Darknet traffic classifier based on natural scene statistics for defense against adversarial attacks

Abstract

The application provides a dark web traffic classifier based on natural scene statistics and an anti-attack defense method, and belongs to the technical field of network security. The method comprises the following steps: obtaining dark web traffic original data to form an original data set; using four attack algorithms to attack each data in the original data set to obtain four kinds of adversarial attack samples; using a natural scene statistics method to characterize the dark web traffic original data and the adversarial attack samples generated by one of the four attack algorithms to obtain a parameter set of a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution; training a detector using each parameter set; adding Gaussian noise to the data in the original data set, and training an autoencoder using the data after the Gaussian noise is added; combining the detector and the autoencoder into a two-layer defense mechanism; and identifying unknown traffic data by using the two-layer defense mechanism, feeding unknown traffic data with a classification result of attack traffic to the autoencoder for reconstruction to obtain benign data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a dark web traffic classifier based on natural scene statistics and a method for defending against adversarial attacks. BACKGROUND

[0002] Internet is a network that we often use, and users can access shared network resources through the Internet. This resource sharing greatly promotes the spread of knowledge and innovation, and promotes social progress and economic development. Among them, the part of the content that cannot be indexed by traditional search engines or needs to be logged in, specific permissions or dynamic requests to access is called deep web. Dark web is a kind of technical means that provides anonymous services for users, which is hidden in the deep web and cannot be searched and accessed by ordinary users through conventional Internet means. Users must use specific tools to access the dark web, such as virtual private networks (VPN) and onion routers (Tor). As a highly concealed and difficult-to-access network area in the Internet, the anonymity of the dark web provides convenience for cyber criminals. Therefore, the classification and characterization of dark web traffic and its related applications are of great significance to ensure network security and maintain social stability. Recent studies have shown that attackers can generate adversarial attack samples by adding tiny perturbations to clean data. Such adversarial attack samples look like dark web traffic original data, but will cause the classifier to make wrong judgments, which is called adversarial attack. There are many types of adversarial attack algorithms, such as fast gradient sign method (FGSM). When an attacker tries to disguise one kind of traffic data as another kind of traffic data, he can change the statistical characteristics of the traffic data such as packet size and packet interval to evade detection by machine learning models. Although existing dark web traffic classifiers perform well in solving traffic classification problems, many dark web traffic classifiers do not consider the adversarial nature of their deployment environment and are therefore vulnerable to adversarial attacks. Therefore, defending against adversarial attacks on dark web traffic classifiers is a very important problem.

[0003] The existing defense methods against adversarial attacks on dark web traffic can be mainly divided into the following four types. a. Adversarial training: Mix adversarial attack samples when training dark web traffic classifiers to achieve the purpose of improving robustness. b. Defensive distillation: Hide the gradient of the dark web traffic classifier to prevent gradient-based attacks from generating adversarial attack samples. c. Detector: Defend against adversarial attacks by training a classifier to distinguish between adversarial attack samples and dark web traffic original samples. d. Denoiser: Denoiser can input dark web traffic data for denoising, and the denoised data can be correctly identified by the classifier.

[0004] However, the above techniques still have the following shortcomings: For adversarial training methods, it is necessary to generate sufficiently diverse adversarial attack samples to cover different attack scenarios, and the defense effect against unknown adversarial attacks is very limited; defensive distillation cannot significantly improve the robustness of the dark web traffic classifier, and this defense can be broken by selecting an appropriate loss function and transferable attacks; the detector can distinguish between the original dark web traffic samples and adversarial attack samples, but simply discarding adversarial attack samples does not conform to some practical application scenarios; the denoising method will denoise all dark web traffic data, which will affect the classification effect of the classifier due to the limitations of the denoising device itself, because the denoising device may change the original dark web traffic data, leading to the classifier's classification error. Summary of the Invention

[0005] In view of this, the present invention provides a method for defending against adversarial attacks on dark web traffic classifiers based on natural scene statistics. This method is used to defend against unknown adversarial attacks. First, the detector classifies the data, and then the detected attack traffic is fed to the autoencoder for reconstruction. This avoids the problem in the prior art where the noise reduction device may change the original data, leading to the classifier's classification error. The detector's identification process does not depend on the dark web traffic classifier or the specific attack process, and it has high flexibility and good robustness in use.

