Group chat member association method based on message reminding flow fingerprint

Abstract

The invention relates to the technical field of group chat member association, in particular to a group chat member association method based on message reminding flow fingerprints, which comprises the following steps of: S1, pre-classifying monitoring flow through a flow preprocessing stage; s2, extracting different fingerprints for different types of traffic in a traffic extraction stage; s3, in a fingerprint matching stage, respectively matching a message reminding flow fingerprint and a message transmission flow fingerprint; and S4, finally outputting an association result in combination with a fingerprint matching result in an association stage. According to the method, a stable message reminding flow fingerprint is extracted from message reminding flow through an accurate fingerprint extraction algorithm by utilizing the instantaneity characteristic of message pushing of an instant messaging application, and then members in group chat are associated through a fingerprint matching algorithm.

Description

Technical Field

[0001] The present invention relates to the technical field of group chat member association, and in particular to a group chat member association method based on message reminder traffic fingerprint. Background Art

[0002] Risk assessment is a key component of data outbound transfer management. It aims to identify and assess potential risks associated with data outbound transfers, allowing for the implementation of appropriate preventative and control measures. Early warning mechanisms issue alerts when risks emerge or approach, enabling relevant departments to respond quickly and prevent them from escalating.

[0003] Among the many scenarios where data can be exported, instant messaging (IM) tools are widely used for communication and collaboration between individuals and organizations due to their convenience and efficiency. However, IM tools have also become a key channel for sensitive data leakage and illegal export. This is especially true in group chats, where the involvement of multiple parties allows for wider information dissemination and increases the risks.

[0004] To protect user privacy, many instant messaging apps currently employ technologies such as end-to-end encryption, making direct monitoring of communication content extremely difficult. This, to a certain extent, hinders effective assessment and early warning of the risk of sensitive data being exported abroad in group chats. Traditional network security monitoring methods often struggle to identify specific participants in encrypted traffic, particularly the identities of group chat members, making risk analysis and early warning for specific groups even more challenging.

[0005] To address these challenges, several methods have been developed that attempt to associate members of instant messaging group chats by analyzing the characteristics of encrypted traffic. These methods typically rely on extracting traffic fingerprints from the traffic received by group chat members, such as packet size, time interval, and transmission mode, hoping to associate members of the same group chat using these unique traffic characteristics. However, these existing methods generally suffer from the problem of traffic fingerprint instability. Specifically, when a group chat member receives multiple group chat messages simultaneously, the fingerprint generated in this process will be deformed, making it impossible to effectively associate the group chat members, which poses a great difficulty in practical applications.

[0006] Therefore, how to overcome the problem of unstable traffic fingerprints in existing technologies and propose a more stable and reliable technology to identify instant messaging group chat members by correlating encrypted traffic is crucial to improving the effectiveness of risk assessment and early warning of sensitive data outbound travel. Summary of the Invention

[0007] The present invention proposes a method for associating group chat members based on message reminder traffic fingerprints. Leveraging the immediacy of instant messaging application message push, this method extracts a stable message reminder traffic fingerprint from the message reminder traffic using a precise fingerprint extraction algorithm. The fingerprint matching algorithm then associates the members of the group chat. The proposed method and system for associating group chat members based on message reminder traffic fingerprints has important practical significance for improving the ability to assess and warn of sensitive data outbound risks. It provides technical support for more effective assessment and warning of sensitive data outbound risks, thereby resolving the issues raised in the aforementioned background technology.

[0008] To achieve the above object, the present invention provides the following technical solution: a method for associating group chat members based on message reminder traffic fingerprint, comprising the following steps:

[0009] S1, pre-classify the monitored traffic through the traffic pre-processing stage;

[0010] S2, then extract different fingerprints for different types of traffic in the traffic extraction stage;

[0011] S3. In the fingerprint matching stage, the message reminder traffic fingerprint and the message transmission traffic fingerprint are matched respectively;

[0012] S4. Finally, in the association stage, the fingerprint matching result is combined to output the association result.

[0013] Preferably, in the traffic preprocessing stage, the original traffic is first divided into different flows according to the five-tuple information of the data packet, and for each flow;

[0014] First, we filter out retransmitted packets. Then, we use the Nfstream open source tool to extract the packet arrival time, packet payload size, and packet transmission direction information for each flow. All packets of the flow are arranged in the order of arrival time to form a representation of the flow.

