Network fingerprint extraction method and device based on image features

Abstract

The invention discloses a network fingerprint extraction method and device based on image features, and relates to the technical field of computers. A specific embodiment of the method comprises the following steps: acquiring statistical characteristics of a data packet and an effective load of the data packet; converting the statistical characteristics of the data packet and the effective load of the data packet into a data packet pseudo image; and determining a classification category to which the data packet belongs according to the data packet pseudo image, and taking the classification category as network fingerprint information of the data packet. According to the embodiment, the one-dimensional traffic data can be converted into the two-dimensional traffic image by combining the feature information of two different angles, so that the relationship between the features is better modeled, and the problem of single dimension of the traffic data is solved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a network fingerprint extraction method and device based on image features. Background Art

[0002] With the rapid development of Internet technology, the number of users and traffic data of various websites are also increasing sharply. When users visit websites, they will generate a large amount of traffic data, which contains various network fingerprint information such as user device information, browsing behavior and shopping preferences. In the existing technology, when classifying network fingerprint information, some basic statistical features are extracted mainly based on rule matching and statistical features, which cannot mine deep network information.

[0003] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:

[0004] (1) The representation ability of statistical features is limited and cannot capture the deep relationships and patterns between data packet features;

[0005] (2) Traditional self-attention network models require complex feature engineering, which not only increases the difficulty of implementation but also increases the computational cost, resulting in low accuracy of network fingerprint classification. Summary of the invention

[0006] In view of this, an embodiment of the present invention provides a network fingerprint extraction method and device based on image features, which can combine feature information from two different angles to convert one-dimensional traffic data into a two-dimensional traffic image, better model the relationship between features, and overcome the problem of single dimensionality of traffic data.

[0007] To achieve the above object, according to one aspect of an embodiment of the present invention, a network fingerprint extraction method based on image features is provided, comprising:

[0008] Obtain statistical characteristics of data packets and the payload of data packets;

[0009] Converting the statistical characteristics of the data packet and the payload of the data packet into a data packet pseudo image;

[0010] The classification category to which the data packet belongs is determined according to the data packet pseudo image as network fingerprint information of the data packet.

[0011] Optionally, after obtaining the payload of the data packet, it also includes: determining whether the payload of the data packet is greater than a preset number of bytes; if so, filtering the payload to obtain a payload of the preset number of bytes; otherwise, filling the payload with preset characters to obtain a payload of the preset number of bytes.

[0012] Optionally, converting the statistical features of the data packet and the payload of the data packet into a data packet pseudo image comprises:

[0013] Creating a grayscale image, each of the statistical features uniquely corresponds to a pixel in the grayscale image, and each byte in the payload uniquely corresponds to a pixel in the grayscale image;

[0014] According to each of the statistical features and each byte in the payload, a pixel value of a corresponding pixel in the grayscale image is determined to obtain the data packet pseudo image.

[0015] Optionally, determining a pixel value of a corresponding pixel in the grayscale image according to each of the statistical features and each byte in the payload includes:

[0016] Mapping the statistical feature into a numerical value within a preset value range, and using the numerical value as the pixel value of the corresponding pixel in the grayscale image;

[0017] Each byte in the payload is normalized, thereby converting each byte into a numerical value within a preset value range, and using the converted numerical value as the pixel value of the corresponding pixel in the grayscale image.

[0018] Optionally, determining the classification category to which the data packet belongs according to the data packet pseudo image includes:

[0019] Divide the data packet pseudo image into a plurality of cut blocks; for any cut block among the plurality of cut blocks, select K cut blocks with the highest correlation with the any cut block from the plurality of cut blocks as the associated cut blocks of the any cut block;

[0020] According to each of the slices and its corresponding associated slices, a double-layer attention mechanism is used to determine the attention weight of the slices;

[0021] Integrate the attention weights of all the slices to obtain the intermediate features of the data packet;

[0022] The classification category to which the data packet belongs is determined according to the intermediate features of the data packet.

[0023] Optionally, determining the classification category to which the data packet belongs according to the intermediate feature of the data packet includes:

[0024] The intermediate features of the data packet are input into a multi-layer perceptron to determine the classification category to which the data packet belongs.

[0025] According to another aspect of an embodiment of the present invention, there is provided a device for extracting a network fingerprint, comprising:

[0026] An acquisition module, which acquires the statistical characteristics of the data packet and the payload of the data packet;

[0027] A conversion module, converting the statistical characteristics of the data packet and the effective load of the data packet into a data packet pseudo image;

[0028] A classification module determines the classification category to which the data packet belongs according to the data packet pseudo-image as network fingerprint information of the data packet.

