A website fingerprinting defense method against encryption proxies

Abstract

This invention relates to a website fingerprinting defense method for encrypted proxies. Compared with existing technologies, it addresses the shortcomings of existing website fingerprinting defense technologies, such as high bandwidth consumption, high latency, and limited defense performance in practical deployments. The invention includes the following steps: network traffic acquisition and preprocessing; construction of a proxy website fingerprint attack model set; implementation of a sequential integration optimization algorithm; real-time perturbation injection; and implementation of website fingerprinting defense. By constructing a structurally heterogeneous attack model set, designing a general adversarial perturbation generation mechanism based on sequential integration optimization, and combining it with a lightweight real-time perturbation injection strategy, this invention achieves cross-traffic generalization capability and strong robustness across models with low resource consumption, effectively balancing the contradictions between defense effectiveness, real-time performance, and practicality.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically a website fingerprinting defense method for encrypted proxies. Background Technology

[0002] Network traffic generated from accessing websites has become one of the most prevalent types of traffic in cyberspace today. To protect their privacy, users widely employ encrypted proxy technology when accessing websites. This technology introduces one or more relay nodes between the user and the target website to forward encrypted network traffic, thereby hiding the direct connection between the user and the target website along the transmission path. Because the traffic is encrypted and relay nodes exist in the path, attackers along the path find it difficult to directly determine the type of website and target service actually accessed by the user, effectively improving the anonymity and security of communication. However, although encrypted proxies can hide communication content and some network path information, the protection of user privacy still faces serious challenges with the development of website fingerprinting technology.

[0003] Website fingerprinting is a passive traffic analysis technique. Attackers can infer the websites a user visits simply by analyzing metadata (such as packet size, direction, and time intervals) within encrypted traffic, without decrypting the traffic content. How to effectively defend against website fingerprinting attacks in encrypted proxy scenarios without significantly impacting communication performance, and further protect user privacy, has become a critical technical problem that urgently needs to be solved in the field of cyberspace security.

[0004] Website fingerprinting technology aims to weaken attackers' ability to identify user access behavior by interfering with or hiding traffic characteristics. Common defense strategies typically involve introducing virtual, forged traffic, disrupting communication timing, reordering data packets, or segmenting traffic to confuse the communication patterns of encrypted website streams, thereby reducing the ability of website fingerprinting models to capture traffic characteristics and lowering their inference accuracy. Traditional website fingerprinting methods require significant bandwidth and latency overhead to shape the actual traffic, making the traffic trajectories of two websites similar, which significantly increases communication burden and reduces access efficiency in practical applications. The core idea of ​​website fingerprinting based on adversarial perturbations, which has emerged in recent years, is to leverage the vulnerability of neural networks to small perturbations to influence the classifier through subtle changes in traffic. While these methods reduce overhead to some extent, they still have issues with practicality and adaptability. On the one hand, these methods often rely on pre-acquiring complete traffic trajectories to calculate targeted perturbations, making them difficult to apply to real-time encrypted communication scenarios; on the other hand, these perturbations are usually generated for specific attack models, lacking generalization ability and robustness against unknown attack models.

[0005] Therefore, the existing website fingerprinting defense methods still have significant shortcomings in application and protection effectiveness in real network environments. There is an urgent need to study more efficient and robust website fingerprinting defense methods from three dimensions: bandwidth and latency overhead control, real-time protection, and defense robustness. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing website fingerprinting defense technologies, which generally suffer from high bandwidth consumption, high latency, and limited defense performance in practical deployments. This invention provides a website fingerprinting defense method for encrypted proxies to solve these problems.

[0007] To achieve the above objectives, the technical solution of the present invention is as follows:

[0008] A website fingerprinting defense method for encrypted proxies includes the following steps:

[0009] 11) Network traffic acquisition and preprocessing;

[0010] 12) Construction of a set of fingerprint attack models for proxy websites;

[0011] 13) Implement the sequential ensemble optimization algorithm: Optimize the attack model set using the generative sequential ensemble optimization algorithm to generate a general website perturbation;

[0012] 14) Real-time perturbation injection and website fingerprinting defense: When a potential attacker launches a website fingerprinting attack, they collect data packets from the encrypted link between the client and the encrypted proxy. The attacker captures the traffic of the target client connecting to the encrypted proxy and uses a classifier to predict the website the client is visiting. Website fingerprinting defense is deployed on the client and encrypted proxy nodes. Based on the perturbation location and perturbation size information of the general website perturbation indication, virtual data packets or delayed real data packets are injected to generate defense traffic. In this way, the traffic captured by the attacker is interfered with, making it difficult for their classifier to accurately identify the website visited by the user, thus achieving online website fingerprinting defense.

