Application fingerprint identification method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to an application fingerprint identification method and device, electronic equipment and a storage medium, and the application fingerprint identification method comprises the steps: collecting encrypted traffic data generated by mobile equipment, and extracting key features of the encrypted traffic data, the key features comprise the transmission time, the size and direction of a data packet, and the transmission interval of the data packet; grouping the encrypted traffic data according to destination information of the encrypted traffic data to form clustering units, wherein each clustering unit represents an independent traffic mode; and performing correlation analysis on different clustering units according to the key features, and integrating the clustering units with correlation to generate an application fingerprint for identification. According to the application, known and unknown mobile application programs can be identified without priori knowledge, and the practicability and reliability of a mobile application program fingerprint identification technology in a complex and dynamic network environment are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an application program fingerprint identification method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the increasing demand for network security and privacy protection, application detection technology based on network traffic analysis has been widely researched and applied. Especially on mobile devices, application fingerprint identification technology plays an increasingly important role in network security. Existing technologies mainly focus on identifying and monitoring applications in the network by analyzing features in plaintext or encrypted traffic. However, with the popularity of encryption technology, traditional traffic analysis methods face unprecedented challenges, especially in the balance between privacy protection and security protection.

[0003] Existing network traffic-based application detection methods can be divided into the following categories: Application identification based on network intrusion detection: such as Snort's AppID system, which identifies applications by creating network intrusion detection rules for specified applications. The limitation of this method is that it relies on predefined rules and known application behavior, so it cannot cope with new applications.

[0004] Application identification based on anomaly detection: for example, Andromaly detects unknown applications by comparing the network behavior of unknown software with the network behavior of known applications. The main challenge of this method is how to effectively identify applications that have not yet appeared, especially in the case of traffic encryption, the effectiveness of the analysis method is greatly reduced.

[0005] Vulnerability detection and device identification: some methods focus on detecting applications containing known vulnerabilities or identifying devices across the network through the list of applications installed on the device. The limitation of these methods is that they also rely on known information, and cannot effectively identify new applications or devices.

[0006] The common point of these methods is that they need to know the network behavior of the application or its installation situation before identification. However, the rapid changes of mobile applications make the application of these methods in real environment severely limited. According to the latest research, even pre-installed applications have significant differences in different devices. This uncertainty leads to the fact that existing methods cannot effectively cope with new applications that have not been pre-identified, especially under the "bring your own device" or BYOD (Bring Your Own Device) policy, it is impossible to know all the applications that may appear in the network in advance.

[0007] Therefore, the prior art has obvious defects in the face of unknown applications, mainly manifested as misclassification or inability to distinguish multiple unknown applications. Network security operators need manual intervention to further analyze unknown traffic, thereby increasing operational complexity and workload. In particular, in the context of the increasing popularity of encrypted traffic, the effectiveness of these methods is greatly reduced. Therefore, how to identify new applications through traffic fingerprints in the absence of prior knowledge and effectively distinguish different applications has become a major challenge in current technology. SUMMARY

[0008] The present application provides an application fingerprint identification method and device, electronic equipment and storage medium to solve the problems in the background art.

[0009] In a first aspect, the present application provides an application fingerprint identification method, comprising: Collecting encrypted traffic data generated by a mobile device and extracting key features of the encrypted traffic data, the key features including transmission time, size and direction of data packets, and transmission interval of data packets; Grouping the encrypted traffic data according to destination information of the encrypted traffic data to form clustering units, each clustering unit representing an independent traffic pattern; Correlation analysis of different clustering units according to the key features, and integration of the clustering units with correlation to generate an application fingerprint for identification.

[0010] Further, the collection of encrypted traffic data generated by a mobile device comprises: Pretreating original network traffic generated by a mobile device to extract TCP / UDP encrypted traffic data.

[0011] Further, the grouping of the encrypted traffic data according to destination information of the encrypted traffic data to form clustering units comprises: Grouping and clustering the encrypted traffic data according to destination information using an unsupervised clustering algorithm to form clustering units.

[0012] Further, after the grouping of the encrypted traffic data according to destination information of the encrypted traffic data to form clustering units, before the correlation analysis of different clustering units according to the key features, the method further comprises: Identifying browser traffic data in the encrypted traffic data and removing the browser traffic data from the encrypted traffic data.

