Network traffic countermeasure defense method based on heuristic ant colony optimization

Abstract

The present invention discloses a network traffic countermeasure defense method based on heuristic ant colony optimization, which belongs to the field of network security and privacy protection technology. The present invention designs an adaptive disturbance generation strategy based on the spatiotemporal characteristics of network traffic trajectories, establishes disturbance injection rules that meet real-time constraints and directional consistency, constructs an integrated substitution model, uses a feature fusion mechanism of spatial convolution, temporal loop and noise reduction coding, generates a traffic fingerprint recognition model with strong generalization ability, adopts an improved ant colony optimization algorithm to improve the disturbance search ability, and integrates a batch processing method and a universal patch scoring mechanism to improve the defense versatility of samples between different network traffic. The present invention can be directly applied to the black box scenario of real-time communication, does not require gradient information or white box access rights of the target model, and achieves an attack recognition suppression rate of over 90% when only increasing the bandwidth overhead by 20%, significantly improving the defense versatility and deployment feasibility, while reducing the disturbance overhead.

Description

Technical Field

[0001] The present invention relates to the technical field of website fingerprint attack defense in the network field, and in particular to a network traffic comparison defense method based on heuristic ant colony optimization. Background Art

[0002] In recent years, more and more people have begun using privacy-enhancing communication tools, such as The Onion Router (T), to combat the growing threat of online surveillance and censorship. Tor protects user privacy by establishing a three-node path between the user and the server. Along this path, fixed-size data packets (called cells) are encrypted and transmitted, making it impossible for any single node to simultaneously reveal the identities of both the user and the server. However, research has shown that local eavesdroppers can attempt to undermine privacy protections by launching website fingerprinting (WF) attacks.

[0003] Website fingerprinting attacks are a method of inferring sensitive information by analyzing encrypted traffic communication patterns. Early approaches relied on maintaining a fingerprint database to match the characteristics of encrypted traffic. While these fingerprint-based approaches achieved some success, the rapid growth of network traffic made maintaining such a large fingerprint database prohibitively expensive and led to a gradual decline in recognition effectiveness.

[0004] With the rise of machine learning technology, the focus of website fingerprinting attack methods has gradually shifted from building fingerprint libraries to training classifiers. These methods are mainly categorized into traditional machine learning and deep learning. Traditional machine learning methods typically extract features such as packet size, time series, and direction series from encrypted traffic. These raw features are then transformed into higher-level information using hand-crafted statistical features (such as mean and variance). This information is then fed into models such as support vector machines (SVMs) and Bayesian classifiers for training. Compared to earlier methods, this traditional machine learning-based recognition approach reduces the cost of maintaining large databases and improves recognition accuracy by adding high-level feature information. However, the model's recognition capabilities rely on hand-crafted feature information. If the feature extraction is poorly designed, recognition results will be significantly reduced. Furthermore, traditional machine learning models have limited learning capabilities.

[0005] In recent years, the development of deep learning technology has driven the further evolution of website fingerprinting attacks. Deep neural network (DNN) models can automatically extract high-level feature information directly from raw fingerprint features and establish a mapping relationship with website categories. Compared with traditional machine learning methods, deep learning methods do not require manual feature design and are more adaptable. Furthermore, as the model depth increases, deep learning models also perform better in terms of recognition accuracy and robustness against attacks. Based on this, Sirinam et al. found that website fingerprinting models primarily rely on directional information for recognition, and can achieve a recognition accuracy rate of 98% using this information. Therefore, most current DNN-based recognition models use directional information to model Tor traffic, including either direction sequence or burst sequence, and use it to analyze web page types.

[0006] Directional sequence modeling uses cells as the basic unit, where each cell represents the direction of data packet transmission. Red uplink packets are represented by +1, and green downlink packets are represented by -1. Burst sequence modeling uses bursts as the basic unit. One or more consecutive cells in the same direction are defined as a burst. The burst size is represented by the number of packets, with the positive or negative sign indicating the uplink or downlink direction.

[0007] Currently, the main challenges of introducing adversarial samples into the network field to combat network fingerprint attacks are as follows:

[0008] (1) Effective defense perturbations are difficult to generate in scenarios where the attack model is unknown (black-box scenarios). Currently, defense approaches in black-box scenarios mainly include three categories: regularization, heuristic algorithms, and generative adversarial networks. However, regularization algorithms have high overhead; heuristic algorithms are prone to falling into local extremes, resulting in unsatisfactory defense effects; and generative adversarial networks are prone to gradient vanishing when training on big data, resulting in perturbation failure. In addition, the current approach for black-box scenarios is to generate perturbations for a certain local alternative model and migrate them to other models. However, this approach is easily affected by the overfitting phenomenon of a single model, resulting in the perturbations being unable to be effectively applied to other attack models. Therefore, there is still a broad research space for generating efficient and highly transferable adversarial perturbations in black-box scenarios;

[0009] (2) Existing perturbation insertion schemes have deficiencies in terms of real-time and directional constraints, which limits their practicality. Most schemes use bursts as the basic unit of perturbation, but because of the indivisibility of bursts, defenders need to collect complete website traffic data before calculating and adding perturbations, which makes it difficult to meet the real-time response requirements of interactive websites. Although some schemes have designed methods based on packets or fixed time units to inject virtual packets to try to solve the real-time problem, they have not fully considered the directional constraints of network data packets. For example, when inserting virtual data packets to implement perturbation, if the direction of the inserted virtual data packet is inconsistent with the original traffic direction, it is necessary to artificially delay the burst to maintain the continuity of the transmission. However, this delay not only increases additional network overhead, but may also have a negative impact on user experience and system performance;

[0010] (3) Existing research has limitations in the versatility of perturbations, resulting in high overall overhead. Perturbation overhead includes not only the direct resource consumption of adding perturbations, but also the additional transmission and computational overhead caused by the perturbations. Currently, most perturbation methods are designed for specific websites or single traffic characteristics. Although they can improve the defense effect against a single target, in actual applications, network traffic is diverse. Customizing perturbations for each website or traffic is both impractical and incurs huge overhead. To this end, a universal perturbation method is needed that does not rely on specific traffic characteristics and can be applied to a wide range of network scenarios, thereby improving the applicability of perturbations in large-scale network flows. Summary of the Invention

