A website fingerprinting method based on cross-window feature extraction

Abstract

The application discloses a website fingerprint identification method based on cross-window feature extraction and belongs to the technical field of network flow analysis.The application divides original flow through fixed time length basic time slices, generates a variable window according to a to-be-aggregated time length, extracts the number of data packets in each window as a local statistical feature, further constructs a window index array, and utilizes a vectorized histogram operation to perform cross-window dependent tracking to model long-range macroscopic time sequence dependent relationship of flow sequence; and parallel calculation and matrix operation are utilized to accelerate the whole feature extraction process at the system level.The application can effectively resist the interference of various active defense mechanisms such as flow filling, delayed sending, multi-tab concurrent browsing and flow splitting forwarding, significantly improves the efficiency and robustness of encrypted flow feature extraction, and enhances the actual deployment adaptability of a behavior recognition model in a real complex network environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a website fingerprint identification method based on cross-window feature extraction. BACKGROUND

[0002] With the rapid development of Internet technology, network traffic analysis plays an increasingly important role in network security, privacy protection and other fields. Website fingerprint identification technology identifies specific websites visited by users by analyzing encrypted network traffic, and has important value in network security monitoring, attack detection and other aspects.

[0003] Traditional website fingerprint identification methods are mainly based on basic features such as packet size, direction, time interval, etc., but these methods still have room for improvement in terms of recognition accuracy and robustness when faced with complex network environments and defense measures. The main problems existing in the prior art can be specifically described as follows:

[0004] (1) Single feature extraction granularity, representation ability needs to be enhanced: traditional methods usually only extract isolated instantaneous statistics (such as single packet size or adjacent packet time difference), or perform simple global aggregation statistics. This processing method is difficult to capture both the microscopic statistical characteristics and the macro temporal dependence of the traffic. For example, they cannot effectively model the local density distribution of traffic within a fixed time window, and lack the description of long-range intervals and burst patterns between non-empty windows, resulting in the extracted features being superficial and unable to fully and deeply represent the unique behavior patterns of website access;

[0005] (2) The ability to model the temporal and spatial dynamic characteristics of traffic needs to be enhanced: Real network traffic, especially under the interference of defense mechanisms, often presents complex characteristics such as non-uniform distribution, intermittent bursts, and the inclusion of continuous idle periods. Existing methods have limited ability to handle continuous empty windows and traffic burst patterns, often ignoring or simplifying the handling of these phenomena. For example, they fail to effectively quantify the "silence" interval between one active window and the next, which is a key timing clue to resist filling and other confusion techniques, resulting in compromised completeness and discriminability of the timing model;

[0006] (3) Computational efficiency needs to be optimized, difficult to meet real-time and large-scale processing needs: Traditional feature extraction processes rely on serial loops or iterative operations for packet-by-packet processing, resulting in low computational efficiency. With the rapid growth of network traffic data, this method is difficult to meet the real-time processing needs of large-scale network traffic data, becoming a performance bottleneck in actual system deployment, limiting the application feasibility of the technology in large networks or high-speed links;

[0007] (4) Poor adaptability and robustness to various flow defense technologies: Currently, in order to counter fingerprint identification, various defense mechanisms such as concurrent browsing of multiple tabs, flow filling, delayed sending and flow splitting and forwarding have appeared. The fixed statistical features based on traditional methods are easily disturbed or hidden by these defense means, and the adaptability is poor. In the face of the above interference, the feature distribution will change significantly, causing the recognition performance of the model trained based on this to drop sharply, and unable to maintain stable attack (recognition) effect in the confrontation environment.

[0008] Therefore, there is an urgent need for a website fingerprint identification method that can break through the above limitations. The ideal method should be able to capture the statistical features within the window and the inter-window dependent features simultaneously through a double-level feature extraction mechanism; it should be able to model the spatiotemporal dynamics of the flow in detail, including handling empty windows and burst intervals; it should use vectorized matrix operations and parallel computing to optimize feature extraction and speed up processing to improve processing efficiency; ultimately, the method should be able to effectively deal with multiple defense mechanisms and still maintain high recognition accuracy and robustness in complex confrontation environments, meeting the urgent needs of actual deployment. SUMMARY

[0009] In view of the above deficiencies in the prior art, the present application provides a website fingerprint identification method based on cross-window feature extraction. The present application uses a double-level feature extraction mechanism of windowed statistics and cross-window dependent tracking, combined with vectorized matrix operations and parallel computing optimization, to simultaneously capture the local statistical properties of the flow and the global temporal dependencies, significantly improving the processing efficiency of large-scale flow, enhancing the robustness to defense measures such as flow filling and delay, adapting to the multi-tab concurrent scenario, and achieving more accurate website fingerprint identification.

