A multi-granularity anonymous user traffic identification method, device and medium

Abstract

This invention discloses a multi-granularity anonymous user traffic identification method, apparatus, and medium. The method includes: acquiring internet traffic; and performing identification and separation processing on the internet traffic according to a multi-feature filtering model to obtain the traffic of anonymous users accessing the dark web. The multi-feature filtering model consists of three layers of filters: the first and third layers are constructed based on Tor traffic features and dark web service features, respectively, while the second layer is constructed based on a binary classifier. This invention proposes a multi-granularity anonymous user traffic identification method, apparatus, and medium. Through a layered filtering design, each layer of filter can perform preliminary or further screening of traffic within its area of ​​expertise. This progressively refined processing helps reduce false positives and false negatives, improves the overall accuracy of identification, and solves the problem of separating anonymous user traffic accessing the dark web from internet traffic.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and in particular to a method, apparatus and medium for identifying multi-granularity anonymous user traffic. Background Technology

[0002] In the current network environment, the widespread use of anonymous communication technologies (such as Tor and I2P) and the dark web has made traffic separation one of the core challenges in the field of network security. Separating anonymous user traffic from dark web traffic from internet traffic is a core technology for balancing network security defense, crime fighting, and privacy protection. It not only requires overcoming the battle between encryption and obfuscation technologies but also achieving multi-objective optimization in terms of efficiency, accuracy, and ethics. Current technologies mainly address the challenge of dark web traffic separation through a three-pronged approach: multi-dimensional feature layered extraction, proactive detection and reverse engineering to break obfuscation, and dynamic classification using machine learning models.

[0003] However, existing technical frameworks are limited in their ability to separate anonymous user access to dark web and light web traffic due to limitations in the accuracy of multi-dimensional feature extraction, the scalability bottlenecks of active detection and reverse engineering, and the adaptive limitations of machine learning models to dynamic traffic patterns. This makes it difficult for them to effectively address core challenges, including dynamic masquerading and countermeasures, ultimately resulting in limited separation performance. Summary of the Invention

[0004] This invention provides a multi-granularity anonymous user traffic identification method, device, and medium to solve the problem of difficulty in separating anonymous user traffic accessing the dark web from Internet traffic.

[0005] To achieve the above objectives, this application provides a multi-granularity anonymous user traffic identification method, comprising:

[0006] Acquire internet traffic;

[0007] The internet traffic is identified and separated using a multi-feature filtering model to obtain the traffic of anonymous users accessing the dark web. The multi-feature filtering model consists of three layers of filters: the first and third layers are constructed based on Tor traffic features and dark web service features, respectively, and the second layer is constructed based on a binary classifier.

[0008] This invention constructs a multi-feature filtering model consisting of three layers of filters, fully utilizing the complementarity of Tor traffic features, binary classifiers, and dark web service features to achieve efficient and accurate identification and separation of internet traffic. The Tor network, as the primary channel for accessing the dark web, exhibits unique traffic characteristics. By accurately extracting these features and constructing the first-layer filter, most Tor traffic can be efficiently identified, helping to initially distinguish Tor traffic from ordinary internet traffic. Since Tor traffic may be obfuscated to evade detection, more complex classification techniques are required. The second-layer filter employs a binary classifier, which, by learning the feature differences between known Tor traffic and normal traffic, can further distinguish obfuscated Tor traffic. Dark web services typically exhibit specific behavioral patterns. By extracting these behavioral features and constructing the third-layer filter, the portion of Tor traffic accessing dark web services can be distinguished from the portion accessing legitimate Tor services. This approach ensures a high degree of accuracy in the final separated dark web traffic. It is evident that each of the three layers of filters has its own function and none can be omitted. The absence of the first layer will increase the amount of computation and introduce data noise; the absence of the second layer will make it impossible to distinguish Tor from other traffic; and the absence of the third layer will make it impossible to determine whether Tor traffic is accessing the dark web. Therefore, only when the three layers of filters work together can the traffic of anonymous users accessing the dark web be effectively separated.

[0009] Compared to existing technologies, this invention uses a layered filtering design, where each filter can perform preliminary or further screening of traffic within its area of ​​expertise. This progressively refined processing helps reduce false positives and false negatives, and improves the overall accuracy of identification. Therefore, it can solve the problem of separating anonymous user traffic accessing the dark web from Internet traffic.

[0010] As a preferred approach, the internet traffic is identified and separated using a multi-feature filtering model to obtain the traffic of anonymous users accessing the dark web, specifically:

[0011] The Internet traffic is identified and separated based on the first layer filter of the multi-feature filtering model to obtain native Tor traffic and first remaining traffic data.

[0012] The first remaining traffic data is identified and separated according to the second layer filter of the multi-feature filtering model to obtain Tor traffic using obfuscation technology;

[0013] The third layer filter of the multi-feature filtering model is used to identify and separate the native Tor traffic and the Tor traffic using obfuscation techniques, filtering out the traffic accessing the open network and obtaining the traffic of the anonymous user accessing the dark network.

[0014] This preferred solution can quickly narrow down the target traffic range through layer-by-layer filtering, thereby reducing unnecessary processing and analysis work, which helps to improve the efficiency and real-time performance of data processing.

[0015] As a preferred embodiment, the internet traffic is identified and separated based on the first layer filter of the multi-feature filtering model to obtain native Tor traffic and first remaining traffic data, specifically as follows:

[0016] Based on the first layer filter of the multi-feature filtering model, unknown traffic data packets are captured from the Internet traffic;

[0017] Feature extraction is performed on the unknown traffic data packets to obtain data features;

[0018] In the data features, data that matches fingerprints in the fingerprint database is defined as the native Tor traffic, and data that does not match fingerprints in the fingerprint database is defined as the first remaining traffic data.

[0019] This preferred solution extracts key features from unknown traffic, which can reduce data dimensionality and data interference. By matching with fingerprints in the fingerprint database, the system can quickly identify data packets that match the characteristics of native Tor traffic. This rapid identification capability is of great significance for real-time monitoring and response to potential threats in the network.

[0020] As a preferred embodiment, the first remaining traffic data is identified and separated according to the second layer filter of the multi-feature filtering model to obtain Tor traffic using obfuscation technology, specifically:

[0021] Based on the second layer filter of the multi-feature filtering model, the entropy features corresponding to the obfuscation technique are extracted from the first remaining traffic data to obtain the target entropy feature set.