[0029] Optionally, after the acquisition module acquires the payload of the data packet, it also includes: determining whether the payload of the data packet is greater than a preset number of bytes; if so, filtering the payload to obtain a payload of the preset number of bytes; otherwise, filling the payload with preset characters to obtain a payload of the preset number of bytes.

[0030] Optionally, the conversion module converts the statistical features of the data packet and the payload of the data packet into a data packet pseudo image, including:

[0031] Creating a grayscale image, each of the statistical features uniquely corresponds to a pixel in the grayscale image, and each byte in the payload uniquely corresponds to a pixel in the grayscale image;

[0032] According to each of the statistical features and each byte in the payload, a pixel value of a corresponding pixel in the grayscale image is determined to obtain the data packet pseudo image.

[0033] Wherein, determining the pixel value of the corresponding pixel in the grayscale image according to each of the statistical features and each byte in the payload includes:

[0034] Mapping the statistical feature into a numerical value within a preset value range, and using the numerical value as the pixel value of the corresponding pixel in the grayscale image;

[0035] Each byte in the payload is normalized, thereby converting each byte into a numerical value within a preset value range, and using the converted numerical value as the pixel value of the corresponding pixel in the grayscale image.

[0036] Optionally, the classification module determines the classification category to which the data packet belongs according to the data packet pseudo image, including:

[0037] Divide the data packet pseudo image into a plurality of cut blocks; for any cut block among the plurality of cut blocks, select K cut blocks with the highest correlation with the any cut block from the plurality of cut blocks as the associated cut blocks of the any cut block;

[0038] According to each of the slices and its corresponding associated slices, a double-layer attention mechanism is used to determine the attention weight of the slices;

[0039] Integrate the attention weights of all the slices to obtain the intermediate features of the data packet;

[0040] The classification category to which the data packet belongs is determined according to the intermediate features of the data packet.

[0041] Wherein, determining the classification category to which the data packet belongs according to the intermediate feature of the data packet includes:

[0042] The intermediate features of the data packet are input into a multi-layer perceptron to determine the classification category to which the data packet belongs.

[0043] According to another aspect of an embodiment of the present invention, there is provided an electronic device for extracting a network fingerprint, comprising:

[0044] one or more processors;

[0045] a storage device for storing one or more programs,

[0046] When the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the first aspect of the embodiment of the present invention.

[0047] According to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present invention is implemented.

[0048] According to another aspect of an embodiment of the present invention, a computer program product is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present invention is implemented.

[0049] An embodiment of the above invention has the following advantages or beneficial effects: a pseudo image of a data packet is constructed through the statistical characteristics of the data packet and the payload of the data packet, thereby realizing network fingerprint classification of the data packet; it can combine feature information from two different angles to convert one-dimensional traffic data into a two-dimensional traffic image; it can better model the relationship between features; a neural network model is constructed through a double-layer attention mechanism, which can better pay attention to feature areas with closer associations, capture long-distance relationships and richer feature information in traffic data packets, and significantly reduce the computational complexity and parameter quantity of the model, thereby improving the accuracy of network fingerprint classification while improving the efficiency of real-time traffic processing.

[0050] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1It is a schematic diagram of the main process of the network fingerprint extraction method based on image features according to an embodiment of the present invention;

[0052] Figure 2 It is a schematic diagram of converting a PCAP file into a packet pseudo-image;

[0053] Figure 3 This is a schematic diagram of obtaining the intermediate features of a data packet through a double-layer attention mechanism;

[0054] Figure 4 It is a data flow diagram of the network fingerprint extraction method based on image features according to an embodiment of the present invention;

[0055] Figure 5 is a schematic diagram of main modules of a device for extracting network fingerprints according to an embodiment of the present invention;

[0056] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0057] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0058] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0059] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0060] According to one aspect of an embodiment of the present invention, a network fingerprint extraction method based on image features is provided.

[0061] Figure 1 FIG. 1 is a schematic diagram of the main process of the network fingerprint extraction method based on image features according to an embodiment of the present invention. Figure 1 As shown, the network fingerprint extraction method based on image features includes: step S101, step S102 and step S103.

[0062] Step S101: Obtain statistical features of a data packet and a payload of the data packet.

