Anonymous network flow association method based on feature extraction and feature enhancement

Abstract

The invention belongs to the technical field of network security tracking and tracing and traffic analysis, and discloses a feature extraction and feature enhancement-based anonymous network traffic association method, which comprises the following steps of: collecting traffic to construct a traffic representation tetrad, constructing an uplink and downlink traffic fused convolutional neural network, and establishing a feature extraction and feature enhancement-based anonymous network traffic association algorithm; extracting an interaction information feature vector after the uplink and downlink flows are fused; constructing a convolutional neural network of local weighted fusion, and obtaining an emphasis weighted fusion feature; performing channel stacking to obtain a local information feature vector; constructing a convolutional neural network for extracting global information, and obtaining a global information feature vector; different small convolution kernels are utilized to obtain three-view fusion features of single-side flow; according to the three-view fusion features, non-associated sample pairs are obtained through rotation cross enhancement, and a convolutional neural network is trained and optimized; and feature extraction and flow association are carried out by using the optimized convolutional neural network. According to the method, multi-angle information can be captured in different views, and the accuracy of stream association is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security tracking and tracing and traffic analysis, and relates to an anonymous network traffic association method based on feature extraction and feature enhancement, and specifically to an anonymous network traffic association method based on multi-view fusion feature extraction and rotation cross feature enhancement. Background Art

[0002] Active analysis technology based on watermark embedding introduces specific rules to mark traffic, but due to its active intervention characteristics, it is easy to be detected and eliminated by attackers, so its tracing effect is limited in real confrontation. Passive analysis methods with flow correlation technology as the core have gradually become the research and development focus in the field of malicious behavior tracing analysis because they do not affect normal traffic. By analyzing the specific traffic patterns formed by differences in equipment and network conditions, flow correlation technology can effectively track the access traffic of malicious users. When the traffic passes through the inlet node, its characteristics are analyzed and retained. When these flows reach the exit detection node, its specific traffic patterns will be analyzed and confirmed again, so as to accurately determine the access intention of malicious users or the specific location of the malicious service node from the exit side. Since 2011, flow correlation technology has proposed a variety of flow correlation methods based on traditional machine learning and deep learning. These methods complete the extraction of traffic statistical features from different angles (such as mutual information between flows, packet time distribution of flows, and packet load distribution of flows, etc.), which to a certain extent improves the robustness of flow correlation methods in dealing with traffic obfuscation.

[0003] However, the existing traffic correlation technology faces the problem of inaccurate feature extraction because the adopted defense strategy will cause traffic obfuscation. In particular, the traditional traffic correlation method based on conventional convolution can only extract local information. Once the traffic header information is specifically obfuscated, the extracted features may be completely invalid. At the same time, the current flow correlation technology fails to fully utilize the advantages of feature extraction and association separation, resulting in the failure to fully utilize the features extracted once, which not only reduces the training efficiency, but also greatly increases the training time. In addition, the existing methods cannot simultaneously meet the different requirements of large-scale and small-scale traffic for correlation technology, which may cause the same method to fail to correlate in different scenarios, providing uncertainty for attackers to perform correlation analysis. Summary of the invention

[0004] In order to solve the technical problems of inaccurate feature extraction and insufficient feature utilization faced by existing traffic correlation technologies, the present invention provides an anonymous network traffic correlation method based on feature extraction and feature enhancement, wherein the multi-view feature extraction mechanism can capture multi-angle information in different data views, thereby improving the accuracy of flow correlation technology; the rotational cross feature enhancement mechanism forms a large number of non-correlated sample pairs through continuous rotational cross operations; and the subsequent traffic correlation provides feature enhancement information, thereby significantly improving the speed of model convergence.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] The present invention provides an anonymous network traffic association method based on feature extraction and feature enhancement, comprising the following steps:

[0007] S1. Set the traffic collection time and collect traffic on both the user side and the service side at the same time;