[0013] The network traffic acquisition and preprocessing includes the following steps:

[0014] 21) Obtain the raw network traffic, preprocess the raw network traffic, and represent the raw traffic trajectory as: direction sequence ,

[0015] in, Indicates the first The total number of data packets contained in the track. Indicating the first position in the trajectory The transmission direction of each data packet. =+1 indicates that the data packet is sent from the client to the web server, and the data packet is transmitted out. =-1 indicates that the data packet is returned from the website server to the client, and the data packet is passed in;

[0016] 22) Convert the directional sequence into a burst sequence. A burst is defined as a set of consecutive data packets with the same direction. Each burst is described by its direction marker and the number of packets. Burst sequence Represented as:

[0017] ,

[0018] in, This indicates the total number of sudden events.

[0019] = , It's a sudden event of varying magnitude. Obtain the direction of the sudden event, and at the same time The number of packets corresponding to the burst sequence. Let the direction magnitude be the j-th burst of the i-th burst sequence. This indicates the transmission direction of the m-th data packet in the j-th burst of the i-th burst sequence;

[0020] Zero-padding and tail-truncation normalization operations are applied to the burst sequence to make it meet the fixed burst input length requirement.

[0021] The construction of the proxy website fingerprint attack model set includes the following steps:

[0022] 31) Select M website fingerprint attack models from third-party models with publicly available open-source implementations, and set the proxy website fingerprint attack model set to include M website fingerprint attack models;

[0023] 32) Construct a set of fingerprint attack models for proxy websites, denoted as . ,in, Indicates the first A fingerprint recognition model for agent websites, where M is the number of models in the set;

[0024] Training is performed on M website fingerprint attack models, using preprocessed normalized burst sequences as input features and website categories as labels for each model. Perform independent supervised training. After training, each model... It can receive a traffic trajectory and output its predicted website category and its confidence level;

[0025] 33) Construct a website-level traffic trajectory dataset: targeting the website Collect multiple traffic trajectories generated under different access conditions to form a traffic trajectory set. ;

[0026] 34) Define a website-level general perturbation optimization strategy:

[0027] Targeting the same website ,

[0028] Using traffic trajectory sets Fingerprint attack model set on proxy websites Joint perturbation optimization is performed on the website to generate a response. General-purpose adversarial perturbation The perturbation optimization problem is formalized as follows:

[0029] ,

[0030] in, express All traffic traces in the proxy website fingerprint attack model set Total losses on This represents the optimized traffic trajectory. To constrain the disturbance amplitude, the maximum bandwidth overhead required to control the disturbance is less than a set threshold. ;

[0031] 35) The original disturbance Initialized to a burst sequence of the original flow trajectory Zero sequences of the same length

[0032]

[0033] The implementation sequence integration optimization algorithm includes the following steps:

[0034] 41) In the outer loop phase, before each round of optimization begins, the fingerprint attack model set of the proxy website is analyzed. The fingerprint recognition models of the Chinese agent website are randomly arranged in order to obtain different ordered sets. ;

[0035] 42) Obtain an ordered set Subsequently, in the inner loop phase, a fingerprint recognition model based on each proxy website is used. Iterative optimization of the disturbance;

[0036] A cumulative optimization strategy based on historical model perturbations is adopted to gradually update the adversarial perturbations.

[0037] remember In ordered set In this study, the adversarial perturbation obtained by optimizing the fingerprint attack model of the first j proxy websites is used to fully utilize the previous... The perturbation information of the proxy website fingerprinting model, together with the adversarial perturbation and the initial perturbation, constitutes the current proxy website fingerprinting model. input set :

[0038] ;

[0039] 43) In order of sorted sets The first in When performing perturbation optimization on the fingerprint recognition model of an agent website, the set and traffic trajectory set As input, the perturbation is updated using a cumulative averaging strategy. The perturbation is updated in the following form:

[0040] ,

[0041] in, This represents the learning rate updated with perturbation. Defined as trajectory Add perturbation Later in the proxy model loss function on, For each perturbation component in the perturbation input set. ;

[0042] 44) The loss function includes two items: adversarial loss. and bandwidth loss , represented as:

[0043] ,

[0044] Adversarial loss Measuring disturbances proxy model The degree of misleading, bandwidth loss Measure the current disturbance Required bandwidth overhead, These are weighting coefficients used to balance the degree of influence between two objectives, and represent bandwidth loss. Represent as = ;

[0045] 45) Application of disturbances Functions are used for control. The added service for function-controlled perturbation shall not exceed the maximum tolerable bandwidth overhead threshold. Meanwhile, the disturbance is controlled to be added only;

[0046] 46) After performing perturbation optimization on M proxy website fingerprinting models within the proxy website fingerprinting attack model set, a set of perturbation sequences is obtained. ,

