A method and system for tracing the leakage of encrypted traffic data based on spatiotemporal features

Abstract

The application relates to the technical field of space-time features, and provides a space-time feature-based encrypted traffic data leakage tracing method and system, which comprises the following steps: obtaining transmission control protocol flow data and light phase fluctuation data of encrypted traffic, wherein the transmission control protocol flow data comprises time sequence statistical features and spatial fingerprint features; generating a space-time correlation website fingerprint based on the time sequence statistical features and the spatial fingerprint features; generating thermal information based on the light phase fluctuation data and in combination with a traffic load change rate; processing the space-time correlation website fingerprint by using a double-flow 3D convolution network to extract first space-time features, and processing the thermal information to extract second space-time features; and weighting and fusing the first space-time features and the second space-time features through a gate attention mechanism to output a tracing result of encrypted traffic data leakage. The application solves the problems of low accuracy and poor reliability of encrypted proxy traffic leakage tracing in the prior art, and improves the accuracy and reliability of encrypted proxy traffic leakage tracing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of spatiotemporal features, in particular to a spatiotemporal feature-based encrypted traffic data exfiltration tracing method and system. BACKGROUND

[0002] Under the background of the wide application of encryption communication technology, malicious actors often use encryption proxy means to hide data exfiltration traces, making traditional detection methods based on plaintext traffic ineffective. There is an urgent need for a technical solution that can penetrate the encryption layer and accurately identify the source and transmission path of data exfiltration, especially when dealing with proxy traffic using dynamic encryption strategies, a comprehensive analysis method that takes into account both traffic behavior features and network transmission features is needed.

[0003] A deep packet inspection and behavior modeling-based solution analyzes the metadata features of encrypted traffic, including packet size distribution, transmission time interval, and other statistical characteristics, and establishes a behavior profile by combining traffic burst patterns. This solution uses a time series neural network to model traffic features and performs tracing analysis by matching traffic behavior patterns with a pre-built feature library.

[0004] This deep packet inspection solution is sensitive to the randomization of encrypted traffic, and its recognition effectiveness decreases when traffic features are deliberately obscured. Its behavior modeling method is difficult to cope with feature distortion caused by proxy node transit, and due to the lack of physical layer transmission features, it is prone to false positives in complex network environments. The loss of path information during traffic transit also limits the depth of this solution's tracing. SUMMARY

[0005] The present application provides a spatiotemporal feature-based encrypted traffic data exfiltration tracing method and system to solve the problem of low accuracy and poor reliability in tracing encrypted proxy traffic exfiltration, improving the accuracy and reliability of encrypted proxy traffic exfiltration tracing.

[0006] In a first aspect, the present application provides a spatiotemporal feature-based encrypted traffic data exfiltration tracing method, comprising:

[0007] Obtaining transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, the transmission control protocol flow data including time series statistical features and spatial fingerprint features;

[0008] Generating a spatiotemporal correlation site fingerprint based on the time series statistical features and the spatial fingerprint features;

[0009] Generating thermal information based on the optical phase fluctuation data and combining traffic load change rate;

[0010] The dual-flow 3D convolution network is used to process the spatiotemporal correlation website fingerprint to extract first spatiotemporal features and to process the thermal information to extract second spatiotemporal features.

[0011] The first spatiotemporal features and the second spatiotemporal features are weighted and fused through a gated attention mechanism to output a tracing result of the encrypted traffic data leakage.

[0012] Optionally, the weighting and fusing of the first spatiotemporal features and the second spatiotemporal features through the gated attention mechanism to output the tracing result of the encrypted traffic data leakage comprises:

[0013] The first spatiotemporal features and the second spatiotemporal features are subjected to feature correlation calculation to generate a feature interaction matrix.

[0014] Based on the feature interaction matrix, dynamic weight coefficients of the first spatiotemporal features and the second spatiotemporal features are respectively calculated through an activation function in the gated attention mechanism.

[0015] Based on the dynamic weight coefficients, a tracing result is generated through element-wise multiplication in the gated attention mechanism.

[0016] Optionally, the generation of the tracing result through the element-wise multiplication in the gated attention mechanism based on the dynamic weight coefficients comprises:

[0017] Based on the dynamic weight coefficients, a weighted sum of the first spatiotemporal features and the second spatiotemporal features is calculated through element-wise multiplication in the gated attention mechanism to generate a weighted fusion feature.

[0018] The weighted fusion feature is subjected to similarity matching with website feature templates in a pre-stored website feature library to determine a target website identifier corresponding to a website feature template with the highest similarity.

[0019] A sequence of access path nodes is generated according to a path feature component in the weighted fusion feature.

[0020] Based on the target website identifier and the sequence of access path nodes, a tracing result is formed.

[0021] Optionally, the generation of the sequence of access path nodes according to the path feature component in the weighted fusion feature comprises:

[0022] The path feature component is extracted from the weighted fusion feature and is decomposed into a plurality of path feature sub-vectors.

[0023] Each path feature sub-vector is subjected to similarity calculation with standard feature data of known nodes in a pre-constructed physical layer signal fingerprint library.

[0024] The identifiers of all known nodes with a similarity greater than or equal to a preset similarity threshold are used as target node identifiers, and all target node identifiers are arranged in chronological order to generate a candidate node sequence.

[0025] Duplicate node identifiers with adjacent timestamps in the candidate node sequence are merged to generate an access path node sequence.

[0026] Optionally, generating a spatiotemporally related website fingerprint based on the temporal statistical features and the spatial fingerprint features includes:

[0027] The time-series statistical features are divided into multiple continuous feature segments according to equal time windows, and the spatial fingerprint features are quantized into fingerprint vectors of fixed dimensions.

[0028] Each of the continuous feature segments is paired and connected with the corresponding vector sub-segment of the fingerprint vector with an equal time window to form a time-space binding unit;

[0029] All binding units are stacked in chronological order to construct a three-dimensional feature block, where the first dimension represents the time window sequence, the second dimension represents the spatial fingerprint segment, and the third dimension represents the feature value.

[0030] In the three-dimensional feature block, a spatiotemporal associated website fingerprint is generated by the correspondence between the time window sequence and the spatial fingerprint segment.

[0031] Optionally, generating thermal information based on the optical phase fluctuation data and the flow load change rate includes:

[0032] The gradient of the number of data packets in the transmission control protocol stream is monitored in real time, and the rate of change of traffic load is calculated based on the gradient of the number of data packets.

[0033] Based on the rate of change of the flow load, the modulation intensity of the optical phase fluctuation data is adjusted;

[0034] The adjusted optical phase fluctuation data is superimposed with the synchronously acquired optical intensity sample values ​​according to the timestamp to generate thermal information.

[0035] Optionally, the step of using a two-stream 3D convolutional network to process the spatiotemporally associated website fingerprint to extract first spatiotemporal features and processing the thermal information to extract second spatiotemporal features includes:

[0036] The spatiotemporal website fingerprint is input into the first convolutional branch of the dual-stream 3D convolutional network. The three-dimensional convolutional operation is used to perform sliding calculations in the time, space and feature dimensions to obtain the first spatiotemporal feature that reflects the traffic statistics characteristics.

[0037] The thermal information is input into the second convolution branch of the dual-stream 3D convolutional network. Through three-dimensional convolution operations, cross-dimensional convolution is performed in the time, phase change, and light intensity dimensions to obtain the second spatiotemporal feature that reflects the modulation characteristics of the physical layer.