[0008] S2, dividing the collected traffic monitoring data into uplink traffic and downlink traffic according to the flow direction, and constructing a traffic characterization quadruple according to the data packet size and data packet arrival time of the uplink and downlink traffic;

[0009] S3. Based on the traffic characterization quadruple, a convolutional neural network for uplink and downlink traffic fusion is constructed, and the interactive information feature vector after the uplink and downlink traffic fusion is extracted;

[0010] S4. Based on the interactive information feature vector after the fusion of uplink and downlink traffic, a local weighted fusion convolutional neural network is constructed to obtain the weighted fusion features of the data packet size and the data packet arrival time;

[0011] S5, performing channel stacking on the weighted fusion features of the packet size and the packet arrival time to obtain a local information feature vector;

[0012] S6. Based on the local information feature vector, a dilated convolutional neural network for extracting global information is constructed to obtain a global information feature vector;

[0013] S7. Use different small convolution kernels to map the interactive information feature vector, the local information feature vector, and the global information feature vector into three single-channel vectors, connect the three single-channel vectors end to end to form a single-channel feature vector, erase the channel dimension, and obtain the three-view fusion feature of the unilateral traffic;

[0014] S8, based on the fusion features of the three views, collect pairs of related features to form a training set, select one side of the related sample pair and rotate it, cross the other side of the related sample with the rotated sample pair to obtain a non-related sample pair, and use a large number of non-related sample pairs to optimize the convolutional neural network in steps S3 to S6 through back propagation training;

[0015] S9. Use the optimized convolutional neural network for feature extraction and traffic association.

[0016] In the above technical solution of the present invention, the specific steps of step S1 include:

[0017] Set the maximum and minimum collection times for traffic, and collect traffic on the user side and the service side at the same time; start collecting traffic from the time traffic is discovered. When the collection time reaches the minimum collection time, if no interaction packet appears within the time window or the maximum collection time is reached, stop the current round of traffic collection and start a new round of traffic collection.

[0018] In the above technical solution of the present invention, the flow characterization quaternary group is expressed as in, is the packet size of the upstream traffic, is the packet size of the downstream traffic, is the arrival time of the upstream traffic packet, is the arrival time of the data packet of the downlink traffic. The four-tuple clarifies the relative order of the interaction between the uplink and downlink traffic, and fixes the data packet with the interaction information to a specific position of a certain dimension of the four-tuple.

[0019] In the above technical solution of the present invention, the step length of the convolution kernel of the convolutional neural network for uplink and downlink traffic fusion is equal to the number of flow directions of the traffic when moving vertically, thereby ensuring that each information fusion and extraction is limited to the size of the data packet or the time dimension of the data packet arrival. After the initial fusion of the uplink and downlink traffic, a two-dimensional single-layer convolution kernel with a horizontal step length of 1 is introduced to further extract the interactive information vector.

[0020] In the above technical solution of the present invention, the specific steps of step S4 include:

[0021] S401, normalizing the interactive information feature vector after the uplink and downlink traffic are fused, and erasing the original biased information caused by different feature types;

[0022] S402, creating two learnable biased attention seeds for respectively generating biased weighted matrices of data packet size and data packet arrival time;

[0023] S403, performing dot products on the normalized features and the two weighted matrices to obtain weighted features of the data packet size and the data packet arrival time;

[0024] S404, using a two-dimensional convolutional neural network to fuse information of local data packet size and data packet arrival time, and obtain a biased weighted fusion feature of the data packet size and data packet arrival time.

[0025] In the above technical solution of the present invention, the biased weighting matrix of the data packet size in step S402 is as follows:

[0026]

[0027] The weighted matrix of the packet arrival time is as follows:

[0028]

[0029] The weighted fusion feature of the packet size is expressed as follows:

[0030]

[0031] The partial weighted fusion feature of the packet arrival time is expressed as follows:

[0032]

[0033] Among them: α and β are learnable biased attention seeds, F is the interactive information feature after the fusion of uplink and downlink traffic; G is a function that generates a biased weighted matrix with the same dimension as F and whose elements are all function input values; L conv2D It is a two-dimensional convolution.

