Anonymous network traffic correlation method based on feature extraction and feature enhancement

Abstract

This invention belongs to the field of network security tracing and traffic analysis technology, and discloses an anonymous network traffic association method based on feature extraction and feature enhancement. The method includes the following steps: collecting traffic data to construct a traffic representation quadruple; constructing a convolutional neural network for uplink and downlink traffic fusion; extracting the interaction information feature vector after uplink and downlink traffic fusion; constructing a locally weighted fusion convolutional neural network to obtain biased weighted fusion features; performing channel stacking to obtain local information feature vectors; constructing a convolutional neural network to extract global information to obtain global information feature vectors; using different small convolutional kernels to obtain three-view fusion features of single-sided traffic; based on the three-view fusion features, obtaining non-associative sample pairs through rotation and cross-enhancement and training and optimizing the convolutional neural network; and using the optimized convolutional neural network for feature extraction and traffic association. This invention can capture multi-angle information from different views, improving the accuracy of flow association.

Description

Technical Field

[0001] This invention belongs to the field of network security tracing and traffic analysis technology, and relates to an anonymous network traffic association method based on feature extraction and feature enhancement, specifically an anonymous network traffic association method based on multi-view fusion feature extraction and rotation-cross feature enhancement. Background Technology

[0002] Active analysis techniques based on watermark embedding label traffic by introducing specific rules. However, due to their proactive intervention, they are easily detected and eliminated by attackers, thus limiting their effectiveness in real-world adversarial scenarios. Passive analysis methods, centered on flow correlation technology, have gradually become a research focus in the field of malicious behavior tracing and analysis because they do not affect normal traffic. By analyzing specific traffic patterns formed by differences in device and network conditions, flow correlation technology can effectively track the access traffic of malicious users. When traffic passes through an entry node, its characteristics are analyzed and stored. When this traffic reaches an exit detection node, its specific traffic patterns are analyzed and confirmed again, thereby accurately determining the malicious user's access intent or the specific location of the malicious service node approaching from the exit side. Since 2011, flow correlation technology has proposed various flow correlation methods based on traditional machine learning and deep learning. These methods extract traffic statistical features from different perspectives (such as mutual information between traffic, packet time distribution, and packet payload distribution), which to some extent improves the robustness of flow correlation methods in dealing with traffic obfuscation.

[0003] However, existing traffic association techniques suffer from inaccurate feature extraction due to the traffic obfuscation caused by the defensive strategies employed. Traditional traffic association methods based on regular convolutions, in particular, can only extract local information; once the traffic header information is specifically obfuscated, the extracted features may become completely ineffective. Furthermore, current flow association techniques fail to fully utilize the advantage of separating feature extraction from association, resulting in underutilization of features extracted in a single run. This not only reduces training efficiency but also significantly increases training time. In addition, existing methods cannot simultaneously meet the different needs of large-scale and small-scale traffic for association techniques, which may lead to the failure of the same method in different scenarios, introducing uncertainty for attackers conducting association analysis. Summary of the Invention

[0004] This invention addresses the technical problems of inaccurate feature extraction and insufficient feature utilization in existing traffic association technologies. It provides an anonymous network traffic association method based on feature extraction and feature enhancement. The multi-view feature extraction mechanism can capture information from multiple angles in different data views, improving the accuracy of traffic association technology. The rotation and cross feature enhancement mechanism forms a large number of non-associative sample pairs through continuous rotation and cross operations, which provide feature enhancement information for subsequent traffic association, significantly improving the convergence speed of the model.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] This invention provides an anonymous network traffic correlation method based on feature extraction and feature enhancement, comprising the following steps:

[0007] S1. Set the traffic collection time and collect traffic from both the user side and the service side simultaneously;

[0008] S2. Divide the collected traffic monitoring data into uplink traffic and downlink traffic according to the direction of flow, and construct a traffic representation quadruple according to the data packet size and data packet arrival time of uplink and downlink traffic.

