Network traffic disturbance method and device, computer equipment, storage medium and computer program product

Abstract

The invention relates to a network traffic disturbance method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: intercepting a data packet sent by a target sending end to a target receiving end, determining a data packet block where the data packet is located, and obtaining a feature disturbance target of the data packet block; determining a feature adjustment strategy for the data packet according to the current network traffic feature of the data packet block, and performing adjustment processing on the data packet according to the feature adjustment strategy, so that the network traffic feature of the data packet block after adjustment of the data packet is closer to a feature disturbance target than the current network traffic feature; and sending the adjusted data packet to the target receiving end. By adopting the method, the network attack defense effect can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular, to a network traffic perturbation method and device, a computer device, a storage medium, and a computer program product. BACKGROUND

[0002] With the development of the Internet, network attacks against users have also begun to appear. Although modern networks widely use encryption technology to protect data transmission content, attackers can still infer sensitive information such as websites visited by users, user operating systems, and specific services used by users by analyzing the side channel characteristics of encrypted traffic (such as packet length, timing patterns, and traffic statistical characteristics). Therefore, it is crucial to perturb the characteristics of network traffic to defend against such attacks.

[0003] In related technologies, random perturbation of traffic is usually performed by filling random bytes or inserting false packets to destroy the original feature distribution of the traffic. However, these packets are easily filtered by attackers due to sequence number errors or checksum mismatches, resulting in poor defense effectiveness. SUMMARY

[0004] Therefore, it is necessary to provide a network traffic perturbation method, device, computer device, storage medium, and computer program product to solve the above technical problems.

[0005] In a first aspect, the present application provides a network traffic perturbation method. The method comprises:

[0006] intercepting a data packet sent by a target sending end to a target receiving end, determining a data packet block in which the data packet is located, and obtaining a feature perturbation target of the data packet block;

[0007] determining a feature adjustment strategy for the data packet according to a current network traffic feature of the data packet block, and adjusting the data packet according to the feature adjustment strategy, so that the network traffic feature of the data packet block after adjustment of the data packet is closer to the feature perturbation target than the current network traffic feature;

[0008] sending the adjusted data packet to the target receiving end.

[0009] In one embodiment, the feature adjustment strategy comprises adjusting the payload carried by the data packet in the total payload, and / or adjusting the sending interval between the data packet and the previous data packet; the total payload is a collection of the payloads of the data packets in the data packet block.

[0010] In one embodiment, the feature perturbation target comprises adjusting the traffic category to which the network traffic feature is classified to a target traffic category.

[0011] determining a feature adjustment policy for the data packet according to a current network traffic feature of the data packet block, comprising:

[0012] determining a policy value interval corresponding to the feature adjustment policy, the policy value interval being composed of a value interval of the payload and / or a value interval of the sending interval;

[0013] determining a target policy value of the feature adjustment policy from the policy value interval, the target policy value corresponding to an action value being highest among action values corresponding to all policy values in the policy value interval;

[0014] wherein the action value is determined by a probability that the network traffic feature of the data packet block is classified into the target traffic category after the data packet is adjusted according to the target policy value; and the network traffic feature is determined based on the adjusted data packet and the current network traffic feature.

[0015] In one embodiment, the target policy value is determined by inputting the current network traffic feature into a target deep Q network, and the method further comprises:

[0016] obtaining an initial deep Q network and a plurality of sample data packets, and determining sample current network traffic features of the sample data packets;

[0017] taking any of the sample data packets as a target sample data packet, determining an initial policy value from the policy value interval, and predicting an action value corresponding to the initial policy value for the sample current network traffic feature by the initial deep Q network;

[0018] training the initial deep Q network according to a difference between the action value and a target action value corresponding to the initial policy value until a training stop condition is met, and taking the current initial deep Q network as the target deep Q network.

[0019] In one embodiment, after the data packet is adjusted according to the feature adjustment policy, the method further comprises:

[0020] determining to-be-updated check items of the data packet based on a target communication protocol specification; the target communication protocol specification being a specification of a communication protocol used between the target sending end and the target receiving end;

[0021] determining target check values of the to-be-updated check items respectively according to the adjusted data packet, and respectively replacing check values of the to-be-updated check items in the data packet with the target check values.

[0022] In one of the embodiments, after the data packet is adjusted according to the characteristic adjustment strategy, the method further comprises:

[0023] In the case that the length of the adjusted data packet and / or the sending interval does not conform to the target communication protocol specification, the adjustment on the data packet is revoked, and the step of determining the characteristic adjustment strategy for the data packet is jumped to until the adjusted data packet conforms to the target communication protocol specification;

[0024] The target communication protocol specification is the specification of the communication protocol used between the target sending end and the target receiving end.

[0025] In one of the embodiments, the data packet block consists of all the data packets sent by the target sending end to the target receiving end during the two times of returning ACK packets by the target receiving end to the target sending end.

[0026] In the second aspect, the application further provides a network traffic disturbance device. The device comprises:

[0027] An intercepting module, configured to intercept a data packet sent by a target sending end to a target receiving end, determine a data packet block where the data packet is located, and obtain a characteristic disturbance target of the data packet block;

[0028] A first determining module, configured to determine a characteristic adjustment strategy for the data packet according to a current network traffic characteristic of the data packet block, and adjust the data packet according to the characteristic adjustment strategy, so that the network traffic characteristic of the data packet block after the adjustment of the data packet is closer to the characteristic disturbance target than the current network traffic characteristic;

[0029] A sending module, configured to send the adjusted data packet to the target receiving end.

