Shadowsocks traffic detection method and system

Abstract

This invention discloses a Shadowsocks traffic detection method and system, comprising: acquiring real-time network communication traffic; splitting the real-time traffic into multiple TCP streams; filtering the multiple TCP streams based on the characteristics of the first four data packets in each TCP stream of Shadowsocks traffic; extracting the original feature vectors of the filtered TCP streams; performing data standardization on the original feature vectors of the TCP streams to obtain standardized feature vectors of the TCP streams; converting the standardized feature vectors of each TCP stream into a two-dimensional array to obtain a two-dimensional feature vector matrix of the TCP streams; calculating the two-dimensional feature vector matrix of each TCP stream using a convolutional neural network to obtain a spatial feature vector matrix of the real-time traffic; calculating the spatial feature vector matrix of the real-time traffic using a preset recurrent neural network model to obtain a temporal dynamic feature vector of the real-time traffic; and calculating the probability value of the Shadowsocks traffic based on the temporal dynamic feature vector.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for detecting Shadowsocks traffic. Background Technology

[0002] Proxy technology is primarily used to relay user traffic through specific proxy servers to access target websites. ShadowSocks (SS) is an open-source proxy software that anonymizes network traffic and bypasses geographical restrictions by encrypting transmitted data. Its original design aimed to help users bypass network censorship and access blocked internet resources. ShadowSocks uses the Socks5 proxy protocol and custom encryption algorithms (such as AES and ChaCha20) to disguise traffic as ordinary HTTPS traffic, avoiding detection by traditional firewalls. ShadowSocks consists of two parts: a client (ss-local) and a server (ss-server). It establishes an encrypted connection between the client and server, transmitting user data in encrypted form, making it difficult for network operators or firewalls to analyze and detect the specific content.

[0003] With both the Shadowsocks local client and remote server configured with encryption keys, no key exchange is required during transmission. The communication between the two parties is a normal TCP transmission, with no difference in content from ordinary HTTPS traffic, thus providing extremely high stealth.

[0004] Currently known methods for identifying Shadowsocks traffic primarily focus on supervised or semi-supervised learning in machine learning. Algorithms such as Random Forest, XGBoost, and SVM are used to learn network traffic characteristics to distinguish Shadowsocks traffic from regular traffic. However, these algorithms generally have low accuracy and are prone to overfitting or underfitting, such as misidentifying regular traffic as Shadowsocks traffic or vice versa. This makes such methods difficult to apply in production environments. Summary of the Invention

[0005] Based on the above situation, the main objective of this invention is to provide a Shadowsocks traffic identification method based on TCP traffic behavior characteristics, convolutional neural networks (CNN), and recurrent neural networks (RNN).

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A Shadowsocks traffic detection method includes the following steps:

[0008] S100, acquire real-time network communication traffic, split the real-time traffic into TCP streams to obtain multiple TCP streams, each TCP stream including multiple data packets;

[0009] S200, the multiple TCP streams are filtered based on the characteristics of the first four data packets in each TCP stream of Shadowsocks traffic to obtain multiple filtered TCP streams;

[0010] S300, for each of the filtered TCP streams, extract the original feature vector of the TCP stream;

[0011] S400, perform data standardization processing on each feature value in the original feature vector of each TCP stream to obtain the standardized feature vector of each TCP stream;

[0012] S500, the normalized feature vector of each TCP stream is transformed into a two-dimensional array to obtain a two-dimensional feature vector matrix for each TCP stream;

[0013] S600, a convolutional neural network is used to calculate the two-dimensional feature vector matrix of each TCP stream to obtain the spatial feature vector matrix of the real-time traffic;

[0014] S700: The spatial feature vector matrix of the real-time traffic is calculated using a preset recurrent neural network model to obtain the temporal dynamic feature vector of the real-time traffic. The probability value of the Shadowsocks traffic is calculated based on the temporal dynamic feature vector. If the probability value is greater than or equal to a preset threshold, it is determined to be Shadowsocks traffic.

[0015] Preferably, step S200, which involves filtering the multiple TCP streams based on the characteristics of the first four data packets in each TCP stream of Shadowsocks traffic, includes:

[0016] S201, determine whether the payload length in the first data packet of each TCP stream is a first preset value; if yes, execute S202; otherwise, delete the TCP stream.

[0017] S202, determine whether the payload length in the second data packet of each TCP stream is within a second preset range; if yes, execute S203; otherwise, delete the TCP stream.

[0018] S203, determine whether the payload length in the third data packet in each TCP stream is greater than a third preset value; if yes, execute S204; otherwise, delete the TCP stream.

[0019] S204, determine whether the response time of the fourth data packet in each TCP stream is greater than the response time of the first three data packets. If so, retain the TCP stream; otherwise, delete the TCP stream.

[0020] Preferably, the first preset value is determined based on the encryption algorithm used by Shadowsocks, the second preset range is determined based on the username and password of Shadowsocks, and the third preset value is determined based on the destination address information of the Shadowsocks proxy.

[0021] Preferably, step S300 includes:

[0022] For each filtered TCP stream, extract the first N data packets from the TCP stream, where N is greater than or equal to 10;

[0023] For the first N data packets in each TCP stream, the data packet length, data packet transmission time interval, and average round-trip time of each data packet are extracted to obtain the original feature vector of each TCP stream.