[0038] Secondly, this application provides a system for tracing the source of encrypted traffic data leakage based on spatiotemporal characteristics, including:

[0039] The acquisition module is used to acquire transmission control protocol stream data and optical phase fluctuation data of encrypted traffic. The transmission control protocol stream data includes time-series statistical features and spatial fingerprint features.

[0040] The first generation module is used to generate a spatiotemporally associated website fingerprint based on the temporal statistical features and the spatial fingerprint features;

[0041] The second generation module is used to generate thermal information based on the optical phase fluctuation data and the flow load change rate.

[0042] The processing module is used to process the spatiotemporally associated website fingerprint using a dual-stream 3D convolutional network to extract a first spatiotemporal feature, and to process the thermal information to extract a second spatiotemporal feature.

[0043] The fusion module is used to weightedly fuse the first spatiotemporal features and the second spatiotemporal features through a gating attention mechanism, and output the source tracing results of the encrypted traffic data leakage.

[0044] Thirdly, this application provides a computing device, including a processor and a memory, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute a method for tracing the source of encrypted traffic data leakage based on spatiotemporal characteristics as described in any of the first aspects.

[0045] Fourthly, this application provides a computer storage medium storing computer program instructions thereon, wherein when the computer program instructions are executed by a processor, they implement the method for tracing the source of encrypted traffic data leakage based on spatiotemporal characteristics as described in any one of the first aspects.

[0046] This application provides a method for tracing the source of encrypted traffic data leakage based on spatiotemporal features. The method includes: acquiring transmission control protocol stream data and optical phase fluctuation data of encrypted traffic, wherein the transmission control protocol stream data includes temporal statistical features and spatial fingerprint features; generating a spatiotemporally associated website fingerprint based on the temporal statistical features and the spatial fingerprint features; generating thermal information based on the optical phase fluctuation data and the traffic load change rate; using a dual-stream 3D convolutional network to process the spatiotemporally associated website fingerprint to extract a first spatiotemporal feature, and processing the thermal information to extract a second spatiotemporal feature; and weightedly fusing the first spatiotemporal feature and the second spatiotemporal feature through a gated attention mechanism to output the source tracing result of encrypted traffic data leakage.

[0047] The technical solution provided in this application has the following beneficial effects:

[0048] This application provides a multi-dimensional data foundation for subsequent analysis by simultaneously collecting network layer traffic characteristics and physical layer optical signal characteristics, overcoming the limitations of a single data source. It performs three-dimensional correlation modeling of temporal statistical features and spatial fingerprint features to form a comprehensive fingerprint feature that simultaneously reflects the temporal variation pattern and spatial distribution characteristics of traffic. By dynamically modulating optical signal characteristics through traffic load changes, a real-time correlation is established between network behavior and physical layer signal changes, enhancing the characterization capability of the features. A dual-stream network is used to separately mine the spatiotemporal evolution patterns of traffic statistical features and the modulation variation patterns of physical layer signals, achieving in-depth feature extraction. A dynamic weight allocation mechanism optimizes the feature fusion process, improving the accuracy and reliability of the final source tracing results.

[0049] Furthermore, this application also calculates the interaction matrix of the first spatiotemporal feature and the second spatiotemporal feature, uses the activation function in the gated attention mechanism to dynamically determine the weight coefficients of the two types of features, and finally uses element-wise multiplication to achieve feature fusion and generate source tracing results.

[0050] Furthermore, this method adaptively balances the contributions of network layer traffic features and physical layer signal features through a dynamic weight allocation mechanism, effectively improving the accuracy of feature fusion in the process of tracing encrypted traffic and enhancing the ability to identify leakage behavior in complex proxy environments.

[0051] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 A flowchart illustrating a method for tracing the source of encrypted traffic data leakage based on spatiotemporal characteristics, provided in an embodiment of this application;

[0054] Figure 2 A schematic diagram of the structure of an encrypted traffic data leakage tracing system based on spatiotemporal characteristics provided in an embodiment of this application;

[0055] Figure 3 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0056] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0057] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0058] Existing methods primarily rely on analyzing the statistical characteristics of network traffic, such as packet size and transmission intervals. However, these characteristics are easily spoofed or interfered with in encrypted proxy environments. Especially when data passes through multiple proxy nodes, the original traffic characteristics become distorted, making it difficult for tracing systems to accurately identify the true source and transmission path of the data leak. More importantly, these methods completely ignore the changes in physical layer signals during network transmission, which often contain crucial information that is difficult to forge.

[0059] To address these issues, this application proposes a spatiotemporal feature-based method for tracing the source of encrypted traffic data leakage. This method achieves accurate source tracing by simultaneously analyzing network traffic characteristics and physical layer optical signal characteristics. First, it collects transmission control protocol stream data and optical phase fluctuation data of the encrypted traffic. Then, it transforms these two types of characteristics into spatiotemporally correlated feature representations. Finally, an intelligent fusion algorithm automatically determines the importance of each feature, ultimately accurately identifying the source and transmission path of the data leakage. The greatest advantage of this method is that even if network traffic characteristics are deliberately disguised, the physical layer optical signal characteristics can still provide reliable judgment criteria. The two mutually corroborate each other, improving the accuracy of source tracing in complex proxy environments and effectively solving the problems of inaccurate identification and difficulty in path reconstruction faced by existing technologies.

[0060] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] Figure 1 A flowchart illustrating a method for tracing the source of encrypted traffic data leakage based on spatiotemporal characteristics, as provided in this application embodiment, is shown below. Figure 1 As shown, the method includes:

[0062] Step 101: Obtain the transmission control protocol stream data and optical phase fluctuation data of the encrypted traffic. The transmission control protocol stream data includes time-series statistical features and spatial fingerprint features.

[0063] In step 101, Transmission Control Protocol (TCP) stream data refers to a sequence of data packets transmitted according to fixed rules in encrypted communication. Optical phase fluctuation data represents the change in phase angle during optical signal transmission, reflecting the signal modulation state. Temporal statistical features represent the distribution pattern of data packets in the time dimension, such as the distribution of transmission intervals. Spatial fingerprint features represent the distribution pattern of data packets in the transmission direction, forming a unique traffic feature vector.

[0064] In this embodiment, transmission control protocol data packets are first captured from the encrypted communication channel, and the size and arrival time of each data packet are recorded. The time interval between consecutive data packets is calculated to form time-series statistical features. At the same time, the distribution of the number of data packets in different transmission directions is statistically analyzed and quantized into a spatial fingerprint vector of fixed length. The phase fluctuation signal output by the optical transmission device is collected synchronously, and the change data of the signal phase angle over time is recorded. Finally, these three types of data are aligned and stored according to the same time base to provide basic data for subsequent processing.

[0065] For example, taking the monitoring of data leakage within an enterprise's intranet as an example, data acquisition equipment is deployed at the core switch to continuously capture Transmission Control Protocol (TCP) traffic passing through the encrypted proxy. The average and variance of the data packet size within that time period are calculated every minute as time-series statistical features. Simultaneously, the data packet transmission direction distribution is quantized into a 128-dimensional vector as a spatial fingerprint feature. Phase detection devices are synchronously installed at optical transmission nodes to record changes in the optical signal phase angle at equal time intervals. All three types of data are time-stamped and stored in the analysis database. The time interval calculation method for the time-series statistical features is the difference between the arrival timestamps of adjacent data packets.

[0066] Step 102: Generate a spatiotemporally related website fingerprint based on the temporal statistical features and the spatial fingerprint features.