[0063] Before obtaining the statistical characteristics of the data packets and the payload of the data packets, it also includes: obtaining the PCAP file (Packet Capture File) of the traffic data. The PCAP file includes the global file header, the header of each data packet and the content of each data packet. The PCAP file is generally obtained through a network packet capture tool. Commonly used network packet capture tools include Wireshark, tcpdump, etc. The network packet capture tool can capture the data packets transmitted in the network and save them in the PCAP file format.

[0064] The following two factors are mainly considered when extracting feature information for each data packet:

[0065] 1) Statistical features of data packets. Statistical features of data packets refer to numerical information extracted from data packets that can reflect their transmission characteristics, content attributes and application types. These features usually include header information, transport layer information, application layer information and certain statistical indicators of data packet content (such as data length, entropy value, etc.). This information is crucial for traffic identification and classification, and can help distinguish different network services and application types. For example:

[0066] According to the characteristics of traffic data, 25-dimensional statistical features of data packets are extracted, including:

[0067] Link layer features 2 dimensions: ARP (Address Resolution Protocol), used to resolve the IP address (Internet Protocol Address) of the network layer into the MAC address (Media Access Control Address) of the link layer; LLC (logical link control), used to provide reliable data transmission on the link layer;

[0068] Four dimensions of network layer characteristics: IP protocol (Internet Protocol) is one of the most basic protocols in the Internet, responsible for transmitting data packets from the source host to the destination host; ICMP (Internet Control Protocol) is used to transmit control messages between the host and the network, such as network error reports, echo requests, etc.; ICMPv6 (Internet Control Protocol version 6) is the IPv6 version of the ICMP protocol, used to transmit control messages in the IPv6 network; EAPoL (Extended Authentication Protocol over LAK) is used to implement EAP (Extended Authentication Protocol) on LAK (Local Area Network);

[0069] 4 dimensions of transport layer features: TCP (Transmission Control Protocol), UDP (User Datagram Protocol), TCP payload length (the length of data actually transmitted in the TCP data packet, excluding the length of the TCP header), TCP window size (the amount of data that the sender can send but has not yet been confirmed);

[0070] 8 dimensions of application layer features: HTTP (Hypertext Transfer Protocol), used to transmit hypertext information between the client (such as a browser) and the server; HTTPS (Hypertext Transfer Protocol Secure), a secure version of HTTP, using SSL / TLS encryption; DHCP (Dynamic Host Configuration Protocol), used to automatically assign IP addresses and configure network devices; BOOTP (Bootstrap Protocol), used to automatically assign IP addresses to network devices; SSDP (Simple Service Discovery Protocol), used for service discovery within a local area network; DKS (Domain Name System, Domain Name Resolution Protocol), used to convert domain names into IP addresses; MDKS (Multicast DKS), used for DKS resolution within a local area network; KTP (Network Time Protocol, Network Time Protocol), used for DKS resolution within a local area network;

[0071] IP option feature 2 dimensions: PaddiKg (padding, used to fill data packets to meet specific alignment requirements), Route Alert (route warning, used to instruct routers to perform special processing on specific data packets);

[0072] The three-dimensional characteristics of the data packet content are: the total size of the data packet, the original data content of the data packet, and the entropy value of the data packet payload;

[0073] Port type features have two dimensions: source port features (source port number of the data packet) and destination port features (destination port number of the data packet).

[0074] According to previous theoretical research and experimental results in the experimental process, it is found that the classification effect of 25-dimensional data packet statistical features is better, and the 25-dimensional data packet statistical features contain most of the useful data in the traffic data packet. In addition, the dimension of the feature can be adjusted according to the needs of the classification task. For example, for network intrusion detection tasks, in order to better identify network intrusion behavior, timestamps, abnormal traffic characteristics and other features can be added to improve the ability to identify network attacks. For user behavior analysis tasks, it may be necessary to pay attention to the access frequency and access time of data packets, so as to better understand user needs and preferences and achieve more accurate personalized recommendations.

[0075] 2) The payload of the data packet: The payload of the data packet is the content of all data packets in the PCAP file. The entire content or part of the payload of the data packet is selected together with the statistical features of the above data packets to construct a data packet pseudo-image.

[0076] Optionally, after obtaining the payload of the data packet, it also includes: determining whether the payload of the data packet is greater than a preset number of bytes; if so, filtering the payload to obtain a payload of the preset number of bytes; otherwise, filling the payload with preset characters to obtain a payload of the preset number of bytes.