[0013] Further, the correlation analysis of different clustering units according to the key features comprises: The correlation strength between different clustering units is determined using the key features, and the clustering units are determined to be correlated when the correlation strength is greater than a preset threshold.

[0014] Furthermore, the step of integrating the relevant clustering units to generate an application fingerprint for identification includes: The clustering units with relevance are integrated based on set parameters to generate an application fingerprint for identification, including Jaccard similarity.

[0015] Furthermore, after integrating the correlated clustering units to generate an application fingerprint for identification, the method further includes: The application fingerprint is matched with known fingerprints in the database. If a match is found, the application is identified; otherwise, the application fingerprint is updated in the database.

[0016] Secondly, this application provides an application fingerprint recognition device, comprising: The data acquisition module is used to collect encrypted traffic data generated by mobile devices and extract key features of the encrypted traffic data, including transmission time, data packet size and direction, and data packet transmission interval. The data clustering module is used to group the encrypted traffic data into clustering units based on the destination information of the encrypted traffic data, and each clustering unit represents an independent traffic pattern; The fingerprint generation module is used to perform correlation analysis on different clustering units based on the key features, and integrate the correlated clustering units to generate an application fingerprint for identification.

[0017] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the application fingerprint recognition method described above.

[0018] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the application fingerprinting method described above.

[0019] The above-mentioned technical solution of this application has the following advantages: The application fingerprinting method provided in the first aspect of this application collects encrypted traffic data generated by mobile devices and extracts key features of the encrypted traffic data. Then, it groups the encrypted traffic data into cluster units based on destination information, where each cluster unit represents an independent traffic pattern. Finally, it performs correlation analysis on different cluster units and integrates the correlated cluster units to generate an application fingerprint for identification. This method can process network traffic without prior knowledge, identify known and unknown mobile applications, improve the practicality and reliability of mobile application fingerprinting technology in complex and dynamic network environments, and achieve real-time and accurate identification of mobile applications.

[0020] It is understood that the beneficial effects of the second, third and fourth aspects mentioned above can be found in the relevant descriptions in the first aspect above, and will not be repeated here. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating the application fingerprint recognition method provided in this application; Figure 2 The overall flowchart of the application fingerprint recognition method provided in this application; Figure 3 A schematic diagram of the structure of the application fingerprint recognition device provided in this application; Figure 4 A schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0023] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of this application with unnecessary detail.

[0024] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0025] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized. "A plurality" means "two or more."

[0027] This application relates to network security and privacy protection technologies, specifically an application fingerprinting method for mobile application fingerprinting. This technology is primarily used in areas such as network traffic analysis, mobile application monitoring, and network security, and has significant application value, particularly in preventing malware and analyzing traffic.

[0028] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0029] like Figure 1 As shown in the figure, this application embodiment provides an application fingerprinting method, which specifically includes the following steps: collecting encrypted traffic data generated by a mobile device and extracting key features of the encrypted traffic data, the key features including transmission time, data packet size and direction, and data packet transmission interval; grouping the encrypted traffic data into cluster units according to the destination information of the encrypted traffic data, each cluster unit representing an independent traffic pattern; performing correlation analysis on different cluster units according to the key features, and integrating the correlated cluster units to generate an application fingerprint for identification.

[0030] This application aims to address several key problems existing in the prior art, particularly in applications such as mobile application fingerprinting and network traffic analysis. Specifically, this application proposes an application fingerprinting method to solve the following technical problems: The problem of identifying unknown applications: Existing technologies mainly rely on the features of known applications for identification, which significantly reduces the accuracy when dealing with newly emerging and unseen applications. The goal of this application is to propose an identification method that does not require prior knowledge, capable of accurately detecting and classifying unseen applications, thereby providing greater adaptability and scalability.

[0031] Application identification in encrypted traffic is challenging: With the widespread adoption of encryption technology, traditional application identification methods based on plaintext traffic are becoming increasingly limited. Existing methods cannot extract valid fingerprint information from encrypted traffic; therefore, how to reliably identify applications in encrypted environments has become a crucial issue in technological development. This application achieves efficient application identification in encrypted traffic by introducing semi-supervised learning methods and clustering techniques.