[0022] The target entropy feature set is classified and predicted based on the trained classifier to obtain the prediction result;

[0023] Based on the prediction results, the Tor traffic using obfuscation technology is obtained from the first remaining traffic data.

[0024] This preferred solution separates Tor traffic using obfuscation techniques, avoiding redundant analysis of mixed traffic in subsequent processing steps and improving system efficiency.

[0025] As a preferred solution, the first and third layer filters are constructed based on Tor traffic characteristics and dark web service characteristics, respectively, as follows:

[0026] With the goal of identifying native Tor traffic, a first-layer filter is established by combining a fingerprint database; wherein, the fingerprint database includes fingerprints of Tor traffic and fingerprints of preset normal traffic;

[0027] With the goal of separating traffic accessing the dark web, the third layer filter is established by combining several decision trees.

[0028] This preferred solution, by combining a fingerprint database, enables the first-layer filter to quickly and accurately identify native Tor traffic. This feature-matching-based method significantly improves identification efficiency when processing large amounts of network traffic data. The third-layer filter, built by combining several decision trees, utilizes the combination of multiple weak classifiers to improve classification accuracy, thereby more accurately separating traffic accessing the dark web.

[0029] As a preferred approach, with the goal of identifying native Tor traffic, the first layer of filter is established using a fingerprint database, specifically as follows:

[0030] Obtain historical traffic data, and statistically obtain a first feature set based on the packet length of Tor traffic in the historical traffic data;

[0031] Based on the first feature set, fingerprint information of Tor traffic and fingerprint information of preset normal traffic are configured respectively, and the fingerprint database is generated based on the fingerprint information of Tor traffic and the fingerprint information of preset normal traffic.

[0032] According to a preset method, with the goal of identifying native Tor traffic, the first layer of filter is established by combining the fingerprint database.

[0033] In this preferred embodiment, the Tor network, due to its specific communication protocol and encryption methods, often exhibits a unique pattern in the length distribution of its data packets. By calculating the characteristics of this data packet length distribution, these unique properties can be effectively captured for identifying Tor traffic. The fingerprint database contains fingerprints of both Tor traffic and preset normal traffic, designed based on in-depth analysis of both types of traffic. Therefore, during the identification process, the filter can more accurately distinguish between Tor traffic and normal traffic, thereby reducing the possibility of false positives and false negatives.

[0034] As a preferred approach, with the goal of separating traffic accessing the dark web, the third-layer filter is established by combining several decision trees, specifically as follows:

[0035] Obtain transmission characteristic data from the Onion service; wherein, the transmission characteristic data includes the timestamp of the outgoing data packet, the number of incoming burst bytes, and the maximum outgoing burst;

[0036] A predictive model is constructed by using a gradient boosting classifier and combining several decision trees as weak learners.

[0037] With the goal of separating traffic accessing the dark web, the prediction model is trained based on the transmission characteristic data, and the trained model is defined as the third layer filter.

[0038] This preferred solution obtains transmission characteristic data from the Onion service, including outgoing packet timestamps, incoming burst byte counts, and maximum outgoing burst size. This transmission characteristic data provides important clues about network traffic behavior, helping to identify traffic accessing the dark web. Gradient boosting classifiers are efficient and powerful ensemble learning techniques. This solution combines multiple weak learners to build a strong learner, which can significantly reduce model bias and variance, thereby improving classification accuracy and robustness.

[0039] As a preferred approach, the second-layer filter is constructed based on a binary classifier, specifically as follows:

[0040] Extract the target entropy feature set from traffic data;

[0041] With the goal of separating Tor traffic using obfuscation techniques, the binary classifier is trained based on the target entropy feature set, and the trained classifier is defined as the second layer filter; wherein, the binary classifier is a support vector machine classifier.

[0042] In this preferred solution, since Tor users may use various obfuscation techniques to hide their traffic characteristics, the classifier needs to be adaptable to obfuscation techniques. By extracting entropy features related to the target obfuscation technique and training a support vector machine classifier, it is possible to effectively identify different obfuscation techniques and improve the generalization ability of the classifier.

[0043] This application also provides a multi-granularity anonymous user traffic identification device, including a traffic module and an identification module;

[0044] The traffic module is used to acquire internet traffic.

[0045] The identification module is used to identify and separate the Internet traffic according to a multi-feature filtering model to obtain the traffic of anonymous users accessing the dark web; wherein, the multi-feature filtering model consists of three layers of filters, the first layer filter and the third layer filter are constructed based on Tor traffic features and dark web service features, respectively, and the second layer filter is constructed based on a binary classifier.

[0046] This application also provides a storage medium storing a computer program, which is called and executed by a computer to implement the multi-granularity anonymous user traffic identification method described above. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating a multi-granularity anonymous user traffic identification method provided in an embodiment of this application;

[0048] Figure 2 This is a schematic diagram of the structure of a multi-granularity anonymous user traffic identification device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] In the description of this application, it should be understood that the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first," "second," and "third" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "several" means two or more.

[0051] The multi-granularity anonymous user traffic identification method provided in this application is mainly used to solve the problem of multi-granularity anonymous user traffic identification, and aims to separate the traffic of anonymous users accessing the dark web from Internet traffic.

[0052] Example 1:

[0053] Please see Figure 1 The embodiments of this application provide a multi-granularity anonymous user traffic identification method, including S1 to S2, and the specific implementation steps are as follows:

[0054] S1. Obtain internet traffic.

[0055] Step S1 in this embodiment of the application is specifically as follows:

[0056] Use professional network traffic monitoring software or hardware devices to obtain Internet traffic; Internet traffic is a comprehensive collection of data packets containing rich information, such as source address, destination address, port number, protocol type, packet size, timestamp, etc.

[0057] S2. Based on the multi-feature filtering model, the Internet traffic is identified and separated to obtain the traffic of anonymous users accessing the dark web. The multi-feature filtering model consists of three layers of filters. The first and third layers of filters are constructed based on Tor traffic features and dark web service features, respectively, and the second layer of filters is constructed based on a binary classifier.

[0058] Step S2 in this embodiment includes S2.1 to S2.3, specifically as follows:

[0059] S2.1. Based on the first layer filter of the multi-feature filtering model, capture unknown traffic data packets from Internet traffic;

[0060] Feature extraction is performed on unknown traffic data packets to obtain a data feature set;

[0061] Several fingerprints are generated based on the data feature set and compared with fingerprints in the fingerprint database. If they match, the network flow is defined as native Tor traffic (i.e., Tor traffic without obfuscation technology). If they do not match, the network flow is defined as the first remaining traffic data. Here, "Tor traffic" refers to data traffic transmitted through the Tor (The Onion Router) network, which is an encrypted communication network designed to protect user anonymity and privacy.

