QUIC specific feature and graph structure-based few-sample incremental website fingerprint identification method and system, medium and program product

Abstract

The invention discloses a few-sample increment website fingerprint identification method and system based on QUIC specific characteristics and a graph structure, a medium and a program product, and aims to solve the problem that QUIC encrypted traffic is difficult to effectively identify by a traditional method. According to the system, firstly, multi-dimensional features of QUIC traffic are extracted and constructed into a graph structure, and the global relevance between the traffic features is captured; then, deep mining is carried out on the features by utilizing a graph analysis technology, and the expression ability of the model to the traffic features is enhanced; and finally, through an incremental learning mechanism, the system can quickly adapt to newly appearing QUIC website traffic, and dynamic updating of a website recognition model is realized, so that the recognition precision and the real-time response capability are remarkably improved. According to the method and the device, through feature extraction and incremental learning for the QUIC traffic, efficient identification of the newly appearing website traffic is realized, and the accuracy and adaptability of website identification in an encrypted traffic environment are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically relates to a small sample incremental website fingerprint recognition method, system, medium and program product based on QUIC-specific features and graph structure. Background Art

[0002] QUIC (Quick UDP Internet Connections), as a new general transport layer network protocol, provides users with faster, more stable and more secure web services. Compared with other protocols, QUIC encrypts more information, including TLS handshakes, stream IDs, etc. Since there is almost no available plaintext related to encrypted communications, the privacy of network users is guaranteed. Since the traffic transmission pattern of QUIC still has the possibility of privacy leakage, the traffic can be associated with a specific website. Identifying which site the traffic belongs to without decryption is called a website fingerprinting (WF) attack. Researchers can analyze the vulnerabilities of the QUIC protocol by implementing WF attacks.

[0003] Since vulnerability analysis provides important support for the QUIC protocol, WF attacks have become a hot topic of research. WF attacks can generate fingerprints based on the metadata (size, direction, time) of encrypted traffic captured from websites in the monitoring list. Since the deployment of the QUIC protocol is gradual and has not yet been fully deployed, some websites in the WF attacker's monitoring list may not support the QUIC protocol. It is no longer possible to crawl QUIC traffic for all monitored websites in advance. Attackers must constantly crawl new QUIC-supported website traffic to train new attack models. In order to achieve almost instant WF attacks on new websites that support the QUIC protocol, attackers must reduce the crawling time. This means that only a few training traffic from new websites that support QUIC can be used for training. This WF attack can be called FSIWF (few-shot incremental website fingerprinting) attack.

[0004] Existing FSIWF attacks can be divided into those based on end-to-end deep learning [Sanjit Bhat, David Lu, Albert Kwon, and Srinivas Devadas. 2019. Var-CNN: A data-efficient website fingerprinting attack based on deep learning. Proceedings on Privacy Enhancing Technologies 2019, 4 (2019), 292–310] [Jan Luxemburk, Karel Hynek, and 2023.Encrypted traffic classification: the QUIC case.In 20237th Network Traffic Measurement and Analysis Conference (TMA). IEEE, 1–10] and based on transfer learning [Jan Luxemburk, Karel Hynek, and 2023.Encrypted traffic classification:theQUIC case.In 20237th Network Traffic Measurement and Analysis Conference (TMA).IEEE,1–10][Payap Sirinam,Nate Mathews,Mohammad Saidur Rahman,and Matthew Wright.2019.Triplet fingerprinting:More practical and portable website fingerprinting with n-shot learning.In Proceedings of the 2019ACM Conference on Computer and Communications Security.1131–1148]There are two types. End-to-end deep learning-based WF attacks rely on the amount of training data and cannot build effective feature representations based on a small amount of traffic. Transfer learning-based methods use a large amount of data to pre-train a powerful model and fine-tune the classifier with a small amount of new task data. The effectiveness of these methods depends on the rich diversity of pre-training data. Since there are fewer websites that initially enable QUIC in the monitoring list, they have limited pre-training data diversity.