[0015] Next, calculate the proportion of packets with the maximum downlink packet load in each flow to the total downlink packets, denoted as α;

[0016] Since the downlink data packets of the flow containing group chat message reminder information are mostly short packets, that is, the load of the data packet is not the maximum value, the α value of the flow containing message reminder information is small, while the downlink data packets of the flow containing group chat message content are mostly long packets, that is, the load of the data packet is mostly the maximum value, so the α value of the flow containing message content is large. Through a large amount of data analysis, the α value is set to 0.4. If α≤0.4, the flow is considered to be a potential flow containing group chat message reminder information, otherwise it is considered to be a potential flow containing group chat message content.

[0017] Preferably, the data packet quintuple includes source / destination IP address, source / destination port number, and protocol type.

[0018] Preferably, the message reminder traffic fingerprint extraction stage has as input the potential flow containing group chat message reminders output by the traffic pre-classification module;

[0019] Through extensive observation of flows containing message alerts, we found that the traffic generated by instant messaging application clients when receiving message alerts has a fixed pattern;

[0020] Specifically, in a stream containing message reminders, each message reminder is transmitted by one or more data packets, which are sent continuously by the server. After the sending is completed, the client will send a confirmation data packet with a payload of 0 to the server.

[0021] Preferably, based on this observation, a message reminder traffic fingerprint extraction algorithm is adopted. Specifically, the input of the algorithm is a potential flow containing group chat message reminders, and the downlink data packet sequence of the flow is divided into different subsequences using confirmation data packets with an uplink load of 0;

[0022] For each subsequence, packets with a payload less than β = 20 are filtered out. The sum of the payloads of all packets in each subsequence is then calculated as the size of the message alert. The arrival time of the first packet in each subsequence is used as the time of the message alert. The message alert size and the time of the message alert together constitute the message alert fingerprint.

[0023] Through the message reminder traffic fingerprint extraction algorithm, a message reminder fingerprint sequence can be extracted from a potential flow containing message reminders.

[0024] Preferably, the message transmission traffic fingerprint extraction stage has as input the potential stream containing group chat message content in the output of the traffic pre-classification module;

[0025] Through extensive observation of flows transmitting group chat messages, we found that the traffic generated by instant messaging application clients when receiving messages has significant characteristics;

[0026] Specifically, in the stream containing group chat message content, each message content is transmitted by multiple data packets with maximum payload. These data packets are sent continuously by the server in a short period of time, forming a data packet cluster in the downstream flow. The time interval between data packet clusters containing different message content is longer.

[0027] Preferably, a message transmission traffic fingerprint extraction algorithm is used. Specifically, the input of the algorithm is a potential stream containing group chat message content. The downlink data packets of the stream are traversed. If the arrival time interval between multiple data packets with maximum load is less than the threshold τ=0.5s, these data packets are considered to be a data packet cluster. The total load of the data packets in the data packet cluster and the time of the first data packet are calculated to jointly constitute the message transmission traffic fingerprint.

[0028] Preferably, the message reminder traffic fingerprint matching stage, the input of this stage is the message reminder traffic fingerprint sequence output by the message reminder traffic fingerprint extraction module. Due to the immediacy of message reminders, members from the same group chat receive message reminders from the group chat with similar performance in the time and space dimensions of traffic. Therefore, this module matches the message reminder traffic fingerprint sequences from different IPs. Specifically, the longest common subsequence matching algorithm is adopted. When the time difference between two message reminder fingerprints is less than ρ=0.1s and the size difference is equal to σ=0, the two fingerprints are considered to match. The algorithm finally obtains the common subsequence of the two fingerprint sequences, calculates the length, fingerprint minimum value, maximum value and average value of the common subsequence as output.