[0062] By iterating through all network flows in the Internet traffic, repeating the above feature extraction, classification prediction and labeling process, we can obtain the original Tor traffic and the first remaining traffic data.

[0063] In this embodiment, S2.1 extracts key features from unknown traffic, which can reduce data dimensionality and reduce data interference. By matching with fingerprints in the fingerprint database, the system can quickly identify data packets that match the characteristics of native Tor traffic. This rapid identification capability is of great significance for real-time monitoring and response to potential threats in the network.

[0064] S2.2. Based on the second layer filter of the multi-feature filtering model, extract the entropy features corresponding to the obfuscation technique from the first remaining traffic data to obtain the target entropy feature set;

[0065] In the second filter layer, the target entropy feature set is classified and predicted according to the trained classifier to obtain the prediction result;

[0066] Based on the classifier's prediction results, determine whether several traffic flows in the first remaining traffic data are Tor traffic using obfuscation techniques (such as obfs, snowflakes, meek, etc.); if so, reclassify the traffic and define it as Tor traffic using obfuscation techniques; if not, further processing or filtering is required depending on the specific circumstances.

[0067] Traverse all network flows in the first remaining traffic data, repeat the above feature extraction, classification prediction and labeling process to obtain Tor traffic using obfuscation techniques; where "obfuscation techniques" in the field of network communication, especially in anonymous communication systems such as Tor networks, refer to a series of methods used to hide or obscure the true characteristics of communication traffic.

[0068] In this embodiment, S2.2 separates the Tor traffic using obfuscation technology, avoiding redundant analysis of the mixed traffic in subsequent processing steps and improving system efficiency.

[0069] S2.3 Extract feature sets from native Tor traffic and Tor traffic using obfuscation techniques based on the third layer filter of the multi-feature filtering model;

[0070] In the third layer filter, the feature set is input into the trained prediction model for classification prediction to obtain the prediction result;

[0071] Based on the prediction results of the prediction model, determine whether certain traffic in the native Tor traffic and Tor traffic using obfuscation technology is traffic accessing the Tor service (i.e., the dark web); if so, mark the traffic as traffic of anonymous users accessing the dark web; if not, mark the traffic as traffic accessing the plain web.

[0072] Iterate through all traffic in both native Tor traffic and Tor traffic using obfuscation techniques, repeating the above feature extraction, classification prediction, and labeling process, filtering out traffic accessing the clear web, to obtain traffic from anonymous users accessing the dark web.

[0073] The multi-feature filtering model consists of three layers of filters. The first and third layers are built based on Tor traffic features and dark web service features, respectively, while the second layer is built based on a binary classifier. The three layers of filters in the multi-feature filtering model are explained in detail below:

[0074] ① First layer filter:

[0075] Historical traffic data is preprocessed. First, Deep Packet Inspection (DPI) is used for feature extraction. Specifically, key information such as Cipher Suites and extended fields are extracted from packets during the TLS (Transport Layer Security) handshake phase. Then, the packet lengths in Tor traffic are statistically analyzed, and their distribution characteristics are examined. Simultaneously, the time intervals between packets are recorded, and relevant statistical characteristics are calculated, including average time interval, maximum time interval, and minimum time interval. After these steps, a first feature set containing these features is obtained; where "Cipher Suites" refers to a set of algorithms used by the Transport Layer Security protocol to specify cipher suites.

[0076] Based on the first feature set, fingerprints for Tor traffic and preset normal traffic are configured separately, and a fingerprint database is built based on these configured fingerprints. Furthermore, in constructing this fingerprint database, two types of fingerprints need to be fully considered: static fingerprints based on fixed or stable features, and dynamic fingerprints based on time fluctuations or statistical characteristics. Therefore, the fingerprint database comprehensively covers the fingerprint information of both Tor traffic and preset normal traffic. The "fingerprints of preset normal traffic" refer to a set of feature identifiers designed to identify and distinguish normal (i.e., non-Tor) network traffic. These fingerprints are created based on a deep understanding of normal behavior or characteristics in network traffic, and they may reflect typical characteristics of normal traffic in terms of packet structure, protocol usage, data transmission rate, packet length distribution, and time interval statistics.

[0077] Following a pre-defined approach, with the goal of identifying native Tor traffic, a first-layer filter is established using a fingerprint database. The pre-defined approach includes: designing and implementing the first-layer filter based on the fingerprint database; the filter should be able to receive network traffic data, extract relevant features, and match them with fingerprints in the database; implementing an efficient matching algorithm to ensure the filter can process network traffic data in real time and accurately identify native Tor traffic; considering the potential overlap or ambiguous boundaries between Tor traffic and normal traffic, the filter may need to employ certain thresholds or decision rules to determine whether a traffic item belongs to Tor traffic.

[0078] The method for configuring Tor traffic fingerprint information is as follows: Select features highly correlated with Tor traffic from a first feature set. These features may be specific statistics of packet length (such as mean, standard deviation, maximum, minimum, etc.) or distribution patterns of packet length. Quantize the selected features, converting them into numerical or discrete feature values. Generate Tor traffic fingerprint information based on the quantized feature values. This typically involves combining feature values ​​into a unique identifier or pattern that represents the characteristics of Tor traffic. The method for configuring preset normal traffic fingerprint information is similar to configuring Tor traffic fingerprint information: Select features highly correlated with preset normal traffic from a first feature set. These features should reflect the typical behavior or characteristics of normal traffic. Quantize the selected features and generate preset normal traffic fingerprint information based on the quantized feature values ​​(the generation process is similar to that of Tor traffic fingerprint information).

[0079] In this embodiment, regarding the establishment of the first-layer filter, the Tor network, due to its specific communication protocol and encryption methods, often exhibits a unique pattern in the length distribution of its data packets. By calculating the length distribution characteristics of the data packets, these unique properties can be effectively captured, thereby enabling the identification of Tor traffic. The fingerprint database contains fingerprints of Tor traffic and preset normal traffic, designed based on in-depth analysis of both types of traffic. Therefore, during the identification process, the filter can more accurately distinguish between Tor traffic and normal traffic, thereby reducing the possibility of false alarms and missed alarms.