[0005] This results in poor representation of the pre-trained model, further limiting the effectiveness of the FSIFW attack. In addition, both types of methods follow the features used in TCP-based FSIWF attacks [Payap Sirinam, Mohsen Imani, Marc Juarez, and Matthew Wright. 2018. Deep fingerprinting: Undermining website fingerprinting defenses with deep learning. In Proceedings of the 2018 ACM Conference on Computer and Communications Security. 1928–1943] and do not care about QUIC-specific features (i.e., related to 1-RTT and 0-RTT packets). The incomplete representation of QUIC traffic [Tlamelo Emmanuel, Thabiso Maupong, Dimane Mpoeleng, Thabo Semong, Banyatsang Mphago, and Oteng Tabona. 2021. A survey on missing data in machine learning. Journal of Big Data 8, 1 (2021), 1–37] limits their FSIWF attack performance under QUIC traffic. In summary, the effectiveness of existing methods is limited by the poor representation of QUIC traffic features and deep features. In order to improve the representation capability, this paper proposes a new FSIWF attack model based on the analysis of specific QUIC features. By analyzing and mining feature associations, the expressiveness of the attack model is enhanced, achieving higher accuracy and effective detection of newly enabled QUIC websites. Summary of the invention

[0006] The purpose of the present invention is to provide a method, system, medium and program product for small-sample incremental website fingerprinting based on QUIC-specific features and graph structure, which is suitable for scenarios where training data is limited and new QUIC-supported websites continue to emerge. The method of the present invention integrates QUIC-specific traffic features into the graph structure feature representation, and performs feature analysis and mining through a global feature aggregator and a graph convolutional network (GCN), thereby enhancing the feature expression capability of QUIC traffic. Compared with traditional methods, this method significantly improves the accuracy of detection and classification in small-sample incremental website identification, making it possible to timely identify newly emerging QUIC-supported websites in the monitoring list, and effectively optimizes the adaptability of the recognition model.

[0007] The purpose of the present invention is achieved through the following technical solutions:

[0008] A small sample incremental website fingerprinting method based on QUIC-specific features and graph structure, comprising the following steps:

[0009] Step 1: QUIC traffic feature extraction;

[0010] First, we extract unique traffic features from QUIC traffic, including but not limited to packet size, timing, protocol features, etc. These features provide basic data for subsequent analysis, ensuring that the unique properties of QUIC traffic can be fully captured.

[0011] Step 2: Graph structure construction and feature representation;

[0012] Map the QUIC traffic features extracted in step 1 to a graph structure, and perform global correlation analysis on these features through the graph convolutional network GCN; the graph structure can not only capture the potential correlation between features, but also enhance the representation of traffic features through multi-level convolution operations;

[0013] Step 3: Incremental model training and few-shot learning;

[0014] After the graph structure in step 2 is built, the recognition model is incrementally trained. Through the few-shot learning method, the recognition ability of the model is continuously optimized using limited training data. This step ensures that the model can maintain a high recognition accuracy rate even when new QUIC-supported websites continue to appear.

[0015] Step 4: Website identification and classification;

[0016] Use the model trained in step 3 to identify and classify the newly collected QUIC traffic data, especially the newly emerged QUIC-supported websites. By combining graph structure analysis with the incremental learning mechanism of the model, accurate identification and classification of new websites can be achieved, and the model can be continuously updated according to real-time conditions.

[0017] Furthermore, the step 1 is specifically as follows:

[0018] Step 1.1: The traffic collection device will deploy network monitoring tools, tshark and tcpdump, to monitor and capture QUIC traffic passing through the network interface in real time; the QUIC protocol transmits data through UDP and captures data packets on all UDP ports;

[0019] Step 1.2: The traffic collection system performs packet preprocessing based on the captured raw traffic data; the preprocessing includes removing irrelevant packets (such as invalid packets and noise packets), deduplicating and time synchronizing the traffic data to ensure the consistency and accuracy of the analyzed packet sequence; and then performing protocol parsing on the packets to extract the fields related to the QUIC protocol;

[0020] Step 1.3: Perform importance analysis on the extracted QUIC features to determine the most critical features for the website identification task; take the domain name of the website as the known variable Y and each feature as the unknown variable X; use conditional entropy and the least absolute shrinkage and selection operator, where the conditional entropy calculation formula is as follows:

[0021]

[0022] Among them, x∈X, y∈Y, p represents the probability distribution, and h represents the conditional entropy of each feature;

[0023] The least absolute shrinkage and selection operator is a regression analysis that automatically uses L1 regularization to make some feature weights 0 to achieve feature selection; the regression loss function is defined as:

[0024]

[0025] Wherein, n is the number of samples, c is the constant coefficient to be adjusted, ||c||1 is the L1 norm, α is a hyperparameter, and the present invention sets α to 0.0001;

[0026] Furthermore, the fields related to the QUIC protocol extracted in step 1.2 include but are not limited to:

[0027] init_pkt_cnt: initial packet count;

[0028] init_pkt_size_tot: total size of the initial message;

[0029] one_rtt_pkt_cnt: 1-RTT message count;

[0030] one_rtt_pkt_size_tot: 1-total RTT message size;

[0031] one_rtt_pkt_size_avg: average size of 1-RTT packets;

[0032] zero_rtt_pkt_cnt: 0-RTT message count;

[0033] zero_rtt_pkt_size_tot: 0-total RTT message size;

[0034] zero_rtt_pkt_size_avg: average size of 0-RTT packets;

[0035] handshake_pkt_cnt: handshake message count;

[0036] handshake_pkt_size_tot: total size of the handshake message;

[0037] certain_cnt_tot: 1250 The number of large and small messages.

[0038] Furthermore, the step 2 is specifically as follows:

[0039] Step 2.1: Treat each QUIC traffic instance as a node, and use the feature similarity between different instances as edges to connect nodes; the edge weight of the graph is determined based on the feature similarity of two traffic instances; use graph neural network GNN or other embedding techniques to represent the features of each node (i.e., traffic instance) as a low-dimensional vector; by learning the feature relationship between nodes and their neighbors, similar traffic instances are brought closer in the embedding space;

[0040] Step 2.2: After the graph structure is built, an initial model is trained using the existing traffic data. The node features are trained through the Graph Convolutional Network (GCN) to identify the category or source website of the traffic.

[0041] Step 2.3: With the addition of new QUIC traffic data, the original model is updated as follows:

[0042] Graph embedding of new nodes: embed newly added traffic instance nodes into the existing graph structure and update the graph’s connection relationships and edge weights;

[0043] Local update: only update the model parameters of the part of the graph structure affected by the new data;

[0044] Loss function optimization: For incremental data, define loss functions, including classification loss and embedding loss. Classification loss uses cross entropy, and embedding loss ensures that the features of new nodes remain close to their similar nodes in the embedding space.

[0045] Step 2.4: Use accuracy, recall, and F1-score indicators to evaluate the performance of the model after incremental learning; based on the evaluation results, adjust the model's hyperparameters or structure (such as the number of GNN layers, embedding dimension, etc.) to continuously improve the model's recognition ability.

[0046] Furthermore, the step 3 is specifically as follows:

[0047] Step 3.1: Capture website traffic data at different time points to ensure that the data contains the target website traffic under the new QUIC protocol; label each piece of traffic data with the corresponding website label to form a labeled data set; divide the collected data set into training set, validation set and test set to ensure that each subset can represent different website characteristics and time changes; when evaluating the model, use accuracy (measure the proportion of traffic predicted correctly by the model to the total traffic), precision (Precision, the accuracy of the model's prediction of positive samples) and recall (Recall, the proportion of all positive samples that the model can find) as evaluation indicators to measure the performance of the model;

[0048] Step 3.2: Input the feature map into the model for training to obtain the initial model parameters; input the validation set data into the model, calculate the model's prediction results, and evaluate it according to the selected evaluation indicators to determine whether the model is overfitting or underfitting;

[0049] Step 3.3: Input the data containing the new website traffic into the model and use the model to make preliminary predictions; add the new data to the model, update the model parameters, and improve the model's ability to recognize new data; use the updated model to evaluate on the test set to measure the model's performance after adding the new data;

[0050] Step 3.4: Perform global performance verification on the test set to ensure the generalization ability of the model.