[0034] In the above-mentioned technical solution of the present invention, the specific steps for obtaining the global information feature vector in step S6 are as follows: a large convolution kernel with a hole is used as a part of the rapid expansion of the receptive field of the convolutional neural network, followed by a small convolution kernel as a feature integration module, and the global information feature vector is obtained through multi-layer iteration.

[0035] In order to solve the problem that it is difficult to extract anti-obfuscation key features from traffic, the present invention uses three views, namely, the interactive information feature vector after the fusion of uplink and downlink traffic, the local information feature vector, and the global information feature vector, to perform deep feature fusion in the process of feature extraction. Specifically: (1) Interactive view of uplink and downlink traffic fusion: The interactive information of uplink and downlink traffic often contains a large amount of communication-specific information. By aligning the data packets in the uplink and downlink traffic one by one, the interactive information is introduced from the input data level. And by controlling the jump step of the two-dimensional convolution, it is possible to capture the uplink and downlink interactive characteristics within the packet size or packet arrival time. (2) Local information view: By using the bias matrix to weight the packet size and packet arrival time respectively, and by using the 2D cross-channel convolution to perform feature fusion, feature information with local bias is obtained. (3) Global information view: The stacked structure combining the dilated convolution layer and the conventional convolution layer is adopted. While effectively solving the gridding problem that may be caused by the dilated convolution, the global information is quickly extracted and integrated through multiple rounds of iterations. These three different views each extract features from a unique perspective, and ultimately form a deep feature representation that is resistant to traffic confusion by aligning and connecting their features.

[0036] In order to solve the problem that it is difficult to quickly extract comparative information from traffic, the present invention selectively introduces only some positive sample pairs in the training stage of the feature extraction model to extract some positive sample feature pair sets, and uses feature extractors and associated separation technology, combined with a rotational cross feature enhancement mechanism, to use a small amount of associated service traffic features and user traffic features extracted in one feature extraction, and continuously changes the arrangement order of the sample set through continuous rotation operations, so that user service feature pairs between different associated pairs are crossed, forming a large number of non-associated sample pairs (negative sample pairs). This method provides rich comparative information for subsequent traffic association in a limited feature extraction process, significantly improving the speed of model convergence.

[0037] It is worth noting that after extracting features according to the above method of the present invention, the attacker determines whether to use the precise association working mode or the credibility filtering working mode according to the traffic scale of the scene. If the attacker faces a small-scale traffic scene, the precise association attack mode is used. If the attacker faces a large-scale traffic scene, the filtering scene is used.

[0038] In the precise association working mode, the obfuscated traffic is introduced, and the original traffic with three-view fusion features and the obfuscated traffic are input into the multi-layer vector perceptron for learning. The network convergence is guided by the cross entropy loss and the smoothed Euclidean distance to identify the associated traffic. The calculation formula of the above-mentioned sliding Euclidean distance is as follows:

[0039] D s =eKd -1,

[0040] Among them, K is the smoothing weight, d is the cumulative traversal distance of each batch, and are the obfuscated traffic features and the original traffic features respectively, and b is the batch size.

[0041] In the credibility filtering working mode, the user-side and service-side traffic are divided into windows according to time blocks, and the original traffic with three-view fusion features is divided into windows according to time blocks. The three-view fusion features are extracted separately for each window, and the cosine distance is calculated using the traffic of each user-side window and the traffic of the service-side window as a window matching score. The association result of each window will be used for voting. For each window score, the association score of the entire traffic is calculated uniformly. The final decision is based on these voting results, and the set threshold is used to determine whether the traffic is associated. This threshold is set according to the needs of the attacker and is used to quantify the attacker's requirements for the credibility of the associated sample.

