequency public domain names;

[0073] Figure 5 Flowchart for the cross-environment feature selection process. DETAILED DESCRIPTION

[0074] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0075] The features and performance of the present invention are further described in detail below in conjunction with the embodiments.

[0076] Embodiment 1

[0077] See also Figure 1 , a method for identifying encrypted traffic access behavior across environments, specifically comprising the following steps:

[0078] Step S1: Traffic preprocessing. Obtain the traffic Pcap packets and corresponding encrypted proxy logs in the source and target environments, extract the TCP stream from the original Pcap file of each website access, and associate it with the domain name in the encrypted proxy log information, extract statistical features such as packet arrival time and packet size, and generate burst structure traffic samples. Figure 2 The feature extraction process is described as follows:

[0079] Step S11: Obtain the traffic Pcap packets and corresponding encrypted proxy logs in the source environment and the target environment, traverse the Pcap packets to extract the TCP flow quintuple information, and associate it with the domain name information in the encrypted proxy log to generate flow-domain name association data in the format of [TCP quintuple 1: [url1], ...];

[0080] The TCP quintuple refers to the source IP address, source port, destination IP address, destination port, and transport layer protocol. The url refers to the interactive domain name recorded in the encrypted proxy log when the network access behavior is performed through the encrypted proxy;

[0081] Step S12: traverse the data packet sequence and record the direction and size of each packet. When the direction changes or the packet size exceeds the specified threshold, add the current data packet as a burst to the result and record the data arrival time, and finally generate a burst structure traffic sample containing direction and size information; the format of the burst structure traffic sample is [[data packet arrival time, ±data packet size], ...], where ± represents the direction of the flow;

[0082] Step S13: Combine the flow-domain name association data in step S11, summarize the unique domain name information corresponding to each TCP flow and the burst structure packet sequence, and generate a traffic sample in the format of [flow arrival time, burst, flow associated domain name]; since there are multiple visits to each website, multiple domain names appear in each visit, and each domain name is associated with one or more TCP flows, when organizing the data set, the domain name information is used to distinguish them. Under each visit, there are all the domain names that appear and the traffic characteristics corresponding to the domain names, such as Figure 3 shown.

[0083] Step S2: Identification of high-frequency public domain names. Use the samples and labels of the training website set to train a high-frequency public domain name classifier, filter out the high-frequency public domain name information of multiple websites, and filter out the data of high-frequency public domain names in the dataset that cannot represent the access behavior. Figure 4 The high-frequency public domain name identification process is described, specifically:

[0084] Step S21: traverse the original data sets in the source environment and the target environment respectively and perform statistics according to the same domain name to obtain the total number of occurrences of a single domain name, i.e., a domain name frequency table, and a collection of websites corresponding to a single domain name, i.e., a domain name website table;

[0085] Step S22: Calculate the total number of occurrences of all domain names in the source environment and the target environment S all_domain , the proportion of domain names appearing in the training website set TR domain , the proportion of domain names in all domain names HR domain , filter out TR domain Add the high-frequency public domain name set HostSet to the domain name that is greater than or equal to the threshold Th com . S all_domain ,TR domain , HR domain The calculation process is:

[0086]

[0087] Among them, N domain is the number of times the domain name appears in the data set, TD web is the number of websites corresponding to the domain name domain in the dataset, TD allwebis the total number of websites in the dataset;

[0088] Step S23: Divide the website set into a training set and a validation set, which belongs to HostSet com is a positive sample, otherwise it is a negative sample, training high-frequency public domain name classifier Model ch , and continuously traverse the threshold interval to select the threshold and classifier with the best classification effect; the training process of the high-frequency public domain name classifier is:

[0089] Step S231: traverse the websites in the training website set and execute 3.2;

[0090] Step S232: traverse the domain names corresponding to the website, and when the domain name belongs to HostSet com When , the samples corresponding to the domain name are divided into training positive samples, otherwise they are divided into training negative samples;

[0091] Step S233: Perform the same operations as 3.1 and 3.2 on the websites in the verification website set to obtain verification positive and negative samples;

[0092] Step S234: Use the training samples to train the random forest model to obtain a high-frequency public domain name classifier, and obtain Model ch ;

[0093] Step S235: Traverse the threshold interval and use the verification sample to verify the Model ch Verify the classification effect and obtain F1 score The highest threshold is taken as Best Th .