[0051] Furthermore, the step 3.4 performs global performance verification, specifically including:

[0052] Global evaluation: Run the model on the test set, calculate all evaluation indicators, and get the overall performance results;

[0053] Tuning and retraining: Based on the evaluation results, the model parameters are tuned, such as adjusting the learning rate and regularization parameters, and the model is retrained on the full dataset to ensure that the final model achieves optimal performance.

[0054] A small sample incremental website fingerprint recognition system based on QUIC-specific features and graph structure, including a traffic monitoring and data collection device, a feature extraction and feature library management device, and a model updating and optimization device;

[0055] The traffic monitoring and data collection device is responsible for real-time monitoring of network traffic, detecting and collecting encrypted traffic data from new websites;

[0056] The feature extraction and feature library management device is responsible for extracting key features from the collected traffic data and updating the feature library to improve the model's ability to identify new traffic;

[0057] The model updating and optimizing device realizes dynamic updating and optimization of the model through incremental training and parameter tuning to ensure its recognition accuracy in a new environment.

[0058] A computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of a small-sample incremental website fingerprinting method based on QUIC-specific features and graph structure.

[0059] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of a small-sample incremental website fingerprinting method based on QUIC-specific features and graph structure.

[0060] The beneficial effects of the present invention are:

[0061] The present invention realizes efficient identification of newly emerging website traffic through feature extraction and incremental learning of QUIC traffic, significantly improving the accuracy and adaptability of website identification in an encrypted traffic environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a system architecture diagram of the present invention;

[0063] Figure 2 The overall flow chart of the system solution described in the present invention;

[0064] Figure 3 WF attack scenario under QUIC traffic;

[0065] Figure 4 Schematic diagram of data packet format;

[0066] Figure 5 Results validity experiment;

[0067] Figure 6 Overall feature contribution analysis results;

[0068] Figure 7 Detailed feature contribution analysis results. DETAILED DESCRIPTION

[0070] The present invention is further described below in conjunction with the accompanying drawings.

[0071] Figure 1 and 2 As shown in the figure, the overall flow chart of the system solution includes:

[0072] Feature extraction device: This device first parses the network traffic data transmitted through the QUIC protocol and extracts multi-dimensional features related to the website. These features include but are not limited to the size of the traffic packet, the time interval between packets, the transmission frequency of the data packet, and the encryption properties unique to the QUIC protocol. The feature extraction device uses data capture tools such as Wireshark to capture the traffic data in real time, and after preliminary processing of the captured raw data, it extracts traffic information that can represent the characteristics of the website, providing basic data support for subsequent feature fusion and identification.

[0073] Feature fusion device: After obtaining the initially extracted traffic features, the feature fusion device constructs these features into a graph structure to capture the potential relationships and global associations between the features. First, the traffic features are represented by graph nodes, and the correlations between the features are represented by graph edges. Then, graph analysis techniques, such as graph convolutional networks, are used to further explore the global correlations between features. The feature fusion device continuously optimizes and adjusts the construction of the feature graph, and ultimately generates a high-dimensional feature space that can accurately express the characteristics of website traffic. This feature space not only covers the explicit features of the traffic, but also includes the complex relationships between implicit features, which helps to improve the overall performance of the recognition model.

[0074] Incremental learning device: Finally, the incremental learning device classifies and identifies website traffic based on the feature space constructed above. The incremental learning device is particularly good at processing newly emerging traffic data. For new website traffic, the device can quickly learn from a small number of samples and integrate the newly learned features into the existing model. The specific operation includes feature extraction of a small number of new samples, matching and learning with the previously constructed graph structure features, and gradually improving the model's recognition ability for new traffic by updating model parameters. Through this dynamic incremental learning method, the incremental learning device ensures the real-time and accuracy of the model, can effectively respond to changes in the network environment, and maintain efficient recognition of different types of QUIC traffic.

[0075] Figure 3 The following is a schematic diagram of a WF attack, specifically:

[0076] The attacker is a passive monitor sitting between the user and the web service provider. They can collect all traffic in the communication, but cannot modify the transmission or decrypt the packets. The attacker's goal is to learn the unique characteristics of each website, called a fingerprint, from the encrypted QUIC traffic. Subsequently, the attacker uses fingerprinting to identify the websites visited by the user.