[0011] To address the aforementioned shortcomings of the existing technology, the present invention proposes a network traffic adversarial defense method based on heuristic ant colony optimization. This method is an optimization algorithm constructed based on the ant colony algorithm in a black-box scenario, hence the name "Handling Ants Against Adversarial Adversaries" (HAAD). Based on an integrated substitution model, the present invention improves perturbation migration capabilities and perturbation effectiveness in black-box scenarios. It also improves the ant colony algorithm with multi-agent collaboration capabilities, enhancing the search capability for optimal perturbation solutions and generating more effective perturbations. The present invention also proposes a directional constraint mechanism to ensure network flow integrity, meeting directional constraints and perturbation real-time requirements. Using the TopK universal perturbation algorithm, a patch scoring mechanism is designed to evaluate and select the universal performance of patches, namely, the insertion position and number of data packets. A TopK selection mechanism is then used to select the K patches with the highest scores, improving the universality of the perturbation.

[0012] The specific technical solutions of the present invention are as follows:

[0013] The present invention provides a network traffic countermeasure defense method based on heuristic ant colony optimization, comprising the following steps:

[0014] Step S1: Construct a network traffic spatiotemporal disturbance constraint system: define the spatiotemporal characteristics of the original traffic trajectory through the directional sequence modeling paradigm, and establish disturbance injection rules that meet real-time constraints and directional consistency;

[0015] Step S2: Training the ensemble replacement model: Build a deep neural network architecture for multi-feature extraction, and generate a traffic fingerprint recognition model with strong generalization capabilities through the feature fusion mechanism of spatial convolution, temporal loop and noise reduction coding;

[0016] Step S3: Generate an adaptive adversarial perturbation vector: Based on the improved ant colony optimization algorithm, patches are selected through a pheromone probability selection strategy and a roulette wheel selection mechanism to construct a dynamic perturbation vector, and the pheromone is updated to achieve dynamic optimization of the virtual data packet defense capability.

[0017] Step S4: Implement a universal perturbation migration strategy: Use a batch processing method combined with a patch scoring mechanism based on defense success rate to improve the defense universality of the sample across different network traffic.

[0018] Preferably, the specific method of step S1 includes:

[0019] S11. Direction sequence modeling paradigm construction: The direction of network traffic packets is encoded as a discrete numerical sequence, where client-to-server packets are marked as +1 and server-to-client packets are marked as -1, thereby defining the spatiotemporal characteristics of the original traffic trajectory;

[0020] S12, direction consistency rule establishment: constrain the direction of inserted virtual data packets to be synchronized with the original traffic direction to avoid conflicting packets causing transmission delays;

[0021] S13. Real-time constraint establishment: Define a perturbation rule vector consisting of multiple patches, each of which is represented by (p, η), where p identifies the virtual data packet insertion position and η quantifies the number of insertions. The perturbation rule vector is used to insert virtual data packets at the target position. There is no need to wait for the complete network stream transmission to be completed. Perturbations can be added by simply completing the insertion operation at the corresponding position, thereby meeting the real-time constraint requirements.

[0022] Preferably, the virtual data packet in S13 is an empty packet sent by the client or server, or a copy of a previously sent data packet.

[0023] Furthermore, the input form of the network traffic spatiotemporal disturbance constraint system in step S1 is a defined direction sequence modeling paradigm;

[0024] Furthermore, the virtual data packet in step S13 of step S1 is implemented in the P4 switch;

[0025] Preferably, the specific method of step S2 includes:

[0026] S21. Build a deep neural network architecture: By integrating the Var-CNN spatial convolution model, the LSTM temporal recurrent model, and the SDAE denoising encoding model, spatial features, temporal features, and denoising features are extracted and generated respectively;

[0027] S22. Design a feature fusion mechanism and generate a recognition model: Adopt a fully connected weighted feature fusion method to adaptively adjust the weights of different features and generate a traffic fingerprint recognition model with synergistically enhanced feature fusion capabilities and model decision-making capabilities.

[0028] Furthermore, the Var-CNN model in the integrated alternative model described in step S2 is an architecture based on the convolutional neural network (CNN) framework and has leading attack performance, while the LSTM and SDAE models are based on the models described in Rimmer's paper;

[0029] Furthermore, the Var-CNN in the integrated substitution model described in step S2 can extract spatial features from spatial information through convolution, LSTM extracts temporal features from sequence data using a three-gate design, and SDAE reconstructs samples and extracts effective denoising features in the encoding layer.

[0030] Furthermore, the ensemble surrogate model described in step S2, by integrating features from three different types of models, can classify samples from multiple dimensions, thereby producing more accurate results. When generating effective perturbations specifically for the ensemble model, the generated perturbations can directly affect multiple effective features of the input samples, thereby improving the transferability of the perturbations.

[0031] Furthermore, the specific operations of the feature fusion mechanism in step S2 include: weighted fusion of the output features of each basic model; aggregating the fused features through a fully connected layer; and outputting a final classification decision based on the aggregation result.

[0032] Preferably, the specific method of step S3 includes:

[0033] S31, Patch probability calculation: Calculate the probability of each patch being selected based on the pheromone concentration level;

[0034] S32, patch selection: Based on the pheromone concentration and local defense effect, a roulette wheel selection mechanism is applied to select patches, retaining the random characteristics of the selection process and combining them to construct a dynamic perturbation vector δ;

[0035] S33, patch injection: mapping the dynamic disturbance vector δ to the original traffic trajectory according to the disturbance injection rule generated in step S1 to form a disturbed network traffic trajectory;

[0036] S34, Pheromone Update: Input the disturbed network traffic trajectory into the integrated substitution model, update the pheromone concentration without gradient based on the successful defense results, and guide the iterative optimization of the subsequent patch search direction.

[0037] Preferably, the patch probability calculation process includes: converting the task of searching for disturbances into a process of searching for different patches in the disturbances; quantifying and recording the global defense effectiveness of each patch by pheromone concentration; and providing convergence direction guidance when the ant agent performs local patch search to enhance the stability of the defense strategy.