[0006] The technical solution adopted by the embodiments of the present invention to solve its technical problem is as follows:

[0007] A method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics includes:

[0008] Step S1: Obtain raw dark web traffic data to form the raw dataset;

[0009] Step S2: Four attack algorithms are used to attack each data in the original dataset to obtain four adversarial attack samples of the original dark web traffic data. The four attack algorithms are fast gradient sign method, DeepFool attack algorithm, basic iterative method and Boundary Attack algorithm.

[0010] Step S3: Use a natural scene statistical method to characterize the raw dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms to obtain a set of parameters for a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution. The set of parameters serves as a feature to distinguish the raw dark web traffic data from the adversarial attack samples.

[0011] Step S4: Train a detector using the parameter sets described above. The detector is used to distinguish whether the traffic data is attack traffic or benign traffic.

[0012] Step S5: Add Gaussian noise to the data in the original dataset, and train an autoencoder using the data with added Gaussian noise. The autoencoder is used to reconstruct the attack traffic into benign data.

[0013] Step S6: Combine the detector trained in step S4 and the autoencoder trained in step S5 into a two-layer defense mechanism.

[0014] Step S7: Using the two-layer defense mechanism to identify unknown traffic data, first, the parameter set of the unknown traffic data is obtained by executing step S3, the parameter set of the unknown traffic data is input into the detector to obtain the classification result, and the unknown traffic data classified as attack traffic is fed into the autoencoder for reconstruction to obtain benign data.

[0015] Preferably, the raw dark web traffic data obtained in step S1 is the publicly available CIC-Darknet-2020 dataset on the internet.

[0016] Preferably, in step S3, a natural scene statistical method is used to characterize the raw dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms. The process is as follows:

[0017] Step S31: The original dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms are combined in a 1:1 ratio to form a detector training set for training the detector.

[0018] Step S32: Convert each element in the detector training set into a grayscale image;

[0019] Step S33: Calculate the MSCN coefficients of each grayscale image; wherein, the bandpass filter used is a DN filter, and the value obtained after processing each grayscale image by the DN filter is the MSCN coefficient, and the formula for calculating the MSCN coefficient is:

[0020]

[0021] In the formula, I(i,j) represents the feature value of position (i,j) in each of the grayscale images, c is a constant, c∈(0,1); μ(i,j) represents the local mean of position (i,j), σ(i,j) represents the local standard deviation of position (i,j), and the calculation formula is:

[0022]

[0023] Where k and l are integers, w k,l It is a 2D circularly symmetric Gaussian weighted function;

[0024] Step S34: The MSCN coefficients of the original dark web traffic data are fitted using the generalized Gaussian distribution GGD and the asymmetric generalized Gaussian distribution AGGD; wherein, the generalized Gaussian distribution is defined as:

[0025]

[0026] Where x is the input MSCN coefficient, β is the shape parameter used to control the distribution of the data, σ is the parameter to control the variance, and Γ(·) is the gamma function, a > 0;

[0027] The asymmetric generalized Gaussian distribution is defined as:

[0028]

[0029] Where x is the input MSCN coefficient; σ l σ is the left-scale scaling parameter, controlling the width of the distribution in the x<0 region; r α is the right-scale scaling parameter, controlling the width of the distribution in the x≥0 region; side∈{r,l}, α l and α r Calculated using the formula; v represents the shape parameter; This represents the scaling parameter, used to control the degree of diffusion on both sides of the pattern;