[0009] S3. Based on the traffic representation quadruple, construct a convolutional neural network for uplink and downlink traffic fusion, and extract the interaction information feature vector after uplink and downlink traffic fusion.

[0010] S4. Based on the interaction information feature vector after the uplink and downlink traffic fusion, construct a locally weighted fusion convolutional neural network to obtain the biased weighted fusion features of data packet size and data packet arrival time.

[0011] S5. The weighted fusion features of data packet size and data packet arrival time are stacked in channels to obtain local information feature vectors;

[0012] S6. Based on the local information feature vector, construct a dilated convolutional neural network to extract global information and obtain the global information feature vector;

[0013] S7. Using different small convolution kernels, the interactive information feature vector, local information feature vector and global information feature vector are mapped into three single-channel vectors. The three single-channel vectors are connected end to end to form a single-channel feature vector. The channel dimension is removed to obtain the three-view fusion feature of the single-side traffic.

[0014] S8. Based on the three-view fusion features, collect the paired related features to form a training set, select one side of the related sample pair and rotate it, cross the other side of the related sample with its rotated sample pair to obtain non-related sample pairs, and use a large number of non-related sample pairs to train and optimize the convolutional neural network in steps S3 to S6 through backpropagation.

[0015] S9. Use the optimized convolutional neural network for feature extraction and traffic correlation.

[0016] In the above-described technical solution of the present invention, step S1 specifically includes the following steps:

[0017] Set the maximum and minimum collection times for traffic, and collect traffic on both the user and service sides simultaneously. Start collecting traffic from the moment it is detected. If no interaction packet appears within the time window or the maximum collection time is reached after the minimum collection time has elapsed, stop the current round of traffic collection and start a new round of traffic collection.

[0018] In the above-described technical solution of the present invention, the flow characterization quadruple is represented as follows: in, This refers to the size of the uplink data packets. This refers to the size of the downlink traffic data packets. The arrival time of the uplink traffic data packets. This represents the arrival time of the downlink traffic data packets. This quadruple clarifies the relative order of uplink and downlink traffic interactions, fixing the data packets containing interaction information to a specific position in one dimension of the quadruple.

[0019] In the above-described technical solution of the present invention, the stride of the convolutional kernel of the convolutional neural network for uplink and downlink traffic fusion is equal to the number of traffic directions when moving vertically, thereby ensuring that each information fusion and extraction is limited to the size of the data packet or the time dimension of the data packet. After the initial fusion of uplink and downlink traffic, a two-dimensional single-layer convolutional kernel with a horizontal stride of 1 is introduced to further extract the interaction information vector.

[0020] In the above-described technical solution of the present invention, step S4 specifically includes:

[0021] S401. Normalize the feature vector of the interaction information after the fusion of uplink and downlink traffic, and remove the original biased information caused by the different types of features.

[0022] S402. Create two learnable biased attention seeds to generate biased weighted matrices for packet size and packet arrival time, respectively.

[0023] S403. Perform dot products between the normalized features and the two biased weighting matrices respectively to obtain the biased weighted features of data packet size and data packet arrival time.

[0024] S404. Using a two-dimensional convolutional neural network, information fusion of local data packet size and data packet arrival time is performed to obtain the weighted fusion features of data packet size and data packet arrival time.

[0025] In the above-described technical solution of the present invention, the weighted matrix of the data packet size in step S402 is as follows:

[0026]

[0027] The weighted matrix of the data packet arrival times is as follows:

[0028]

[0029] The weighted fusion feature based on data packet size is represented as follows:

[0030]

[0031] The weighted fusion feature of the data packet arrival time is represented as follows:

[0032]

[0033] Where: α and β are learnable biased attention seeds; F is the interaction information feature after fusing uplink and downlink traffic; G is a function that generates a biased weighted matrix with the same dimension as F and whose elements are all function input values; L conv2D It is a two-dimensional convolution.