[0042] Two different working modes are designed to meet the different needs of small-scale targets and large-scale traffic. When dealing with small-scale targets, in order to improve the accuracy of model association, a guided learning mechanism is designed for different traffic obfuscation measures, which can effectively learn and identify the characteristics of data obfuscation, thereby minimizing the impact of data obfuscation. When dealing with large-scale targets, a multi-window voting mechanism is set up to allow attackers to flexibly adjust the strictness of filtering according to specific attack needs and real-time network traffic conditions, thereby obtaining a set of highly reliable matching traffic sets.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The present invention proposes a feature extraction mechanism based on multiple views, namely, three convolutional neural networks are constructed based on the interactive view, local information view and global information view of the fusion of uplink and downlink traffic. By integrating these three neural networks to form a multi-view fusion feature extraction network, deep traffic features that are resistant to traffic confusion are extracted. This feature extraction method can capture information from multiple angles in different data views, and significantly improve the accuracy of flow correlation technology by effectively integrating this information, thereby improving the accuracy of the traffic correlation method in dealing with traffic confusion.

[0045] The present invention also proposes a feature enhancement mechanism based on rotational crossover. By extracting a small amount of associated service traffic features and user traffic features, the arrangement order of the sample set is continuously changed through continuous rotation operations, so that user service feature pairs between different associated pairs are crossed, forming a large number of non-associated sample pairs. This process provides feature enhancement information for subsequent traffic associations, significantly improving the speed of model convergence. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the process of multi-view fusion feature extraction and rotation cross feature enhancement according to Embodiment 1 of the present invention.

[0047] Figure 2 It is a schematic diagram of the convolutional neural network structure for uplink and downlink traffic fusion of the present invention.

[0048] Figure 3 Schematic diagram of the local weighted fusion convolutional neural network structure of the present invention.

[0049] Figure 4 Schematic diagram of the structure of the dilated convolutional neural network for global information extraction in the present invention.

[0050] Figure 5 This is a schematic diagram of feature association processing in Example 1 of the present invention.

[0051] Figure 6 The figure shows a comparison between the method of the present invention and the existing DeepCoFFEA method in the case of large-scale samples.

[0052] Figure 7 This is a result diagram of a horizontal comparison of the efficiency of the method of the present invention and the existing mainstream methods.

[0053] Figure 8 This is a result diagram of a longitudinal comparison of the efficiency of the method of the present invention and the existing mainstream method.

[0054] Fig. 9 This is a schematic diagram of the results of the method of the present invention in resisting network noise. DETAILED DESCRIPTION

[0055] The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention. Unless otherwise specified, the technical means used in the examples are conventional means known to those skilled in the art. The test methods in the following examples are conventional methods unless otherwise specified.

[0056] Example 1

[0057] Please refer to Figure 1 Schematic diagram of the process of multi-view fusion feature extraction and rotation cross feature enhancement in the present invention. In this embodiment, an anonymous network traffic association method based on multi-view fusion feature extraction and rotation cross feature enhancement specifically includes the following steps:

[0058] Step S1: Construct the traffic data set to be associated, let T min =120s, T max =30s, T Interruption= 5s, collect traffic on both the user side and the service side. When a traffic collection time exceeds T min After that, in T Interruption There is no interactive information within the time, or the collection time exceeds T max , then stop the current collection, include it in the single-side traffic data set, and start the next round of traffic collection.

[0059] Step S2: Preprocess a single flow data to obtain a four-tuple representation of the flow in, is the packet size of the upstream traffic, is the packet size of the downstream traffic, is the arrival time of the upstream traffic packet, is the packet arrival time of the downstream traffic.

[0060] Step S3: Based on the traffic characterization quadruple, a convolutional neural network for uplink and downlink traffic fusion is constructed, such as Figure 2 As shown in the figure, its structure includes: input layer-inter-channel fusion convolution layer CONV2D (vaild)-batch normalization layer BN-activation function ELU-intra-channel feature extraction convolution layer CONV2D (same)-activation function RELU-batch normalization layer BN-maximum pooling layer Maxpool. The traffic is input into the network, and the uplink and downlink interactive information is fused to obtain the interactive information feature vector after the uplink and downlink traffic is fused.

