A cross-environment encrypted traffic access behavior identification method

Abstract

This invention discloses a cross-environmental method for identifying encrypted traffic access behavior, specifically for identifying encrypted traffic access behavior. Through traffic preprocessing, the method associates each TCP flow with domain name information in logs, regenerating traffic samples with burst characteristics. The integration of these characteristics with domain name information improves the accuracy of encrypted traffic analysis, ensuring accurate identification and analysis of network access behavior in encrypted proxy environments.

Description

Technical Field

[0001] The present invention relates to the field of identifying encrypted traffic access behavior, and in particular to how to overcome the problem of feature drift in the case of environmental changes to improve the accuracy of cross-environment encrypted traffic access behavior identification; specifically, to a cross-environment encrypted traffic access behavior identification method. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and may not constitute prior art.

[0003] With the widespread adoption of the internet, privacy protection is gaining increasing attention. Encrypted proxies such as Shadowsocks and V2Ray are widely used to conceal content transmission or provide anonymous access, thereby ensuring privacy and security. However, the use of encrypted proxies can also create loopholes in cybersecurity regulation. Criminals exploit their anonymity to access illegal or sensitive websites abroad, publish and transmit illicit information, evade traffic scrutiny by domestic security agencies, disrupt network order, and pose a serious threat to national cyberspace security. In this context, identifying encrypted traffic access behavior is particularly important.

[0004] Existing related technical solutions mainly use website fingerprint attack technology to classify and identify users' network access behaviors, and improve the recognition accuracy of encrypted traffic classification models through feature engineering, feature selection, model training, etc. However, these technologies are usually based on the situation where the training and testing environments of the encrypted traffic access behavior recognition model are consistent. When the environment changes, that is, when the feature distribution of traffic samples used to train the encrypted traffic access behavior recognition model and the test phase is inconsistent, feature drift problems will occur, causing the model's encrypted traffic access behavior recognition performance to degrade. Therefore, how to overcome the feature drift problem in cross-environment identification of encrypted traffic access behavior and improve the accuracy of cross-environment encrypted traffic access behavior recognition when the new environment is changing rapidly and labeled training samples in the current new environment cannot be obtained in real time has become an urgent problem to be solved in the field of network security. Summary of the Invention

[0005] The purpose of the present invention is to provide a cross-environment encrypted traffic access behavior identification method to address the problem of inconsistent feature distribution caused by changes in training and testing environments, which leads to decreased recognition performance. The method associates the access behavior between the source environment and the target environment based on domain name information, ensures the accuracy of encrypted traffic analysis, and improves the adaptability and generalization ability of the model in diverse network environments.

[0006] The technical solutions of the present invention are as follows:

[0007] A method for identifying encrypted traffic access behavior across environments, comprising:

[0008] Step S1: Traffic preprocessing: Obtain traffic Pcap packets and corresponding encrypted proxy logs in the source and target environments, extract the TCP stream from the original Pcap file of each website access, and associate it with the domain name in the encrypted proxy log information, extract statistical features such as packet arrival time and packet size, and generate burst structure traffic samples;

[0009] Step S2: Identify high-frequency public domain names; use the samples and labels of the training website set to train a high-frequency public domain name classifier, filter out high-frequency public domain name information of multiple websites, and filter out data in the dataset that is associated with high-frequency public domain names that cannot represent access behavior;

[0010] Step S3: Calculate key domain names; use TF-IDF technology to calculate domain name information that can highly characterize the website to be identified; TF is used as the frequency filter to filter common domain names with high frequency, and IDF assigns smaller weights to more common domain names and larger weights to less common domain names. Multiplying TF and IDF yields TF-IDF, which indicates the importance of the website to be identified.

[0011] Step S4: Cross-environment feature selection: select features in rounds, assign different weights to each dimension of features, train the cross-environment feature selection classifier, and obtain the features that are constant or have little variation across environments as the best feature subset;

[0012] Step S5: Identify cross-environment website access behavior; input the best feature subset after cross-environment feature selection and the sample data set associated with the key domain name set into the classification model training to generate a cross-environment website access behavior classifier to classify the samples to be identified.