[0094] Step S3: Calculation of key domain names. Use TF-IDF technology to calculate domain name information that can highly characterize the website to be identified. TF is used as a frequency filter to filter common domain names with high frequency. IDF gives smaller weights to more common domain names and larger weights to less common domain names. Multiply TF and IDF to obtain the importance of TF-IDF to identify the current website to be identified. The calculation steps of key domain names are as follows:

[0095] Step S31: Count the frequency of each domain name in the sample, i.e., TF, and generate a corresponding domain name frequency dictionary tfdict for each sample i i , the structure is [domain name: TF]. Save all the domain names in the data set and remove duplicate domain names to form the domain name set HostSet. The calculation process of TF is:

[0096]

[0097] Among them, c domain is the number of times the domain name domian appears in the current sample, ∑ domian∈dataset C domainis the sum of the number of occurrences of all domain names in the current sample;

[0098] Step S32: Calculate the IDF of each domain name in the domain name set HostSet. The calculation process of IDF is:

[0099]

[0100] where c web_Host is the number of websites containing the domain name in HostSet, c web_domian is the number of websites that contain domian;

[0101] Step S33: Calculate the TF-IDF corresponding to each domain name in the domain name set HostSet. The calculation process of TF-IDF is:

[0102] TF-IDF domain =TF domain ×TDF domain

[0103] Step S34: Combine with tfdict i and TF-IDF generate n×m two-dimensional matrices X, where n is the number of samples and m is the size of the domain name set HostSet. ij Indicates the TF-IDF corresponding to the domain name with subscript j in the domain name set HostSet of the i-th sample. Select the median of all TF-IDFs in each column of the two-dimensional matrix as the final TF-IDF of each domain name in the domain name set HostSet and add it to TF-IDF-LIST;

[0104] Step S35: traverse TF-IDF-LIST and filter out domain names that are not in the high-frequency public domain name set HostSet com The domain names in the search results are sorted in descending order, and the top 10 domain names are selected as the key domain name set.

[0105] Step S4: Cross-environment feature selection. Select features in rounds, assign different weights to each dimension of features, train the cross-environment feature selection classifier, and obtain features that are constant or have little variation across environments as the best feature subset. Figure 5 The cross-environment feature selection process is described, specifically:

[0106] Step S41: obtaining samples of the current website to be identified from the source environment data set as training positive samples; obtaining samples of other websites as training negative samples, and generating a training set;

[0107] Step S42: obtaining samples of the current website to be identified from the target environment data set as test positive samples; obtaining samples of other websites as test negative samples to generate a training set;

[0108] Step S43: Eliminate the high-frequency public domain name HostSet in the training set and the test set com Domain names and corresponding features, using the trained high-frequency public domain name classifier Model ch The features are further filtered to retain non-high-frequency public domain name features;

[0109] Step S44: Train the random forest model and calculate the false positive rate FPR of each feature in the validation set basic , FPR basic The calculation process is:

[0110]

[0111] Among them, FP is the number of negative samples that are incorrectly predicted as positive, and TN is the number of negative samples that are correctly predicted as negative;

[0112] Step S45: Set the maximum false positive rate to FPR max , and according to FPR basic Dynamically update FPR max , the update process is:

[0113] FPR max =min(FPR max , FPR basic ×ratio)

[0114] Among them, ratio is a preset proportional factor used to adjust the calculation of FPR;

[0115] Step S46: Initialize feature score list f score , record the score of each feature and set the negative score neg score = -1000 to mark the selected feature. Traverse each feature in turn, and calculate the feature score after all feature combinations in the first round. cur , add each feature score to the record;

[0116] Step S47: For each feature, calculate its feature score under the non-selection condition ro , use score ri and score cur Update the feature score list f by the difference score , and select features based on FPR and recall;

[0117] Step S48: Iteratively select the features with the highest scores, update the feature scores and mark the selected features as negative scores, gradually accumulate the optimal feature combination, and fine-tune the feature scores in all rounds to avoid the situation where the feature scores are equal. Finally, sort the feature scores from high to low to generate the best feature subset.

[0118] Step S5: Identification of cross-environment website access behavior. The best feature subset after cross-environment feature selection and the sample data set associated with the key domain name set are input into the classification model training to generate a cross-environment website access behavior classifier to classify the samples to be identified. The specific steps are:

[0119] Step S51: extracting features from the source environment data and the target environment data to generate 18-dimensional features including the sum of the data packet size in the receiving direction, the sum of the data packet size in the sending direction, and the total number of changes in the flow transmission direction;

[0120] Step S52: Select samples associated with the key domain name set, and select the best feature subset through a cross-environment feature selection process;

[0121] Step S53: Divide the training set and the n-shot learning sample set, and use the training set to input the training model for preliminary training to generate a classification model;

[0122] Step S54: Use the n-shot learning idea to fine-tune the model, enhance the generalization ability of the model, and generate a final classifier to identify the test samples.

[0123] The above-mentioned embodiments only express the specific implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the protection scope of the present application. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the technical solution concept of the present application, and these all belong to the protection scope of the present application.

