Anonymous traffic detection method, device and equipment

Abstract

The invention relates to the technical field of computer data processing, provides an anonymous traffic detection method, device and equipment, and is used for solving the problems of high calculation overhead and relatively low traffic data troubleshooting efficiency caused by unobvious anonymous traffic characteristics and huge network traffic data volume in related technologies. According to the anonymous traffic detection method provided by the embodiment of the invention, the risk data in the preset time window can be screened out according to the effective features in combination with the kernel density estimation algorithm, the risk window is divided according to the risk data, and the traffic data in the risk window is classified and identified through the classification model to obtain the classification result; according to the technical scheme, traffic classification and identification do not need to be carried out on data of all time windows, the calculation overhead can be effectively reduced, the identification speed is increased, the precision of anonymous traffic detection is improved, and the method is simple and good in universality.

Description

Technical Field

[0001] The present application relates to the field of computer data processing technology, and in particular to a method, device and equipment for detecting anonymous traffic. Background Art

[0002] In the current technical environment, the methods for identifying anonymous network traffic mainly include feature-based methods and statistics-based methods.

[0003] Among them, the feature-based method relies on extracting traffic features from unencrypted protocol headers, and on this basis, identifies the type of traffic through pattern recognition or keyword matching technology. The statistical-based method focuses on analyzing statistical features such as message length and time interval during the interaction of encrypted traffic. These features can be trained and identified through machine learning technology to help detect traffic of various encryption protocols.

[0004] As a typical anonymous proxy system, ShadowSocks is usually deployed on virtual private servers in cloud data centers around the world. The traffic data of anonymous proxy SS is mainly composed of encrypted data based on TCP (Transmission Control Protocol). In the communication process between the client and the remote server, key negotiation and exchange are not involved.

[0005] Since the protocol header of SS traffic lacks obvious distinguishing features and does not have different length-direction features like the methods mentioned above, traditional traffic identification methods face challenges in detecting SS anonymous traffic. In addition, due to the huge amount of traffic data on the network backbone routing, the computational cost of checking all traffic one by one is very high, and the known illegal addresses are limited, making it impossible to conduct effective investigation.

[0006] Therefore, there are problems in the related technology that the anonymous traffic features are not obvious and the amount of network traffic data is huge, resulting in high computing overhead and low efficiency in traffic data investigation. Summary of the invention

[0007] The purpose of this application is to provide an anonymous traffic detection method, device and equipment to solve the problems in the related art that the anonymous traffic characteristics are not obvious and the amount of network traffic data is huge, resulting in high computing overhead and low efficiency in traffic data investigation.

[0008] In a first aspect, the present application provides a method for detecting anonymous traffic, the method comprising:

[0009] Get each flow data in the preset time window;

[0010] Extracting features from each piece of traffic data to obtain a flow context correlation feature and a destination IP address distribution feature of each piece of traffic data;

[0011] Based on the obtained context correlation characteristics of each flow and the distribution characteristics of the destination IP address, a kernel density estimation algorithm is used to determine the risk value of each piece of traffic data;

[0012] If the risk value of any piece of the traffic data is greater than a preset risk threshold, the preset time window is determined to be a risk window;

[0013] The traffic data in the risk window is classified using a trained classification model to obtain a traffic classification result.

[0014] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain a flow context correlation feature of each piece of traffic data, including:

[0015] For any piece of traffic data in the preset time window, perform the following steps:

[0016] For any one of the plurality of preset context relationship types, if the relationship between the current traffic data and the remaining traffic data other than the current traffic data satisfies any one of the relationship types, then updating the characteristic parameters of the current traffic data; wherein the characteristic parameters correspond to any one of the relationship types;

[0017] A flow context correlation feature of the current flow data is determined according to a plurality of feature parameters of the current flow data.

[0018] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain a distribution feature of a destination IP address of each piece of traffic data, including:

[0019] Determine the probability distribution of each destination IP address in the preset time window according to the destination IP address of each piece of traffic data in the preset time window;

[0020] Based on the probability distribution, an entropy value of the preset time window is obtained, and the entropy value is used as a distribution feature of the destination IP address of any piece of traffic data in the preset time window.

[0021] In a possible implementation, the method of determining the risk value of each piece of traffic data by using a kernel density estimation algorithm based on the obtained context correlation features of each flow and the distribution features of the destination IP address includes:

[0022] For any piece of traffic data in the preset time window, perform the following steps:

[0023] Determine a feature matrix vector of the current traffic data based on a flow context correlation feature and a destination IP address distribution feature of the current traffic data;

[0024] The difference between the characteristic matrix vector of the current flow data and the characteristic matrix vector of each flow data in the preset time window is used as the distance between the current flow data and each flow data in the preset time window;

[0025] The distance is normalized by using a preset bandwidth to obtain a normalized distance corresponding to each of the current flow data and each flow data in the preset time window;

[0026] According to the obtained standardized distances and Gaussian kernel functions, kernel density estimation is performed on each piece of flow data to obtain a risk value of the current flow data.

[0027] In a possible implementation, performing kernel density estimation on each piece of flow data according to each of the obtained standardized distances and Gaussian kernel functions to obtain a risk value of the current flow data includes:

[0028] Inputting each of the obtained standardized distances into a Gaussian kernel function to obtain the influence of each flow data in the preset time window on the current flow data;

[0029] Sum the influence of each flow data in the preset time window on the current flow data to obtain the sum of the influence of the preset time window;

[0030] The sum of the influences is normalized by using the preset bandwidth and the quantity of all the traffic data in the preset time window to obtain a kernel function value of the current traffic data;

[0031] The kernel function value of the current traffic data is used as the risk value of the current traffic data.

[0032] In one possible implementation, the following steps are used to train the classification model:

[0033] Acquire a training sample, wherein the training sample includes a sample flow data set and a label set of the sample flow data;

[0034] Inputting the sample flow data set into a classification model for classification prediction processing to obtain a prediction label set;

[0035] The obtained predicted label set and the labeled label set are compared to determine the loss function value, and based on the loss function value, the network parameters of the classification model are updated.