[0013] Furthermore, the step S1 includes:

[0014] Step S11: Obtain the traffic Pcap packets and corresponding encrypted proxy logs in the source and target environments, traverse the Pcap packets to extract the TCP flow quintuple information, and associate it with the domain name information in the encrypted proxy log to generate flow-domain name association data in the format of [TCP quintuple 1: [url1], ...]; where the TCP quintuple refers to the source IP address, source port, destination IP address, destination port, and transport layer protocol; url refers to the interactive domain name recorded in the encrypted proxy log when the network access behavior is performed through the encrypted proxy;

[0015] Step S12: Traverse the data packet sequence and record the direction and size of each packet. When the direction changes or the packet size exceeds the specified threshold, add the current packet as a burst to the result and record the data arrival time. Finally, generate a burst structure traffic sample containing direction and size information. The format of the burst structure traffic sample is [[packet arrival time, ±packet size], ...], where ± represents the direction of the flow.

[0016] Step S13: Combined with the flow-domain name association data in step S11, the unique domain name information corresponding to each TCP flow and the burst structure packet sequence are summarized to generate a traffic sample in the format of [flow arrival time, burst, flow-associated domain name]. Since there are multiple visits to each website, multiple domain names appear in each visit, and each domain name is associated with one or more TCP flows, when organizing the data set, domain name information is used to distinguish them. Under each visit, all the domain names that appear and the traffic characteristics corresponding to the domain names are present.

[0017] Furthermore, the step S2 includes:

[0018] Step S21: traverse the original data sets in the source environment and the target environment respectively and perform statistics based on the same domain name to obtain the total number of occurrences of a single domain name, i.e., a domain name frequency table, and the set of websites corresponding to a single domain name, i.e., a domain name website table;

[0019] Step S22: Calculate the total number of occurrences of all domain names in the source environment and the target environment S all_domain , the proportion of domain names appearing in the training website set TR domain , the proportion of domain names appearing in all domain names HR domain , filter out TR domain Add high-frequency public domain name set HostSet to domain names greater than or equal to the threshold Th com ;

[0020] Step S23: Divide the website set into a training set and a validation set, belonging to HostSet com is a positive sample otherwise it is a negative sample, training high-frequency public domain name classifier Model ch , and continuously traverse the threshold interval to select the threshold and classifier with the best classification effect.

[0021] Furthermore, the S in step S22 all_domain , TR domain , HR domain The calculation process is as follows:

[0022]

[0023]

[0024] Among them, N domain is the number of times the domain name appears in the dataset, TD web is the number of websites corresponding to the domain name domain in the dataset, TD allweb is the total number of websites in the dataset.

[0025] Furthermore, the step S23 includes:

[0026] Step S231: traverse the websites in the training website set and execute step S232;

[0027] Step S232: traverse the domain name corresponding to the website, when the domain name belongs to HostSet com When , the samples corresponding to the domain name are divided into training positive samples, otherwise they are divided into training negative samples;

[0028] Step S233: Perform the same operations as steps S231 and S232 on the websites in the verification website set to obtain verification positive and negative samples;

[0029] Step S234: Use the training samples to train the random forest model to obtain a high-frequency public domain name classifier, and obtain Model ch ;

[0030] Step S235: Traverse the threshold interval and use the verification sample to check the Model ch Verify the classification effect and obtain F1 score The highest threshold is taken as the Best Th .

[0031] Furthermore, the step S3 includes:

[0032] Step S31: Count the frequency of each domain name in the sample, i.e., TF, and generate a corresponding domain name frequency dictionary tfdict for each sample i. i , the structure is [domain name:TF]; save all domain names in the dataset and remove duplicate domain names to form the domain name set HostSet;

[0033] Step S32: Calculate the IDF of each domain name in the domain name set HostSet;

[0034] Step S33: Calculate the TF-IDF corresponding to each domain name in the domain name set HostSet;

[0035] Step S34: Combine with tfdict i And TF-IDF generates n×m two-dimensional matrix X, where n is the number of samples and m is the size of the domain name set HostSet. ijRepresents the TF-IDF of the domain name with subscript j in the domain name set HostSet corresponding to the i-th sample; select the median of all TF-IDFs in each column of the two-dimensional matrix as the final TF-IDF of each domain name in the domain name set HostSet and add it to TF-IDF-LIST;

[0036] Step S35: traverse TF-IDF-LIST and filter out domain names that are not in the high-frequency public domain name set HostSet com The domain names in the search results are sorted in descending order, and the top 10 domain names are selected as the key domain name set.