[0010] The specific technical solutions of the present application are as follows:

[0011] The present application provides a website fingerprint identification method based on cross-window feature extraction, comprising the following steps:

[0012] Step S1, obtaining network flow trajectory data , wherein each data packet contains a timestamp and a signed packet information , the sign of the data packet transmission direction, representing an outbound data packet, representing an inbound data packet, indicating the size of the data packet;

[0013] Step S2, based on the network flow trajectory , set the maximum trajectory length as a hyperparameter, if the actual trajectory length If the time is right, then a truncation operation is performed on the trajectory data, retaining only the preceding data. One data packet;

[0014] Step S3: Filter invalid records from the trajectory data processed in step S2 and remove timestamps. The data packets yield a valid record index set. ;

[0015] Step S4: If the valid record index set obtained in step S3... If not empty, then based on Extract valid timestamp data from the original trajectory. With valid package information data ;

[0016] Step S5: Perform normalization calculation: based on the preset maximum loading time. The original timestamp sequence extracted in step S4 Each element in Perform a linear mapping to obtain a normalized timestamp sequence. The specific mapping formula is as follows: ,in, Represents a normalized timestamp sequence The k-th element in;

[0017] Step S6: The normalized timestamp sequence obtained in step S5... Mapped to discrete window indices through linear transformation and floor operation: ,in The maximum number of windows is preset; then... Perform pruning to limit the value range of all its elements to a specific range. Within the range;

[0018] Step S7: Based on the valid packet information data extracted in step S4 The symbols for each element in the table distinguish between outbound and inbound records, and a corresponding outbound record index set is defined. and inbound record index set ;

[0019] Step S8: Based on the window index obtained in step S6 and the index set defined in step S7 and Vectorized histogram statistics were used to calculate the outbound data packet quantity characteristics for each time window. Characteristics of the number of inbound data packets The specific calculation formula is as follows:

[0020] ;

[0021] ;

[0022] wherein, is the corresponding window index array obtained according to the outbound index set , is the corresponding window index array obtained according to the inbound index set , () is the invoked vectorized histogram statistics function;

[0023] Step S9, based on the window index obtained in step S6, the valid packet information data extracted in step S4, and the index set defined in step S7, , and , the weighted histogram operation is used to calculate the outbound packet total size feature and the inbound packet total size feature of each time window respectively, and the specific calculation formula is as follows:

[0024] ;

[0025] ;

[0026] wherein, is the corresponding packet size array obtained according to the outbound index set , is the corresponding packet size array obtained according to the inbound index set , () is the invoked weighted histogram function, and the negative sign for aims to ensure that the inbound packet total size feature value is positive;

[0027] Step S10, all non-empty windows containing at least one packet are identified, and a unique ordered set of window indexes thereof is obtained, denoted as , () is the invoked ascending order sorting function;

[0028] Step S11, when the number of non-empty windows , wherein Diff() is the method representation for calculating the difference array of the indexes of the continuous non-empty windows, and the difference values are assigned to the interval features of the corresponding windows , denotes the interval feature vector corresponding to all windows (i.e., the fourth type of feature), denotes the non-empty window index sequence The sub-sequence after removing the first element is used to calculate the difference Align to the next window that produces the interval;

[0029] Step S12, constructing a feature matrix Each row corresponds to a time window, containing five features of the number of outbound packets, the number of inbound packets, the total outbound size, the total inbound size, and the window interval, corresponding to the vector in turn: ;

[0030] Step S13, logarithmic transformation is performed on the feature matrix, and the transformed result is taken as a feature representation to improve numerical stability and facilitate subsequent machine learning model processing.

[0031] Preferably, in step S2, the maximum trajectory length is dynamically adjusted according to the application scenario: in a single-flow application scenario, the value is 5000 to optimize memory consumption; in a multi-flow application scenario, the value is 10000 to capture more complex interaction patterns. For super-long traffic trajectories whose actual trajectory length exceeds the maximum trajectory length, a sliding window technique is used to perform the truncation operation.

[0032] Preferably, in step S5, the maximum loading time is pre-set according to the business scenario: 80 seconds for single-flow business and 120 seconds for multi-flow business.

[0033] Preferably, in step S6, the window index is clipped, specifically by performing boundary checking to ensure that all window indices fall within the range of [0, ].

[0034] Preferably, the histogram operation and the weighted histogram operation in steps S8 and S9 are implemented using a vectorized bincount operation and are efficiently counted through the optimization routine of NumPy; wherein the weighted histogram operation takes the weight as negative to ensure that the feature value is positive when calculating the total inbound packet size feature; when a window has no packet, the corresponding histogram statistic value is zero.

[0035] Preferably, in step S10, the unique and ascendingly arranged indices in the window index array W are obtained to obtain the non-empty window index set U; in step S11, the index difference between consecutive non-empty windows is calculated, specifically including: calculating the difference between adjacent non-empty window indices and assigning the difference to the interval feature position corresponding to the next non-empty window; for the first non-empty window, set its interval feature value to the index value of the window.

[0036] Further, the calculation formula of the interval feature in step S11 is defined as: wherein represents the index position of the current non-empty window in the sequence, represents the current window corresponding interval feature value, represents the window the index of the nearest non-empty window before; for the first non-empty window, the interval feature value is set as the index value of the window itself.

[0037] Preferably, in step S13, the logarithmic transformation of the feature matrix comprises: if the effective record set is empty, directly returning the logarithmic transformation result of the zero matrix; after step S13, further comprising normalizing the logarithmically transformed feature matrix.