[0067] In step 102, the spatiotemporal associated website fingerprint representation is a website access behavior feature representation that integrates temporal and spatial features.

[0068] In this embodiment, the temporal statistical features are divided into multiple consecutive time periods with a fixed duration, and the feature data within each time period constitutes a feature segment; the spatial fingerprint vector is divided into a corresponding number of sub-segments according to the same number of time periods; the feature segments of each time period are combined with the corresponding spatial fingerprint sub-segments to form a time-space binding unit; all binding units are arranged in chronological order to construct a three-dimensional feature block, where the first dimension represents the time series, the second dimension represents the spatial features, and the third dimension stores the specific feature values; this organization method forms a website fingerprint feature that can simultaneously reflect temporal changes and spatial distribution.

[0069] For example, following the previous example, the collected 10 minutes of data is divided into 10 time periods, with each minute representing a window. The mean packet size and the variance of the interval within each time period form a feature segment. The 128-dimensional spatial fingerprint vector is divided into 10 sub-segments. The feature segment of the first minute is combined with the first 12-dimensional sub-segments, the feature segment of the second minute is combined with the next 12-dimensional sub-segments, and so on. Finally, a 10×12×2 three-dimensional feature block is constructed, where 10 corresponds to the time window, 12 is the sub-segment dimension, and 2 indicates that each data point contains two feature values: the mean packet size and the variance of the interval.

[0070] Step 103: Based on the optical phase fluctuation data and combined with the flow load change rate, generate thermal information.

[0071] In step 103, the traffic load change rate refers to the dynamic fluctuation of the data volume or transmission rate of the transmission control protocol stream in the encrypted proxy channel. It originates from real-time monitoring and statistics of encrypted traffic data packets, and is derived by calculating the change in the number of bytes or data packets transmitted per unit time. Thermal information represents characteristic data reflecting the impact of network load changes on optical signal modulation.

[0072] In this embodiment, the changes in the number of data packets in the Transmission Control Protocol (TCP) stream are statistically analyzed in real time, and the difference in the number of data packets in adjacent time periods is calculated to obtain the rate of change of traffic load. The optical phase modulation intensity is dynamically adjusted according to the magnitude and direction of the rate of change. The modulated phase fluctuation data is superimposed with the synchronously acquired optical intensity sampling value according to the corresponding time points to form thermal information data that simultaneously contains phase and optical intensity changes.

[0073] For example, continuing the previous example, calculate the difference between the number of data packets per minute and the previous minute. When the difference is greater than zero, increase the optical phase modulation intensity by multiplying the difference by a coefficient. When the difference is less than zero, decrease it accordingly. The adjusted phase data and light intensity data are superimposed at a sampling rate of one sampling point per second to generate thermal information of 600 sampling points, where each sampling point contains two values: phase angle and light intensity.

[0074] Step 104: Using a dual-stream 3D convolutional network, process the spatiotemporal associated website fingerprint to extract the first spatiotemporal feature, and process the thermal information to extract the second spatiotemporal feature.

[0075] In step 104, the dual-stream 3D convolutional network represents a deep learning model that processes two types of features in parallel. The first spatiotemporal feature represents the spatiotemporal pattern features extracted from the encrypted traffic data, specifically reflecting the statistical regularity of the transmission control protocol flow in the time dimension and the distribution characteristics in the spatial dimension, including the fusion information of packet transmission timing changes and flow fingerprint spatial distribution. The second spatiotemporal feature represents the spatiotemporal pattern features extracted from the physical layer of the optical signal, specifically reflecting the modulation change law of optical phase and light intensity in the time dimension, including the physical layer signal perturbation characteristics caused by traffic load changes. The physical relationship between the first spatiotemporal feature and the temporal statistical feature and the spatial fingerprint feature is that the temporal statistical feature provides the variation law of packet size, interval, etc. of traffic on the time axis, and the spatial fingerprint feature provides the spatial distribution pattern of the traffic vector. The first spatiotemporal feature is a high-order fusion feature extracted by the 3D convolutional network after performing spatiotemporal correlation modeling on these two types of features, which not only retains the physical meaning of the original features, but also explores their cross-dimensional correlation patterns.

[0076] In this embodiment, the spatiotemporal website fingerprint is input into the first processing path of the three-dimensional convolutional network. Through multi-layer three-dimensional convolutional operations, the change patterns of traffic data in the time and space dimensions are extracted, and the first spatiotemporal feature is output. The thermal information is input into the second processing path, and the modulation features of the light signal in the time and physical dimensions are extracted through three-dimensional convolutional operations, and the second spatiotemporal feature is output. The network structures of the two processing paths are the same but the parameters are independent, ensuring that they can learn the feature representations most suitable for their respective data types.

[0077] For example, a 10×12×2 three-dimensional feature block is input into the first path, and three convolution operations are performed using a 3×3×2 convolution kernel. After each convolution, the feature map size decreases, and the final output is a 48-dimensional first spatiotemporal feature. A 10×20×50 thermal information block is input into the second path, and three convolution operations are performed using a 3×5×5 convolution kernel, and the final output is a 72-dimensional second spatiotemporal feature. The convolution kernel size and stride settings of the two paths ensure that the spatiotemporal variation patterns of their respective data can be effectively captured.

[0078] Step 105: The first spatiotemporal feature and the second spatiotemporal feature are weighted and fused using a gating attention mechanism to output the source tracing result of the encrypted traffic data leakage.

[0079] In step 105, the gated attention mechanism represents a fusion method that dynamically adjusts feature weights. The source tracing result refers to the final data leakage behavior analysis conclusions output by this method, specifically including two core elements: first, the identified target website identifier, i.e., the specific website to which the data ultimately flowed; and second, the reconstructed access path node sequence, i.e., the complete transmission route of the data from the source to the target website through various network relay nodes. These two elements together constitute a complete tracking and location of data leakage behavior in an encrypted proxy environment.

[0080] In this embodiment, the similarity matrix of the first spatiotemporal feature and the second spatiotemporal feature is calculated and converted into weight coefficients through an activation function; the two types of features are dynamically weighted and summed using these coefficients to obtain the fused feature; the fused feature is compared with a pre-stored website feature template to find the website corresponding to the most similar template as the source of the leak; at the same time, path-related information is extracted from the fused feature to reconstruct the network node sequence through which the data passed, and finally, a complete source tracing result is output.

[0081] For example, the similarity between the 48 dimensions of the first spatiotemporal feature and the 72 dimensions of the second spatiotemporal feature is calculated. This is then converted into weight coefficients between 0 and 1 using the sigmoid function. The weighted features of the two classes are concatenated into a 120-dimensional fused feature vector, which is then compared one by one with 100 pre-stored website feature templates in the feature library. The cosine similarity algorithm is used to find the website template with the highest matching degree, identifying the corresponding leaked target website as A. Simultaneously, node feature data for 10 consecutive time periods are parsed from the fused feature vector and matched sequentially with node features in the physical layer signal fingerprint library. This identifies the three network nodes through which the data passed: node B, node C, and node D. The final source tracing result includes the target website identifier A and the access path node sequence B, C, and D arranged in chronological order, fully presenting the endpoint and transmission route of the data leak. The similarity calculation uses the standard cosine similarity formula, with the numerator being the dot product of the feature vectors and the denominator being the product of the magnitudes of the vectors.