[0036] In a possible implementation, the method further includes:

[0037] When training the classification model, the traffic data whose predicted labels meet the high confidence condition is added to the training samples, and the classification model is iteratively trained through the updated training samples until there is no traffic data meeting the high confidence condition or the preset number of iterations is reached; wherein the high confidence condition is that the absolute value of the predicted label is greater than a preset confidence threshold.

[0038] In a possible implementation manner, classifying the traffic data in the risk window by using a trained classification model to obtain a traffic classification result includes:

[0039] For any piece of traffic data in the risk window, perform the following steps:

[0040] Through the decision function of the trained classification model, the current traffic data is classified and predicted to obtain the prediction label;

[0041] If the predicted label is greater than or equal to 0, the current traffic data is determined to be risky traffic;

[0042] If the predicted label is less than 0, it is determined that the current traffic data is normal traffic.

[0043] In a second aspect, the present application provides an anonymous traffic detection device, the device comprising:

[0044] A flow data acquisition module is configured to acquire each flow data in a preset time window;

[0045] A feature determination module is configured to extract features from each piece of traffic data to obtain a flow context correlation feature and a destination IP address distribution feature of each piece of traffic data;

[0046] A risk value determination module is configured to determine the risk value of each piece of traffic data by using a kernel density estimation algorithm based on the obtained context correlation characteristics of each flow and the distribution characteristics of the destination IP address;

[0047] a risk window determination module, configured to determine the preset time window as a risk window if the risk value of any piece of the traffic data is greater than a preset risk threshold;

[0048] The traffic data classification module is configured to classify the traffic data in the risk window through a trained classification model to obtain a traffic classification result.

[0049] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain a flow context correlation feature of each piece of traffic data, and the feature determination module is configured as follows:

[0050] For any piece of traffic data in the preset time window, perform the following steps:

[0051] For any one of the plurality of preset context relationship types, if the relationship between the current traffic data and the remaining traffic data other than the current traffic data satisfies any one of the relationship types, then updating the characteristic parameters of the current traffic data; wherein the characteristic parameters correspond to any one of the relationship types;

[0052] A flow context correlation feature of the current flow data is determined according to a plurality of feature parameters of the current flow data.

[0053] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain a distribution feature of a destination IP address of each piece of traffic data, and the feature determination module is configured as follows:

[0054] Determine the probability distribution of each destination IP address in the preset time window according to the destination IP address of each piece of traffic data in the preset time window;

[0055] Based on the probability distribution, an entropy value of the preset time window is obtained, and the entropy value is used as a distribution feature of the destination IP address of any piece of traffic data in the preset time window.

[0056] In a possible implementation, based on the obtained context correlation features of each flow and the distribution features of the destination IP address, a kernel density estimation algorithm is used to determine the risk value of each piece of traffic data, and the risk value determination module is configured as follows:

[0057] For any piece of traffic data in the preset time window, perform the following steps:

[0058] Determine a feature matrix vector of the current traffic data based on a flow context correlation feature and a destination IP address distribution feature of the current traffic data;

[0059] The difference between the characteristic matrix vector of the current flow data and the characteristic matrix vector of each flow data in the preset time window is used as the distance between the current flow data and each flow data in the preset time window;

[0060] The distance is normalized by using a preset bandwidth to obtain a normalized distance corresponding to each of the current flow data and each flow data in the preset time window;

[0061] According to the obtained standardized distances and Gaussian kernel functions, kernel density estimation is performed on each piece of flow data to obtain a risk value of the current flow data.

[0062] In a possible implementation, the kernel density estimation is performed on each piece of flow data according to each of the obtained standardized distances and Gaussian kernel functions to obtain a risk value of the current flow data, and the risk value determination module is configured as follows:

[0063] Inputting each of the obtained standardized distances into a Gaussian kernel function to obtain the influence of each flow data in the preset time window on the current flow data;

[0064] Sum the influence of each flow data in the preset time window on the current flow data to obtain the sum of the influence of the preset time window;

[0065] The sum of the influences is normalized by using the preset bandwidth and the quantity of all the traffic data in the preset time window to obtain a kernel function value of the current traffic data;

[0066] The kernel function value of the current traffic data is used as the risk value of the current traffic data.

[0067] In a possible implementation, the traffic data classification module is configured to train the classification model using the following steps:

[0068] Acquire a training sample, wherein the training sample includes a sample flow data set and a label set of the sample flow data;

[0069] Inputting the sample flow data set into a classification model for classification prediction processing to obtain a prediction label set;

[0070] The obtained predicted label set and the labeled label set are compared to determine the loss function value, and based on the loss function value, the network parameters of the classification model are updated.

[0071] In a possible implementation, the traffic data classification module is further configured to:

[0072] When training the classification model, the traffic data whose predicted labels meet the high confidence condition is added to the training samples, and the classification model is iteratively trained through the updated training samples until there is no traffic data meeting the high confidence condition or the preset number of iterations is reached; wherein the high confidence condition is that the absolute value of the predicted label is greater than a preset confidence threshold.

[0073] In a possible implementation, the traffic data in the risk window is classified by using a trained classification model to obtain a traffic classification result, and the traffic data classification module is configured as follows:

[0074] For any piece of traffic data in the risk window, perform the following steps:

[0075] Through the decision function of the trained classification model, the current traffic data is classified and predicted to obtain the prediction label;

[0076] If the predicted label is greater than or equal to 0, the current traffic data is determined to be risky traffic;

[0077] If the predicted label is less than 0, it is determined that the current traffic data is normal traffic.

[0078] In a third aspect, the present application provides an electronic device, including:

[0079] Processor and memory;

[0080] The memory is used to store the processor executable instructions;

[0081] The processor is configured to execute the instructions to implement the anonymous traffic detection method as described in any one of the first aspects of the present application.

[0082] In a fourth aspect, the present application provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the anonymous traffic detection method as described in any one of the items provided in the first aspect of the present application.

[0083] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the anonymous traffic detection method as described in any one of the items provided in the first aspect of the present application.

