Website fingerprinting defense method based on Decision Transformer

Abstract

The present application relates to a website fingerprint defense method based on Decision Transformer, which solves the defects that the conventional defense method mainly adopts traffic shaping or fixed mode data packet filling strategy, only interferes with static traffic characteristics, is difficult to effectively model the timing analysis mode of the attacker and the defense rules are solidified and are easy to suffer adaptive attack compared with the prior art.The present application comprises the following steps: generation of defense trajectory data set; training of DT decision model; monitoring of network fingerprint attack; defense of website fingerprint; the present application extracts the timing behavior characteristics of network traffic, adopts Transformer architecture to model the long-term dependence relationship of traffic interaction, generates virtual data packet sequence matched with the space-time characteristics of real business flow by using Decision Transformer; the method dynamically optimizes the defense strategy by using the reinforcement learning framework, realizes the intelligent evolution of the defense rules in the confrontation environment, effectively confuses the traffic characteristic analysis of the attacker and significantly improves the defense success rate of the website fingerprint attack.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to a website fingerprinting defense method based on Decision Transformer. Background Technology

[0002] Tor, a widely used anonymous routing network, plays a crucial role in protecting user privacy by resisting tracking, monitoring, and censorship. Between February 2024 and February 2025, Tor attracted approximately 6 million unique users daily, making its security vital for protecting the privacy of this massive user base. However, the emergence of website fingerprinting (WF) attacks poses a real threat to Tor. In WF attacks, attackers can passively monitor the traffic characteristics generated when clients access websites, analyze traffic patterns using statistical methods, and train machine learning or deep learning models to identify specific users' website access behavior. These attacks can be easily launched by local attackers, internet service providers, or even Tor gateway guard nodes. Therefore, developing effective defense mechanisms to address such threats is urgently needed.

[0003] Web fingerprinting (WF) attacks pose a significant threat to the security and privacy of Tor users. Existing defenses face a dilemma in balancing efficiency, usability, and adaptability.

[0004] Traditional randomization-based methods interfere with classification by injecting traffic noise, but their effectiveness in obfuscating attack classifiers is limited. For example, the random perturbations added to the traffic may not be enough to mask the underlying patterns that the classifier relies on, allowing attackers to maintain high website identification accuracy.

[0005] Regularization-based methods aim to unify traffic patterns to confuse classifiers, but they incur high bandwidth overhead. Studies show that such defenses can lead to 30-40% bandwidth consumption. In scenarios with limited network resources, such high bandwidth consumption makes them impractical for real-world applications.

[0006] Adversarial learning techniques offer a new direction for website fingerprinting defense. These methods leverage the sensitivity of neural networks to small perturbations, influencing classifier performance with minor traffic modifications, thus improving the balance between bandwidth and defense effectiveness compared to the previous two types of methods. However, their practical deployment still faces significant challenges. The core issue is that some adversarial learning-based defense schemes require not only complete traffic sequences during training but also complete temporal information during real-time traffic processing. This is highly impractical in Tor real-time deployment scenarios because network traffic is dynamically changing, making it impossible to capture complete traffic sequences in real time, thus hindering the practical application of defense mechanisms.

[0007] While some advanced adversarial schemes mitigate the full sequence dependency problem by pre-computing perturbations, their adaptability remains limited. The perturbations generated by these methods have the following characteristics: first, they are pre-computed, meaning their generation is independent of real-time input; second, they are statically fixed, failing to consider dynamic factors such as webpage content updates and network environment changes. In real-world scenarios, webpage content may be updated periodically (e.g., news websites), and network latency and bandwidth may fluctuate dynamically (e.g., mobile networks). These changes can cause a shift between training traffic and actual traffic distribution. Because pre-computed perturbations lack dynamic adjustment capabilities, their defensive effectiveness in real-world environments differs significantly from that in the training phase.

