Dark network traffic classifier against-resistance attack defense method based on natural scene statistics

Abstract

The invention provides a method for defending against resistance attacks by a dark network traffic classifier based on natural scene statistics, and belongs to the technical field of network security. Comprising the steps of obtaining original data of dark network traffic to form an original data set; attacking each data in the original data set by using four attack algorithms to obtain four antagonistic attack samples; representing the original data of the dark network traffic and the antagonistic attack sample generated by one of the four attack algorithms by using a natural scene-based statistical method to obtain a parameter set of generalized Gaussian distribution and asymmetric generalized Gaussian distribution; training a detector by using each parameter set; gaussian noise is added to the data in the original data set, and an automatic encoder is trained by using the data added with the Gaussian noise; a detector and an automatic encoder are combined into a two-layer defense mechanism; and identifying unknown traffic data by using a two-layer defense mechanism, and feeding the unknown traffic data of which the classification result is attack traffic to an automatic encoder for reconstruction to obtain benign data.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a dark web traffic classifier adversarial attack defense method based on natural scene statistics. Background Art

[0002] The Internet is a network we often use. Users can access shared network resources through the Internet. This resource sharing has greatly promoted the dissemination and innovation of knowledge and promoted social progress and economic development. Among them, the content that cannot be indexed by traditional search engines or requires login, specific permissions or dynamic requests to access is called the deep web. The dark web is a type of technical means that provides anonymous services to users. It is hidden in the deep web and ordinary users cannot search and access it through conventional Internet means. Users must use specific tools to access the dark web, such as virtual private networks (VPNs) and onion routers (Tor). As a highly hidden network area in the Internet that is difficult to access through conventional means, the anonymity of the dark web provides convenience for criminals to commit cyber crimes. Therefore, the classification and characterization of dark web traffic and its related applications are of great significance to ensuring network security and maintaining social stability. Recent studies have shown that attackers can generate adversarial attack samples by adding tiny perturbations to clean data. Such adversarial attack samples look like the original data of dark web traffic, but will cause the classifier to make wrong judgments. This is called an adversarial attack. There are many types of adversarial attack algorithms, such as Fast Gradient Sign Method (FGSM). When an attacker attempts to disguise one type of traffic data as another type of traffic data, he or she can evade detection by machine learning models by changing the statistical characteristics of the traffic data, such as the packet size and packet interval. Although existing dark web traffic classifiers perform well in solving traffic classification problems, many dark web traffic classifiers themselves do not take into account the adversarial nature of their deployment environment and are therefore vulnerable to adversarial attacks. Therefore, it is a very important issue to defend against adversarial attacks on dark web traffic classifiers.

[0003] Existing defense methods for adversarial attacks on dark web traffic can be mainly divided into the following four types. a. Adversarial training: adversarial attack samples are mixed into the dark web traffic classifier when training it to improve robustness. b. Defensive distillation: gradients of dark web traffic classifiers are hidden to prevent gradient-based attacks from generating adversarial attack samples. c. Detector: adversarial attacks are defended by training a classifier that distinguishes between adversarial attack samples and original dark web traffic samples. d. Denoiser: The denoiser can input dark web traffic data for denoising, and the denoised data can be correctly identified by the classifier.

[0004] However, the above technology still has the following shortcomings: for adversarial training methods, it is necessary to generate sufficiently diverse adversarial attack samples to cover different attack scenarios, and the defense effect against unknown adversarial attacks is very limited; defensive distillation cannot significantly improve the robustness of the dark web traffic classifier, and this defense can be broken by selecting appropriate loss functions and transferable attacks; the detector can distinguish between original dark web traffic samples and adversarial attack samples, but simply discarding adversarial attack samples does not conform to some actual application scenarios; the denoiser method will perform denoising on all dark web traffic data, which will affect the classification effect of the classifier due to the limitations of the denoiser itself, because the denoiser may change the original dark web traffic data, resulting in classifier classification errors. Summary of the invention

[0005] In view of this, the present invention provides a dark web traffic classifier adversarial attack defense method based on natural scene statistics, which is used to defend against unknown adversarial attacks. First, the detector performs data classification, and then the detected attack traffic is fed to the automatic encoder for reconstruction, thereby avoiding the problem in the prior art that the denoiser may change the original data and cause classifier classification errors. The detector recognition process does not depend on the dark web traffic classifier or the specific attack process, and has high flexibility and good robustness in use.