[0082] This method constructs a multi-dimensional spatiotemporal correlation model by simultaneously analyzing network traffic characteristics and physical layer optical signal characteristics. It then utilizes deep learning technology to automatically extract key features and achieves accurate source tracing through an intelligent fusion mechanism. Even in encrypted proxy environments, it can accurately identify the source and transmission path of data leakage, overcoming the shortcomings of traditional methods in feature masquerading and path reconstruction, and improving the reliability and accuracy of encrypted traffic tracing.

[0083] To address the issue of insufficient feature fusion accuracy in encrypted traffic tracing, in some embodiments, step 105: the weighted fusion of the first spatiotemporal feature and the second spatiotemporal feature using a gated attention mechanism to output the tracing result of encrypted traffic data leakage includes:

[0084] Step 201: Perform feature association calculation on the first spatiotemporal feature and the second spatiotemporal feature to generate a feature interaction matrix.

[0085] In step 201, the feature interaction matrix is ​​a mathematical representation that reflects the degree of correlation between two types of spatiotemporal features. The rows of the matrix correspond to the dimensions of the first spatiotemporal feature, the columns correspond to the dimensions of the second spatiotemporal feature, and each element value represents the correlation strength of the corresponding dimension feature.

[0086] In this embodiment, a matrix multiplication operation is performed on the first spatiotemporal feature and the second spatiotemporal feature, with the first spatiotemporal feature as the matrix multiplier and the transposed second spatiotemporal feature as the multiplicand, to calculate an initial interaction matrix. The matrix is ​​then standardized to ensure that the values ​​of each element are within a reasonable range, ultimately generating a feature interaction matrix that reflects the correlation between the dimensions of the two types of features.

[0087] Step 202: Based on the feature interaction matrix, calculate the dynamic weight coefficients of the first spatiotemporal feature and the second spatiotemporal feature respectively through the activation function in the gating attention mechanism.

[0088] In step 202, the dynamic weight coefficient refers to the weight value obtained after processing the feature interaction matrix through the activation function, which is used to quantify the importance of the two types of features in different dimensions.

[0089] In this embodiment, the mean of the feature interaction matrix is ​​calculated by row and column respectively to obtain the initial weight distribution of the two types of features; the initial weights are input into the activation function for nonlinear transformation to ensure that the weight values ​​are within the set range; the transformed weights are normalized to keep the sum of all weight coefficients constant, and finally dynamic weight coefficients that can be used for feature fusion are generated.

[0090] Step 203: Based on the dynamic weight coefficients, generate the source tracing result through element-wise multiplication in the gating attention mechanism.

[0091] In step 203, element-wise multiplication refers to the operation method of multiplying the feature values ​​at corresponding positions according to the weight coefficients.

[0092] In this embodiment, the dynamic weight coefficient of the first spatiotemporal feature is used to weight each feature value, and the dynamic weight coefficient of the second spatiotemporal feature is used to weight the corresponding feature value. The two types of features after weighting are concatenated by dimension to form a fused feature vector. The website that leaked the data is determined based on the matching result between the fused feature and the pre-stored feature. At the same time, the path node information is parsed from the fused feature and arranged in chronological order to generate a complete source tracing result.

[0093] Here is a specific example:

[0094] In the enterprise intranet data leakage monitoring scenario, the system has extracted a 48-dimensional first spatiotemporal feature and a 72-dimensional second spatiotemporal feature. First, matrix multiplication is performed on these two sets of features. The first spatiotemporal feature is treated as a 120×48 matrix, and the transposed second spatiotemporal feature is treated as a 72×120 matrix. Multiplying them yields a 48×72 feature interaction matrix, where each element represents the degree of correlation between corresponding dimensions of the two feature classes. The mean of the feature interaction matrix is ​​calculated for both rows and columns to obtain initial weight vectors of 48 and 72 dimensions. These vectors are then input into a sigmoid activation function for transformation. The sigmoid function expression is: Where x represents the input value, Output weight coefficients between 0 and 1; normalize the transformed weight coefficients so that the sum of all weights for the first and second spatiotemporal features is 1; use the normalized weight coefficients to perform element-wise multiplication and weighting on the original features, multiplying each dimension value of the first spatiotemporal feature by the corresponding weight coefficient, and doing the same for the second spatiotemporal feature, to obtain weighted 48-dimensional and 72-dimensional feature vectors; concatenate the two sets of weighted features into a 120-dimensional fused feature vector, and calculate its similarity with 100 pre-stored website feature templates using the cosine similarity formula. Where X and Y represent feature vectors, · represents dot product operation, and ||·|| represents the magnitude of the vector; the website A corresponding to the template with the highest similarity is identified as the leakage target. At the same time, the node features of 10 time periods are parsed from the fused features. After matching with the physical layer signal fingerprint database, it is determined that the data passes through nodes B, C and D in sequence. Finally, the complete tracing results of website A and path B to C to D are output. The path node identification is based on the matching degree of node features in each time period exceeding the set threshold of 0.85 and the continuity in time order.

[0095] In this embodiment of the application, the method achieves accurate feature fusion through a dynamic weight allocation mechanism, which effectively improves the accuracy of encrypted traffic tracing, can reliably identify the leaked target and restore the complete transmission path, and solves the shortcomings of traditional methods in feature fusion and path restoration.

[0096] To address the accuracy issues of feature fusion and path reconstruction in encrypted traffic tracing, in some embodiments, step 203: generating the tracing result based on the dynamic weight coefficients through element-wise multiplication in the gated attention mechanism, includes:

[0097] Step 301: Based on the dynamic weight coefficients, the first spatiotemporal feature and the second spatiotemporal feature are weighted and summed by element-wise multiplication in the gating attention mechanism to generate a weighted fusion feature.

[0098] In step 301, the weighted fusion feature refers to the comprehensive feature representation after dynamically combining two types of spatiotemporal features according to their importance, wherein the value of each feature dimension is obtained by multiplying the original feature value by the corresponding weight coefficient.

[0099] In this embodiment, the dynamic weight coefficients of the first spatiotemporal feature are used to perform element-wise multiplication on each feature value, and the same operation is performed on the second spatiotemporal feature. The two weighted features are then concatenated in dimensional order to form a longer new feature vector. The new feature vector is then standardized to ensure that the values ​​of each dimension are within a comparable range, and finally, a weighted fusion feature containing both network traffic and physical signal characteristics is generated.

[0100] Step 302: Perform similarity matching between the weighted fusion features and the website feature templates in the pre-stored website feature library to determine the target website identifier corresponding to the website feature template with the highest similarity.

[0101] In step 302, the website feature template refers to a pre-stored standard pattern of various website access behavior characteristics, with each template corresponding to a unique identifier for a specific website. The target website identifier refers to the unique identity identifier corresponding to the pre-stored website feature template that best matches the weighted fusion features, determined through similarity matching. Specifically, it is a digital code representing the specific website or network service to which the leaked data ultimately flows. In practical applications, it can be a website domain name, IP address hash value, or other unique encoding form, used to accurately identify the endpoint target of the data leak.

[0102] In this embodiment, the weighted fusion features are sequentially compared with all website templates in the feature library to calculate their similarity; the template with the highest similarity value is found by comparison; and the target website identifier to which the leaked data will ultimately flow is determined based on the correspondence between the template and the website identifier.

[0103] Step 303: Generate an access path node sequence based on the path feature components in the weighted fusion features.