[0029] Preferably, the message transmission fingerprint matching order is received. The input of this stage is the message transmission traffic fingerprint sequence output by the message transmission traffic fingerprint proposing module and the longest common subsequence in the message reminder traffic fingerprint matching. Since when the client receives messages from multiple group chats at the same time, the data packet clusters generated by multiple messages will overlap, causing the message transmission fingerprint to be deformed. Therefore, this module is an auxiliary module for fingerprint matching result analysis, aiming to reduce false positives of fingerprint matching results. Specifically, this module uses the time T of all fingerprints in the longest common subsequence in the message reminder traffic fingerprint matching module as a filtering condition, extracts the message transmission fingerprints within the time range of T±ε=0.2s, and uses the dynamic time warping algorithm to calculate the similarity between the message transmission fingerprints of the two clients, and uses the similarity as the output of this module.

[0030] Preferably, in the fingerprint matching result analysis phase, the input of this phase includes the length of the common subsequence, the minimum value, the maximum value and the average value of the fingerprint output by the message reminder fingerprint matching module, and the similarity value output by the message transmission traffic fingerprint matching module. These values ​​are fed into the trained random forest model, and the model outputs whether the two client IPs are in the same group chat. The core of the random forest model is that it is composed of multiple independent decision trees, each of which is trained based on a different training data subset and feature subset.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] This application pre-classifies the monitored traffic through the traffic preprocessing stage, then extracts different fingerprints for different types of traffic in the traffic extraction stage, matches the message reminder traffic fingerprint and the message transmission traffic fingerprint respectively in the fingerprint matching stage, and finally outputs the association result in the association stage based on the fingerprint matching result. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0034] Figure 1 Schematic diagram of a group chat member association method based on message reminder traffic fingerprint of the present invention;

[0035] Figure 2 This is a flow chart of the method for the flow pre-classification stage of the present invention;

[0036] Figure 3 This is a flow chart of the message reminder traffic fingerprint extraction module method of the present invention;

[0037] Figure 4 This is a flow chart of the message transmission traffic fingerprint extraction module method of the present invention. DETAILED DESCRIPTION

[0038] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0039] See also Figures 1 to 4 , the present invention provides a technical solution:

[0040] A method for associating group chat members based on message reminder traffic fingerprints includes the following steps:

[0041] S1, pre-classify the monitored traffic through the traffic pre-processing stage;

[0042] S2, then extract different fingerprints for different types of traffic in the traffic extraction stage;

[0043] S3. In the fingerprint matching stage, the message reminder traffic fingerprint and the message transmission traffic fingerprint are matched respectively;

[0044] S4. Finally, in the association stage, the fingerprint matching result is combined to output the association result.

[0045] In the traffic preprocessing stage, the original traffic is first divided into different flows according to the packet quintuple information (source / destination IP address, source / destination port number, protocol type). For each flow, first filter out the retransmitted data packets, then use the Nfstream open source tool to extract the data packet arrival time, data packet load size, and data packet transmission direction information of each flow. All data packets of the flow are arranged in the order of arrival time to form the representation of the flow. Then, calculate the proportion of data packets with the maximum load of the downlink data packets in each flow, which is recorded as α. Since the downlink data packets of the flow containing group chat message reminder information are mostly short packets, that is, the load of the data packets is not the maximum value, the α value of the flow containing message reminder information is small. The downlink data packets of the flow containing group chat message content are mostly long packets, that is, the load of the data packets is mostly the maximum value, so the α value of the flow containing message content is larger. Through a large amount of data analysis, the present invention sets the α value to 0.4. If α≤0.4, the flow is considered to be a potential flow containing group chat message reminder information. Otherwise, the flow is considered to be a potential flow containing group chat message content. The specific method diagram of this module is shown as follows. Figure 2 shown.

[0046] The message reminder traffic fingerprint extraction stage, the input of this stage is the potential flow containing group chat message reminders output by the traffic pre-classification module. Through a large number of observations on flows containing message reminders, it is found that the traffic generated by the instant messaging application client when receiving message reminders has a fixed pattern. Specifically, in the flow containing message reminders, each message reminder is transmitted by one or more data packets, which are sent continuously by the server. After the sending is completed, the client will send a confirmation data packet with a load of 0 to the server. Based on this observation, the present invention proposes a message reminder traffic fingerprint extraction algorithm. Specifically, the input of the algorithm is a potential flow containing group chat message reminders, and the downlink data packet sequence of the flow is divided into different subsequences using the confirmation data packet with an uplink load of 0. For each subsequence, the data packets with a load less than β=20 are filtered out, and then the sum of the loads of all data packets in each subsequence is calculated as the size of the message reminder, and the arrival time of the first packet of each subsequence is used as the time of the message reminder. The size of the message reminder and the time of the message reminder together constitute the message reminder fingerprint. After the message reminder traffic fingerprint extraction algorithm, a message reminder fingerprint sequence can be extracted from a potential flow containing message reminders. The flow diagram of this module method is as follows. Figure 3 shown.