[0047] Final perturbation Aggregation is performed using a weighted strategy that incorporates historical data, and the calculation formula is as follows:

[0048] ,

[0049] in, ∈[0,1] is the fusion factor, used to control the weighting ratio between the newly generated perturbation and the original perturbation;

[0050] 47) Dependence on ordered sets Each proxy website's fingerprinting model is used to verify the generated adversarial perturbations. The effectiveness of this is determined by updating the perturbation after each round of internal and external loop optimization iterations. Applied to websites Each training flow trajectory x∈ Generate corresponding adversarial examples ;

[0051] If all proxy website fingerprinting models are effective against this adversarial sample The success rate of generating misclassifications reaches the set success rate threshold parameter. If the perturbation optimization is complete, the perturbation is recorded. The iteration is terminated; the decision criteria are as follows:

[0052] ,

[0053] in, It is an indicator function, when the first Fingerprint recognition model for agent websites For the flow after the disturbance An error occurred, meaning the classification result is not the original label. hour, This indicates that the perturbation successfully misled the model; otherwise...

[0054] This represents the minimum number of misclassifications required for a successful perturbation across all proxy website fingerprinting models; this success rate threshold is... The size reflects the requirements for disturbance defense performance;

[0055] 48) If the perturbation success rate does not reach the threshold, proceed to the next round of iteration of the sequential ensemble optimization algorithm, and update the perturbation in this round. Set as initial perturbation Continue executing steps 41)-48) until the perturbation success rate termination condition is met;

[0056] 49) Once the perturbation success rate meets the termination condition, a website-level general perturbation for the target website w is obtained. .

[0057] The real-time perturbation injection and website fingerprinting defense implementation includes the following steps:

[0058] 51) The website-level general disturbance δ obtained from the target website w is pre-stored in the disturbance database of the defense system. The injection position of the website-level general disturbance indicates the specific position of the disturbance injection in the original traffic burst sequence, and the injection quantity indicates the virtual data packet that should be inserted at the corresponding position. Through the injection position and injection quantity, δ is mapped to any traffic trajectory that accesses the target website w.

[0059] 52) When a client actually accesses a website, the client checks whether the current browsing session belongs to a protected website in the monitoring list. If so, the client browser obtains the injection location and injection quantity information of virtual data packets based on the website-level general adversarial perturbation corresponding to that website.

[0060] 53) In the sending direction from the client to the website, when the corresponding injection position is reached, the client first caches the real data packet that will be sent at the injection position, and then inserts the virtual data packet after the real data packet according to the injection quantity, and sends the encrypted traffic trajectory with added perturbation to the encrypted proxy node.

[0061] When the encryption proxy receives the perturbed encrypted traffic from the client, it identifies and removes the virtual data packets appended to the tail based on the website-level general perturbation δ, and forwards the restored real traffic to the target website server.

[0062] 54) In the direction of sending traffic from the website to the client, the encrypted proxy uses the same injection method to generate encrypted traffic traces to the client.

[0063] A computer-readable storage medium storing a computer program that, when executed by a processor, implements a website fingerprinting defense method against encrypted proxies.

[0064] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, which, when executed by the processor, implements a website fingerprinting defense method against encrypted proxies.

[0065] Beneficial effects

[0066] This invention provides a website fingerprinting defense method for encrypted proxies. By constructing a set of heterogeneous attack models, designing a general adversarial perturbation generation mechanism based on sequential integration optimization, and combining it with a lightweight real-time perturbation injection strategy, it achieves cross-traffic generalization capability and strong robustness across models with low resource overhead. It effectively balances the contradiction between defense effectiveness, real-time performance, and practicality, providing a deployable, sustainable, and scalable proactive defense solution for user privacy protection. It solves the problem of existing defense mechanisms struggling to balance generalization, real-time performance, and resource overhead.

[0067] To achieve low defense overhead, this invention leverages the high sensitivity of deep learning-based website fingerprinting models to adversarial examples and proposes a low-overhead defense strategy. By injecting carefully designed micro-perturbations into the communication link between the client and the encrypted proxy, the attack model misclassifies the user's actual traffic trajectory as other websites, thereby effectively concealing the user's browsing intent.

[0068] To enhance the cross-traffic generalization capability and robustness against unknown attack models of adversarial perturbations, this invention proposes an adversarial perturbation generation method based on sequential ensemble optimization. This method constructs a proxy model set containing various structurally heterogeneous website fingerprint attack models and jointly optimizes and generates a website-level general adversarial perturbation for each target website. This perturbation, after design, can be applied to different access sessions of the target website and still possesses effective misleading capabilities against website fingerprint attack models not encountered during training, thereby achieving robust defense against unknown attackers.