[0008] In conclusion, website fingerprinting attacks, as an important means of threatening online privacy, have evolved in recent years with the development of new identification technologies assisted by deep learning, which has significantly increased the difficulty of defense and made the need for dynamic defense mechanisms increasingly urgent. Summary of the Invention

[0009] The purpose of this invention is to address the shortcomings of existing traditional defense methods, which mainly employ traffic shaping or fixed-pattern packet filling strategies, only interfering with static traffic characteristics, making it difficult to effectively model the attacker's temporal analysis patterns, and whose rigid defense rules are susceptible to adaptive attacks. This invention provides a website fingerprinting defense method based on Decision Transformer to solve the above problems.

[0010] To achieve the above objectives, the technical solution of the present invention is as follows:

[0011] A website fingerprinting defense method based on Decision Transformer includes the following steps:

[0012] Generation of the defense trajectory dataset: The defense trajectory dataset is generated based on the optimization-driven dataset of stochastic gradient descent;

[0013] Training the DT decision model: Train the Decision Transformer model using the defense trajectory dataset;

[0014] Monitoring network fingerprint attacks: Monitoring network fingerprint attack traffic data;

[0015] Website fingerprinting defense: By inputting attack traffic data into the trained DT decision model, website fingerprinting defense can be achieved.

[0016] The generation of the defense trajectory dataset includes the following steps:

[0017] Get protected users Access the target website Real-time network traffic generated during browsing activities;

[0018] Configuration of adversarial patches;

[0019] Dynamically inject adversarial patches into real-time network traffic ,

[0020] When a website fingerprint attacker's classifier During analysis, its output Misled as

[0021] ,

[0022] Among them, parameters As an adjustable defense variable, it maintains the protection against users accessing the target website. The targeted protection targets are then switched. It is valuable for flexibly responding to the ever-evolving threat of website fingerprinting.

[0023] The training of the DT decision model includes the following steps:

[0024] Define the actions, states, and rewards for the Decision Transformer model;

[0025] Fine-tune the Decision Transformer model.

[0026] The configuration of the adversarial patch includes the following steps:

[0027] Configure the target website for users. Traffic trajectory As input, adversarial perturbation signals are dynamically injected while maintaining communication functionality. The disturbed flow Feature representation to reference website Baseline distribution offset;

[0028] By minimizing the disturbance flow With the original Website traffic The difference measure in the deep feature space forces the classifier to modify the Access trajectory error associated with The category cluster; its expression is as follows:

[0029] ,

[0030] (1)

[0031] in, Indicates the maximum load of the patch. Indicates user Visiting the website Traffic when no patch is injected Defined to patch Injected traffic The injection function, Indicates the local WF feature extractor. It is the feature distance; The optimal patch needed to transform the raw traffic into the target traffic;

[0032] Through feature space Mini-batch gradient computation constructs a stochastic optimization framework:

[0033] The continuous relaxation method is used to relieve the pressure. Discrete constraints allow parameters to remain within a convex region during iterative optimization. Continuously updated within the scope;

[0034] Once the optimization converges, discrete constraints are applied through a post-processing binarization step: a sign function mapping is performed on all parameters. ,Right now Negative activation values ​​are merged into -1, and non-negative values ​​are mapped to +1, ultimately generating an adversarial patch that satisfies the discrete conditions. .

[0035] Setting the actions, states, and rewards of the Decision Transformer model includes the following steps:

[0036] Set the action:

[0037] In time steps ,action Decision in The number of virtual packets injected into the burst data packets, and the actions. The range of values ​​is limited to ,in This indicates the upper limit of virtual data packets that can be injected in a single burst. Virtual data packets are only injected on transmission links in the same direction as the burst group.