[0038] Preferably, the specific method of selecting patches using the roulette wheel selection mechanism includes: calculating the cumulative value of the probability of each patch as the cumulative probability; generating a uniformly distributed random number in [0,1]; traversing the patch list, and when it is detected that the cumulative probability of a patch exceeds the random number for the first time, selecting the patch as the i-th element and adding it to the dynamic perturbation vector; and executing the loop until a total of Q patches are selected to form a complete dynamic perturbation vector.

[0039] Preferably, the pheromone is a global pheromone, which is obtained by averaging the sum of the pheromones of all ant agents.

[0040] Furthermore, the patch probability calculation in step S31 of step S3 ensures that the search process meets two necessary conditions: first, sufficient randomness must exist to avoid local extremes; second, the search must be guided by a directional strategy, otherwise inconsistent results will occur. To meet these two requirements, we transform the task of finding perturbations into a search for different patches in the perturbation space. During this process, pheromones are used to record the global defensive effects of the patches. This mechanism provides clear guidance to the ant agents as they conduct local searches, thereby ensuring more stable defensive results.

[0041] Moreover, multiple ant agents are combined with the roulette method to explore different patches. Compared with the single-agent method, this group exploration method not only ensures sufficient randomness, but also expands the exploration space through collaborative search. This design can not only effectively avoid falling into local optimal solutions, but also significantly improve the search efficiency and the reliability of the defense strategy.

[0042] Furthermore, in the patch probability calculation process of step S31 in step S3, in order to search for patches with good defense effects, it is necessary to calculate the search probability of each possible patch. The probability calculation of each ant's search process is described by the following formula:

[0043] ;

[0044] in, Indicates that the selected value is The probability of a patch with ρ(where p is the injection position and η is the number of injected packets); Representation and patch Related pheromones (all pheromone values are initialized to 1 to ensure that the search directions of all patches are equal during the initial search); N represents the maximum number of injected data packets; α represents the weight control parameter of pheromone; β represents the weight control parameter of the number of inserted data packets; M represents the maximum insertion position of the data packet;

[0045] This probability formula shows that for a given patch, the algorithm will give priority to patches with higher pheromone concentrations and fewer data packet injections. This preference mechanism will significantly increase the probability of the patch being selected. Therefore, the search direction is more likely to converge towards the current dominant patch, making the subsequent selection process more instructive and effective.

[0046] Furthermore, the patch selection mechanism (S32) in step S3 is designed to introduce randomness into the search results to avoid falling into local extremes. After accurately calculating the probability of each patch, a roulette-wheel-based selection strategy is used to construct the perturbation vector: first, the cumulative probability of each patch is accurately calculated; second, a random number uniformly distributed in the interval [0, 1] is generated; when the cumulative probability of a patch exceeds this random number for the first time, the patch is selected and added to the perturbation vector as the i-th element; the above process is repeated until Q patches are selected, thereby completing the construction of the entire perturbation vector.

[0047] The patch selection mechanism based on cumulative probability is highly efficient, avoiding the high computational complexity and complex evaluation process of traditional exhaustive search, and significantly reducing computational overhead. At the same time, the built-in randomness mechanism enables the perturbation vector to explore a wider range of possible solution spaces, effectively preventing the search process from falling into local optimal solutions, and improving the robustness and execution efficiency of the overall solution by enhancing the diversity of solutions.

[0048] Furthermore, after completing a disturbance injection, the pheromone update in step S34 in step S3 needs to evaluate all patches in the current disturbance to update the pheromone and guide the subsequent ant search direction. The specific pheromone update formula is as follows:

[0049] ;

[0050] Where, Represents a batch of data containing multiple samples x. Function The current disturbance Applicable to . No. The number of misclassified samples in the prediction results of ants is recorded as , is obtained by using the L0 norm Calculated by comparing the prediction results with the original labels;

[0051] ;

[0052] Where, Indicates the The pheromone of the ant, is the decay rate of the previous pheromone. The formula shows that the greater the number of misclassified samples, the higher the pheromone concentration; therefore, future ants are more likely to explore stronger defense patches in this direction.

[0053] Since the pheromone of a single ant cannot provide meaningful guidance, the global pheromone should reflect the sum of the pheromones of all ants; the global pheromone is calculated as follows:

[0054] ;

[0055] In the formula, for all The pheromones of the ants are averaged to obtain the new global pheromone The updated global pheromone will guide the ants to determine the next disturbance.

[0056] Preferably, the specific method of step S4 includes:

[0057] S41. Batch processing: A batch processing mechanism is used to synchronously process multiple raw traffic traces. By combining different input samples into the same batch, the algorithm can cover a wider data distribution in each iteration.

[0058] S42. Universality Scoring Mechanism: A patch scoring mechanism is introduced after the batch processing step. The universality score is calculated based on the defense success rate of the candidate patch in the current batch. Patches with high scores indicate excellent defense performance or stable performance across multiple batches of defense, indicating strong universality.

[0059] S43, TopK selection mechanism: Improve the universality of perturbation by screening the K patches with the highest scores.

[0060] Furthermore, the batch processing in step S4 integrates a batch processing mechanism into the HAAD algorithm, allowing multiple traffic trajectories to be processed simultaneously during each disturbance generation process. This operation reduces the algorithmic overhead of processing only a single trajectory at a time and improves the versatility of the generated disturbances. In addition, aggregating different input samples into a batch allows the algorithm to access a wider data distribution at each iteration. Therefore, the ant-based optimization process can more effectively access global data patterns, reduce sensitivity to abnormal inputs, and enhance the stability of the learning process.

[0061] Furthermore, the universality scoring in step S4 introduces a patch scoring mechanism based on the defense success rate after batch processing to improve the universality of the generated perturbations. Specifically, the defense effect of each candidate patch is evaluated by calculating its success rate in the current batch. The higher the score, the better the defense performance of the patch in the batch, or the more frequently it appears in multiple batches, showing stronger universality. This scoring method can effectively improve the universality of the evaluated patches. Finally, the multiple patches with the highest scores are selected to form the final universal perturbation vector.