[0077] The whole attack process is divided into four steps. First, the attacker must simulate the behavior of users visiting m monitoring websites W = {w0,w1,...,w m}, and collect encrypted traffic.

[0078] Secondly, the attacker parses the encrypted traffic and extracts features for training;

[0079] Third, the attacker uses the labels W to complete the supervised training of the traces-based classifier.

[0080] Finally, the attacker conducts a WF attack based on the trained classifier to infer which monitored website the current traffic belongs to. As new QUIC-enabled websites continue to emerge, the website set W will gradually expand. The attacker captures a small amount of QUIC traffic from the website that re-enables QUIC and quickly updates the attack model. The above four steps are described in detail below.

[0081] Figure 4 The format fields of the QUIC protocol header packet are shown. As shown in the figure, the header packet can be divided into two formats: long header and short header. The green field is unencrypted and the gray field is encrypted or header protected. Whether the header of the message is long or not can be identified by the visible "Header Type" field, where "1" indicates a long header and "0" indicates a short header. The long header is used to send data packets before the connection is established. It supports four types of messages: initial message, handshake message, 0-RTT message and retry message. They can be distinguished by the visible field "Long Packet Type" of the packet header. Initial and handshake messages are related to establishing a connection. 0-RTT and retry packets are related to carrying "early" data before the handshake is completed. If it is the first communication between the client and the server, or the first communication after a long time, the 1-RTT handshake mode is used. In contrast, the communication uses the 0-RTT mode handshake. Once the connection is established, the short header is used for data transmission. The short message is a compressed format for actual data transmission, used by 1-RTT messages.

[0082] In order to verify the effectiveness of the present invention in implementing website traffic identification, in order to collect QUIC traffic, the present invention uses a virtual cloud machine located in Silicon Valley, USA to simulate the behavior of visiting the website. This machine is equipped with the 12th generation Intel (R) core (TM) i5-12400@2.5GHz, 32g memory, and Windows 2022 server is installed. The present invention selected 10 mainstream websites as the targets for crawling. The simulation is automatically implemented by driving Chrome (version 122.0.6261.95) through selenium (version 3.141), and the traffic crawler is executed based on Tshark. During the simulation, the QUIC enable mode is set in Chrome.

[0083] During the crawling process, the maximum allowed loading time for each website is 45 seconds, and those failed loads are not retained as samples. In order to ensure that the traffic is completed before the page is rendered, the present invention takes an additional waiting time of 5 seconds after the load is successful. In addition, the present invention waits for 5 hours after 50 visits to each website to prevent IP blocking. Finally, all traffic generated from a specific website is saved in a PCAP file. In order to ensure the balance of data volume, the present invention selects 260 samples from each website (130 samples for both 0-RTT mode and 1-RTT mode) as traces to form the final data set. The number of different websites crawled is 20. The traffic of websites No. 1 to 10 was collected in March 2024. The traffic of websites No. 11 to 20 was collected in April 2024. The first 10 websites are used to simulate the original monitoring list. The last 10 websites are used to simulate new QUIC-enabled websites that need to be added to the monitoring list.

[0084] The present invention designs two different experiments to verify the website traffic identification capability of the present invention. They mainly include:

[0085] 1. Effectiveness experiment. Figure 5 It can be seen that the performance of all methods decreases with the decrease of train_size. The GWF-QUIC-based method proposed in this invention significantly outperforms all baselines in all train_size settings. With only 14 training samples, it can perform more than 92% of the performance on all indicators, which shows very strong performance in the case of limited data. It stems from the QUIC-specific features and global feature association mining. CUMUL achieves suboptimal performance in terms of richness features. Due to the lack of QUIC-specific features, the overall performance is difficult to improve. DF, QUIC-CNN and MM-CNN are all deep learning-based methods, which are difficult to mine effective features when the amount of data is insufficient. DF has a deep and complex structure and is greatly affected by the amount of data. Although TF and empTLFA alleviate data dependence through transfer learning, their performance is still limited by the incomplete QUIC traffic features. In addition, the CNN model only learns local features, resulting in the inability of the above CNN-based methods to mine the potential correlation between input features. In contrast, the GWF-QUIC-based method incorporates the feature importance extracted from the machine learning method into GF-rep. The additional information helps the model learn more robust representations based on a small amount of training data. At the same time, the potential global feature correlation mined from GF-agg is conducive to extracting stable WF attack potential features. Thanks to the effective combination of machine learning and deep learning, the robustness of the GWF-QUIC-based method has been improved.

