DoH encrypted domain name service traffic classification method and device

Abstract

This application provides a method and apparatus for classifying DoH encrypted domain name service traffic. The method includes: performing dimensionality reduction processing on target traffic feature data corresponding to DoH encrypted domain name service traffic data to obtain dimensionality-reduced traffic feature data; inputting the dimensionality-reduced traffic feature data into a preset machine learning model for classifying DoH encrypted domain name service traffic, so that the machine learning model outputs traffic classification result data corresponding to the DoH encrypted domain name service traffic data. This application can effectively reduce the computational resource consumption of the DoH encrypted domain name service traffic classification process and prevent data overfitting. While ensuring the reliability and accuracy of the DoH encrypted domain name service traffic classification results, it can effectively improve the efficiency of DoH encrypted domain name service traffic classification, thereby improving the security of DoH encrypted domain name services.

Description

Technical Field

[0001] This application relates to the field of traffic classification technology, and in particular to a method and apparatus for classifying traffic for DoH encrypted domain name services. Background Technology

[0002] DoH (DNS-over-HTTPS) refers to using the HTTPS protocol to make DNS requests and implement DNS domain name resolution services. DoH encrypted domain name service traffic data refers to encrypted traffic data containing domain name information generated by the DoH protocol after encrypting the data through SSL or TLS. This is used to verify the identity of the domain name resolution service and protect data integrity. The payload of the encrypted traffic data is in encrypted form and cannot be identified using conventional encrypted traffic detection methods such as deep packet inspection. Network attackers have repeatedly exploited the unique characteristics of DoH encrypted domain name services to carry out network sabotage or steal data by exploiting security vulnerabilities.

[0003] Therefore, it is of great significance to distinguish the type of DoH encrypted domain name service traffic data from background traffic, namely non-DoH traffic, benign DoH traffic, or malicious DoH traffic. However, since DoH encrypted domain name service traffic data involves many feature dimensions, conventional DoH encrypted domain name service traffic classification methods will result in a large computational burden and long time consumption. Therefore, there is an urgent need to find a way to effectively reduce the computational resource consumption of the automatic classification process of DoH encrypted domain name service traffic. Summary of the Invention

[0004] In view of this, embodiments of this application provide a DoH encrypted domain name service traffic classification method and apparatus to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of this application provides a method for classifying traffic for DoH encrypted domain name services, including:

[0006] Dimensionality reduction is performed on the target traffic feature data corresponding to the DoH encrypted domain name service traffic data to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data.

[0007] The dimensionality-reduced traffic feature data is input into a preset machine learning model for classifying DoH encrypted domain name service traffic, so that the machine learning model outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data.

[0008] In some embodiments of this application, the step of performing dimensionality reduction processing on the target traffic feature data corresponding to the DoH encrypted domain name service traffic data to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data includes:

[0009] The target traffic feature data corresponding to the DoH encrypted domain name service traffic data is dimensionality reduced based on the truncated singular value decomposition method to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data.

[0010] In some embodiments of this application, the step of performing dimensionality reduction processing on the target traffic feature data corresponding to the DoH encrypted domain name service traffic data based on the truncated singular value decomposition method to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data includes:

[0011] Information entropy is calculated for each dimension of the target traffic feature data to obtain an information entropy matrix composed of the information entropy values ​​corresponding to each dimension of the feature.

[0012] The information entropy values ​​in the information entropy matrix are sorted from largest to smallest, and the first preset number of sorted information entropy values ​​are retained to obtain the corresponding optimized information entropy matrix. The preset number is determined in advance based on the number and percentage threshold of each information entropy value in the information entropy matrix.

[0013] Furthermore, singular value decomposition is performed on the target traffic feature data based on the truncated singular value decomposition method to obtain the singular value decomposition result data of the target traffic feature data;

[0014] The optimized information entropy matrix and the singular value decomposition result data are weighted and normalized to obtain the corresponding dimensionality-reduced traffic feature matrix, which is then used as the dimensionality-reduced traffic feature data corresponding to the target traffic feature data.

[0015] In some embodiments of this application, the machine learning model includes: a classifier;

[0016] The classifier includes: XGBoost, a gradient boosting decision tree.