[0084] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0085] The anonymous traffic detection method provided in the embodiment of the present application can screen out risk data in a preset time window based on effective features combined with a kernel density estimation algorithm, and divide the risk window accordingly. The traffic data in the risk window is classified and identified through a classification model to obtain a classification result. It is not necessary to classify and identify traffic data in all time windows, which can effectively reduce computing overhead, speed up identification, and improve the accuracy of anonymous traffic detection. The technical solution provided by the present application is simple in method and has good versatility.

[0086] It should be understood that the above general description and the following detailed description are only exemplary and explanatory and cannot limit the present application. Based on the common sense in the art, the above preferred conditions can be combined arbitrarily to obtain the preferred embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0088] Figure 1 A schematic diagram of an application scenario of an anonymous traffic detection method provided in an embodiment of the present application;

[0089] Figure 2 A schematic diagram of the overall process of an anonymous traffic detection method provided in an embodiment of the present application;

[0090] Figure 3 A schematic diagram of a sliding window provided in an embodiment of the present application;

[0091] Figure 4 A schematic diagram of a process for determining flow context correlation features provided in an embodiment of the present application;

[0092] Figure 5 A schematic diagram of a process for determining the distribution characteristics of a destination IP address provided in an embodiment of the present application;

[0093] Figure 6 A schematic diagram of a process for determining the risk value of each piece of traffic data using a kernel density estimation algorithm provided in an embodiment of the present application;

[0094] Figure 7 A schematic diagram of a process for determining the risk value of current traffic data provided in an embodiment of the present application;

[0095] Figure 8 A schematic diagram of a process for training a classification model provided in an embodiment of the present application;

[0096] Fig. 9 A schematic diagram of the structure of an anonymous traffic detection device provided in an embodiment of the present application;

[0097] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0098] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0099] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “ / ” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0100] In the following, the terms "first", "second", and "first" are used for descriptive purposes only and should not be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first", "second", or "first" may explicitly or implicitly include one or more of the features.

[0101] The following is an explanation of the professional terms and technologies involved in this application:

[0102] Anonymous network traffic technology: Anonymous technology aims to hide the identity and location of users and prevent them from being tracked through network traffic analysis. It is usually used to protect user privacy and prevent cyber attackers or monitoring agencies from discovering their true identity and location.

[0103] ShadowSocks (SS): is an open source proxy tool designed to help users bypass Internet censorship, especially when certain countries and regions block specific websites. It encrypts traffic to conceal the user's access behavior, thereby enabling access to restricted content. Shadowsocks uses the SOCKS5 protocol, allowing users to access network resources through a remote proxy server. It bypasses firewalls or network restrictions by encrypting user traffic and forwarding it through a proxy server. When a user uses a Shadowsocks client locally, the client encrypts the traffic and sends it to the configured Shadowsocks server. The server decrypts the traffic and forwards the request to the target website. After returning the data, it is encrypted again and sent back to the user.

[0104] Virtual Private Server: is a virtualization technology that divides a physical server into multiple independent virtual servers, each with its own operating system and resources (such as CPU, memory, storage, etc.). Although multiple VPSs share the hardware of the same physical server, they behave like independent servers in use.

[0105] Kernel density estimation: is a non-parametric statistical method used to estimate the probability density function of a random variable. It "expands" each data point into a smooth distribution, and then superimposes these distributions to obtain the overall probability density distribution of the data. Kernel density estimation can be used to see the overall distribution of the data and can be used to detect abnormal patterns or irregular traffic in network traffic.

[0106] Semi-supervised learning: Semi-supervised learning is a machine learning method that lies between supervised learning and unsupervised learning. It uses a small amount of labeled data (labeled data) and a large amount of unlabeled data (unlabeled data) for model training, which can reduce the labeling cost and improve the model performance.

[0107] Self-training learning: is a commonly used semi-supervised learning method that aims to improve the performance of the model by using a large amount of unlabeled data and a small amount of labeled data. Self-training learning gradually enhances the learning ability of the model by iteratively using the model's prediction results for unlabeled data as "pseudo labels" and adding these pseudo-labeled data to the training set.

[0108] Encrypted and anonymous network traffic technologies, such as SSH, TOR, VPN, etc., provide an effective way to encrypt users' communication content and hide their true identity. These technologies play an important role in protecting the privacy of legitimate users, allowing users to safely bypass geographic restrictions and access restricted content. However, due to the high anonymity and encryption characteristics of these technologies, they are also widely used by illegal network actors and become an important tool for carrying out various illegal activities. These illegal activities include data theft, the dissemination of illegal pornographic content, cyber attacks, and transactions on the dark web. Therefore, the identification and monitoring of these encrypted traffic is particularly important, which is of vital significance for maintaining network security and combating cybercrime.

[0109] In the current technical environment, the methods for identifying anonymous network traffic mainly include feature-based methods and statistics-based methods.

[0110] Among them, the feature-based method relies on extracting traffic features from unencrypted protocol headers, and on this basis, identifies the type of traffic through pattern recognition or keyword matching technology. The statistical-based method focuses on analyzing statistical features such as message length and time interval during the interaction of encrypted traffic. These features can be trained and identified through machine learning technology to help detect traffic of various encryption protocols.

[0111] As a typical anonymous proxy system, ShadowSocks is usually deployed on virtual private servers in cloud data centers around the world. The traffic data of anonymous proxy SS is mainly composed of encrypted data based on TCP (Transmission Control Protocol). In the communication process between the client and the remote server, key negotiation and exchange are not involved.

[0112] Since the protocol header of SS traffic lacks obvious distinguishing features and does not have different length-direction features like the methods mentioned above, traditional traffic identification methods face challenges in detecting SS anonymous traffic. In addition, due to the huge amount of traffic data on the network backbone routing, the computational cost of checking all traffic one by one is very high, and the known illegal addresses are limited, making it impossible to conduct effective investigation.

[0113] Therefore, there are problems in the related technology that the anonymous traffic features are not obvious and the amount of network traffic data is huge, resulting in high computing overhead and low efficiency in traffic data investigation.