[0006] The technical solution adopted by the embodiment of the present invention to solve the technical problem is:

[0007] A dark web traffic classifier adversarial attack defense method based on natural scene statistics, comprising:

[0008] Step S1, obtaining the original data of dark web traffic to form an original data set;

[0009] Step S2, using four attack algorithms to attack each data in the original data set to obtain four adversarial attack samples of the original data of dark web traffic, the four attack algorithms are fast gradient symbol method, DeepFool attack algorithm, basic iterative method and Boundary Attack algorithm;

[0010] Step S3, using a natural scene statistical method to characterize the original dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms, to obtain a parameter set of a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution, wherein the parameter set is used as a feature to distinguish the original dark web traffic data from the adversarial attack samples;

[0011] Step S4, using each of the parameter sets to train a detector, the detector being used to distinguish whether the traffic data is attack traffic or benign data;

[0012] Step S5, adding Gaussian noise to the data in the original data set, and using the data after adding Gaussian noise to train an autoencoder, wherein the autoencoder is used to reconstruct the attack traffic into benign data;

[0013] Step S6, combining the detector trained in step S4 and the autoencoder trained in step S5 into a two-layer defense mechanism;

[0014] Step S7, using the two-layer defense mechanism to identify unknown traffic data, first obtain the parameter set of the unknown traffic data by executing step S3, input the parameter set of the unknown traffic data into the detector to obtain the classification result, and feed the unknown traffic data with the classification result as attack traffic to the automatic encoder for reconstruction to obtain benign data.

[0015] Preferably, the raw darknet traffic data obtained in step S1 is the CIC-Darknet-2020 dataset publicly available on the Internet.

[0016] Preferably, in step S3, the original dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms are characterized using a natural scene statistical method, and the process is as follows:

[0017] Step S31, the original data of the dark web traffic and the adversarial attack samples generated by one of the four attack algorithms are combined into a detector training set in a one-to-one ratio for training the detector;

[0018] Step S32, converting each element in the detector training set into a grayscale image;

[0019] Step S33, calculating the MSCN coefficient of each grayscale image; wherein the bandpass filter used for characterization is a DN filter, and the value obtained after each grayscale image is processed by the DN filter is the MSCN coefficient, and the calculation formula of the MSCN coefficient is:

[0020]

[0021] Where I(i,j) represents the eigenvalue of position (i,j) in each grayscale image, c is a constant, c∈(0,1); μ(i,j) represents the local mean of position (i,j), σ(i,j) represents the local standard deviation of position (i,j), and the calculation formula is:

[0022]

[0023] Among them, k and l are integers, w k,l is a 2D circularly symmetric Gaussian weighting function;

[0024] Step S34, using the generalized Gaussian distribution GGD and the asymmetric generalized Gaussian distribution AGGD to fit the MSCN coefficient of each of the dark web traffic raw data; wherein the generalized Gaussian distribution is defined as:

[0025]

[0026] Where x is the input MSCN coefficient, β is the shape parameter used to control the distribution of the data, σ is the parameter controlling the variance, and Γ(·) is the gamma function, a>0;

[0027] The asymmetric generalized Gaussian distribution is defined as:

[0028]

[0029] Where x is the input MSCN coefficient; σ l is the left scale scaling parameter, which controls the width of the distribution in the x<0 part; σ r is the right scale scaling parameter, controlling the width of the distribution in the x ≥ 0 part; side∈{r,l}, α l and α r Calculated according to the formula; v represents the shape parameter; Represents the scaling parameter, which is used to control the degree of diffusion on both sides of the pattern;

[0030] Define the parameter η as:

[0031]