[0069] Furthermore, this invention designs a lightweight real-time perturbation injection mechanism, combining a website-level general adversarial perturbation pre-computed and stored during the training phase as an executable shaping rule. This perturbation can achieve online perturbation injection during encrypted communication without needing to know the complete traffic trajectory in advance, avoiding the high computational overhead of online perturbation generation, and significantly improving practicality and deployment efficiency. Attached Figure Description

[0070] Figure 1 This is a sequence diagram of the method of the present invention;

[0071] Figure 2 This is a logical structure diagram of the present invention;

[0072] Figure 3 This is the real-time injection diagram based on universal perturbation in this invention;

[0073] Figure 4 A schematic diagram illustrating real-time perturbation injection and website fingerprinting defense. Detailed Implementation

[0074] To provide a better understanding of the structural features and effects achieved by the present invention, a detailed description is provided below, accompanied by preferred embodiments and accompanying drawings:

[0075] This invention proposes a method, system, and device for defending against website fingerprinting attacks on encrypted proxies, enhancing users' privacy protection capabilities during encrypted communication and resisting various website fingerprinting attack models. The method flow is as follows: Figure 2 As shown, the process is mainly divided into three stages. The first stage is the selection of proxy website fingerprint attack models, which involves building and collecting multiple open-source implementations of website fingerprint attack models to form a proxy model set. The second stage is sequential integration and optimization, which uses a collaborative optimization strategy to jointly optimize the adversarial perturbations corresponding to each proxy website fingerprint attack model in the model set, generating a general perturbation for the target website. The third stage is real-time perturbation injection, which seamlessly integrates the generated general website perturbation into real-time website access traffic, ensuring that the perturbation injection does not significantly interfere with the normal operation of the network.

[0076] like Figure 1 As shown, the website fingerprinting defense method for encrypted proxies according to the present invention includes the following steps:

[0077] The first step is network traffic acquisition and preprocessing. In the website fingerprinting task, to model encrypted traffic and resist interference injection, the raw network traffic must first be preprocessed. This invention uses direction sequence (DS) as the basic traffic representation.

[0078] (1) Obtain the raw network traffic and preprocess it. The raw traffic trajectory is represented as: direction sequence ,

[0079] in, Indicates the first The total number of data packets contained in the track. Indicating the first position in the trajectory The transmission direction of each data packet. =+1 indicates that the data packet is sent from the client to the web server, and the data packet is transmitted out. =-1 indicates that the data packet is returned from the website server to the client, and the data packet is passed in.

[0080] (2) Convert the direction sequence into a burst sequence. A burst is defined as a set of consecutive data packets with the same direction. Each burst is described by its direction marker and the number of packets. Burst sequence Represented as:

[0081] ,

[0082] in, This indicates the total number of sudden events.

[0083] = , It's a sudden event of varying magnitude. Obtain the direction of the sudden event, and at the same time The number of packets corresponding to the burst sequence. Let j be the size of the j-th burst in the i-th burst sequence. This indicates the transmission direction of the m-th data packet in the j-th burst of the i-th burst sequence;

[0084] Zero-padding and tail-truncation normalization are applied to burst sequences to meet the fixed input length requirement. To further standardize the input format, all burst sequences are normalized by setting a maximum burst length. , like Then, zeros are padded to the end of the sequence until the length reaches the specified value. ;like Then keep the previous one. One burst occurs, the rest are truncated. This normalization strategy ensures that all traffic trajectories have the same input dimension, facilitating subsequent model identification and perturbation generation.

[0085] The second step is to construct a set of fingerprint attack models for proxy websites.

[0086] Choosing a suitable proxy website fingerprinting attack model is fundamental to ensuring the effectiveness of adversarial perturbations. Defenders can acquire a mainstream open-source website fingerprinting attack model and use it as a proxy model. By training this proxy model and utilizing its output to guide the generation of adversarial perturbations, the perturbations can possess targeted deception capabilities. However, in real-world deployment scenarios, the architecture of website fingerprinting attack models employed by attackers is highly uncertain and diverse. If the proxy model chosen by the defender differs significantly from the target model actually used by the attacker, the generated adversarial perturbations are likely to fail to effectively interfere with the target model's identification results, leading to defense failure. The root cause of this problem lies in the fact that traditional perturbation generation strategies heavily rely on the loss function and gradient information of the proxy model. When the proxy model structure is singular or overly specific, the perturbation direction during the optimization process is prone to overfitting to the model's unique feature representation, lacking generalization ability and robustness to other unknown models.

[0087] To address this issue, this invention proposes constructing a proxy model set using a variety of open-source website fingerprinting attack models with diverse structures. Currently, mainstream deep learning-based website fingerprinting attack models fall into two main categories: those based on Convolutional Neural Networks (CNNs) and those based on Transformers. CNN-based models are better at capturing local features, which correspond to the loading of different website resources such as HTML, CSS, and images. Transformer-based models possess stronger global modeling capabilities and excel at extracting contextual features related to resource loading order and overall communication structure from traffic sequences.