[0024] Preferably, in step S400, the following formula is used to perform data standardization processing on each feature value in the original feature vector of each TCP stream:

[0025]

[0026] in, X These are the eigenvalues ​​in the original eigenvector.

[0027] Xmin The eigenvalues ​​in the original feature vector X The minimum value,

[0028] Xmax The eigenvalues ​​in the original feature vector X The maximum value,

[0029] X′ These are the eigenvalues ​​in the standardized eigenvector.

[0030] Preferably, step 600 includes: the convolutional neural network calculates the two-dimensional feature vector matrix of each TCP stream using a sliding window method to obtain the spatial feature vector matrix of the real-time traffic.

[0031] Preferably, the convolutional neural network calculates the two-dimensional feature vector matrix of each TCP stream using a sliding window approach, including:

[0032] Based on a pre-defined kernel size and a pre-defined stride, the convolution process starts from a pre-defined position in the two-dimensional feature vector matrix of the TCP stream. When the pre-defined kernel size aligns with a region of the two-dimensional feature vector matrix, convolution calculation is performed until the entire two-dimensional feature vector matrix of the TCP stream has completed the convolution calculation, thus obtaining the spatial feature vector matrix of the real-time traffic.

[0033] Preferably, the preset recurrent neural network model structure is as follows:

[0034] h t =f(W xh *x t +W hh *h t-1 +b h )，

[0035] in, h t This is the time-series dynamic feature vector of the real-time traffic;

[0036] f() For activation functions;

[0037] W xh The weight matrix is ​​input to the hidden layer;

[0038] W hh This is the weight matrix from hidden layer to hidden layer;

[0039] b h The bias vector of the hidden layer;

[0040] x t is the vector value of the spatial feature vector matrix of the real-time traffic.

[0041] Preferably, calculating the probability value of the Shadowsocks traffic based on the time-series dynamic feature vector includes:

[0042] The fully connected layer of the preset recurrent neural network is based on the... W xh、 W hh and b h Calculate the weight matrix projected from the hidden state to the final classification space. W o and hidden state bias vectorb o ,

[0043] The probability value of outputting the Shadowsocks traffic is calculated using a softmax classifier:

[0044] y=softmax(W o h t +b o )，

[0045] in, h t This is the time-series dynamic feature vector of the real-time traffic.

[0046] Preferably, the preset recurrent neural network model is obtained by training using the following method:

[0047] S701, Obtain preset traffic, the preset traffic including Shadowsocks traffic and normal traffic;

[0048] S702, the preset traffic is split into multiple TCP streams, each TCP stream including multiple data packets;

[0049] S703, based on the characteristics of the first four data packets in each TCP stream of Shadowsocks traffic, multiple TCP streams of the preset traffic are filtered to obtain multiple filtered TCP streams of the preset traffic.

[0050] S704, For the multiple filtered TCP streams of the preset traffic, extract the original feature vector of each TCP stream;

[0051] S705, the original feature vector of each TCP flow of the preset traffic is labeled, the original feature array of Shadowsocks traffic is labeled as 1, and the original feature array of non-Shadowsocks traffic is labeled as 0.

[0052] S706, perform data standardization processing on each feature value in the original feature vector of the labeled preset traffic TCP stream to obtain the standardized feature vector of each TCP stream of the preset traffic;

[0053] S707, the normalized original feature vector of each TCP stream of the preset traffic is transformed into a two-dimensional array to obtain a two-dimensional feature vector matrix of each TCP stream of the preset traffic;

[0054] S708, A convolutional neural network is used to calculate the two-dimensional feature vector matrix of each TCP stream of the preset traffic to obtain the spatial feature vector matrix of the preset traffic;

[0055] S709, the recurrent neural network is trained according to the spatial feature vector matrix of the preset flow to obtain the weight matrix of the input hidden layer, the weight matrix from the hidden layer to the hidden layer, and the bias vector of the hidden layer of the recurrent neural network, thereby obtaining the preset recurrent neural network model.

[0056] The present invention also discloses a Shadowsocks traffic detection system, characterized in that it includes a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, and the processor executes the steps of the Shadowsocks traffic detection method according to any one of the present invention when executing the computer instructions.

[0057] The Shadowsocks traffic detection method of this invention performs an initial screening of high-suspection Shadowsocks traffic based on the characteristics of the first four data packets in the TCP stream, reducing the amount of data to be identified and effectively improving identification efficiency. Features are extracted from the high-suspection traffic data identified in the initial screening. The extracted raw feature vectors are converted into a two-dimensional array, and a convolutional neural network (CNN) model is used to extract the spatial feature vector matrix of the real-time traffic. A pre-defined recurrent neural network is then used to calculate the temporal dynamic feature vector of the real-time traffic from this spatial feature vector matrix, thereby achieving the identification of Shadowsocks traffic. Using CNN to extract the spatial feature vector matrix of the real-time traffic eliminates the need for manual feature extraction, improving identification efficiency and accuracy.