[0038] Setting status:

[0039] Setting time steps Status coding This represents the modified burst sequence segment that the agent has processed up to the present time, i.e., the sequence segment following the injection of virtual data packets through previous action decisions. Group burst data, subsequent burst sequences are not included In this context, the dimension of the state space is a fixed value;

[0040] Will The dimension is represented as In the initial stage, Initialized to A vector of all zeros in dimension, in time The state is represented as:

[0041] (2)

[0042] in, For data packets at time t, For the action at time t, The symbol for the element;

[0043] Set rewards:

[0044] Introducing balance parameters Precisely control the trade-off between defense effectiveness and resource consumption. As shown in formula (4):

[0045] (4)

[0046] The metric indicates whether the traffic sequence after defense can effectively obfuscate the attack model. This component evaluates the obfuscation effect of the defense mechanism through a pre-trained machine learning or deep learning WF classifier. Represented as:

[0047] (5)

[0048] in, It is the original burst sequence. It is a sparse reward, meaning the value is only non-zero at the last timestamp. It is the output label of the WF classifier. After the last step, if the defended burst sequence can successfully confuse the classifier, the reward is 1; otherwise, it is -1.

[0049] A penalty is imposed on each virtual data packet, expressed as:

[0050] (6)

[0051] This is a sparse reward, designed to reduce the bandwidth overhead of the defense mechanism; the reward remains zero until the final time step. It is a function used to count the number of data packets in a burst sequence. This represents the number of data packets in the burst sequence following the agent's action. This indicates the number of data packets in the burst sequence preceding the agent's action;

[0052] In the Decision Transformer model framework, traditional instant rewards are replaced with expected returns. ,

[0053] ,

[0054] Where T is the last time step. The original reward enables the model to generate action sequences based on expected future returns.

[0055] The fine-tuning of the Decision Transformer model includes the following steps:

[0056] The policy is represented as a multivariate Gaussian distribution with a diagonal covariance matrix, where the action distribution depends on the state and the residual reward objective value, and is quantified by parameters. Parameterization

[0057] set up The strategy parameters are represented as follows:

[0058] (7)

[0059] in, Indicates in arrive Choose an action based on your state and reward experience. The probability, Indicates a normal distribution. This represents the center of the Gaussian distribution. It is assumed to be the diagonal; Let the state be from time t-K+1 to time t. The reward for time t-K+1 to t; The action selected at time t;

[0060] Given a stochastic policy, maximize the log-likelihood of trajectories in the training dataset, or equivalently minimize the negative log-likelihood loss. :

[0061] ,

[0062] (8)

[0063] Where K is the sequence length, Calculate the expected value. Let (a,s,g) be the distribution of empirical data, where (a,s,g) represents the action, state, and reward.

[0064] The exploration intensity is quantified by policy entropy, and it is defined as follows:

[0065] (9)

[0066] in, express Shannon entropy of distribution

[0067] Policy entropy depends on data distribution It is static during the offline pre-training phase, but dynamic during fine-tuning because it depends on the online data obtained during the exploration phase;

[0068] To encourage exploration by imposing a lower bound on the policy entropy, address the following constraint problem:

[0069] (10)

[0070] in, It is a pre-defined hyperparameter.

[0071] To avoid solving the inequality constraints by solving (10), consider using the Lagrange multiplication table. and solve To optimize and ,

[0072] fixed Seeking a solution The problem is expressed as:

[0073] (11)

[0074] fixed Seeking a solution The problem is expressed as:

[0075] (12)

[0076] A computer-readable storage medium storing a computer program that, when executed by a processor, enables a website fingerprinting defense method based on Decision Transformer.

[0077] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, which, when executed by the processor, implements a website fingerprinting defense method based on Decision Transformer.

[0078] Beneficial effects

[0079] The website fingerprinting defense method based on Decision Transformer of the present invention, compared with the prior art, extracts the temporal behavioral features of network traffic, models the long-term dependency relationship of traffic interaction using the Transformer architecture, and uses Decision Transformer to generate virtual data packet sequences that match the spatiotemporal characteristics of real business flows; the method dynamically optimizes the defense strategy through a reinforcement learning framework, realizes the intelligent evolution of defense rules in adversarial environments, effectively obfuscates the attacker's traffic feature analysis, and significantly improves the success rate of defending against website fingerprinting attacks.

[0080] The method described in this invention differs fundamentally from all previous research by utilizing the innovative framework "Decision Transformer," which reimagines reinforcement learning as a sequence modeling task. This marks the first application of DT in WF (website fingerprinting) defense, fully leveraging the advantages of its Transformer architecture to dynamically generate traffic perturbations and adaptively adjust the filling strategy.