[0088] This invention integrates these two types of models into a unified proxy model set, and collaboratively optimizes adversarial perturbations. This ensures that the generated perturbations are not only effective for the models in the set, but also have stronger generalization capabilities, potentially covering unknown model structures used by potential attackers, and improving the effectiveness of defense in actual deployments.

[0089] (1) Select M website fingerprint attack models from the third-party models with open-source implementations, and set the proxy website fingerprint attack model set to include M website fingerprint attack models.

[0090] (2) Construct a set of fingerprint attack models for proxy websites, denoted as ,in, Indicates the first A fingerprint recognition model for agent websites, where M is the number of models in the set;

[0091] Using preprocessed normalized burst sequences as input features, and website category as the label, for each model... Perform independent supervised training. After training, each model... It can receive a traffic trajectory and output its predicted website category and its confidence level.

[0092] (3) Construct a website-level traffic trajectory set: targeting the website Collect multiple traffic trajectories generated under different access conditions to form a traffic trajectory set.

[0093] (4) Define website-level general perturbation optimization strategies:

[0094] Targeting the same website ,

[0095] Using traffic trajectory sets Fingerprint attack model set on proxy websites Joint perturbation optimization is performed on the website to generate a response. General-purpose adversarial perturbation The perturbation optimization problem is formalized as follows:

[0096] ,

[0097] in, The total loss across all traffic trajectories on the proxy website fingerprint attack model set can be expressed as: This is used to measure the overall obfuscation capability of a perturbation on the entire set of attack models. This represents the flow trajectory after the perturbation is applied. This represents the cross-entropy classification loss function. For target website The true label. To constrain the disturbance amplitude, the maximum bandwidth overhead required to control the disturbance is less than a set threshold. The disturbance In practice, it represents a set of executable traffic shaping rules that indicate the injection location and number of virtual packets.

[0098] (5) The original disturbance Initialized to a burst sequence of the original flow trajectory Zero sequences of the same length

[0099] .

[0100] The third step is the sequential ensemble optimization algorithm: the sequential ensemble optimization algorithm is used to optimize the attack model set to generate a universal website perturbation applicable to any traffic trajectory of the target website.

[0101] Because the defender does not know the fingerprint attack model of the target black-box website. Because of their internal structure and parameters, they cannot use the echelon information of the target model to optimize the perturbation. This invention relies on multiple known models from a proxy model set to evaluate the migration performance of perturbations, thereby indirectly optimizing the misleading effect of perturbations on unknown website fingerprint attack models. Furthermore, due to changes in the network environment, perturbations generated along a traffic trajectory... This approach may not be applicable to other traffic patterns on the same website. Therefore, this invention introduces a website-level universal perturbation optimization strategy during the perturbation generation process.

[0102] (1) In the outer loop phase, the fingerprint attack model set of the proxy website is evaluated before each round of optimization. The fingerprint recognition models of the Chinese agent website are randomly arranged in order to obtain different ordered sets. .

[0103] (2) Obtain an ordered set Subsequently, in the inner loop phase, a fingerprint recognition model based on each proxy website is used. Iterative optimization of the disturbance;

[0104] A cumulative optimization strategy based on historical model perturbations is adopted to gradually update the adversarial perturbations.

[0105] remember In ordered set In this study, the adversarial perturbation obtained by optimizing the fingerprint attack model of the first j proxy websites is used to fully utilize the previous... The perturbation information of the proxy website fingerprinting model, together with the adversarial perturbation and the initial perturbation, constitutes the current proxy website fingerprinting model. input set :

[0106]

[0107] (3) In order to sort the set The first in When performing perturbation optimization on the fingerprint recognition model of an agent website, the set and traffic trajectory set As input, the perturbation is updated using a cumulative averaging strategy. The perturbation is updated in the following form:

[0108] ,

[0109] in, This represents the learning rate updated with perturbation. Defined as trajectory Add perturbation Later in the proxy model loss function on, For each perturbation component in the perturbation input set. .

[0110] (4) The loss function includes two items: adversarial loss and bandwidth loss , represented as:

[0111] ,

[0112] Adversarial loss Measuring disturbances proxy model The degree of misleading, bandwidth loss Measure the current disturbance Required bandwidth overhead, These are weighting coefficients used to balance the degree of influence between two objectives, and represent bandwidth loss. Represent as =

[0113] (5) Application of disturbances Functions are used for control. The added service for function-controlled perturbation shall not exceed the maximum tolerable bandwidth overhead threshold. Meanwhile, the perturbation is controlled to be performed only in an "addition" manner, meaning the perturbation operation is only the injection of virtual data packets, and the total number of newly added data packets does not exceed a certain percentage of the original traffic. Proportion;

[0114] (6) After performing perturbation optimization on the M proxy website fingerprinting models in the proxy website fingerprinting attack model set, a set of perturbation sequences is obtained. ,

[0115] Final perturbation Aggregation is performed using a weighted strategy that incorporates historical data, and the calculation formula is as follows:

[0116] ,

[0117] in, ∈[0,1] is the fusion factor, which is used to control the weighting ratio between the newly generated perturbation and the original perturbation, control the smooth update of the new perturbation and the historical perturbation, and avoid oscillation.