[0058] Other beneficial effects of the present invention will be explained in detail through the introduction of specific technical features and technical solutions in specific embodiments. Those skilled in the art should be able to understand the beneficial technical effects brought about by these technical features and technical solutions through the introduction of these technical features and technical solutions. Attached Figure Description

[0059] The preferred embodiment of the Shadowsocks traffic detection method according to the present invention will now be described with reference to the accompanying drawings. In the drawings:

[0060] Figure 1 This is a flowchart of a Shadowsocks traffic detection method according to a preferred embodiment of the present invention;

[0061] Figure 2 This is a flowchart illustrating the filtering of the plurality of TCP streams in a Shadowsocks traffic detection method according to a preferred embodiment of the present invention.

[0062] Figure 3 This is a schematic diagram of data packet transmission between the Shadowsocks client and server according to a preferred embodiment of the present invention;

[0063] Figure 4 This is a flowchart of the training process of a pre-defined recurrent neural network model in a Shadowsocks traffic detection method according to a preferred embodiment of the present invention. Detailed Implementation

[0064] To provide a more detailed description of the technical solutions of this application and to facilitate a better understanding of this application, specific embodiments of this application are described below in conjunction with the accompanying drawings. However, it should be understood that all illustrative embodiments and their descriptions are used to explain this application and do not constitute the sole limitation of this application.

[0065] Figure 1 A preferred embodiment of the Shadowsocks traffic detection method according to the present invention is characterized by comprising the following steps:

[0066] S100: Acquire real-time network communication traffic and split the real-time traffic into multiple TCP streams, each containing multiple data packets. Communication between the Shadowsocks local client and the remote server is a standard TCP transmission; therefore, splitting the traffic into TCP streams is necessary. A TCP stream represents the entire process from the initiation to the termination of the TCP connection between the Shadowsocks local client and the remote server. Splitting the traffic facilitates subsequent data extraction. Specifically, tcpdump can be used to acquire real-time network communication traffic. tcpdump is a network data acquisition and analysis tool that can capture network data packets according to defined parameters.

[0067] In a specific implementation, each TCP stream can be:

[0068] TCP stream = {P1, P2, ..., P} n}, where P i This represents the i-th data packet. It includes data packets from the local client to the remote server, as well as data packets from the remote server to the local client.

[0069] S200: Based on the characteristics of the first four packets in each TCP stream of Shadowsocks traffic, the multiple TCP streams are filtered to obtain multiple filtered TCP streams. Since the Shadowsocks protocol is implemented based on SOCKS5, after the Shadowsocks local client and remote server establish a TCP three-way handshake, the first four packets have relatively obvious characteristics, but cannot be completely identified as Shadowsocks proxy traffic. Therefore, by filtering the acquired real-time traffic based on the relatively obvious characteristics of the first four packets in each TCP stream, most of the high-suspection Shadowsocks traffic can be filtered out.

[0070] S300, for each of the filtered TCP streams, extract the original feature vector of the TCP stream.

[0071] S400, perform data standardization on each feature value in the original feature vector of each TCP stream to obtain a standardized feature vector for each TCP stream. The feature values ​​in the original feature vector typically vary significantly, with some values ​​exceeding 1000 and others less than 10. Such data is detrimental to subsequent convolutional neural network and recurrent neural network models, impacting their performance and recognition accuracy. Standardization ensures that the feature values ​​in the original feature vector fall within a similar range, for example, between 0 and 1, reducing the probability of false recognition and improving recognition accuracy.

[0072] S500, the normalized feature vector of each TCP stream is converted into a two-dimensional array to obtain a two-dimensional feature vector matrix for each TCP stream. In a specific implementation, a dedicated conversion tool or the reshape_to_2d(data,num_rows, num_cols) function can be used to convert the normalized feature vector of each TCP stream into a two-dimensional array, where data is the normalized feature vector, num_rows is the number of rows after conversion, and num_cols is the number of columns after conversion.

[0073] S600, a convolutional neural network is used to calculate the two-dimensional feature vector matrix of each TCP stream to obtain the spatial feature vector matrix of the real-time traffic. Each value in the spatial feature vector matrix of the real-time traffic represents the comprehensive characteristics of pixel values ​​in a small region around a certain position in the original matrix, such as edge, texture, intensity variation, etc.

[0074] S700: A preset recurrent neural network model is used to calculate the spatial feature vector matrix of the real-time traffic to obtain the temporal dynamic feature vector of the real-time traffic. Based on the temporal dynamic feature vector, the probability value of the Shadowsocks traffic is calculated. If the probability value is greater than or equal to a preset threshold, it is determined to be Shadowsocks traffic. Specifically, a preset threshold can be set based on the false recognition rate during modeling or testing. For example, the preset threshold can be set to 0.8 or 0.6, etc. A probability value greater than the preset threshold is considered Shadowsocks traffic; otherwise, it is not.

[0075] The Shadowsocks traffic detection method of this invention performs an initial screening of high-suspection Shadowsocks traffic based on the characteristics of the first four data packets in the TCP stream, reducing the amount of data to be identified and effectively improving identification efficiency. Features are extracted from the high-suspection traffic data identified in the initial screening. The extracted raw feature vectors are converted into a two-dimensional array, and a convolutional neural network (CNN) model is used to extract the spatial feature vector matrix of the real-time traffic. A pre-defined recurrent neural network is then used to calculate the temporal dynamic feature vector of the real-time traffic from this spatial feature vector matrix, thereby achieving the identification of Shadowsocks traffic. Using CNN to extract the spatial feature vector matrix of the real-time traffic eliminates the need for manual feature extraction, improving identification efficiency and accuracy.