[0030] Define the parameter η as:

[0031]

[0032] Adjacent MSCN coefficients are modeled using adjacency coefficients along four directions: horizontal (H), vertical (V), main diagonal (D1), and secondary diagonal (D2). The adjacency coefficient calculation formula is as follows:

[0033]

[0034] The asymmetric generalized Gaussian distribution uses η, v, and σ. l σ r The asymmetric generalized Gaussian distribution parameter η is characterized by four parameters, which are expressed along the four directions of horizontal H, vertical V, main diagonal D1, and secondary diagonal D2, respectively. H v H , η V v V , η D1 v D1 , ηD2 v D2 , The generalized symmetric Gaussian distribution uses β and σ 2 Two generalized symmetric Gaussian distribution parameters are used to characterize the data; the parameter set consists of 18 parameters, including the two generalized symmetric Gaussian distribution parameters and 16 asymmetric generalized Gaussian distribution parameters.

[0035] Preferably, the detector used in step S4 is an SVM.

[0036] Preferably, in step S5, when training the autoencoder, the input data of the autoencoder is the original dark web traffic data r(x) with Gaussian noise added, and the constructor function r(x) for the training data is:

[0037] r(x) = clip(x + ε·randn(x) s ))

[0038] Where, x s The shape of the input traffic data is represented by `randn(·)`, which represents an array filled with random floating-point numbers; `ε` represents scaling noise, and `clip` represents clipping each data point to the valid range.

[0039] Preferably, in step S6, the structure of the autoencoder trained using the original dark web traffic data with added Gaussian noise is as follows:

[0040]

[0041] In the table, Kernel, Strides, Depth, and Activation are the kernel size, stride, number of kernels, and activation function, respectively.

[0042] As can be seen from the above technical solution, the adversarial attack defense method for dark web traffic classifier based on natural scene statistics provided in this embodiment of the invention first obtains the original dark web traffic data to form an original dataset; then, it uses four attack algorithms to attack each data in the original dataset, obtaining four adversarial attack samples of the original dark web traffic data. The four attack algorithms are the fast gradient sign method, the DeepFool attack algorithm, the basic iterative method, and the Boundary method. The Attack algorithm uses a natural scene statistical method to characterize the raw dark web traffic data and adversarial attack samples generated by one of the four attack algorithms, obtaining parameter sets of generalized Gaussian distribution and asymmetric generalized Gaussian distribution. These parameter sets serve as features to distinguish between the raw dark web traffic data and adversarial attack samples. A detector is trained using these parameter sets to differentiate between attack traffic and benign traffic. Gaussian noise is added to the raw dataset, and an autoencoder is trained using this noise-added data to reconstruct benign attack traffic. The detector and autoencoder are combined into a two-layer defense mechanism. This two-layer defense mechanism is used to identify unknown traffic data. The parameter set of the unknown traffic data is input into the detector to obtain a classification result. Unknown traffic data classified as attack traffic is fed into the autoencoder for reconstruction to obtain benign data. This method avoids the problem in existing technologies where noise reduction may alter the raw data, leading to classifier errors. The detector identification process does not depend on the dark web traffic classifier or the specific attack process, offering high flexibility and robustness in use. Attached Figure Description

[0043] Figure 1 This is a schematic diagram illustrating the implementation process of the dark web traffic classifier adversarial attack defense method based on natural scene statistics of the present invention.

[0044] Figure 2 This is a frequency distribution diagram of the MSCN coefficients.

[0045] Figure 3 This is a flowchart illustrating the operation of the detector of the present invention.

[0046] Figure 4 This is a flowchart of the two-layer defense mechanism of the present invention.

[0047] Figure 5 This is a diagram illustrating the effect of a two-layer defense mechanism. Detailed Implementation

[0048] The technical solution and effects of the present invention will be further described in detail below with reference to the accompanying drawings.