[0124] This background section is provided to generally present the context of the invention, and the work of the presently named inventors, the work to the extent described in this background section, and aspects of this section that did not constitute prior art at the time of application are neither explicitly nor implicitly admitted to be prior art to the present invention.

Claims

1. A method for identifying encrypted traffic access behavior across environments, characterized in that: include: Step S1: flow preprocessing; Obtain the traffic Pcap packages and corresponding encrypted proxy logs in the source and target environments, extract the TCP stream from the original Pcap file of each website access, and associate it with the domain name in the encrypted proxy log information, extract statistical features, and generate burst structure traffic samples; Step S2: Identification of high-frequency public domain names: using samples and labels of the training website set to train a high-frequency public domain name classifier, screening out high-frequency public domain name information of multiple websites, and filtering out data of high-frequency public domain names associated with the data set that cannot represent access behavior; Step S3: Calculate key domain names: Use TF-IDF technology to calculate domain name information that can highly characterize the website to be identified; TF is used as a word frequency filter to filter common domain names with high frequency. IDF gives smaller weights to more common domain names and larger weights to less common domain names. Multiplying TF and IDF to get TF-IDF indicates the importance of the current website to be identified. Step S4: cross-environment feature selection: select features in rounds, assign different weights to each dimension of features, train the cross-environment feature selection classifier, and obtain features that are constant or have little variation across environments as the best feature subset; Step S5: Identify cross-environment website access behavior; input the best feature subset after cross-environment feature selection and the sample data set associated with the key domain name set into the classification model training to generate a cross-environment website access behavior classifier to classify the samples to be identified.

2. According to the method for identifying encrypted traffic access behavior across environments according to claim 1, it is characterized in that: The step S1 comprises: Step S11: Obtain the traffic Pcap packets and corresponding encrypted proxy logs in the source environment and the target environment, traverse the Pcap packets to extract the TCP flow quintuple information, and associate it with the domain name information in the encrypted proxy log to generate flow-domain name association data in the format of [TCP quintuple 1: [url1], ...]; wherein the TCP quintuple refers to the source IP address, source port, destination IP address, destination port and transport layer protocol; url refers to the interactive domain name recorded in the encrypted proxy log when the network access behavior is performed through the encrypted proxy; Step S12: traverse the data packet sequence and record the direction and size of each packet; when the direction changes or the packet size exceeds the specified threshold, add the current data packet to the result as a burst and record the data arrival time, and finally generate a burst structure traffic sample containing direction and size information; the format of the burst structure traffic sample is [[data packet arrival time, ±data packet size], ...], where ± represents the direction of the flow; Step S13: Combined with the flow-domain name association data in step S11, the unique domain name information corresponding to each TCP flow and the burst structured data packet sequence are summarized to generate a traffic sample in the format of [flow arrival time, burst, flow associated domain name]. Since there are multiple visits to each website, multiple domain names appear in each visit, and each domain name is associated with one or more TCP flows, when organizing the data set, the domain name information is used to distinguish them. Under each visit, all the domain names that appear and the traffic characteristics corresponding to the domain names exist.

3. According to claim 2, a method for identifying encrypted traffic access behavior across environments is characterized in that: The step S2 comprises: Step S21: traverse the original data sets in the source environment and the target environment respectively and perform statistics according to the same domain name to obtain the total number of occurrences of a single domain name, i.e., a domain name frequency table, and a collection of websites corresponding to a single domain name, i.e., a domain name website table; Step S22: Calculate the total number of occurrences of all domain names in the source environment and the target environment S all_domain , the proportion of domain names appearing in the training website set TR domain , the proportion of domain names in all domain names HR domain , filter out TR domain Add high-frequency public domain name set HostSet to domain names greater than or equal to the threshold Th com ; Step S23: Divide the website set into a training set and a validation set, which belongs to HostSet com is a positive sample, otherwise it is a negative sample, training high-frequency public domain name classifier Model ch , and continuously traverse the threshold interval to select the threshold and classifier with the best classification effect.

4. According to the method for identifying encrypted traffic access behavior across environments according to claim 3, it is characterized in that: The S in step S22 all_domain ,TR domain , HR domain The calculation process is as follows: Among them, N domain is the number of times the domain name appears in the data set, TD web is the number of websites corresponding to the domain name domain in the dataset, TD allweb is the total number of websites in the dataset.