[0077] Exemplarily, the preset number of bytes is set to 700. For the payload of a data packet with a byte number greater than 700, the first 700 bytes are extracted to obtain a payload with a byte number of 700. For the payload of a data packet with a byte number less than 700, the character 0 is padded to reach a payload number of 700 bytes, ensuring that a data fragment of a fixed length can be obtained regardless of the total length of the data packet.

[0078] Step S102: Convert the statistical features of the data packet and the effective load of the data packet into a data packet pseudo image.

[0079] Optionally, converting the statistical features of the data packet and the payload of the data packet into a data packet pseudo image comprises:

[0080] Creating a grayscale image, each of the statistical features uniquely corresponds to a pixel in the grayscale image, and each byte in the payload uniquely corresponds to a pixel in the grayscale image;

[0081] According to each of the statistical features and each byte in the payload, a pixel value of a corresponding pixel in the grayscale image is determined to obtain the data packet pseudo image.

[0082] Wherein, determining the pixel value of the corresponding pixel in the grayscale image according to each of the statistical features and each byte in the payload includes:

[0083] Mapping the statistical feature into a numerical value within a preset value range, and using the numerical value as the pixel value of the corresponding pixel in the grayscale image;

[0084] Each byte in the payload is normalized, thereby converting each byte into a numerical value within a preset value range, and using the converted numerical value as the pixel value of the corresponding pixel in the grayscale image.

[0085] Figure 2 The following is a schematic diagram of converting a PCAP file into a packet pseudo image, which can be applied to an embodiment of the present invention. Figure 2A method for converting a PCAP file into a data packet pseudo image according to an embodiment of the present invention is described in detail.

[0086] like Figure 2 As shown, PCAP File indicates PCAP file, and packets indicates data packets.

[0087] The method of converting a PCAP file into a packet pseudo-image mainly includes the following steps:

[0088] 1. Create a 28*28*1 packet image (784 pixels in total);

[0089] 2. Use a network packet capture tool to capture network traffic data and save it as a PCAP file. The PCAP file includes the global file header, the header of each data packet, and the content of each data packet.

[0090] 3. Read the content of the data packet in the file, extract the statistical features of the data packet and the payload of the data packet, where the statistical features may be the statistical features of the 25-dimensional data packet mentioned in step S101, including 2-dimensional link layer features, 4-dimensional network layer features, 4-dimensional transport layer features, 8-dimensional application layer features, 2-dimensional IP option features, 3-dimensional data packet content features, and 2-dimensional port type features, and select the first 759 bytes of the payload of the data packet;

[0091] 4. For the statistical features of the data packets, the port type features are mapped to 0, 1, 2, and 3 according to the recognized ports (0-1023), registered ports (1024-49151), dynamic or private ports (49152-65535), and unknown ports. The remaining features are assigned 0 or 1 according to whether they are used or exist. The numerical features in the remaining features are mapped to the interval (0, 1) according to the actual values. Finally, all statistical features are regularized and mapped to the interval (0, 1);

[0092] Each byte in the data packet payload is divided by 255 for regularization, and each byte is normalized to the interval (0, 1). The regularized statistical feature value and the byte value of the regularized payload are used as the pixel value of the corresponding pixel in the data packet image, and feature splicing is performed to obtain the data packet image.

[0093] In this embodiment, two features, namely, statistical features of data packets and data packet payloads, are selected. The statistical features of the selected data packets include key features of different levels of computer networks and statistical information of the data packets themselves, taking into account feature information from two different angles. At the same time, converting one-dimensional features into two-dimensional features can better model the relationship between features.

[0094] Optionally, converting the statistical features of the data packet and the payload of the data packet into a data packet pseudo image comprises:

[0095] According to the predetermined image size, the payload of the data packet is processed to obtain a two-dimensional matrix that meets the requirements, and reorganized into a two-dimensional matrix according to the predefined size; if the length of the extracted data is less than the predefined size, the image size is adjusted to match the predefined size by zero padding, and then it is saved as a picture format using the OpeKCv library to obtain the original image;

[0096] Encode the statistical features of the data packet into a grayscale image, and superimpose the grayscale image with the original image to obtain a data packet pseudo image;

[0097] Among them, the statistical features of the data packet are encoded as a grayscale image, and the grayscale image is superimposed on the original image to obtain a data packet pseudo image, including: encoding the statistical features of the data packet as a statistical feature image, dividing the statistical feature image into several groups, performing weighted averaging on each group of feature images to obtain a new grayscale image, and superimposing the new grayscale image on the corresponding position of the original image. The image superposition can be performed in a weighted averaging manner, and the superposition intensity can also be adjusted according to actual conditions to obtain a data packet pseudo image.