[0030] In one of the embodiments, the characteristic adjustment strategy comprises adjusting a payload carried by the data packet in a total payload, and / or adjusting a sending interval between the data packet and a previous data packet; the total payload is a collection of the payloads of the data packets in the data packet block.

[0031] In one of the embodiments, the characteristic disturbance target comprises adjusting a traffic category to which the network traffic characteristic is classified to a target traffic category.

[0032] The first determining module is further configured to:

[0033] determine a strategy value interval corresponding to the characteristic adjustment strategy, the strategy value interval being composed of a value interval of the payload and / or a value interval of the sending interval;

[0034] determining a target policy value of the feature adjustment policy from the policy value interval, the target policy value corresponding to an action value that is highest among action values corresponding to all policy values in the policy value interval;

[0035] The action value is determined by a probability that the network traffic feature of the data packet block is classified into the target traffic category after the data packet is adjusted according to the target policy value; and the network traffic feature is determined based on the adjusted data packet and the current network traffic feature.

[0036] In one of the embodiments, the target policy value is determined by inputting the current network traffic feature into a target deep Q network, and the apparatus further comprises:

[0037] The second determining module is configured to obtain an initial deep Q network and a plurality of sample data packets, and determine sample current network traffic features of the sample data packets;

[0038] The prediction module is configured to determine an initial policy value from the policy value interval by taking any sample data packet as a target sample data packet, and predict an action value corresponding to the initial policy value and the sample current network traffic feature by using the initial deep Q network.

[0039] The training module is configured to train the initial deep Q network according to a difference between the action value and a target action value corresponding to the initial policy value until a training stop condition is met, and take the current initial deep Q network as the target deep Q network.

[0040] In one of the embodiments, the apparatus further comprises:

[0041] The third determining module is configured to determine to-be-updated check items of the data packet based on a target communication protocol specification, the target communication protocol specification being a specification of a communication protocol used between the target sending end and the target receiving end.

[0042] The fourth determining module is configured to determine target check values of the to-be-updated check items respectively based on the adjusted data packet, and replace check values of the to-be-updated check items in the data packet with the target check values respectively.

[0043] In one of the embodiments, the apparatus further comprises:

[0044] a revoking module, configured to, in a case that the length of the adjusted data packet and / or the sending interval does not conform to the target communication protocol specification, revoke the adjustment on the data packet, and jump to the step of determining the feature adjustment strategy for the data packet until the adjusted data packet conforms to the target communication protocol specification;

[0045] The target communication protocol specification is a specification of a communication protocol used between the target sending end and the target receiving end.

[0046] In one embodiment, the data packet block is composed of all data packets sent by the target sending end to the target receiving end during two times of returning ACK packets by the target receiving end to the target sending end.

[0047] In a third aspect, the present application also provides a computer device. The computer device comprises a memory and a processor. The memory stores a computer program. The processor implements any of the above methods when executing the computer program.

[0048] In a fourth aspect, the present application also provides a computer readable storage medium. The computer readable storage medium stores a computer program. The computer program is executed by a processor to implement any of the above methods.

[0049] In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program. The computer program is executed by a processor to implement any of the above methods.

[0050] The network traffic disturbance method, device, computer device, storage medium and computer program product described above intercept data packets between a target sending end and a target receiving end, calculate network traffic features of a data packet block in units of data packet blocks, and determine a feature adjustment strategy that can make the network traffic features of an adjusted data packet block closer to a feature disturbance target after adjusting the data packet according to the current network traffic features of the data packet block where the data packet is located. The data packet is sent to the target receiving end after adjusting the data packet according to the feature adjustment strategy. The embodiments of the present application can support network traffic camouflage by shaping original data packets in traffic according to a specific feature disturbance target, and have stronger concealment compared with feature disturbance algorithms that only destroy feature distribution, and can improve defense performance. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 A flowchart of a network traffic disturbance method in one embodiment;

[0052] Figure 2 A flowchart of a network traffic disturbance method in another embodiment;

[0053] Figure 3 This is a schematic diagram of offline training and online traffic perturbation in one embodiment;

[0054] Figure 4 This is a structural block diagram of a network traffic disturbance device in one embodiment;

[0055] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] In one embodiment, such as Figure 1 As shown, a network traffic perturbation method is provided. This embodiment illustrates the application of this method to a target network node, where the target network node can be a sending end or any intermediate network node between the receiving end and the sending end. In this embodiment, the method includes the following steps:

[0058] Step 102: Intercept the data packets sent from the target sender to the target receiver, determine the data packet block in which the data packets are located, and obtain the characteristics of the data packet block to disturb the target.

[0059] In this embodiment, communication occurs between the target sender and the target receiver. The target network node can be the target sender or any network node located on the communication path between the target sender and the target receiver. The target network node is capable of intercepting data packets in the network traffic transmitted from the target sender to the target receiver.

[0060] Furthermore, this allows the target network node to read the response returned by the target receiver to the target sender, enabling the target network node to adaptively adjust its traffic perturbation strategy based on the receiver's response. For example, if the target sender and receiver communicate using TCP (Transmission Control Protocol), and the target network node does not receive an ACK packet (ACK stands for Acknowledgement, a confirmation packet returned by the receiver to the sender in the TCP protocol upon receiving data) for an extended period, it indicates that the traffic perturbation by the target network node may have resulted in checksum errors, invalid formats, or other problems with the data packets. In this case, the target network node can reduce traffic perturbation or change its data packet feature adjustment strategy to prioritize data transmission reliability.