[0032] Use adjacent coefficients to model adjacent MSCN coefficients along four directions: horizontal H, vertical V, and main diagonal D 1 and the secondary diagonal D 2 ; The adjacent coefficient calculation formula is:

[0033]

[0034] Asymmetric generalized Gaussian distribution using η, v, σ l , σ r Four parameters are used to characterize the horizontal H, vertical V, main diagonal D 1 and the secondary diagonal D 2 The four directions are represented respectively, and the asymmetric generalized Gaussian distribution parameter η is obtained H 、v H , η V 、v V , ηD1 、v D1 , η D2 、v D2 , The generalized symmetric Gaussian distribution uses β, σ 2 Two generalized symmetric Gaussian distribution parameters are used for characterization; a total of 18 parameters, including two generalized symmetric Gaussian distribution parameters and 16 asymmetric generalized Gaussian distribution parameters, constitute the parameter set.

[0035] Preferably, the detector used in step S4 is SVM.

[0036] Preferably, in step S5, when training the autoencoder, the input data of the autoencoder is the original dark web traffic data r(x) with Gaussian noise added, and the constructor r(x) of the training data is:

[0037] r(x)=clip(x+ε·randn(x) s ))

[0038] Among them, x s represents the shape of the input traffic data, randn(·) represents an array filled with random floating point numbers; ε is the scaling noise, and clip means clipping each data to the valid range.

[0039] Preferably, in step S6, the structure of the autoencoder trained using the original dark web traffic data after adding Gaussian noise is:

[0040]

[0041] In the table, Kernel, Strides, Depth, and Activation are the convolution kernel size, stride, number of convolution kernels, and activation function, respectively.

[0042] It can be seen from the above technical scheme that the dark web traffic classifier adversarial attack defense method based on natural scene statistics provided by the embodiment of the present invention first obtains the original data of the dark web traffic to form an original data set; uses four attack algorithms to attack each data in the original data set to obtain four adversarial attack samples of the original data of the dark web traffic, and the four attack algorithms are the fast gradient symbol method, the DeepFool attack algorithm, the basic iterative method and the Boundary Attack algorithm; characterize the original data of dark web traffic and the adversarial attack samples generated by one of the four attack algorithms using a natural scene statistical method to obtain a parameter set of generalized Gaussian distribution and asymmetric generalized Gaussian distribution, and the parameter set is used as a feature to distinguish the original data of dark web traffic from the adversarial attack samples; use each parameter set to train the detector, and the detector is used to distinguish whether the traffic data is attack traffic or benign data; add Gaussian noise to the data in the original data set, and use the data after adding Gaussian noise to train the autoencoder, and the autoencoder is used to reconstruct the attack traffic into benign data; combine the detector and the autoencoder into a two-layer defense mechanism; use the two-layer defense mechanism to identify unknown traffic data, input the parameter set of the unknown traffic data into the detector to obtain the classification result, and feed the unknown traffic data with the classification result as attack traffic to the autoencoder for reconstruction to obtain benign data. Through the method of the present invention, the problem that the denoiser in the prior art may change the original data and cause the classifier to classify incorrectly can be avoided, and the detector recognition process does not depend on the dark web traffic classifier, nor on the specific attack process, and has high flexibility and good robustness in use. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the implementation process of the dark web traffic classifier based on natural scene statistics against adversarial attack defense method of the present invention.

[0044] Figure 2 This is the frequency distribution diagram of MSCN coefficients.

[0045] Figure 3 It is a working flow chart of the detector of the present invention.

[0046] Figure 4 It is a flow chart of the two-layer defense mechanism of the present invention.

[0047] Figure 5 This is the effect diagram of the two-layer defense mechanism. DETAILED DESCRIPTION

[0048] The technical scheme and technical effects of the present invention are further elaborated in detail below in conjunction with the accompanying drawings of the present invention.