[0080] ② Second layer filter:

[0081] Based on traffic data, a target entropy feature set is extracted from different types of obfuscated Tor traffic. This set includes the entropy value of the first message, the entropy of the URI (Uniform Resource Identifier) ​​in the HTTP GET message, the information entropy of the sent / received message lengths (and additional relative entropy features specific to Meek obfuscation techniques). Here, an "HTTP GET message" is a "request message" sent by a client (such as a browser) when requesting resources from a server. "Meek obfuscation techniques" are an advanced obfuscation technique used in the Tor network to increase the anonymity and censorship resistance of Tor communication. Specifically:

[0082] ① Entropy value of the first message:

[0083] Traditional first-message entropy calculation ignores the multi-scale characteristics of time series. To be suitable for distinguishing confused Tor traffic, this embodiment adopts a multi-scale relative entropy (MRE) approach. First, a multi-scale adaptive binning strategy is implemented, dynamically grouping the first-message according to its length, such as dividing it into 16 short groups and 32 long groups. The grouping formula is as follows:

[0084]

[0085] Subsequently, the relative entropy D is calculated. KL (P||Q) is the Kullback-Leibler (KL) divergence between the probability distribution P and the uniform distribution Q. The formula used for calculation is:

[0086]

[0087] Finally, by weighted summing of the KL divergences at multiple scales, the weighted multi-scale relative entropy (the first message entropy value) is obtained, namely:

[0088]

[0089] Where L is the message length and Bins(τ) is the number of bins; n is the number of data points falling into the binning interval. T represents the number of time scales; τ takes values ​​from 1 to T, representing the traversal from the 1st time scale to the Tth time scale; ω τ This represents the weighting coefficient at the t-th time scale.

[0090] ② Entropy of the URI in an HTTP GET message:

[0091] To meet the specific requirements of this embodiment, a dynamic window arrangement entropy method is adopted. This method follows these steps: First, a sliding window (recommended window size 3-5 characters) is used to divide the URI into multiple parts; next, for the characters within each window, their arrangement pattern π (e.g., ascending or descending order) is determined; then, the standard deviation SD(π) of these arrangement patterns is calculated to quantify their dispersion. Finally, the entropy of the URI in the HTTP GET message is calculated based on the above parameters. The specific entropy calculation formula is as follows:

[0092]

[0093] Where π represents the arrangement pattern of characters within the window; SD(π) is the standard deviation of the pattern; the size of Π is determined by the window length m and is the factorial of m; P(π) is the probability of a specific arrangement pattern π appearing in the entire time series; β is the second weighting coefficient, used to adjust the contribution ratio of the standard deviation of the pattern to the final entropy value.

[0094] ③ Information entropy of the sent / received message length:

[0095] Traditional methods calculate the length entropy in both the sending and receiving directions independently. Obfuscation strategies such as Meek obfuscation mask features by shaping bidirectional traffic. This embodiment uses Joint Distribution Entropy (JDE) to statistically analyze the joint probability distribution of sending and receiving message length pairs, thereby capturing the statistical dependencies of bidirectional interactions.

[0096]

[0097] Subsequently, by using a sliding window with a time window of 10 seconds, the standard deviation of the joint distribution entropy is calculated to detect periodic disturbances in the traffic, thereby obtaining the information entropy of the sent / received message length, i.e.:

[0098]

[0099] Among them, L in It is the input message length, L out It is the output message length, P(L) in ,L out ) represents the probability that a specific input length and output length co-occur within a statistical time period; T is the entire time period, t is the time window, and JDE t The joint distribution entropy, μ, is the value within a specific time window. JDE It is the mean of the joint distribution entropy.

[0100] ④ Additional relative entropy features specific to Meek obfuscation techniques (i.e., obfuscation technique-specific relative entropy):

[0101] To analyze the Tor traffic distribution characteristics under obfuscation methods such as Meek and Obfs, and using Jason-Shannon divergence (JS divergence), we compare and analyze the differences between the actual traffic distribution and the baseline distribution.

[0102]

[0103] in, Q represents a known Meek traffic template distribution, and D... KL (P||M) represents the KL divergence between probability distribution P and uniform distribution M, and D KL (Q||M) represents the KL divergence between the probability distribution Q and the uniform distribution M.

[0104] Furthermore, a support vector machine (SVM) binary classification model is trained using the strongest voting mechanism. When any of the above entropies is detected to exhibit characteristics of confusing Tor traffic, it is directly marked as confusing Tor traffic.

[0105] With the goal of separating Tor traffic using obfuscation techniques, a binary classifier is trained based on the target entropy feature set, and the trained classifier is defined as the second layer filter.

[0106] The binary classifier is a Support Vector Machine (SVM) classifier, which classifies a given sample point x. i Its category label is y i ∈{-1,1}, the classification condition is:

[0107] y i (w T x i +b)≥1

[0108] The goal of SVM is to maximize the margin, which is the distance from the decision hyperplane to the nearest sample point. For linearly separable samples, maximizing the margin can be transformed into minimizing the following objective function:

[0109]

[0110] Where w is the normal vector, used to determine the direction of the hyperplane; b is the bias term, used to control the distance between the hyperplane and the origin; x is the input feature vector; and T represents the transpose.

[0111] In this embodiment, regarding the establishment of the second-layer filter, since Tor users may use various obfuscation techniques to hide their traffic characteristics, the classifier needs to be adaptable to obfuscation techniques. By extracting entropy features related to the target obfuscation technique and training a support vector machine classifier, it is possible to effectively identify different obfuscation techniques and improve the generalization ability of the classifier.

[0112] ③ Third layer filter:

[0113] Two key characteristics of the Onion service were identified: latency and packet reordering due to long network circuits, and small page resources and small data loading. Based on these key characteristics, transmission feature data was obtained from the Onion service. This transmission feature data included the timestamp of outgoing packets, the number of bytes in incoming bursts, and the maximum outgoing burst.

[0114] A predictive model is constructed by using a gradient boosting classifier and combining several decision trees as weak learners.

[0115] With the goal of separating traffic accessing the dark web, a prediction model is trained based on transmission characteristic data, and the trained model is defined as the third layer filter.

[0116] The final prediction model is as follows:

[0117]

[0118] Where F(x) is the final prediction model, i.e., the model after training; h m (x) is the m-th decision tree, and M is the total number of weak learners.