[0076] In a preferred embodiment, such as Figure 2 As shown, step S200, which filters the multiple TCP streams based on the characteristics of the first four data packets in each TCP stream of Shadowsocks traffic, includes:

[0077] S201, determine whether the payload length in the first data packet of each TCP stream is a first preset value; if yes, execute S202; otherwise, delete the TCP stream.

[0078] S202, determine whether the payload length in the second data packet of each TCP stream is within a second preset range; if yes, execute S203; otherwise, delete the TCP stream.

[0079] S203, determine whether the payload length in the third data packet in each TCP stream is greater than a third preset value; if yes, execute S204; otherwise, delete the TCP stream.

[0080] S204, determine whether the response time of the fourth data packet in each TCP stream is greater than the response time of the first three data packets. If yes, retain the TCP stream; otherwise, delete the TCP stream.

[0081] In a preferred embodiment, the payload of the first data packet in the aforementioned TCP stream is typically an acknowledgment of the encryption algorithm. Therefore, the payload length of the first data packet is related to the encryption algorithm used, and the first preset value can be determined based on the encryption algorithm used by Shadowsocks. It is typically 16 bytes or 32 bytes. For example, if the chacha20-ietf-poly1305 encryption algorithm is used, the payload length of the first data packet is 32 bytes; the payload length of the first data packet in aes-128-gcm is 16 bytes. The payload of the second data packet in the aforementioned TCP stream is typically a username and password verification. Therefore, the second preset range can be determined based on the Shadowsocks username and password. The payload length of the second data packet is generally greater than or equal to 50 bytes and less than or equal to 60 bytes. The payload of the third data packet in the aforementioned TCP stream is typically the destination address information of the proxy, usually including the proxy domain name, proxy port, and proxy URL information. Therefore, the third preset value can be determined based on the destination address information of the Shadowsocks proxy. The payload length of the third data packet is typically greater than 500 bytes.

[0082] After receiving the third data packet, the Shadowsocks server will send a request to the target server it's proxying. Therefore, the response time for the fourth data packet will be significantly longer than the response time for the first three data packets. Figure 3 As shown, the first three data packets are all actively sent from the Shadowsocks client to the Shadowsocks server. The first two packets do not contain a PUSH packet from the Shadowsocks server; they only contain an ACK packet in response from the Shadowsocks server. The third packet contains both an ACK packet and a PUSH packet from the Shadowsocks server, which is the first response packet from the proxy target server. Therefore, the server response time is significantly longer than the response time of the first three data packets. For example, during testing, this invention's technical solution revealed... Figure 3 middle:

[0083] The time interval between receiving the ACK packet for the first data packet and receiving the ACK packet for the second data packet is: 0.000054 = 0.015040 - 0.014986;

[0084] The time interval between receiving the ACK packet for the third data packet and receiving the ACK packet for the second data packet is: 0.00030 = 0.015134 - 0.015040;

[0085] The time interval between the fourth data packet PUSH and the third data packet receiving the ACK packet is: 0.137407 = 0.152541 - 0.015134.

[0086] Clearly, the response time for the fourth data packet PUSH in the TCP stream is significantly longer than the response time for the first three data packets.

[0087] Based on the characteristics of these data packets in Shadowsocks' TPC stream, the real-time network communication traffic is first filtered to identify high-probability TCP streams, thereby reducing the amount of identification data and effectively improving identification efficiency.

[0088] In a preferred embodiment, step S300 may include: for each filtered TCP stream, extracting the first N data packets in each TCP stream, where N is greater than or equal to 10; for the first N data packets in each TCP stream, extracting the data packet length, inter-data packet transmission time interval, and average round-trip time of each data packet to obtain the original feature vector of each TCP stream. The first 10 data packets of a TCP stream have relatively obvious characteristics, which can usually determine whether it is Shadowsocks traffic.

[0089] In a specific implementation, a dedicated tool, such as Wireshark, can be used to extract the packet size, the time interval between each packet transmission, and the average round-trip time of the first 10 packets in the TCP stream, thus obtaining the original feature vector X for each TCP stream. For example, the original feature vector X for each TCP stream obtained by extracting the first 10 packets is:

[0090] X=[ℓ1,ℓ2,ℓ3,...,ℓ10,Δt1,Δt2,...,Δt10,RTTavg]

[0091] Where ℓ represents the length of the i-th data packet, i = 1, 2, ..., 10;

[0092] Δti represents the time interval for sending the i-th data packet;

[0093] RTTavg represents the average round-trip time for data packets.

[0094] In TCP, RTT stands for "Round-Trip Time," which is the time elapsed from when the sender starts sending data until the sender receives an acknowledgment message from the receiver.

[0095] Table 1 shows the data information of the first 10 packets of a TCP stream extracted using the dedicated tool Wireshark, including the timestamp, packet length, and RTT time of each packet.

[0096] Table 1

[0097]

[0098] Table 2 shows the data packet transmission time interval Δti (unit: milliseconds) calculated based on the data in Table 1.

