Encrypted traffic data leakage traceability method and system based on spatio-temporal characteristics

Abstract

The invention relates to the technical field of spatio-temporal characteristics, and provides an encrypted traffic data leakage traceability method and system based on spatio-temporal characteristics, and the method comprises the steps: obtaining transmission control protocol stream data and optical phase fluctuation data of encrypted traffic, the transmission control protocol stream data comprising time sequence statistical characteristics and spatial fingerprint characteristics; generating time-space associated website fingerprints based on the time sequence statistical features and the space fingerprint features; based on the optical phase fluctuation data, generating thermodynamic information in combination with a flow load change rate; processing the time-space associated website fingerprints by using a double-flow 3D convolutional network to extract first time-space features, and processing the thermodynamic information to extract second time-space features; and carrying out weighted fusion on the first spatial-temporal feature and the second spatial-temporal feature through a gating attention mechanism, and outputting a tracing result of encrypted traffic data leakage. According to the method and the device, the problems of low accuracy and poor reliability of encryption agent traffic leakage tracing in the prior art are solved, and the accuracy and the reliability of encryption agent traffic leakage tracing are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of spatiotemporal features, in particular to a method and system for tracing data exfiltration of encrypted traffic based on spatiotemporal features. BACKGROUND

[0002] Under the background of the wide application of encryption communication technology, malicious actors often use encryption proxy means to hide data exfiltration traces, making traditional detection methods based on plaintext traffic ineffective. There is an urgent need for a technical solution that can penetrate the encryption layer and accurately identify the source and transmission path of data exfiltration, especially when dealing with proxy traffic using dynamic encryption strategies, a comprehensive analysis method that takes into account both traffic behavior features and network transmission features is needed.

[0003] A solution based on deep packet inspection and behavior modeling analyzes the metadata features of encrypted traffic, including packet size distribution, transmission time interval, and other statistical characteristics, and establishes a behavior profile by combining traffic burst patterns. This solution uses a time series neural network to model traffic features and performs trace analysis by matching traffic behavior patterns with a pre-built feature library.

[0004] This deep packet inspection solution is sensitive to the randomization of encrypted traffic and its recognition effectiveness decreases when traffic features are deliberately obscured. Its behavior modeling method is difficult to cope with feature distortion caused by proxy node transit, and due to the lack of physical layer transmission features, it is prone to false positives in complex network environments. The loss of path information during traffic transit also limits the depth of traceability of this solution. SUMMARY

[0005] The present application provides a method and system for tracing data exfiltration of encrypted traffic based on spatiotemporal features, which solves the problem of low accuracy and poor reliability in existing technology for tracing data exfiltration of encrypted proxy traffic, and improves the accuracy and reliability of tracing data exfiltration of encrypted proxy traffic.

[0006] In a first aspect, the present application provides a method for tracing data exfiltration of encrypted traffic based on spatiotemporal features, comprising: obtaining transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, the transmission control protocol flow data including time series statistical features and spatial fingerprint features; generating a spatiotemporal correlation site fingerprint based on the time series statistical features and the spatial fingerprint features; generating thermal information based on the optical phase fluctuation data and combining traffic load change rate; processing the spatiotemporal correlation site fingerprint to extract first spatiotemporal features and processing the thermal information to extract second spatiotemporal features using a dual-flow 3D convolutional network; The first spatio-temporal feature and the second spatio-temporal feature are fused by a gating attention mechanism to output a tracing result of the encrypted traffic data leakage.

[0007] Optionally, the fusing the first spatio-temporal feature and the second spatio-temporal feature by a gating attention mechanism to output a tracing result of the encrypted traffic data leakage comprises: performing feature correlation calculation on the first spatio-temporal feature and the second spatio-temporal feature to generate a feature interaction matrix; calculating dynamic weight coefficients of the first spatio-temporal feature and the second spatio-temporal feature respectively by an activation function in the gating attention mechanism based on the feature interaction matrix; generating a tracing result by element-wise multiplication in the gating attention mechanism based on the dynamic weight coefficients.

[0008] Optionally, the generating a tracing result by element-wise multiplication in the gating attention mechanism based on the dynamic weight coefficients comprises: performing weighted summation on the first spatio-temporal feature and the second spatio-temporal feature by element-wise multiplication in the gating attention mechanism based on the dynamic weight coefficients to generate a weighted fusion feature; performing similarity matching on the weighted fusion feature and a website feature template in a pre-stored website feature library to determine a target website identifier corresponding to a website feature template with the highest similarity; generating an access path node sequence according to a path feature component in the weighted fusion feature; forming a tracing result based on the target website identifier and the access path node sequence.

[0009] Optionally, the generating an access path node sequence according to a path feature component in the weighted fusion feature comprises: extracting a path feature component from the weighted fusion feature, and decomposing the path feature component into a plurality of path feature sub-vectors; performing similarity calculation on each path feature sub-vector and standard feature data of a known node in a pre-constructed physical layer signal fingerprint library; identifying all known nodes with a similarity greater than or equal to a preset similarity threshold as target node identifiers, and arranging all target node identifiers in a time sequence to generate a candidate node sequence; merging repeated node identifiers of adjacent time stamps in the candidate node sequence to generate an access path node sequence.

[0010] Optionally, the generating a spatio-temporal correlation website fingerprint based on the time sequence statistical feature and the spatial fingerprint feature comprises: The time sequence statistical features are divided into a plurality of continuous feature segments according to equal-length time windows, and the spatial fingerprint features are quantified into fixed-dimension fingerprint vectors; Each of the continuous feature segments is connected with a corresponding vector sub-segment of the fingerprint vector in the equal-length time window to form a time-space binding unit; All of the binding units are stacked in time sequence to construct a three-dimensional feature block, wherein the first dimension represents a time window sequence, the second dimension represents a spatial fingerprint sub-segment, and the third dimension represents a feature value; In the three-dimensional feature block, a space-time correlation site fingerprint is generated through the correspondence between the time window sequence and the spatial fingerprint sub-segment.

[0011] Optionally, the thermal information is generated based on the optical phase fluctuation data in combination with a traffic load change rate, including: A data packet quantity change gradient of the transmission control protocol flow data is monitored in real time, and a traffic load change rate is calculated according to the data packet quantity change gradient; The modulation intensity of the optical phase fluctuation data is adjusted based on the traffic load change rate; The adjusted optical phase fluctuation data and the synchronously collected optical intensity sampling value are superimposed according to a time stamp to generate the thermal information.

[0012] Optionally, the first space-time feature is extracted by processing the space-time correlation site fingerprint and the second space-time feature is extracted by processing the thermal information, including: The space-time correlation site fingerprint is input into a first convolution branch of a dual-flow 3D convolution network, and a three-dimensional convolution operation is performed on the time, space and feature dimensions to obtain a first space-time feature reflecting traffic statistical characteristics; The thermal information is input into a second convolution branch of the dual-flow 3D convolution network, and a three-dimensional convolution operation is performed on the time, phase change and optical intensity dimensions to obtain a second space-time feature reflecting physical layer modulation characteristics.