[0119] In this embodiment, the transmission characteristic data obtained from the Onion service during the establishment of the third-layer filter includes outgoing packet timestamps, incoming burst byte counts, and the maximum outgoing burst. This transmission characteristic data provides important clues about network traffic behavior and helps identify traffic accessing the dark web. Gradient boosting classifiers are efficient and powerful ensemble learning techniques. This scheme combines multiple weak learners to construct a strong learner, which can significantly reduce model bias and variance, thereby improving classification accuracy and robustness.

[0120] In this embodiment S2, by combining a fingerprint database, the first-layer filter can quickly and accurately identify native Tor traffic. This feature-matching-based method can significantly improve identification efficiency when processing large amounts of network traffic data. The third-layer filter, which combines several decision trees, can improve classification accuracy by using the combination of multiple weak classifiers, thereby more accurately separating traffic accessing the dark web.

[0121] Furthermore, by filtering layer by layer, the scope of the target traffic can be quickly narrowed down, thereby reducing unnecessary processing and analysis work, which helps to improve the efficiency and real-time performance of data processing.

[0122] It should be noted that the process of identifying and separating Internet traffic in this embodiment to obtain the traffic of anonymous users accessing the dark web and the traffic accessing the open web is completed based on the corresponding filters in the multi-feature filtering model.

[0123] Overall, this embodiment has the following beneficial effects:

[0124] This application constructs a multi-feature filtering model consisting of three layers of filters, fully utilizing the complementarity of Tor traffic features, binary classifiers, and dark web service features to achieve efficient and accurate identification and separation of internet traffic. The Tor network, as a primary channel for accessing the dark web, exhibits unique traffic characteristics. By accurately extracting these characteristics and constructing the first-layer filter, most Tor traffic can be efficiently identified, helping to initially distinguish Tor traffic from ordinary internet traffic. Since Tor traffic may be obfuscated to evade detection, more complex classification techniques are required. The second-layer filter employs a binary classifier, which, by learning the feature differences between known Tor traffic and normal traffic, can further distinguish obfuscated Tor traffic. Dark web services typically exhibit specific behavioral patterns. By extracting these behavioral characteristics and constructing a third-layer filter, it's possible to distinguish between the portion of Tor traffic that accesses dark web services and the portion that accesses legitimate Tor services. This method ensures a high degree of accuracy in the final separation of dark web traffic. Clearly, each of the three filter layers plays a crucial role and none can be omitted. Lacking the first layer would increase computational load and introduce data noise; lacking the second layer would prevent the distinction between Tor and other traffic; and lacking the third layer would make it impossible to determine whether Tor traffic accesses the dark web. Therefore, only when all three filters work together can the traffic from anonymous users accessing the dark web be effectively separated.

[0125] In summary, this application, by setting up three layers of filters, can progressively and accurately identify different types of Tor traffic. From native Tor traffic to Tor traffic using obfuscation techniques, and finally to traffic accessing the dark web, each layer undertakes a specific identification task, ensuring the accuracy and efficiency of the identification process.

[0126] Example 2:

[0127] Please see Figure 2 The embodiments of this application provide a multi-granularity anonymous user traffic identification device, including a traffic module 10 and an identification module 20;

[0128] Among them, the traffic module 10 is used to acquire Internet traffic;

[0129] The identification module 20 is used to identify and separate Internet traffic based on a multi-feature filtering model to obtain the traffic of anonymous users accessing the dark web. The multi-feature filtering model consists of three layers of filters. The first and third layers of filters are constructed based on Tor traffic features and dark web service features, respectively, while the second layer of filters is constructed based on a binary classifier.

[0130] In one embodiment, the traffic module 10 specifically comprises:

[0131] Use professional network traffic monitoring software or hardware devices to obtain Internet traffic; Internet traffic is a comprehensive collection of data packets containing rich information, such as source address, destination address, port number, protocol type, packet size, timestamp, etc.

[0132] In one embodiment, the identification module 20 includes a first filtering unit, a second filtering unit, and a third filtering unit;

[0133] The first filtering unit is used to capture unknown traffic data packets from Internet traffic based on the first layer filter of the multi-feature filtering model.

[0134] The first filtering unit is also used to extract features from unknown traffic data packets to obtain a data feature set;

[0135] The first filtering unit is also used to generate several fingerprints based on the data feature set and compare them with fingerprints in the fingerprint database; if they match, the network flow is defined as native Tor traffic (i.e., Tor traffic without obfuscation technology); if they do not match, the network flow is defined as the first remaining traffic data; where “Tor traffic” refers to data traffic transmitted through the Tor (The Onion Router) network, and the “Tor network” is an encrypted communication network designed to protect user anonymity and privacy;

[0136] The first filtering unit is also used to traverse all network flows in the Internet traffic, repeat the above feature extraction, classification prediction and labeling process to obtain the original Tor traffic and the first remaining traffic data.

[0137] In this embodiment, the first filtering unit extracts key features from unknown traffic, which can reduce data dimensionality and data interference. By matching with fingerprints in the fingerprint database, the system can quickly identify data packets that match the characteristics of native Tor traffic. This rapid identification capability is of great significance for real-time monitoring and response to potential threats in the network.

[0138] The second filtering unit is used to extract entropy features corresponding to the obfuscation technique from the first remaining traffic data according to the second layer filter of the multi-feature filtering model, and obtain the target entropy feature set.

[0139] The second filtering unit is also used in the second layer filter to classify and predict the target entropy feature set according to the trained classifier to obtain the prediction result.

[0140] The second filtering unit is also used to determine, based on the prediction results of the classifier, whether several traffic flows in the first remaining traffic data are Tor traffic flows that use obfuscation techniques (such as obfs, snowflakes, meek, etc.); if so, the traffic flows are reclassified and defined as Tor traffic flows that use obfuscation techniques; if not, further processing or filtering is required depending on the specific circumstances.

[0141] The second filtering unit is also used to traverse all network flows in the first remaining traffic data, repeat the above feature extraction, classification prediction and labeling process to obtain Tor traffic using obfuscation techniques; where “obfuscation techniques” in the field of network communication, especially in anonymous communication systems such as the Tor network, refer to a series of methods used to hide or obscure the true characteristics of communication traffic.

[0142] In this embodiment, the second filtering unit separates the Tor traffic using obfuscation technology, avoiding redundant analysis of the mixed traffic in subsequent processing steps and improving system efficiency.