[0099] ,

[0100] The average round-trip time RTTavg calculated based on the data in Table 1 is:

[0101] RTTavg=( 45+40+43+47+42+45+44+46+43+41) / 10 = 43.6ms

[0102] Finally, the original feature vector X of the TCP stream is obtained:

[0103] X=[100,480,1500,600,800,300,1280,500,700,650,20,5,20,15,20,10,30,5,15,43.6].

[0104] In a preferred embodiment, step S400 uses the following formula to perform data standardization processing on each feature value in the original feature vector of each TCP stream:

[0105] ,

[0106] in, X These are the eigenvalues ​​in the original eigenvector. Xmin The eigenvalues ​​in the original feature vector X The minimum value, Xmax The eigenvalues ​​in the original feature vector X The maximum value, X′ This refers to the eigenvalues ​​in the standardized eigenvector. Standardization ensures that the data items in the eigenvector are within the same range, for example, between 0 and 1.

[0107] For example, the original feature vector X of the TCP stream obtained from the above calculation:

[0108] The standardized feature vector obtained after standardization of X=[100,480,1500,600,800,300,1280,500,700,650,20,5,20,15,20,10,30,5,15,43.6] is:

[0109] X=[0.0636, 0.3177, 1.0000, 0.3973, 0.5318, 0.1973, 0.8545, 0.3301,0.4662, 0.4336,0.0100, 0.0000, 0.0100, 0.0067, 0.0100, 0.0033, 0.0167,0.0000, 0.0067, 0.0261].

[0110] In a specific implementation, step 500 can use a proprietary conversion tool or function to first convert the standardized feature vector into a two-dimensional array. For example, the standardized feature vector of a certain TCP stream obtained above is:

[0111] X=[0.0636, 0.3177, 1.0000, 0.3973, 0.5318, 0.1973, 0.8545, 0.3301,0.4662, 0.4336,0.0100, 0.0000, 0.0100, 0.0067, 0.0100, 0.0033, 0.0167,0.0000, 0.0067, 0.0261].

[0112] The standardized feature vectors consist of 20 elements. These standardized feature vectors can be transformed into a 4x5 two-dimensional array matrix, which is the two-dimensional feature vector matrix of the TCP stream, as follows:

[0113] [[0.0636, 0.3177, 1.0000, 0.3973, 0.5318],

[0114] [0.1973, 0.8545, 0.3301, 0.4662, 0.4336],

[0115] [0.0100, 0.0000, 0.0100, 0.0067, 0.0100],

[0116] [0.0033, 0.0167, 0.0000, 0.0067, 0.0261]].

[0117] In a preferred embodiment, the convolutional neural network in step 600 uses a sliding window to calculate the two-dimensional feature vector matrix of each TCP stream to obtain the spatial feature vector matrix of the real-time traffic.

[0118] In a specific implementation, the convolutional neural network can slide from a preset position of the two-dimensional feature vector matrix of the TCP stream according to a preset size convolutional kernel and a preset stride. When the preset size convolutional kernel is aligned with a region of the two-dimensional feature vector matrix, convolution calculation is performed until the entire two-dimensional feature vector matrix of the TCP stream has completed the convolution calculation, thereby obtaining the spatial feature vector matrix of the real-time traffic.

[0119] For example, the convolution kernel can be a 3x3 matrix, and each kernel contains a set of weights (default 0.1). The convolution kernel can be:

[0120] Convolution kernel = [[0.1, 0.1, 0.1],

[0121] [0.1, 0.1, 0.1],

[0122] [0.1, 0.1, 0.1]].

[0123] The preset stride is 1, meaning the convolution kernel moves only one pixel at a time. During the sliding process, the convolution kernel starts from the top left corner of the input matrix and slides gradually, moving right and down with a preset stride. Convolution is performed whenever the convolution kernel aligns with a region of the two-dimensional feature vector matrix. The input data is the value input(i,j) at the corresponding position in the two-dimensional feature vector matrix, where i and j are the coordinates in the two-dimensional feature vector matrix. The output of the convolution operation is a point output(i,j) on the two-dimensional feature vector matrix. The weights of the convolution kernel at positions m and n are kernel(m,n), where m and n are the coordinates of the convolution kernel. Convolution calculations typically start from positions m=1 and n=1. To ensure that the size of the output feature matrix matches the input feature matrix or meets other requirements, the convolution boundary is padded with Same Padding (zero values ​​are used to fill in out-of-bounds values).

[0124] For example, taking the 3×3 region surrounding the point 0.8545 in the 2nd row and 2nd column of the above two-dimensional feature vector matrix, including itself and 8 surrounding points (with padding of 0s at the boundaries), we get the following 3×3 matrix:

[0125] [[0.0636 0.3177 1.0000],

[0126] [0.1973 0.8545 0.3301], [0.0100 0.0000 0.0100]]

[0128] The expanded vector of the above 3×3 matrix is: [0.0636, 0.3177, 1.0000, 0.1973, 0.8545, 0.3301, 0.0100, 0.0000, 0.0100]

[0129] The convolution value calculated by the convolutional neural network is: (0.0636 + 0.3177 + 1.0000 + 0.1973 + 0.8545 + 0.3301 + 0.0100 + 0.0000 + 0.0100) × 0.1 = 0.27832.