[0049] To address the aforementioned technical problems and improve the defense effectiveness of dark web traffic classifiers against adversarial attacks, this invention provides a method for defending against adversarial attacks on dark web traffic classifiers based on natural scene statistics and an autoencoder. This method consists of an adversarial attack sample detector based on natural scene statistics and an autoencoder. This method can defend against unknown adversarial attacks and, by combining the detector and the autoencoder, allows the detected adversarial attack samples to be fed into the autoencoder, thus avoiding the problem that the autoencoder might alter the original data, leading to classification errors in the classifier.

[0050] refer to Figure 1 As shown, this invention provides a method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics. The implementation steps include:

[0051] Step S1: Obtain raw dark web traffic data to form the raw dataset; the raw dark web traffic data is the publicly available CIC-Darknet-2020 dataset.

[0052] Step S2 involves using four attack algorithms to attack each data point in the original dataset, resulting in four adversarial attack samples of the original dark web traffic data. This invention primarily considers four adversarial attacks to evaluate the robustness of the model: three transferable adversarial attacks—Fast Gradient Sign Method (FGSM), DeepFool attack algorithm, Basic Iterative Method (BIM), and a decision-based boundary attack called Boundary Attack. Transferable adversarial attacks refer to attacks where the attacker cannot obtain the model's architecture and parameters but can access the dataset. The attacker generates adversarial attack samples by attacking an alternative model and then transfers them to the dark web traffic classifier. This type of attack is effective against the dark web traffic classifier. Since this invention uses transferable attacks, an alternative model needs to be trained first to generate adversarial attack samples. The attack traffic is generated by Adversarial RobustnessToolbox, an open-source tool available on GitHub. This invention uses all test data to generate adversarial attack samples, and all generated adversarial attack samples are fed into a two-layer defense system for robustness evaluation. In the adversarial environment set by this invention, the attack parameters epsilon for FGSM, BIM, and Boundary attack are all set to 0.1, delta is set to 0.1, and DeepFool uses the default attack parameters.

[0053] Step S3 involves characterizing the raw dark web traffic data and adversarial attack samples generated by one of the four attack algorithms using a natural scene statistical method. This yields parameter sets for a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution. These parameter sets serve as features distinguishing the raw dark web traffic data from the adversarial attack samples. The detector of this invention is based on NSS. It assumes that the raw dark web traffic data in a natural scene deviates from the adversarial attack samples in terms of natural statistical regularity; therefore, adversarial attack samples can be identified based on this deviation. The dark web traffic feature information in a natural scene itself does not possess stable statistics, but after passing through a bandpass filter, it exhibits a unimodal form. In this case, a generalized Gaussian distribution (GGD) or similar method can be used for fitting.

[0054] Step S4: Train the detector using the parameter set. The detector uses SVM to distinguish whether the traffic data is attack traffic or benign data.

[0055] Step S5: Add Gaussian noise to the data in the original dataset, and use the data with added Gaussian noise to train an autoencoder. The autoencoder is used to reconstruct the adversarial attack samples so that the adversarial attack samples are projected back into the original dark web traffic data and the attack traffic is reconstructed into benign data.

[0056] Step S6: Combine the detector trained in step S4 and the autoencoder trained in step S5 into a two-layer defense mechanism.

[0057] Step S7: Use a two-layer defense mechanism to identify unknown traffic data. First, obtain the parameter set of unknown traffic data by executing step S3. Input the parameter set of unknown traffic data into the detector to obtain the classification result. Feed the unknown traffic data that is classified as attack traffic to the autoencoder for reconstruction to obtain benign data.

[0058] Step S3 uses a natural scene statistical method to characterize the raw dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms. The process is as follows:

[0059] Step S31: The raw dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms are combined in a one-to-one ratio to form a detector training set for training the detector.