[0013] In a second aspect, the present application provides a system for tracing encrypted traffic data leakage based on space-time features, including: An acquisition module is configured to acquire transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, wherein the transmission control protocol flow data includes time sequence statistical features and spatial fingerprint features; A first generation module is configured to generate a space-time correlation site fingerprint based on the time sequence statistical features and the spatial fingerprint features; A second generation module is configured to generate thermal information based on the optical phase fluctuation data in combination with a traffic load change rate; a processing module configured to process the spatiotemporal correlation website fingerprint using a dual-flow 3D convolution network to extract first spatiotemporal features and process the thermal information to extract second spatiotemporal features; a fusion module configured to fuse the first spatiotemporal features and the second spatiotemporal features by a gated attention mechanism to output a tracing result of the encrypted traffic data leakage.

[0014] In a third aspect, the present application provides a computing device comprising a processor and a memory, wherein the memory stores a computer program, and the processor is configured to execute the computer program to perform the method for tracing encrypted traffic data leakage based on spatiotemporal features according to any one of the first aspect.

[0015] In a fourth aspect, the present application provides a computer storage medium having computer program instructions stored thereon, wherein the computer program instructions are executed by a processor to implement the method for tracing encrypted traffic data leakage based on spatiotemporal features according to any one of the first aspect.

[0016] In the present application, a method for tracing encrypted traffic data leakage based on spatiotemporal features is provided, which comprises: obtaining transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, wherein the transmission control protocol flow data comprises time series statistical features and spatial fingerprint features; generating a spatiotemporal correlation website fingerprint based on the time series statistical features and the spatial fingerprint features; generating thermal information based on the optical phase fluctuation data in combination with a traffic load change rate; processing the spatiotemporal correlation website fingerprint using a dual-flow 3D convolution network to extract first spatiotemporal features and processing the thermal information to extract second spatiotemporal features; and fusing the first spatiotemporal features and the second spatiotemporal features by a gated attention mechanism to output a tracing result of the encrypted traffic data leakage.

[0017] The technical scheme provided by the present application has the following beneficial effects: The present application synchronously collects network layer flow features and physical layer optical signal features to provide a multi-dimensional data basis for subsequent analysis and break through the limitation of a single data source. The time series statistical features and the spatial fingerprint features are three-dimensionally correlated and modeled to form comprehensive fingerprint features that can simultaneously reflect the time variation law and the spatial distribution characteristics of the flow. The flow load change dynamically modulates the optical signal features to establish a real-time correlation between the network behavior and the physical layer signal change and enhance the representation ability of the features. The dual-flow network is used to respectively mine the spatiotemporal evolution mode in the flow statistical features and the modulation change law of the physical layer signal to realize deep feature extraction. The dynamic weight distribution mechanism is used to optimize the feature fusion process to improve the accuracy and reliability of the final tracing result.

[0018] Further, the application also dynamically determines the weight coefficients of the two types of features by calculating the interaction matrix of the first spatiotemporal feature and the second spatiotemporal feature, using the activation function in the gated attention mechanism, and finally realizes feature fusion by element-by-element multiplication to generate the tracing result.

[0019] Moreover, the method adaptively balances the contribution degrees of the network layer flow features and the physical layer signal features through a dynamic weight distribution mechanism, effectively improves the accuracy of feature fusion in the encrypted traffic tracing process, and enhances the identification ability of exfiltration behavior in a complex proxy environment.

[0020] These aspects or other aspects of the present application will be more apparent in the following description of the embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0022] Figure 1 A flowchart of an encrypted traffic data exfiltration tracing method based on spatiotemporal features provided by an embodiment of the present application; Figure 2 A structural schematic diagram of an encrypted traffic data exfiltration tracing system based on spatiotemporal features provided by an embodiment of the present application; Figure 3 A structural schematic diagram of a computing device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application.

[0024] In some processes described in the specification and claims of the present application and the above description, a plurality of operations appearing in a specific order are included, but it should be clearly understood that these operations can be executed in the order appearing in the text or in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes can include more or fewer operations, and the operations can be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in the text are used to distinguish different messages, devices, modules, etc., and do not represent the order of sequence, nor do "first" and "second" represent different types.

[0025] Existing methods mainly rely on analyzing statistical features of network traffic, such as packet size, transmission interval, etc., but these features are easily disguised or disturbed in encrypted proxy environments. Especially when data is transferred through multiple proxy nodes, the original traffic features are distorted, making it difficult for the tracing system to accurately identify the true data leakage source and transmission path. More importantly, such methods completely ignore the changing characteristics of physical layer signals during network transmission, and these physical signals often contain key information that is difficult to fake.

[0026] To solve these problems, the present application proposes an encrypted traffic data leakage tracing method based on spatiotemporal features, which realizes accurate tracing by simultaneously analyzing network traffic features and physical layer optical signal features. The method first collects Transmission Control Protocol stream data and optical phase fluctuation data of encrypted traffic, then converts these two types of features into spatiotemporal correlation feature representations, and finally accurately identifies the source and transmission path of data leakage through an intelligent fusion algorithm to automatically determine the importance of each feature. The biggest advantage of this method is that even if the network traffic features are deliberately disguised, the physical layer optical signal features can still provide reliable judgment basis, and the two features can confirm each other, improving the accuracy of tracing in complex proxy environments and effectively solving the problems of inaccurate identification and difficult path restoration faced by existing technologies.

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0028] Figure 1 A flowchart of an encrypted traffic data leakage tracing method based on spatiotemporal features provided by the embodiments of the present application is shown in Figure 1 The method comprises: Step 101: Obtain Transmission Control Protocol stream data and optical phase fluctuation data of encrypted traffic, wherein the Transmission Control Protocol stream data comprises time series statistical features and spatial fingerprint features.

[0029] In step 101, the Transmission Control Protocol stream data refers to the sequence of data packets transmitted according to fixed rules in encrypted communication. The optical phase fluctuation data represents the change data of the phase angle in the process of optical signal transmission, reflecting the signal modulation state. The time series statistical features represent the distribution law of data packets in the time dimension, such as the distribution of transmission interval. The spatial fingerprint features represent the distribution pattern of data packets in the transmission direction, forming a unique traffic feature vector.

[0030] In the embodiments of the present application, first, the transmission control protocol data packets are captured from the encrypted communication channel, the size and arrival time of each data packet are recorded, the time interval between consecutive data packets is calculated, and the time sequence statistical features are formed; at the same time, the number distribution of data packets in different transmission directions is counted and quantified as a fixed-length spatial fingerprint vector; the phase fluctuation signal output by the optical transmission equipment is synchronously collected, and the data of the change of the signal phase angle with time is recorded; finally, the three types of data are aligned and stored according to the same time reference, providing basic data for subsequent processing.

[0031] For example, taking the monitoring of data leakage in an intranet of an enterprise as an example, a data collection device is deployed at the core switch to continuously capture the transmission control protocol traffic passing through the encryption agent, the average value and the variance of the data packet size in the time period are counted every minute as the time sequence statistical features, and the data packet transmission direction distribution is quantified as a 128-dimensional vector as the spatial fingerprint feature; a phase detection device is synchronously installed at the optical transmission node to record the change data of the optical signal phase angle at the same time interval; after the three types of data are marked with a unified time, they are stored in an analysis database. The time interval calculation method in the time sequence statistical features is to take the difference between the timestamps of adjacent data packets.

[0032] Step 102: generating a space-time correlation website fingerprint based on the time sequence statistical features and the spatial fingerprint features.

[0033] In step 102, the space-time correlation website fingerprint represents a website access behavior feature representation that integrates time and space features.