[0081] This invention proposes an innovative method based on a decision transformer to achieve dual optimization objectives. Firstly, leveraging the sequence modeling capabilities of the decision transformer, the model is trained to generate dynamic, incremental perturbations synchronously with the traffic transmission process. Compared to the limitations of traditional methods that rely on complete traffic sequences, this invention generates perturbations in real-time based on traffic conditions, offering high deployment feasibility. These perturbations are not pre-generated universal adjustment parameters, but rather adaptive strategies dynamically generated by the model based on observed traffic patterns, ensuring strong adaptability to diverse attack scenarios.

[0082] On the other hand, by leveraging the exploratory advantages of the DT framework, which integrates offline pre-training and online fine-tuning, the optimal defense strategy can be efficiently found. This strategy achieves a dynamic balance between defense effectiveness (such as reducing the accuracy of website fingerprint attacks) and perturbation costs (such as bandwidth overhead). By employing a stochastic strategy based on sequence-level entropy regularization, the model can proactively explore diverse perturbation generation patterns, adapting to constantly evolving traffic characteristics and attacker strategies while maintaining operational efficiency. Attached Figure Description

[0083] Figure 1 This is a sequence diagram of the method of the present invention;

[0084] Figure 2 This is a structural diagram of the Decision Transformer model involved in this invention;

[0085] Figure 3 This is a generated image of the defense trajectory dataset involved in this invention;

[0086] Figure 4 This is a schematic diagram illustrating the deployment of the present invention as a proxy. Detailed Implementation

[0087] To provide a better understanding of the structural features and effects achieved by the present invention, a detailed description is provided below, accompanied by preferred embodiments and accompanying drawings:

[0088] like Figure 1 As shown, the Decision Transformer defense mechanism of this invention comprises two independent stages: dataset generation and model training. This method generates high-quality defense data through a systematic process and utilizes the sequence modeling capabilities of Decision Transformer to construct an efficient, scalable, and adaptive defense system to counter website fingerprinting (WF) attacks, such as... Figure 2 .

[0089] The first phase generates a defense trajectory dataset by simulating adversarial perturbations. These perturbations are specifically designed to disrupt the WF classifier and involve targeted modifications to traffic sequences, such as injecting virtual packets or adjusting packet timing, thereby effectively interfering with attackers' identification of the target website. This process builds a defense strategy library covering multiple attack scenarios by dynamically generating adversarial examples adapted to real-time traffic characteristics.

[0090] The second stage trains a decision-making Transformer model based on the generated dataset. This model refactors reinforcement learning into a sequence modeling task, fully leveraging the Transformer architecture's advantage in capturing long-range dependencies—a crucial feature for handling complex temporal patterns in WF traffic. Through a self-attention mechanism, the model dynamically analyzes the spatiotemporal correlations of traffic segments and progressively generates optimal perturbation strategies based on historical action-state sequences, achieving real-time optimization and dynamic adaptation of adversarial defense strategies.

[0091] Dataset generation:

[0092] In offline reinforcement learning (Offline RL) scenarios, the performance of the DecisionTransformer (DT) decision paradigm based on sequence modeling is highly dependent on the quality and distribution characteristics of the training dataset. Traditional random dataset generation methods have two major drawbacks: First, random sampling lacks targeted exploration of key features in the state-action space, resulting in insufficient trajectory diversity and incomplete coverage of key decision boundaries, forcing the use of large-scale sampling to fill information gaps and significantly increasing computational costs; second, random generation mechanisms are difficult to adapt to dynamically changing reward functions in complex tasks, often producing low-value samples and exacerbating the distribution bias problem during policy network training.

[0093] To address the aforementioned challenges, this invention proposes an optimization-driven dataset generation framework based on stochastic gradient descent (SGD), as follows: Figure 3 Its core innovation lies in modeling dataset generation as a parametric optimization problem, and dynamically adjusting the sampling strategy through gradient feedback to achieve targeted exploration of high-value state-action regions and refined coverage of key decision boundaries.