[0017] In some embodiments of this application, the dimensionality reduction processing of the target traffic feature data corresponding to the DoH encrypted domain name service traffic data includes:

[0018] Feature extraction is performed on the currently collected DoH encrypted domain name service traffic data to obtain the traffic features corresponding to the DoH encrypted domain name service traffic data;

[0019] The traffic characteristics corresponding to the DoH encrypted domain name service traffic data are preprocessed to obtain the target traffic characteristic data corresponding to the DoH encrypted domain name service traffic data.

[0020] In some embodiments of this application, the step of extracting features from the currently collected DoH encrypted domain name service traffic data to obtain the traffic features corresponding to the DoH encrypted domain name service traffic data includes:

[0021] The collected DoH encrypted domain name service traffic data is parsed using Wireshark software to extract the traffic characteristics corresponding to the DoH encrypted domain name service traffic data. The traffic characteristics include: source IP, destination IP, data length, and transmission time.

[0022] In some embodiments of this application, the step of preprocessing the traffic features corresponding to the DoH encrypted domain name service traffic data to obtain the target traffic feature data corresponding to the DoH encrypted domain name service traffic data includes:

[0023] Missing features are deleted and normalized on the traffic features corresponding to the DoH encrypted domain name service traffic data to obtain the target traffic feature data corresponding to the DoH encrypted domain name service traffic data.

[0024] Another aspect of this application provides a DoH encrypted domain name service traffic classification device, comprising:

[0025] The feature dimensionality reduction module is used to perform dimensionality reduction processing on the target traffic feature data corresponding to the DoH encrypted domain name service traffic data to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data.

[0026] The traffic classification module is used to input the dimensionality-reduced traffic feature data into a preset machine learning model for classifying DoH encrypted domain name service traffic, so that the machine learning model outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data.

[0027] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the DoH encrypted domain name service traffic classification method.

[0028] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the DoH encrypted domain name service traffic classification method.

[0029] A fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the DoH encrypted domain name service traffic classification method.

[0030] The DoH encrypted domain name service traffic classification method provided in this application reduces the dimensionality of the target traffic feature data corresponding to the DoH encrypted domain name service traffic data to obtain the dimensionality-reduced traffic feature data. This dimensionality-reduced traffic feature data is then input into a preset machine learning model for classifying DoH encrypted domain name service traffic. The machine learning model outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data. This method retains more information from the traffic features as feature weights for dimensionality reduction, reducing the impact of less informative feature values ​​on parameter estimation. It effectively reduces the computational resource consumption of the DoH encrypted domain name service traffic classification process, significantly improving detection efficiency while maintaining data integrity. On the one hand, it saves overall model runtime and improves efficiency; on the other hand, it prevents data overfitting and improves service classification accuracy. Therefore, while ensuring the reliability and accuracy of the DoH encrypted domain name service traffic classification results, it effectively improves the efficiency of DoH encrypted domain name service traffic classification, thereby enhancing the security of DoH encrypted domain name services.

[0031] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon reading the following text, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0032] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0033] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings:

[0034] Figure 1 This is a schematic diagram of the first process of the DoH encrypted domain name service traffic classification method in one embodiment of this application.

[0035] Figure 2 This is a schematic diagram of the second process of the DoH encrypted domain name service traffic classification method in one embodiment of this application.

[0036] Figure 3This is a schematic diagram of the second process of the DoH encrypted domain name service traffic classification method in one embodiment of this application.

[0037] Figure 4 This is a schematic diagram of the DoH encrypted domain name service traffic classification device in one embodiment of this application. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0039] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the scheme according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0040] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0041] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0042] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0043] To address the issues of high computational burden and long processing time in conventional DoH encrypted domain name service traffic classification methods, this application provides a DoH encrypted domain name service traffic classification method, a DoH encrypted domain name service traffic classification device for executing the DoH encrypted domain name service traffic classification method, a physical device, a computer-readable storage medium, and a computer program product. These methods effectively reduce the computational resource consumption of the DoH encrypted domain name service traffic classification process, prevent data overfitting, and improve the efficiency of DoH encrypted domain name service traffic classification while ensuring the reliability and accuracy of the classification results. Ultimately, this enhances the security of the DoH encrypted domain name service.

[0044] The following examples will provide a detailed description.

[0045] Based on this, embodiments of this application provide a DoH encrypted domain name service traffic classification method that can be implemented by a DoH encrypted domain name service traffic classification device, see [link to relevant documentation]. Figure 1The DoH encrypted domain name service traffic classification method specifically includes the following:

[0046] Step 100: Perform dimensionality reduction processing on the target traffic feature data corresponding to the DoH encrypted domain name service traffic data to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data.