[0034] In the above-mentioned technical solution of the present invention, the specific steps for obtaining the global information feature vector in step S6 are as follows: a convolution with a large kernel and dilation is used as the rapid expansion part of the receptive field of the convolutional neural network, followed by a small convolution kernel as the feature integration module, and the global information feature vector is obtained through multi-layer iteration.

[0035] To address the difficulty in extracting anti-aliasing key features from traffic, this invention utilizes three views—interaction information feature vectors after uplink and downlink traffic fusion, local information feature vectors, and global information feature vectors—to perform deep feature fusion during the feature extraction process. Specifically: (1) Interaction view of uplink and downlink traffic fusion: The interaction information of uplink and downlink traffic often contains a large amount of communication-specific information. By aligning the data packets in the uplink and downlink traffic one by one, interaction information is introduced from the input data level. Furthermore, by controlling the jump stride of the two-dimensional convolution, the uplink and downlink interaction characteristics within the data packet size or data packet arrival time are captured. (2) Local information view: By using a weighting matrix to weight the data packet size and data packet arrival time respectively, and by using two-dimensional cross-channel convolution for feature fusion, feature information with local weighting is obtained. (3) Global information view: A stacked structure combining dilated convolutional layers and regular convolutional layers is adopted. While effectively solving the gridding problem that dilated convolution may cause, global information is quickly extracted and integrated through multiple iterations. These three different views each extract features from a unique perspective, and by aligning and connecting these features, a deep feature representation that can resist traffic obfuscation is formed.

[0036] To address the challenge of quickly extracting comparative information from traffic data, this invention selectively introduces only a subset of positive sample pairs during the training phase of the feature extraction model. This extracts a partial set of positive sample feature pairs. Utilizing a feature extractor and association separation techniques, combined with a rotation-cross feature enhancement mechanism, the small number of associated service traffic features and user traffic features extracted in a single feature extraction are continuously rotated to alter the order of the sample sets. This causes crossover between user service feature pairs from different associated pairs, resulting in a large number of non-associated sample pairs (negative sample pairs). This method provides rich comparative information for subsequent traffic association within a limited feature extraction process, significantly improving the model's convergence speed.

[0037] It is worth noting that after extracting features according to the method described above, the attacker determines whether to use the precise association attack mode or the credibility filtering attack mode based on the traffic scale of the target scenario. If the attacker is targeting a small-scale traffic scenario, the precise association attack mode is used. If the attacker is targeting a large-scale traffic scenario, the filtering mode is used.

[0038] In the precise association working mode, obfuscated traffic is introduced. The original traffic with three-view fusion characteristics and the obfuscated traffic are input into a multilayer vector perceptron for learning. Cross-entropy loss and smooth Euclidean distance guide network convergence, identifying associated traffic. The formula for calculating the smooth Euclidean distance is as follows:

[0039] D s =eKd -1,

[0040] Where K is the smoothing weight, and d is the cumulative traversal distance for each batch. and These represent the traffic characteristics with obfuscation and the original traffic characteristics, respectively, with b being the batch size.

[0041] In the credibility filtering working mode, user-side and service-side traffic is divided into windows according to time blocks. Raw traffic with three-view fusion characteristics is further divided into windows according to time blocks. The three-view fusion features are extracted separately for each window. The cosine distance is calculated using the traffic from each user-side and service-side window, serving as a window matching score. The association results for each window are used for voting. For each window's score, the association score for the entire traffic is calculated uniformly. The final decision is based on these voting results, and a set threshold is used to determine whether the traffic is associated. This threshold is set according to the attacker's needs, quantifying the attacker's requirements for the credibility of the associated samples.

[0042] Two different operating modes were designed to address the different needs of small-scale targets and large-scale traffic. For small-scale targets, a guided learning mechanism was designed to improve the accuracy of model associations, effectively learning and identifying the characteristics of data obfuscation to minimize its impact. For large-scale targets, a multi-window voting mechanism was implemented, allowing attackers to flexibly adjust the filtering strictness based on specific attack requirements and real-time network traffic conditions, thereby obtaining a highly reliable set of matching traffic.