[0034] In the embodiments of the present application, the time sequence statistical features are divided into a plurality of continuous time periods according to a fixed time length, the feature data in each time period constitutes a feature segment; the spatial fingerprint vector is divided into a corresponding number of sub-segments according to the same number of time periods; the feature segment of each time period is combined with the corresponding spatial fingerprint sub-segment to form a time-space binding unit; all the binding units are arranged in time sequence to construct a three-dimensional feature block, wherein the first dimension represents the time sequence, the second dimension represents the spatial feature, and the third dimension stores the specific feature values; through this organization mode, a website fingerprint feature that can reflect both time variation and spatial distribution is formed.

[0035] For example, according to the previous example, the collected 10-minute data is divided into 10 time periods according to a one-minute window, and the average value and the interval variance of the packet size in each time period constitute a feature segment; the 128-dimensional spatial fingerprint vector is equally divided into 10 sub-segments; the feature segment of the first minute is combined with the first 12 sub-segments, the feature segment of the second minute is combined with the next 12 sub-segments, and so on; finally, a 10x12x2 three-dimensional feature block is constructed, wherein 10 corresponds to the time window, 12 is the dimension of the sub-segment, and 2 represents that each data point contains two feature values of the average value of the packet size and the interval variance.

[0036] Step 103: generating heat information based on the optical phase fluctuation data and in combination with the traffic load change rate.

[0037] In step 103, the traffic load change rate refers to the dynamic fluctuation of the data volume or transmission rate of the transmission control protocol flow in the encrypted proxy channel, which is derived from real-time monitoring statistics of encrypted traffic packets, and is obtained by calculating the number of bytes or packet quantity change transmitted per unit time. The heat information represents characteristic data reflecting the influence of network load change on optical signal modulation.

[0038] In the embodiments of the present application, the number of data packets of the transmission control protocol flow is counted in real time, the difference in the number of data packets in adjacent time periods is calculated to obtain the traffic load change rate, the optical phase modulation intensity is dynamically adjusted according to the size and direction of the change rate, and the modulated phase fluctuation data and the synchronously collected optical intensity sampling values are superimposed according to the time points to form heat information data containing phase and optical intensity changes.

[0039] For example, continuing the previous example, the difference between the number of data packets per minute and the number of data packets in the previous minute is calculated, the optical phase modulation intensity is increased by the value of the difference multiplied by a coefficient when the difference is greater than zero, and the optical phase modulation intensity is decreased by the value of the difference multiplied by a coefficient when the difference is less than zero; the adjusted phase data and the optical intensity data are superimposed in a manner of one sampling point per second to generate 600 sampling points of heat information, each of which contains two values of phase angle and optical intensity.

[0040] Step 104: processing the spatiotemporal correlation site fingerprint to extract first spatiotemporal features and processing the heat information to extract second spatiotemporal features using a dual-stream 3D convolutional network.

[0041] In step 104, the dual-stream three-dimensional convolutional network represents a deep learning model for processing two types of features in parallel. The first spatiotemporal features represent spatiotemporal pattern features extracted from encrypted traffic data, which specifically reflect the statistical rules of transmission control protocol flows in the time dimension and the distribution characteristics in the space dimension, and contain the fusion information of the timing change of data packet transmission and the spatial distribution of flow fingerprints. The second spatiotemporal features represent spatiotemporal pattern features extracted from the physical layer of optical signals, which specifically reflect the modulation change rules of optical phase and optical intensity in the time dimension, and contain the physical layer signal disturbance characteristics caused by traffic load changes. The physical correlation of the first spatiotemporal features with the timing statistical features and the spatial fingerprint features is that the timing statistical features provide the change rules of packet size and interval in the time axis, and the spatial fingerprint features provide the spatial distribution pattern of the flow vector, while the first spatiotemporal features are high-order fusion features extracted by the three-dimensional convolutional network for spatiotemporal correlation modeling of the two types of features, which not only retains the physical meaning of the original features, but also mines the cross-dimension correlation patterns of the original features.

[0042] In the embodiment of the present application, the spatio-temporal correlation website fingerprint is input into the first processing path of the three-dimensional convolution network, the change mode of the traffic data in the time and space dimensions is extracted through multi-layer three-dimensional convolution operation, and the first spatio-temporal feature is output; the thermal information is input into the second processing path, and the modulation feature of the optical signal in the time and physical dimensions is extracted through three-dimensional convolution operation, and the second spatio-temporal feature is output; the network structures of the two processing paths are the same but the parameters are independent, which ensures that the feature representation most suitable for each data type can be learned respectively.

[0043] For example, a three-dimensional feature block of 10x12x2 is input into the first path, a 3x3x2 convolution kernel is used for three times of convolution operation, the feature map size decreases after each convolution, and finally a first spatio-temporal feature of 48 dimensions is output; the thermal information of 10x20x50 is input into the second path, a 3x5x5 convolution kernel is used for three times of convolution, and finally a second spatio-temporal feature of 72 dimensions is output; the size and step length of the convolution kernel of the two paths are set to ensure that the spatio-temporal change law of the respective data can be effectively captured.

[0044] Step 105: The first spatio-temporal feature and the second spatio-temporal feature are weighted and fused through a gated attention mechanism, and a tracing result of encrypted traffic data leakage is output.

[0045] In step 105, the gated attention mechanism represents a fusion method of dynamically adjusting feature weights. The tracing result refers to the data leakage behavior analysis conclusion finally output by the method, which specifically includes two core elements: one is the identified leakage target website identifier, i.e., the specific website to which the data finally flows; the other is the restored access path node sequence, i.e., the complete transmission route of the data from the source to each network transfer node of the target website. The two elements together constitute a complete tracking and positioning of the data leakage behavior in the encrypted proxy environment.

[0046] In the embodiment of the present application, the similarity matrix of the first spatio-temporal feature and the second spatio-temporal feature is calculated, and the weight coefficients are converted through an activation function; the two types of features are dynamically weighted and summed using these coefficients to obtain a fusion feature; the fusion feature is compared with a pre-stored website feature template to find the website corresponding to the most similar template as the leakage source; at the same time, the path related information is extracted from the fusion feature to restore the network node sequence through which the data passes, and finally the complete tracing result is output.

[0047] For example, the similarity of the first spatiotemporal feature with 48 dimensions and the second spatiotemporal feature with 72 dimensions is calculated, the weight coefficient between 0 and 1 is converted through a sigmoid function, the weighted two types of features are spliced into a 120-dimensional fusion feature vector, and then the fusion feature vector is compared with 100 pre-stored website feature templates in the feature library one by one, the website template with the highest matching degree is found out by using a cosine similarity algorithm, and the corresponding exfiltration target website A is determined. Meanwhile, the node feature data of 10 continuous time periods is parsed from the fusion feature vector, and the node features in the physical layer signal fingerprint library are matched in turn, and three network nodes through which the data passes in sequence are identified as node B, node C and node D. Finally, the output traceability result contains the target website identifier A and the access path node sequence B, C and D arranged in time sequence, which completely presents the endpoint and transmission route of data exfiltration. The similarity calculation uses a standard cosine similarity formula, the numerator is the dot product of the feature vectors, and the denominator is the product of the lengths of the vectors.