[0130] The final output spatial feature vector matrix of the TCP stream after being processed by the convolutional neural network is:

[0131] [[0.14331, 0.27632, 0.33658, 0.3159, 0.18289],

[0132] [0.14431, 0.27832, 0.33825, 0.31857, 0.18456],

[0133] [0.10818, 0.14219, 0.16909, 0.12894, 0.09493],

[0134] [0.003, 0.004, 0.00401, 0.00595, 0.00495]].

[0135] In a preferred embodiment, the preset recurrent neural network model structure is as follows:

[0136] h t =f(W xh *x t +W hh *h t-1 +b h )，

[0137] in, h t This is the temporal dynamic feature vector of the real-time traffic, that is, the hidden state at each time step, based on the input. x t and the previous hidden state h t-1 Update. A new one will be generated at each time step. h t (h 1 , h 2 , h3 , h 4 …). Each vector value in the spatial feature vector matrix represents a time step. For example, [0.14331, 0.27632, 0.33658, 0.3159, 0.18289], [0.14431, 0.27832, 0.33825, 0.31857, 0.18456], [0.10818, 0.14219, 0.16909, 0.12894, 0.09493], and [0.003, 0.004, 0.00401, 0.00595, 0.00495] in the spatial feature vector matrix above are all time steps.

[0138] f() is an activation function used to introduce nonlinearity, such as ReLU (Rectified Linear Unit), which is widely used in deep learning.

[0139] W xh The weight matrix is ​​input to the hidden layer, typically with dimensions ( d x , d h ), d x This refers to the dimension of the input vectors. For example, the first set of input vectors is [0.14331, 0.27632, 0.33658, 0.3159, 0.18289] in the spatial feature vector matrix. d x Therefore, the value is 5. d h It is the dimension of the hidden state. d h It is usually preset, for example, d h =3. This will be automatically adjusted during the training of the recurrent neural network model. W xh After training is complete, the final result will be output. W xh Typically, initialization is random. Using NumPy in Python for initialization can yield the following initial values:

[0140] [[ 0.41464402, 0.41327708, -0.56720912]

[0141] [ 0.54227529, -0.38445507, -0.57550701]

[0142] [-0.02735228, 0.76430118, 0.41231241]

[0143] [-0.38546816, -0.08997415, -0.60848241]

[0144] [-0.20309375, -0.38992564, 0.17008614]].

[0145] W hh The weight matrix from hidden layer to hidden layer is typically of dimension ( ). d h , d h Similarly, during the training of a recurrent neural network model, adjustments will be made automatically. W hh After training is complete, the final result will be output. W hh Typically, initialization is random. Using NumPy in Python for initialization can yield the following initial values:

[0146] [[0.44362834, 0.24905251, 0.02326545]

[0147] [0.67805588, 0.36544153, 0.49940929]

[0148] [0.2071509, 0.33147703, 0.40736134]].

[0149] b h Let be the bias vector of the hidden layer, typically with dimension ( d h Recurrent neural network models automatically initialize. b h The value is 0, and the result is automatically adjusted during training. The final result is output after training is completed. b h Typically, initialization is random. Using Python's NumPy functions, you can obtain the following initial values: [0, 0, 0]. The final... b h It could be [0.12, -0.08, 0.03], and this value is determined during the training process.

[0150] x t These are the vector values ​​of the spatial feature vector matrix of the real-time traffic, that is, the feature vector values ​​at each time step. For example, in the spatial feature vector matrix of the example above: [0.14331, 0.27632, 0.33658, 0.3159, 0.18289], [0.14431, 0.27832, 0.33825, 0.31857, 0.18456], [0.10818, 0.14219, 0.16909, 0.12894, 0.09493] and [0.003, 0.004, 0.00401, 0.00595, 0.00495].

[0151] The spatial feature vector matrix of real-time traffic obtained in the above embodiments is input into the preset recurrent neural network model, and after calculation, the temporal dynamic feature vector of real-time traffic is obtained. h t For example, the temporal dynamic feature vector obtained after the spatial feature vector matrix is ​​calculated by the pre-defined recurrent neural network model in this invention. h t It is: [1.12303574 1.39078292 2.25616917].

[0152] In a preferred embodiment, calculating the probability value of the Shadowsocks traffic based on the temporal dynamic feature vector may include: using a pre-defined fully connected layer of a recurrent neural network based on the... W xh、 W hh and b h The weight matrix is ​​calculated by mapping the hidden state onto the final classification space. W o and hidden state bias vector b o Then, a softmax classifier is used to calculate the probability value of the output Shadowsocks traffic:

[0153] y=softmax(W o h t +b o )

[0154] in, h t The time-series dynamic feature vector of real-time traffic is usually called the hidden state.

[0155] In a preferred embodiment, such as Figure 4 As shown, the preset recurrent neural network model can be trained using the following method:

[0156] S701, Obtain preset traffic, which includes Shadowsocks traffic and normal traffic. Specifically, tcpdump can be used to obtain Shadowsocks traffic and other types of encrypted or unencrypted normal traffic.

[0157] S702, the preset traffic is split into multiple TCP streams, each containing multiple data packets. Similarly, each TCP stream can be:

[0158] TCP stream = {P1, P2, ..., P} n}, where P i This represents the i-th data packet.

[0159] S703, based on the characteristics of the first four data packets in each TCP stream of Shadowsocks traffic, multiple TCP streams of the preset traffic are filtered to obtain multiple filtered TCP streams of the preset traffic.