[0043] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0044] This invention proposes a multi-view-based feature extraction mechanism, which constructs three convolutional neural networks based on an interactive view of uplink and downlink traffic fusion, a local information view, and a global information view. By integrating these three neural networks to form a multi-view fusion feature extraction network, deep traffic features resistant to traffic confusion are extracted. This feature extraction method can capture information from multiple angles in different data views and significantly improve the accuracy of flow association technology by effectively integrating this information, thereby enhancing the accuracy of flow association methods in dealing with traffic confusion.

[0045] This invention also proposes a feature enhancement mechanism based on rotation and crossover. By extracting a small number of associated service traffic features and user traffic features, and through continuous rotation operations, the arrangement order of the sample set is constantly changed, causing user service feature pairs between different associated pairs to crossover and forming a large number of unassociated sample pairs. This process provides feature enhancement information for subsequent traffic association and significantly improves the convergence speed of the model. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of the process of multi-view fusion feature extraction and rotational intersection feature enhancement in Embodiment 1 of the present invention.

[0047] Figure 2 This is a schematic diagram of the convolutional neural network structure for uplink and downlink traffic fusion in this invention.

[0048] Figure 3 This is a schematic diagram of the locally weighted fusion convolutional neural network structure of the present invention.

[0049] Figure 4 This is a schematic diagram of the dilated convolutional neural network structure for global information extraction according to the present invention.

[0050] Figure 5 This is a schematic diagram of feature association processing in Embodiment 1 of the present invention.

[0051] Figure 6 This is a comparison between the method of the present invention and the existing DeepCoFFEA method in the case of large-scale samples.

[0052] Figure 7 The figure shows the results of a horizontal comparison of the efficiency of the method of this invention with existing mainstream methods.

[0053] Figure 8 This figure shows the results of a longitudinal comparison of the efficiency of the method of this invention with existing mainstream methods.

[0054] Figure 9 This is a schematic diagram illustrating the results of the method of the present invention in resisting network noise. Detailed Implementation

[0055] The following embodiments are used to illustrate the present invention, but are not intended to limit the scope of protection of the present invention. Unless otherwise specified, the technical means used in the embodiments are conventional means well known to those skilled in the art. Unless otherwise specified, the test methods in the following embodiments are conventional methods.

[0056] Example 1

[0057] Please refer to Figure 1 This invention is illustrated by a schematic diagram of the process of multi-view fusion feature extraction and rotational intersection feature enhancement. This embodiment of an anonymous network traffic association method based on multi-view fusion feature extraction and rotational intersection feature enhancement specifically includes the following steps:

[0058] Step S1: Construct a traffic dataset to be associated, let T min =120s, T max =30s, T Interruption=5s, traffic is collected simultaneously on the user side and the service side. When the collection time for a single traffic item exceeds T... min Afterwards, in T Interruption No interactive information within a certain time period, or the data collection time exceeds T. max If the current data collection fails, the data will be stopped, and the data will be added to the single-sided traffic dataset to begin the next round of traffic collection.

[0059] Step S2: Preprocess a single traffic data entry to obtain its quadruple representation. in, This refers to the size of the uplink data packets. This refers to the size of the downlink traffic data packets. The arrival time of the uplink traffic data packets. This represents the arrival time of data packets for downlink traffic.

[0060] Step S3: Based on the traffic representation quadruple, construct a convolutional neural network for fusing uplink and downlink traffic, such as... Figure 2 As shown, its structure includes: input layer - inter-channel fusion convolutional layer CONV2D(vaild) - batch normalization layer BN - activation function ELU - intra-channel feature extraction convolutional layer CONV2D(same) - activation function RELU - batch normalization layer BN - max pooling layer. Traffic is input into the network, and uplink and downlink interaction information is fused to obtain the interaction information feature vector after uplink and downlink traffic fusion.

[0061] Implementation example: The input feature has dimensions [4, 600], and its four dimensions are... The output feature has dimensions [2, 600], and its two dimensions are...