[0061] Implementation example: The dimension of the input feature is [4,600], and its four dimensions are The dimension of the output feature is [2,600], and its two dimensions are

[0062] Step S4: Based on the interactive information feature vector after the uplink and downlink traffic fusion, a local weighted fusion convolutional neural network is constructed, such as Figure 3 As shown, the structure includes: weighted matrix generation and data input layer - channel weighted fusion convolution layer CONV2D (vaild) - batch normalization layer BN - activation function ELU (retaining the intermediate feature F Intermediate1 )-Convolutional layer CONV2D (same) for intra-channel feature extraction-RELU activation function-Batch normalization layer BN (same as F Intermediate1 The interactive information feature vector after the fusion of uplink and downlink traffic is input into the local weighted fusion convolutional neural network to extract local information and obtain the weighted features of the packet size and packet arrival time. The weighted fusion information of the packet size and packet arrival time is further obtained by using two layers of convolution.

[0063] Implementation example: The dimension of the input feature is [2,600], and the dimensions of the two biased features of the output are both [1,600].

[0064] Step S5: Channel stacking is performed on the weighted fusion information of the packet size and the packet arrival time to obtain a local information feature vector.

[0065] Implementation example: The dimension of the input feature is [1,600], and the dimension of the local information feature after concatenation is [2,600].

[0066] Step S6: Based on the local information feature vector, a dilated convolutional neural network is constructed to extract global information, such as Figure 4 As shown in Figure 1, its structure includes three global information extraction modules, each of which includes: dilated convolution global information extraction layer Dilated Conv2D-batch normalization layer BN-activation function RELU (retaining the intermediate feature F Intermediate2 )-Small convolution kernel global information integration layer Conv2D-activation function RELU (with F Intermediate2 The local biased information is input into the first global information extraction module, and the convolution with a large convolution kernel and a hole is used as the rapid expansion part of the receptive field of the convolutional neural network. It is followed by a small convolution kernel as a feature integration module. The global information feature vector is obtained through three layers of iteration, and finally the Flatten function is used to convert the extracted features into a one-dimensional vector for constructing fusion features.

[0067] Implementation example: The dimension of the input feature is [2,600], and the dimension of the output global information feature is [2,7].

[0068] Step S7: Use different small convolution kernels to map the interactive information feature vector, the local information feature vector and the global information feature vector into three single-channel vectors, connect the three single-channel vectors end to end to form a single-channel feature vector, erase the channel dimension, and obtain the three-view fusion features of the unilateral traffic.

[0069] Implementation example: The dimension of the interactive information feature channel after expansion is

[2312] , the dimension of the local information feature channel after expansion is

[1056] , the dimension of the global information feature channel after expansion is

[7168] , and the dimension of the three-view fusion feature after connection is

[10536] .

[0070] Step S8: Based on the fusion features of the three views, pairs of related features are collected to form a training set, and the associated sample pairs on one side are selected and rotated. The other side of the associated sample is crossed with the rotated sample pair to obtain non-associated sample pairs, and a large number of non-associated sample pairs are used to optimize the convolutional neural network in steps S3 to S6 through back propagation training.

[0071] Implementation example: If N associated sample pairs are input in this step, they can be rotated at most N-1 times. The experiment selects rotation times, the total amount can be obtained Group negative samples.

[0072] Step S9: Use the optimized convolutional neural network to perform feature extraction and traffic correlation. Figure 5 As shown, the attacker selects the feature association working mode according to his own intention and the number of targets. If the target data volume is small, the precise association working mode is selected (step S10), and if the target number is large, the credibility filtering working mode is selected (step S11).

[0073] Step S10: When facing a small number of targets, the original traffic pairs with three-view fusion features and the obfuscated traffic pairs are input into the multi-layer vector perceptron, and the network converges according to the cross entropy loss and smoothed Euclidean distance. The obtained value is the association score. When the association score exceeds the threshold or meets the attacker's established strategy, it is determined to be associated and enters step S12.