[0114] In view of this, the present application provides an anonymous traffic detection method, device and equipment to solve the problems in the related art that the anonymous traffic characteristics are not obvious and the amount of network traffic data is huge, resulting in high computing overhead and low efficiency in traffic data investigation.

[0115] The inventive concept of the present application can be summarized as follows: first, feature extraction is performed on each piece of traffic data in a preset time window to obtain the flow context correlation feature and the destination IP address distribution feature of each piece of traffic data; then, based on the flow context correlation feature and the destination IP address distribution feature, a kernel density estimation algorithm is used to determine the risk value of each piece of traffic data, and the risk window is screened out by comparing the risk value of the traffic data with the preset risk threshold; finally, the traffic data in the risk window is classified by the trained classification model to obtain a traffic classification result.

[0116] In summary, the anonymous traffic detection method provided in the embodiment of the present application can screen out risk data in a preset time window based on effective features combined with a kernel density estimation algorithm, and divide the risk window accordingly. The traffic data in the risk window is classified and identified through a classification model to obtain a classification result. It is not necessary to classify and identify traffic data in all time windows, which can effectively reduce computing overhead, speed up identification speed, and improve the accuracy of anonymous traffic detection. The technical solution provided by the present application is simple in method and has good versatility.

[0117] After introducing the main inventive ideas of the embodiments of the present application, the following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0118] For ease of understanding, the following is a detailed description of an anonymous traffic detection method provided by an embodiment of the present application in conjunction with the accompanying drawings:

[0119] like Figure 1 As shown, it is a schematic diagram of an application scenario of an anonymous traffic detection method provided by an embodiment of the present application. The figure includes: a network 10, a server 20, and a memory 30. The server 20 obtains traffic data of a preset time window through the network. Through the method provided by the embodiment of the present application, the traffic data of the preset time window can be detected and processed, and whether the traffic is risky traffic can be accurately determined, thereby improving the efficiency and accuracy of traffic detection.

[0120] The description in this application only details a single server, but those skilled in the art should understand that the network 10, server 20 and memory 30 shown are intended to represent the operation of the electronic device, server and memory involved in the technical solution of this application. The single server and memory are described in detail at least for the convenience of explanation, and do not imply any restrictions on the number, type or location of the server. It should be noted that if additional modules are added to the illustrated environment or individual modules are removed from it, it will not change the underlying concepts of the example embodiments of this application. In addition, although for the convenience of explanation, Figure 1 A bidirectional arrow from the storage 30 to the server 20 is shown in the figure, but those skilled in the art can understand that the sending and receiving of the above data also needs to be implemented through the network 10.

[0121] It should be noted that the memory in the embodiment of the present application may be, for example, a cache system, a hard disk storage, a memory storage, etc. In addition, the processing method of the spectral data proposed in the present application is not only applicable to Figure 1 The application scenario shown can also be used in other possible application scenarios, and the embodiments of the present application are not limited thereto.

[0122] Based on the above description, the present application provides an anonymous traffic detection method, the overall process of which is as follows: Figure 2 As shown, including the following:

[0123] In step 201, each piece of flow data in a preset time window is obtained.

[0124] In a possible implementation, the present application embodiment uses a sliding window to collect and acquire traffic data, such as Figure 3 As shown, the sliding window can be set to a window size w flow =10s, sliding step b=w flow =10s, each sliding window is used as a preset time window, and the flow data in the window is subsequently calculated.

[0125] It should be added that the present application also requires preprocessing of the flow data within a preset time window, and the specific preprocessing steps are not described here.

[0126] In step 202, feature extraction is performed on each piece of traffic data to obtain a flow context correlation feature and a destination IP address distribution feature of each piece of traffic data.

[0127] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain the flow context correlation feature of each piece of traffic data. The process is as follows: Figure 4 As shown, it can be implemented as:

[0128] For any piece of traffic data in the preset time window, perform the following steps:

[0129] In step 401, for any relationship type of multiple preset context relationship types, if the relationship between the current traffic data and the remaining traffic data other than the current traffic data satisfies any relationship type, the characteristic parameters of the current traffic data are updated; wherein the characteristic parameters correspond to any relationship type.

[0130] In step 402, flow context correlation features of the current traffic data are determined according to a plurality of feature parameters of the current traffic data.

[0131] In the embodiment of the present application, there are multiple preset context relationship types. Assuming f and g are two arbitrary traffic flows, the five preset context relationship types are as follows:

[0132] R S_DP :f.sip=g.sip,f.dip=g.dip,f.dport=g.dport, indicating that the same source host requests the same target service;

[0133] R S_D :f.sip=g.sip,f.dip=g.dip, indicating that the same source host requests one or more services of the destination IP;

[0134] R DP :f.dip=g.dip,d.fport=g.dport, indicating that one or more source hosts request the same target service;

[0135] R D :f.dip=g.dip, indicating that one or more source hosts request the same destination IP;

[0136] R S :f.sip=g.sip, receiving the same destination IP on one or more destination IPs or target services.

[0137] When a user uses the anonymous proxy system SS to access the target service, all connections initiated by the host application to the target service will be proxied, resulting in a change in the context of the flow.

[0138] For example, when a user visits a web page containing images, videos, and advertisements, services need to be provided by the network server, image server, video server, and advertisement server. If the anonymous proxy system SS is not used to access the web page, the user host needs to establish connections with n target hosts at the same time; if the anonymous proxy system SS is used to access the web page, the host will establish multiple connections with the SS server, and the SS server will then initiate requests to the n target hosts. Therefore, satisfying R S_D and R S_DP The amount of flow data will be significantly higher than that in non-SS processes.

[0139] When multiple users in the network use the same SS service at the same time, the flows from different hosts to multiple different target services are all executed by the anonymous proxy system SS; when the anonymous proxy system SS is not used, the flows between different hosts and different target servers are unrelated. Therefore, when the anonymous proxy system SS is used, R D and R DP The amount of flow data will be significantly higher than that in non-SS processes.