[0061] The target network node can intercept all data packets in the network traffic, adjust each data packet, or the target network node can only select part of the data packets from the network traffic for interception and adjustment. In the latter case, the target network node can intercept all data packets carrying payloads in the network traffic for adjustment, or intercept one or more data packets every interval of a preset number of data packets for adjustment.

[0062] The data packet block to which the data packet belongs is the unit of feature perturbation, and a data packet block contains a plurality of continuous data packets. Since the attacker conducts network attacks by intercepting a plurality of continuous data packets and analyzing the traffic features of the plurality of data packets, when defending, the traffic features of the plurality of continuous data packets also need to be disguised.

[0063] It should be noted that the data packet blocks can overlap, for example, data packets 1, 2, and 3 can belong to one data packet block, and data packets 2, 3, and 4 can belong to another data packet block.

[0064] In one example, the target network node can take a preset number (for example, 5, 10) of continuous data packets as a data packet block. The target network node can maintain a counter and record the current network traffic features of the data packet block, and the counter +1 every time a data packet in the network traffic is read. Before the value of the counter reaches the preset number, the target network node calculates the feature adjustment strategy using the recorded current network traffic features. After the value of the counter reaches the preset number, the target network node clears the current network traffic features and starts to calculate the current network traffic features of the data packet block again.

[0065] In one embodiment, the data packet block is composed of all data packets sent by the target sending end to the target receiving end during the two times that the target receiving end returns ACK packets to the target sending end. In the embodiment of the present application, the target network node reads the network traffic sent by the target receiving end to the target sending end, and identifies whether a data packet is an ACK packet according to the ACK field of each data packet in the traffic. All data packets sent by the target sending end to the target receiving end during the two times that the target network node reads the ACK packets form a data packet block.

[0066] It should be noted that since the ACK packet is returned by the target receiving end to the target sending end after the target network node starts to send the processed data packet to the target receiving end, at the beginning of transmission, the target network node can first take all data packets before the first time of receiving the ACK packet as a data packet block, and then normally take all data packets during the two times of reading the ACK packets as a data packet block.

[0067] Assuming the TCP sliding window can accommodate 3 data packets, the above process is illustrated by an actual example. The sliding window is a mechanism in the TCP protocol to improve the efficiency of data transmission. The sender can continuously send multiple data packets to the receiver without waiting for an ACK packet until the sliding window is full. After the receiver returns an ACK packet for one or more of these data packets, the sliding window moves backward, and the sender can continue to send data packets.

[0068] The target sender continuously sends data packets 1, 2, 3 to the target receiver at the beginning of transmission. These are the data packets currently in the sliding window and also belong to all the data packets intercepted by the target network node before it first receives an ACK packet. The target network node can take data packets 1, 2, 3 as data packet block 1. After processing data packet 1, the target network node sends data packet 1 to the target receiver and updates the current network traffic characteristics of data packet block 1 based on the characteristics of data packet 1.

[0069] Then the target network node continues to process data packet 2, which also belongs to data packet block 1. The target network node calculates the characteristic adjustment strategy of data packet 2 based on the current network traffic characteristics. After processing data packet 2, the target network node sends data packet 2 to the target receiver and updates the current network traffic characteristics of data packet block 1 based on the characteristics of data packet 2.

[0070] Assuming that the target receiver sends ACK packet 1 for data packet 1 at this time, the target sender will continue to send data packets to the target receiver due to the backward movement of the sliding window. At the same time, since the target network node has read this ACK packet, the data packets intercepted by the target network node subsequently belong to a new data packet block.

[0071] The target sender continues to send data packets to the target receiver. At the same time, the target network node continues to process the received data packets. Assuming that the target receiver sends ACK packet 2 for data packet 2 when the target network node processes data packet 3, and the data packets in the sliding window at this time are data packets 4, 5, 6. Then data packets 4, 5, 6 form data packet block 2. In other words, the target network node takes all the data packets sent by the target sender during the reading of ACK packet 1 and ACK packet 2 as a data packet block.

[0072] Similarly, if the target network node receives ACK packet 3 for data packet 3 when processing data packet 5, and the data packets in the sliding window at this time are data packets 6, 7, 8, then all data packets 7, 8 sent by the target sender after the last reception of ACK packet 2 form a new data packet block 3. This process continues until the data transmission between the target sender and the target receiver is complete.

[0073] By the above manner, the target network node does not need to maintain additional packet counting function and packet block determination algorithm, and can accurately divide the packet block through the ACK mechanism in the TCP protocol. Moreover, due to the characteristics of the sliding window mechanism of the TCP protocol, the data packet sending rate of the target sending end is usually faster than the ACK packet returning rate of the target receiving end, and therefore, during the time when the target receiving end returns the ACK packet to the target sending end twice, a plurality of data packets which are not divided into the packet block are usually accumulated in the sliding window. In this way, the data packets contained in the packet block are determined each time the packet block is divided, and the situation that the packet block still contains the data packet which has not been sent by the sending end does not occur. The data packets are adjusted at the level of the packet block.