[0032] Adaptability to Application Updates: Existing application fingerprinting methods often suffer a significant drop in effectiveness after application updates, failing to adapt to dynamic changes in applications. The goal of this application is to design a method capable of handling application updates, ensuring stable recognition accuracy throughout the application's iterative update process, and being able to identify newer application versions.

[0033] The application fingerprinting method of this application can detect previously unseen applications with an accuracy of up to 93.5% and can process network traffic without prior knowledge, thereby greatly improving the practicality and reliability of mobile application fingerprinting technology in complex and dynamic network environments.

[0034] In some embodiments, the acquisition of encrypted traffic data generated by the mobile device includes: preprocessing the raw network traffic generated by the mobile device to extract TCP / UDP encrypted traffic data.

[0035] Regularly collect encrypted TCP / UDP traffic traces generated by mobile devices, ensuring that the collected data includes information on all traffic directions (i.e., inbound and outbound). The collected traffic is processed in units of flows, which can be defined as consecutive transmissions of data with the same source address, destination address, source port, and destination port. Each flow represents a session from the device to the network destination. To construct a valid fingerprint, the following key features are extracted from each flow: transmission time, packet size and direction, and packet transmission interval. The timestamp feature captures the access sequence of the flow; the transmission interval and packet size features provide a basis for identifying specific application modules. These features not only characterize the overall pattern of the traffic but can also be used in subsequent steps for clustering, correlation analysis, and fingerprint construction.

[0036] In some embodiments, grouping the encrypted traffic data into cluster units based on the destination information of the encrypted traffic data includes: using an unsupervised clustering algorithm to group and cluster the encrypted traffic data according to the destination information to form cluster units.

[0037] Mobile application traffic is typically routed to specific network destinations, with each application module frequently communicating with these destinations. Based on this characteristic, destination clustering enables the system to separate the traffic of different modules. Using unsupervised clustering algorithms, such as distance-based hierarchical clustering or K-means clustering, the traffic of each device is grouped according to destination information, forming cluster units. Each cluster unit represents the traffic pattern of an independent module. The result of each cluster is considered as a preliminary identification basis for the application module; the goal of this step is to generate characteristically stable communication patterns, preparing for subsequent fingerprint generation.

[0038] In some embodiments, after grouping the encrypted traffic data into cluster units based on the destination information of the encrypted traffic data, and before performing correlation analysis on different cluster units based on the key features, the method further includes: identifying browser traffic data in the encrypted traffic data and removing the browser traffic data from the encrypted traffic data.

[0039] As a platform for accessing general web content, the browser's multi-purpose nature can affect the accurate identification of applications. This application first identifies and isolates browser traffic to eliminate its interference with application fingerprinting. Browser behavioral characteristics include frequent access to different destinations and short-term concurrent requests. Browser traffic is identified by analyzing whether there are significant changes in destinations and high access frequency. Once browser traffic is identified, it is removed from the total traffic to prevent its behavioral patterns from confusing the characteristics of dedicated applications, thereby improving the accuracy of fingerprinting.

[0040] In some embodiments, performing correlation analysis on different clustering units based on the key features includes: using the key features to determine the correlation strength between different clustering units, and determining that the clustering units are correlated when the correlation strength is greater than a preset threshold.

[0041] After destination clustering is completed, temporal correlation analysis is performed on the clustering results for each device. By leveraging temporal correlation, traffic from different cluster units is combined to form a more complete application profile. Modules of the same application often participate in communication within a short period. Based on this, temporal correlation can be used to capture the relationships between application modules. By calculating time intervals, frequencies, and traffic distributions, traffic with similar times is clustered and associated. If certain traffic units exhibit strong correlations, they are considered to belong to the same application fingerprint set, thus generating stable and coherent application fingerprints.

[0042] In some embodiments, the step of integrating the clustering units with relevance to generate an application fingerprint for identification includes: integrating the clustering units with relevance to generate an application fingerprint for identification based on set parameters, the set parameters including Jaccard similarity.

[0043] Based on correlation analysis results, temporally related clustered traffic from each device is integrated to generate an application fingerprint. The fingerprint includes feature sets from different modules, forming a unique application identification pattern. After generation, the fingerprint is stored in a fingerprint database for subsequent identification and updates. As the fingerprints are continuously updated, the fingerprint database can be continuously expanded. Whenever new application features are detected, the fingerprint database is dynamically updated to ensure a wider range of application identification capabilities.