[0062] Step S4: Based on the interaction information feature vector after the uplink and downlink traffic fusion, construct a locally weighted fusion convolutional neural network, such as... Figure 3 As shown, the structure includes: a weighted matrix generation and data input layer, an inter-channel weighted fusion convolutional layer CONV2D (vailable), a batch normalization layer (BN), and an activation function ELU (preserving intermediate features F). Intermediate1 - Intra-channel feature extraction convolutional layer CONV2D (same) - Activation function ReLU - Batch normalization layer BN (same as F) Intermediate1 The structure consists of a residual layer (Maxpooling) followed by a random deactivation layer (Dropout). The interaction information feature vector after fusing uplink and downlink traffic is input into a locally weighted convolutional neural network for local information extraction. This extracts weighted features of packet size and arrival time. Two convolutional layers are then used to further obtain the weighted fused information of packet size and arrival time.

[0063] Implementation example: The input feature dimension is [2, 600], and the output two skewed features are both [1, 600].

[0064] Step S5: Stack the channel-weighted fusion information based on packet size and packet arrival time to obtain local information feature vectors.

[0065] Implementation example: The dimensions of the input features are [1, 600], and the dimensions of the connected local information features are all [2, 600].

[0066] Step S6: Based on the local information feature vectors, construct a dilated convolutional neural network to extract global information, such as... Figure 4 As shown, its structure includes three global information extraction modules. Each global information extraction module includes: a dilated convolutional global information extraction layer (Dilated Conv2D), a batch normalization layer (BN), and an activation function (ReLU, which preserves intermediate features F). Intermediate2 Conv2D - Small convolutional kernel global information integration layer - Activation function ReLU (and F) Intermediate2 The structure consists of a residual layer (Maxpooling) followed by a random deactivation layer (Dropout). Locally biased information is input into the first global information extraction module. A large, dilated convolutional kernel is used to rapidly expand the receptive field of the convolutional neural network, followed by a small convolutional kernel as a feature integration module. Global information feature vectors are obtained through three iterative layers. Finally, the Flatten function is used to convert the extracted features into a one-dimensional vector for constructing fused features.

[0067] Implementation example: The input feature dimension is [2, 600], and the output global information feature dimension is [2, 7].

[0068] Step S7: Using different small convolution kernels, the interactive information feature vector, local information feature vector, and global information feature vector are mapped into three single-channel vectors. The three single-channel vectors are concatenated end to end to form a single-channel feature vector. The channel dimension is removed to obtain the three-view fusion feature of the single-side traffic.

[0069] Implementation example: The dimensions of the interactive information feature channel after expansion are

[2312] , the dimensions of the local information feature channel after expansion are

[1056] , the dimensions of the global information feature channel after expansion are

[7168] , and the dimensions of the three-view fusion feature after connection are

[10536] .

[0070] Step S8: Based on the three-view fusion features, collect paired related features to form a training set, select one side of the related sample pair and rotate it, cross the other side of the related sample with its rotated sample pair to obtain non-related sample pairs, and use a large number of non-related sample pairs to train and optimize the convolutional neural network in steps S3 to S6 through backpropagation.

[0071] Implementation example: If this step inputs N related sample pairs, then the rotation can be performed at most N-1 times. The experiment chooses rotation. Then, the total amount that can be obtained is... Group of negative samples.

[0072] Step S9: Perform feature extraction and traffic correlation using the optimized convolutional neural network. For example... Figure 5 As shown, the attacker selects the feature association working mode based on their own intent and the number of targets. If the amount of target data is small, the precise association working mode is selected (step S10); if the number of targets is large, the credibility filtering working mode is selected (step S11).

[0073] Step S10: When faced with a small number of targets, the original traffic pairs with three-view fusion features and the confused traffic pairs are input into a multilayer vector perceptron. The network convergence is guided by cross-entropy loss and smooth Euclidean distance. The obtained value is the association score. When the association score exceeds the threshold or meets the attacker's predetermined strategy, it is determined to be an association, and the process proceeds to step S12.