[0074] The feature perturbation target of the packet block can at least include the following items: adjusting the traffic category to which the network flow feature is classified to the target traffic category (that is, disguising the network flow as another category of flow, for example, disguising the communication flow as the video flow); making the network flow feature not correspond to the valid classification result, or reducing the probability of the network flow feature being classified to the original traffic category (that is, destroying the original distribution of the feature). Different data packet blocks belonging to the same network flow can have different feature perturbation targets, so that the same network flow appears to be multiple different network flows from the perspective of the attacker, and the defense effect is improved.

[0075] The target network node can determine the feature perturbation target of the packet block when determining the packet block. For example, the feature perturbation target can be randomly selected from a plurality of preset feature perturbation targets, which is not limited in the embodiments of the present application.

[0076] In step 104, a feature adjustment strategy for the data packet is determined according to the current network flow feature of the packet block, and the data packet is adjusted according to the feature adjustment strategy, so that the network flow feature of the data packet after adjustment is closer to the feature perturbation target than the current network flow feature.

[0077] In the embodiments of the present application, the current network flow feature of the packet block refers to the network flow feature of the entire packet block determined according to the current state of all data packets (including processed and unprocessed data packets) in the packet block. For example, if the packet block includes data packets 1, 2 and 3, data packet 1 is a processed data packet and has been sent to the target receiving end, data packet 2 is a data packet to be processed, and data packet 3 is an unprocessed data packet, then the current network flow feature of the packet block is calculated according to the processed data packet 1 and the unprocessed data packets 2 and 3. The target network node updates the current network flow feature of the packet block once after processing each data packet.

[0078] The network traffic features can include maximum / minimum / average packet length, time interval standard deviation, and any other features that can identify network traffic. The embodiments of the present application do not limit the specific features of the network traffic.

[0079] The adjustment target for each data packet is to make the network traffic features of the entire data packet block closer to the feature perturbation target after adjustment. For the several feature perturbation targets mentioned in the foregoing embodiments, the meaning of "closer" can be respectively: making the probability of the adjusted network traffic features being classified into the target traffic category higher than before adjustment; making the probability of the network traffic features being classified into each traffic category lower; and making the probability of the network traffic features being classified into the original traffic category lower. The meaning of "higher" above can be "greater than" or "greater than a preset threshold". Similarly, the meaning of "lower" can be "less than" or "less than a preset threshold". For other feature perturbation targets, the meaning of "closer to the feature perturbation target" can be set by those skilled in the art according to actual needs.

[0080] The feature adjustment strategy refers to the way of adjusting the features of the data packet, where the features can include the length of the data packet, the sending interval between the data packet and the previous data packet, and the like. Correspondingly, the adjustment way can include filling data into the data packet or moving data in the data packet to the next data packet, lengthening or shortening the sending interval.

[0081] In one embodiment, the feature adjustment strategy includes adjusting the payload carried by the data packet in the total payload, and / or adjusting the sending interval between the data packet and the previous data packet; where the total payload is the collection of the payloads of the data packets in the data packet block.

[0082] In the embodiments of the present application, if the target network node has intercepted all the data packets in the data packet block where the data packet is located when processing the data packet, the target network node can collect the payloads of the data packets to obtain the total payload, and then redistribute the total payload among the data packets. In this way, the total number of data packets in each data packet block can be ensured to be constant, and the payload carried by each data packet block can also be constant, preventing information loss or semantic change caused by filling or deleting data.

[0083] In addition to adjusting the payload carried by each data packet in the total payload, the feature adjustment strategy can also include adjusting the transmission interval between the data packet and the previous data packet. The target network node can record the time interval between the adjacent two data packets, and accordingly obtain the transmission interval between each two data packets in the entire data packet block, and then can disturb the network traffic feature of the data packet block by adjusting the transmission interval. After adjusting the transmission interval, the target network node waits for the adjusted transmission interval after sending the previous data packet before sending the next data packet.

[0084] The embodiments of the present application do not make specific limitations on the manner of determining the feature adjustment strategy. Illustratively, a plurality of preset feature adjustment strategies (such as: increasing the transmission interval by 5%, reducing the payload by 100 bytes, etc.) can be preset, and then the network traffic features of the data packet blocks after adjusting the data packets according to the preset feature adjustment strategies are determined respectively. After determining a target network traffic feature that is closer to the feature disturbance target than other network traffic features, the preset feature adjustment strategy corresponding to the target network traffic feature is taken as the feature adjustment strategy, and the data packets are formally adjusted according to the feature adjustment strategy.

[0085] In one embodiment, the idea of calculating the reward value for the strategy in reinforcement learning can be used to determine the feature adjustment strategy. Taking the feature disturbance target as an example of adjusting the network traffic feature to be classified to the target traffic category, it includes:

[0086] determining the strategy value interval corresponding to the feature adjustment strategy, the strategy value interval being composed of the value interval of the payload and / or the value interval of the transmission interval;

[0087] determining the target strategy value of the feature adjustment strategy from the strategy value interval, the action value corresponding to the target strategy value being the highest among the action values corresponding to all strategy values in the strategy value interval;

[0088] wherein the action value is determined by the probability that the network traffic feature of the data packet block is classified to the target traffic category after adjusting the data packets according to the target strategy value; the network traffic feature is determined based on the adjusted data packets and the current network traffic feature.