[0098] Encoding statistical features into images and superimposing them onto the original images can enrich the image information and provide more comprehensive data packet features.

[0099] Step S103: determining the classification category to which the data packet belongs according to the data packet pseudo image as network fingerprint information of the data packet.

[0100] Optionally, determining the classification category to which the data packet belongs according to the data packet pseudo image includes:

[0101] Divide the data packet pseudo image into a plurality of cut blocks; for any cut block among the plurality of cut blocks, select K cut blocks with the highest correlation with the any cut block from the plurality of cut blocks as the associated cut blocks of the any cut block;

[0102] According to each of the slices and its corresponding associated slices, a double-layer attention mechanism is used to determine the attention weight of the slices;

[0103] Integrate the attention weights of all the slices to obtain the intermediate features of the data packet;

[0104] Determining the classification category to which the data packet belongs according to the intermediate features of the data packet;

[0105] Wherein, determining the classification category to which the data packet belongs according to the intermediate feature of the data packet includes:

[0106] The intermediate features of the data packet are input into a multi-layer perceptron to determine the classification category to which the data packet belongs.

[0107] Optionally, the intermediate features are input into a three-layer perceptron, and after repeated slicing, attention calculation, and feature integration operations, the outputs of all attention heads are connected to the classification head, and the prediction probability of each category is obtained using a multi-layer perceptron;

[0108] The category with the highest probability is selected as the classification category to which the data packet belongs.

[0109] Optionally, before the intermediate features are input into the three-layer perceptron, the intermediate features are added to the original value vector after the depthwise separable convolution to add a residual connection, so that the training process can perform gradient descent more smoothly and prevent the occurrence of gradient vanishing.

[0110] Optionally, determining the classification category to which the data packet belongs according to the data packet pseudo image includes:

[0111] The pseudo image of the data packet is divided into a plurality of blocks; after performing noise reduction processing on each block by singular value decomposition, a low-frequency part of the image is extracted by discrete wavelet transform, and a binary hash code of the image is generated by using the low-frequency part of the image. The method for obtaining the binary hash code of the image by using the low-frequency part of the image is as follows: the low-frequency sub-image is modified to a preset size, and the pixel average value of the modified image is calculated, all pixel points of the image are traversed, and the pixel points with pixel values ​​greater than the pixel average value are recorded as 1, and the other pixel points are recorded as 0 to obtain the binary hash code corresponding to the image, and the Hamming distance between the binary hash codes of each block is calculated to obtain the similarity between each block, and the similarity is sorted to find the K blocks with the highest correlation of any block, and the attention weight of the block is determined by a multi-head attention mechanism according to each block and its corresponding associated block; the attention weights of all blocks are integrated to obtain the intermediate features of the data packet, and the classification category to which the data packet belongs is determined according to the intermediate features of the data packet.

[0112] Wherein, determining the classification category to which the data packet belongs according to the intermediate feature of the data packet includes:

[0113] The intermediate features of the data packet are input into a convolutional neural network to determine the classification category to which the data packet belongs.

[0114] In this embodiment, the image is denoised by singular value decomposition to ensure that the denoised image has less interference with the result during post-processing. Then, the low-frequency part of the image is obtained by discrete wavelet transform to calculate the hash value, retaining the main information of the image. Finally, the K blocks with the highest correlation are selected by calculating the Hamming distance of the hash value, which has better performance and higher robustness.

[0115] Optionally, the packet pseudo image is divided into a plurality of blocks, and the following division method may be used, and the formula used is as follows:

[0116] x=patchify(input,patchsize=G / C)

[0117] Where x represents the packet pseudo image after slicing, patchify represents the function of slicing the packet pseudo image, input represents the input packet pseudo image, patchsize represents the size of each slicing, G represents the size of the input packet pseudo image, C represents the number of slices in each direction, and when the height and width of the packet pseudo image are equal, a total of C 2 Cut into pieces.

[0118] Optionally, the data packet pseudo image is divided into a plurality of cut blocks, and a window of a fixed size may be slid on the data packet pseudo image, each time sliding with a certain step length, and an area covered by the window is extracted as a cut block.

[0119] Figure 3 The following is a schematic diagram showing the intermediate features of a data packet obtained by a double-layer attention mechanism in an embodiment of the present invention. Figure 3 The method for obtaining the intermediate features of a data packet through a double-layer attention mechanism in an embodiment of the present invention is described in detail.