[0062] Furthermore, the patch scoring mechanism based on the defense success rate in step S4 is implemented by constructing a perturbation unit effectiveness evaluation function.

[0063] Furthermore, the patch scoring mechanism described in step S4 is implemented through the TopK universal perturbation algorithm, which evaluates and selects the universal performance of patches, i.e., the insertion position and number of data packets, and uses the TopK selection mechanism to select the K patches with the highest scores to improve the universality of the perturbation.

[0064] The present invention also provides an application based on the traffic countermeasure defense method, which deploys the method to a P4 switch and conducts testing in a Tor network environment for use in a network security defense platform.

[0065] Furthermore, to verify the deployability of the defense method, it was implemented on the P4 platform and tested in the Tor network environment. The experimental results show that the defense method can achieve nearly 90% defense effectiveness with only 20% network overhead.

[0066] The beneficial technical effects of the present invention are:

[0067] (1) In order to solve the difficulty of perturbation generation in black box scenarios, the present invention proposes an adversarial ant heuristic algorithm based on an integrated substitution model. First, a substitution model integrating multiple recognition models is constructed, and then an improved adversarial ant algorithm based on an ant colony algorithm is applied to the substitution model for solution. Each ant maintains a perturbation solution based on a shared pheromone table, and collects feedback information of the perturbation solution in each iteration to update the public pheromone, thereby guiding the next solution. Through this method, each solution can perform a global search based on shared information, while using the local information emitted by a single ant solution space to ensure local optimality. It not only avoids the problem of traditional heuristic algorithms falling into local extreme values, but also effectively solves the problem of perturbation generation in black box scenarios;

[0068] (2) To maintain the directional constraints and real-time performance of network flows, the present invention improves the perturbation insertion scheme and proposes a directional constraint mechanism. By generating a perturbation sequence to guide the insertion position and number of virtual packets, the perturbation can be completed without waiting for the complete data packet sequence to be loaded, thus meeting the real-time requirements. To ensure that the network flow remains intact after the perturbation is added, a constraint function is used to stipulate that the insertion direction of each packet must be consistent with the direction of the previous packet, thereby ensuring that the complete network flow burst is not split and avoiding the generation of additional network overhead;

[0069] (3) To solve the overhead problem caused by the lack of universality of perturbations in existing research, this paper proposes a universal perturbation algorithm. The algorithm uses a topk scoring mechanism to screen universal perturbations that are effective for all network flows. In each iteration, a weighted score is calculated for each ant's perturbation sequence insertion point to evaluate its perturbation effect on the current traffic. At the same time, the number of packets at the same insertion position is selected with a certain probability. After all sample iterations are completed, the k insertion positions with the highest scores and the current number of inserted packets are selected as universal perturbations, thereby solving the problem of insufficient universality of perturbations in existing research. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 This is a flow chart of the network traffic countermeasure defense method based on heuristic ant colony optimization proposed by the present invention;

[0071] Figure 2 This is a flow chart of the disturbance generation algorithm proposed in the present invention;

[0072] Figure 3 This is a flow chart of the generalized perturbation algorithm proposed in this invention. DETAILED DESCRIPTION

[0073] The present invention is described in detail below with reference to the accompanying drawings and embodiments. It is apparent that the embodiments described are only a portion of the embodiments of the present invention, rather than all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0074] Example 1:

[0075] This embodiment provides a network traffic defense method based on heuristic ant colony optimization. The specific process is as follows: Figure 1 As shown, the following steps are included:

[0076] Step S1: Construct a network traffic spatiotemporal disturbance constraint system: define the spatiotemporal characteristics of the original traffic trajectory through the directional sequence modeling paradigm, and establish disturbance injection rules that meet real-time constraints and directional consistency;

[0077] Directional sequence modeling paradigm construction: The direction of network traffic packets is encoded as a discrete numerical sequence, where client-to-server packets are marked as +1 and server-to-client packets are marked as -1, thereby defining the spatiotemporal characteristics of the original traffic trajectory;

[0078] Establishment of directional consistency rules: The direction of inserted virtual data packets is constrained to be synchronized with the original traffic direction to avoid conflicting packets that cause transmission delays;

[0079] Real-time constraint establishment: A perturbation rule vector is defined as consisting of multiple patches. Each patch is represented by (p, η), where p identifies the virtual packet insertion position and η quantifies the number of insertions. The perturbation rule vector is used to insert virtual packets at the target location. There is no need to wait for the entire network stream to be transmitted. Perturbations can be added by simply completing the insertion operation at the corresponding location, thereby meeting the real-time constraint requirements.

[0080] In this embodiment, the specific implementation steps include:

[0081] (1) Obtain the original network stream;

[0082] (2) Encoding network flows in a directional sequence modeling paradigm;

[0083] (3) Generate a universal perturbation through the defense algorithm (subsequent steps will calculate the universal perturbation by applying the directional consistency rule. The generated perturbation is a vector composed of patches described in the real-time constraint);

[0084] (4) Deploy the general perturbation to the P4 switch and perform packet forwarding based on real-time constraints and directional consistency rules. The specific implementation includes:

[0085] Maintain the forwarding table and packet counter; when the counter value matches the patch insertion position, trigger the insertion of the virtual packet operation and repeat the forwarding of the previous packet. This packet-level transmission mechanism avoids the waiting delay of sending packets after the complete network flow transmission is completed. At the same time, it inherits the transmission direction of the previous packet to maintain the principle of directional consistency, and finally completes the instant forwarding to realize the packet processing method with zero additional delay.

[0086] Spatiotemporal features include time features and space features: time features, for example, the direction sequence generally starts with [+1, -1, +1], which indicates the order of data packet sending, the client's request first, and the server's response later. There is a time dependency between the data packets, and the order of data packets from different websites is different, which constitutes the time feature; spatial features, for example, a lot of -1 appear continuously in a certain stream sequence, indicating that this sequence is likely related to video network applications, because similar to video streaming, a large number of data packets need to be transmitted from the server to return data. Similarly, the continuous appearance of many +1s may be related to network applications for database queries because many requests need to be sent. From this, it can be seen that the number of continuous data packets in the same direction can also reflect the usage differences of different applications, and also constitute the spatial features of different applications.