5. According to the method for identifying encrypted traffic access behavior across environments according to claim 3, it is characterized in that: The step S23 comprises: Step S231: traverse the websites in the training website set and execute step S232; Step S232: traverse the domain names corresponding to the website, and when the domain name belongs to HostSet com When , the samples corresponding to the domain name are divided into training positive samples, otherwise they are divided into training negative samples; Step S233: Perform the same operation as step S231 and step S232 on the websites in the verification website set to obtain verification positive and negative samples; Step S234: Use the training samples to train the random forest model to obtain a high-frequency public domain name classifier, and obtain Model ch ; Step S235: Traverse the threshold interval and use the verification sample to verify the Model ch Verify the classification effect and obtain F1 score The highest threshold is taken as Best Th .

6. According to the method for identifying encrypted traffic access behavior across environments according to claim 3, it is characterized in that: The step S3 comprises: Step S31: Count the frequency of each domain name in the sample, i.e., TF, and generate a corresponding domain name frequency dictionary tfdict for each sample i i , the structure is [domain name: TF]; save all the domain names in the data set and remove duplicate domain names to form the domain name set HostSet; Step S32: Calculate the IDF of each domain name in the domain name set HostSet; Step S33: Calculate the TF-IDF corresponding to each domain name in the domain name set HostSet; Step S34: Combine with tfdict i and TF-IDF generate n×m two-dimensional matrices X, where n is the number of samples and m is the size of the domain name set HostSet. ij Indicates the TF-IDF corresponding to the domain name with subscript j in the domain name set HostSet of the i-th sample; select the median of all TF-IDFs in each column of the two-dimensional matrix as the final TF-IDF of each domain name in the domain name set HostSet, and add it to TF-IDF-LIST; Step S35: traverse TF-IDF-LIST and filter out domain names that are not in the high-frequency public domain name set HostSet com The domain names in the search results are sorted in descending order, and the top 10 domain names are selected as the key domain name set.

7. A method for identifying encrypted traffic access behavior across environments according to claim 6, characterized in that: The calculation process of TF in step S31 is as follows: Among them, c domain is the number of times the domain name domian appears in the current sample, ∑ domian∈dataset C domain is the sum of the number of occurrences of all domain names in the current sample; The calculation process of IDF in step S32 is as follows: where c web_Host is the number of websites containing the domain name in HostSet, c web_domian is the number of websites that contain domian; The calculation process of TF-IDF in step S33 is: TF-IDF domain =TF domain ×TDF domain 。 8. A method for identifying encrypted traffic access behavior across environments according to claim 6, characterized in that: The step S4 comprises: Step S41: obtaining samples of the current website to be identified from the source environment data set as training positive samples; obtaining samples of other websites as training negative samples, and generating a training set; Step S42: obtaining samples of the current website to be identified from the target environment data set as test positive samples; obtaining samples of other websites as test negative samples to generate a training set; Step S43: Eliminate the high-frequency public domain name HostSet in the training set and the test set com Domain names and corresponding features, using the trained high-frequency public domain name classifier Model ch The features are further filtered to retain non-high-frequency public domain name features; Step S44: Train the random forest model and calculate the false positive rate FPR of each feature in the validation set basic ; Step S45: Set the maximum false positive rate to FPR max , and according to FPR basic Dynamically update FPR max ; Step S46: Initialize feature score list f score , record the score of each feature and set the negative score neg score = -1000 to mark the selected features; traverse each feature in rounds, and calculate the feature score after all feature combinations in the first round cur , add each feature score to the record; Step S47: For each feature, calculate its feature score under the non-selection condition ri , use score ri and score cur Update the feature score list f by the difference score , and select features based on FPR and recall; Step S48: Iteratively filter the features with the highest scores, update the feature scores and mark the selected features as negative scores, gradually accumulate the optimal feature combination; and fine-tune the feature scores in all rounds to avoid the situation where the feature scores are equal. Finally, sort the feature scores from high to low to generate the best feature subset.

9. A method for identifying encrypted traffic access behavior across environments according to claim 8, characterized in that: The FPR in step S44 basic The calculation process is as follows: Among them, FP is the number of negative samples that are incorrectly predicted as positive, and TN is the number of negative samples that are correctly predicted as negative; The dynamic update process in step S45 is as follows: FPR max =min(FPR max ,FPR basic ×ratio) Here, ratio is a preset scaling factor used to adjust the calculation of FPR.

10. A method for identifying encrypted traffic access behavior across environments according to claim 8, characterized in that: The step S5 comprises: Step S51: extracting features from the source environment data and the target environment data to generate 18-dimensional features including the sum of the data packet size in the receiving direction, the sum of the data packet size in the sending direction, and the total number of changes in the flow transmission direction; Step S52: Select samples associated with the key domain name set, and select the best feature subset through a cross-environment feature selection process; Step S53: Divide the training set and the n-shot learning sample set, and use the training set to input the training model for preliminary training to generate a classification model; Step S54: Use the n-shot learning idea to fine-tune the model, enhance the generalization ability of the model, and generate a final classifier to identify the test samples.

Images