[0044] In some embodiments, after integrating the clustering units with correlation to generate an application fingerprint for identification, the method further includes: matching the application fingerprint with known fingerprints in a database; if a match is successful, the application is identified; otherwise, the application fingerprint is updated in the database.

[0045] The newly generated fingerprint is matched against known fingerprints in the database to determine if the current traffic belongs to a known application. If a match is found, the application is identified. If the new fingerprint does not match a known fingerprint in the database, it is marked as an unknown application and updated in the database for later use. This method is adaptive, capable of identifying emerging applications and meeting the dynamic needs of real-world applications.

[0046] This application supports real-time processing and dynamic updates to cope with traffic changes and application updates. Employing a streaming data processing architecture, it can monitor the traffic of each device in real time in the background and dynamically generate fingerprints, ensuring rapid response to traffic fluctuations and pattern changes in practical applications. The fingerprint database is updated regularly, supporting fingerprint upgrades for known applications and automatic addition of fingerprints for unknown applications. This mechanism ensures adaptability to frequent application updates and diversified development, improving the accuracy and coverage of fingerprint recognition.

[0047] This application proposes an application fingerprinting method that can identify known and unknown mobile applications in a semi-supervised manner without prior knowledge. The method achieves its goal through steps such as data acquisition, feature extraction, destination clustering, browser isolation, temporal correlation analysis, fingerprint generation, and fingerprint matching. Figure 2 As shown, the following are detailed instructions for each step: A: Feature Extraction Module: Demonstrates the process of extracting features from network trace files (.pcap files). B: Clustering Module: Demonstrates the process of clustering network traffic for each device according to network destination. C: Browser Isolation Module: Demonstrates the process of detecting and isolating browser traffic to reduce interference with dedicated application fingerprints. D: Cross-correlation Module: Demonstrates the process of analyzing the correlation between different network destinations to identify destinations with strong correlations. E: Fingerprint Generation Module: Demonstrates the process of generating application fingerprints based on strong correlations. F: Matching / Update Module: Demonstrates the process of matching the generated application fingerprint with fingerprints in an existing fingerprint database and updating the fingerprint database as needed. Figure 2 This paper demonstrates the main modules of this application and their interactions, showing how network traffic data is processed step by step to ultimately generate and match mobile application fingerprints.

[0048] The method described in this application is applicable to mobile application fingerprinting based on encrypted network traffic, especially for mobile environments with dynamically changing traffic. Its implementation is based on an unsupervised / semi-supervised learning mechanism, which can effectively capture the characteristic patterns of each application in the network, thereby achieving accurate application identification. This implementation method combines... Figure 1 and Figure 2 The flowchart shown further describes the best implementation steps of this application.

[0049] First, the network traffic feature extraction module receives network traffic data from mobile devices and inputs it into the system in .pcap file format. To extract the features required for application identification, this implementation uses the Scikit-learn and NetworkX libraries to preprocess the raw network traffic, extracting TCP / UDP streams and their time, frequency, and other features, and generating feature vectors that meet the model's input requirements. This step ensures that the multidimensional features of the network traffic are fully captured, providing data support for subsequent processing.

[0050] Next, the clustering module clusters the network traffic of each device according to its network destination. The core idea behind this module is that applications communicate with relatively fixed servers, thus different applications exhibit high identifiability in their destination choices. The clustering operation categorizes traffic with similar communication patterns based on the temporal and spatial characteristics of the traffic. This step helps group traffic from different applications and reduces noise caused by homogeneity.

[0051] To further improve fingerprint recognition accuracy, the browser isolation module detects and removes browser-related traffic. As a content access platform, browser traffic patterns are highly similar across different applications; without isolation, this could interfere with the recognition by dedicated applications. This implementation employs a feature-based isolation algorithm to remove browser-related traffic, ensuring that the generated fingerprint is more distinctive.

[0052] After removing irrelevant traffic, the cross-correlation module analyzes the temporal correlation between traffic clusters. By calculating the correlation strength between destinations, this implementation can identify frequently co-occurring destination combinations, thereby constructing a correlation graph reflecting the application's communication characteristics. During this process, a correlation threshold (τ_correlation) is set, retaining only correlation connections exceeding the threshold to further enhance the fingerprint's discriminative effect.