[0047] In one or more embodiments of this application, DoH (DNS over HTTPS) uses the secure HTTPS protocol to run DNS, primarily to enhance user security and privacy. By using encrypted HTTPS connections, third parties can no longer influence or monitor the resolution process. Therefore, third parties cannot view and modify the requested URL. If HTTPS-based DNS is used, the Transmission Control Protocol (TCP) in DoH reacts more quickly to data loss during transmission.

[0048] In one or more embodiments of this application, DoH encrypted domain name service traffic data refers to encrypted traffic data containing domain name information formed after the traffic generated by the DoH protocol is encrypted using SSL or TLS.

[0049] It is understood that the target traffic characteristic data refers to the traffic characteristics used to represent the traffic data of the DoH encrypted domain name service. These traffic characteristics include: source IP, destination IP, data length, and transmission time.

[0050] In one or more embodiments of this application, the dimensionality reduction process may employ at least one of the following dimensionality reduction methods: PCA, LDA, and TSVD.

[0051] Principal Components Analysis (PCA), also known as principal component analysis, aims to reduce the dimensionality of multiple indicators by transforming them into a few comprehensive indicators. The goal of PCA is to find r (r < n) new variables that reflect the main characteristics of a subject, compressing the size of the original data matrix, reducing the dimensionality of the eigenvectors, and selecting the fewest possible dimensions to summarize the most important features. Each new variable is a linear combination of the original variables, reflecting the combined effect of the original variables and possessing practical meaning. These r new variables are called "principal components," and they can largely reflect the influence of the original n variables. Furthermore, these new variables are uncorrelated and orthogonal. Through principal component analysis, the data space is compressed, allowing the characteristics of multivariate data to be intuitively represented in a lower-dimensional space.

[0052] LDA is a linear discriminant analysis method, a supervised learning algorithm. LDA assumes that all sample data follow a Gaussian distribution, with identical and full-rank covariance matrices. Compared to PCA, LDA is a supervised dimensionality reduction algorithm, meaning the data has labels (class labels). TSVD refers to truncated singular value decomposition.

[0053] Step 200: Input the dimensionality-reduced traffic feature data into a preset machine learning model for classifying DoH encrypted domain name service traffic, so that the machine learning model outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data.

[0054] In step 200, the machine learning model can be pre-trained using the dimensionality-reduced traffic feature data corresponding to each historical DoH encrypted domain name service traffic data and the type labels corresponding to each historical DoH encrypted domain name service traffic data. The type labels represent the type of the historical DoH encrypted domain name service traffic data, and the traffic classification result data represents the type of the DoH encrypted domain name service traffic data. It is understood that the types include: non-DoH traffic, benign DoH traffic belonging to DoH traffic, and malicious DoH traffic belonging to DoH traffic.

[0055] As can be seen from the above description, the DoH encrypted domain name service traffic classification method provided in this application can retain more information in the traffic features as feature weights for dimensionality reduction decomposition, reduce the impact of feature values ​​with smaller information on parameter estimation, effectively reduce the computational resource consumption of the DoH encrypted domain name service traffic classification process, and significantly improve detection efficiency while maintaining data integrity. On the one hand, it saves the overall running computation time of the model and improves efficiency; on the other hand, it prevents data overfitting and improves the accuracy of service classification. Thus, while ensuring the reliability and accuracy of the DoH encrypted domain name service traffic classification results, it can effectively improve the efficiency of DoH encrypted domain name service traffic classification, thereby improving the security of DoH encrypted domain name services.

[0056] To further improve the effectiveness and reliability of dimensionality reduction processing of target traffic feature data corresponding to DoH encrypted domain name service traffic data, a DoH encrypted domain name service traffic classification method is provided in this application embodiment. (See also...) Figure 2 Step 100 in the DoH encrypted domain name service traffic classification method specifically includes the following:

[0057] Step 110: Perform dimensionality reduction processing on the target traffic feature data corresponding to the DoH encrypted domain name service traffic data based on the truncated singular value decomposition method to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data.

[0058] Truncated singular value decomposition (TSVD) is a matrix factorization technique that decomposes a matrix M into three matrices: U, ∑, and V. U is an m×m orthogonal matrix called the left singular matrix; ∑ is an m×n diagonal matrix whose diagonal elements are called singular values; and V is an n×n orthogonal matrix called the right singular matrix. TSVD is a variation of SVD, calculating only the K largest singular values ​​specified by the user. Unlike regular SVD, TSVD can produce a decomposition matrix of a specified dimension. For example, a matrix that remains a single matrix after SVD decomposition can be generated by TSVD, thus achieving dimensionality reduction.