[0140] Based on the above-described changes in flow context features caused by using the anonymous proxy system SS and not using the anonymous proxy system SS, the embodiment of the present application determines whether the flow involves the anonymous proxy system SS by acquiring the flow context correlation features of each flow data.

[0141] In the preset time window w flowThe following formula is used to calculate the correlation between any flow f being processed in the window and the previous and next flows G = g1, g2, ...;

[0142]

[0143] For example, each flow data f will obtain a feature vector [S_DP, S_D, DP, D, S]. f and each other flow in the window are calculated using the above formula. If the relationship in the above formula is satisfied, then +1 is added. For example, the flow data f and 10 flow data in the window satisfy the relationship S_DP and S_D, 20 data satisfy the relationship DP and D, and 0 data satisfy the relationship S. Then the feature of the flow data f will be [10, 10, 20, 20, 0], which is the flow context correlation feature.

[0144] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain the distribution feature of the destination IP address of each piece of traffic data. The process is as follows: Figure 5 As shown, it can be implemented as:

[0145] In step 501, the probability distribution of each destination IP address in the preset time window is determined according to the destination IP address of each piece of traffic data in the preset time window.

[0146] In step 502, based on the probability distribution, an entropy value of a preset time window is obtained, and the entropy value is used as a distribution feature of a destination IP address of any piece of traffic data in the preset time window.

[0147] When using a host of the anonymous proxy system SS, the network connection that the client should establish with the target server is changed to a connection between the client and the SS server, which makes the destination of more traffic data gather on one host. Therefore, the distribution of the destination IP addresses of the traffic data generated by the host using the anonymous proxy system SS has certain centralized characteristics, which is different from the dispersed distribution of the destination IP addresses of the traffic data generated by the host not using the anonymous proxy system SS. The embodiment of the present application measures the degree of dispersion of the destination IP addresses by calculating the entropy of the set of destination IP addresses accessed by the host in a given time.

[0148] For example, let dipSet = {ip1, ip2, ..., ip n} is the destination IP address of the host connection within the preset time window, ip i is the i-th destination IP address, let P = {p1, p2, ..., p i ,...,p n} is the probability distribution of dipSet, p i is ip i The probability of, the entropy is The larger the entropy value, the more dispersed the IP addresses of the destination hosts accessed by the host, and the lower the probability that the host uses the anonymous proxy system SS; the smaller the entropy value, the more concentrated the IP addresses of the destination hosts accessed by the host, and the higher the probability that the host uses the anonymous proxy system SS.

[0149] The embodiment of the present application proposes effective features based on user usage habits, including flow context correlation features and destination IP address distribution features, and can distinguish risky traffic from normal traffic based on the effective features.

[0150] In step 203, based on the obtained context correlation characteristics of each flow and the distribution characteristics of the destination IP address, a kernel density estimation algorithm is used to determine the risk value of each piece of traffic data.

[0151] In a possible implementation, based on the obtained context correlation characteristics of each flow and the distribution characteristics of the destination IP address, a kernel density estimation algorithm is used to determine the risk value of each flow data. The process is as follows: Figure 6 As shown, it can be implemented as:

[0152] For any piece of traffic data in the preset time window, perform the following steps:

[0153] In step 601, a feature matrix vector of the current traffic data is determined based on the flow context correlation characteristics and the destination IP address distribution characteristics of the current traffic data.

[0154] For example, the flow context correlation feature of the current traffic data is [10, 10, 20, 20, 0], and the destination IP address distribution feature, i.e., the entropy, is [5]. Then, the feature matrix vector of the current traffic data is [10, 10, 20, 20, 0, 5].

[0155] In step 602, the difference between the characteristic matrix vector of the current flow data and the characteristic matrix vector of each flow data in the preset time window is used as the distance between the current flow data and each flow data in the preset time window.

[0156] In step 603, the distance is standardized using a preset bandwidth to obtain the standardized distances corresponding to the current flow data and each flow data in the preset time window.

[0157] In step 604, kernel density estimation is performed on each piece of flow data according to each obtained standardized distance and Gaussian kernel function to obtain a risk value of the current flow data.

[0158] In a possible implementation, kernel density estimation is performed on each flow data according to each obtained standardized distance and Gaussian kernel function to obtain the risk value of the current flow data. The process is as follows: Figure 7As shown, it can be implemented as:

[0159] In step 701, each obtained standardized distance is input into a Gaussian kernel function to obtain the influence of each flow data in a preset time window on the current flow data.

[0160] In step 702, the influence of each flow data in the preset time window on the current flow data is summed up to obtain the sum of the influence of the preset time window.

[0161] In step 703, the sum of influences is normalized using the preset bandwidth and the quantity of all traffic data in the preset time window to obtain a kernel function value of the current traffic data.

[0162] In step 704, the kernel function value of the current traffic data is used as the risk value of the current traffic data.

[0163] In a possible implementation, the embodiment of the present application uses the following kernel density estimation algorithm formula to determine the risk value of the current traffic data:

[0164]

[0165] Among them, x represents the characteristic matrix vector of the current traffic data, x i Represents the characteristic matrix vector of the i-th flow data in the preset time window, represents the Gaussian kernel function, Indicates the preset bandwidth. Represents the standard deviation of all traffic data in the preset time window, represents the mean of all traffic data in the preset time window, n or N represents the number of all traffic data in the preset time window, Indicates the risk value of the current traffic data.

[0166] In step 204, if the risk value of any piece of traffic data is greater than a preset risk threshold, the preset time window is determined to be a risk window.

[0167] For example, setting a risk threshold When the value of one or more traffic data in the preset time window is greater than the risk threshold, the preset time window is divided into a risk window, and all data in the risk window is divided into suspected risk data and used for the next classification model processing.

[0168] In step 205, the traffic data in the risk window is classified using the trained classification model to obtain a traffic classification result.

[0169] In a possible implementation, the present application embodiment adopts the following steps to train the classification model, and the process is as follows: Figure 8As shown, it can be implemented as:

[0170] In step 801, a training sample is obtained, where the training sample includes a sample flow data set and an annotated label set of the sample flow data.