[0104] In step 303, the path feature component refers to the feature subspace specifically representing the access path in the weighted fusion features. It originates from the optical signal hopping patterns recorded in the second spatiotemporal features (reflecting the network nodes traversed by the traffic) and is the key path information retained by the gating attention mechanism during feature fusion. Its numerical changes correspond to the phase-intensity perturbation characteristics of the physical layer signal at different transmission nodes. The path feature component is a subset of features specifically representing the network transmission path separated from the weighted fusion features. Its physical meaning lies in recording the optical signal modulation traces left at the physical layer when the traffic passes through each network node. Unlike the first spatiotemporal features, which mainly reflect traffic statistical characteristics, and the second spatiotemporal features, which mainly reflect physical layer modulation characteristics, the path feature component is the key path information filtered from the second spatiotemporal features through the gating attention mechanism. It inherits the physical layer characteristics of optical signal phase-intensity changes in the second spatiotemporal features and strengthens the feature dimension most correlated with network nodes through weighted fusion, specifically used to reconstruct the traffic transmission path. The access path node sequence is obtained by matching and reconstructing the path feature components with the pre-stored network topology node features. Specifically, the path feature components are decomposed according to the time dimension, and the similarity between the features of each time segment and the known node optical signal fingerprints is matched in turn to restore the actual node order through which the traffic passes.

[0105] In this embodiment, feature segments corresponding to the time window are extracted from the weighted fusion features; each segment is matched with a pre-stored node feature library; node identifiers with matching degree exceeding a threshold are identified; these node identifiers are arranged in chronological order, and adjacent duplicate nodes are merged to generate a complete access path node sequence.

[0106] Step 304: Based on the target website identifier and the access path node sequence, a tracing result is generated.

[0107] In this embodiment of the application, the determined target website identifier is combined with the generated access path node sequence; it is encapsulated into structured data according to a standard format; and a complete traceability report is output after adding a timestamp and a credibility score.

[0108] Here is a specific example:

[0109] In the enterprise intranet data leakage monitoring scenario, the system has obtained a weighted 48-dimensional first spatiotemporal feature and a 72-dimensional second spatiotemporal feature. These two sets of features are concatenated into a 120-dimensional fused feature vector, which is then compared with 100 pre-stored website feature templates, each of which is a 120-dimensional vector. The cosine similarity formula is used to calculate the matching degree between the fused feature and each template. This formula states that the similarity equals the dot product of two vectors divided by the product of their magnitudes. The dot product is calculated by multiplying the corresponding dimension values ​​and then summing the results, where the magnitude is the length of each vector dimension. The square root of the sum of squares is used to find the template with the highest matching degree, which corresponds to a cloud storage platform identifier A, with a similarity value of 0.92. At the same time, 10 time-segment node feature sub-vectors are extracted from the fused features. Each sub-vector has 12 dimensions and is matched with the node feature library in turn. When the matching degree of a node exceeds the threshold of 0.85, the node identifier is recorded. Finally, it is determined that the data passes through the intranet server B, the border firewall C, and the Internet gateway D in sequence. The cloud storage platform identifier A is combined with the path node sequence B to C to D to output a complete traceability report.

[0110] In the embodiments of this application, the method achieves accurate positioning of encrypted traffic leakage behavior through dynamic weighted fusion and hierarchical feature matching. It can accurately identify the final target of data leakage and restore the complete transmission path of data in complex networks, effectively solving the shortcomings of traditional methods in feature utilization and path restoration.

[0111] To address the issue of incomplete encrypted traffic path reconstruction, in some embodiments, step 303, which involves generating an access path node sequence based on the path feature components in the weighted fusion features, includes:

[0112] Step 401: Extract path feature components from the weighted fusion features, and decompose the path feature components into multiple path feature sub-vectors.

[0113] In step 401, the decomposition is based on the time window division method used when collecting the original encrypted traffic data. Specifically, it is decomposed according to the equal-length time intervals (e.g., one window per minute) used when generating the spatiotemporal associated website fingerprint, ensuring that each path feature sub-vector is strictly aligned with the initial time window, thereby maintaining the mapping relationship between the time dimension and the network node position during traffic transmission. The path feature sub-vector refers to the feature fragment extracted from the weighted fusion features by dividing it into time windows. Each sub-vector contains physical layer signal feature data reflecting changes in the network transmission path within a specific time period. It is formed by dividing the complete path feature components into fixed time intervals and is used to independently analyze the network nodes that traffic may pass through in each time period.

[0114] In this embodiment, feature data segments corresponding to time windows are separated from the complete weighted fusion features. The feature data corresponding to each time period constitutes a path feature sub-vector. These sub-vectors are arranged in chronological order to form a feature sequence reflecting path changes.

[0115] Step 402: Calculate the similarity between each path feature subvector and the standard feature data of known nodes in the pre-built physical layer signal fingerprint database.

[0116] In step 402, the physical layer signal fingerprint database refers to the pre-stored set of standard optical signal features of different network nodes, with each node corresponding to a unique optical signal modulation mode.

[0117] In this embodiment of the application, the similarity of each path feature subvector with all node features in the fingerprint database is calculated, and the nodes that the traffic may pass through during this time period are evaluated by comparing the matching degree of signal modulation features.

[0118] Step 403: Use the identifiers of all known nodes with a similarity greater than or equal to the preset similarity threshold as target node identifiers, and arrange all target node identifiers in chronological order to generate a candidate node sequence.

[0119] In step 403, the candidate node sequence refers to the intermediate result of the possible nodes initially selected and arranged in chronological order.

[0120] In this embodiment, for the path feature subvector of each time period, node identifiers with similarity reaching the threshold are retained, and matching results below the threshold are discarded; qualified node identifiers of all time periods are sorted according to the collection time to form a preliminary path sequence.

[0121] Step 404: Merge the duplicate node identifiers with adjacent timestamps in the candidate node sequence to generate an access path node sequence.

[0122] In this embodiment of the application, the node identifiers of adjacent time periods in the candidate node sequence are checked. If the same node identifier is found to appear continuously, they are merged into a single node and the duration range is recorded. Isolated nodes that appear briefly are verified and retained after their reliability is confirmed. Finally, a concise and accurate complete path sequence is generated.

[0123] Here is a specific example:

[0124] Based on the aforementioned scenario where cloud storage platform A has been identified as the target of the data leak and the data has been preliminarily determined to have passed through nodes B, C, and D, the system extracts 10 12-dimensional path feature sub-vectors from the 120-dimensional weighted fusion features. Each sub-vector corresponds to the physical layer signal features within a 1-minute time window. The first sub-vector is compared with a pre-stored feature library of 50 network nodes, and the matching degree is calculated using the cosine similarity formula. This formula is expressed as the numerator obtained by multiplying the corresponding dimension values ​​of the two vectors and adding them together, and the denominator obtained by multiplying the square roots of the sum of the squares of all dimension values ​​of each vector. The first sub-vector... The feature matching degree with node B reaches 0.88; the subsequent sub-vectors are processed in sequence. The matching degree between the second sub-vector and node B is 0.86, the matching degree between the third and fourth sub-vectors and node C is 0.89 and 0.87 respectively, and the matching degree between the fifth to seventh sub-vectors and node D is between 0.85 and 0.90; the matching results are arranged in chronological order to generate the initial node sequence B, B, C, C, D, D, D; after merging adjacent duplicate nodes, the final access path node sequence B to C to D is formed, where node B lasts for 2 minutes, node C lasts for 2 minutes, and node D lasts for 3 minutes.

[0125] In this embodiment of the application, the method achieves accurate reconstruction of the encrypted traffic transmission path through hierarchical feature extraction and multi-level node verification. It can accurately identify each key node that the data passes through and its duration, thus solving the fragmentation and unreliability problems of traditional methods in path reconstruction.