[0089] In the embodiments of the present application, the feature adjustment strategy is represented by a target strategy value taken from a strategy value interval, wherein the strategy value interval is composed of a value interval of the payload and / or a value interval of the transmission interval. The value interval of the payload is from 0 to the total payload, and the value interval of the transmission interval can be determined according to the maximum transmission interval and the minimum transmission interval between two data packets supported by the communication protocol. For example, if a value a is taken from the value interval of the payload and a value b is taken from the value interval of the transmission interval, it means that the payload of the data packet needs to be modified to a, and the transmission interval between the data packet and the previous data packet needs to be modified to b.

[0090] Since the strategy value interval is continuous, the point in the strategy value interval that can achieve the maximum value of the action value function can be approximated based on the action value function and any method that can find the maximum point of the function, and the point is also the point where the target strategy value is located. The action value function is related to the probability that the network traffic feature of the data packet block is classified into the target traffic category after the data packet is adjusted according to the target strategy value. The greater the probability, the greater the action value calculated based on the action value function should be.

[0091] For example, a classifier that can classify network traffic based on network traffic features can be trained, which can output the traffic category to which the network traffic belongs and the probability of belonging to the traffic category. In this way, the classification result of the classifier can be called to calculate the action value.

[0092] Taking determination of the target strategy value by the gradient ascent method as an example, the specific process of determining the target strategy value is as follows: an initial strategy value is selected from the strategy value interval, and based on the initial strategy value and the current network traffic feature, the network traffic feature of the data packet block to which the data packet belongs after the data packet is adjusted according to the initial strategy value is determined; the network traffic feature is input into the classifier to obtain the probability that the network traffic feature belongs to the target traffic category; according to the gradient ascent method, the gradient of the initial strategy value is calculated based on the probability and the action value function, and the initial strategy value is updated, and the above process is repeated until the target strategy value is found.

[0093] In an embodiment, the neural network can be trained to determine the feature adjustment strategy based on the idea of reinforcement learning. Reinforcement learning generally involves an agent for determining a next action (in this case, the feature adjustment strategy) according to a given environment (in this case, the current network traffic feature), and an action value function for evaluating the value of the action. Before performing the next action, the agent calculates the action value corresponding to all possible actions in the action space under the current environment based on the action value function, and selects the action with the maximum action value as the action to be performed next. Therefore, a neural network for predicting the feature adjustment strategy can be trained by the idea of reinforcement learning, and in the application, the current network traffic feature can be input into the neural network to obtain the optimal feature adjustment strategy predicted by the neural network.

[0094] In an embodiment, a deep Q network is used as the neural network for predicting the feature adjustment strategy. The process of training the deep Q network includes:

[0095] An initial deep Q network and a plurality of sample data packets are obtained, and the sample current network traffic features of the sample data packets are determined.

[0096] Any sample data packet is taken as a target sample data packet, an initial policy value is determined from the policy value interval, and the action value of the initial policy value corresponding to the sample current network traffic feature is predicted by the initial deep Q network.

[0097] The initial deep Q network is trained according to the difference between the action value and the target action value corresponding to the initial policy value until the training stop condition is met, and the current initial deep Q network is taken as the target deep Q network.

[0098] In the embodiments of the present application, the initial deep Q network can use any network architecture. For example, the initial deep Q network can be constructed using a bidirectional LSTM structure. The sample data packet can be any plurality of consecutive data packets in the collected sample network traffic.

[0099] In the training phase, the feature adjustment strategy to be taken for the sample data packet next can be calculated from any sample data packet.

[0100] In deep Q-learning, the initial policy value for the target sample data packet can be calculated using a greedy algorithm. After obtaining the initial policy value, a reward function is first used to calculate the reward value of the initial policy value under the current network traffic characteristics of the sample. Then, the current network traffic characteristics of the sample, the initial policy value, the reward value, and the sample network traffic characteristics of the target sample data packet adjusted according to the initial policy value are stored as experience in the memory. The calculation principle of the reward value can be the same as the action value in the previous embodiment, that is, it is determined by the probability that the network traffic characteristics of the data packet block are classified into the target traffic category after adjusting the data packet according to the target policy value.

[0101] For example, the reward value can be calculated using formula (1):

[0102] Formula (1)

[0103] in, It is the reward value for the next action. It represents the sample network traffic characteristics after adjusting the data packets according to the initial policy values. This refers to the classifier targeting The confidence level of belonging to category y. y is the target traffic category.

[0104] During the network training phase, the experience corresponding to any target sample data packet is retrieved from the memory bank. The initial policy value in the initial deep Q network is used to predict the action value of the current network traffic feature of the corresponding sample. Based on the difference between this action value and the target action value calculated by the target network in deep Q learning, the parameters of the initial deep Q network are adjusted until the training stopping condition is met (action value convergence or the preset number of training rounds is reached), and the trained target deep Q network is obtained.

[0105] The target action value is calculated based on a specific target action value function with respect to the initial policy value. In one example, the target action value can be calculated using formula (II):

[0106] Formula (II)

[0107] in, The parameters represent the Q-network at the current initial depth. The value of the target action below It is a discount factor. It is the state space (i.e., the current network traffic characteristics of the sample). Here, r is the action (i.e., the initial policy value chosen), and r is the aforementioned reward function. representing the average of the sum of the rewards from the next action onwards.

[0108] The network can be used in an application to predict the action value of each policy value under the current network traffic characteristics, and then the target policy value with the maximum action value can be selected as the feature adjustment policy.