[0171] In step 802, the sample traffic data set is input into the classification model for classification prediction processing to obtain a prediction label set.

[0172] In step 803, the obtained predicted label set is compared with the labeled label set to determine the loss function value, and based on the loss function value, the network parameters of the classification model are updated.

[0173] For example, the sample traffic data with known labels is X known , whose label is Y known ; The traffic data of unknown tags is X unknown , whose predicted label is Y unknown ; All data X T =[X known ,X unknown ],Y T =[Y known ,Y unknown ], +1 is positive, indicating risk traffic, -1 is negative, indicating normal traffic. known , and the corresponding label Y known To train the initial support vector machine (SVM) model f(x) = ω T x+b, ω is the slope, b is the bias, a sample traffic data and its corresponding annotation label are input, the predicted label set and the annotation label set are compared, the loss function value is determined, and based on the loss function value, the network parameters of the classification model are updated. Finally, the optimal ω and b are determined through training to obtain the optimal support vector machine (SVM) model.

[0174] In one possible implementation, when training a classification model, the embodiment of the present application also adds traffic data whose prediction labels satisfy high confidence conditions to training samples, and iteratively trains the classification model through updated training samples until there is no traffic data satisfying the high confidence conditions or a preset number of iterations is reached; wherein the high confidence condition is that the absolute value of the prediction label is greater than a preset confidence threshold.

[0175] For example, when the traffic data with unknown labels is X unknown In the example, the traffic data with higher confidence is selected as the sample. The confidence is measured by the absolute value of the output value of the decision function. The larger the value, the farther away from the hyperplane, and the higher the confidence. The embodiment of the present application uses the formula |ω T x j+b|>0.9, select high-confidence traffic data, add high-confidence traffic to the sample traffic data set with known labels and the annotated label set as X known , Y known The training is completed until there is no more high-confidence traffic data to be added to the sample traffic data set, or the preset number of iterations (such as 100,000) is reached.

[0176] The above-mentioned method of training the classification model is a semi-supervised learning algorithm. When only partial labeled data is available, it can effectively classify and judge unknown traffic data, solving the pain point of the industry that is unable to effectively judge actual data due to lack of data.

[0177] In a possible implementation, the traffic data in the risk window is classified by a trained classification model to obtain a traffic classification result, which can be implemented as follows:

[0178] For any piece of traffic data in the risk window, perform the following steps:

[0179] Through the decision function of the trained classification model, the current traffic data is classified and predicted to obtain the prediction label;

[0180] If the predicted label is greater than or equal to 0, the current traffic data is determined to be risky traffic;

[0181] If the predicted label is less than 0, it is determined that the current traffic data is normal traffic.

[0182] For example, use the trained classification model to classify traffic data X with unknown labels. unknown Make an initial prediction and get the predicted label Y unknown For any unknown label traffic data x j ∈X unknown , through the decision function of the classification model Make a prediction, if the predicted label Otherwise, it is a positive class +1, otherwise it is a negative class -1, that is, risk flow +1 and normal flow -1.

[0183] In a possible implementation, for traffic data processed by the classification model, when a piece of traffic data is marked as +1, i.e., risky traffic, the system can perform a series of processing such as tracking and alarming as needed.

[0184] To sum up, the anonymous traffic detection method provided in the embodiment of the present application can screen out risk data in a preset time window based on effective features combined with a kernel density estimation algorithm, and divide the risk window accordingly. The traffic data in the risk window is classified and identified through a classification model to obtain a classification result. It is not necessary to classify and identify traffic data in all time windows, which can effectively reduce computing overhead, speed up identification speed, and improve the accuracy of anonymous traffic detection. The technical solution provided by the present application is simple in method and has good versatility.

[0185] Based on the same inventive concept, the embodiment of the present application also provides a detection device for anonymous traffic, such as Fig. 9 As shown, the device 900 includes:

[0186] The flow data acquisition module 901 is configured to acquire each flow data in a preset time window;

[0187] The feature determination module 902 is configured to extract features from each piece of traffic data to obtain a flow context correlation feature and a destination IP address distribution feature of each piece of traffic data;

[0188] The risk value determination module 903 is configured to determine the risk value of each of the flow data by using a kernel density estimation algorithm based on the obtained context correlation characteristics of each flow and the distribution characteristics of the destination IP address;

[0189] The risk window determination module 904 is configured to determine the preset time window as a risk window if the risk value of any piece of the traffic data is greater than a preset risk threshold;

[0190] The traffic data classification module 905 is configured to classify the traffic data in the risk window by using a trained classification model to obtain a traffic classification result.

[0191] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain a flow context correlation feature of each piece of traffic data, and the feature determination module is configured as follows:

[0192] For any piece of traffic data in the preset time window, perform the following steps:

[0193] For any one of the plurality of preset context relationship types, if the relationship between the current traffic data and the remaining traffic data other than the current traffic data satisfies any one of the relationship types, then updating the characteristic parameters of the current traffic data; wherein the characteristic parameters correspond to any one of the relationship types;

[0194] A flow context correlation feature of the current flow data is determined according to a plurality of feature parameters of the current flow data.

[0195] In a possible implementation, feature extraction is performed on each piece of traffic data to obtain a distribution feature of a destination IP address of each piece of traffic data, and the feature determination module is configured as follows:

[0196] Determine the probability distribution of each destination IP address in the preset time window according to the destination IP address of each piece of traffic data in the preset time window;

[0197] Based on the probability distribution, an entropy value of the preset time window is obtained, and the entropy value is used as a distribution feature of the destination IP address of any piece of traffic data in the preset time window.

[0198] In a possible implementation, based on the obtained context correlation features of each flow and the distribution features of the destination IP address, a kernel density estimation algorithm is used to determine the risk value of each piece of traffic data, and the risk value determination module is configured as follows:

[0199] For any piece of traffic data in the preset time window, perform the following steps:

[0200] Determine a feature matrix vector of the current traffic data based on a flow context correlation feature and a destination IP address distribution feature of the current traffic data;

[0201] The difference between the characteristic matrix vector of the current flow data and the characteristic matrix vector of each flow data in the preset time window is used as the distance between the current flow data and each flow data in the preset time window;

[0202] The distance is normalized by using a preset bandwidth to obtain a normalized distance corresponding to each of the current flow data and each flow data in the preset time window;

[0203] According to the obtained standardized distances and Gaussian kernel functions, kernel density estimation is performed on each piece of flow data to obtain a risk value of the current flow data.