[0126] To address the issue of incomplete characterization of encrypted traffic features, in some embodiments, step 102: generating a spatiotemporally related website fingerprint based on the temporal statistical features and the spatial fingerprint features, includes:

[0127] Step 501: Divide the time-series statistical features into multiple continuous feature segments according to equal-length time windows, and quantize the spatial fingerprint features into fingerprint vectors of fixed dimensions.

[0128] In step 501, a continuous feature segment refers to an equal-length segment in which temporal statistical features (such as packet transmission intervals) are divided according to a fixed duration. Continuity is guaranteed by strict adjacency of timestamps. For example, 10 minutes of traffic is divided into 10 segments in 1-minute windows, and the end time of the nth segment is equal to the start time of the (n+1)th segment. A fixed-dimensional representation spatial fingerprint vector is quantized into a 128-dimensional vector, with each dimension corresponding to a specific traffic statistic (such as packet size percentiles). The fingerprint vector is a numerical sequence quantized from traffic direction features into a fixed-dimensional sequence.

[0129] In this embodiment of the application, the collected time-series statistical features are divided into multiple consecutive time periods according to a fixed duration, and the data packet statistics in each time period constitute a feature segment; at the same time, the original spatial fingerprint features are converted into numerical vectors of a uniform dimension to ensure that the features of different time periods are comparable.

[0130] Step 502: Pair and connect each of the continuous feature segments with the corresponding vector segments of the fingerprint vector with the same time window to form a time-space binding unit.

[0131] In step 502, the process of generating vector segments involves dividing the fixed-dimensional fingerprint vector into equal parts according to the number of time windows. If the vector is 128-dimensional and divided into 10 time windows, then each segment is 12.8-dimensional (actually rounded to 12 or 13 dimensions). The binding unit refers to the association structure formed by combining the temporal feature segments with the corresponding spatial fingerprint segments.

[0132] In this embodiment of the application, the feature segments of each time period are paired with the corresponding sub-segments in the fingerprint vector, and the two types of features are combined into a larger feature unit through a specific connection method to establish a temporal and spatial correspondence.

[0133] Step 503: Stack all binding units in chronological order to construct a three-dimensional feature block, where the first dimension represents the time window sequence, the second dimension represents the spatial fingerprint segment, and the third dimension represents the feature value.

[0134] In step 503, the difference between time sequence and equal-length windows is as follows: equal-length windows emphasize the division rules (e.g., every 1 minute), while time sequence emphasizes the temporal order of the segments (window 1 to window 2 to... to window N). A three-dimensional feature block refers to a three-dimensional data structure formed by stacking multiple bound units in chronological order. Continuous feature segments are mainly reflected by the first-dimensional time window sequence. Each time window corresponds to feature data within a continuous time period. The continuity of features is reflected through the sequential arrangement of the first dimension, while the third-dimensional feature values ​​store the specific statistical values ​​within each time window.

[0135] In this embodiment, all time-period binding units are arranged in chronological order of acquisition time. The first dimension represents the time axis sequence, the second dimension represents the spatial fingerprint segment, and the third dimension stores the specific feature values, thus constructing a three-dimensional feature block containing complete spatiotemporal information.

[0136] Step 504: In the three-dimensional feature block, a spatiotemporal associated website fingerprint is generated by the correspondence between the time window sequence and the spatial fingerprint segment.

[0137] In this embodiment, by analyzing the correspondence between time windows and spatial fingerprint segments in the three-dimensional feature block, a comprehensive fingerprint feature that reflects both the temporal variation pattern of traffic and the spatial distribution characteristics is extracted. The third dimension is used to store the specific feature values ​​(such as the average packet size) at each time-space coordinate point. When generating the final fingerprint, fusion is achieved through full-dimensional correlation of the three-dimensional coordinates (time, spatial segments, and feature values). The spatiotemporal correlated website fingerprint reflects the website fingerprint characteristics through the numerical distribution pattern of the third-dimensional feature values ​​in the three-dimensional feature block. Specifically, the feature value combinations at different time windows and spatial fingerprint segment combinations form unique numerical patterns. This three-dimensional numerical distribution structure is the core representation of the website fingerprint.

[0138] Here is a specific example:

[0139] In the enterprise intranet data leakage monitoring scenario, the system has collected 10 minutes of encrypted proxy traffic data. The average packet size per minute and the variance of the transmission interval are used to form 10 feature segments, each containing two feature values. The 128-dimensional spatial fingerprint vector is divided into 10 sub-segments, each with 12.8 dimensions. The first 9 sub-segments have 12 dimensions, and the last sub-segment has the remaining 20 dimensions. The feature segment of the first minute is combined with the first 12-dimensional sub-segments, the feature segment of the second minute is combined with the next 12-dimensional sub-segments, and so on, until the feature segment of the 10th minute is combined with the last 20-dimensional sub-segments. All combined units are stacked in chronological order to construct a 10×12×2 three-dimensional feature block, where 10 represents 10 time windows, 12 represents the maximum dimension of the spatial fingerprint sub-segment, and 2 represents the number of features per data point. The packet size mean and interval variance are used to extract spatiotemporal correlation features from the three-dimensional feature block. By analyzing the numerical change patterns of the feature segments of each time window and their corresponding spatial fingerprint sub-segments, the correlation between traffic changes in the time dimension and directional distribution in the spatial dimension is established. For example, the feature segment of the 3-minute time window shows a sudden increase in the average packet size, and at the same time, the values ​​of dimensions 5 to 7 in the corresponding spatial fingerprint sub-segment change, indicating that the traffic is abnormal in a specific direction at this time. The final spatiotemporal correlation website fingerprint contains both the traffic statistics features per minute and retains the spatial characteristics of the data packet directional distribution, providing a comprehensive basis for subsequent feature fusion. The formula used for dividing the spatial fingerprint sub-segments is that the starting position of the sub-segment is equal to the time window sequence number multiplied by 12.8 and then rounded down, ensuring that each sub-segment covers the complete feature space.

[0140] In this embodiment of the application, the method achieves a comprehensive characterization of encrypted traffic characteristics through three-dimensional correlation modeling of spatiotemporal features. It can capture the changing patterns in the time dimension and retain the spatial distribution characteristics, providing a reliable feature basis for subsequent accurate source tracing.

[0141] To address the issue of inaccurate physical layer feature extraction for encrypted traffic, in some embodiments, step 103: generating thermal information based on the optical phase fluctuation data and the traffic load change rate includes:

[0142] Step 601: Monitor the gradient of the number of data packets in the Transmission Control Protocol (TCP) stream data in real time, and calculate the rate of change of traffic load based on the gradient of the number of data packets.

[0143] In step 601, the gradient of data packet quantity change refers to the degree of increase or decrease in the number of transmission control protocol flow data packets per unit time, reflecting the real-time fluctuation of network load.

[0144] In this embodiment of the application, the magnitude and direction of traffic change are calculated by statistically analyzing the difference in the number of data packets in adjacent time periods. Positive values ​​indicate an increase in load, negative values ​​indicate a decrease in load, and the absolute value reflects the degree of drastic change.

[0145] Step 602: Adjust the modulation intensity of the optical phase fluctuation data based on the rate of change of the flow load.

[0146] In step 602, the modulation intensity adjustment process refers to the dynamic adjustment of the optical signal phase fluctuation amplitude according to changes in network load.