[0118] (7) Dependence on ordered sets Each proxy website's fingerprinting model is used to verify the generated adversarial perturbations. The effectiveness of this is determined by updating the perturbation after each round of internal and external loop optimization iterations. Applied to websites Each training flow trajectory x∈ Generate corresponding adversarial examples If all proxy website fingerprinting models are effective against this adversarial sample... The success rate of generating misclassifications reaches the set success rate threshold parameter. If the perturbation optimization is complete, the perturbation is recorded. The iteration is terminated; the decision criteria are as follows:

[0119] ,

[0120] in, It is an indicator function, when the first Fingerprint recognition model for agent websites For the flow after the disturbance An error occurred, meaning the classification result is not the original label. hour, This indicates that the perturbation successfully misled the model; otherwise...

[0121] This represents the minimum number of misclassifications required for a successful perturbation across all proxy website fingerprinting models; this success rate threshold is... The size reflects the requirements for disturbance defense performance.

[0122] (8) If the perturbation success rate does not reach the threshold, proceed to the next round of sequential ensemble optimization algorithm iteration, and update the perturbation in this round. Set as initial perturbation Continue executing steps 41)-48) until the perturbation success rate termination condition is met.

[0123] (9) When the perturbation success rate meets the termination condition, a website-level general perturbation for the target website w is obtained. The generated general perturbation In reality, it is a set of lightweight shaping rules for all traffic trajectories in the target website w, including trigger conditions (reaching the specified injection location) and response actions (inserting a specified number of virtual data packets).

[0124] The fourth step is to inject real-time perturbations and implement website fingerprinting defense: When a potential attacker launches a website fingerprinting attack, they collect data packets from the encrypted link between the client and the encrypted proxy. The attacker captures the traffic of the target client connecting to the encrypted proxy and uses a classifier to predict the website the client is visiting. Website fingerprinting defense is deployed on the client and encrypted proxy nodes. Defense traffic is generated by injecting virtual data packets or delaying real data packets. In this way, the traffic captured by the attacker is interfered with, making it difficult for their classifier to accurately identify the website visited by the user, thus achieving website fingerprinting defense.

[0125] To effectively defend against website fingerprinting attacks while ensuring system usability and real-time performance, this invention proposes a real-time perturbation injection mechanism. This mechanism allows clients and encrypted proxy nodes to quickly inject pre-generated general perturbations into real-time traffic during website access without needing to calculate perturbations in real time, thereby misleading attackers and concealing the user's true access intent.

[0126] This invention first calculates a website-level general adversarial perturbation for each protected website. The general perturbation contains two key elements: injection location and injection quantity. The injection location indicates the specific position in the original traffic burst sequence where the perturbation should be injected, and the injection quantity indicates how many virtual data packets should be inserted at the corresponding position. This perturbation is distributed to the client terminal and its corresponding encrypted proxy node during the system initialization phase, allowing both parties to obtain complete perturbation information before the actual website session arrives. In this way, the defense system can implement a preprocessing mechanism with no computational delay, improving practicality. The specific real-time injection method is as follows: Figure 3 and Figure 4 As shown.

[0127] (1) The website-level general disturbance δ obtained by the target website w is pre-stored in the disturbance database of the defense system. The injection position of the website-level general disturbance indicates the specific position of the disturbance injected into the original traffic burst sequence, and the injection quantity indicates the virtual data packet that should be inserted at the corresponding position. Through the injection position and injection quantity, δ is mapped to any traffic trajectory that accesses the target website w.

[0128] (2) When the client actually accesses a website, the client checks whether the current browsing session belongs to the protected website in the monitoring list. If so, the client browser obtains the injection location and injection quantity information of the virtual data packet according to the website-level general adversarial disturbance corresponding to the website.

[0129] (3) In the sending direction from the client to the website, when the corresponding injection position is reached, the client first caches the real data packet that will be sent at the injection position, and then inserts the virtual data packet after the real data packet according to the injection quantity, and sends the encrypted traffic trajectory with added perturbation to the encrypted proxy node;

[0130] When the encryption proxy receives perturbed encrypted traffic from the client, it identifies and removes the appended virtual data packets based on the website-level general perturbation δ, and forwards the restored real traffic to the target website server.