[0059] To optimize the truncated singular value decomposition process and further improve the effectiveness and reliability of dimensionality reduction processing of target traffic feature data corresponding to DoH encrypted domain name service traffic data, a DoH encrypted domain name service traffic classification method is provided in this application embodiment. (See also...) Figure 3 Step 110 in the DoH encrypted domain name service traffic classification method specifically includes the following:

[0060] Step 111: Calculate the information entropy of each dimension of the target traffic feature data to obtain an information entropy matrix composed of the information entropy values ​​corresponding to each dimension of the feature.

[0061] Step 112: Sort the information entropy values ​​in the information entropy matrix from largest to smallest, and retain the first preset number of sorted information entropy values ​​to obtain the corresponding optimized information entropy matrix. The preset number is determined in advance based on the number and percentage threshold of each information entropy value in the information entropy matrix.

[0062] It is understood that the percentage threshold can be set according to actual application needs; in one example, it can be set to 80%.

[0063] And, step 113: Perform singular value decomposition on the target traffic feature data based on the truncated singular value decomposition method to obtain the singular value decomposition result data of the target traffic feature data.

[0064] Step 114: Perform weighted and normalized processing on the optimized information entropy matrix and the singular value decomposition result data to obtain the corresponding dimensionality-reduced traffic feature matrix, so as to use the dimensionality-reduced traffic feature matrix corresponding to the target traffic feature data.

[0065] To further improve the accuracy and effectiveness of DoH encrypted domain name service traffic classification, in the DoH encrypted domain name service traffic classification method provided in this application embodiment, the machine learning model can employ a classifier, and in particular, XGBoost based on gradient boosting decision trees can be selected as the classifier. The dimensionality-reduced traffic feature data is then input into XGBoost, which outputs traffic labeling results to achieve the classification of non-DoH traffic, benign DoH traffic, and malicious DoH traffic.

[0066] To further improve the effectiveness and reliability of the application of target traffic feature data corresponding to DoH encrypted domain name service traffic data, a DoH encrypted domain name service traffic classification method is provided in this application embodiment. (See also...) Figure 2 The DoH encrypted domain name service traffic classification method includes the following content before step 100:

[0067] Step 010: Extract features from the currently collected DoH encrypted domain name service traffic data to obtain the traffic features corresponding to the DoH encrypted domain name service traffic data;

[0068] Step 020: Preprocess the traffic features corresponding to the DoH encrypted domain name service traffic data to obtain the target traffic feature data corresponding to the DoH encrypted domain name service traffic data.

[0069] To further improve the accuracy and reliability of feature extraction from DoH encrypted domain name service traffic data, a DoH encrypted domain name service traffic classification method is provided in this application embodiment, see [link to relevant documentation]. Figure 3 Step 010 of the DoH encrypted domain name service traffic classification method specifically includes the following:

[0070] Step 011: Use Wireshark software to parse the currently collected DoH encrypted domain name service traffic data to extract the traffic characteristics corresponding to the DoH encrypted domain name service traffic data. The traffic characteristics include: source IP, destination IP, data length, and transmission time.

[0071] Specifically, Wireshark is a network packet analyzer. Its function is to capture network packets and display the most detailed network packet information possible. Wireshark uses WinPCAP (Windows Packet Capture) as its interface to directly exchange data packets with the network card.

[0072] Wireshark is not an intrusion detection system (IDS). It does not generate alerts or any notifications for abnormal network traffic. However, careful analysis of packets captured by Wireshark can help users gain a clearer understanding of network behavior. Wireshark does not modify the content of network packets; it only reflects the information of passing packets.

[0073] Additionally, PCAPNG (PCAP Next Generation Dump File Format) refers to the next-generation file format of the PCAP process characterization software package, with the suffix ".pcapng".

[0074] Therefore, in one example, before extracting traffic characteristics, the environment needs to be set up to use the pyshark library (a Python library for network packet capture and analysis) to capture and parse traffic packets. First, Wireshark needs to be installed and the tshark command-line tool (the command-line version of Wireshark) needs to be available. Then, the path to tshark is set in the code, and a directory is created to save downloaded files. The core function is analyze_pcap, which uses the pyshark library to parse a given PCAP file and extract packets for TCP, UDP, and ICMP protocols. It can capture information such as source IP, destination IP, packet length, transmission time, source port, and destination port from traffic packets as traffic characteristics, and identify DNS queries and TLS handshake data.