[0147] In this embodiment, the calculated rate of change of traffic load is converted into control parameters of the optical phase modulation device. When the load increases, the modulation depth is increased, and when the load decreases, the modulation depth is decreased, so that the changes in optical signal and network load keep in sync.

[0148] Step 603: The adjusted optical phase fluctuation data is superimposed with the synchronously acquired optical intensity sample value according to the timestamp to generate thermal information.

[0149] In step 603, the light intensity sampling value is the raw data of the light signal intensity captured in real time by a photoelectric sensor. Its physical meaning is the quantified measurement value of the light power per unit time during light transmission. It is collected synchronously with the light phase fluctuation data to jointly reflect the modulation effect of the encrypted traffic load change on the physical layer optical signal. The timestamp is a precise time mark for data acquisition, the equal-length window is an artificial segmentation rule for time-series statistical characteristics, and the time order is the arrangement logic of the window. The relationship among the three is that the timestamp of the light intensity sampling value is strictly aligned with the time window of the transmission control protocol stream data, ensuring that the traffic statistical characteristics and the physical layer optical signal characteristics are spatiotemporally correlated under the same time base.

[0150] In this embodiment of the application, the adjusted optical phase fluctuation value is combined with the optical intensity sampling value collected at the corresponding time according to the same time base. The data at each time point includes two dimensions: phase angle and optical intensity, forming characteristic data that reflects the comprehensive impact of network load changes on optical signals.

[0151] Here is a specific example:

[0152] In the enterprise intranet data leakage monitoring scenario, the system continuously monitors encrypted proxy traffic, counts the number of data packets every minute, and calculates the difference in changes between adjacent minutes as the change gradient. For example, if 200 packets are transmitted in the second minute, an increase of 50 packets compared to 150 packets in the first minute, the change gradient is +50. According to the formula modulation intensity change = change gradient × 0.1, the optical phase modulation intensity in the second minute is increased by 5 units. The adjusted optical phase data and corresponding optical intensity data are collected synchronously, recording a set of sampling values ​​every second. The phase value ranges from 0 to 2π, and the optical intensity value uses the standardized relative intensity value. The adjusted phase data and optical intensity data are aligned and superimposed with the same timestamp to generate 600 thermal information data points. Each point contains two parameters: phase value θ and optical intensity value I.

[0153] In this embodiment of the application, the method achieves a precise correlation between network load changes and optical signal characteristics through dynamic modulation and physical layer feature fusion. The generated thermal information can reflect the trend of traffic changes and retain the unique pattern of physical layer signals, providing a reliable physical layer feature basis for encrypted traffic analysis.

[0154] To address the issue of insufficient feature extraction from encrypted traffic, in some embodiments, step 104: using a dual-stream 3D convolutional network to process the spatiotemporally associated website fingerprint to extract first spatiotemporal features, and processing the thermal information to extract second spatiotemporal features, includes:

[0155] Step 701: Input the spatiotemporal associated website fingerprint into the first convolutional branch of the dual-stream 3D convolutional network, and perform sliding calculations in the time, space and feature dimensions through three-dimensional convolution operations to obtain the first spatiotemporal feature reflecting the traffic statistics characteristics.

[0156] In step 701, the first convolutional branch refers to a three-dimensional convolutional neural network path that specifically processes flow statistics features, and its convolutional kernel simultaneously performs sliding operations in the three dimensions of time, space and features.

[0157] In this embodiment, after the spatiotemporal website fingerprint is input into the first branch, the convolution kernel is first slidable in the time dimension to capture the traffic change trend, while the fingerprint distribution pattern is analyzed in the spatial dimension. Finally, the correlation of different statistics is integrated in the feature dimension, and a high-order feature representation that can comprehensively reflect the spatiotemporal characteristics of traffic is gradually extracted through multi-layer convolution.

[0158] Step 702: Input the thermal information into the second convolution branch of the dual-stream 3D convolutional network, and perform cross-dimensional convolution in the time, phase change and light intensity dimensions through three-dimensional convolution operations to obtain the second spatiotemporal feature reflecting the modulation characteristics of the physical layer.

[0159] In step 702, the second convolutional branch refers to a three-dimensional convolutional neural network path that is specifically designed to process the physical layer signal features. Its convolutional kernel is designed to adapt to the three-dimensional characteristics of the time-phase-intensity of the optical signal.

[0160] In this embodiment, after the thermal information is input into the second branch, the continuity of signal change is analyzed in the time dimension, the modulation pattern is captured in the phase dimension, and the intensity change pattern is identified in the light intensity dimension. The deep features that can characterize the modulation characteristics of the physical layer are extracted by the convolution kernel with a specific structure.

[0161] Here is a specific example:

[0162] In the enterprise intranet data leakage monitoring scenario, the system inputs a pre-constructed 10×12×2 three-dimensional feature block into the first processing path of the dual-stream network. This feature block contains 10 time windows, 12 spatial segments, and 2 feature values. A 3×3×2 convolutional kernel is used to perform sliding computation in three dimensions. The first convolutional layer has a stride of 1 along the time window direction and a stride of 1 along the spatial segment direction, with complete coverage of the feature value direction, outputting an 8×10×1 feature map. The second convolutional layer maintains the same kernel size, outputting a 6×8×1 feature map. After the third convolution, a final output of 4×6×1 is obtained, which is flattened into a 48-dimensional first spatiotemporal feature. Simultaneously, 10×60×2 thermal information is input into the second processing path. The system uses a 3×5×1 convolutional kernel for processing. After the first convolutional layer, an 8×56×1 feature map is obtained. The second layer outputs a 6×52×1 feature map, and the third layer outputs a 4×48×1 feature map, which flattens out to a 72-dimensional second spatiotemporal feature map. The convolutional kernel of the first path is set to 3 in the time dimension to capture the traffic change pattern over a continuous 3-minute period. It is also set to 3 in the spatial dimension to analyze the correlation between adjacent spatial segments. The convolutional kernel of the second path is set to 3 in the time dimension and 5 in the phase change dimension, which is suitable for extracting the modulation pattern of optical signals. The convolutional operations of the two paths do not interfere with each other but are time-synchronized to ensure that the temporal correspondence is consistent during subsequent feature fusion. The final output of 48-dimensional and 72-dimensional features will be used for weighted fusion.

[0163] In this embodiment, the method extracts the spatiotemporal features of the network layer and the physical layer through a dual-branch three-dimensional convolutional network, which not only preserves the traffic statistics characteristics but also captures the modulation law of the optical signal, providing a comprehensive and complementary feature representation basis for subsequent feature fusion.

[0164] Figure 2This application provides a schematic diagram of the structure of an encrypted traffic data leakage tracing system based on spatiotemporal characteristics, as shown in the embodiments of this application. Figure 2 As shown, the system includes:

[0165] The acquisition module 21 is used to acquire the transmission control protocol stream data and optical phase fluctuation data of the encrypted traffic. The transmission control protocol stream data includes time-series statistical features and spatial fingerprint features.

[0166] The first generation module 22 is used to generate a spatiotemporally associated website fingerprint based on the temporal statistical features and the spatial fingerprint features.

[0167] The second generation module 23 is used to generate thermal information based on the optical phase fluctuation data and the flow load change rate.

[0168] The processing module 24 is used to process the spatiotemporal associated website fingerprint to extract first spatiotemporal features using a dual-stream 3D convolutional network, and to process the thermal information to extract second spatiotemporal features.

[0169] The fusion module 25 is used to weightedly fuse the first spatiotemporal features and the second spatiotemporal features through a gating attention mechanism, and output the source tracing result of the leakage of encrypted traffic data.