[0131] (4) In the direction of sending from the website to the client, the encrypted proxy uses the same injection method to generate encrypted traffic traces to the client.

[0132] On the receiving side, when the encryption proxy receives perturbed encrypted traffic from the client, it identifies and removes the added virtual data packets based on the same general perturbation information, and forwards the restored real traffic to the target website server, ensuring that the integrity of the business content or protocol logic is not affected. Through the above process, the perturbation insertion operation is performed at the end of the burst in the real traffic trajectory, without introducing any new bursts on the actual website access path, resulting in additional round-trip time (RTT).

[0133] Furthermore, to cover the entire communication path, this invention performs perturbation injection and restoration operations on both the client and the encrypted proxy sides. In this way, the defense system can symmetrically cover the entire data path throughout the session, thereby maximizing the effectiveness of website fingerprint defense. Ultimately, the traffic trajectory captured by a potential attacker located between the client and the encrypted proxy will contain false features injected by the general perturbation, causing the attacker's model to produce incorrect classification results, effectively protecting user access privacy.

[0134] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A method for website fingerprinting defense against encryption proxies, characterized in that, Includes the following steps: 11) Network traffic acquisition and preprocessing; 12) Construction of a set of fingerprint attack models for proxy websites; 13) Implement the sequential ensemble optimization algorithm: Optimize the attack model set using the generative sequential ensemble optimization algorithm to generate a general website perturbation; The implementation sequence integration optimization algorithm includes the following steps: 131) In the outer loop phase, before each round of optimization begins, the fingerprint attack model set of the proxy website is analyzed. The fingerprint recognition models of the Chinese agent website are randomly arranged in order to obtain different ordered sets. ; 132) Obtain an ordered set Subsequently, in the inner loop phase, a fingerprint recognition model based on each proxy website is used. Iterative optimization of the disturbance; A cumulative optimization strategy based on historical model perturbations is adopted to gradually update the adversarial perturbations. remember In ordered set In this study, the adversarial perturbation obtained by optimizing the fingerprint attack model of the first j proxy websites is used to fully utilize the previous... The perturbation information of the proxy website fingerprinting model, together with the adversarial perturbation and the initial perturbation, constitutes the current proxy website fingerprinting model. input set : ； 133) In order of sorted sets The first in When performing perturbation optimization on the fingerprint recognition model of an agent website, the set and traffic trajectory set As input, the perturbation is updated using a cumulative averaging strategy. The perturbation is updated in the following form: ， in, This represents the learning rate updated with perturbation. Defined as trajectory Add perturbation Later in the proxy model loss function on, For each perturbation component in the perturbation input set. ; 134) The loss function includes two items: adversarial loss. and bandwidth loss , represented as: ， Adversarial loss Measuring disturbances proxy model The degree of misleading, bandwidth loss Measure the current disturbance Required bandwidth overhead, These are weighting coefficients used to balance the degree of influence between two objectives, and represent bandwidth loss. Represent as = ; 135) Application of disturbances Functions are used for control. The added service for function-controlled perturbation shall not exceed the maximum tolerable bandwidth overhead threshold. Meanwhile, the disturbance is controlled to be added only; 136) After performing perturbation optimization on M proxy website fingerprinting models within the proxy website fingerprinting attack model set, a set of perturbation sequences is obtained. , Final perturbation Aggregation is performed using a weighted strategy that incorporates historical data, and the calculation formula is as follows: ， in, ∈[0,1] is the fusion factor, used to control the weighting ratio between the newly generated perturbation and the original perturbation; 137) Dependence on ordered sets Each proxy website's fingerprinting model is used to verify the generated adversarial perturbations. The effectiveness of this is determined by updating the perturbation after each round of internal and external loop optimization iterations. Applied to websites Each training flow trajectory x∈ Generate corresponding adversarial examples ; If all proxy website fingerprinting models are effective against this adversarial sample The success rate of generating misclassifications reaches the set success rate threshold parameter. If the perturbation optimization is complete, the perturbation is recorded. The iteration is terminated; the decision conditions are as follows: ， in, It is an indicator function, when the first Fingerprint recognition model for agent websites For the flow after the disturbance Incorrect classification result; the classification result is not the original label. hour, This indicates that the perturbation successfully misled the model; otherwise... ; This represents the minimum number of misclassifications required for a successful perturbation across all proxy website fingerprinting models; this success rate threshold is... The size reflects the requirements for disturbance defense performance; 138) If the perturbation success rate does not reach the threshold, proceed to the next round of iteration of the sequential ensemble optimization algorithm, and update the perturbation in this round. Set as initial perturbation Continue executing steps 131)-138) until the perturbation success rate termination condition is met; 139) Once the perturbation success rate meets the termination condition, a website-level general perturbation for the target website W is obtained. ; 14) Real-time perturbation injection and website fingerprinting defense: When a potential attacker launches a website fingerprinting attack, they collect data packets from the encrypted link between the client and the encrypted proxy node. The attacker captures the traffic of the target client connecting to the encrypted proxy node and uses a classifier to predict the website the client is visiting. Website fingerprinting defense is deployed on the client and the encrypted proxy node. Based on the perturbation location and perturbation size information of the general website perturbation indication, virtual data packets or delayed real data packets are injected to generate defense traffic. In this way, the traffic captured by the attacker is interfered with, making it difficult for their classifier to accurately identify the website visited by the user, thus achieving online website fingerprinting defense.