[0143] The third filtering unit is used to extract feature sets from native Tor traffic and Tor traffic using obfuscation techniques based on the third layer filter of the multi-feature filtering model;

[0144] The third filtering unit is also used to input the feature set into the trained prediction model in the third layer filter to perform classification prediction and obtain the prediction result;

[0145] The third filtering unit is also used to determine, based on the prediction results of the prediction model, whether certain traffic in the native Tor traffic and the Tor traffic using obfuscation technology is traffic accessing the Tor service (i.e., the dark web); if so, the traffic is marked as traffic of anonymous users accessing the dark web; if not, the traffic is marked as traffic accessing the plain web.

[0146] The third filtering unit is also used to traverse all traffic in both native Tor traffic and Tor traffic using obfuscation techniques, repeating the above-mentioned feature extraction, classification prediction, and labeling process to filter out traffic accessing the open web and obtain traffic from anonymous users accessing the dark web.

[0147] The multi-feature filtering model consists of three layers of filters. The first and third layers are built based on Tor traffic features and dark web service features, respectively, while the second layer is built based on a binary classifier. The three layers of filters in the multi-feature filtering model are explained in detail below:

[0148] ① First layer filter:

[0149] Historical traffic data is preprocessed. First, Deep Packet Inspection (DPI) is used for feature extraction. Specifically, key information such as Cipher Suites and extended fields are extracted from packets during the TLS (Transport Layer Security) handshake phase. Then, the packet lengths in Tor traffic are statistically analyzed, and their distribution characteristics are examined. Simultaneously, the time intervals between packets are recorded, and relevant statistical characteristics are calculated, including average time interval, maximum time interval, and minimum time interval. After these steps, a first feature set containing these features is obtained; where "Cipher Suites" refers to a set of algorithms used by the Transport Layer Security protocol to specify cipher suites.

[0150] Based on the first feature set, fingerprints for Tor traffic and preset normal traffic are configured separately, and a fingerprint database is built based on these configured fingerprints. Furthermore, in constructing this fingerprint database, two types of fingerprints need to be fully considered: static fingerprints based on fixed or stable features, and dynamic fingerprints based on time fluctuations or statistical characteristics. Therefore, the fingerprint database comprehensively covers the fingerprint information of both Tor traffic and preset normal traffic. The "fingerprints of preset normal traffic" refer to a set of feature identifiers designed to identify and distinguish normal (i.e., non-Tor) network traffic. These fingerprints are created based on a deep understanding of normal behavior or characteristics in network traffic, and they may reflect typical characteristics of normal traffic in terms of packet structure, protocol usage, data transmission rate, packet length distribution, and time interval statistics.

[0151] Following a pre-defined approach, with the goal of identifying native Tor traffic, a first-layer filter is established using a fingerprint database. The pre-defined approach includes: designing and implementing the first-layer filter based on the fingerprint database; the filter should be able to receive network traffic data, extract relevant features, and match them with fingerprints in the database; implementing an efficient matching algorithm to ensure the filter can process network traffic data in real time and accurately identify native Tor traffic; considering the potential overlap or ambiguous boundaries between Tor traffic and normal traffic, the filter may need to employ certain thresholds or decision rules to determine whether a traffic item belongs to Tor traffic.

[0152] The method for configuring Tor traffic fingerprint information is as follows: Select features highly correlated with Tor traffic from a first feature set. These features may be specific statistics of packet length (such as mean, standard deviation, maximum, minimum, etc.) or distribution patterns of packet length. Quantize the selected features, converting them into numerical or discrete feature values. Generate Tor traffic fingerprint information based on the quantized feature values. This typically involves combining feature values ​​into a unique identifier or pattern that represents the characteristics of Tor traffic. The method for configuring preset normal traffic fingerprint information is similar to configuring Tor traffic fingerprint information: Select features highly correlated with preset normal traffic from a first feature set. These features should reflect the typical behavior or characteristics of normal traffic. Quantize the selected features and generate preset normal traffic fingerprint information based on the quantized feature values ​​(the generation process is similar to that of Tor traffic fingerprint information).

[0153] In this embodiment, regarding the establishment of the first-layer filter, the Tor network, due to its specific communication protocol and encryption methods, often exhibits a unique pattern in the length distribution of its data packets. By calculating the length distribution characteristics of the data packets, these unique properties can be effectively captured, thereby enabling the identification of Tor traffic. The fingerprint database contains fingerprints of Tor traffic and preset normal traffic, designed based on in-depth analysis of both types of traffic. Therefore, during the identification process, the filter can more accurately distinguish between Tor traffic and normal traffic, thereby reducing the possibility of false alarms and missed alarms.

[0154] ② Second layer filter:

[0155] Based on traffic data, a target entropy feature set is extracted from different types of obfuscated Tor traffic. This set includes the entropy value of the first message, the entropy of the URI (Uniform Resource Identifier) ​​in the HTTP GET message, the information entropy of the sent / received message lengths (and additional relative entropy features specific to Meek obfuscation techniques). Here, an "HTTP GET message" is a "request message" sent by a client (such as a browser) when requesting resources from a server. "Meek obfuscation techniques" are an advanced obfuscation technique used in the Tor network to increase the anonymity and censorship resistance of Tor communication. Specifically:

[0156] ① Entropy value of the first message:

[0157] Traditional first-message entropy calculation ignores the multi-scale characteristics of time series. To be suitable for distinguishing confused Tor traffic, this embodiment adopts a multi-scale relative entropy (MRE) approach. First, a multi-scale adaptive binning strategy is implemented, dynamically grouping the first-message according to its length, such as dividing it into 16 short groups and 32 long groups. The grouping formula is as follows:

[0158]

[0159] Subsequently, the relative entropy D is calculated. KL (P||Q) is the Kullback-Leibler (KL) divergence between the probability distribution P and the uniform distribution Q. The formula used for calculation is:

[0160]

[0161] Finally, by weighted summing of the KL divergences at multiple scales, the weighted multi-scale relative entropy (the first message entropy value) is obtained, namely:

[0162]

[0163] Where L is the message length and Bins(τ) is the number of bins; n is the number of data points falling into the binning interval. T represents the number of time scales; τ takes values ​​from 1 to T, representing the traversal from the 1st time scale to the Tth time scale; ω τ This represents the weighting coefficient at the t-th time scale.