[0047] The message transmission traffic fingerprint extraction stage, the input of this stage is the potential flow containing group chat message content in the output of the traffic pre-classification module. Through a large number of observations on the flow that transmits group chat messages, it is found that the traffic generated by the instant messaging application client when receiving messages has significant characteristics. Specifically, in the flow containing group chat message content, each message content is transmitted by multiple data packets with a maximum load. These data packets are sent continuously by the server in a short period of time, forming a data packet cluster in the downstream flow, and the time interval between the data packet clusters containing different message contents is longer. Based on this observation, the present invention adopts a message transmission traffic fingerprint extraction algorithm. Specifically, the input of the algorithm is a potential flow containing group chat message content. The downstream data packets of the flow are traversed. If the arrival time interval between multiple data packets with a maximum load is less than the threshold τ=0.5s, these data packets are considered to be a data packet cluster. The sum of the data packet loads in the data packet cluster and the time of the first data packet are calculated to together constitute the message transmission traffic fingerprint. The flow chart of this module method is shown as follows. Figure 4 shown.

[0048] The message reminder traffic fingerprint matching stage, the input of this stage is the message reminder traffic fingerprint sequence output by the message reminder traffic fingerprint extraction module. Due to the immediacy of message reminders, members from the same group chat receive message reminders from the group chat with similar performance in the time and space dimensions of traffic, so this module matches the message reminder traffic fingerprint sequences from different IPs. Specifically, the present invention proposes an improved longest common subsequence matching algorithm. When the time difference between two message reminder fingerprints is less than ρ = 0.1s and the size difference is equal to σ = 0, the two fingerprints are considered to match. The algorithm finally obtains the common subsequence of the two fingerprint sequences, calculates the length, fingerprint minimum value, maximum value and average value of the common subsequence as the output.

[0049] Message transmission fingerprint matching order, the input of this stage is the message transmission traffic fingerprint sequence output by the message transmission traffic fingerprint extraction module and the longest common subsequence in the message reminder traffic fingerprint matching. Since when the client receives messages from multiple group chats at the same time, the data packet clusters generated by multiple messages will overlap, causing the message transmission fingerprint to be deformed. Therefore, this module is an auxiliary module for fingerprint matching result analysis, aiming to reduce the false positives of fingerprint matching results. Specifically, this module uses the time T of all fingerprints in the longest common subsequence in the message reminder traffic fingerprint matching module as the filtering condition, extracts the message transmission fingerprints within the time range of T±ε=0.2s, and uses the Dynamic Time Warping (DTW) algorithm to calculate the similarity between the message transmission fingerprints of the two clients, and uses the similarity as the output of this module.

[0050] During the fingerprint matching result analysis phase, the inputs include the length of the common subsequence, the minimum, maximum, and average fingerprint values ​​output by the message reminder fingerprint matching module, and the similarity value output by the message transmission traffic fingerprint matching module. These values ​​are fed into the trained random forest model, which then outputs whether the two client IP addresses are in the same group chat. The core of the random forest model lies in its composition of multiple independent decision trees, each trained based on a different subset of training data and features. Assume that T decision trees are constructed.

[0051] RandomForest={Tree1,Tree2,...,Tree T}

[0052] Among them, Tree t Identify the t-th decision tree in the random forest. When constructing each decision tree, the random forest uses the Bootstrap Aggregating (Bagging) method to perform random sampling with replacement from the original training data set. Assume that the original training data set is D, which contains N samples. To construct the t-th decision tree, we extract N samples from D with replacement to form a new training data set D t When constructing each node of each decision tree for splitting, random forest does not consider all features, but randomly selects a subset from all features. Assuming there are M features in total, when each node splits, m features are randomly selected to search for the optimal split point, where m≤M. In this invention, m=log2(M)+1. For a given input sample x, the tth decision tree Tree t Will output a prediction result y t ,