[0120] For packet pseudo-images, neural networks and attention mechanisms can focus on information at different locations when processing data, thereby focusing on information at different locations and discovering the inherent correlation between different sources and different location features of packets. In order to improve the accuracy and efficiency of neural networks, a double-layer attention mechanism is used to construct a neural network to train and predict packet pseudo-images.

[0121] Input the packet pseudo image into the neural network and slice it to obtain blocks;

[0122] Extract the query, key and value of each slice, that is, the query vector Q, key vector Key and value vector V of each slice. The formula used is as follows:

[0123] Q=X r W q ,Key=X r W k ,V=X r W v

[0124] In the formula, X r Represents the feature vector of each slice, W q , Wk , W v The weight matrices representing the query vector, key vector, and value vector respectively;

[0125] like Figure 3 As shown, the number of columns of the query vector Q is Where H represents the height of the packet pseudo image, W represents the width of the packet pseudo image, and S 2 Indicates the size of each block; the number of columns of the key vector Key is That is, the size after dimensional splicing of the K most correlated blocks, where K represents the number of the most correlated blocks;

[0126] Calculate the pixel average of each slice as the query vector of the slice, perform matrix multiplication on the query vector of each slice with the key vectors of all other slices, and perform normalization to obtain the affinity matrix. The number of columns of the affinity matrix is The elements in the affinity matrix represent the semantic similarity between two blocks. The affinity matrix is ​​used to find the K blocks (K is a positive integer) that are most similar to each block, and these blocks are used as the associated blocks of each block. Each block only performs pixel-level attention with the K blocks with the highest association, that is, the attention value of each pixel in each block and each pixel in the most similar K blocks is calculated to obtain the pixel-level attention score of each block. The pixel-level attention score of each block is weightedly summed with the value vector of each block to obtain the attention weight of each block. The attention weights of all blocks are integrated to obtain the intermediate features of the data packet.

[0127] Compared with the traditional self-attention network model, the double-layer attention mechanism can better focus on the feature areas with closer correlation. The present invention selects the K blocks with the highest correlation for pixel-level attention, which can improve the processing efficiency of real-time traffic, reduce the amount of calculation, and the accuracy of the model will not decrease.

[0128] Figure 4 The data flow diagram of the network fingerprint extraction method based on image features in the embodiment of the present invention is shown. Figure 4 The data flow of network fingerprint extraction based on image features in an embodiment of the present invention is described in detail.

[0129] like Figure 4 As shown, PCAP File indicates PCAP file, and packets indicates data packets.

[0130] like Figure 4As shown, the data flow of the network fingerprint extraction method based on image features is as follows: obtain a PCAP file of traffic data, where the PCAP file includes a global file header, a header of each data packet, and the content of each data packet, parse the data packet content of the PCAP file, and then extract the statistical features and payload of the data packet, convert the statistical features and payload into a data packet image, input the data packet image into a two-layer attention network for training, and output the classification category to which the data packet belongs as the network fingerprint extraction result.

[0131] The network fingerprint extraction result refers to the generation of a digital signature that can uniquely identify a specific network activity, application or device by analyzing various characteristics of network traffic. This signature usually consists of a series of characteristics or parameters that can be used to identify and classify network traffic.

[0132] For example, in the field of network security, network traffic fingerprints can be used to detect malware, identify network attacks and abnormal behaviors. In terms of user behavior analysis, network traffic fingerprints can help understand users' shopping preferences, thereby achieving more efficient and accurate recommendations for users.

[0133] The process of inputting the packet image into the two-layer attention network for training is as follows:

[0134] Input the packet image into the two-layer attention network and slice it to obtain multiple blocks;

[0135] For the multiple slices, the query vector Q, key vector Key and value vector V of each slice are extracted, and the formula used is as follows:

[0136] Q=X r W q ,Key=X r W k ,V=X r W v

[0137] In the formula, X r Represents the feature vector of each slice, W q , W k , W v The weight matrices representing the query vector, key vector, and value vector respectively;

[0138] The pixel average value of each block is calculated as the region value of the block, and the semantic similarity between each block and other blocks is calculated using the region value of the block, thereby constructing an inter-region adjacency matrix. The formula used is as follows:

[0139] A r =Q r (Key r ) T

[0140] In the formula, A r represents the inter-region adjacency matrix of each cut block, T represents the transpose symbol of the matrix, Q r Represents the query vector of each slice, Key r Represents the key vectors for all other slices;