[0164] ② Entropy of the URI in an HTTP GET message:

[0165] To meet the specific requirements of this embodiment, a dynamic window arrangement entropy method is adopted. This method follows these steps: First, a sliding window (recommended window size 3-5 characters) is used to divide the URI into multiple parts; next, for the characters within each window, their arrangement pattern π (e.g., ascending or descending order) is determined; then, the standard deviation SD(π) of these arrangement patterns is calculated to quantify their dispersion. Finally, the entropy of the URI in the HTTP GET message is calculated based on the above parameters. The specific entropy calculation formula is as follows:

[0166]

[0167] Where π represents the arrangement pattern of characters within the window; SD(π) is the standard deviation of the pattern; the size of Π is determined by the window length m and is the factorial of m; P(π) is the probability of a specific arrangement pattern π appearing in the entire time series; β is the second weighting coefficient, used to adjust the contribution ratio of the standard deviation of the pattern to the final entropy value.

[0168] ③ Information entropy of the sent / received message length:

[0169] Traditional methods calculate the length entropy in both the sending and receiving directions independently. Obfuscation strategies such as Meek obfuscation mask features by shaping bidirectional traffic. This embodiment uses Joint Distribution Entropy (JDE) to statistically analyze the joint probability distribution of sending and receiving message length pairs, thereby capturing the statistical dependencies of bidirectional interactions.

[0170]

[0171] Subsequently, by using a sliding window with a time window of 10 seconds, the standard deviation of the joint distribution entropy is calculated to detect periodic disturbances in the traffic, thereby obtaining the information entropy of the sent / received message length, i.e.:

[0172]

[0173] Among them, L in It is the input message length, L out It is the output message length, P(L) in ,L out ) represents the probability that a specific input length and output length co-occur within a statistical time period; T is the entire time period, t is the time window, and JDE t The joint distribution entropy, μ, is the value within a specific time window. JDE It is the mean of the joint distribution entropy.

[0174] ④ Additional relative entropy features specific to Meek obfuscation techniques (i.e., obfuscation technique-specific relative entropy):

[0175] To analyze the Tor traffic distribution characteristics under obfuscation methods such as Meek and Obfs, and using Jason-Shannon divergence (JS divergence), we compare and analyze the differences between the actual traffic distribution and the baseline distribution.

[0176]

[0177] in, Q represents a known Meek traffic template distribution, and D... KL (P||M) represents the KL divergence between probability distribution P and uniform distribution M, and D KL (Q||M) represents the KL divergence between the probability distribution Q and the uniform distribution M.

[0178] Furthermore, a support vector machine (SVM) binary classification model is trained using the strongest voting mechanism. When any of the above entropies is detected to exhibit characteristics of confusing Tor traffic, it is directly marked as confusing Tor traffic.

[0179] With the goal of separating Tor traffic using obfuscation techniques, a binary classifier is trained based on the target entropy feature set, and the trained classifier is defined as the second layer filter.

[0180] The binary classifier is a Support Vector Machine (SVM) classifier, which classifies a given sample point x. i Its category label is y i ∈{-1,1}, the classification condition is:

[0181] y i (w T x i +b)≥1

[0182] The goal of SVM is to maximize the margin, which is the distance from the decision hyperplane to the nearest sample point. For linearly separable samples, maximizing the margin can be transformed into minimizing the following objective function:

[0183]

[0184] Where w is the normal vector, used to determine the direction of the hyperplane; b is the bias term, used to control the distance between the hyperplane and the origin; x is the input feature vector; and T represents the transpose.

[0185] In this embodiment, regarding the establishment of the second-layer filter, since Tor users may use various obfuscation techniques to hide their traffic characteristics, the classifier needs to be adaptable to obfuscation techniques. By extracting entropy features related to the target obfuscation technique and training a support vector machine classifier, it is possible to effectively identify different obfuscation techniques and improve the generalization ability of the classifier.

[0186] ③ Third layer filter:

[0187] Two key characteristics of the Onion service were identified: latency and packet reordering due to long network circuits, and small page resources and small data loading. Based on these key characteristics, transmission feature data was obtained from the Onion service. This transmission feature data included the timestamp of outgoing packets, the number of bytes in incoming bursts, and the maximum outgoing burst.

[0188] A predictive model is constructed by using a gradient boosting classifier and combining several decision trees as weak learners.

[0189] With the goal of separating traffic accessing the dark web, a prediction model is trained based on transmission characteristic data, and the trained model is defined as the third layer filter.

[0190] The final prediction model is as follows:

[0191]

[0192] Where F(x) is the final prediction model, i.e., the model after training; h m (x) is the m-th decision tree, and M is the total number of weak learners.

[0193] In this embodiment, the transmission characteristic data obtained from the Onion service during the establishment of the third-layer filter includes outgoing packet timestamps, incoming burst byte counts, and the maximum outgoing burst. This transmission characteristic data provides important clues about network traffic behavior and helps identify traffic accessing the dark web. Gradient boosting classifiers are efficient and powerful ensemble learning techniques. This scheme combines multiple weak learners to construct a strong learner, which can significantly reduce model bias and variance, thereby improving classification accuracy and robustness.

[0194] In this embodiment, the identification module 20, by combining a fingerprint database, enables the first-layer filter to quickly and accurately identify native Tor traffic. This feature-matching-based method significantly improves identification efficiency when processing large amounts of network traffic data. The third-layer filter, built by combining several decision trees, can improve classification accuracy by utilizing the combination of multiple weak classifiers, thereby more accurately separating traffic accessing the dark web.

[0195] Furthermore, by filtering layer by layer, the scope of the target traffic can be quickly narrowed down, thereby reducing unnecessary processing and analysis work, which helps to improve the efficiency and real-time performance of data processing.

[0196] It should be noted that the process of identifying and separating Internet traffic in this second embodiment to obtain the traffic of anonymous users accessing the dark web and the traffic accessing the open web is completed based on the corresponding filters in the multi-feature filtering model.

[0197] Overall, this embodiment has the following beneficial effects:

[0198] This application constructs a multi-feature filtering model consisting of three layers of filters, fully utilizing the complementarity of Tor traffic features, binary classifiers, and dark web service features to achieve efficient and accurate identification and separation of internet traffic. The Tor network, as a primary channel for accessing the dark web, exhibits unique traffic characteristics. By accurately extracting these characteristics and constructing the first-layer filter, most Tor traffic can be efficiently identified, helping to initially distinguish Tor traffic from ordinary internet traffic. Since Tor traffic may be obfuscated to evade detection, more complex classification techniques are required. The second-layer filter employs a binary classifier, which, by learning the feature differences between known Tor traffic and normal traffic, can further distinguish obfuscated Tor traffic. Dark web services typically exhibit specific behavioral patterns. By extracting these behavioral characteristics and constructing a third-layer filter, it's possible to distinguish between the portion of Tor traffic that accesses dark web services and the portion that accesses legitimate Tor services. This method ensures a high degree of accuracy in the final separation of dark web traffic. Clearly, each of the three filter layers plays a crucial role and none can be omitted. Lacking the first layer would increase computational load and introduce data noise; lacking the second layer would prevent the distinction between Tor and other traffic; and lacking the third layer would make it impossible to determine whether Tor traffic accesses the dark web. Therefore, only when all three filters work together can the traffic from anonymous users accessing the dark web be effectively separated.