[0074] Implementation example: The ratio of associated samples to non-associated samples is only 1:49. Using the feature extraction method based on three views of the present invention, associated samples can be accurately identified in four different levels of defense deployment, and compared with other methods. The results are shown in Table 1.

[0075] Table 1 Comparison with existing advanced methods in the case of small-scale samples

[0076] method No Defense Wtf-pad front Front-t1 Random-Front Restor 0.882 0219 0.532 0.799 0.569 Flowtraker 0.862 0.771 0.646 0.825 0.475 DeepCorr 0.949 0.762 0.413 0.771 0.141 Ours 0.986 0.904 0.955 0.968 0.759

[0077] Step S11: In the face of a large number of targets, the user-side and service-side traffic is divided into windows, and features are extracted separately for each window. Each window of each pre-determined traffic is used to perform association judgment to obtain a window matching score. For each window score, the association score of the entire traffic is calculated uniformly. When the association score exceeds the threshold or meets the attacker's established strategy, it is determined to be associated and enters step S12.

[0078] Implementation example: The ratio of related samples to non-related samples is as low as 1:1999. Due to the strict comparison mechanism, many traditional methods cannot effectively deal with it. Only the DeepCoFFEA method using the window voting mechanism can still show good performance in this case. Therefore, the present invention chooses to compare only with the DeepCoFFEA method, and the results are as follows Figure 6 As shown, the results show that the method of the present invention is significantly better than the DeepCoFFEA method in performance.

[0079] Step S12: If it is in training mode, back propagation is performed to optimize the three-view feature extraction network until the preset training rounds are completed, and then step S13 is entered. If it is in attack mode, directly enter S13.

[0080] Step S13: The method ends.

[0081] In order to verify the efficiency of the method, this embodiment is evaluated from two aspects: one is horizontal comparison, comparing the efficiency with the existing mainstream methods; the other is vertical testing, verifying its low data dependence by continuously adjusting the amount of input data.

[0082] like Figure 7 As shown in the figure, under the full data set, the method of the present invention has a significant speed advantage over DeepCorr, but is still slightly slower than the well-designed FlowTracker and ResTor. However, the accuracy of the method of the present invention is much higher than these two methods. In addition, when the amount of input data is reduced, the method of the present invention can maintain a higher accuracy while achieving a similar time overhead as these two methods.

[0083] like Figure 8 As shown, in terms of longitudinal comparison, as the amount of data decreases, the amount of data required by the method of the present invention drops sharply, but its accuracy can still be maintained at a high level, which proves the low data dependence of the method of the present invention.

[0084] Since there are various noises in the Internet, and these noises may not appear in the training data of the model, the present invention simulates four types of network noises and only adds them to the test data to verify the robustness of the method of the present invention. The results are as follows: Fig. 9 Although the method of the present invention is affected by various noises to a certain extent, its accuracy still remains at a high level.

[0085] In order to verify the effectiveness of each view feature extraction module and the rotation cross feature enhancement module, this embodiment conducts an ablation experiment on each part of the method, verifying that each part of the method plays a certain role and improves the accuracy of the flow association technology. The results are shown in Table 2.

[0086] Ablation Module top1 accuracy Training time (hours) Complete Method 0.955 7.1 Interactive view of uplink and downlink traffic fusion 0.941 5.1 Local information view 0.923 4.6 Global Information View 0.889 4.3 Rotational cross enhancement 0.729 4.0

[0087] In summary, the method proposed in the present invention has better correlation accuracy and higher training efficiency than the existing method, and has good innovation and application prospects.

[0088] The embodiments described above are only preferred embodiments of the present invention and are only used to explain the present invention, not to limit the scope of implementation of the present invention. For those skilled in the art, other implementation methods can certainly be easily made by replacement or modification based on the technical contents disclosed in this specification. Therefore, all changes and improvements made on the principles of the present invention should be included in the scope of the patent application of the present invention.