[0048] The method synchronously analyzes network traffic features and physical layer optical signal features, constructs a multi-dimensional spatiotemporal correlation model, automatically extracts key features by using deep learning technology, and realizes accurate traceability through an intelligent fusion mechanism. Even in an encrypted proxy environment, the data exfiltration source and transmission path can be accurately identified, the shortcomings of traditional methods in feature camouflage and path restoration are solved, and the reliability and accuracy of encrypted traffic traceability are improved.

[0049] To solve the problem of insufficient feature fusion accuracy in encrypted traffic traceability, in some embodiments, step 105: the first spatiotemporal feature and the second spatiotemporal feature are weighted and fused by using a gated attention mechanism to output a traceability result of encrypted traffic data exfiltration, including: Step 201: Perform feature correlation calculation on the first spatiotemporal feature and the second spatiotemporal feature to generate a feature interaction matrix.

[0050] In step 201, the feature interaction matrix refers to a mathematical representation reflecting the correlation degree between the two types of spatiotemporal features. The rows of the matrix correspond to the dimensions of the first spatiotemporal feature, the columns correspond to the dimensions of the second spatiotemporal feature, and each element value represents the correlation strength of the corresponding dimensional features.

[0051] In the embodiments of the present application, the first spatiotemporal feature and the second spatiotemporal feature are subjected to matrix multiplication. The first spatiotemporal feature is the multiplier, and the second spatiotemporal feature is the multiplicand after transposition. An initial interaction matrix is calculated. The matrix is normalized to make the element values within a reasonable range, and finally a feature interaction matrix reflecting the correlation relationship between the dimensions of the two types of features is generated.

[0052] Step 202: Based on the feature interaction matrix, the dynamic weight coefficients of the first spatio-temporal feature and the second spatio-temporal feature are respectively calculated by an activation function in the gated attention mechanism.

[0053] In step 202, the dynamic weight coefficient refers to the weight value obtained by processing the feature interaction matrix through the activation function, which is used to quantify the importance of the two types of features in different dimensions.

[0054] In the embodiments of the present application, the mean values of the feature interaction matrix are calculated by row and column respectively to obtain the initial weight distribution of the two types of features; the initial weight is input into the activation function for nonlinear transformation to ensure that the weight value is within a certain range; the transformed weight is normalized to keep the sum of all weight coefficients constant, and finally the dynamic weight coefficient for feature fusion is generated.

[0055] Step 203: Based on the dynamic weight coefficient, the traceability result is generated by element-wise multiplication in the gated attention mechanism.

[0056] In step 203, element-wise multiplication refers to the operation of multiplying the feature values at corresponding positions according to the weight coefficients.

[0057] In the embodiments of the present application, the dynamic weight coefficient of the first spatio-temporal feature is used to weight each feature value, and the dynamic weight coefficient of the second spatio-temporal feature is used to weight the corresponding feature value; the weighted two types of features are concatenated by dimension to form a fusion feature vector; the exfiltration website is determined according to the matching result of the fusion feature and the pre-stored feature, and the path node information is parsed from the fusion feature, arranged in time sequence to generate a complete traceability result.

[0058] The following is a specific example: In the enterprise intranet data exfiltration monitoring scene, the system has extracted 48-dimensional first spatio-temporal features and 72-dimensional second spatio-temporal features. First, the two groups of features are subjected to matrix multiplication operation, where the first spatio-temporal feature is a 120x48 matrix, and the second spatio-temporal feature is transposed to a 72x120 matrix. After multiplication, a 48x72 feature interaction matrix is obtained, and each element value of the matrix represents the correlation degree between the corresponding dimensions of the two types of features. The mean values of the feature interaction matrix are calculated by row and column respectively to obtain 48-dimensional and 72-dimensional initial weight vectors, which are input into the sigmoid activation function for transformation. The sigmoid function expression is where x represents the input value, Output a weight coefficient between 0 and 1; normalize the transformed weight coefficient so that the sum of all weights of the first spatiotemporal feature is 1 and the sum of all weights of the second spatiotemporal feature is also 1; use the normalized weight coefficient to perform element-by-element multiplication weighting on the original feature, multiply each dimension value of the first spatiotemporal feature by the corresponding weight coefficient, and similarly process the second spatiotemporal feature to obtain a weighted 48-dimensional and 72-dimensional feature vector; concatenate the two groups of weighted features into a 120-dimensional fusion feature vector, and calculate the similarity with the pre-stored 100 website feature templates using the cosine similarity formula where X and Y represent feature vectors, · represents dot product operation, and ||·|| represents vector length; find the website A corresponding to the template with the highest similarity as the exfiltration target, and parse 10 time period node features from the fusion feature; after matching with the physical layer signal fingerprint library, determine that the data passes through node B, node C and node D in turn, and finally output the complete tracing result of website A and path B to C to D, where the path node identification is based on the matching degree of the node features in each time period exceeding the set threshold 0.85 and having continuity in time sequence.

[0059] In the embodiments of the present application, the method realizes accurate feature fusion through a dynamic weight distribution mechanism, effectively improves the accuracy of encrypted traffic tracing, can reliably identify the exfiltration target and restore the complete transmission path, and solves the shortcomings of traditional methods in feature fusion and path restoration.

[0060] To solve the problem of accuracy of feature fusion and path restoration in encrypted traffic tracing, in some embodiments, step 203: based on the dynamic weight coefficient, a tracing result is generated through element-by-element multiplication in the gated attention mechanism, including: Step 301: based on the dynamic weight coefficient, weighted sum is performed on the first spatiotemporal feature and the second spatiotemporal feature through element-by-element multiplication in the gated attention mechanism to generate a weighted fusion feature.

[0061] In step 301, the weighted fusion feature refers to a comprehensive feature representation dynamically combined according to importance of two types of spatiotemporal features, wherein the value of each feature dimension is obtained by multiplying the original feature value by the corresponding weight coefficient.

[0062] In the embodiments of the present application, the dynamic weight coefficient of the first spatiotemporal feature is used to perform element-by-element multiplication operation on each feature value thereof, and the same operation is performed on the second spatiotemporal feature; the two types of weighted features are concatenated in dimension order to form a longer new feature vector; the new feature vector is standardized to ensure that the values of each dimension are within a comparable range, and finally a weighted fusion feature containing dual characteristics of network traffic and physical signals is generated.

[0063] Step 302: Similarity matching is performed between the weighted fusion feature and website feature templates in a pre-stored website feature library to determine a target website identifier corresponding to a website feature template with the highest similarity.

[0064] In step 302, the website feature template refers to a pre-stored standard mode of various website access behavior features, and each template corresponds to a unique identifier of a specific website. The target website identifier refers to a unique identity identifier corresponding to a pre-stored website feature template that is most consistent with the weighted fusion feature determined through similarity matching. It specifically represents a digital code of a specific website or network service that represents the final flow direction of exfiltrated data. In actual applications, it can be a website domain name, an IP address hash value, or other unique coding forms, and is used to accurately indicate the end target of data exfiltration.

[0065] In the embodiments of the present application, similarity calculation is sequentially performed between the weighted fusion feature and all website templates in the feature library; the template with the largest similarity value is found through comparison; and the target website identifier of the final flow direction of exfiltrated data is determined according to the correspondence between the template and the website identifier.

[0066] Step 303: An access path node sequence is generated according to the path feature component in the weighted fusion feature.