[0037] Furthermore, the calculation process of TF in step S31 is as follows:

[0038]

[0039] Among them, c domain is the number of times the domain name domian appears in the current sample, ∑ domian∈dataset C domain is the sum of the number of occurrences of all domain names in the current sample;

[0040] The calculation process of IDF in step S32 is as follows:

[0041]

[0042] where c web_Host is the number of websites containing domain names in HostSet, c web_domian is the number of websites that contain domian;

[0043] The calculation process of TF-IDF in step S33 is:

[0044] TF-IDF domain =TF domain ×TDF domain .

[0045] Furthermore, the step S4 includes:

[0046] Step S41: Obtain samples of the website to be identified from the source environment dataset as training positive samples; obtain samples of other websites as training negative samples to generate a training set;

[0047] Step S42: Obtain samples of the website to be identified from the target environment dataset as positive test samples; obtain samples of other websites as negative test samples to generate a training set;

[0048] Step S43: Eliminate high-frequency public domain names HostSet in the training set and test set comDomain names and corresponding features, using the trained high-frequency public domain name classifier Model ch The features are further filtered to retain non-high-frequency public domain name features;

[0049] Step S44: Train the random forest model and calculate the false positive rate (FPR) of each feature in the validation set basic ;

[0050] Step S45: Set the maximum false positive rate FPR max , and according to FPR basic Dynamically update FPR max ;

[0051] Step S46: Initialize feature score list f score , record the score of each feature and set the negative score neg score = -1000 to mark the selected features; traverse each feature in turn, and calculate the feature score after all feature combinations in the first round cur , add each feature score to the record;

[0052] Step S47: For each feature, calculate its feature score under the non-selection condition ri , using score ri and score cur Update the feature score list f with the difference of score , and filter features based on FPR and recall;

[0053] Step S48: Iteratively filter the features with the highest scores, update the feature scores and mark the selected features as negative scores, gradually accumulate the optimal feature combination; and fine-tune the feature scores in all rounds to avoid the situation where the feature scores are equal. Finally, sort the feature scores from high to low to generate the best feature subset.

[0054] Furthermore, the FPR in step S44 basic The calculation process is as follows:

[0055]

[0056] Among them, FP is the number of negative samples that are incorrectly predicted as positive, and TN is the number of negative samples that are correctly predicted as negative;

[0057] The dynamic update process in step S45 is as follows:

[0058] FPR max =min(FPR max , FPR basic ×ratio)

[0059] Here, ratio is a preset scaling factor used to adjust the calculation of FPR.

[0060] Furthermore, the step S5 includes:

[0061] Step S51: Extract features from the source environment data and the target environment data to generate 18-dimensional features including the sum of the receiving direction packet size, the sum of the sending direction packet size, and the total number of traffic transmission direction changes;

[0062] Step S52: Select samples associated with the key domain name set, and select the best feature subset through a cross-environment feature selection process;

[0063] Step S53: Divide the training set and the n-shot learning sample set, and use the training set to input the training model for preliminary training to generate a classification model;

[0064] Step S54: Use the n-shot learning idea to fine-tune the model, enhance the generalization ability of the model, and generate the final classifier to identify the test samples.

[0065] Compared with the existing technology, the beneficial effects of the present invention are:

[0066] 1. The present invention associates each TCP flow with the domain name information in the log through traffic preprocessing, and then generates a traffic sample with burst characteristics. The feature fusion of domain name information improves the accuracy of encrypted traffic analysis and ensures that network access behavior can be accurately identified and analyzed in an encrypted proxy environment.

[0067] 2. The present invention uses a high-frequency domain name classifier to select high-frequency domain names across environments, updates the threshold based on the classification effect, and more effectively filters out samples in the data set that cannot represent access behavior, reduces the interference of noise data, and improves the accuracy and efficiency of traffic analysis.

[0068] 3. The present invention uses a high-frequency public domain name identification module and a cross-environment feature selection module to screen and train the optimal feature subset in different environments. Combined with a cross-environment website fingerprint recognition classifier, it can realize cross-environment encrypted traffic access behavior recognition, thereby enhancing the system's adaptability and generalization capabilities in diverse network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A flowchart of a method for identifying encrypted traffic access behavior across environments;

[0070] Figure 2 This is the flow chart of traffic preprocessing;

[0071] Figure 3 This is a diagram of how the dataset is organized;

[0072] Figure 4 Generate a process flow chart for the set of high-frequency public domain names;

[0073] Figure 5 Flowchart for the cross-environment feature selection process. DETAILED DESCRIPTION

[0074] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0075] The features and performance of the present invention are further described in detail below with reference to the embodiments.