[0060] Step S32: Convert each element in the detector training set into a grayscale image;

[0061] Step S33: Calculate the MSCN coefficients of each grayscale image; wherein, the bandpass filter used is a DN (Divisive Normalization) filter, and the value obtained after processing each grayscale image by the DN filter is the MSCN (Mean Subtracted Contrast Normalized) coefficient. The formula for calculating the MSCN coefficients is:

[0062]

[0063] In the formula, I(i,j) represents the feature value of position (i,j) in each grayscale image, c is a constant, c∈(0,1); μ(i,j) represents the local mean of position (i,j), and σ(i,j) represents the local standard deviation of position (i,j), calculated as follows:

[0064]

[0065] Where k and l are integers, w k,l The function is a 2D circularly symmetric Gaussian weighted function. In order to calculate the MSCN coefficient of the traffic characteristics, this invention converts the one-dimensional dark web traffic characteristics into a 10x14 grayscale traffic characteristic matrix.

[0066] To demonstrate the statistical difference between raw dark web traffic data and adversarial attack samples, the frequency distribution of the MSCN coefficients obtained from the grayscale image of the traffic feature matrix is ​​shown below. Figure 2 As shown in the figure, the statistics include five types of traffic data: four adversarial attack traffic types (FGSM, DeepFool, BIM, and Boundary attack) and the raw dark web traffic data (Org). The figure shows that the distribution of FGSM and BIM attack traffic exhibits a bimodal pattern, significantly different from the unimodal distribution of the raw dark web traffic data, making them easily distinguishable. Although DeepFool and Boundary attack traffic types have similar distributions to the raw dark web traffic data, it is easy to observe that the peak frequency of the raw dark web traffic data is significantly higher than that of DeepFool and Boundary attack traffic types. Therefore, there is indeed a certain difference in the distribution of the MSCN coefficient between the raw dark web traffic data and the adversarial attack samples.

[0067] Step S34: The MSCN coefficients of the original dark web traffic data are fitted using the generalized Gaussian distribution GGD and the asymmetric generalized Gaussian distribution AGGD; wherein, the generalized Gaussian distribution is defined as:

[0068]

[0069] Where x is the input MSCN coefficient, β is the shape parameter used to control the distribution of the data, σ is the parameter to control the variance, and Γ(·) is the gamma function, a > 0;

[0070] The asymmetric generalized Gaussian distribution is defined as:

[0071]

[0072] Where x is the input MSCN coefficient; σ l σ is the left-scale scaling parameter, controlling the width of the distribution in the x<0 region; r α is the right-scale scaling parameter, controlling the width of the distribution in the x≥0 region; side∈{r,l}, α l and α r According to formula α side Calculated; v represents the shape parameter; This represents the scaling parameter, used to control the degree of diffusion on both sides of the pattern;

[0073] The other parameter η, which is not reflected in the previous formula, is the mean, and its definition is as follows:

[0074]

[0075] To achieve more accurate detection, adjacent MSCN coefficients are modeled using adjacency coefficients along four directions: (1) horizontal (H), (2) vertical (V), (3) main diagonal (D1), and (4) secondary diagonal (D2). The adjacency coefficient calculation formula is as follows:

[0076]

[0077] The asymmetric generalized Gaussian distribution uses η, v, and σ. l σ r The asymmetric generalized Gaussian distribution parameter η is characterized by four parameters, which are expressed along the four directions of horizontal H, vertical V, main diagonal D1, and secondary diagonal D2, respectively. H v H , η V v V , η D1 v D1 , η D2 v D2 , The generalized symmetric Gaussian distribution uses β and σ 2 Two generalized symmetric Gaussian distribution parameters are used to characterize the data; the parameter set consists of 18 parameters, including the two generalized symmetric Gaussian distribution parameters and 16 asymmetric generalized Gaussian distribution parameters.