[0094] Website fingerprinting defense model:

[0095] Protecting users Access the target website In browsing scenarios, an adversarial perturbation mechanism is employed to achieve proactive defense. Specifically, the system proactively defends against attacks from users and other users. Configurable adversarial patches are dynamically injected into real-time network traffic generated by the interaction. This patch manipulates the feature space of traffic trajectories through algorithmic design, making it more effective against website fingerprinting (WF) attackers' classifiers. During the analysis, its output was misled as ,parameter As an adjustable defense variable, it maintains the resistance to Targeted protection objectives, and can be switched It is valuable for flexibly responding to the ever-evolving WF threat.

[0096] This invention constructs a traffic obfuscation mechanism based on feature space mapping by reverse engineering the implicit feature space of a website fingerprint model. The system uses user access to the target website... The traffic trajectory serves as the input, and adversarial disturbance signals are dynamically injected while maintaining communication functionality. This process deliberately optimizes the perturbed flow through similarity optimization in the deep feature space. Feature representation to reference website The baseline distribution shift. Its core principle lies in constructing a feature similarity optimization function: minimizing the perturbation flow... With the original Website traffic Dissimilarity measures in deep feature spaces (such as cosine similarity or Mahalanobis distance) force the classifier to adjust the values ​​of the modified features. Access trajectory error associated with The classifier clusters are defined. When optimization converges, the adversarial patch creates feature ambiguity near the classifier's decision boundary, thereby disrupting the traditional WF detection paradigm that relies on statistical feature differences. This mechanism achieves covert traffic masquerading without significantly altering the original packet sequence and can be practically deployed in anonymous network environments.

[0097] The optimization problem described above can be represented as:

[0098]

[0099] (1)

[0100] in Indicates the maximum load of the patch. Indicates user Visiting the website Traffic when no patch is injected Defined to patch Injected traffic The injection function. Finally. This represents the local WF feature extractor (usually a classifier). It is the feature distance (in this invention, it is the L2 norm).

[0101] Disturbance generation:

[0102] To solve the discrete optimization problem represented by formula (1), we use the feature space The core innovation lies in using mini-batch gradient computation to construct a stochastic optimization framework. This framework utilizes a continuous relaxation method to remove the constraints imposed by the gradient descent. Discrete constraints allow parameters to remain within a convex region during iterative optimization. The search space is continuously updated within the specified range. This differentiable approximation method transforms the original combinatorial search space into a smooth manifold, enabling gradient-based optimization. Once the optimization converges, discrete constraints are imposed through a post-processing binarization step: a sign function mapping is performed on all parameters—that is... Negative activation values ​​are merged into -1, and non-negative values ​​are mapped to +1, ultimately generating adversarial patches that satisfy the discrete conditions.

[0103] Model training:

[0104] While Decision Transformer (DT) excels at generating obfuscated policies based on fixed datasets, and its ability to reconstruct reinforcement learning tasks through sequence modeling has been validated, its defensive performance may degrade when facing novel and unseen attack patterns. To address this limitation, this method innovatively introduces an online adaptive module, enabling the model to dynamically adjust policies through task-specific interactions with the environment. This adaptability is supported by techniques such as sequence-level entropy regularization and autoregressive modeling, improving sample utilization efficiency while ensuring the robustness of the defense mechanism during threat evolution. The Transformer architecture's ability to capture long-range dependencies makes it particularly suitable for handling complex temporal patterns in network traffic, while its modeling characteristics for policy distribution endow the defense system with the advantage of flexibly responding to diverse security needs, making this method a powerful choice for optimizing website fingerprint attack defense systems.

[0105] Action, Status, Reward

[0106] Action: In time steps ,action Decision in The number of virtual packets injected into a burst of data packets. Action The range of values ​​is limited to ,in This indicates the upper limit of virtual data packets allowed to be injected in a single burst. Virtual data packets are only injected on transmission links in the same direction as the burst group. The core constraint is: the agent's time... Only the current number can be modified. Group outbreaks—emergency groups whose previous steps have been modified remain unmodifiable, while subsequent emergency groups are subject to time restrictions. It is not yet operational.