[0053] y t =Tree t (x)

[0054] The final prediction result of the random forest is determined by a majority vote on the prediction results of all decision trees. Assume that the category set we want to predict is C = {c1, c2, ..., c k}. For the input sample x, the final prediction result of random forest is is the category with the most votes. For each category c j ∈C, calculate the number of decision trees that support this category:

[0055]

[0056] in, is an indicator function that is 1 if the condition is true and 0 otherwise. The final predicted category is:

[0057]

[0058] In this paper, we chose to use a random forest model to identify members of instant messaging group chats. This is primarily due to the following advantages: 1) High prediction accuracy: Random forest is an ensemble learning method that constructs and aggregates the prediction results of multiple decision trees to make a final judgment. This ensemble strategy can effectively reduce the overfitting problem that may occur with a single decision tree and improve overall prediction accuracy. For complex encrypted traffic data, random forests can generally provide higher recognition accuracy than single classifiers. 2) Good robustness: Random forests construct each decision tree by randomly selecting samples and features. This randomness makes the model robust to noise and outliers in the training data. In real-world network environments, encrypted traffic may be affected by various interference factors. Random forests can better cope with these uncertainties and maintain relatively stable recognition performance. 3) Low risk of overfitting: Compared to single decision trees, random forests effectively reduce the risk of overfitting by introducing randomness (e.g., bagging and random feature selection). Even with large amounts of training data or high feature dimensionality, random forests can maintain good generalization ability, resulting in better performance in practical applications. 4) Feature Importance Assessment: The random forest model outputs a score for the importance of each feature in the classification process. This is valuable for understanding which encrypted traffic features are most critical for identifying group chat members, helping us further optimize feature selection and model design. 5) Ability to handle nonlinear relationships: The relationship between encrypted traffic features and group chat members may not be a simple linear relationship. As a nonlinear model, random forests can better capture these complex correlations, thereby improving recognition accuracy.

[0059] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for associating group chat members based on message reminder traffic fingerprint, characterized by: The steps include: S1, pre-classify the monitored traffic through the traffic pre-processing stage; S2, then extract different fingerprints for different types of traffic in the traffic extraction stage; S3. In the fingerprint matching stage, the message reminder traffic fingerprint and the message transmission traffic fingerprint are matched respectively; S4. Finally, in the association stage, the fingerprint matching result is combined to output the association result.

2. A group chat member association method based on message reminder traffic fingerprint according to claim 1, characterized in that: In the traffic preprocessing stage, the original traffic is first divided into different flows according to the five-tuple information of the data packet. For each flow; First, we filter out retransmitted packets. Then, we use the Nfstream open source tool to extract the packet arrival time, packet payload size, and packet transmission direction information for each flow. All packets of the flow are arranged in the order of arrival time to form a representation of the flow. Next, calculate the proportion of packets with the maximum downlink packet load in each flow to the total downlink packets, which is recorded as; Since the downlink data packets of the flow containing group chat message reminder information are mostly short packets, that is, the load of the data packet is not the maximum value, the α value of the flow containing message reminder information is small, while the downlink data packets of the flow containing group chat message content are mostly long packets, that is, the load of the data packet is mostly the maximum value, so the α value of the flow containing message content is large. Through a large amount of data analysis, the α value is set to 0.

4. If α≤0.4, the flow is considered to be a potential flow containing group chat message reminder information, otherwise it is considered to be a potential flow containing group chat message content.

3. The method for associating group chat members based on message reminder traffic fingerprint according to claim 2, characterized in that: The data packet quintuple includes source / destination IP address, source / destination port number, and protocol type.

4. The method for associating group chat members based on message reminder traffic fingerprint according to claim 1, characterized in that: The message reminder traffic fingerprint extraction stage, the input of this stage is the potential flow containing group chat message reminders output by the traffic pre-classification module; Through extensive observation of flows containing message alerts, we found that the traffic generated by instant messaging application clients when receiving message alerts has a fixed pattern; Specifically, in a stream containing message reminders, each message reminder is transmitted by one or more data packets, which are sent continuously by the server. After the sending is completed, the client will send a confirmation data packet with a payload of 0 to the server.