[0074] Implementation example: The ratio of associated samples to unassociated samples is only 1:49. Using the feature extraction method based on three views of this invention, associated samples can be accurately identified in four different levels of defense deployment. The results are compared with other methods, as shown in Table 1.

[0075] Table 1 compares the results with existing state-of-the-art methods on small-sample scenarios.

[0076] method No defense WTF-pad front Front-t1 Random-Front Restor 0.882 0219 0.532 0.799 0.569 Flowtraker 0.862 0.771 0.646 0.825 0.475 DeepCorr 0.949 0.762 0.413 0.771 0.141 Ours 0.986 0.904 0.955 0.968 0.759

[0077] Step S11: Faced with a large number of targets, the user-side and service-side traffic is divided into windows. Feature extraction is performed on each window separately. A window matching score is obtained by using each window of each pre-judged traffic for association judgment. For the score of each window, the association score of the entire traffic is calculated uniformly. When the association score exceeds the threshold or meets the attacker's predetermined strategy, it is judged as an association, and the process proceeds to step S12.

[0078] Implementation Example: The ratio of associated to unassociated samples is as low as 1:1999. Due to the stringent comparison mechanism, many traditional methods cannot effectively handle this situation. Only the DeepCoFFEA method, which employs a window voting mechanism, still demonstrates good performance in this case. Therefore, this invention chooses to compare only with the DeepCoFFEA method, and the results are as follows... Figure 6 As shown in the figure, the results demonstrate that the method of the present invention is significantly superior to the DeepCoFFEA method in terms of performance.

[0079] Step S12: If in training mode, perform backpropagation to optimize the three-view feature extraction network until the preset training rounds are completed, then proceed to step S13. If in attack mode, proceed directly to S13.

[0080] Step S13: End of method.

[0081] To verify the efficiency of the method, this embodiment was evaluated from two aspects: first, a horizontal comparison, comparing its efficiency with existing mainstream methods; and second, a vertical test, verifying its low data dependency by continuously adjusting the amount of input data.

[0082] like Figure 7 As shown, with the full dataset, the method of this invention has a significant speed advantage over DeepCorr, but is still slightly slower than the well-designed FlowTracker and ResTor. However, the method of this invention achieves a much higher accuracy than these two methods. Furthermore, when the amount of input data decreases, the method of this invention can maintain high accuracy while achieving similar time overhead to these two methods.

[0083] like Figure 8 As shown, in terms of longitudinal comparison, as the amount of data decreases, the amount of data required by the method of the present invention drops sharply, but its accuracy can still maintain a high level, which proves the low data dependence of the method of the present invention.

[0084] Because various types of noise exist on the internet, and these noises may not necessarily appear in the model's training data, this invention simulates four types of network noise and adds them only to the test data to verify the robustness of the method. The results are as follows: Figure 9 As shown. Although the method of the present invention is affected to some extent by various noises, its accuracy remains at a high level.

[0085] To verify the effectiveness of the view feature extraction module and the rotation and intersection feature enhancement module, this embodiment conducts ablation experiments on each part of the method, verifying that each part of the method plays a certain role and improves the accuracy of the flow association technology. The results are shown in Table 2.

[0086] ablation module top1 accuracy Training time (hours) Complete method 0.955 7.1 Interactive view of uplink and downlink traffic fusion 0.941 5.1 Local information view 0.923 4.6 Global Information View 0.889 4.3 Rotational Cross Reinforcement 0.729 4.0

[0087] In summary, the method proposed in this invention has better association accuracy and higher training efficiency than existing methods, and has good innovation and application prospects.

[0088] The embodiments described above are merely preferred embodiments of the present invention and are only used to explain the present invention. They are not intended to limit the scope of the present invention. For those skilled in the art, other implementation methods can be easily made by substitution or modification based on the technical content disclosed in this specification. Therefore, all changes and improvements made on the principle of the present invention should be included within the scope of the patent application of the present invention.