[0067] In step 303, the path feature component refers to a feature subspace in the weighted fusion feature that specifically represents an access path, is derived from the light signal jump mode (reflecting the network nodes passed by the traffic) recorded in the second spatiotemporal feature, and is the key path information retained by the gated attention mechanism during feature fusion. The numerical change corresponds to the phase-intensity disturbance characteristics of the physical layer signal at different transmission nodes. The path feature component is a feature subset specifically representing the network transmission path separated from the weighted fusion feature. Its physical meaning is to record the light signal modulation traces left at the physical layer when the traffic passes through each network node. Unlike the first spatiotemporal feature mainly reflecting traffic statistical characteristics and the second spatiotemporal feature mainly reflecting physical layer modulation characteristics, the path feature component is the key path information selected from the second spatiotemporal feature through the gated attention mechanism, which not only inherits the physical layer characteristics of the phase-intensity change of the light signal in the second spatiotemporal feature, but also strengthens the feature dimension with the strongest association with the network node through weighted fusion, and is specifically used to restore the traffic transmission path. The access path node sequence is obtained by matching the path feature component with the pre-stored network topology node features. Specifically, after the path feature component is decomposed in the time dimension, the similarity between the features of each time slice and the known node light signal fingerprint is matched in sequence, so as to restore the actual node sequence passed by the traffic.

[0068] In the embodiment of the present application, the feature sub-segments corresponding to the time window are extracted from the weighted fused features; each sub-segment is matched with the pre-stored node feature library; the node identifiers with a matching degree exceeding a threshold are found out; the node identifiers are arranged in time sequence, and the adjacent repeated nodes are merged to generate a complete access path node sequence.

[0069] Step 304: Forming a traceability result based on the target website identifier and the access path node sequence.

[0070] In the embodiment of the present application, the determined target website identifier and the generated access path node sequence are combined; a complete traceability report is output after being packaged into structured data in a standard format and adding a timestamp and a credibility score.

[0071] The following is a specific example: In the enterprise intranet data leakage monitoring scene, the system has obtained the weighted 48-dimensional first space-time feature and the 72-dimensional second space-time feature, and after splicing the two groups of features into a 120-dimensional fused feature vector, the 120-dimensional fused feature vector is compared with 100 pre-stored website feature templates, each of which is a 120-dimensional vector; the cosine similarity formula is used to calculate the matching degree of the fused feature and each template, which is expressed as similarity equals the product of the dot product of two vectors divided by the product of their module lengths, wherein the dot product calculation is to multiply the corresponding dimension values and then sum them up, and the module length is the square root of the sum of the squares of the dimension values of each vector; find out that the template with the highest matching degree corresponds to a cloud storage platform identifier A, and the similarity value is 0.92; at the same time, 10 time period node feature sub-vectors are extracted from the fused feature, each of which is a 12-dimensional vector, and is matched with the node feature library in turn, and when the matching degree of a node exceeds the threshold value 0.85, the node identifier is recorded, and finally it is determined that the data passes through intranet server B, boundary firewall C and Internet gateway D in turn; the cloud storage platform identifier A and the path node sequence B to C to D are combined, and a complete traceability report is output.

[0072] In the embodiment of the present application, the method realizes accurate positioning of encrypted traffic leakage behavior through dynamic weighted fusion and hierarchical feature matching, which can not only accurately identify the final target of data leakage, but also restore the complete transmission path of data in a complex network, effectively solving the shortcomings of traditional methods in feature utilization and path restoration.

[0073] In order to solve the problem of incomplete encrypted traffic path restoration, in some embodiments, step 303: generating an access path node sequence according to the path feature components in the weighted fused features, comprises: Step 401: Extracting path feature components from the weighted fused features, and decomposing the path feature components into a plurality of path feature sub-vectors.

[0074] In step 401, the decomposition is based on the time window division manner when the original encrypted traffic data is collected, and specifically, the decomposition is performed according to the equal-length time interval (for example, one window per minute) used when the space-time correlation website fingerprint is generated, so as to ensure that each path feature sub-vector is strictly aligned with the initial time window, thereby maintaining the mapping relationship between the time dimension and the network node position in the traffic transmission process. The path feature sub-vector refers to a feature segment extracted from the weighted fusion feature according to the time window division, and each sub-vector contains physical layer signal feature data reflecting the change of the network transmission path in a specific time period. The complete path feature component is divided into sub-vectors according to the fixed time interval, and is used for independent analysis of the network nodes possibly passed by the traffic in each time period.

[0075] In the embodiment of the present application, the feature data segment corresponding to the time window is separated from the complete weighted fusion feature, and the feature data corresponding to each time period constitutes a path feature sub-vector. These sub-vectors are arranged in time sequence to form a feature sequence reflecting the path change.

[0076] Step 402: Similarity calculation is performed between each path feature sub-vector and the standard feature data of the known nodes in the pre-constructed physical layer signal fingerprint library.

[0077] In step 402, the physical layer signal fingerprint library refers to a pre-stored standard optical signal feature set of different network nodes, and each node corresponds to a unique optical signal modulation mode.

[0078] In the embodiment of the present application, similarity calculation is performed between each path feature sub-vector and the feature of all nodes in the fingerprint library, and the matching degree of the signal modulation feature is compared to evaluate the node possibly passed by the traffic in the time period.

[0079] Step 403: The identifiers of all known nodes with similarity greater than or equal to a preset similarity threshold are taken as target node identifiers, and all target node identifiers are arranged in time sequence to generate a candidate node sequence.

[0080] In step 403, the candidate node sequence refers to an intermediate result of the possible nodes arranged in time sequence after preliminary screening.

[0081] In the embodiment of the present application, for the path feature sub-vector of each time period, the node identifier with similarity reaching the threshold requirement is retained, and the matching result below the threshold is discarded; all qualified node identifiers of the time periods are sorted according to the collection time to form a preliminary path sequence.

[0082] Step 404: The repeated node identifiers of adjacent time stamps in the candidate node sequence are merged to generate an access path node sequence.

[0083] In the embodiment of the present application, the node identifiers of adjacent time periods in the candidate node sequence are checked. If the same node identifier appears continuously, it is merged into a single node and the duration range is recorded. The isolated nodes that appear briefly are verified. If they are reliable, they are retained. Finally, a concise and accurate complete path sequence is generated.

[0084] The following is a specific example: Based on the foregoing, it is identified that cloud storage platform A is the exfiltration target and it is preliminarily determined that the data passes through nodes B, C and D. The system extracts 10 12-dimensional path feature sub-vectors from the 120-dimensional weighted fusion features, and each sub-vector corresponds to the physical layer signal features of a 1-minute time window. The first sub-vector is compared with the pre-stored 50 network node feature library, and the matching degree is calculated using the cosine similarity formula. The formula is that the numerator is obtained by multiplying and adding the corresponding dimension values of the two vectors, and the denominator is obtained by multiplying the square roots of the sum of the dimension values of each vector. The matching degree of the first sub-vector and the feature of node B reaches 0.88. After processing the subsequent sub-vectors in turn, the matching degree of the second sub-vector and node B is 0.86, the matching degrees of the third and fourth sub-vectors and node C are 0.89 and 0.87 respectively, and the matching degrees of the fifth to seventh sub-vectors and node D are between 0.85 and 0.90. The matching results are arranged in time sequence to generate the initial node sequence B, B, C, C, D, D and D. After merging adjacent repeated nodes, the final access path node sequence B to C to D is formed, in which node B lasts for 2 minutes, node C lasts for 2 minutes, and node D lasts for 3 minutes.