[0170] Figure 2 The aforementioned encrypted traffic data leakage tracing system based on spatiotemporal characteristics can execute... Figure 1 The implementation principle and technical effects of the encrypted traffic data leakage tracing method based on spatiotemporal characteristics described in the illustrated embodiment will not be repeated here. The specific methods by which each module and unit performs operations in the encrypted traffic data leakage tracing system based on spatiotemporal characteristics described in the above embodiments have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0171] In one possible design, Figure 2 The encrypted traffic data leakage tracing system based on spatiotemporal characteristics in the illustrated embodiment can be implemented as a computing device, such as... Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0172] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component 32.

[0173] The processing component 32 is used to perform the above. Figure 1 The embodiment describes a method for tracing the source of leaked encrypted traffic data based on spatiotemporal characteristics.

[0174] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-described method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described method.

[0175] Storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0176] Of course, computing devices may also include other components, such as input / output interfaces, display components, communication components, etc.

[0177] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc.

[0178] The communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0179] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform. In this case, the computing device can refer to a cloud server, and the aforementioned processing components, storage components, etc., can be basic server resources rented or purchased from the cloud computing platform.

[0180] This application also provides a computer storage medium storing a computer program, which, when executed by a computer, can perform the above-described functions. Figure 1 The illustrated embodiment presents a method for tracing the source of encrypted traffic data leakage based on spatiotemporal characteristics.

[0181] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0182] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0183] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0184] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for tracing the leakage of encrypted traffic data based on spatiotemporal features, characterized in that, The method comprises the following steps: acquiring transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, the transmission control protocol flow data comprising time sequence statistical features and spatial fingerprint features; generating a space-time correlation website fingerprint based on the time sequence statistical features and the spatial fingerprint features; generating thermal information based on the optical phase fluctuation data in combination with a traffic load change rate, specifically comprising: monitoring a data packet number change gradient of the transmission control protocol flow data in real time, calculating a traffic load change rate according to the data packet number change gradient, adjusting the modulation intensity of the optical phase fluctuation data based on the traffic load change rate, superimposing the adjusted optical phase fluctuation data and synchronously collected optical intensity sampling values according to time stamps to generate thermal information; processing the space-time correlation website fingerprint to extract first space-time features and processing the thermal information to extract second space-time features by using a double-flow 3D convolution network; generating a weighted fusion feature by weighted fusion of the first space-time features and the second space-time features through a gated attention mechanism, performing similarity matching of the weighted fusion feature and a website feature template in a pre-stored website feature library to determine a target website identifier corresponding to a website feature template with the highest similarity, generating an access path node sequence according to a path feature component in the weighted fusion feature, and forming a traceability result of encrypted traffic data leakage based on the target website identifier and the access path node sequence.

2. The method of claim 1, wherein, The method of generating a traceability result of encrypted traffic data leakage by weighted fusion of the first space-time features and the second space-time features through a gated attention mechanism comprises the following steps: performing feature correlation calculation on the first space-time features and the second space-time features to generate a feature interaction matrix; calculating dynamic weight coefficients of the first space-time features and the second space-time features respectively through an activation function in the gated attention mechanism based on the feature interaction matrix; generating a traceability result through element-wise multiplication in the gated attention mechanism based on the dynamic weight coefficients.

3. The method of claim 2, wherein, The method of generating a traceability result through element-wise multiplication in the gated attention mechanism based on the dynamic weight coefficients comprises the following steps: performing weighted summation on the first space-time features and the second space-time features through element-wise multiplication in the gated attention mechanism based on the dynamic weight coefficients to generate a weighted fusion feature; performing similarity matching of the weighted fusion feature and a website feature template in a pre-stored website feature library to determine a target website identifier corresponding to a website feature template with the highest similarity; generating an access path node sequence according to a path feature component in the weighted fusion feature; forming a traceability result based on the target website identifier and the access path node sequence.

4. The method of claim 3, wherein, The method of generating an access path node sequence according to a path feature component in the weighted fusion feature comprises the following steps: extracting a path feature component from the weighted fusion feature, and decomposing the path feature component into a plurality of path feature sub-vectors; performing similarity calculation on each path feature sub-vector and standard feature data of a known node in a pre-constructed physical layer signal fingerprint library; Identify all known nodes with a similarity greater than or equal to a preset similarity threshold as target node identifiers, and arrange all target node identifiers in chronological order to generate a candidate node sequence; Merge the repeated node identifiers of adjacent time stamps in the candidate node sequence to generate an access path node sequence.

5. The method of claim 1, wherein, The space-time correlation website fingerprint is generated based on the time sequence statistical features and the space fingerprint features, including: The time sequence statistical features are divided into multiple continuous feature segments according to equal-length time windows, and the space fingerprint features are quantized into fixed-dimension fingerprint vectors; Each continuous feature segment is paired and connected with the vector sub-segment corresponding to the equal-length time window in the fingerprint vector to form a time and space binding unit; All binding units are stacked in chronological order to construct a three-dimensional feature block, where the first dimension represents the time window sequence, the second dimension represents the space fingerprint sub-segment, and the third dimension represents the feature value; In the three-dimensional feature block, the space-time correlation website fingerprint is generated through the correspondence between the time window sequence and the space fingerprint sub-segment.

6. The spatiotemporal feature-based exfiltration data outflow tracing method according to claim 1, characterized in that, The space-time correlation website fingerprint is processed using a dual-flow 3D convolutional network to extract first space-time features, and the thermal information is processed to extract second space-time features, including: The space-time correlation website fingerprint is input into the first convolution branch of the dual-flow 3D convolutional network, and three-dimensional convolution operation is performed on the time, space and feature dimensions to obtain first space-time features reflecting traffic statistical characteristics; The thermal information is input into the second convolution branch of the dual-flow 3D convolutional network, and cross-dimension convolution is performed on the time, phase change and light intensity dimensions through three-dimensional convolution operation to obtain second space-time features reflecting physical layer modulation characteristics.

7. A system for tracing the leakage of encrypted traffic data based on spatiotemporal features, characterized in that, It includes: An acquisition module is configured to acquire transmission control protocol flow data and optical phase fluctuation data of encrypted traffic, the transmission control protocol flow data including time sequence statistical features and space fingerprint features; A first generation module is configured to generate a space-time correlation website fingerprint based on the time sequence statistical features and the space fingerprint features; A second generation module is configured to generate thermal information based on the optical phase fluctuation data and combined with the traffic load change rate, specifically including: monitoring the data packet number change gradient of the transmission control protocol flow data in real time, calculating the traffic load change rate according to the data packet number change gradient, adjusting the modulation intensity of the optical phase fluctuation data based on the traffic load change rate, and superimposing the adjusted optical phase fluctuation data and the synchronously collected light intensity sampling value according to the time stamp to generate thermal information; A processing module is configured to use a dual-flow 3D convolutional network to process the space-time correlation website fingerprint to extract first space-time features, and process the thermal information to extract second space-time features; The fusion module is configured to fuse the first spatio-temporal feature and the second spatio-temporal feature by a gating attention mechanism to generate a weighted fusion feature, perform similarity matching between the weighted fusion feature and a website feature template in a pre-stored website feature library, determine a target website identifier corresponding to a website feature template with the highest similarity, generate an access path node sequence according to a path feature component in the weighted fusion feature, and form a traceability result of encrypted traffic data leakage based on the target website identifier and the access path node sequence.

Images