[0109] In an embodiment, after the data packet is adjusted according to the feature adjustment policy, the method further comprises:

[0110] Based on the target communication protocol specification, determine the to-be-updated check items of the data packet; the target communication protocol specification is the specification of the communication protocol used between the target sending end and the target receiving end;

[0111] According to the adjusted data packet, determine the target check value of each to-be-updated check item respectively, and replace the check value of each to-be-updated check item in the data packet with the target check value.

[0112] In the embodiment of the application, the check item in the data packet needs to be adjusted after the data packet is adjusted, so as to avoid the loss of the data packet due to the non-compliance with the communication protocol specification. The to-be-updated check item is a check item that needs to update the value after the data packet is adjusted among all the check items of the target communication protocol specification. The to-be-updated check item is determined according to the selected feature adjustment policy, for example, when the feature adjustment policy is to adjust the sending interval, the check item generally does not need to be updated, and the to-be-updated check item does not exist; when the feature adjustment policy is to adjust the payload, the sequence number (i.e. the starting byte of the payload carried in the data packet) and the checksum generally need to be updated.

[0113] In the case where the to-be-updated check item exists, the target network node needs to calculate the target check value of each to-be-updated check item according to the adjusted data packet, and then fill the target check value into the corresponding field to update the original check value of the to-be-updated check item.

[0114] In an embodiment, after the data packet is adjusted according to the feature adjustment policy, the method further comprises:

[0115] In the case where the length and / or the sending interval of the adjusted data packet do not comply with the target communication protocol specification, the adjustment of the data packet is cancelled, and the step of determining the feature adjustment policy for the data packet is jumped to until the adjusted data packet complies with the target communication protocol specification;

[0116] The target communication protocol specification is the specification of the communication protocol used between the target sending end and the target receiving end.

[0117] In the embodiments of the present application, it is also necessary to verify whether the length or sending interval of the adjusted data packet conforms to the target communication protocol specification. For example, the TCP protocol generally stipulates that the payload of a data packet needs to be less than 1500 bytes. If the length or sending interval of the adjusted data packet does not conform to the target communication protocol specification, the adjustment is rolled back, and a feature adjustment strategy different from the currently adopted feature adjustment strategy is determined again.

[0118] It should be noted that, when the aforementioned deep Q network is used to predict the optimal feature adjustment strategy, it is difficult to instruct the deep Q network to output a feature adjustment strategy different from the originally selected feature adjustment strategy. Therefore, the method of re-determining the feature adjustment strategy can be as follows: the payload of the data packet is adjusted to the maximum number of bytes allowed by the target communication protocol specification, and then the remaining bytes are added back to the total payload to be allocated, and left for the next data packet.

[0119] In step 106, the adjusted data packet is sent to the target receiving end.

[0120] In the embodiments of the present application, after the target data packet is adjusted, the target network node sends the adjusted data packet to the target receiving end.

[0121] The network traffic disturbance method provided in the embodiments of the present application intercepts data packets between the target sending end and the target receiving end, calculates the network traffic features of the data packet blocks in units of data packet blocks, and determines a feature adjustment strategy that can make the network traffic features of the adjusted data packet blocks closer to the feature disturbance target after the data packets are adjusted according to the current network traffic features of the data packet blocks in which the data packets are located. After the data packets are adjusted according to the feature adjustment strategy, the data packets are sent to the target receiving end. The embodiments of the present application can support shaping the original data packets in the traffic according to a specific feature disturbance target to achieve network traffic camouflage, and have stronger concealment and improved defense performance compared with feature disturbance algorithms that only destroy feature distribution.

[0122] In one embodiment, a network traffic disturbance method is provided, as shown in Figure 2 , comprising:

[0123] S1, an environment simulator is constructed. A deep neural network (DNN) classifier is constructed as the environment simulator to simulate the analysis behavior of an attacker on encrypted traffic. The input of the environment simulator is network traffic features, and the output is the confidence that the network traffic features belong to each traffic category. In the training phase, the environment simulator can be pre-trained based on a real traffic data set, and a cross-entropy loss function is used to optimize the classification accuracy. In the running phase, the parameters are fixed, and are used to evaluate the deception effect of the disturbed traffic on the classifier.

[0124] S2, deep Q network training. A deep Q network framework is designed, and a double-layer bidirectional LSTM structure is used to model the state-action value function Q(s, a). The state s is defined as a three-tuple (the current packet length l of the data packet block i , the arrival interval t i , and the number of unallocated payload bytes ε in the total payload of the data packet block i ); the action a is the packet length l i+1 and the sending interval t i+1 of the next data packet. The reward function R can be seen in the aforementioned formula (I), and the deep Q network obtains the parameters required for calculating the reward function by interacting with the environment simulator in real time.

[0125] The parameters θ of the initial deep Q network are iterated through the deep Q learning algorithm to obtain the trained target deep Q network.

[0126] As shown in Figure 3 , the foregoing S1 and S2 can be executed offline. After execution, the environment simulator and the target deep Q network are deployed on the target network node for real-time traffic disturbance.

[0127] S3, intercepting the data packets sent by the target sender to the target receiver.

[0128] Among them, the target sender and the target receiver use encrypted communication, and the target network node can read the bidirectional traffic between the target sender and the target receiver in real time, and intercept the data packets sent by the target sender to the target receiver. Among them, the intercepted data packets are encrypted data packets.

[0129] S4, dividing the data packet block according to the ACK packet of the TCP protocol.