[0204] In a possible implementation, the kernel density estimation is performed on each piece of flow data according to each of the obtained standardized distances and Gaussian kernel functions to obtain a risk value of the current flow data, and the risk value determination module is configured as follows:

[0205] Inputting each of the obtained standardized distances into a Gaussian kernel function to obtain the influence of each flow data in the preset time window on the current flow data;

[0206] Sum the influence of each flow data in the preset time window on the current flow data to obtain the sum of the influence of the preset time window;

[0207] The sum of the influences is normalized by using the preset bandwidth and the quantity of all the traffic data in the preset time window to obtain a kernel function value of the current traffic data;

[0208] The kernel function value of the current traffic data is used as the risk value of the current traffic data.

[0209] In a possible implementation, the traffic data classification module is configured to train the classification model using the following steps:

[0210] Acquire a training sample, wherein the training sample includes a sample flow data set and a label set of the sample flow data;

[0211] Inputting the sample flow data set into a classification model for classification prediction processing to obtain a prediction label set;

[0212] The obtained predicted label set and the labeled label set are compared to determine the loss function value, and based on the loss function value, the network parameters of the classification model are updated.

[0213] In a possible implementation, the traffic data classification module is further configured to:

[0214] When training the classification model, the traffic data whose predicted labels meet the high confidence condition is added to the training samples, and the classification model is iteratively trained through the updated training samples until there is no traffic data meeting the high confidence condition or the preset number of iterations is reached; wherein the high confidence condition is that the absolute value of the predicted label is greater than a preset confidence threshold.

[0215] In a possible implementation, the traffic data in the risk window is classified by using a trained classification model to obtain a traffic classification result, and the traffic data classification module is configured as follows:

[0216] For any piece of traffic data in the risk window, perform the following steps:

[0217] Through the decision function of the trained classification model, the current traffic data is classified and predicted to obtain the prediction label;

[0218] If the predicted label is greater than or equal to 0, the current traffic data is determined to be risky traffic;

[0219] If the predicted label is less than 0, it is determined that the current traffic data is normal traffic.

[0220] Refer to the following Fig.10 The electronic device 130 according to this embodiment of the present application is described. Fig.10 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0221] like Fig.10 As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: the at least one processor 131, the at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0222] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0223] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0224] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0225] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0226] In an exemplary embodiment, the present application further provides a computer-readable storage medium including instructions, such as a memory 132 including instructions, and the above instructions can be executed by the processor 131 of the electronic device 130 to complete the above anonymous traffic detection method. Optionally, the computer-readable storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0227] In an exemplary embodiment, a computer program product is also provided, including a computer program, and when the computer program is executed by the processor 131, the anonymous traffic detection method provided in the present application is implemented.

[0228] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0229] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0230] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0231] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0232] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting anonymous traffic, characterized in that: The method comprises: Get each flow data in the preset time window; Extracting features from each piece of traffic data to obtain a flow context correlation feature and a destination IP address distribution feature of each piece of traffic data; Based on the obtained context correlation characteristics of each flow and the distribution characteristics of the destination IP address, a kernel density estimation algorithm is used to determine the risk value of each piece of traffic data; If the risk value of any piece of the traffic data is greater than a preset risk threshold, the preset time window is determined to be a risk window; The traffic data in the risk window is classified using a trained classification model to obtain a traffic classification result.

2. The method according to claim 1, characterized in that: Feature extraction is performed on each piece of traffic data to obtain a flow context correlation feature of each piece of traffic data, including: For any piece of traffic data in the preset time window, perform the following steps: For any one of the plurality of preset context relationship types, if the relationship between the current traffic data and the remaining traffic data other than the current traffic data satisfies any one of the relationship types, then updating the characteristic parameters of the current traffic data; wherein the characteristic parameters correspond to any one of the relationship types; A flow context correlation feature of the current flow data is determined according to a plurality of feature parameters of the current flow data.

3. The method according to claim 1, characterized in that Feature extraction is performed on each piece of traffic data to obtain the destination IP address distribution feature of each piece of traffic data, including: Determine the probability distribution of each destination IP address in the preset time window according to the destination IP address of each piece of traffic data in the preset time window; Based on the probability distribution, an entropy value of the preset time window is obtained, and the entropy value is used as a distribution feature of the destination IP address of any piece of traffic data in the preset time window.

4. The method according to claim 1, characterized in that The method of determining the risk value of each piece of traffic data by using a kernel density estimation algorithm based on the obtained context correlation features of each flow and the distribution features of the destination IP address includes: For any piece of traffic data in the preset time window, perform the following steps: Determine a feature matrix vector of the current traffic data based on a flow context correlation feature and a destination IP address distribution feature of the current traffic data; The difference between the characteristic matrix vector of the current flow data and the characteristic matrix vector of each flow data in the preset time window is used as the distance between the current flow data and each flow data in the preset time window; The distance is normalized by using a preset bandwidth to obtain a normalized distance corresponding to each of the current flow data and each flow data in the preset time window; According to the obtained standardized distances and Gaussian kernel functions, kernel density estimation is performed on each piece of flow data to obtain a risk value of the current flow data.

5. The method according to claim 4, characterized in that The step of performing kernel density estimation on each piece of flow data according to each of the obtained standardized distances and Gaussian kernel functions to obtain a risk value of the current flow data includes: Inputting each of the obtained standardized distances into a Gaussian kernel function to obtain the influence of each flow data in the preset time window on the current flow data; Sum the influence of each flow data in the preset time window on the current flow data to obtain the sum of the influence of the preset time window; The sum of the influences is normalized by using the preset bandwidth and the quantity of all the traffic data in the preset time window to obtain a kernel function value of the current traffic data; The kernel function value of the current traffic data is used as the risk value of the current traffic data.