[0141] According to the inter-region adjacency matrix, find the K blocks (K is a positive integer) that are most similar to each block as the associated blocks of each block, record the indexes of the K associated blocks, and construct the index matrix. The formula used is as follows:

[0142] I r =topnIndex(A r )

[0143] In the formula, I r represents the index matrix, topnIndex represents the index function of recording K associated blocks;

[0144] Calculate the attention value of each pixel in each cut block and each pixel in the most similar K cut blocks to obtain the pixel-level attention score of each cut block;

[0145] The pixel-level attention score of each slice is weighted summed with the value matrix of each slice to obtain the attention weight of each slice;

[0146] Integrate the attention weights of all the slices to obtain the intermediate features of the data packet;

[0147] Determining the classification category to which the data packet belongs according to the intermediate features of the data packet;

[0148] Wherein, determining the classification category to which the data packet belongs according to the intermediate feature of the data packet includes:

[0149] The intermediate features of the data packet are input into a multi-layer perceptron to determine the classification category to which the data packet belongs.

[0150] According to another aspect of the embodiments of the present invention, a device for implementing the above method is provided.

[0151] Figure 5 FIG. 1 is a schematic diagram of the main modules of the apparatus for extracting network fingerprints according to an embodiment of the present invention. Figure 5 As shown, the network fingerprint extraction device 500 includes:

[0152] An acquisition module 501 acquires statistical characteristics of a data packet and a payload of the data packet;

[0153] A conversion module 502 converts the statistical features of the data packet and the payload of the data packet into a data packet pseudo image;

[0154] The classification module 503 determines the classification category to which the data packet belongs according to the data packet pseudo image as network fingerprint information of the data packet.

[0155] Optionally, after the acquisition module acquires the payload of the data packet, it also includes: determining whether the payload of the data packet is greater than a preset number of bytes; if so, filtering the payload to obtain a payload of the preset number of bytes; otherwise, filling the payload with preset characters to obtain a payload of the preset number of bytes.

[0156] Optionally, the conversion module converts the statistical features of the data packet and the payload of the data packet into a data packet pseudo image, including:

[0157] Creating a grayscale image, each of the statistical features uniquely corresponds to a pixel in the grayscale image, and each byte in the payload uniquely corresponds to a pixel in the grayscale image;

[0158] According to each of the statistical features and each byte in the payload, a pixel value of a corresponding pixel in the grayscale image is determined to obtain the data packet pseudo image.

[0159] Wherein, determining the pixel value of the corresponding pixel in the grayscale image according to each of the statistical features and each byte in the payload includes:

[0160] Mapping the statistical feature into a numerical value within a preset value range, and using the numerical value as the pixel value of the corresponding pixel in the grayscale image;

[0161] Each byte in the payload is normalized, thereby converting each byte into a numerical value within a preset value range, and using the converted numerical value as the pixel value of the corresponding pixel in the grayscale image.

[0162] Optionally, the classification module determines the classification category to which the data packet belongs according to the data packet pseudo image, including:

[0163] Divide the data packet pseudo image into a plurality of cut blocks; for any cut block among the plurality of cut blocks, select K cut blocks with the highest correlation with the any cut block from the plurality of cut blocks as the associated cut blocks of the any cut block;

[0164] According to each of the slices and its corresponding associated slices, a double-layer attention mechanism is used to determine the attention weight of the slices;

[0165] Integrate the attention weights of all the slices to obtain the intermediate features of the data packet;

[0166] The classification category to which the data packet belongs is determined according to the intermediate features of the data packet.

[0167] Wherein, determining the classification category to which the data packet belongs according to the intermediate feature of the data packet includes:

[0168] The intermediate features of the data packet are input into a multi-layer perceptron to determine the classification category to which the data packet belongs.

[0169] According to another aspect of an embodiment of the present invention, there is provided an electronic device for extracting a network fingerprint, comprising:

[0170] one or more processors;

[0171] a storage device for storing one or more programs,

[0172] When the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the first aspect of the embodiment of the present invention.

[0173] According to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present invention is implemented.

[0174] Figure 6 An exemplary system architecture 600 is shown to which the network fingerprint extraction method based on image features or the network fingerprint extraction device according to the embodiment of the present invention can be applied.

[0175] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0176] Users can use terminal devices 601, 602, and 603 to interact with server 605 through network 604 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 601, 602, and 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0177] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0178] The server 605 may be a server that provides various services, such as a backend management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 601, 602, and 603. The backend management server may analyze and process the received network traffic and other data, and feed back the processing results (such as product recommendation information - only an example) to the terminal device.