[0130] Among them, the target network node intercepts all data packets between two ACK packets sent by the target receiver as a data packet block. If the target network node reads the network traffic of multiple communication streams at the same time, the target network node can divide the independent communication streams according to the five-tuple (source IP, destination IP, source port, destination port, protocol) in the data packet, and monitor the ACK packet and execute the above data packet block division process for each independent communication stream.

[0131] S5, extracting statistical features of the data packet block as the current network traffic features. According to the feature importance ranking, multiple core statistical features are extracted, including the maximum / minimum / average value of the packet length, the standard deviation of the time interval, the packet length distribution histogram, the traffic duration, the time interval distribution histogram, the maximum / minimum / average time interval, etc. Feature standardization is performed, and continuous features (such as time interval) are normalized to eliminate the influence of dimension.

[0132] S6, real-time traffic disturbance. When a new unprocessed data packet is received, update the current network traffic characteristics of the data packet block to which the unprocessed data packet belongs, and take the current network traffic characteristics as the state s i , and predict the optimal action a i+1 (i.e., the adjusted packet length l i+1 and the sending interval t i+1 ) through the trained target deep Q network. During the disturbance process, ensure the conservation of the total amount of data packet payload (i.e., ε i = ε i-1 -l i ). Process the data packets in units of each data packet block to avoid delay accumulation caused by the dependence of data packets in different data packet blocks on each other.

[0133] S7, protocol verification. The disturbed data packets need to meet the TCP / IP protocol compliance: 1) the sequence number (SEQ) and the acknowledgement number (ACK) fields are refilled according to the protocol specification to ensure correct parsing at the receiving end; 2) the checksum (Checksum) field is calculated in real time to prevent the data packet from being discarded; 3) the length of a single data packet is limited to [60, 1500] bytes (consistent with the MTU constraint). Through the protocol verification module, dynamically adjust the disturbance parameters. If the generated data packet violates the above rules, trigger the rollback mechanism to re-allocate the remaining byte number to the subsequent data packet.

[0134] After the execution of S7 is completed, the current network traffic characteristics of the data packet block to which the processed data packet belongs need to be updated according to the characteristics of the processed data packet.

[0135] S8, output the disturbed traffic. Real-time forward the protocol-verified data packet to the target receiving end. The output traffic is statistically biased towards the target category while maintaining the original communication semantics (such as the request-response mode), for example, disguising instant messaging traffic as video stream traffic.

[0136] It should be understood that although each step in the flowchart involved in each of the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each of the above embodiments can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0137] Based on the same inventive concept, the embodiments of the present application also provide a network traffic disturbance device for implementing the network traffic disturbance method described above. The implementation scheme of the device for solving the problem is similar to the implementation scheme described in the above method, so the specific limitations in one or more network traffic disturbance device embodiments provided below can refer to the limitations of the network traffic disturbance method described above, which will not be repeated here.

[0138] In one embodiment, as shown in Figure 4 a network traffic disturbance device 400 is provided, comprising: an interception module 402, a first determination module 404, and a sending module 406, wherein:

[0139] The interception module 402 is configured to intercept a data packet sent by a target sending end to a target receiving end, determine a data packet block where the data packet is located, and obtain a feature disturbance target of the data packet block.

[0140] The first determination module 404 is configured to determine a feature adjustment strategy for the data packet according to a current network traffic feature of the data packet block, and perform adjustment processing on the data packet according to the feature adjustment strategy, so that the network traffic feature of the data packet block after the adjustment of the data packet is closer to the feature disturbance target than the current network traffic feature.

[0141] The sending module 406 is configured to send the adjusted data packet to the target receiving end.

[0142] In one embodiment, the feature adjustment strategy includes adjusting a payload carried by the data packet in a total payload, and / or adjusting a sending interval between the data packet and a previous data packet; the total payload is a collection of payloads of data packets in the data packet block.

[0143] In one embodiment, the feature disturbance target includes adjusting a traffic category to which the network traffic feature is classified to a target traffic category.

[0144] The first determination module 404 is further configured to:

[0145] determine a strategy value interval corresponding to the feature adjustment strategy, the strategy value interval being composed of a value interval of the payload and / or a value interval of the sending interval;

[0146] determine a target strategy value of the feature adjustment strategy from the strategy value interval, the action value corresponding to the target strategy value being the highest among the action values corresponding to all strategy values in the strategy value interval.

[0147] The action value is determined by adjusting the data packet according to the target policy value, and the probability of the network traffic feature of the data packet block being classified into the target traffic category.

[0148] In one of the embodiments, the target policy value is determined by inputting the current network traffic feature into a target deep Q network, and the device further comprises:

[0149] The second determining module is configured to obtain an initial deep Q network and a plurality of sample data packets, and determine sample current network traffic features of the sample data packets.

[0150] The prediction module is configured to take any of the sample data packets as a target sample data packet, determine an initial policy value in the policy value interval, and predict an action value corresponding to the initial policy value and the sample current network traffic feature by using the initial deep Q network.

[0151] The training module is configured to train the initial deep Q network according to a difference between the action value and a target action value corresponding to the initial policy value, until a training stop condition is met, and take the current initial deep Q network as the target deep Q network.

[0152] In one of the embodiments, the device further comprises:

[0153] The third determining module is configured to determine to-be-updated check items of the data packet based on a target communication protocol specification; and the target communication protocol specification is a specification of a communication protocol used between the target sending end and the target receiving end.