Claims

1. An anonymous network traffic association method based on feature extraction and feature enhancement, characterized in that: The following steps are involved: S1. Set the traffic collection time and collect traffic on both the user side and the service side at the same time; S2, dividing the collected traffic monitoring data into uplink traffic and downlink traffic according to the flow direction, and constructing a traffic characterization quadruple according to the data packet size and data packet arrival time of the uplink and downlink traffic; S3. Based on the traffic characterization quadruple, a convolutional neural network for uplink and downlink traffic fusion is constructed, and the interactive information feature vector after the uplink and downlink traffic fusion is extracted; S4. Based on the interactive information feature vector after the fusion of uplink and downlink traffic, a local weighted fusion convolutional neural network is constructed to obtain the weighted fusion features of the data packet size and the data packet arrival time; S5, performing channel stacking on the weighted fusion features of the packet size and the packet arrival time to obtain a local information feature vector; S6. Based on the local information feature vector, a dilated convolutional neural network for extracting global information is constructed to obtain a global information feature vector; S7. Use different small convolution kernels to map the interactive information feature vector, the local information feature vector, and the global information feature vector into three single-channel vectors, connect the three single-channel vectors end to end to form a single-channel feature vector, erase the channel dimension, and obtain the three-view fusion feature of the unilateral traffic; S8, based on the fusion features of the three views, collect pairs of related features to form a training set, select one side of the related sample pair and rotate it, cross the other side of the related sample with the rotated sample pair to obtain a non-related sample pair, and use a large number of non-related sample pairs to optimize the convolutional neural network in steps S3 to S6 through back propagation training; S9. Use the optimized convolutional neural network for feature extraction and traffic association.

2. The anonymous network traffic correlation method according to claim 1, characterized in that: The specific steps of step S1 include: Set the maximum and minimum collection times for traffic, and collect traffic on the user side and the service side at the same time; start collecting traffic from the time traffic is discovered. When the collection time reaches the minimum collection time, if no interaction packet appears within the time window or the maximum collection time is reached, stop the current round of traffic collection and start a new round of traffic collection.

3. The anonymous network traffic correlation method according to claim 1, characterized in that: The traffic characterization quaternary is expressed as in, is the packet size of the upstream traffic, is the packet size of the downstream traffic, is the arrival time of the upstream traffic packet, is the packet arrival time of the downstream traffic.

4. The anonymous network traffic correlation method according to claim 1, characterized in that: The step length of the convolution kernel of the convolutional neural network for upstream and downstream traffic fusion when moving vertically is equal to the number of flow directions of the traffic.

5. The anonymous network traffic correlation method according to claim 1, characterized in that: The specific steps of step S4 include: S401, normalizing the interactive information feature vector after the uplink and downlink traffic are fused, and erasing the original biased information caused by different feature types; S402, creating two learnable biased attention seeds for respectively generating biased weighted matrices of data packet size and data packet arrival time; S403, performing dot products on the normalized features and the two weighted matrices to obtain weighted features of the data packet size and the data packet arrival time; S404, using a two-dimensional convolutional neural network to fuse information of local data packet size and data packet arrival time, and obtain a biased weighted fusion feature of the data packet size and data packet arrival time.

6. The anonymous network traffic correlation method according to claim 5, characterized in that: The weighted matrix of the packet size in step S402 is as follows: The weighted matrix of the packet arrival time is as follows: The weighted fusion feature of the packet size is expressed as follows: The weighted fusion feature of the packet arrival time is expressed as follows: Among them: α and β are learnable biased attention seeds, F is the interactive information feature after the fusion of uplink and downlink traffic; G is a function that generates a biased weighted matrix with the same dimension as F and whose elements are all function input values; L conv2D It is a two-dimensional convolution.

7. The anonymous network traffic correlation method according to claim 1, characterized in that: The specific steps of obtaining the global information feature vector in step S6 are as follows: a large convolution kernel with a hole is used as a part of the convolutional neural network that quickly expands the receptive field, followed by a small convolution kernel as a feature integration module, and the global information feature vector is obtained through multi-layer iteration.

Images