[0049] In order to solve the above technical problems and improve the defense effect of dark web traffic classifier against adversarial attacks, the present invention provides a dark web traffic classifier adversarial attack defense method based on natural scene statistics and autoencoder, which consists of an adversarial attack sample detector based on natural scene statistics and an autoencoder. The method can defend against unknown adversarial attacks, and combines the detector and the autoencoder. The autoencoder can feed the detected adversarial attack samples to the autoencoder, thereby avoiding the problem that the autoencoder may change the original data and cause the classifier to classify incorrectly.

[0050] refer to Figure 1 As shown, the present invention provides a dark web traffic classifier adversarial attack defense method based on natural scene statistics, and the implementation steps include:

[0051] Step S1, obtain the original data of darknet traffic to form the original data set; the original data of darknet traffic is the CIC-Darknet-2020 data set publicly available on the Internet

[0052] Step S2, use four attack algorithms to attack each data in the original data set, and obtain four adversarial attack samples of the original data of dark web traffic; the present invention mainly considers four adversarial attacks to evaluate the robustness of the model, which are three adversarial attacks based on transferability: Fast Gradient Symbol Method (FGSM), DeepFool attack algorithm, Basic Iterative Method (Basic Iterative Method, BIM) and a decision-based boundary attack called Boundary Attack. Among them, the adversarial attack based on transferability means that the attacker cannot obtain the architecture and parameters of the model but can access the data set. The attacker generates adversarial attack samples by attacking an alternative model, and then transfers it to the dark web traffic classifier. This attack can effectively attack the dark web traffic classifier. Since the present invention uses an attack based on transferability, it is necessary to first train an alternative model to make adversarial attack samples. The attack traffic is generated by Adversarial Robustness Toolbox, which is open source on the github website. The present invention uses all test data to make adversarial attack samples, and the generated adversarial attack samples will all be fed to the two-layer defense device for robustness evaluation. In the adversarial environment set by the present invention, the attack parameter epsilon of FGSM is set to 0.1, the attack parameter epsilon of BIM is set to 0.1, the attack parameter epsilon of Boundary attack is set to 0.1, delta is set to 0.1, and DeepFool uses the default attack parameters

[0053] Step S3, characterize the raw data of dark web traffic and the adversarial attack samples generated by one of the four attack algorithms using a natural scene statistical method, and obtain a parameter set of generalized Gaussian distribution and asymmetric generalized Gaussian distribution, and the parameter set is used as a feature to distinguish the raw data of dark web traffic from the adversarial attack samples; the detector of the present invention is implemented based on NSS, assuming that the raw data of dark web traffic in natural scenes and the adversarial attack samples have deviations in natural statistical laws, then the adversarial attack samples can be identified based on this deviation. The characteristic information of dark web traffic in natural scenes does not have stable statistics itself, but it will present a single peak after passing through a bandpass filter, and at this time it can be fitted with a generalized Gaussian distribution (Generalized Gaussian Distribution, GGD) or the like.

[0054] Step S4, using each parameter set to train a detector, the detector using SVM to distinguish traffic data as attack traffic or benign data;

[0055] Step S5, adding Gaussian noise to the data in the original data set, and using the data after adding Gaussian noise to train the autoencoder, the autoencoder is used to reconstruct the adversarial attack samples so that the adversarial attack samples are projected back to the original data of the dark web traffic to reconstruct the attack traffic into benign data;

[0056] Step S6, combining the detector trained in step S4 and the autoencoder trained in step S5 into a two-layer defense mechanism;

[0057] Step S7, using a two-layer defense mechanism to identify unknown traffic data, first obtain a parameter set of the unknown traffic data by executing step S3, input the parameter set of the unknown traffic data into the detector to obtain a classification result, and feed the unknown traffic data classified as attack traffic to the automatic encoder for reconstruction to obtain benign data.