[0199] In summary, this application, by setting up three layers of filters, can progressively and accurately identify different types of Tor traffic. From native Tor traffic to Tor traffic using obfuscation techniques, and finally to traffic accessing the dark web, each layer undertakes a specific identification task, ensuring the accuracy and efficiency of the identification process.

[0200] Example 3:

[0201] This application provides a computer-readable storage medium including a stored computer program, wherein the computer program controls the device where the computer-readable storage medium is located to execute the multi-granularity anonymous user traffic identification method when it is running.

[0202] The multi-granularity anonymous user traffic identification method, when implemented as a software functional unit and used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0203] The above are preferred embodiments of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying multi-granularity anonymous user traffic, characterized in that, include: Acquire internet traffic; The internet traffic is identified and separated using a multi-feature filtering model to obtain the traffic of anonymous users accessing the dark web. Specifically, the internet traffic is identified and separated using the first layer filter of the multi-feature filtering model to obtain native Tor traffic and first remaining traffic data; the first remaining traffic data is identified and separated using the second layer filter of the multi-feature filtering model to obtain Tor traffic using obfuscation technology; the native Tor traffic and the Tor traffic using obfuscation technology are identified and separated using the third layer filter of the multi-feature filtering model to filter out traffic accessing the surface web, thus obtaining the traffic of anonymous users accessing the dark web. The multi-feature filtering model consists of three layers of filters: the first and third layers are constructed based on Tor traffic features and dark web service features, respectively; the second layer filter is constructed based on a binary classifier.

2. The multi-granularity anonymous user traffic identification method as described in claim 1, characterized in that, The internet traffic is identified and separated based on the first layer filter of the multi-feature filtering model to obtain native Tor traffic and the first remaining traffic data, specifically: Based on the first layer filter of the multi-feature filtering model, unknown traffic data packets are captured from the Internet traffic; Feature extraction is performed on the unknown traffic data packets to obtain data features; In the data features, data that matches fingerprints in the fingerprint database is defined as the native Tor traffic, and data that does not match fingerprints in the fingerprint database is defined as the first remaining traffic data.

3. The multi-granularity anonymous user traffic identification method as described in claim 1, characterized in that, The first remaining traffic data is identified and separated based on the second layer filter of the multi-feature filtering model to obtain Tor traffic using obfuscation techniques, specifically: Based on the second layer filter of the multi-feature filtering model, the entropy features corresponding to the obfuscation technique are extracted from the first remaining traffic data to obtain the target entropy feature set. The target entropy feature set is classified and predicted based on the trained classifier to obtain the prediction result; Based on the prediction results, the Tor traffic using obfuscation technology is obtained from the first remaining traffic data.

4. A multi-granularity anonymous user traffic identification method as described in any one of claims 1-3, characterized in that, The first and third layers of filters are constructed based on Tor traffic characteristics and dark web service characteristics, respectively, as follows: With the goal of identifying native Tor traffic, a first-layer filter is established by combining a fingerprint database; wherein, the fingerprint database includes fingerprints of Tor traffic and fingerprints of preset normal traffic; With the goal of separating traffic accessing the dark web, the third layer filter is established by combining several decision trees.

5. The multi-granularity anonymous user traffic identification method as described in claim 4, characterized in that, With the goal of identifying native Tor traffic, the first layer of filters is established using a fingerprint database, specifically as follows: Obtain historical traffic data, and statistically obtain a first feature set based on the packet length of Tor traffic in the historical traffic data; Based on the first feature set, fingerprint information of Tor traffic and fingerprint information of preset normal traffic are configured respectively, and the fingerprint database is generated based on the fingerprint information of Tor traffic and the fingerprint information of preset normal traffic. According to a preset method, with the goal of identifying native Tor traffic, the first layer of filter is established by combining the fingerprint database.

6. The multi-granularity anonymous user traffic identification method as described in claim 4, characterized in that, With the goal of separating traffic accessing the dark web, the third-layer filter is established by combining several decision trees, specifically as follows: Obtain transmission characteristic data from the Onion service; wherein, the transmission characteristic data includes the timestamp of the outgoing data packet, the number of incoming burst bytes, and the maximum outgoing burst; A predictive model is constructed by using a gradient boosting classifier and combining several decision trees as weak learners. With the goal of separating traffic accessing the dark web, the prediction model is trained based on the transmission characteristic data, and the trained model is defined as the third layer filter.

7. A multi-granularity anonymous user traffic identification method as described in any one of claims 1-3, characterized in that, The second layer of filters is constructed based on a binary classifier, specifically as follows: Extract the target entropy feature set from traffic data; With the goal of separating Tor traffic using obfuscation techniques, the binary classifier is trained based on the target entropy feature set, and the trained classifier is defined as the second layer filter; wherein, the binary classifier is a support vector machine classifier.

8. A multi-granularity anonymous user traffic identification device, characterized in that, Includes a traffic module and an identification module; The traffic module is used to acquire internet traffic. The identification module is used to identify and separate the internet traffic according to a multi-feature filtering model to obtain the traffic of anonymous users accessing the dark web. Specifically, it performs identification and separation processing on the internet traffic according to the first layer filter of the multi-feature filtering model to obtain native Tor traffic and first remaining traffic data; it performs identification and separation processing on the first remaining traffic data according to the second layer filter of the multi-feature filtering model to obtain Tor traffic using obfuscation technology; it performs identification and separation processing on the native Tor traffic and the Tor traffic using obfuscation technology according to the third layer filter of the multi-feature filtering model to filter out the traffic accessing the surface web and obtain the traffic of anonymous users accessing the dark web. The multi-feature filtering model consists of three layers of filters. The first and third layers of filters are constructed based on Tor traffic features and dark web service features, respectively, and the second layer of filters is constructed based on a binary classifier.

9. A storage medium, characterized in that, The storage medium stores a computer program, which is called and executed by a computer to implement a multi-granularity anonymous user traffic identification method as described in any one of claims 1 to 7.

Images