[0179] It should be noted that the network fingerprint extraction method based on image features provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the network fingerprint extraction device is generally set in the server 605 .

[0180] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0181] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of a terminal device suitable for implementing an embodiment of the present invention. Figure 7 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0182] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0183] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAK card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0184] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0185] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0186] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0187] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor, for example, may be described as: a processor includes: an acquisition module, which acquires the statistical characteristics of a data packet and the effective load of a data packet; a conversion module, which converts the statistical characteristics of the data packet and the effective load of the data packet into a data packet pseudo image; a classification module, which determines the classification category to which the data packet belongs according to the data packet pseudo image as the network fingerprint information of the data packet.

[0188] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: obtaining statistical features of a data packet and a payload of a data packet; converting the statistical features of the data packet and the payload of the data packet into a data packet pseudo image; determining the classification category to which the data packet belongs based on the data packet pseudo image as the network fingerprint information of the data packet.

[0189] According to the technical solution of the embodiment of the present invention, a pseudo-image of a data packet is constructed through the statistical characteristics of the data packet and the payload of the data packet, thereby realizing network fingerprint classification of the data packet. It is able to combine feature information from two different angles and convert one-dimensional traffic data into a two-dimensional traffic image at the same time, so as to better model the relationship between features. By constructing a neural network model through a double-layer attention mechanism, it is able to better pay attention to feature areas with closer associations, capture long-distance relationships and richer feature information in traffic data packets, and significantly reduce the computational complexity and parameter quantity of the model, thereby improving the accuracy of network fingerprint classification while improving the efficiency of real-time traffic processing.

[0190] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network fingerprint extraction method based on image features, characterized in that: include: Obtain statistical characteristics of data packets and the payload of data packets; Converting the statistical characteristics of the data packet and the payload of the data packet into a data packet pseudo image; The classification category to which the data packet belongs is determined according to the data packet pseudo image as network fingerprint information of the data packet.

2. The method according to claim 1, characterized in that After obtaining the payload of the data packet, it also includes: determining whether the payload of the data packet is greater than a preset number of bytes; if so, filtering the payload to obtain a payload of the preset number of bytes; otherwise, filling the payload with preset characters to obtain a payload of the preset number of bytes.

3. The method according to claim 1, characterized in that Converting the statistical characteristics of the data packet and the payload of the data packet into a data packet pseudo image, including: Creating a grayscale image, each of the statistical features uniquely corresponds to a pixel in the grayscale image, and each byte in the payload uniquely corresponds to a pixel in the grayscale image; According to each of the statistical features and each byte in the payload, a pixel value of a corresponding pixel in the grayscale image is determined to obtain the data packet pseudo image.

4. The method according to claim 3, characterized in that Determining a pixel value of a corresponding pixel in the grayscale image according to each of the statistical features and each byte in the payload includes: Mapping the statistical feature into a numerical value within a preset value range, and using the numerical value as the pixel value of the corresponding pixel in the grayscale image; Each byte in the payload is normalized, thereby converting each byte into a numerical value within a preset value range, and using the converted numerical value as the pixel value of the corresponding pixel in the grayscale image.

5. The method according to claim 1, characterized in that Determining the classification category to which the data packet belongs according to the data packet pseudo image includes: Divide the data packet pseudo image into a plurality of cut blocks; for any cut block among the plurality of cut blocks, select K cut blocks with the highest correlation with the any cut block from the plurality of cut blocks as the associated cut blocks of the any cut block; According to each of the slices and its corresponding associated slices, a double-layer attention mechanism is used to determine the attention weight of the slices; Integrate the attention weights of all the slices to obtain the intermediate features of the data packet; The classification category to which the data packet belongs is determined according to the intermediate features of the data packet.

6. The method according to claim 5, characterized in that Determining, according to the intermediate feature of the data packet, the classification category to which the data packet belongs, includes: The intermediate features of the data packet are input into a multi-layer perceptron to determine the classification category to which the data packet belongs.

7. A device for extracting network fingerprints, characterized in that: include: An acquisition module, which acquires the statistical characteristics of the data packet and the payload of the data packet; A conversion module, converting the statistical characteristics of the data packet and the effective load of the data packet into a data packet pseudo image; A classification module determines the classification category to which the data packet belongs according to the data packet pseudo image as network fingerprint information of the data packet.

8. An electronic device for extracting network fingerprints, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images