[0087] This perturbation addition method is convenient for deployment on P4 switches. To prevent network identifiers from modeling network traffic based on this directional sequence and then using network traffic analysis techniques to monitor the network, this method is used for defense. Specifically, the defense measure involves adding dummy packets to this type of input to perform perturbation defense.

[0088] Step S2: Training the ensemble replacement model: Build a deep neural network architecture for multi-feature extraction, and generate a traffic fingerprint recognition model with strong generalization capabilities through the feature fusion mechanism of spatial convolution, temporal loop and noise reduction coding;

[0089] Build a deep neural network architecture: By integrating the Var-CNN spatial convolution model, the LSTM temporal recurrent model, and the SDAE denoising encoding model, spatial features, temporal features, and denoising features are extracted and generated respectively;

[0090] Design a feature fusion mechanism and generate a recognition model: Adopt a fully connected weighted feature fusion method to adaptively adjust the weights of different features and generate a traffic fingerprint recognition model with synergistically enhanced feature fusion capabilities and model decision-making capabilities.

[0091] In this embodiment, a fully connected integration approach is adopted to achieve weighted fusion of the output results of each model, combining the different feature extraction capabilities of each model and their complementary output results to form an integrated model decision with significantly enhanced robustness; among which, the distribution of weights is automatically achieved through the backpropagation mechanism in the neural network training process.

[0092] Network traffic characteristics are analogous to the unique identification properties of biological fingerprints. Direction information, as a component of traffic fingerprints, has individual differentiation capabilities similar to fingerprints. Although a complete traffic fingerprint should include multi-dimensional features such as protocol, timing, and operating system, this model focuses on direction information, a key fingerprint feature subset, for identification. Therefore, the model finally generated in this step is defined as a "traffic fingerprint recognition model."

[0093] Step S3: Generate an adaptive adversarial perturbation vector: Based on the improved ant colony optimization algorithm, patches are selected through a pheromone probability selection strategy and a roulette wheel selection mechanism to construct a dynamic perturbation vector, and the pheromone is updated to achieve dynamic optimization of the virtual data packet defense capability.

[0094] Patch probability calculation: Calculate the probability of each patch being selected based on the pheromone concentration level;

[0095] Patch selection: Based on the pheromone concentration and local defense effect, a roulette wheel selection mechanism is applied to select patches, retaining the random characteristics of the selection process and combining them to construct a dynamic perturbation vector δ;

[0096] Patch injection: Map the dynamic perturbation vector δ to the original traffic trajectory according to the perturbation injection rule generated in step S1 to form a perturbed network traffic trajectory;

[0097] Pheromone update: The perturbed network traffic trajectory is input into the integrated substitution model, and the pheromone concentration is updated without gradient based on the successful defense results, guiding the iterative optimization of the subsequent patch search direction.

[0098] Step S4: Implement a generalized perturbation migration strategy: Improve the defense capability of adversarial samples across different network traffic flows through batch processing combined with a patch scoring mechanism based on defense success rate.

[0099] Batch processing: A batch processing mechanism is used to synchronously process multiple raw traffic traces. By combining different input samples into the same batch, the algorithm can cover a wider data distribution in each iteration.

[0100] Universality Scoring Mechanism: A patch scoring mechanism is introduced after the batch processing step. The universality score is calculated based on the defense success rate of the candidate patch in the current batch. Patches with high scores indicate excellent defense performance or stable performance across multiple batches of defense, indicating strong universality.

[0101] TopK selection mechanism: Improves the universality of perturbations by screening the K patches with the highest scores.

[0102] The batch processing method of this invention uses an ant colony algorithm to generate universal perturbations for batches of data, enabling a single perturbation to be applied to the entire batch. This approach aims to improve the perturbation's universality, rather than generating a specific perturbation specifically for a single data set. Because direct application to an entire dataset would result in the generated universal perturbation becoming overly dependent on a specific dataset (i.e., effective for that dataset but ineffective for other similar datasets), a batch processing mechanism is employed. The results of each batch are recorded, and ultimately, an evaluation function is used to select valid patch units and combine them to form a universal perturbation.

[0103] Example 2:

[0104] This embodiment provides a heuristic ant colony defense method based on an integrated substitution model. The specific process is as follows: Figure 2 As shown in Figure 2, the construction of a disturbance generation framework based on the improved ant colony optimization algorithm includes the following steps:

[0105] Step S31: Patch probability calculation: The ants calculate the probability of each patch being selected based on the pheromone concentration level.

[0106] In this embodiment, the search process meets two necessary conditions: first, it must be sufficiently random to escape local extrema; second, the search requires a directional strategy to guide it; otherwise, the final results may be inconsistent. To meet these two requirements, we transform the task of finding perturbations into a search for different patches within the perturbations. During this process, we use pheromones to record the global defensive effectiveness of these patches. This provides clear guidance for the local search of numerous "ant" agents, resulting in more stable defensive results. Furthermore, we employ a roulette wheel method with multiple agents (ants) to explore different patches. Compared to single-agent approaches, this exploration approach not only ensures sufficient randomness but also provides a broader search space, effectively preventing the search from becoming trapped in local optima, significantly improving search efficiency and the reliability of the defense strategy.

[0107] In order to search for patches with good defensive effects, we need to calculate the search probability of each possible patch. The probability calculation of each ant's search process is described by the following formula:

[0108] ;

[0109] in, Indicates that the selected value is The probability of a patch with η being injected is η(where p is the injection position and η is the number of injected packets). Representation and patch The relevant pheromone values are initialized to 1 to ensure that all patches are searched in the same direction during the initial search. N represents the maximum number of injected packets. α is the weight control parameter for the pheromone. β is the weight control parameter for the number of inserted packets. M represents the maximum insertion position for a packet (for example, if the trace length is 200, the maximum insertion position is 199). This probability formula indicates that for a given patch, we prefer a higher pheromone concentration and fewer injected packets, which increases the probability range for selecting that patch. Therefore, the search direction is more likely to converge towards the current patch, making the subsequent selection process more instructive and effective.