[0075] To further improve the accuracy and reliability of preprocessing the traffic characteristics corresponding to the DoH encrypted domain name service traffic data, a DoH encrypted domain name service traffic classification method is provided in this application embodiment. (See also...) Figure 3 Step 020 in the DoH encrypted domain name service traffic classification method specifically includes the following:

[0076] Step 021: Perform missing feature deletion and normalization processing on the traffic features corresponding to the DoH encrypted domain name service traffic data to obtain the target traffic feature data corresponding to the DoH encrypted domain name service traffic data.

[0077] Specifically, normalization methods can include linear function normalization (Min-Max Scaling), zero-mean normalization (Z-Score Normalization), and Max-Min standardization (also known as deviation standardization).

[0078] Specifically, linear function normalization (Min-Max Scaling) maps the original data to the range [0,1] by applying a linear transformation. This method is suitable for cases where the values ​​are relatively concentrated, but if the maximum and minimum values ​​are unstable, the normalization result will also be unstable.12 Zero-mean normalization (Z-Score Normalization) maps the original data to a distribution with a mean of 0 and a standard deviation of 1. Max-Min standardization maps the eigenvalues ​​to the range [0,1].

[0079] To further illustrate the above embodiments, this application also provides an application example of a DoH encrypted domain name service traffic classification method, relating to the field of malicious classification and detection technology. Given the problems of numerous feature dimensions and high computational burden in general DoH encrypted domain name service traffic classification methods, this application improves the TSVD (Truncated Singular Value Decomposition) dimensionality reduction method by analyzing the information entropy characteristics of the traffic. It retains the more information-rich parts of the traffic features as feature weights for dimensionality reduction decomposition, reducing the impact of feature values ​​with less information on parameter estimation, generating a matrix of specified dimensions, and finally obtaining dimensionality-reduced data features carrying feature importance information. This significantly improves detection efficiency while maintaining data integrity, saving overall model computation time and improving efficiency, while also preventing data overfitting and improving service classification accuracy.

[0080] Based on this, the DoH encrypted domain name service traffic classification method provided in this application example specifically includes the following:

[0081] S1: Obtain DoH encrypted domain name service traffic data and extract traffic characteristics.

[0082] Specifically, raw traffic data packet files are collected from the deployed device environment. The pcapng files in the data packets are parsed using tools such as the command-line version of Wireshark and the Linux command line to extract traffic features. The traffic features include source IP, destination IP, data packet length, and transmission time. The traffic features are formally represented as F = {f1, f2, ..., fT}, t = 1, 2, ..., T, where T is the total number of features and T is greater than 3.

[0083] S2: Preprocess the traffic characteristics, perform missing data processing and feature normalization processing to obtain the target traffic characteristic data.

[0084] Specifically, the datasets with missing features in each dataset corresponding to the traffic features are deleted to obtain new datasets corresponding to the traffic features. At the same time, feature normalization is performed on each set of features in the new dataset.

[0085] S3: Perform TSVD truncation singular value decomposition on the preprocessed target traffic feature data, and combine feature importance with the TSVD calculation formula to achieve feature dimensionality reduction, thereby obtaining dimensionality-reduced traffic feature data.

[0086] Specifically, improving the TSVD decomposition method by incorporating feature importance metrics to achieve dimensionality reduction of traffic features includes:

[0087] First, the importance of the target traffic feature data Fz is calculated based on the magnitude of the information entropy value. Then, the information entropy is calculated for each dimension of the target traffic feature data Fz. The information entropy value of the i-th dimension feature Fi is:

[0088]

[0089] n represents the number of observations, and Fij represents the j-th dimension value of the i-th dimension feature Fi.

[0090] Secondly, singular value decomposition is performed on the target traffic feature data Fz. Given an m×n dimension traffic feature matrix Fz, the SVD formula for matrix Z is defined as Z = CKV. T , where C∈R m×m ,K∈R m×n All elements except those on the main diagonal are 0, and the elements on the main diagonal are singular values.