[0085] In the embodiment of the present application, the method realizes accurate restoration of the encrypted traffic transmission path through hierarchical feature extraction and multi-level node verification, can accurately identify each key node and its duration that the data passes through, and solves the fragmentation and unreliability problems of the traditional method in path restoration.

[0086] In order to solve the problem of incomplete feature representation of encrypted traffic, in some embodiments, step 102: generating a space-time correlation site fingerprint based on the time sequence statistical features and the space fingerprint features, includes: Step 501: dividing the time sequence statistical features into multiple continuous feature segments according to equal-length time windows, and quantizing the space fingerprint features into fixed-dimension fingerprint vectors.

[0087] In step 501, the continuous feature segment refers to the equal-length segment of the time sequence statistical feature (such as the data packet transmission interval) divided by a fixed time length, and the continuity is guaranteed by strictly adjacent time stamps, for example, 10 minutes of traffic is divided into 10 segments by 1 minute window, and the end time of the nth segment is equal to the start time of the n+1 segment. The fixed dimension represents that the space fingerprint vector is quantized to a 128-dimensional vector, and each dimension corresponds to a specific traffic statistical quantity (such as the packet size percentile). The fingerprint vector is a numerical sequence of a fixed dimension quantized from the traffic direction feature.

[0088] In the embodiment of the present application, the collected time sequence statistical features are divided into multiple continuous time periods by a fixed time length, and the data packet statistical quantity in each time period constitutes a feature segment; at the same time, the original space fingerprint feature is converted into a numerical vector of uniform dimension, to ensure the comparability of the features of different time periods.

[0089] Step 502: Pair and connect each of the continuous feature segments with the vector sub-segments of the corresponding equal-length time window in the fingerprint vector to form a time and space binding unit.

[0090] In step 502, the generation process of the vector sub-segment is to equally divide the fixed dimension fingerprint vector by the number of time windows, if the vector is 128-dimensional and divided into 10 time windows, then each sub-segment is 12.8-dimensional (actually 12 or 13-dimensional). The binding unit refers to the associated structure formed by combining the time feature segment and the corresponding space fingerprint sub-segment.

[0091] In the embodiment of the present application, the feature segment of each time period is paired with the sub-segment at the corresponding position in the fingerprint vector, and the two types of features are combined into a larger feature unit by a specific connection method, to establish the correspondence between time and space.

[0092] Step 503: Stack all the binding units in time sequence to construct a three-dimensional feature block, wherein the first dimension represents the time window sequence, the second dimension represents the space fingerprint sub-segment, and the third dimension represents the feature value.

[0093] In step 503, the time sequence is different from the equal-length time window: the equal-length time window emphasizes the division rule (such as every 1 minute), and the time sequence emphasizes the time sequence of the segment arrangement (window 1 to window 2 to…to window N). The three-dimensional feature block refers to a three-dimensional data structure formed by stacking multiple binding units in time sequence. The continuous feature segment is mainly reflected by the first dimension time window sequence, each time window corresponds to the feature data in a continuous time period, and the continuity of the feature is embodied by the sequential arrangement of the first dimension, and the third dimension feature value stores the specific statistical value in each time window.

[0094] In the embodiment of the present application, the binding units of all time periods are arranged in the order of collection time, the first dimension represents the time axis sequence, the second dimension represents the spatial fingerprint sub-section, and the third dimension stores specific feature values, thereby constructing a three-dimensional feature block containing complete space-time information.

[0095] Step 504: In the three-dimensional feature block, a space-time correlation site fingerprint is generated through the correspondence between the time window sequence and the spatial fingerprint sub-section.

[0096] In the embodiment of the present application, by analyzing the correspondence between the time window and the spatial fingerprint sub-section in the three-dimensional feature block, a comprehensive fingerprint feature is extracted, which can reflect both the time variation rule of traffic and the spatial distribution characteristics. The third dimension is used: the third dimension "feature value" is actually used to store the specific feature value (such as the average packet size) of each time-space coordinate point, and in the generation of the final fingerprint, the fusion is realized through the three-dimensional coordinate (time, spatial sub-section, feature value) full-dimensional association. The space-time correlation site fingerprint is embodied by the numerical distribution pattern of the third dimension feature value in the three-dimensional feature block, and the specific performance is that the feature value combination at different time window and spatial fingerprint sub-section combination positions forms a unique numerical pattern, and this three-dimensional numerical distribution structure is the core representation of the website fingerprint.

[0097] The following is a specific example: In the enterprise intranet data leakage monitoring scene, the system has collected 10 minutes of encrypted agent traffic data, and the average value of the packet size and the variance of the transmission interval of each minute are combined into 10 characteristic segments, each of which contains two characteristic values; 128-dimensional space fingerprint vectors are evenly divided into 10 sub-segments, each of which is 12.8-dimensional, of which the first 9 sub-segments are 12-dimensional, and the last sub-segment is 20-dimensional; the characteristic segment of the first minute is combined with the first 12-dimensional sub-segment, the characteristic segment of the second minute is combined with the next 12-dimensional sub-segment, and so on, and finally the characteristic segment of the 10th minute is combined with the last 20-dimensional sub-segment; all the combined units are stacked in time sequence to build a 10x12x2 three-dimensional feature block, where 10 represents 10 time windows, 12 represents the maximum dimension of the space fingerprint sub-segment, and 2 represents that each data point contains the average value of the packet size and the interval variance; when extracting the space-time correlation feature from the three-dimensional feature block, the correlation between the traffic change in the time dimension and the direction distribution in the space dimension is established by analyzing the numerical change pattern of each time window characteristic segment and its corresponding space fingerprint sub-segment, for example, the characteristic segment of the 3rd minute time window shows a sudden increase in the average packet size, and the numerical change of the 5th to 7th dimension in the space fingerprint sub-segment corresponding to this minute indicates that the traffic is abnormal in a certain direction; the finally generated space-time correlation website fingerprint contains not only the traffic statistical features of each minute, but also the space characteristics of the packet direction distribution, providing a comprehensive basis for subsequent feature fusion, and the formula used for dividing the space fingerprint sub-segment is that the starting position of the sub-segment is equal to the product of the time window sequence number and 12.8, and then the integer is taken, ensuring that each sub-segment covers the complete feature space.

[0098] In the embodiments of the present application, the method realizes comprehensive representation of encrypted traffic features through three-dimensional correlation modeling of space-time features, which can capture the change law in the time dimension and retain the space distribution characteristics, providing a reliable feature basis for subsequent accurate tracing.

[0099] To solve the problem of inaccurate physical layer feature extraction of encrypted traffic, in some embodiments, step 103: based on the light phase fluctuation data, combined with the traffic load change rate, generate heat information, including: Step 601: Real-time monitoring of the data packet quantity change gradient of the transmission control protocol flow data, and calculating the traffic load change rate according to the data packet quantity change gradient.

[0100] In step 601, the data packet quantity change gradient refers to the increase or decrease degree of the transmission control protocol flow data packet quantity per unit time, reflecting the real-time fluctuation of network load.

[0101] In the embodiments of the present application, the difference between the number of data packets in adjacent time periods is counted to calculate the magnitude and direction of traffic change, a positive value indicates an increase in load, a negative value indicates a decrease in load, and the absolute value size reflects the degree of change.