[0107] State: State serves as an environmental representation accessible to the agent, strictly encapsulating information that is only permitted for decision-making. Within the framework of this invention, time steps... Status coding This refers to the modified burst sequence segments that the agent has processed up to the present time; specifically, the segments preceding the virtual data packets injected through previous action decisions. Group burst data. Subsequent burst sequences are not included. In, because of its time steps The state space is not yet visible to the agent, thus maintaining the integrity of temporal causality and action constraints. To facilitate reinforcement learning, the dimension of the state space is fixed. This invention will... The dimension is represented as In the initial stage, since no burst sequences have been processed yet, Initialized to A vector of all zeros in dimension. In time... The state is represented as:

[0108] (2)

[0109] Reward: The reward function defines the optimization objective of this invention, aiming to simultaneously achieve two tasks: misleading the website fingerprint (WF) classifier's identification judgment, while minimizing the number of injected virtual data packets. This is achieved by introducing a balancing parameter. Precisely control the trade-off between defense effectiveness and resource consumption, as shown in formula (4).

[0110] (4)

[0111] The metric indicates whether the traffic sequence after defense effectively obfuscates the attack model. This component evaluates the obfuscation effect of the defense mechanism using a pre-trained machine learning or deep learning WF classifier (as an alternative model). Represented as:

[0112] (5)

[0113] in It is the original burst sequence. It is a sparse reward, where the reward is only given in the last step. This is the output label of the WF classifier. After the final step, if the defended burst sequence successfully confuses the classifier, the reward is 1; otherwise, it is -1.

[0114] A penalty is imposed on each virtual data packet, expressed as:

[0115] (6)

[0116] This is also a sparse reward, designed to reduce the bandwidth overhead of the defense mechanism. The reward remains zero until the final time step. It is a function used to count the number of data packets in a burst sequence. This represents the number of data packets in the burst sequence following the agent's action. This represents the number of data packets in the burst sequence before the agent takes action.

[0117] It should be noted that in the Decision Transformer framework, traditional immediate rewards are replaced with expected returns (Return-to-go). , where T is the last time step. Its design motivation is to enable the model to generate action sequences based on future expected returns (rather than historical rewards).

[0118] Model fine-tuning:

[0119] This section outlines a general, probabilistic approach to learning stochastic policies, aiming to optimize the likelihood of observed datasets. For continuous action spaces, we adopt a widely accepted method, representing the policy as a multivariate Gaussian distribution with a diagonal covariance matrix, where the action distribution depends on the state and the return-to-go (RTG) objective value, and is denoted by parameters. Parameterization. Furthermore, we explore how to adapt this probabilistic framework to facilitate policy exploration within the Decision Transformer (DT), enabling policies to better navigate and learn autonomously in dynamic environments. Let... The policy parameters represent the policy, which can be expressed as:

[0120] (7)

[0121] in Indicates in arrive Choose an action based on your state and reward experience. The probability, Indicates a normal distribution. This represents the center of the Gaussian distribution. Assumed to be diagonal. Given a stochastic policy, maximize the log-likelihood of trajectories in the training dataset, or equivalently minimize the negative log-likelihood (NLL) loss.

[0122] ,

[0123] (8)

[0124] Where K is the sequence length. Calculate the expected value. For empirical data distribution, These are the parameters of the strategy model.

[0125] The core characteristic of online reinforcement learning (RL) algorithms lies in their ability to balance the exploration-exploitation tradeoff. Although traditional Decision Transformers employ random policies as shown in Equation (8), their design does not explicitly consider the exploration mechanism. To compensate for this deficiency, the exploration intensity is first quantified using policy entropy, defined as: ,

[0126] (9)

[0127] in express The Shannon entropy of the distribution. The policy entropy depends on the data distribution. It is static during the offline pre-training phase, but dynamic during fine-tuning because it depends on the online data obtained during the exploration phase.