[0086] With less training data, GWF-QUIC-h outperforms GWF-QUIC-c by 0.2%, as shown in Figure 5 As shown in Figure 2. When the available training samples are small, the impact of outliers will be amplified. Since LASSO limits the range of feature coefficients through the L1 regularization term, it is robust to outliers and noise in traffic.

[0087] 2. Feature contribution analysis and method contribution analysis. The present invention replaces the features used in CUMUL, DF, QUIC-CNN, TF and TLFA with the features proposed by the present invention. The variants are denoted as CUMUL-pf, DF-pf, QUIC-CNN-pf, TF-pf and TLFA-pf, respectively. Since the structure of MM-CNN does not conform to the features proposed by the present invention, it has no mutation. By calculating the performance of these variants on the original version, the present invention can evaluate the contribution of the proposed features. The results of the variants with less training data are shown in Figure 2. Figure 6 shown.

[0088] Figure 6 and Figure 5 In comparison, CUMUL-pf, TLFA-pf, and QUIC-CNN-pf improve the performance by 0.8%-4.28%, 0.3%-3.4%, and 2.7%-14.9% on all hits, respectively. The performance improvement shows that the proposed features provide more information for FSIWF attacks under QUIC traffic. In contrast, TF-pf and DF-pf degrade on all metrics where the accuracy drops the most. Since the structures of DF and TF are customized for packet direction-based input, they are poor in effectively extracting latent features from the proposed features.

[0089] To further quantify the contribution of QUIC-specific features, the present invention proposes the following two types of variants.

[0090] GWF-QUIC-quic: This is a variant of the GWF-QUIC method that uses only QUIC-specific features. It is used to evaluate whether QUIC-specific features are effective against WF attacks.

[0091] GWF-QUIC-flow: This is a variant of the GWF-QUIC method that uses only flow statistics features. Since this version removes quic-specific features, it can be used to evaluate the contribution of QUIC-specific features to WF attacks.

[0092] The above variants correspond to the two modes of the GWF-QUIC method, denoted as GWF-QUIC-h-quic, GWF-QUIC-c-quic, GWF-QUIC-h-flow, and GWF-QUIC-c-flow. The results of the variants with less training data based on GWF-QUIC are shown in Figure 2. Figure 7 shown.

[0093] like Figure 7 As shown in the figure, the performance of the GWF-QUIC-flow based method improves with the increase of training data, while the performance of the GWF-QUIC-quic based method is in a fluctuating state. The statistical features capture the global information of the website traffic. As the number of samples increases, the statistics converge to the steady-state distribution and the performance gradually improves. Since QUIC has 0-RTT and 1-RTT communication modes, the QUIC-specific characteristics obey two distributions. It affects the stability of the GWF-QUIC-quic based method. Despite this, the GWF-QUIC-quic based method maintains an accuracy of more than 70%, up to 88%, which proves the importance of QUIC-specific features to FSIWF attacks.

[0094] In order to evaluate the contribution of the GWF-QUIC method, the present invention proposes the following two types of variants.

[0095] MLP: Since MLP is able to mine the global correlation of features, we propose a variant to evaluate the contribution of the GWF-QUIC method. This variant uses a one-dimensional array instead of GF-rep and MLP instead of GF-agg. Features and their importance are concatenated along this line. According to the feature importance h and c, the variants can be denoted as MLP-h and MLP-c, respectively.

[0096] GWF-QUIC-n: This is an unweighted variant of the GWF-QUIC method. The contribution of the GWF-QUIC method to feature learning is evaluated under the guidance of feature importances generated by machine learning methods.