Claims

1. A method for anonymizing network traffic correlation based on feature extraction and feature enhancement, characterized in that, Includes the following steps: S1. Set the traffic collection time and collect traffic from both the user side and the service side simultaneously; S2. Divide the collected traffic monitoring data into uplink traffic and downlink traffic according to the direction of flow, and construct a traffic representation quadruple according to the data packet size and data packet arrival time of uplink and downlink traffic. S3. Based on the traffic representation quadruple, construct a convolutional neural network for uplink and downlink traffic fusion, and extract the interaction information feature vector after uplink and downlink traffic fusion. S4. Based on the interaction information feature vector after the uplink and downlink traffic fusion, construct a locally weighted fusion convolutional neural network to obtain the biased weighted fusion features of data packet size and data packet arrival time. S5. The weighted fusion features of data packet size and data packet arrival time are stacked in channels to obtain local information feature vectors; S6. Based on the local information feature vector, construct a dilated convolutional neural network to extract global information and obtain the global information feature vector; S7. Using different small convolution kernels, the interactive information feature vector, local information feature vector and global information feature vector are mapped into three single-channel vectors. The three single-channel vectors are connected end to end to form a single-channel feature vector. The channel dimension is removed to obtain the three-view fusion feature of the single-side traffic. S8. Based on the three-view fusion features, collect the paired related features to form a training set, select one side of the related sample pair and rotate it, cross the other side of the related sample with its rotated sample pair to obtain non-related sample pairs, and use a large number of non-related sample pairs to train and optimize the convolutional neural network in steps S3 to S6 through backpropagation. S9. Use the optimized convolutional neural network for feature extraction and traffic correlation.

2. The anonymous network traffic correlation method according to claim 1, characterized in that, The specific steps of step S1 include: Set the maximum and minimum collection times for traffic, and collect traffic on both the user and service sides simultaneously. Start collecting traffic from the moment it is detected. If no interaction packet appears within the time window or the maximum collection time is reached after the minimum collection time has elapsed, stop the current round of traffic collection and start a new round of traffic collection.

3. The anonymous network traffic correlation method according to claim 1, characterized in that, The flow representation quadruple is represented as in, This refers to the size of the uplink data packets. This refers to the size of the downlink data packets. The arrival time of the uplink traffic data packets. This represents the arrival time of data packets for downlink traffic.

4. The anonymous network traffic correlation method according to claim 1, characterized in that, The convolutional kernel of the convolutional neural network that fuses uplink and downlink traffic has a stride equal to the number of traffic directions when moving vertically.

5. The anonymous network traffic correlation method according to claim 1, characterized in that, The specific steps of step S4 include: S401. Normalize the feature vector of the interaction information after the fusion of uplink and downlink traffic, and remove the original biased information caused by the different types of features. S402. Create two learnable biased attention seeds to generate biased weighted matrices for packet size and packet arrival time, respectively. S403. Perform dot products between the normalized features and the two biased weighting matrices respectively to obtain the biased weighted features of data packet size and data packet arrival time. S404. Using a two-dimensional convolutional neural network, information fusion of local data packet size and data packet arrival time is performed to obtain the weighted fusion features of data packet size and data packet arrival time.

6. The anonymous network traffic correlation method according to claim 5, characterized in that, The weighted matrix for the data packet size mentioned in step S402 is as follows: The weighted matrix of the data packet arrival times is as follows: The weighted fusion feature based on data packet size is represented as follows: The weighted fusion feature of the data packet arrival time is represented as follows: Where: α and β are learnable biased attention seeds; F is the interaction information feature after uplink and downlink traffic fusion; G is a function that generates a biased weighted matrix with the same dimension as F and whose elements are all function input values; L conv2D It is a two-dimensional convolution.

7. The anonymous network traffic correlation method according to claim 1, characterized in that, The specific steps for obtaining the global information feature vector in step S6 are as follows: a convolution with a large kernel and dilation is used as the rapid expansion part of the receptive field of the convolutional neural network, followed by a small convolution kernel as the feature integration module, and the global information feature vector is obtained through multi-layer iteration.

Images