[0154] The fourth determining module is configured to determine target check values of the to-be-updated check items respectively according to the adjusted data packet, and replace check values of the to-be-updated check items in the data packet with the target check values respectively.

[0155] In one of the embodiments, the device further comprises:

[0156] The revoking module is configured to, in a case where a length of the adjusted data packet and / or the sending interval does not conform to the target communication protocol specification, revoke the adjustment on the data packet, and jump to a step of determining a feature adjustment strategy for the data packet until the adjusted data packet conforms to the target communication protocol specification.

[0157] The target communication protocol specification is a specification of a communication protocol used between the target sending end and the target receiving end.

[0158] In one of the embodiments, the data packet block is composed of all the data packets sent by the target sender to the target receiver during the two times that the target receiver returns ACK packets to the target sender.

[0159] Each of the modules in the apparatus can be implemented by software, hardware, and combinations thereof, in whole or in part. The modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the modules.

[0160] In one embodiment, a computer device, which can be a server, is provided, and an internal structure diagram of the computer device can be as shown in Figure 5 The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement a network traffic perturbation method.

[0161] Those skilled in the art can understand that Figure 5 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0162] In one embodiment, a computer device is provided, including a memory and a processor, and the memory stores a computer program. The processor executes the computer program to implement the steps in the above method embodiments.

[0163] In one embodiment, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0164] In one embodiment, a computer program product is provided, and the computer program product includes a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0165] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0166] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0167] The technical features of the above embodiments can be combined in any way. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present disclosure.

[0168] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A network traffic perturbation method, characterized by, The method comprises: intercepting a data packet sent by a target sending end to a target receiving end, determining a data packet block where the data packet is located, and obtaining a characteristic perturbation target of the data packet block; determining a characteristic adjustment strategy for the data packet according to a current network traffic characteristic of the data packet block, and adjusting the data packet according to the characteristic adjustment strategy, so that the network traffic characteristic of the data packet block after the data packet is adjusted is closer to the characteristic perturbation target than the current network traffic characteristic; sending the adjusted data packet to the target receiving end.

2. The method of claim 1, wherein, The characteristic adjustment strategy comprises adjusting a payload carried by the data packet in a total payload, and / or adjusting a sending interval between the data packet and a previous data packet; the total payload is a collection of payloads of data packets in the data packet block.

3. The method of claim 2, wherein, The characteristic perturbation target comprises adjusting a traffic category to which the network traffic characteristic is classified to a target traffic category; The determining of the characteristic adjustment strategy for the data packet according to the current network traffic characteristic of the data packet block comprises: determining a strategy value interval corresponding to the characteristic adjustment strategy, the strategy value interval being composed of a value interval of the payload and / or a value interval of the sending interval; determining a target strategy value of the characteristic adjustment strategy from the strategy value interval, an action value corresponding to the target strategy value being the highest among action values corresponding to all strategy values in the strategy value interval; wherein the action value is determined by a probability that the network traffic characteristic of the data packet block is classified to the target traffic category after the data packet is adjusted according to the target strategy value; the network traffic characteristic is determined based on the adjusted data packet and the current network traffic characteristic.

4. The method of claim 3, wherein, The target strategy value is determined by inputting the current network traffic characteristic into a target deep Q network; the method further comprises: obtaining an initial deep Q network and a plurality of sample data packets, and determining sample current network traffic characteristics of the sample data packets; taking any sample data packet as a target sample data packet, determining an initial strategy value from the strategy value interval, and predicting an action value corresponding to the initial strategy value for the sample current network traffic characteristic through the initial deep Q network; training the initial deep Q network according to a difference between the action value and a target action value corresponding to the initial strategy value until a training stop condition is met, and taking the current initial deep Q network as the target deep Q network.

5. The method of claim 1, wherein, After the data packet is adjusted according to the characteristic adjustment strategy, the method further comprises: determining to-be-updated check items of the data packet based on a target communication protocol specification; the target communication protocol specification is a specification of a communication protocol used between the target sending end and the target receiving end; determining target check values of the to-be-updated check items respectively according to the adjusted data packet, and respectively replacing check values of the to-be-updated check items in the data packet with the target check values.

6. The method of claim 2, wherein, After the data packet is adjusted according to the feature adjustment strategy, the method further comprises: In the case that the length of the adjusted data packet and / or the sending interval does not conform to the target communication protocol specification, the adjustment of the data packet is revoked, and the step of determining the feature adjustment strategy for the data packet is jumped to until the adjusted data packet conforms to the target communication protocol specification; The target communication protocol specification is the specification of the communication protocol used between the target sending end and the target receiving end.

7. The method of claim 1, wherein, The data packet block is composed of all data packets sent by the target sending end to the target receiving end during the period when the target receiving end returns ACK packets to the target sending end twice.

8. A network traffic perturbation apparatus, characterized by, The device comprises: An intercepting module for intercepting data packets sent by a target sending end to a target receiving end, determining a data packet block in which the data packets are located, and obtaining a feature perturbation target of the data packet block; A first determining module for determining a feature adjustment strategy for the data packets according to the current network traffic feature of the data packet block, and adjusting the data packets according to the feature adjustment strategy, so that the network traffic feature of the data packet block after the adjustment of the data packets is closer to the feature perturbation target than the current network traffic feature; A sending module for sending the adjusted data packets to the target receiving end. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images