[0053] Subsequently, the fingerprint generation module generates application fingerprints based on strong correlations. In this module, traffic clustering results and temporal correlation maps are used to create unique fingerprint representations, and traffic combinations with high similarity are selected based on Jaccard similarity (τ_similarity) to generate application fingerprints that can be used for identification. The fingerprint generation aims to ensure stable application identification capabilities, thereby forming traffic characteristics capable of handling frequent application updates.

[0054] Finally, the matching / updating module matches the newly generated fingerprint with fingerprints in the existing fingerprint database. When a new application fingerprint is detected or an existing application fingerprint is updated, the new fingerprint is stored in the fingerprint database, and the contents of existing fingerprints are adjusted as needed. The purpose of this module is to achieve dynamic updates to ensure the long-term validity of the fingerprint database, thereby achieving the goal of real-time recognition.

[0055] Through the above process, this application not only achieves efficient and accurate mobile application fingerprint recognition, but also processes newly installed or updated applications without relying on any prior knowledge, demonstrating strong generalization ability.

[0056] The application fingerprinting method provided in this application achieves real-time and accurate identification of mobile applications, offering significant advantages over existing technologies in several aspects. First, the method avoids reliance on prior knowledge of the application, enabling it to adapt to changes in network traffic and application updates. In experiments, the method was implemented using a prototype with machine learning and graphics computing capabilities implemented through the Scikit-learn and NetworkX libraries. Evaluation results show that the method exhibits high accuracy in identifying known applications and handling new applications. Specifically, compared to the state-of-the-art supervised application identification technology AppScanner, this method demonstrates superior accuracy. In the evaluation dataset, the method achieved an accuracy of 89.2% for identifying known applications, while AppScanner's accuracy was relatively low. Furthermore, the method can detect previously unseen applications with 93.5% accuracy, demonstrating strong adaptability in handling dynamically changing and unforeseen applications.

[0057] This application improves the accuracy and efficiency of fingerprint recognition by introducing multiple parameters to optimize the fingerprint generation and matching process. These parameters include: τ_batch (processing time per batch), τ_window (active time window of the target cluster), τ_correlation (minimum correlation between clusters), and τ_similarity (minimum Jaccard similarity of the fingerprint). Experimental optimization shows that these parameters play a significant role in improving the F1 score (harmonic mean). The optimized parameter selection ensures fingerprint accuracy, enabling the system to more accurately identify and match application traffic, thereby improving the overall recognition efficiency of the method.

[0058] This application achieves significant results in isolating browser behavior. Experimental results show that the browser isolation module effectively avoids noise introduced by the browser's frequent access to network destinations, further improving the accuracy of this method in identifying dedicated applications. This isolation approach enables the method to maintain accurate detection of application communication behavior in diverse and complex mobile traffic environments, improving the confidence and uniqueness of application fingerprints.

[0059] The method presented in this application also has significant advantages in real-time performance. In experiments, this method can complete fingerprint generation and matching in a short time and has the ability to handle real-time network traffic. This real-time characteristic makes this method suitable for high-frequency, highly dynamic mobile network environments, and can meet the needs of rapid detection and identification in various practical application scenarios.

[0060] Overall, the application fingerprinting method of this application significantly improves the accuracy of application identification compared to existing supervised learning techniques, especially demonstrating strong adaptability and robustness when dealing with unknown applications and dynamically changing network traffic. Furthermore, its innovative designs in browser isolation, parameter optimization, and real-time performance give this application significant benefits in the field of mobile application identification, providing an efficient, flexible, and accurate technical solution for application identification in mobile network environments.

[0061] Corresponding to the application fingerprint recognition method described in the above embodiments, such as Figure 3 As shown, this application embodiment also provides an application fingerprint recognition device, the application fingerprint recognition device 300 including: The data acquisition module 301 is used to acquire encrypted traffic data generated by the mobile device and extract key features of the encrypted traffic data, including transmission time, data packet size and direction, and data packet transmission interval. Data clustering module 302 is used to group the encrypted traffic data into clustering units based on the destination information of the encrypted traffic data, and each clustering unit represents an independent traffic pattern; The fingerprint generation module 303 is used to perform correlation analysis on different clustering units based on the key features, and integrate the clustering units with correlation to generate an application fingerprint for identification.