[0078] In step S4, since GGD has two shape parameters and AGGD has 16 shape parameters, the detector receives a total of 18 features to identify adversarial attack samples. Finally, because the number of features used is relatively small, this invention employs a Support Vector Machine (SVM) for adversarial attack sample identification. The detector's workflow diagram is shown below. Figure 3 As shown, the detector ultimately uses an SVM classifier to identify adversarial attack samples. During detector training, a training set is created by mixing 1000 raw dark web traffic data points with 1000 adversarial attack samples. Notably, this invention can identify other types of adversarial attack samples using only DeepFool attack traffic as adversarial attack samples during the training phase; therefore, the detection method designed in this invention has good generalization ability.

[0079] In step S5, during the training of the autoencoder, the input data for the autoencoder is the original dark web traffic data r(x) with Gaussian noise added. The constructor r(x) for the training data is:

[0080] r(x) = clip(x + ε·randn(x) s (11)

[0081] Where, x s The shape of the input traffic data is represented by the length and width of the matrix. randn(·) represents an array filled with random floating-point numbers. ε is the scaling noise, and clip represents clipping each data point to the valid range (the valid range is [0,1]).

[0082] In step S6, the structure of the autoencoder trained using the original dark web traffic data with added Gaussian noise is as follows:

[0083] Table 1 Automatic Encoder Structure

[0084]

[0085] In the table, Kernel, Strides, Depth, and Activation are the kernel size, stride, number of kernels, and activation function, respectively.

[0086] In step S7, the trained detector and autoencoder are combined into a two-layer defense mechanism. The detector can identify adversarial attack samples and feed them into the autoencoder for reconstruction. To increase the robustness of the dark web traffic classifier, this invention designs a two-layer defense mechanism consisting of two parts. The first part is the detector, which can identify adversarial attack samples in network traffic. The second part is the autoencoder, which receives the adversarial attack samples identified by the detector. These adversarial attack samples can be projected back into the flow pattern of the original dark web traffic data, enabling the dark web traffic classifier to correctly classify them. The flowchart of the two-layer defense mechanism is as follows: Figure 4 As shown.

[0087] Furthermore, during the training of the detector and autoencoder, we can divide the obtained raw dataset into training and test sets proportionally, such as dividing it into 90% training set and 10% test set. The data in the training set is used as classification labels, and the classification labels are used to compare with the classification results of the detector. Then, we first use the training set to perform steps S1-S6 for training, and then use the test set to test the trained two-layer defense mechanism. The testing process also involves performing steps S1-S6.

[0088] To verify the effectiveness of this invention, the proposed two-layer defense mechanism was evaluated under the adversarial environment set by this invention. First, the detector's performance in identifying adversarial attack samples was evaluated. Table 2 shows a comparison of the detector's accuracy in detecting four types of adversarial attack samples. Here, M-SVM represents the detector method designed in this invention, M-ANN represents replacing the classifier in the detector method designed in this invention with an ANN classifier, and SVM represents training the model using traffic data without NSS representation. The data in the table shows that the detector method of this invention achieves high accuracy in identifying adversarial attack samples, with an accuracy greater than 99% for detecting all four types of adversarial attack samples. This is a significant improvement over the detection performance of the ANN classifier and is an ideal classification method. In contrast, directly training the model using traffic data without NSS representation does not yield ideal results.

[0089] Table 2 Comparison of detector accuracy for four types of adversarial attack samples

[0090]