[0160] S704, for the multiple filtered TCP streams of the preset traffic, extract the original feature vector of each TCP stream. Similarly, the original feature vector may include the packet length, the time interval between packet transmissions, and the average round-trip time of the packets.

[0161] S705, the original feature vector of each TCP flow in the preset traffic is labeled. The original feature vector of Shadowsocks traffic is labeled as 1, and the original feature vector of non-Shadowsocks traffic is labeled as 0. Specifically, traffic analysis tools can be used to automatically label the vectors and directly write them into the preset positions of the original feature vectors of the TCP flows.

[0162] S706, perform data standardization on each feature value in the original feature vector of the labeled preset traffic TCP stream to obtain the standardized feature vector of each TCP stream of the preset traffic. It is understood that since the 1s and 0s labeled in step S705 are used to distinguish between Shadowsocks traffic and non-Shadowsocks traffic, the 1s and 0s labeled in step S705 are not standardized during the standardization process.

[0163] S707, the normalized original feature vector of each TCP stream of the preset traffic is transformed into a two-dimensional array to obtain a two-dimensional feature vector matrix of each TCP stream of the preset traffic;

[0164] S708, A convolutional neural network is used to calculate the two-dimensional feature vector matrix of each TCP stream of the preset traffic to obtain the spatial feature vector matrix of the preset traffic;

[0165] S709, the recurrent neural network is trained based on the spatial feature vector matrix of the preset traffic flow to obtain the weight matrix of the input hidden layer of the recurrent neural network. W xh Weight matrix from hidden layer to hidden layer W hh and the bias vector of the hidden layer b h Thus, the preset recurrent neural network model is obtained.

[0166] This invention combines TCP flow behavior characteristics with a deep learning model to detect Shadowsocks traffic, offering the following advantages:

[0167] High efficiency: Introducing high-susceptibility traffic filtering reduces the computational burden on the model and improves real-time performance;

[0168] High accuracy: CNN extracts complex spatial feature vector matrices, and RNN captures temporal dynamic information, significantly improving the Shadowsocks traffic recognition rate;

[0169] Strong generalization: It solves the problem of traditional methods relying on feature engineering and avoids model overfitting;

[0170] Wide adaptability: Suitable for different network environments and diverse Shadowsocks traffic types.

[0171] The present invention also discloses a Shadowsocks traffic detection system, including a memory and a processor. The memory stores computer instructions that can be executed on the processor. When the processor executes the computer instructions, it performs the steps of the Shadowsocks traffic detection method according to any one of the present invention.

[0172] Specifically, based on the embodiments disclosed above in this application, reference is made to... Figure 1 The processes described in the flowcharts of the embodiments can be implemented as computer programs. For example, embodiments of this application also provide a computer program product including a computer program carried on a computer-readable medium, the computer program comprising methods for executing... Figure 1 The flowchart of the embodiment describes the program code for the method. In such an embodiment, the computer program can be downloaded and installed from a network via a communication interface, or installed from memory. When the computer program is executed by a processor, it performs the functions defined in the method of the above embodiment.

[0173] It should be noted that the aforementioned computer-readable media may include, but is not limited to: volatile memory, such as random access memory (RAM); non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); and combinations of the above types of memory.

[0174] In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0175] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0176] In an optional embodiment, this application also provides a computer storage medium that can be used for computer software instructions, including a computer program, which, when executed by a processor, performs the presentation whiteboard display method as described in the above embodiments. This storage medium includes, but is not limited to, flash memory, hard disk, and solid-state drive.

[0177] It should be noted that the use of step numbers (letter or number) to refer to certain specific method steps in this invention is merely for the purpose of convenience and brevity in description, and is by no means intended to restrict the order of these method steps. Those skilled in the art will understand that the order of the relevant method steps should be determined by the technology itself and should not be unduly restricted by the existence of step numbers.

[0178] Those skilled in the art will understand that, without conflict, the above-mentioned preferred solutions can be freely combined and superimposed.

[0179] It should be understood that the above embodiments are merely exemplary and not restrictive. Various obvious or equivalent modifications or substitutions that can be made by those skilled in the art regarding the above details without departing from the basic principles of the present invention will be included within the scope of the claims of the present invention.