6. The method according to claim 1, characterized in that The following steps are used to train the classification model: Acquire a training sample, wherein the training sample includes a sample flow data set and a label set of the sample flow data; Inputting the sample flow data set into a classification model for classification prediction processing to obtain a prediction label set; The obtained predicted label set and the labeled label set are compared to determine the loss function value, and based on the loss function value, the network parameters of the classification model are updated.

7. The method according to claim 6, characterized in that The method further comprises: When training the classification model, the traffic data whose predicted labels meet the high confidence condition is added to the training samples, and the classification model is iteratively trained through the updated training samples until there is no traffic data meeting the high confidence condition or the preset number of iterations is reached; wherein the high confidence condition is that the absolute value of the predicted label is greater than a preset confidence threshold.

8. The method according to any one of claims 1 to 7, characterized in that: The traffic data in the risk window is classified by the trained classification model to obtain a traffic classification result, including: For any piece of traffic data in the risk window, perform the following steps: Through the decision function of the trained classification model, the current traffic data is classified and predicted to obtain the prediction label; If the predicted label is greater than or equal to 0, the current traffic data is determined to be risky traffic; If the predicted label is less than 0, it is determined that the current traffic data is normal traffic.

9. An anonymous traffic detection device, characterized in that: The device comprises: A flow data acquisition module is configured to acquire each flow data in a preset time window; A feature determination module is configured to extract features from each piece of traffic data to obtain a flow context correlation feature and a destination IP address distribution feature of each piece of traffic data; A risk value determination module is configured to determine the risk value of each piece of traffic data by using a kernel density estimation algorithm based on the obtained context correlation characteristics of each flow and the distribution characteristics of the destination IP address; a risk window determination module, configured to determine the preset time window as a risk window if the risk value of any piece of the traffic data is greater than a preset risk threshold; The traffic data classification module is configured to classify the traffic data in the risk window through a trained classification model to obtain a traffic classification result.

10. The device according to claim 9, characterized in that Feature extraction is performed on each piece of traffic data to obtain a flow context correlation feature of each piece of traffic data. The feature determination module is configured as follows: For any piece of traffic data in the preset time window, perform the following steps: For any one of the plurality of preset context relationship types, if the relationship between the current traffic data and the remaining traffic data other than the current traffic data satisfies any one of the relationship types, then updating the characteristic parameters of the current traffic data; wherein the characteristic parameters correspond to any one of the relationship types; A flow context correlation feature of the current flow data is determined according to a plurality of feature parameters of the current flow data.

11. The device according to claim 9, characterized in that Feature extraction is performed on each piece of traffic data to obtain a distribution feature of a destination IP address of each piece of traffic data. The feature determination module is configured as follows: Determine the probability distribution of each destination IP address in the preset time window according to the destination IP address of each piece of traffic data in the preset time window; Based on the probability distribution, an entropy value of the preset time window is obtained, and the entropy value is used as a distribution feature of the destination IP address of any piece of traffic data in the preset time window.

12. The device according to claim 9, characterized in that Based on the obtained context correlation features of each flow and the distribution features of the destination IP address, a kernel density estimation algorithm is used to determine the risk value of each piece of traffic data, and the risk value determination module is configured as follows: For any piece of traffic data in the preset time window, perform the following steps: Determine a feature matrix vector of the current traffic data based on a flow context correlation feature and a destination IP address distribution feature of the current traffic data; The difference between the characteristic matrix vector of the current flow data and the characteristic matrix vector of each flow data in the preset time window is used as the distance between the current flow data and each flow data in the preset time window; The distance is normalized by using a preset bandwidth to obtain a normalized distance corresponding to each of the current flow data and each flow data in the preset time window; According to the obtained standardized distances and Gaussian kernel functions, kernel density estimation is performed on each piece of flow data to obtain a risk value of the current flow data.

13. The device according to claim 12, characterized in that According to the obtained standardized distances and Gaussian kernel functions, kernel density estimation is performed on each piece of traffic data to obtain the risk value of the current traffic data. The risk value determination module is configured as follows: Inputting each of the obtained standardized distances into a Gaussian kernel function to obtain the influence of each flow data in the preset time window on the current flow data; Sum the influence of each flow data in the preset time window on the current flow data to obtain the sum of the influence of the preset time window; The sum of the influences is normalized by using the preset bandwidth and the quantity of all the traffic data in the preset time window to obtain a kernel function value of the current traffic data; The kernel function value of the current traffic data is used as the risk value of the current traffic data.

14. The device according to claim 9, characterized in that The traffic data classification module is configured to train the classification model using the following steps: Acquire a training sample, wherein the training sample includes a sample flow data set and a label set of the sample flow data; Inputting the sample flow data set into a classification model for classification prediction processing to obtain a prediction label set; The obtained predicted label set and the labeled label set are compared to determine the loss function value, and based on the loss function value, the network parameters of the classification model are updated.

15. The device according to claim 14, characterized in that The traffic data classification module is further configured to: When training the classification model, the traffic data whose predicted labels meet the high confidence condition is added to the training samples, and the classification model is iteratively trained through the updated training samples until there is no traffic data meeting the high confidence condition or the preset number of iterations is reached; wherein the high confidence condition is that the absolute value of the predicted label is greater than a preset confidence threshold.

16. The device according to any one of claims 9 to 15, characterized in that: The traffic data in the risk window is classified by the trained classification model to obtain a traffic classification result, and the traffic data classification module is configured as follows: For any piece of traffic data in the risk window, perform the following steps: Through the decision function of the trained classification model, the current traffic data is classified and predicted to obtain the prediction label; If the predicted label is greater than or equal to 0, the current traffic data is determined to be risky traffic; If the predicted label is less than 0, it is determined that the current traffic data is normal traffic.

17. An electronic device, characterized in that: include: Processor and memory; The memory is used to store the processor executable instructions; The processor is configured to execute the instructions to implement the anonymous traffic detection method according to any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the anonymous traffic detection method as described in any one of claims 1 to 8.

Images