[0091] C T C = CC T =I m V T V = VV T =I n

[0092] Let Y = Z T Z, Y∈R n×n After eigenvalue decomposition, n eigenvalues ​​and their corresponding eigenvectors v are obtained, satisfying the formula Yv i =λ i v i .

[0093] Let X = ZZ T , X∈R m×m We obtain m eigenvalues ​​and their corresponding eigenvectors u, satisfying (ZZ) T )u i =λ i u i .

[0094] Finally, TSVD is improved by incorporating feature importance metrics. The top 80% of feature dimensions with the highest information entropy values ​​in the information entropy matrix are retained to obtain the corresponding optimized information entropy matrix. This optimized information entropy matrix is ​​then weighted and combined with the singular value decomposition results and normalized to obtain the dimensionality-reduced traffic feature matrix X carrying feature importance information.

[0095]

[0096] Where p = 80%, N is the total number of samples, and the updated feature dataset is E1, with dimensions u×v.

[0097] S4: Input the dimensionality-reduced traffic feature matrix X corresponding to the DoH encrypted domain name service traffic data into the classifier so that the classifier outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data.

[0098] Specifically, the dimensionality-reduced and optimized labeled traffic data features are input into the general machine learning classifier xgboost, and the output traffic labeling results are used to classify non-DoH traffic, DoH traffic, benign DoH traffic and malicious DoH traffic.

[0099] In other words, this application example provides a method for DoH traffic detection based on machine learning, and incorporates feature dimensionality reduction during the DoH detection process. Furthermore, this application example refines the dimensionality reduction process using a specific computational method. Compared to existing dimensionality reduction methods that do not consider the importance of pre-defined features, suffer from high computational costs, and may retain the optimal representation feature while losing the optimal discriminative feature, this application example can pre-determine the optimal discriminative feature (features with high information entropy) based on information entropy.

[0100] From a software perspective, this application also provides an apparatus for performing all or part of the DoH encrypted domain name service traffic classification method, see [link to relevant documentation]. Figure 4 The DoH encrypted domain name service traffic classification device specifically includes the following components:

[0101] The feature dimensionality reduction module 10 is used to perform dimensionality reduction processing on the target traffic feature data corresponding to the DoH encrypted domain name service traffic data to obtain the dimensionality-reduced traffic feature data corresponding to the target traffic feature data.

[0102] The traffic classification module 20 is used to input the dimensionality-reduced traffic feature data into a preset machine learning model for classifying DoH encrypted domain name service traffic, so that the machine learning model outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data.

[0103] The embodiments of the DoH encrypted domain name service traffic classification device provided in this application can be used to execute the processing flow of the DoH encrypted domain name service traffic classification method embodiments described above. Its functions will not be repeated here, but can be referred to the detailed description of the DoH encrypted domain name service traffic classification method embodiments described above.

[0104] The DoH encrypted domain name service traffic classification device can perform the DoH encrypted domain name service traffic classification function either on the server or on the client device. The choice can be made based on the processing capabilities of the client device and the limitations of the user's usage scenario. This application does not impose any limitations in this regard. If all operations are performed on the client device, the client device may further include a processor for the specific processing of DoH encrypted domain name service traffic classification.

[0105] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0106] The server and the client device can communicate using any suitable network protocol, including those not yet developed as of the date of this application. Such network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Furthermore, such network protocols may also include RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer Protocol) protocols used on top of the aforementioned protocols.

[0107] As can be seen from the above description, the DoH encrypted domain name service traffic classification device provided in this application embodiment can retain more information in the traffic features as feature weight dimensionality reduction decomposition, reduce the impact of feature values ​​with smaller information on parameter estimation, effectively reduce the computational resource consumption of the DoH encrypted domain name service traffic classification process, and significantly improve detection efficiency while maintaining data integrity. On the one hand, it saves the overall running calculation time of the model and improves efficiency; on the other hand, it prevents data overfitting and improves service classification accuracy. Thus, while ensuring the reliability and accuracy of DoH encrypted domain name service traffic classification results, it can effectively improve the efficiency of DoH encrypted domain name service traffic classification, thereby improving the security of DoH encrypted domain name services.

[0108] This application also provides an electronic device, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the DoH encrypted domain name service traffic classification method mentioned in the above embodiments. The processor and memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and memory via wired or wireless means.

[0109] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0110] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the DoH encrypted domain name service traffic classification method in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the DoH encrypted domain name service traffic classification method in the above method embodiments.