[0110] Step S32: Patch selection: Based on the pheromone concentration and the current local defense effect, patches are selected in a probabilistic manner; the selected patches are combined to form a disturbance vector .

[0111] In this embodiment, to introduce randomness into the search results and avoid getting stuck in local minima, a roulette-wheel-based selection strategy is introduced to select patches for constructing the perturbation vector after precisely determining the probability of each patch. First, the cumulative probability of each patch is accurately calculated. Then, a random number uniformly distributed in the interval [0, 1] is generated. The first patch whose cumulative probability exceeds this random value is selected and added as the i-th element in the perturbation vector. This operation is repeated until Q patches have been selected, completing the construction of the perturbation vector. The cumulative probability-based patch selection mechanism is highly efficient. It cleverly avoids the computationally intensive exhaustive search and complex evaluation, thereby reducing computational overhead. Furthermore, its inherent randomness enables the perturbation vector construction to explore a wider range of possibilities. This expands the search space, effectively preventing regression into local optimal solutions, and enhancing the robustness and effectiveness of the overall solution.

[0112] Step S33 patch injection: inject this disturbance vector Injected into the original traffic trace according to certain rules.

[0113] In this embodiment, the perturbation vector is injected into the original traffic trajectory according to the perturbation injection rules described in step S1. Although there is a temporal order in the transmission of data packets, the perturbation has little impact on the timing because the perturbation injection rules established by this method satisfy the principle of directional consistency. Step S1 not only captures temporal features but also spatial features. The introduction of a large number of virtual data packets changes the size of the burst (the number of consecutive data packets with the same direction) and alters spatial relationships. For example, TCP packets that originally did not need to be retransmitted exhibit a high-frequency retransmission pattern after the introduction of virtual data packets, deceiving attackers. Because this method achieves the coordinated capture of temporal and spatial features, the effectiveness of subsequent defense mechanisms is enhanced in both traffic trajectory disguise and attacker misleading.

[0114] Step S34: Pheromone update: The disturbed network traffic trajectory is input into the integrated model, and then the results of the integrated model are used to update the pheromone, and then the next round of calculation begins.

[0115] In this embodiment, after completing a disturbance injection, we need to evaluate all patches in the current disturbance in order to update the pheromone and guide the subsequent ant search direction. The specific pheromone update formula is given by the following formula:

[0116] ;

[0117] In the formula, Represents a batch of data containing multiple samples x. Function The current disturbance Applicable to . No. The number of misclassified samples in the prediction results of ants is recorded as , is obtained by using the L0 norm Calculated by comparing the prediction results with the original labels;

[0118] ;

[0119] In the formula, Indicates the The pheromone of the ant, is the decay rate of the previous pheromone. The formula shows that the greater the number of misclassified samples, the higher the pheromone concentration. Therefore, future ants are more likely to explore stronger defensive patches in this direction;

[0120] , since the pheromone of a single ant cannot provide meaningful guidance, the global pheromone should reflect the sum of the pheromones of all ants. Therefore, in the formula, we The pheromones of the ants are averaged to obtain the new global pheromone This global pheromone will then guide the ants in determining the next perturbation.

[0121] The experimental platform is equipped with an NVIDIA GeForce RTX 4090 GPU, 32GB of memory, and Linux 11. The development framework uses Python version 3.7 and PyTorch version 2.0. In the experiment, defense tests were conducted on six types of DNN models using the Rimmer100 and Sirinam datasets, and compared with four types of defense algorithms.

[0122] Website fingerprinting (WF) attacks are essentially a multi-classification problem that relies on deep neural network (DNN) models. Therefore, in our experimental evaluation, we use recall, precision, and F1-score as key metrics to measure experimental results and evaluate model performance. These metrics are defined as follows:

[0123] Recall: Recall measures the model’s ability to correctly identify all relevant samples.

[0124] Precision: Precision indicates the proportion of correctly predicted positive samples among all samples predicted as positive examples.

[0125] Weighted F1 Score: The F1 score is the harmonic mean of recall and precision, balancing these two metrics. Weighted F1 takes into account the class distribution and can more accurately evaluate the performance of our attacker's deep neural network model.

[0126] Table 1 Network fingerprint attack results based on DNN model:

[0127]

[0128] In Table 1, the first column represents different datasets; the second column represents various evaluation metrics, where Rec represents recall, Pre represents precision, and F1 represents weighted F1 score; the first row represents various deep neural network (DNN) models, where CNN represents convolutional neural network, LSTM represents long short-term memory neural network, SDAE represents stacked denoising autoencoder, VarCNN represents a semi-automated network feature extraction attack method based on deep learning, DF stands for Deep Fingerprinting and is a deep fingerprint neural network, and Ensemble represents an integrated model based on Var-CNN, LSTM, and SDAE proposed in this paper. From the results, we draw the following conclusions:

[0129] (1) The ensemble model (Ensemble) shows significant attack advantages in all evaluation indicators. For the Rimmer100 dataset, the recall rate (Rec), precision rate (Pre) and F1 score (F1) of the ensemble model reached 0.978, 0.984 and 0.979 respectively, which is better than the second-ranked DF model (0.976, 0.982, 0.976). Similarly, for the Sirinam dataset, these values reached 0.913, 0.934 and 0.912 respectively, which also exceeded the second-ranked DF model (0.906, 0.928, 0.905). Compared with the worst-performing convolutional neural network (CNN) model on the Rimmer100 dataset, the ensemble model recognized 14.02% more actual positive samples, and on the Sirinam dataset, it recognized 17.2% more actual positive samples. These significant improvements can be attributed to the fact that the integration of multiple models effectively overcomes the limitations of individual models in feature extraction, classification decision-making, etc., thereby improving performance;

[0130] (2) The ensemble model exhibits stable and reliable performance on both datasets. For the Rimmer100 dataset, the recall is 0.978, the precision is 0.984, and the F1 score is 0.979. These values are very close, indicating consistent performance across different evaluation metrics. Similarly, for the Sirinam dataset, the recall is 0.913, the precision is 0.934, and the F1 score is 0.912. This stability in performance can be attributed to the ensemble model’s ability to balance various aspects of classification, thereby providing reliable results across different application scenarios.