[0128] Similar to many existing maximum RL algorithms such as SAC, this invention explicitly imposes a lower bound on the policy entropy to encourage exploration; that is, this invention aims to address the following constraint problem:

[0129] (10)

[0130] in The hyperparameters are pre-defined. This invention avoids solving inequality constraints by solving (10). We consider using Lagrange multiplication tables. and solve To optimize and .

[0131] fixed Seeking a solution The problem is expressed as:

[0132] (11)

[0133] fixed Seeking a solution The problem is expressed as:

[0134] (12)

[0135] This invention integrates a dynamic traffic obfuscation module, a feature space adversarial perturbation generation module, and a defense strategy optimization module based on a decision transformer. It can be deployed on anonymous network nodes (such as Tor egress relays) or edge gateway devices with traffic shaping capabilities to defend against website fingerprinting (WF) attacks in real time and protect the privacy and anonymity of users' network activities.

[0136] Taking an internal user of a medical research institution accessing a sensitive database via the Tor network as an example (see diagram). Figure 4 Attackers can extract temporal features (such as packet direction sequences and burst intervals) by monitoring outbound traffic and use a pre-trained WF classifier to identify target websites. This invention's method analyzes traffic segments in real time using a decision transformer, dynamically injecting virtual packet sequences aligned with the feature space of pre-set decoy websites (such as public news sites), while simultaneously adjusting the perturbation strength using an online adaptive module. When an attacker attempts to fingerprint the encrypted traffic, their classifier will misjudge due to feature confusion (e.g., misidentifying database access as news browsing), thus effectively protecting user privacy. The system continuously optimizes the perturbation strategy through a reinforcement learning framework, achieving dynamic defense against new WF attack models while maintaining normal communication latency, ensuring long-term anonymity protection.

[0137] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A website fingerprinting defense method based on Decision Transformer, characterized in that, Includes the following steps: 11) Generation of the defense trajectory dataset: The defense trajectory dataset is generated based on the optimization-driven dataset of stochastic gradient descent; 12) Training the DT decision model: Train the Decision Transformer model using the defense trajectory dataset; The training of the DT decision model includes the following steps: 121) Define the actions, states, and rewards for the Decision Transformer model; Setting the actions, states, and rewards of the Decision Transformer model includes the following steps: 1211) Set the action: In time steps ,action Decision in The number of virtual packets injected into the burst data packets, and the actions. The range of values ​​is limited to ,in This indicates the upper limit of virtual data packets that can be injected in a single burst. Virtual data packets are only injected on transmission links in the same direction as the burst group. 1212) Setting Status: Setting time steps Status coding This represents the modified burst sequence segment that the agent has processed up to the present time, i.e., the sequence segment following the injection of virtual data packets through previous action decisions. Group burst data, subsequent burst sequences are not included In this context, the dimension of the state space is a fixed value; Will The dimension is represented as In the initial stage, Initialized to A vector of all zeros in dimension, in time The state is represented as: ， (2) in, For data packets at time t, For the action at time t, The symbol for the element; 1213) Set rewards: Introducing balance parameters Precisely control the trade-off between defense effectiveness and resource consumption. As shown in formula (4): ， (4) The metric indicates whether the traffic sequence after defense can effectively obfuscate the attack model. This component evaluates the obfuscation effect of the defense mechanism through a pre-trained machine learning or deep learning WF classifier. Represented as: ， (5) in, It is the original burst sequence. It is a sparse reward, meaning the value is only non-zero at the last timestamp. It is the output label of the WF classifier. After the last step, if the defended burst sequence can successfully confuse the classifier, the reward is 1; otherwise, it is -1. A penalty is imposed on each virtual data packet, expressed as: ， (6) This is a sparse reward, designed to reduce the bandwidth overhead of the defense mechanism; the reward remains zero until the final time step. It is a function used to count the number of data packets in a burst sequence. This represents the number of data packets in the burst sequence following the agent's action. This indicates the number of data packets in the burst sequence preceding the agent's action; In the Decision Transformer model framework, traditional instant rewards are replaced with expected returns. , ， Where T is the last time step. The original reward enables the model to generate action sequences based on expected future returns; 122) Fine-tune the Decision Transformer model; The fine-tuning of the Decision Transformer model includes the following steps: 1221) Represent the policy as a multivariate Gaussian distribution with a diagonal covariance matrix, where the action distribution depends on the state and the residual reward objective value, and is given by parameters. Parameterization set up The strategy parameters are represented as follows: ，(7) in, Indicates in arrive Choose an action based on your state and reward experience. The probability, Indicates a normal distribution. This represents the center of the Gaussian distribution. It is assumed to be the diagonal; Let the state be from time t-K+1 to time t. The reward for time t-K+1 to t; The action selected at time t; 1222) Given a stochastic policy, maximize the log-likelihood of trajectories in the training dataset, or equivalently minimize the negative log-likelihood loss. : ， ， (8) Where K is the sequence length, Calculate the expected value. Let (a,s,g) be the distribution of empirical data, where (a,s,g) represents the action, state, and reward. 1223) The exploration intensity is quantified by policy entropy, which is defined as: ; ， (9) in, express Shannon entropy of distribution Policy entropy depends on data distribution It is static during the offline pre-training phase, but dynamic during fine-tuning because it depends on the online data obtained during the exploration phase; To encourage exploration by imposing a lower bound on the policy entropy, address the following constraint problem: (10)， in, It is a pre-defined hyperparameter. To avoid solving the inequality constraints by solving (10), consider using the Lagrange multiplication table. and solve To optimize and , fixed Seeking a solution The problem is expressed as: ， (11) fixed Seeking a solution The problem is expressed as: ； 13) Monitoring network fingerprint attacks: Monitoring network fingerprint attack traffic data; 14) Website fingerprinting defense: Input attack traffic data into the trained DT decision model to achieve website fingerprinting defense.