[0111] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0112] The one or more modules are stored in the memory, and when executed by the processor, the DoH encrypted domain name service traffic classification method in the implementation embodiment is executed.

[0113] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0114] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0115] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0116] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned DoH encrypted domain name service traffic classification method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0117] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the aforementioned DoH encrypted domain name service traffic classification method.

[0118] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0119] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0120] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0121] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for classifying traffic in DoH encrypted domain name service, characterized in that, include: Information entropy is calculated for each dimension of the target traffic feature data corresponding to the DoH encrypted domain name service traffic data to obtain an information entropy matrix composed of the information entropy values ​​corresponding to each dimension of the feature; the information entropy values ​​in the information entropy matrix are sorted from largest to smallest, and the first preset number of sorted information entropy values ​​are retained to obtain the corresponding optimized information entropy matrix, wherein the preset number is determined in advance based on the number and percentage threshold of each information entropy value in the information entropy matrix; and singular value decomposition is performed on the target traffic feature data based on the truncated singular value decomposition method to obtain the singular value decomposition result data of the target traffic feature data; the optimized information entropy matrix and the singular value decomposition result data are weighted and normalized to obtain the corresponding dimensionality-reduced traffic feature matrix, and the dimensionality-reduced traffic feature matrix is ​​used as the dimensionality-reduced traffic feature data corresponding to the target traffic feature data. The dimensionality-reduced traffic feature data is input into a preset machine learning model for classifying DoH encrypted domain name service traffic, so that the machine learning model outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data.

2. The DoH encrypted domain name service traffic classification method according to claim 1, characterized in that, The machine learning model includes: a classifier; The classifier includes: XGBoost, a gradient boosting decision tree.

3. The DoH encrypted domain name service traffic classification method according to claim 1, characterized in that, Before calculating the information entropy of each dimension of the target traffic feature data, the following steps are included: Feature extraction is performed on the currently collected DoH encrypted domain name service traffic data to obtain the traffic features corresponding to the DoH encrypted domain name service traffic data; The traffic characteristics corresponding to the DoH encrypted domain name service traffic data are preprocessed to obtain the target traffic characteristic data corresponding to the DoH encrypted domain name service traffic data.

4. The DoH encrypted domain name service traffic classification method according to claim 3, characterized in that, The step of extracting features from the currently collected DoH encrypted domain name service traffic data to obtain the traffic features corresponding to the DoH encrypted domain name service traffic data includes: The collected DoH encrypted domain name service traffic data is parsed using Wireshark software to extract the traffic characteristics corresponding to the DoH encrypted domain name service traffic data. The traffic characteristics include: source IP, destination IP, data length, and transmission time.

5. The DoH encrypted domain name service traffic classification method according to claim 3, characterized in that, The step of preprocessing the traffic features corresponding to the DoH encrypted domain name service traffic data to obtain the target traffic feature data corresponding to the DoH encrypted domain name service traffic data includes: Missing features are deleted and normalized on the traffic features corresponding to the DoH encrypted domain name service traffic data to obtain the target traffic feature data corresponding to the DoH encrypted domain name service traffic data.

6. A DoH encrypted domain name service traffic classification device, characterized in that, include: The feature dimensionality reduction module is used to calculate the information entropy of each dimension of the target traffic feature data corresponding to the DoH encrypted domain name service traffic data, so as to obtain an information entropy matrix composed of the information entropy values ​​corresponding to each dimension of the feature; sort the information entropy values ​​in the information entropy matrix from largest to smallest, and retain the first preset number of information entropy values ​​after sorting to obtain the corresponding optimized information entropy matrix, wherein the preset number is determined in advance based on the number and percentage threshold of each information entropy value in the information entropy matrix; and perform singular value decomposition on the target traffic feature data based on the truncated singular value decomposition method to obtain the singular value decomposition result data of the target traffic feature data; and perform weighted and normalized processing on the optimized information entropy matrix and the singular value decomposition result data to obtain the corresponding dimensionality-reduced traffic feature matrix, so as to use the dimensionality-reduced traffic feature matrix corresponding to the target traffic feature data. The traffic classification module is used to input the dimensionality-reduced traffic feature data into a preset machine learning model for classifying DoH encrypted domain name service traffic, so that the machine learning model outputs the traffic classification result data corresponding to the DoH encrypted domain name service traffic data.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the DoH encrypted domain name service traffic classification method as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the DoH encrypted domain name service traffic classification method as described in any one of claims 1 to 5.

Images