[0131] Table 2 Black box defense results based on the integrated model:

[0132]

[0133] From Table 2 we can see that:

[0134] (1) HAAD (Heuristic Ant Algorithm Defense) can effectively degrade the performance of deep neural networks (DNNs) in black-box scenarios. Our method reduces the performance of ensemble models by more than 90% on multiple datasets. This demonstrates that our method has strong defense capabilities, even without knowing anything about the internal structure of the model.

[0135] (2) The perturbations generated by HAAD also show strong transferability. These perturbations can also reduce the performance of other deep neural network models (such as DF models) by more than 91%. This shows that these perturbations are effective not only for the target ensemble model, but also for other models, highlighting their broad defensive capabilities;

[0136] (3) The ensemble model consistently demonstrates excellent robustness. After applying adversarial defenses, the ensemble model's classification performance on all datasets is robust compared to the individual models that make it up. On the Rimmer100 dataset, the ensemble model outperforms the second-best model by more than 10% on all evaluation metrics. This is because the integration of multiple models enhances the ensemble model's ability to maintain high resilience under adversarial conditions, which has significant advantages in practical applications. In addition, the DF model exhibits significant robustness, even surpassing the ensemble model on the Sirinam dataset, demonstrating its unique advantages in specific scenarios.

[0137] Table 3 Comparison of results of different defense algorithms:

[0138]

[0139] The experiment used a network sequence length of 200 packets and used the DF model as an unknown attack model to identify the perturbed sequence. DFD and MockingBird were also selected as perturbation defense methods. As shown in Table 3, in the first row, DFD stands for Deep Fingerprinting Defender, a deep fingerprint defense system; MockingBird is a website fingerprint attack simulation framework; BLANKET blind adversarial perturbation is a targetless adversarial attack technique; Minipatch is a lightweight real-time traffic obfuscation defense solution; and HAAD is the heuristic ant colony optimization algorithm proposed in this paper. DFD and MockingBird consume 57 and 62 packets, respectively, both reaching a perturbation overhead of nearly 30%. Both MockingBird and DFD require a perturbation overhead of nearly 30% to achieve a defense effectiveness of less than 80%. While BLANKET has a lower packet overhead, its defense performance is worse, with an effectiveness of less than 70%.

[0140] In contrast, the proposed HAAD algorithm achieves robust defense performance with only approximately 20% of the perturbation overhead. On both datasets, HAAD reduced the target model's classification accuracy by over 90%, while outperforming the next-best method, Minipatch, by over 5%. Experimental results demonstrate that HAAD (heuristic ant algorithm) exhibits significantly stronger defense capabilities than other defense algorithms.

[0141] Example 3:

[0142] This embodiment provides a general disturbance defense method of heuristic ant colony based on integrated substitution model. The specific process is as follows: Figure 3 As shown, the following specific methods are included:

[0143] S41 batch processing, this method is used to integrate the batch processing mechanism into HAAD. During each perturbation generation process, multiple traffic trajectories can be processed simultaneously. In this way, the algorithmic overhead generated by processing a single trajectory separately each time is effectively reduced, while the versatility of the generated perturbations is improved. In addition, by aggregating different input samples into a batch, the algorithm can access a wider data distribution at each iteration. As a result, the ant colony-based optimization process can more effectively access global data patterns, reduce sensitivity to abnormal inputs, and further enhance the stability of the learning process. Ultimately, the robustness and adaptability of the generated perturbations are improved, and the defense against adversarial samples is strengthened.

[0144] In this embodiment, batch processing is implemented starting from the computational perturbation, changing the original single sample processing method to a method that can process multiple samples at a time, similar to the batch training speed-up of neural network training. However, in this method, it is not only for speed-up but also for improving versatility.

[0145] S42 Universality Scoring Mechanism: This method is used to further improve the universality of generated perturbations. After the batch processing step is completed, a patch scoring mechanism based on defense success rate is introduced. Specifically, the success rate of each candidate patch within the current batch is calculated to evaluate its defense effectiveness. A higher score indicates better defense performance in the current batch, or a patch with frequent appearance in multiple batches indicates greater universality. The scoring method used in this mechanism can effectively assist in evaluating the universality of patches.

[0146] S43 TopK selection mechanism: This method mainly operates based on the universality score calculated in S42, and finally selects the top K patches with the highest scores to form the final universal perturbation vector.

[0147] In this embodiment, the specific scoring formula is actually the calculation formula of pheromones, as follows:

[0148] ;

[0149] Where, Represents a batch of data containing multiple samples x. Function The current disturbance Applicable to . No. The number of misclassified samples in the prediction results of ants is recorded as This step uses the result of Lj as the score in the patch scoring mechanism. This score is essentially the success rate of the perturbation result. For example: a batch has 64 samples, the perturbation vector is 4 patches, and the defense is successful (the replacement model fails to predict 5 or 6 samples). Then the success rate is 7 / 8. The scores of these four patches are all 7 / 8. The same calculation process is repeated for each supplement. The calculated scores are accumulated until the entire dataset is calculated. Finally, the TopK (the top K patches with the highest scores) are selected.

[0150] The existing WF defense schemes do not propose the use of a single perturbation to defend network data. The present invention proposes for the first time the use of a single universal perturbation to defend network data, which can significantly reduce network overhead. Among the existing methods: minipatch uses universal perturbations on a single website, but the large number of websites leads to huge overhead; mockingbird relies on model gradient information and complete flow records, which is not feasible in practice because the complete flow cannot be recorded in advance; BLANKET and DFD have the defects of high bandwidth overhead and poor defense effect. The present invention uses a heuristic ant colony algorithm and does not need to rely on model gradient information. The universal perturbation algorithm can not only pre-calculate the perturbation, but also greatly reduces the computational overhead due to its universality. The present invention significantly improves the defense effect, and its perturbation addition method has practical deployment feasibility.