[0058] In step S3, the original dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms are characterized using a natural scene statistical method. The process is as follows:

[0059] Step S31, the original data of the dark web traffic and the adversarial attack samples generated by one of the four attack algorithms are used to form a detector training set in a one-to-one ratio for training the detector;

[0060] Step S32, converting each element in the detector training set into a grayscale image;

[0061] Step S33, calculating the MSCN coefficient of each grayscale image; wherein the bandpass filter used for characterization is a DN (Divisive Normalization) filter, and the value obtained after each grayscale image is processed by the DN filter is the MSCN (Mean Subtracted Contrast Normalized) coefficient, and the calculation formula of the MSCN coefficient is:

[0062]

[0063] Where I(i,j) represents the eigenvalue of position (i,j) in each grayscale image, c is a constant, c∈(0,1); μ(i,j) represents the local mean of position (i,j), σ(i,j) represents the local standard deviation of position (i,j), and the calculation formula is:

[0064]

[0065] Among them, k and l are integers, w k,l It is a 2D circularly symmetric Gaussian weighted function. In order to calculate the MSCN coefficient of the traffic feature, the present invention converts the one-dimensional dark network traffic feature into a 10x14 traffic feature matrix grayscale image;

[0066] In order to prove that there is a statistical difference between the original data of dark web traffic and the adversarial attack samples, the traffic feature matrix grayscale graph is calculated by the MSCN coefficient frequency distribution diagram as shown in the figure Figure 2 As shown. The figure contains statistics of five types of traffic data, namely four adversarial attack traffic FGSM, DeepFool, BIM and Boundary attack, as well as the raw data of dark web traffic Org. As can be seen from the figure, the distribution of FGSM attack traffic and BIM attack traffic is in the form of a double peak, which is quite different from the single-peak distribution of the raw data of dark web traffic and can be easily distinguished. Although the two adversarial attack traffics, DeepFool and Boundaryattack, have similar distributions to the raw data of dark web traffic, it is not difficult to conclude through observation that the peak value of the frequency of the raw data of dark web traffic is significantly greater than that of DeepFool and Boundary attack attack traffic. Therefore, there is indeed a certain difference in the distribution of the MSCN coefficient between the raw data of dark web traffic and the adversarial attack samples.

[0067] Step S34, using the generalized Gaussian distribution GGD and the asymmetric generalized Gaussian distribution AGGD to fit the MSCN coefficient of each of the dark web traffic raw data; wherein the generalized Gaussian distribution is defined as:

[0068]

[0069] Where x is the input MSCN coefficient, β is the shape parameter used to control the distribution of the data, σ is the parameter controlling the variance, and Γ(·) is the gamma function, a>0;

[0070] The asymmetric generalized Gaussian distribution is defined as:

[0071]

[0072] Where x is the input MSCN coefficient; σ l is the left scale scaling parameter, which controls the width of the distribution in the x<0 part; σ r is the right scale scaling parameter, controlling the width of the distribution in the x ≥ 0 part; side∈{r,l}, α l and α r According to the formula α side Calculate; v represents the shape parameter; Represents the scaling parameter, which is used to control the degree of diffusion on both sides of the pattern;

[0073] Another parameter η that is not reflected in the previous formula is the mean, which is defined as follows:

[0074]

[0075] For more accurate detection, the adjacent coefficients are used to model the adjacent MSCN coefficients along four directions: (1) horizontal H, (2) vertical V, (3) main diagonal D1, and (4) sub-diagonal D2. The adjacent coefficient calculation formula is as follows:

[0076]

[0077] Asymmetric generalized Gaussian distribution using η, v, σ l , σ r Four parameters are used to characterize the horizontal H, vertical V, main diagonal D 1 and the secondary diagonal D 2 The four directions are represented respectively, and the asymmetric generalized Gaussian distribution parameter η is obtained H 、v H , η V 、v V , η D1 、v D1 , η D2 、v D2 , The generalized symmetric Gaussian distribution uses β, σ 2Two generalized symmetric Gaussian distribution parameters are used for characterization; a total of 18 parameters, including two generalized symmetric Gaussian distribution parameters and 16 asymmetric generalized Gaussian distribution parameters, constitute the parameter set.