[0097] As the number of training samples increases, the performance of the GWF-QUIC based method is 1.7%-3.5% higher than that of the MLP based method in 18 shots.

[0098] The performance improvement increases as the number of training samples decreases. It is verified that the GWF-QUIC-based method is superior to the MLP-based method in learning global features. Since GF-rep associates all features and GF-agg performs message propagation, GWF-QUIC-n can mine the correlation between all features based on a small amount of data.

[0099] GWF-QUIC-h and GWF-QUIC-c improved by 0.7-1.0% over GWF-QUIC-n. The accuracy increased with the increase in the number of training samples, reaching a hit rate of 3.39%-4.79% in 18 rounds. The results show that the GWF-QUIC-based method effectively utilizes the pre-analysis results and successfully links machine learning with deep learning.

[0100] In summary, from all the above results, it can be seen that the contribution of the proposed features is the greatest. The proposed features contribute 0.3%-14.9% performance improvement in all hits. Since QUIC-specific features can better represent QUIC-enabled websites, fingerprints can be effectively constructed based on a small amount of data. The contributions of the GWF-QUIC method and feature importance are similar, contributing 0.7%~3.5% and 0.7%~4.79% performance improvement, respectively. The GWF-QUIC method can use the guidance of the global graph structure and feature importance to mine the correlation between all features. Therefore, the GWF-QUIC method can quickly learn stable latent features with only a small amount of training data.

[0101] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A small sample incremental website fingerprinting method based on QUIC-specific features and graph structure, characterized by: The following steps are involved: Step 1: QUIC traffic feature extraction; Extract unique traffic features from QUIC traffic, including but not limited to packet size, timing, and protocol features; Step 2: Graph structure construction and feature representation; Map the QUIC traffic features extracted in step 1 to the graph structure, and perform global correlation analysis on these features through the graph convolutional network GCN; Step 3: Incremental model training and few-shot learning; After the graph structure in step 2 is constructed, the recognition model is incrementally trained. Through the few-sample learning method, the recognition ability of the model is continuously optimized using limited training data. Step 4: Website identification and classification; Use the model trained in step 3 to identify and classify the newly collected QUIC traffic data, especially the newly emerged QUIC-supported websites. By combining graph structure analysis with the incremental learning mechanism of the model, accurate identification and classification of new websites can be achieved, and the model can be continuously updated according to real-time conditions.

2. According to claim 1, a small sample incremental website fingerprint identification method based on QUIC-specific features and graph structure is characterized by: The step 1 is specifically as follows: Step 1.1: The traffic collection device will deploy network monitoring tools, tshark and tcpdump, to monitor and capture QUIC traffic passing through the network interface in real time; the QUIC protocol transmits data through UDP and captures data packets on all UDP ports; Step 1.2: The traffic collection system performs data packet preprocessing based on the captured raw traffic data; Preprocessing This includes removing irrelevant packets, deduplicating traffic data, and time synchronizing to ensure the consistency and accuracy of the packet sequence being analyzed; Then perform protocol parsing on the data packet and extract fields related to the QUIC protocol; Step 1.3: Perform importance analysis on the extracted QUIC features to determine the most critical features for the website identification task; take the domain name of the website as the known variable Y and each feature as the unknown variable X; use conditional entropy and the least absolute shrinkage and selection operator, where the conditional entropy calculation formula is as follows: Among them, x∈X, y∈Y, p represents the probability distribution, and h represents the conditional entropy of each feature; The least absolute shrinkage and selection operator is a regression analysis that automatically uses L1 regularization to make some feature weights 0 to achieve feature selection; the regression loss function is defined as: Among them, n is the number of samples, c is the constant coefficient to be adjusted, ||c||1 is the L1 norm, and α is the hyperparameter.