[0151] Table 4 The impact of different disturbance delays on the network:

[0152]

[0153] The first column in Table 4 represents the bandwidth of transmitted data, the second column represents the delay of normal forwarding, and the third through eighth columns represent the delays introduced by adding perturbations of varying sizes. The delay overhead in the table is calculated using a general perturbation algorithm from a heuristic ant colony. Data analysis shows that the impact of perturbation delay is lower than that of network jitter. This embodiment was deployed on a P4 switch. The perturbation injection method proposed in this method enables rapid perturbation deployment on the P4. Measured data shows that the impact of the introduced delay is lower than that of network jitter, indicating that the impact of this perturbation mechanism is negligible.

[0154] Although the embodiments of the present invention have been disclosed as above, they are not limited to the applications listed in the description and implementation methods. They can be fully applied to various fields suitable for the present invention. For those familiar with the art, for those of ordinary skill in the art, various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to specific details.

Claims

1. A network traffic defense method based on heuristic ant colony optimization, characterized in that: The following steps are involved: Step S1: Construct a network traffic spatiotemporal disturbance constraint system: define the spatiotemporal characteristics of the original traffic trajectory through the directional sequence modeling paradigm, and establish disturbance injection rules that meet real-time constraints and directional consistency; Step S2: Training the ensemble replacement model: Build a deep neural network architecture for multi-feature extraction, and generate a traffic fingerprint recognition model with strong generalization capabilities through the feature fusion mechanism of spatial convolution, temporal loop and noise reduction coding; Step S3: Generate an adaptive adversarial disturbance vector: Based on the improved ant colony optimization algorithm, patches are selected through a pheromone probability selection strategy and a roulette wheel selection mechanism to construct a dynamic disturbance vector, and the pheromone is updated to achieve dynamic optimization of the virtual data packet defense capability; S31, Patch probability calculation: Calculate the probability of each patch being selected based on the pheromone concentration level; S32, patch selection: Based on the pheromone concentration and local defense effect, a roulette wheel selection mechanism is applied to select patches, retaining the random characteristics of the selection process and combining them to construct a dynamic perturbation vector δ; S33, patch injection: mapping the dynamic disturbance vector δ to the original traffic trajectory according to the disturbance injection rule generated in step S1 to form a disturbed network traffic trajectory; S34, Pheromone Update: Input the perturbed network traffic trajectory into the integrated substitution model, update the pheromone concentration without gradient according to the defense success result, and guide the iterative optimization of the subsequent patch search direction; Step S4: Implement a universal perturbation migration strategy: Use a batch processing method combined with a patch scoring mechanism based on defense success rate to improve the defense universality of the sample across different network traffic.

2. The traffic countermeasure defense method according to claim 1, characterized in that: The specific method of step S1 includes: S11. Direction sequence modeling paradigm construction: The direction of network traffic packets is encoded as a discrete numerical sequence, where client-to-server packets are marked as +1 and server-to-client packets are marked as -1, thereby defining the spatiotemporal characteristics of the original traffic trajectory; S12, direction consistency rule establishment: constrain the direction of inserted virtual data packets to be synchronized with the original traffic direction to avoid conflicting packets causing transmission delays; S13. Real-time constraint establishment: Define a perturbation rule vector consisting of multiple patches, each of which is represented by (p, η), where p identifies the virtual data packet insertion position and η quantifies the number of insertions. The perturbation rule vector is used to insert virtual data packets at the target position. There is no need to wait for the complete network stream transmission to be completed. Perturbations can be added by simply completing the insertion operation at the corresponding position, thereby meeting the real-time constraint requirements.

3. The traffic countermeasure defense method according to claim 2, characterized in that: The virtual data packet in S13 is an empty packet sent by the client or server, or a copy of a previously sent data packet.

4. The traffic countermeasure defense method according to claim 1, characterized in that: The specific method of step S2 includes: S21. Build a deep neural network architecture: By integrating the Var-CNN spatial convolution model, the LSTM temporal recurrent model, and the SDAE denoising encoding model, spatial features, temporal features, and denoising features are extracted and generated respectively; S22. Design a feature fusion mechanism and generate a recognition model: Adopt a fully connected weighted feature fusion method to adaptively adjust the weights of different features and generate a traffic fingerprint recognition model with synergistically enhanced feature fusion capabilities and model decision-making capabilities.

5. The traffic countermeasure defense method according to claim 1, characterized in that: The patch probability calculation process includes: converting the task of searching for disturbances into the process of searching for different patches in the disturbance; quantifying and recording the global defense effectiveness of each patch through pheromone concentration; and providing convergence direction guidance when the ant agent performs local patch search to enhance the stability of the defense strategy.

6. The traffic countermeasure defense method according to claim 1, characterized in that: The specific method for selecting patches using the roulette wheel selection mechanism includes: calculating the cumulative value of the probabilities of each patch as the cumulative probability; generating a uniformly distributed random number in the range [0, 1]; traversing the patch list, and when it is detected that the cumulative probability of a patch exceeds the random number for the first time, selecting the patch as the i-th element and adding it to the dynamic perturbation vector; and looping until a total of Q patches are selected to form a complete dynamic perturbation vector.

7. The traffic countermeasure defense method according to claim 1, characterized in that: The pheromone is a global pheromone, which is obtained by averaging the sum of the pheromones of all ant agents.

8. The traffic countermeasure defense method according to claim 1, characterized in that: The specific method of step S4 includes: S41. Batch processing: A batch processing mechanism is used to synchronously process multiple raw traffic traces. By combining different input samples into the same batch, the algorithm can cover a wider data distribution in each iteration. S42. Universality Scoring Mechanism: A patch scoring mechanism is introduced after the batch processing step. The universality score is calculated based on the defense success rate of the candidate patch in the current batch. Patches with high scores indicate excellent defense performance or stable performance across multiple batches of defense, indicating strong universality. S43, TopK selection mechanism: Improve the universality of perturbation by screening the K patches with the highest scores.

9. An application of the traffic countermeasure defense method according to any one of claims 1 to 8, characterized in that: The method is deployed to a P4 switch and tested in a Tor network environment for use in a network security defense platform.

Images