[0091] Next, the two-layer defense mechanism is evaluated as a whole. First, a dark web traffic classifier is trained. This invention chooses random forest as the dark web traffic classifier, and the trained dark web traffic classifier achieves an accuracy of 98.52% on the test set. Then, adversarial attack samples are used to attack the dark web traffic classifier. In the adversarial environment set by this invention, the dark web traffic classification accuracy of the dark web traffic classifier drops significantly, such as... Figure 5 As shown, this invention designs a two-layer defense mechanism to counter adversarial attack samples. For four types of attacks—FGSM, DeepFool, BIM, and Boundary attack—after deploying the defense mechanism of this invention, the recognition accuracy of the dark web traffic classifier recovered to 47.19%, 26.41%, 30.57%, and 16.80%, respectively. Compared to the D-AE designed by Mohanty et al., the defense mechanism designed in this invention significantly improves the accuracy recovery of the dark web traffic classifier, increasing the accuracy recovery after FGSM, DeepFool, and BIM adversarial attacks by 11.21%, 11.42%, and 4.74%, respectively. Unlike other defense methods, the two-layer defense mechanism designed in this invention is independent of the dark web traffic classifier, does not affect the classifier's classification performance on the original dark web traffic data, and can be used in conjunction with other defense methods. Because the autoencoder can learn the flow pattern of the original dark web traffic data, the defense mechanism of this invention remains effective against unknown attack types.

[0092] The method of this invention consists of an adversarial attack sample detector based on natural scene statistics and an autoencoder. This method can defend against unknown adversarial attacks and combines a detector and an autoencoder. The detector can feed detected adversarial attack samples to the autoencoder, thus avoiding the problem that the autoencoder might alter the original data, leading to classifier errors. The defense method proposed in this invention does not rely on a dark web traffic classifier or a specific attack process, therefore it can be integrated with other passive defense methods in future work, offering high flexibility in use.

[0093] According to the embodiments disclosed herein, the present invention also provides an electronic device, a readable storage medium, and a computer program product.

[0094] Electronic devices are intended to represent various forms of digital computers, and may also represent various forms of mobile devices, such as personal digital processors and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the invention disclosed herein and / or claimed.

[0095] Electronic devices include a computing unit that can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) or loaded from a storage unit into random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0096] Multiple components in the electronic device are connected to I / O interface 4, including: input units, output units, storage units, and communication units. The communication unit allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0097] The computing unit can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Examples of computing units include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit performs the various methods and processes described above, such as the adversarial attack defense method for a dark web traffic classifier based on natural scene statistics. For example, in some embodiments, the adversarial attack defense method for a dark web traffic classifier based on natural scene statistics can be implemented as a computer software program tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the computing unit, one or more steps of the adversarial attack defense method for a dark web traffic classifier based on natural scene statistics described above can be performed. Alternatively, in other embodiments, the computing unit may be configured, by any other suitable means (e.g., by means of firmware), to perform an adversarial attack defense method for a dark web traffic classifier based on natural scene statistics.

[0098] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0099] Program code for implementing the methods disclosed in this invention may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a standalone software package, or entirely on a remote machine or server.

[0100] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0101] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0102] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0103] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0104] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the invention. Those skilled in the art will understand that implementing all or part of the above-described embodiments and making equivalent changes in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics, characterized in that, include: Step S1: Obtain raw dark web traffic data to form the raw dataset; Step S2: Four attack algorithms are used to attack each data in the original dataset to obtain four adversarial attack samples of the original dark web traffic data. The four attack algorithms are fast gradient sign method, DeepFool attack algorithm, basic iterative method and Boundary Attack algorithm. Step S3: Use a natural scene statistical method to characterize the raw dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms to obtain a set of parameters for a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution. The set of parameters serves as a feature to distinguish the raw dark web traffic data from the adversarial attack samples. Step S4: Train a detector using the parameter sets described above. The detector is used to distinguish whether the traffic data is attack traffic or benign traffic. Step S5: Add Gaussian noise to the data in the original dataset, and train an autoencoder using the data with added Gaussian noise. The autoencoder is used to reconstruct the attack traffic into benign data. Step S6: Combine the detector trained in step S4 and the autoencoder trained in step S5 into a two-layer defense mechanism. Step S7: Using the two-layer defense mechanism to identify unknown traffic data, first, the parameter set of the unknown traffic data is obtained by executing step S3, the parameter set of the unknown traffic data is input into the detector to obtain the classification result, and the unknown traffic data classified as attack traffic is fed into the autoencoder for reconstruction to obtain benign data.