3. According to claim 2, a small sample incremental website fingerprint identification method based on QUIC-specific features and graph structure is characterized by: The fields related to the QUIC protocol extracted in step 1.2 include but are not limited to: init_pkt_cnt: initial packet count; init_pkt_size_tot: total size of the initial message; one_rtt_pkt_cnt: 1-RTT message count; one_rtt_pkt_size_tot: 1-total RTT message size; one_rtt_pkt_size_avg: average size of 1-RTT packets; zero_rtt_pkt_cnt: 0-RTT message count; zero_rtt_pkt_size_tot: 0-total RTT message size; zero_rtt_pkt_size_avg: average size of 0-RTT packets; handshake_pkt_cnt: handshake message count; handshake_pkt_size_tot: total size of the handshake message; certain_cnt_tot: 1250 The number of large and small messages.

4. According to claim 1, a small sample incremental website fingerprint identification method based on QUIC-specific features and graph structure is characterized by: The step 2 is specifically as follows: Step 2.1: Treat each QUIC traffic instance as a node, and use the feature similarity between different instances as edges to connect nodes; the edge weight of the graph is determined based on the feature similarity of two traffic instances; use graph neural network GNN or other embedding techniques to represent the features of each node as a low-dimensional vector; by learning the feature relationship between nodes and their neighbors, similar traffic instances are made closer in the embedding space; Step 2.2: After the graph structure is built, use the existing traffic data to train an initial model; train the node features through the graph neural network, with the goal of identifying the category or source website of the traffic; Step 2.3: With the addition of new QUIC traffic data, the original model is updated as follows: Graph embedding of new nodes: embed newly added traffic instance nodes into the existing graph structure and update the graph’s connection relationships and edge weights; Local update: only update the model parameters of the part of the graph structure affected by the new data; Loss function optimization: For incremental data, define loss functions, including classification loss and embedding loss. Classification loss uses cross entropy, and embedding loss ensures that the features of new nodes remain close to their similar nodes in the embedding space. Step 2.4: Use accuracy, recall, and F1-score indicators to evaluate the performance of the model after incremental learning; based on the evaluation results, adjust the model's hyperparameters or structure to continuously improve the model's recognition ability.

5. According to claim 1, a small sample incremental website fingerprint identification method based on QUIC-specific features and graph structure is characterized by: The step 3 is specifically as follows: Step 3.1: Capture website traffic data at different time points to ensure that the data contains the target website traffic under the new QUIC protocol; label each piece of traffic data with the corresponding website label to form a labeled data set; divide the collected data set into training set, validation set, and test set to ensure that each subset can represent different website characteristics and time changes; when evaluating the model, use accuracy, precision, and recall as evaluation indicators to measure the performance of the model; Step 3.2: Input the feature map into the model for training to obtain the initial model parameters; input the validation set data into the model, calculate the model's prediction results, and evaluate it according to the selected evaluation indicators to determine whether the model is overfitting or underfitting; Step 3.3: Input the data containing the new website traffic into the model and use the model to make preliminary predictions; add the new data to the model, update the model parameters, and improve the model's ability to recognize new data; use the updated model to evaluate on the test set to measure the model's performance after adding the new data; Step 3.4: Perform global performance verification on the test set to ensure the generalization ability of the model.

6. According to claim 5, a small sample incremental website fingerprint identification method based on QUIC-specific features and graph structure is characterized by: The step 3.4 performs global performance verification, specifically including: Global evaluation: Run the model on the test set, calculate all evaluation indicators, and get the overall performance results; Tuning and retraining: Based on the evaluation results, the model parameters are tuned, such as adjusting the learning rate and regularization parameters, and the model is retrained on the full dataset to ensure that the final model achieves optimal performance.

7. A small sample incremental website fingerprint recognition system based on QUIC-specific features and graph structure according to any one of claims 1 to 6, characterized in that: It includes flow monitoring and data collection device, feature extraction and feature library management device, model updating and optimization device; The traffic monitoring and data collection device is responsible for real-time monitoring of network traffic, detecting and collecting encrypted traffic data from new websites; The feature extraction and feature library management device is responsible for extracting key features from the collected traffic data and updating the feature library to improve the model's ability to identify new traffic; The model updating and optimizing device realizes dynamic updating and optimization of the model through incremental training and parameter tuning to ensure its recognition accuracy in a new environment.

8. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method described in claims 1-6 are implemented.

9. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method described in claims 1-6 are implemented.

Images