[0078] In step S4, since GGD has two shape parameters and AGGD has 16 shape parameters, the detector inputs a total of 18 features to identify adversarial attack samples. Finally, because the number of features used in the end is small, the present invention uses a support vector machine (SVM) to identify adversarial attack samples. The workflow diagram of the detector is shown in Figure 3 As shown. The detector finally uses the SVM classifier to identify adversarial attack samples. When training the detector, 1000 dark web traffic raw data and 1000 adversarial attack samples are mixed as the training set for training. It is worth noting that the present invention can recognize other types of adversarial attack samples by only using DeepFool attack traffic as adversarial attack samples during the training phase. Therefore, the detection method designed by the present invention has good generalization ability.

[0079] In step S5, when training the autoencoder, the input data of the autoencoder is the original dark web traffic data r(x) with Gaussian noise added, and the constructor r(x) of the training data is:

[0080] r(x)=clip(x+ε·randn(x) s )) (11)

[0081] Among them, x s represents the shape of the input traffic data (the shape refers to the length and width of the matrix), randn(·) represents an array filled with random floating point numbers; ε is the scaling noise, and clip means clipping each data into the valid range (the valid range is [0,1]).

[0082] In step S6, the structure of the autoencoder trained using the original dark web traffic data with Gaussian noise added is:

[0083] Table 1 Autoencoder structure

[0084]

[0085] In the table, Kernel, Strides, Depth, and Activation are the convolution kernel size, stride, number of convolution kernels, and activation function, respectively.

[0086] In step S7, the trained detector and autoencoder are combined into a two-layer defense mechanism, which can identify adversarial attack samples and feed the adversarial attack samples to the autoencoder for reconstruction. In order to increase the robustness of the dark web traffic classifier, the present invention designs a two-layer defense mechanism, which consists of two parts. The first component is a detector, which can identify adversarial attack samples in network traffic. The second component is an autoencoder, which can receive adversarial attack samples identified by the detector. The adversarial attack samples can be projected back into the flow type of the original data of the dark web traffic, so that the dark web traffic classifier can correctly classify them. The flow chart of the two-layer defense mechanism is shown as follows. Figure 4 shown.

[0087] Furthermore, in the process of training the detector and the autoencoder, we can divide the original data set into a training set and a test set in proportion, such as 90% training set and 10% test set. The data in the training set is classified and labeled, and the classification labels are used to compare with the classification results of the detector. Then, the training set is used to perform steps S1-S6 for training, and the test set is used to test the trained two-layer defense mechanism. The test process still executes steps S1-S6.

[0088] In order to verify the effectiveness of the present invention, the two-layer defense mechanism proposed by the present invention is evaluated in the adversarial environment set by the present invention. First, the adversarial attack sample recognition effect of the detector is evaluated. Table 2 shows the comparison of the accuracy of the detector in detecting four adversarial attack samples, where M-SVM represents the detector method designed by the present invention, M-ANN represents the replacement of the classifier in the detector method designed by the present invention with an ANN classifier, and SVM represents the use of traffic data that has not been characterized by NSS for model training. It can be concluded from the data in the table that the detector method of the present invention achieves a high accuracy rate in the task of identifying adversarial attack samples, and the accuracy rate of detecting four adversarial attack samples is greater than 99%, which is significantly improved compared to the detection effect of the ANN classifier, and is an ideal classification method. In contrast, if the model is directly trained using traffic data that has not been characterized by NSS, the effect is not ideal.

[0089] Table 2 Comparison of the accuracy of the detectors in detecting four adversarial attack samples

[0090]