[0076] Example 1

[0077] See also Figure 1 A method for identifying encrypted traffic access behavior across environments includes the following steps:

[0078] Step S1: Traffic preprocessing. Obtain traffic Pcap packets and corresponding encrypted proxy logs from the source and target environments. Extract the TCP stream from the original Pcap file for each website access and associate it with the domain name in the encrypted proxy log information. Extract statistical features such as packet arrival time and packet size to generate burst structure traffic samples. Figure 2 The feature extraction process is described as follows:

[0079] Step S11: Obtain the traffic Pcap packets and corresponding encrypted proxy logs in the source and target environments, traverse the Pcap packets to extract the TCP flow quintuple information, and associate it with the domain name information in the encrypted proxy log to generate flow-domain name association data in the format of [TCP quintuple 1: [url1], ...];

[0080] The TCP quintuple refers to the source IP address, source port, destination IP address, destination port, and transport layer protocol. The URL refers to the interactive domain name recorded in the encrypted proxy log when the network is accessed through the encrypted proxy.

[0081] Step S12: Traverse the data packet sequence and record the direction and size of each packet. When the direction changes or the packet size exceeds a specified threshold, the current packet is added to the result as a burst and the data arrival time is recorded. Ultimately, a burst structure traffic sample containing direction and size information is generated. The format of the burst structure traffic sample is [[packet arrival time, ±packet size], ...], where ± represents the direction of the flow.

[0082] Step S13: Combine the flow-domain name association data in step S11, summarize the unique domain name information corresponding to each TCP flow and the burst structure packet sequence, and generate a traffic sample in the format of [flow arrival time, burst, flow associated domain name]; since there are multiple visits to each website, multiple domain names appear in each visit, and each domain name is associated with one or more TCP flows, when organizing the data set, domain name information is used to distinguish them. Under each visit, all the domain names that appear and the traffic characteristics corresponding to the domain names are present, such as Figure 3 shown.

[0083] Step S2: Identify high-frequency public domain names. Use the samples and labels of the training website set to train a high-frequency public domain name classifier, filter out high-frequency public domain name information for multiple websites, and filter out data in the dataset that is associated with high-frequency public domain names that cannot represent access behavior. Figure 4 The process of identifying high-frequency public domain names is described, specifically:

[0084] Step S21: traverse the original data sets in the source environment and the target environment respectively and perform statistics based on the same domain name to obtain the total number of occurrences of a single domain name, i.e., a domain name frequency table, and the set of websites corresponding to a single domain name, i.e., a domain name website table;

[0085] Step S22: Calculate the total number of occurrences of all domain names in the source environment and the target environment S all_domain , the proportion of domain names appearing in the training website set TR domain , the proportion of domain names appearing in all domain names HR domain , filter out TR domain Add high-frequency public domain name set HostSet to domain names greater than or equal to the threshold Th com . S all_domain , TR domain , HR domain The calculation process is:

[0086]

[0087] Among them, N domain is the number of times the domain name appears in the dataset, TD web is the number of websites corresponding to the domain name domain in the dataset, TD allwebis the total number of websites in the dataset;

[0088] Step S23: Divide the website set into a training set and a validation set, belonging to HostSet com is a positive sample otherwise it is a negative sample, training high-frequency public domain name classifier Model ch , and continuously traverse the threshold interval to select the threshold and classifier with the best classification effect; the training process of the high-frequency public domain name classifier is:

[0089] Step S231: traverse the websites in the training website set and execute 3.2;

[0090] Step S232: traverse the domain name corresponding to the website, when the domain name belongs to HostSet com When , the samples corresponding to the domain name are divided into training positive samples, otherwise they are divided into training negative samples;

[0091] Step S233: Perform the same operations as 3.1 and 3.2 on the websites in the verification website set to obtain verification positive and negative samples;

[0092] Step S234: Use the training samples to train the random forest model to obtain a high-frequency public domain name classifier, and obtain Model ch ;

[0093] Step S235: Traverse the threshold interval and use the verification sample to check the Model ch Verify the classification effect and obtain F1 score The highest threshold is taken as the Best Th .