5. The method for associating group chat members based on message reminder traffic fingerprint according to claim 4, characterized in that: Based on this observation, a message reminder traffic fingerprint extraction algorithm is adopted. Specifically, the input of the algorithm is a potential flow containing group chat message reminders. The downlink packet sequence of the flow is segmented into different subsequences using the confirmation packets with an uplink load of 0. For each subsequence, packets with a payload less than β = 20 are filtered out. The sum of the payloads of all packets in each subsequence is then calculated as the size of the message alert. The arrival time of the first packet in each subsequence is used as the time of the message alert. The message alert size and the time of the message alert together constitute the message alert fingerprint. Through the message reminder traffic fingerprint extraction algorithm, a message reminder fingerprint sequence can be extracted from a potential flow containing message reminders.

6. The method for associating group chat members based on message reminder traffic fingerprint according to claim 1, characterized in that: The message transmission traffic fingerprint extraction stage, the input of this stage is the potential flow containing group chat message content in the output of the traffic pre-classification module; Through extensive observation of flows transmitting group chat messages, we found that the traffic generated by instant messaging application clients when receiving messages has significant characteristics; Specifically, in the stream containing group chat message content, each message content is transmitted by multiple data packets with maximum payload. These data packets are sent continuously by the server in a short period of time, forming a data packet cluster in the downstream flow. The time interval between data packet clusters containing different message contents is longer.

7. The method for associating group chat members based on message reminder traffic fingerprint according to claim 6, characterized in that: A message transmission traffic fingerprint extraction algorithm is used. Specifically, the input of the algorithm is a potential stream containing group chat message content. The downlink data packets of the stream are traversed. If the arrival time interval between multiple data packets with maximum load is less than the threshold τ = 0.5s, these data packets are considered to be a data packet cluster. The total load of the data packets in the data packet cluster and the time of the first data packet are calculated to form the message transmission traffic fingerprint.

8. The method for associating group chat members based on message reminder traffic fingerprint according to claim 7, characterized in that: The message reminder traffic fingerprint matching stage, the input of this stage is the message reminder traffic fingerprint sequence output by the message reminder traffic fingerprint extraction module. Due to the immediacy of message reminders, members from the same group chat receive message reminders from the group chat with similar performance in the time and space dimensions of traffic. Therefore, this module matches the message reminder traffic fingerprint sequences from different IP addresses. Specifically, the longest common subsequence matching algorithm is adopted. When the time difference between two message reminder fingerprints is less than ρ = 0.1s and the size difference is equal to σ = 0, the two fingerprints are considered to match. The algorithm finally obtains the common subsequence of the two fingerprint sequences, calculates the length of the common subsequence, the minimum fingerprint value, the maximum fingerprint value and the average fingerprint value as the output.

9. The method for associating group chat members based on message reminder traffic fingerprint according to claim 8, characterized in that: The message transmission fingerprint matching order is received. The input of this stage is the message transmission traffic fingerprint sequence output by the message transmission traffic fingerprint extraction module and the longest common subsequence in the message reminder traffic fingerprint matching. Since when the client receives messages from multiple group chats at the same time, the data packet clusters generated by multiple messages will overlap, causing the message transmission fingerprint to be deformed. Therefore, this module is an auxiliary module for fingerprint matching result analysis, aiming to reduce false positives of fingerprint matching results. Specifically, this module uses the time T of all fingerprints in the longest common subsequence in the message reminder traffic fingerprint matching module as the filtering condition, extracts the message transmission fingerprints within the time range of T±ε=0.2s, and uses the dynamic time warping algorithm to calculate the similarity between the message transmission fingerprints of the two clients, and uses the similarity as the output of this module.

10. The method for associating group chat members based on message reminder traffic fingerprint according to claim 9, characterized in that: The fingerprint matching result analysis phase includes the input of the common subsequence length, fingerprint minimum, maximum, and average values ​​output by the message reminder fingerprint matching module, and the similarity value output by the message transmission traffic fingerprint matching module. These values ​​are fed into a trained random forest model, and the model outputs whether the two client IP addresses are in the same group chat. The core of the random forest model is that it is composed of multiple independent decision trees, each of which is trained based on a different subset of training data and feature subsets.

Images