2. The website fingerprinting defense method for encrypted proxies according to claim 1, characterized in that, The network traffic acquisition and preprocessing includes the following steps: 21) Obtain the raw network traffic, preprocess the raw network traffic, and represent the raw traffic trajectory as: direction sequence , in, Indicates the first The total number of data packets contained in the track. Indicating the first position in the trajectory The transmission direction of each data packet. =+1 indicates that the data packet is sent from the client to the web server, and the data packet is transmitted out. =-1 indicates that the data packet is returned from the website server to the client, and the data packet is passed in; 22) Convert the directional sequence into a burst sequence. A burst is defined as a set of consecutive data packets with the same direction. Each burst is described by its direction marker and the number of packets. Burst sequence Represented as: ， in, This indicates the total number of sudden events. = , It's a sudden event of varying magnitude. Obtain the direction of the sudden event, and at the same time The number of packets corresponding to the burst sequence. Let the direction magnitude be the j-th burst of the i-th burst sequence. This indicates the transmission direction of the m-th data packet in the j-th burst of the i-th burst sequence; Zero-padding and tail-truncation normalization operations are applied to the burst sequence to make it meet the fixed burst input length requirement.

3. The website fingerprinting defense method for encrypted proxies according to claim 1, characterized in that, The construction of the proxy website fingerprint attack model set includes the following steps: 31) Select M website fingerprint attack models from third-party models with publicly available open-source implementations, and set the proxy website fingerprint attack model set to include M website fingerprint attack models; 32) Construct a set of fingerprint attack models for proxy websites, denoted as ,in, Indicates the first A fingerprint recognition model for agent websites, where M is the number of models in the set; Train fingerprint attack models for M websites respectively; 33) Construct a website-level traffic trajectory set: For the target website W, collect multiple traffic trajectories generated under different access conditions to form a traffic trajectory set. ; 34) Define a website-level general perturbation optimization strategy: For the same target website W, Using traffic trajectory sets Fingerprint attack model set on proxy websites Joint perturbation optimization is performed on the website to generate a response. General-purpose adversarial perturbation The perturbation optimization problem is formalized as follows: ， in, express All traffic traces in the proxy website fingerprint attack model set Total losses on This represents the optimized traffic trajectory. To constrain the disturbance amplitude, the maximum bandwidth overhead required to control the disturbance is less than a set threshold. ; 35) The original disturbance Initialized to the normalized burst sequence Zero sequences of the same length 。 4. The website fingerprinting defense method for encrypted proxies according to claim 1, characterized in that, The real-time perturbation injection and website fingerprinting defense implementation includes the following steps: 41) The website-level general disturbance δ obtained from the target website W is pre-stored in the disturbance database of the defense system. The injection position of the website-level general disturbance indicates the specific position of the disturbance injection in the original traffic burst sequence, and the injection quantity indicates the virtual data packet that should be inserted at the corresponding position. Through the injection position and injection quantity, δ is mapped to any traffic trajectory that accesses the target website W. 42) When a client actually accesses a website, the client checks whether the current browsing session belongs to a protected website in the monitoring list. If so, the client browser obtains the injection location and injection quantity information of virtual data packets based on the website-level general adversarial perturbation corresponding to that website. 43) In the sending direction from the client to the website, when the corresponding injection position is reached, the client first caches the real data packet that is about to be sent at the injection position, and then inserts the virtual data packet after the real data packet according to the injection quantity, and sends the encrypted traffic trajectory with added perturbation to the encrypted proxy node; When the encrypted proxy node receives the perturbed encrypted traffic from the client, it identifies and removes the virtual data packets appended to the tail based on the website-level general perturbation δ, and forwards the restored real traffic to the target website server. 44) In the direction of sending traffic from the website to the client, the encrypted proxy node uses the same injection method to send the encrypted traffic trajectory to the client.

5. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the website fingerprinting defense method for encrypted proxies as described in any one of claims 1-4.

6. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, which, when executed by the processor, implements the website fingerprinting defense method for encrypted proxies as described in any one of claims 1-4.

Images