2. The website fingerprinting defense method based on Decision Transformer according to claim 1, characterized in that, The generation of the defense trajectory dataset includes the following steps: 21) Obtain protected users Access the target website Real-time network traffic generated during browsing activities; 22) Configuration of adversarial patches; 23) Dynamically inject adversarial patches into real-time network traffic. , When a website fingerprint attacker's classifier During analysis, its output Misled as , Among them, parameters As an adjustable defense variable, it maintains the protection against users accessing the target website. The targeted protection targets are then switched. It is valuable for flexibly responding to the ever-evolving threat of website fingerprinting.

3. The website fingerprinting defense method based on Decision Transformer according to claim 2, characterized in that, The configuration of the adversarial patch includes the following steps: 31) Configure the target website for user access Traffic trajectory As input, adversarial perturbation signals are dynamically injected while maintaining communication functionality. The disturbed flow Feature representation to reference website Baseline distribution offset; 32) By minimizing disturbance flow With the original Website traffic The difference measure in the deep feature space forces the classifier to modify the Access trajectory error associated with The category cluster; its expression is as follows: ， ， (1) in, Indicates the maximum load of the patch. Indicates user Visiting the website Traffic when no patch is injected Defined to patch Injected traffic The injection function, Indicates the local WF feature extractor. It is the feature distance; The optimal patch needed to transform the raw traffic into the target traffic; 33) Through feature space Mini-batch gradient computation constructs a stochastic optimization framework: The continuous relaxation method is used to relieve the pressure. Discrete constraints allow parameters to remain within a convex region during iterative optimization. Continuously updated within the scope; Once the optimization converges, discrete constraints are applied through a post-processing binarization step: a sign function mapping is performed on all parameters. ,Right now Negative activation values ​​are merged into -1, and non-negative values ​​are mapped to +1, ultimately generating an adversarial patch that satisfies the discrete conditions. .

4. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the website fingerprinting defense method based on DecisionTransformer as described in any one of claims 1-3.

5. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, which, when executed by the processor, implements the website fingerprinting defense method based on any one of claims 1-3.

Images