[0091] Next, the two-layer defense mechanism is evaluated as a whole. First, a dark web traffic classifier is trained. The present invention selects random forest as the dark web traffic classifier. The accuracy of the trained dark web traffic classifier on the test set is 98.52%. Then, the adversarial attack sample is used to attack the dark web traffic classifier. In the adversarial environment set by the present invention, the dark web traffic classification accuracy of the dark web traffic classifier has dropped significantly, such as Figure 5 As shown. The present invention designs a two-layer defense mechanism to deal with adversarial attack samples. For the four attacks of FGSM, DeepFool, BIM and Boundary attack, after deploying the defense mechanism of the present invention, the recognition accuracy of the dark web traffic classifier is restored to 47.19%, 26.41%, 30.57% and 16.80% respectively. Compared with the D-AE designed by Mohanty et al., the defense mechanism designed by the present invention has a significant improvement in the effect of restoring the accuracy of the dark web traffic classifier. The accuracy recovery after the three adversarial attacks of FGSM, DeepFool and BIM is improved by 11.21%, 11.42% and 4.74% respectively. Unlike other defense methods, the two-layer defense mechanism designed by the present invention is independent of the dark web traffic classifier, does not affect the classification performance of the classifier on the raw data of the dark web traffic, and can be used in conjunction with other defense methods. Since the autoencoder can learn the flow type of the raw data of the dark web traffic, the defense mechanism of the present invention is still effective for unknown attack types.

[0092] The method of the present invention consists of an adversarial attack sample detector based on natural scene statistics and an autoencoder. The method can defend against unknown adversarial attacks, and combines the detector and the autoencoder. The detector can feed the detected adversarial attack samples to the autoencoder, thereby avoiding the problem that the autoencoder may change the original data and cause the classifier to misclassify. The defense method proposed by the present invention does not rely on the dark web traffic classifier, nor does it rely on the specific attack process. Therefore, it can be integrated with some other passive defense methods in future work, and has high flexibility in use.

[0093] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0094] Electronic device is intended to represent various forms of digital computers, and may also represent various forms of mobile devices, such as personal digital processing and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit implementations of the present invention disclosed herein and / or claimed.

[0095] The electronic device includes a computing unit, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) or a computer program loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for the operation of the device can also be stored. The computing unit, ROM and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0096] A number of components in the electronic device are connected to the I / O interface 4, including an input unit, an output unit, a storage unit and a communication unit. The communication unit allows the electronic device to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0097] The computing unit may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of computing units include, but are not limited to, central processing units (CPUs), graphics processing units (GPUs), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit performs the various methods and processes described above, such as the dark web traffic classifier adversarial attack defense method based on natural scene statistics. For example, in some embodiments, the dark web traffic classifier adversarial attack defense method based on natural scene statistics may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the computing unit, one or more steps of the dark web traffic classifier adversarial attack defense method based on natural scene statistics described above may be executed. Alternatively, in other embodiments, the computing unit may be configured in any other suitable manner (e.g., by means of firmware) to execute the dark web traffic classifier adversarial attack defense method based on natural scene statistics.

[0098] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0099] The program code for implementing the method disclosed in the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0100] In the context disclosed by the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0101] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0102] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0103] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0104] What is disclosed above is only a preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. A person skilled in the art can understand that all or part of the processes of the above embodiments and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A dark web traffic classifier adversarial attack defense method based on natural scene statistics, characterized in that: include: Step S1, obtaining the original data of dark web traffic to form an original data set; Step S2, using four attack algorithms to attack each data in the original data set to obtain four adversarial attack samples of the original data of dark web traffic, the four attack algorithms are fast gradient symbol method, DeepFool attack algorithm, basic iterative method and Boundary Attack algorithm; Step S3, using a natural scene statistical method to characterize the original dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms, to obtain a parameter set of a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution, wherein the parameter set is used as a feature to distinguish the original dark web traffic data from the adversarial attack samples; Step S4, using each of the parameter sets to train a detector, the detector being used to distinguish whether the traffic data is attack traffic or benign data; Step S5, adding Gaussian noise to the data in the original data set, and using the data after adding Gaussian noise to train an autoencoder, wherein the autoencoder is used to reconstruct the attack traffic into benign data; Step S6, combining the detector trained in step S4 and the autoencoder trained in step S5 into a two-layer defense mechanism; Step S7, using the two-layer defense mechanism to identify unknown traffic data, first obtain the parameter set of the unknown traffic data by executing step S3, input the parameter set of the unknown traffic data into the detector to obtain the classification result, and feed the unknown traffic data with the classification result as attack traffic to the automatic encoder for reconstruction to obtain benign data.