[0102] Step 602: Adjust the modulation intensity of the optical phase fluctuation data based on the traffic load change rate.

[0103] In step 602, the adjustment process of the modulation intensity refers to the dynamic adjustment of the amplitude of the optical signal phase fluctuation according to the network load change.

[0104] In the embodiments of the present application, the calculated traffic load change rate is converted into the control parameter of the optical phase modulation device, and the modulation depth is increased when the load increases and the modulation depth is reduced when the load decreases, so that the optical signal change is synchronized with the network load.

[0105] Step 603: Superimpose the adjusted optical phase fluctuation data and the synchronously collected optical intensity sampling value according to the time stamp to generate thermal information.

[0106] In step 603, the optical intensity sampling value is the original data of the optical signal intensity captured by the photoelectric sensor in real time, and its physical meaning is the quantitative measurement value of the optical power per unit time in the optical transmission process. The optical intensity sampling value is synchronously collected with the optical phase fluctuation data, and together reflects the modulation influence of the encrypted traffic load change on the physical layer optical signal. The time stamp is the accurate time mark of data collection, the equal length time window is the artificial segmentation rule of time sequence statistical characteristics, and the time sequence is the arrangement logic of the window; the association of the three is that the time stamp of the optical intensity sampling value is strictly aligned with the time window of the transmission control protocol flow data, ensuring that the traffic statistical characteristics and the physical layer optical signal characteristics are correlated in time and space under the same time reference.

[0107] In the embodiments of the present application, the adjusted optical phase fluctuation value and the optical intensity sampling value collected at the corresponding time are combined according to the same time reference, and the data at each time point contains two dimensions of phase angle and optical intensity, forming characteristic data reflecting the comprehensive influence of network load change on optical signal.

[0108] The following is a specific example: In the enterprise intranet data leakage monitoring scene, the system continuously monitors the encrypted proxy traffic, counts the number of packets every minute and calculates the change difference of adjacent minutes as the change gradient, for example, 200 packets are transmitted in the 2nd minute, which is 50 more than 150 packets in the 1st minute, and the change gradient is +50; according to the formula modulation intensity change amount=change gradient x 0.1, the optical phase modulation intensity of the 2nd minute is increased by 5 units; the adjusted optical phase data and the corresponding optical intensity data are synchronously collected, and a group of sampling values are recorded every second, wherein the phase value ranges from 0 to 2π, and the optical intensity value is the standardized relative intensity value; the adjusted phase data and the optical intensity data are aligned and superimposed according to the same time stamp to generate 600 thermal information data points, each point containing two parameters of phase value θ and optical intensity value I.

[0109] In the embodiment of the present application, the method realizes the accurate association of network load changes and optical signal characteristics through dynamic modulation and physical layer feature fusion, and the generated thermal information can not only reflect the traffic change trend, but also retain the unique mode of the physical layer signal, thereby providing a reliable physical layer feature basis for encrypted traffic analysis.

[0110] In order to solve the problem of insufficient encrypted traffic feature extraction, in some embodiments, step 104: the dual-flow 3D convolutional network is used to process the space-time correlation website fingerprint to extract first space-time features, and to process the thermal information to extract second space-time features, including: Step 701: input the space-time correlation website fingerprint into the first convolution branch of the dual-flow 3D convolutional network, and perform sliding calculation in the time, space and feature dimensions through three-dimensional convolution operation to obtain first space-time features reflecting traffic statistical characteristics.

[0111] In step 701, the first convolution branch refers to a three-dimensional convolutional neural network path that is specially designed to process traffic statistical characteristics, and the convolution kernel slides and operates in time, space and feature dimensions at the same time.

[0112] In the embodiment of the present application, after inputting the space-time correlation website fingerprint into the first branch, first, the sliding convolution kernel in the time dimension captures the traffic change trend, while the fingerprint distribution mode is analyzed in the space dimension, and finally the correlation of different statistical quantities is integrated in the feature dimension, and high-order feature representations that can comprehensively reflect the space-time characteristics of traffic are gradually extracted through multi-layer convolution.

[0113] Step 702: input the thermal information into the second convolution branch of the dual-flow 3D convolutional network, and perform cross-dimension convolution in the time, phase change and light intensity dimensions through three-dimensional convolution operation to obtain second space-time features reflecting physical layer modulation characteristics.

[0114] In step 702, the second convolution branch refers to a three-dimensional convolutional neural network path that is specially designed to process physical layer signal characteristics, and the convolution kernel is designed to adapt to the time-phase-light three-dimensional characteristics of optical signals.

[0115] In the embodiment of the present application, after inputting the thermal information into the second branch, first, the signal change continuity is analyzed in the time dimension, then the modulation law is captured in the phase dimension, and finally the intensity change mode is identified in the light intensity dimension, and the deep features that can represent the physical layer modulation characteristics are extracted through the convolution kernel with a specific structure.

[0116] The following is a specific example: In the enterprise intranet data leakage monitoring scene, the system inputs the constructed 10x12x2 three-dimensional feature block into the first processing path of the double-flow network, the feature block contains 10 time windows, 12-dimensional space sub-sections and 2 feature values; a 3x3x2 size convolution kernel is used to slide calculation in three dimensions, the first layer convolution is along the time window direction with a step of 1, the space sub-section direction with a step of 1, and the feature value direction is completely covered, outputting a 8x10x1 feature map; the second layer convolution kernel keeps the same size, outputting a 6x8x1 feature map; the third layer convolution obtains a final output of 4x6x1, which is flattened into a 48-dimensional first space-time feature; at the same time, the 10x60x2 thermal information is input into the second processing path, and a 3x5x1 convolution kernel is used for processing, and after the first layer convolution, a 8x56x1 feature map is obtained, the second layer outputs 6x52x1, and the third layer outputs 4x48x1, which is flattened into a 72-dimensional second space-time feature; wherein the convolution kernel of the first path is set to 3 in the time dimension, which can capture the flow change pattern of 3 consecutive minutes, and is set to 3 in the space dimension, which can analyze the correlation of adjacent space sub-sections; the convolution kernel of the second path is 3 in the time dimension and 5 in the phase change dimension, which is suitable for extracting the modulation law of the optical signal; the convolution operations of the two paths do not interfere with each other but keep time synchronization, ensuring that the time corresponding relationship is consistent when the subsequent features are fused, and the finally output 48-dimensional and 72-dimensional features will be used for weighted fusion.

[0117] In the embodiments of the present application, the method extracts the space-time features of the network layer and the physical layer through a double-branch three-dimensional convolution network, which not only retains the flow statistical characteristics but also captures the optical signal modulation law, providing a comprehensive and complementary feature representation basis for subsequent feature fusion.

[0118] Figure 2 The structure diagram of an encrypted traffic data leakage tracing system based on space-time features provided by the embodiments of the present application is shown in Figure 2 As shown in the figure, the system comprises: An acquisition module 21 is configured to acquire transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, wherein the transmission control protocol flow data comprises time sequence statistical features and spatial fingerprint features.

[0119] A first generation module 22 is configured to generate a space-time correlation site fingerprint based on the time sequence statistical features and the spatial fingerprint features.

[0120] A second generation module 23 is configured to generate thermal information based on the optical phase fluctuation data in combination with the flow load change rate.