[0094] Step S3: Calculate key domain names. Use TF-IDF technology to calculate domain name information that can highly characterize the website to be identified. TF, as a word frequency filter, filters common domain names that appear frequently. IDF assigns less weight to more common domain names and more weight to less common domain names. Multiplying TF and IDF yields the TF-IDF value, which indicates the importance of the website to be identified. The steps for calculating key domain names are as follows:

[0095] Step S31: Count the frequency of each domain name in the sample, i.e., TF, and generate a corresponding domain name frequency dictionary tfdict for each sample i. i The structure is [domain name:TF]. All domain names in the dataset are saved and duplicate domain names are removed to form the domain name set HostSet. The calculation process of TF is:

[0096]

[0097] Among them, c domain is the number of times the domain name domian appears in the current sample, ∑ domian∈dataset C domainis the sum of the number of occurrences of all domain names in the current sample;

[0098] Step S32: Calculate the IDF of each domain name in the domain name set HostSet. The IDF calculation process is:

[0099]

[0100] where c web_Host is the number of websites containing domain names in HostSet, c web_domian is the number of websites that contain domian;

[0101] Step S33: Calculate the TF-IDF corresponding to each domain name in the domain name set HostSet. The TF-IDF calculation process is:

[0102] TF-IDF domain =TF domain ×TDF domain

[0103] Step S34: Combine with tfdict i And TF-IDF generates n×m two-dimensional matrix X, where n is the number of samples and m is the size of the domain name set HostSet. ij Denotes the TF-IDF of the domain name with subscript j in the HostSet for the i-th sample. The median of all TF-IDFs in each column of the two-dimensional matrix is ​​selected as the final TF-IDF of each domain name in the HostSet and added to the TF-IDF-LIST.

[0104] Step S35: traverse TF-IDF-LIST and filter out domain names that are not in the high-frequency public domain name set HostSet com The domain names in the search results are sorted in descending order, and the top 10 domain names are selected as the key domain name set.

[0105] Step S4: Cross-environment feature selection. Select features in rounds, assign different weights to each dimension of features, train the cross-environment feature selection classifier, and obtain the features that are constant or vary very little across environments as the optimal feature subset. Figure 5 The cross-environment feature selection process is described, specifically:

[0106] Step S41: Obtain samples of the website to be identified from the source environment dataset as training positive samples; obtain samples of other websites as training negative samples to generate a training set;

[0107] Step S42: Obtain samples of the website to be identified from the target environment dataset as positive test samples; obtain samples of other websites as negative test samples to generate a training set;

[0108] Step S43: Eliminate high-frequency public domain names HostSet in the training set and test set com Domain names and corresponding features, using the trained high-frequency public domain name classifier Model ch The features are further filtered to retain non-high-frequency public domain name features;

[0109] Step S44: Train the random forest model and calculate the false positive rate (FPR) of each feature in the validation set basic , FPR basic The calculation process is:

[0110]

[0111] Where FP is the number of negative samples that are incorrectly predicted as positive, and TN is the number of negative samples that are correctly predicted as negative;

[0112] Step S45: Set the maximum false positive rate FPR max , and according to FPR basic Dynamically update FPR max , the update process is:

[0113] FPR max =min(FPR max , FPR basic ×ratio)

[0114] Among them, ratio is a pre-set proportional factor used to adjust the calculation of FPR;

[0115] Step S46: Initialize feature score list f score , record the score of each feature and set the negative score neg score = -1000 to mark the selected features. Traverse each feature in turn and calculate the feature score after all feature combinations in the first round. cur , add each feature score to the record;

[0116] Step S47: For each feature, calculate its feature score under the non-selection condition ro , using score ri and score cur Update the feature score list f with the difference of score , and filter features based on FPR and recall;

[0117] Step S48: Iteratively select the features with the highest scores, update the feature scores, mark the selected features as negative scores, and gradually accumulate the optimal feature combination. Fine-tune the feature scores in all rounds to avoid equal feature scores. Finally, sort the feature scores from high to low to generate the optimal feature subset.

[0118] Step S5: Identify cross-environment website access behavior. The optimal feature subset after cross-environment feature selection and the sample dataset associated with the key domain name set are input into the classification model training to generate a cross-environment website access behavior classifier to classify the samples to be identified. The specific steps are:

[0119] Step S51: Extract features from the source environment data and the target environment data to generate 18-dimensional features including the sum of the receiving direction packet size, the sum of the sending direction packet size, and the total number of traffic transmission direction changes;

[0120] Step S52: Select samples associated with the key domain name set, and select the best feature subset through a cross-environment feature selection process;

[0121] Step S53: Divide the training set and the n-shot learning sample set, and use the training set to input the training model for preliminary training to generate a classification model;

[0122] Step S54: Use the n-shot learning idea to fine-tune the model, enhance the generalization ability of the model, and generate the final classifier to identify the test samples.