2. The method for defending against adversarial attacks of a dark web traffic classifier based on natural scene statistics as claimed in claim 1, characterized in that: The original darknet traffic data obtained in step S1 is the CIC-Darknet-2020 dataset publicly available on the Internet.

3. The method for defending against adversarial attacks of a dark web traffic classifier based on natural scene statistics as claimed in claim 1, characterized in that: In step S3, the original dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms are characterized using a natural scene statistical method, and the process is as follows: Step S31, forming a detector training set with adversarial attack samples generated by one of the four attack algorithms in a one-to-one ratio for training the detector; Step S32, converting each element in the detector training set into a grayscale image; Step S33, calculating the MSCN coefficient of each grayscale image; wherein the bandpass filter used for characterization is a DN filter, and the value obtained after each grayscale image is processed by the DN filter is the MSCN coefficient, and the calculation formula of the MSCN coefficient is: Where I(i,j) represents the eigenvalue of position (i,j) in each grayscale image, c is a constant, c∈(0,1); μ(i,j) represents the local mean of position (i,j), σ(i,j) represents the local standard deviation of position (i,j), and the calculation formula is: Among them, k and l are integers, w k,l is a 2D circularly symmetric Gaussian weighting function; Step S34, using the generalized Gaussian distribution GGD and the asymmetric generalized Gaussian distribution AGGD to fit the MSCN coefficient of each of the dark web traffic raw data; wherein the generalized Gaussian distribution is defined as: Γ(a)=∫t a-1 e -t dt Where x is the input MSCN coefficient, β is the shape parameter used to control the distribution of the data, σ is the parameter controlling the variance, and Γ(·) is the gamma function, a>0; The asymmetric generalized Gaussian distribution is defined as: Where x is the input MSCN coefficient; σ l is the left scale scaling parameter, which controls the width of the distribution in the x<0 part; σ r is the right scale scaling parameter, controlling the width of the distribution in the x ≥ 0 part; side∈{r,l}, α l and α r According to the formula α side Calculate; v represents the shape parameter; Represents the scaling parameter, which is used to control the degree of diffusion on both sides of the pattern; Define the parameter η as: The adjacent coefficients are used to model the adjacent MSCN coefficients along four directions, namely horizontal H, vertical V, main diagonal D1 and sub-diagonal D2; the adjacent coefficient calculation formula is: Asymmetric generalized Gaussian distribution using η, v, σ l , σ r The four parameters are represented along the horizontal H, vertical V, main diagonal D1 and secondary diagonal D2 directions respectively, and the asymmetric generalized Gaussian distribution parameter η is obtained. H 、v H , η V 、v V , η D1 、v D1 , η D2 、v D2 , The generalized symmetric Gaussian distribution uses β, σ 2 Two generalized symmetric Gaussian distribution parameters are used for characterization; a total of 18 parameters, including two generalized symmetric Gaussian distribution parameters and 16 asymmetric generalized Gaussian distribution parameters, constitute the parameter set.

4. The method for defending against adversarial attacks of a dark web traffic classifier based on natural scene statistics as claimed in claim 1, characterized in that: The detector used in step S4 is SVM.

5. The method for defending against adversarial attacks of a dark web traffic classifier based on natural scene statistics as claimed in claim 1, characterized in that: In step S5, when training the autoencoder, the input data of the autoencoder is the original dark web traffic data r(x) with Gaussian noise added, and the constructor r(x) of the training data is: r(x)=clip(x+ε·randn(x s )) Among them, x s represents the shape of the input traffic data, randn(·) represents an array filled with random floating point numbers; ε is the scaling noise, and clip means clipping each data to the valid range.

6. The method for defending against adversarial attacks of a dark web traffic classifier based on natural scene statistics as claimed in claim 1, characterized in that: In step S6, the structure of the autoencoder trained using the original dark web traffic data after adding Gaussian noise is: In the table, Kernel, Strides, Depth, and Activation are the convolution kernel size, stride, number of convolution kernels, and activation function, respectively.

7. An electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 6.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-6.

9. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images