[0121] A processing module 24 is configured to process the space-time correlation site fingerprint to extract a first space-time feature and process the thermal information to extract a second space-time feature by using a double-flow 3D convolution network.

[0122] The fusion module 25 is configured to fuse the first spatio-temporal feature and the second spatio-temporal feature by a gated attention mechanism to output a result of tracing the encrypted traffic data leakage.

[0123] Figure 2 The spatio-temporal feature-based encrypted traffic data leakage tracing system can perform Figure 1 The spatio-temporal feature-based encrypted traffic data leakage tracing method of the embodiments has been described above. The specific implementation manners of the various modules and units of the spatio-temporal feature-based encrypted traffic data leakage tracing system in the embodiments have been described in detail, and will not be described here.

[0124] In one possible design, Figure 2 The spatio-temporal feature-based encrypted traffic data leakage tracing system can be implemented as a computing device, such as a server or a terminal. Figure 3 As shown in the figure, the computing device can include a storage component 31 and a processing component 32. The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32.

[0125] The processing component 32 is configured to execute the above Figure 1 The spatio-temporal feature-based encrypted traffic data leakage tracing method of the embodiments.

[0126] The processing component 32 can include one or more processors to execute the computer instructions to complete all or part of the steps in the above method. Of course, the processing component can also be one or more application-specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components, for executing the above method.

[0127] The storage component 31 is configured to store various types of data to support the operation of the terminal. The storage component can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0128] Of course, the computing device can also include other components, such as an input / output interface, a display component, a communication component, etc.

[0129] The input / output interface provides an interface between the processing component and peripheral interface modules, which can be output devices, input devices, etc.

[0130] The communication component is configured to facilitate wired or wireless communication between the computing device and other devices, etc.

[0131] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform, and the processing component, the storage component, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0132] The embodiments of the present application also provide a computer storage medium storing a computer program, and the computer program can implement the above-mentioned Figure 1 The embodiment shown provides a method for tracing the leakage of encrypted traffic data based on space-time characteristics.

[0133] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-mentioned system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0134] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0135] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and necessary general hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of software products, and the computer software products can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and include a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0136] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for tracing the leakage of encrypted traffic data based on spatiotemporal features, characterized in that, The method comprises the following steps: obtaining transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, wherein the transmission control protocol flow data comprises time sequence statistical features and spatial fingerprint features; generating a space-time correlation website fingerprint based on the time sequence statistical features and the spatial fingerprint features; generating thermal information based on the optical phase fluctuation data in combination with a traffic load change rate; processing the space-time correlation website fingerprint to extract first space-time features and processing the thermal information to extract second space-time features by using a dual-flow 3D convolution network; outputting a traceability result of encrypted traffic data leakage by weighted fusion of the first space-time features and the second space-time features through a gated attention mechanism.

2. The method of claim 1, wherein, The method of outputting a traceability result of encrypted traffic data leakage by weighted fusion of the first space-time features and the second space-time features through a gated attention mechanism comprises the following steps: performing feature correlation calculation on the first space-time features and the second space-time features to generate a feature interaction matrix; calculating dynamic weight coefficients of the first space-time features and the second space-time features through an activation function in the gated attention mechanism based on the feature interaction matrix; generating a traceability result through element-wise multiplication in the gated attention mechanism based on the dynamic weight coefficients.

3. The method of claim 2, wherein, The method of generating a traceability result through element-wise multiplication in the gated attention mechanism based on the dynamic weight coefficients comprises the following steps: performing weighted summation on the first space-time features and the second space-time features through element-wise multiplication in the gated attention mechanism based on the dynamic weight coefficients to generate a weighted fusion feature; performing similarity matching on the weighted fusion feature and a website feature template in a pre-stored website feature library to determine a target website identifier corresponding to a website feature template with the highest similarity; generating an access path node sequence according to a path feature component in the weighted fusion feature; forming a traceability result based on the target website identifier and the access path node sequence.

4. The method of claim 3, wherein, The method of generating an access path node sequence according to a path feature component in the weighted fusion feature comprises the following steps: extracting a path feature component from the weighted fusion feature, and decomposing the path feature component into a plurality of path feature sub-vectors; performing similarity calculation on each path feature sub-vector and standard feature data of a known node in a pre-constructed physical layer signal fingerprint library; taking an identifier of all known nodes with a similarity greater than or equal to a preset similarity threshold as a target node identifier, and arranging all target node identifiers in chronological order to generate a candidate node sequence; merging repeated node identifiers of adjacent time stamps in the candidate node sequence to generate an access path node sequence.

5. The method of claim 1, wherein, The method of generating a space-time correlation website fingerprint based on the time sequence statistical features and the spatial fingerprint features comprises the following steps: dividing the time sequence statistical features into a plurality of continuous feature segments according to equal-length time windows, and quantizing the spatial fingerprint features into fixed-dimension fingerprint vectors; pairing and connecting each continuous feature segment with a vector sub-segment corresponding to an equal-length time window in the fingerprint vectors to form a time and space binding unit; Stack all the binding units in time sequence to build a three-dimensional feature block, wherein the first dimension represents the time window sequence, the second dimension represents the spatial fingerprint sub-segment, and the third dimension represents the feature value; In the three-dimensional feature block, a space-time correlation website fingerprint is generated through the correspondence between the time window sequence and the spatial fingerprint sub-segment.

6. The spatiotemporal feature-based exfiltration data outflow tracing method according to claim 1, characterized in that, The heat information is generated based on the optical phase fluctuation data combined with the traffic load change rate, including: Real-time monitoring of the data packet quantity change gradient of the transmission control protocol flow data, and calculating the traffic load change rate according to the data packet quantity change gradient; Based on the traffic load change rate, the modulation intensity of the optical phase fluctuation data is adjusted; The adjusted optical phase fluctuation data and the synchronously collected optical intensity sampling value are superimposed according to the time stamp to generate heat information.

7. The spatiotemporal feature-based exfiltration traceback method of encrypted traffic data according to claim 1, wherein, The double-flow 3D convolution network is used to process the space-time correlation website fingerprint to extract first space-time features, and to process the heat information to extract second space-time features, including: The space-time correlation website fingerprint is input into the first convolution branch of the double-flow 3D convolution network, and sliding calculation is performed in the time, space and feature dimensions through three-dimensional convolution operation to obtain first space-time features reflecting traffic statistical characteristics; The heat information is input into the second convolution branch of the double-flow 3D convolution network, and cross-dimension convolution is performed in the time, phase change and optical intensity dimensions through three-dimensional convolution operation to obtain second space-time features reflecting physical layer modulation characteristics.

8. A system for tracing the leakage of encrypted traffic data based on spatiotemporal features, characterized in that, It includes: An acquisition module is configured to acquire transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, wherein the transmission control protocol flow data includes time sequence statistical characteristics and spatial fingerprint characteristics; A first generation module is configured to generate a space-time correlation website fingerprint based on the time sequence statistical characteristics and the spatial fingerprint characteristics; A second generation module is configured to generate heat information based on the optical phase fluctuation data combined with the traffic load change rate; A processing module is configured to use a double-flow 3D convolution network to process the space-time correlation website fingerprint to extract first space-time features, and to process the heat information to extract second space-time features; A fusion module is configured to fuse the first space-time features and the second space-time features through a gated attention mechanism to output a traceability result of encrypted traffic data leakage.

Images