[0062] It should be noted that the information interaction and execution process between the above modules / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0063] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0064] This application also provides an electronic device 400, such as... Figure 4 As shown, it includes a memory 401, a processor 402, and a computer program 403 stored in the memory 401 and executable on the processor 402. When the processor 402 executes the computer program 403, it implements the steps of the application fingerprinting method provided in the first aspect.

[0065] In applications, electronic devices may include, but are not limited to, processors and memory. Figure 4 This is merely an example of an electronic device and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combinations of certain components, or different components, such as input / output devices, network access devices, etc. Input / output devices may include cameras, audio capture / playback devices, displays, etc. Network access devices may include network modules for wireless network communication with external devices.

[0066] In applications, the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0067] In applications, memory can be an internal storage unit of an electronic device in some embodiments, such as a hard drive or RAM. In other embodiments, memory can be an external storage device of the electronic device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Memory can also include both internal and external storage units of the electronic device. Memory is used to store operating systems, applications, bootloaders, data, and other programs, such as program code for computer programs. Memory can also be used to temporarily store data that has been output or will be output.

[0068] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps in the above-described method embodiments.

[0069] This application implements all or part of the processes in the methods of the above embodiments, which can be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can at least include: any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a portable hard drive, a magnetic disk, or an optical disk.

[0070] Those skilled in the art will recognize that the device and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0071] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interface, or the device may be indirectly coupled or communicated, and may be electrical, mechanical, or other forms.

[0072] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An application fingerprint recognition method, characterized in that, include: Collect encrypted traffic data generated by mobile devices and extract key features of the encrypted traffic data, including transmission time, data packet size and direction, and data packet transmission interval; The encrypted traffic data is grouped into cluster units based on the destination information of the encrypted traffic data, and each cluster unit represents an independent traffic pattern. Based on the key features, correlation analysis is performed on different clustering units, and the clustering units with correlation are integrated to generate an application fingerprint for identification.

2. The application fingerprint recognition method as described in claim 1, characterized in that, The encrypted traffic data collected from mobile devices includes: The raw network traffic generated by mobile devices is preprocessed to extract TCP / UDP encrypted traffic data.

3. The application fingerprint recognition method as described in claim 1, characterized in that, The step of grouping the encrypted traffic data into cluster units based on the destination information of the encrypted traffic data includes: The encrypted traffic data is grouped and clustered according to destination information using an unsupervised clustering algorithm to form cluster units.

4. The application fingerprint recognition method as described in claim 1, characterized in that, After grouping the encrypted traffic data into cluster units based on the destination information of the encrypted traffic data, and before performing correlation analysis on different cluster units based on the key features, the method further includes: Identify browser traffic data within the encrypted traffic data and remove the browser traffic data from the encrypted traffic data.

5. The application fingerprint recognition method as described in claim 1, characterized in that, The correlation analysis of different clustering units based on the key features includes: The correlation strength between different clustering units is determined using the key features, and the clustering units are determined to be correlated when the correlation strength is greater than a preset threshold.

6. The application fingerprint recognition method as described in claim 1, characterized in that, The step of integrating the correlated clustering units to generate an application fingerprint for identification includes: The clustering units with relevance are integrated based on set parameters to generate an application fingerprint for identification, including Jaccard similarity.

7. The application fingerprint recognition method as described in claim 1, characterized in that, After integrating the correlated clustering units to generate an application fingerprint for identification, the method further includes: The application fingerprint is matched with known fingerprints in the database. If a match is found, the application is identified; otherwise, the application fingerprint is updated in the database.

8. An application-based fingerprint recognition device, characterized in that, include: The data acquisition module is used to collect encrypted traffic data generated by mobile devices and extract key features of the encrypted traffic data, including transmission time, data packet size and direction, and data packet transmission interval. The data clustering module is used to group the encrypted traffic data into clustering units based on the destination information of the encrypted traffic data, and each clustering unit represents an independent traffic pattern; The fingerprint generation module is used to perform correlation analysis on different clustering units based on the key features, and integrate the correlated clustering units to generate an application fingerprint for identification.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the application fingerprinting method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the application fingerprinting method as described in any one of claims 1 to 7.

Images