[0123] The above-described embodiments merely represent specific implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of protection of the present application. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the technical concept of the present application, and all such variations and improvements fall within the scope of protection of the present application.

[0124] This background section is provided to generally present the context of the invention, and the work of the presently named inventors, the work to the extent described in this background section, and aspects of the description in this section that did not constitute prior art at the time of filing are neither explicitly nor implicitly admitted to be prior art to the present invention.

Claims

1. A method for identifying encrypted traffic access behavior across environments, characterized in that: include: Step S1: traffic preprocessing; Obtain traffic Pcap packets and corresponding encrypted proxy logs from the source and target environments. Extract the TCP stream from the original Pcap file for each website access and associate it with the domain name in the encrypted proxy log information. Extract statistical features and generate burst structure traffic samples. Step S2: Identify high-frequency public domain names; use the samples and labels of the training website set to train a high-frequency public domain name classifier, filter out high-frequency public domain name information of multiple websites, and filter out data in the dataset that is associated with high-frequency public domain names that cannot represent access behavior; Step S3: Calculate key domain names; use TF-IDF technology to calculate domain name information that can highly characterize the website to be identified; multiply TF and IDF to obtain the TF-IDF indicator of the importance of the current website to be identified; Step S4: Cross-environment feature selection: select features in rounds, assign different weights to each dimension of features, train the cross-environment feature selection classifier, and obtain the features that are constant or have little variation across environments as the best feature subset; Step S5: Identify cross-environment website access behavior; input the best feature subset after cross-environment feature selection and the sample data set associated with the key domain name set into the classification model training to generate a cross-environment website access behavior classifier to classify the samples to be identified; The step S5 comprises: Step S51: Extract features from the source environment data and the target environment data to generate 18-dimensional features including the sum of the receiving direction packet size, the sum of the sending direction packet size, and the total number of traffic transmission direction changes; Step S52: Select samples associated with the key domain name set, and select the best feature subset through a cross-environment feature selection process; Step S53: Divide the training set and the n-shot learning sample set, and use the training set to input the training model for preliminary training to generate a classification model; Step S54: Use the n-shot learning idea to fine-tune the model, enhance the generalization ability of the model, and generate the final classifier to identify the test samples.

2. A method for identifying encrypted traffic access behavior across environments according to claim 1, characterized in that: The step S1 includes: Step S11: Obtain traffic Pcap packets and corresponding encrypted proxy logs in the source and target environments, traverse the Pcap packets to extract TCP flow quintuple information, and associate it with the domain name information in the encrypted proxy log to generate flow-domain name association data in the format of [TCP quintuple 1: [url1], ...]; where the TCP quintuple refers to the source IP address, source port, destination IP address, destination port, and transport layer protocol; url refers to the interactive domain name recorded in the encrypted proxy log when the network access behavior is performed through the encrypted proxy; Step S12: Traverse the data packet sequence and record the direction and size of each packet. When the direction changes or the packet size exceeds the specified threshold, add the current packet as a burst to the result and record the data arrival time. Finally, generate a burst structure traffic sample containing direction and size information. The format of the burst structure traffic sample is [[packet arrival time, ±packet size], ...], where ± represents the direction of the flow. Step S13: Combined with the flow-domain name association data in step S11, the unique domain name information corresponding to each TCP flow and the burst structure packet sequence are summarized to generate a traffic sample in the format of [flow arrival time, burst, flow-associated domain name]. Since there are multiple visits to each website, multiple domain names appear in each visit, and each domain name is associated with one or more TCP flows, when organizing the data set, domain name information is used to distinguish them. Under each visit, all the domain names that appear and the traffic characteristics corresponding to the domain names are present.