Claims

1. A method for detecting Shadowsocks traffic, characterized in that, Including the following steps: S100, acquire real-time network communication traffic, split the real-time traffic into TCP streams to obtain multiple TCP streams, each TCP stream including multiple data packets; S200, filtering the multiple TCP streams based on the characteristics of the first four packets in each TCP stream of Shadowsocks traffic, including: S201, determine whether the payload length in the first data packet of each TCP stream is a first preset value. If yes, execute S202; otherwise, delete the TCP stream. The first preset value is determined according to the encryption algorithm used by Shadowsocks. S202, determine whether the payload length in the second data packet in each TCP stream is within a second preset range. If yes, execute S203; otherwise, delete the TCP stream. The second preset range is determined based on the Shadowsocks username and password. S203, determine whether the payload length in the third data packet in each TCP stream is greater than a third preset value. If yes, execute S204; otherwise, delete the TCP stream. The third preset value is determined based on the destination address information of the Shadowsocks proxy. S204, determine whether the response time of the fourth data packet in each TCP stream is greater than the response time of the first three data packets. If yes, retain the TCP stream; otherwise, delete the TCP stream. Multiple filtered TCP streams were obtained; S300, for each of the filtered TCP streams, extract the features of the first 10 data packets in the TCP stream to obtain the original feature vector of the TCP stream. The features of the first 10 data packets include the length of each data packet, the time interval between data packets, and the average round-trip time of the data packets. S400, perform data standardization processing on each feature value in the original feature vector of each TCP stream to obtain the standardized feature vector of each TCP stream; S500, the normalized feature vector of each TCP stream is transformed into a two-dimensional array to obtain a two-dimensional feature vector matrix for each TCP stream; S600, a convolutional neural network is used to calculate the two-dimensional feature vector matrix of each TCP stream to obtain the spatial feature vector matrix of the real-time traffic; S700: The spatial feature vector matrix of the real-time traffic is calculated using a preset recurrent neural network model to obtain the temporal dynamic feature vector of the real-time traffic. The probability value of the Shadowsocks traffic is calculated based on the temporal dynamic feature vector. If the probability value is greater than or equal to a preset threshold, it is determined to be Shadowsocks traffic.

2. The Shadowsocks traffic detection method according to claim 1, characterized in that, In step S400, the following formula is used to perform data standardization processing on each feature value in the original feature vector of each TCP stream: , in, X These are the eigenvalues ​​in the original eigenvector. Xmin The eigenvalues ​​in the original feature vector X The minimum value, Xmax The eigenvalues ​​in the original feature vector X The maximum value, X′ These are the eigenvalues ​​in the standardized eigenvector.

3. The Shadowsocks traffic detection method according to claim 1, characterized in that, Step 600 includes: the convolutional neural network calculates the two-dimensional feature vector matrix of each TCP stream using a sliding window method to obtain the spatial feature vector matrix of the real-time traffic.

4. The Shadowsocks traffic detection method according to claim 3, characterized in that, The convolutional neural network calculates the two-dimensional feature vector matrix of each TCP stream using a sliding window approach, including: Based on a pre-defined kernel size and a pre-defined stride, the convolution process starts from a pre-defined position in the two-dimensional feature vector matrix of the TCP stream. When the pre-defined kernel size aligns with a region of the two-dimensional feature vector matrix, convolution calculation is performed until the entire two-dimensional feature vector matrix of the TCP stream has completed the convolution calculation, thus obtaining the spatial feature vector matrix of the real-time traffic.

5. The Shadowsocks traffic detection method according to claim 1, characterized in that, The preset recurrent neural network model structure is as follows: h t =f(W xh *x t +W hh *h t-1 +b h ), in, h t This is the time-series dynamic feature vector of the real-time traffic; f() For activation functions; W xh The weight matrix is ​​input to the hidden layer; W hh This is the weight matrix from hidden layer to hidden layer; b h The bias vector of the hidden layer; x t is the vector value of the spatial feature vector matrix of the real-time traffic.

6. The Shadowsocks traffic detection method according to claim 5, characterized in that, The probability value of the Shadowsocks traffic calculated based on the time-series dynamic feature vector includes: The fully connected layer of the preset recurrent neural network is based on the... W xh、 W hh and b h Calculate the weight matrix projected from the hidden state to the final classification space. W o and hidden state bias vector b o , The probability value of outputting the Shadowsocks traffic is calculated using a softmax classifier: y=softmax(W o h t +b o ), in, h t This is the time-series dynamic feature vector of the real-time traffic.

7. The Shadowsocks traffic detection method according to any one of claims 1-6, characterized in that, The preset recurrent neural network model is obtained by training using the following method: S701, Obtain preset traffic, the preset traffic including Shadowsocks traffic and normal traffic; S702, the preset traffic is split into multiple TCP streams, each TCP stream including multiple data packets; S703, based on the characteristics of the first four data packets in each TCP stream of Shadowsocks traffic, multiple TCP streams of the preset traffic are filtered to obtain multiple filtered TCP streams of the preset traffic. S704, For the multiple filtered TCP streams of the preset traffic, extract the original feature vector of each TCP stream; S705, the original feature vector of each TCP flow of the preset traffic is labeled, the original feature array of Shadowsocks traffic is labeled as 1, and the original feature array of non-Shadowsocks traffic is labeled as 0. S706, perform data standardization processing on each feature value in the original feature vector of the labeled preset traffic TCP stream to obtain the standardized feature vector of each TCP stream of the preset traffic; S707, the normalized original feature vector of each TCP stream of the preset traffic is transformed into a two-dimensional array to obtain a two-dimensional feature vector matrix of each TCP stream of the preset traffic; S708, A convolutional neural network is used to calculate the two-dimensional feature vector matrix of each TCP stream of the preset traffic to obtain the spatial feature vector matrix of the preset traffic; S709, the recurrent neural network is trained according to the spatial feature vector matrix of the preset flow to obtain the weight matrix of the input hidden layer, the weight matrix from the hidden layer to the hidden layer, and the bias vector of the hidden layer of the recurrent neural network, thereby obtaining the preset recurrent neural network model.

8. A Shadowsocks traffic detection system, characterized in that, The method includes a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, and the processor executes the steps of the Shadowsocks traffic detection method according to any one of claims 1 to 7 when executing the computer instructions.

Images