2. The method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics as described in claim 1, characterized in that, The raw dark web traffic data obtained in step S1 is the publicly available CIC-Darknet-2020 dataset.

3. The method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics as described in claim 1, characterized in that, In step S3, a natural scene-based statistical method is used to characterize the raw dark web traffic data and the adversarial attack samples generated by one of the four attack algorithms. The process is as follows: Step S31: The adversarial attack samples generated by one of the four attack algorithms are combined in a one-to-one ratio to form a detector training set for training the detector. Step S32: Convert each element in the detector training set into a grayscale image; Step S33: Calculate the MSCN coefficients of each grayscale image; wherein, the bandpass filter used is a DN filter, and the value obtained after processing each grayscale image by the DN filter is the MSCN coefficient, and the formula for calculating the MSCN coefficient is: In the formula, I(i,j) represents the feature value of position (i,j) in each of the grayscale images, c is a constant, c∈(0,1); μ(i,j) represents the local mean of position (i,j), σ(i,j) represents the local standard deviation of position (i,j), and the calculation formula is: Where k and l are integers, w k,l It is a 2D circularly symmetric Gaussian weighted function; Step S34: The MSCN coefficients of the original dark web traffic data are fitted using the generalized Gaussian distribution GGD and the asymmetric generalized Gaussian distribution AGGD; wherein, the generalized Gaussian distribution is defined as: Γ(a)=∫t a-1 e -t dt Where x is the input MSCN coefficient, β is the shape parameter used to control the distribution of the data, σ is the parameter to control the variance, and Γ(·) is the gamma function, a > 0; The asymmetric generalized Gaussian distribution is defined as: Where x is the input MSCN coefficient; σ l σ is the left-scale scaling parameter, controlling the width of the distribution in the x<0 region; r α is the right-scale scaling parameter, controlling the width of the distribution in the x≥0 region; side∈{r,l}, α l and α r According to formula α side Calculated; v represents the shape parameter; This represents the scaling parameter, used to control the degree of diffusion on both sides of the pattern; Define the parameter η as: Adjacent MSCN coefficients are modeled using adjacency coefficients along four directions: horizontal (H), vertical (V), main diagonal (D1), and secondary diagonal (D2). The adjacency coefficient calculation formula is as follows: The asymmetric generalized Gaussian distribution uses η, v, and σ. l σ r The asymmetric generalized Gaussian distribution parameter η is characterized by four parameters, which are expressed along the four directions of horizontal H, vertical V, main diagonal D1, and secondary diagonal D2, respectively. H v H , η V v V , η D1 v D1 , η D2 v D2 , The generalized symmetric Gaussian distribution uses β and σ 2 Two generalized symmetric Gaussian distribution parameters are used to characterize the data; the parameter set consists of 18 parameters, including the two generalized symmetric Gaussian distribution parameters and 16 asymmetric generalized Gaussian distribution parameters.

4. The method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics as described in claim 1, characterized in that, The detector used in step S4 is an SVM.

5. The method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics as described in claim 1, characterized in that, In step S5, during the training of the autoencoder, the input data of the autoencoder is the original dark web traffic data r(x) with Gaussian noise added, and the constructor function r(x) for the training data is: r(x)=clip(x+ε·randn(x s )) Where, x s The shape of the input traffic data is represented by `randn(·)`, which represents an array filled with random floating-point numbers; `ε` represents scaling noise, and `clip` represents clipping each data point to the valid range.

6. The method for defending against adversarial attacks using a dark web traffic classifier based on natural scene statistics as described in claim 1, characterized in that, In step S6, the structure of the autoencoder trained using the original dark web traffic data with added Gaussian noise is as follows: In the table, Kernel, Strides, Depth, and Activation are the kernel size, stride, number of kernels, and activation function, respectively.

7. An electronic device, comprising: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

9. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-6.

Images