3. A method for identifying encrypted traffic access behavior across environments according to claim 2, characterized in that: The step S2 includes: Step S21: traverse the original data sets in the source environment and the target environment respectively and perform statistics based on the same domain name to obtain the total number of occurrences of a single domain name, i.e., a domain name frequency table, and the set of websites corresponding to a single domain name, i.e., a domain name website table; Step S22: Calculate the total number of occurrences of all domain names in the source environment and the target environment , the proportion of domain names appearing in the training website set , the proportion of domain names appearing in all domain names , filter out Greater than or equal to the threshold Add high-frequency public domain name collection ; Step S23: Divide the website collection into a training set and a validation set, belonging to is a positive sample otherwise it is a negative sample, training a high-frequency public domain name classifier , and continuously traverse the threshold interval to select the threshold and classifier with the best classification effect.

4. A method for identifying cross-environment encrypted traffic access behavior according to claim 3, characterized in that: In step S22 、 、 The calculation process is as follows: in, Domain name in the dataset The number of occurrences, Domain name The corresponding number of websites in the dataset, is the total number of websites in the dataset.

5. A method for identifying encrypted traffic access behavior across environments according to claim 3, characterized in that: The step S23 includes: Step S231: traverse the websites in the training website set and execute step S232; Step S232: traverse the domain name corresponding to the website, when the domain name belongs to When , the samples corresponding to the domain name are divided into training positive samples, otherwise they are divided into training negative samples; Step S233: Perform the same operations as steps S231 and S232 on the websites in the verification website set to obtain verification positive and negative samples; Step S234: Use the training samples to train the random forest model to obtain a high-frequency public domain name classifier. ; Step S235: traverse the threshold interval and use the verification sample to The classification effect is verified and obtained The highest threshold is .

6. A method for identifying encrypted traffic access behavior across environments according to claim 3, characterized in that: The step S3 includes: Step S31: Count the frequency of each domain name in the sample, i.e., TF, and generate a Generate corresponding domain name frequency dictionary , the structure is [domain name: TF]; save all domain names in the dataset and remove duplicate domain names to form a domain name set ; Step S32: Calculate the domain name set The IDF of each domain name in; Step S33: Calculate the domain name set TF-IDF corresponding to each domain name in; Step S34: Combination And TF-IDF generates n×m two-dimensional matrix X, where n is the number of samples and m is the domain name set The size of ; select the median of all TF-IDF in each column of the two-dimensional matrix as the domain name set The final TF-IDF of each domain name in is added to TF-IDF-LIST; Step S35: traverse TF-IDF-LIST and filter out domain names that are not in the high-frequency public domain name set The domain names in the search results are sorted in descending order, and the top 10 domain names are selected as the key domain name set.

7. A method for identifying encrypted traffic access behavior across environments according to claim 6, characterized in that: The calculation process of TF in step S31 is as follows: in, The domain name in the current sample The number of occurrences, is the sum of the number of occurrences of all domain names in the current sample; The calculation process of IDF in step S32 is as follows: in To include The number of websites with the domain name in To include the number of websites; The calculation process of TF-IDF in step S33 is: 。 8. A method for identifying encrypted traffic access behavior across environments according to claim 6, characterized in that: The step S4 comprises: Step S41: Obtain samples of the website to be identified from the source environment dataset as training positive samples; obtain samples of other websites as training negative samples to generate a training set; Step S42: Obtain samples of the website to be identified from the target environment dataset as positive test samples; obtain samples of other websites as negative test samples to generate a training set; Step S43: Eliminate high-frequency public domain names in the training set and test set Domain names and corresponding features, using the trained high-frequency public domain name classifier The features are further filtered to retain non-high-frequency public domain name features; Step S44: Train the random forest model and calculate the false positive rate of each feature in the validation set ; Step S45: Set the maximum false positive rate to , and according to Dynamic Updates ; Step S46: Initialize feature score list , record the score of each feature and set the negative score To mark the selected features; traverse each feature in rounds, and calculate the feature scores after all feature combinations in the first round , add each feature score to the record; Step S47: For each feature, calculate its feature score under the non-selection condition ,use and Update the feature score list with the difference of , and according to and recall screening features; Step S48: Iteratively filter the features with the highest scores, update the feature scores and mark the selected features as negative scores, gradually accumulate the optimal feature combination; and fine-tune the feature scores in all rounds to avoid the situation where the feature scores are equal. Finally, sort the feature scores from high to low to generate the best feature subset.

9. A method for identifying encrypted traffic access behavior across environments according to claim 8, characterized in that: In step S44 The calculation process is as follows: in, is the number of negative samples that are incorrectly predicted as positive, is the number of negative samples correctly predicted as negative; The dynamic update process in step S45 is as follows: in, is a preset scaling factor used to adjust Calculation.

Images