[0038] The application also provides a website fingerprint identification system based on statistical window features and cross-window tracking, for executing the method, comprising the following parts:

[0039] A data preprocessing module is responsible for executing steps S1-S4, for receiving original network traffic data, generating a structured traffic data set to be processed through traffic cleaning, invalid record filtering and trajectory length standardization processing;

[0040] A window division engine is responsible for executing steps S5-S6, for establishing a time index architecture, and for discretizing continuous traffic data into a plurality of time window units of fixed length through timestamp normalization and linear mapping;

[0041] A double-level feature extractor, as the core of the business logic, is responsible for executing steps S7-S9, for extracting micro statistical properties within the window and macro temporal dependence between windows; by calling the calculation interface provided by the vectorization calculation engine, a vectorization operator is configured to extract the deep features of the traffic, and the vectorization operator includes a histogram operator and a weight operator;

[0042] A vectorization calculation engine, as a general-purpose computing support, is responsible for executing steps S10-S11, for providing feature calculation capabilities based on matrix operations; by encapsulating the vectorization operator, the nonlinear iterative logic issued by the double-level feature extractor is converted into high-concurrency matrix operations, thereby realizing high-speed calculation of features;

[0043] A feature post-processing module is responsible for executing steps S12-S13, for normalizing the original feature matrix after calculation, and for outputting the feature representation conforming to the input requirements of the machine learning model by performing logarithmic transformation and standardization processing.

[0044] Preferably, the double-level feature extractor further comprises:

[0045] a flow direction identification unit automatically distinguishes the outbound traffic and the inbound traffic based on the packet information;

[0046] a count statistics unit counts the number of outbound and inbound packets in each time window;

[0047] a size statistics unit accumulatively calculates the total size of outbound and inbound packets in each time window;

[0048] a time-dependent modeling unit captures the time dynamics of the traffic by tracking the distribution pattern of non-empty windows;

[0049] an empty window processing unit specially processes the case of continuous empty windows to ensure the accuracy of the interval feature calculation.

[0050] Preferably, the vectorized calculation engine further comprises:

[0051] a parallel processing unit simultaneously processes the feature calculation of multiple time windows by using a multi-core processor architecture;

[0052] a memory optimization unit reduces the memory occupation by using matrix pre-allocation and memory reuse techniques;

[0053] a calculation acceleration unit accelerates the histogram operation by integrating a GPU acceleration library;

[0054] a numerical stability unit is used to handle extreme numerical cases to prevent numerical overflow problems in logarithmic transformation.

[0055] The present application has the beneficial technical effects of:

[0056] (1) More comprehensive feature extraction and stronger anti-interference ability: Through a double-level feature extraction mechanism, both window-in statistics features and window-dependent features are captured, providing richer traffic representation. This method can effectively deal with common traffic defense measures such as padding and delay, and still maintains high recognition accuracy in complex scenarios such as multi-tab concurrent browsing and traffic obfuscation, significantly enhancing the robustness and practical deployment adaptability of the feature extraction method;

[0057] (2) Processing efficiency is significantly improved, and system stability is higher: Vectorized matrix operations and parallel computing are used to optimize feature extraction, converting traditional iterative operations into efficient matrix operations, which greatly improves the processing speed of large-scale traffic data. At the same time, through strict data cleaning, boundary checking and exception handling mechanisms, the method ensures stable operation in various network environments and has good scalability, facilitating the integration of new algorithms and models;

[0058] ​(3) Wide practical value and superior comprehensive performance: The method can be applied to network security monitoring, attack detection, privacy protection evaluation and other fields. The modular system design can adapt to the needs of the developing network environment, and has advantages in comprehensiveness and computational efficiency of feature extraction, and shows significant comprehensive performance advantages in identification accuracy and training efficiency when dealing with various defense mechanisms. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 is a website fingerprint identification method framework based on cross-window feature extraction, which shows the overall technical architecture of the application, and highlights the core processing flow of cross-window feature extraction;

[0060] Figure 2 is a schematic diagram of various feature extraction methods under random delay defense, which compares the feature extraction effect difference of the traditional feature extraction method and the cross-window feature extraction method proposed by the application when dealing with random delay defense;

[0061] Figure 3 is a comparison chart of average precision (MAP) values of different methods under different website label numbers, which directly shows the recognition accuracy performance of the method and the traditional method under different website label numbers in the form of a line chart;

[0062] Figure 4 is a comprehensive comparison chart of training efficiency (Epoch time) and recognition performance (F1 value) of different methods in a single flow scenario, which shows the comprehensive performance of each comparison method in the two dimensions of single round training time (Epoch time) and recognition performance (F1 value) under various defense measures, and directly reflects the comprehensive advantages of the method in training efficiency and recognition accuracy;

[0063] Figure 5 is a balance chart of training efficiency (Epoch time) and recognition accuracy (average precision) of different methods in a multi-flow scenario, which shows the distribution of each comparison method in the two key dimensions of training efficiency (single round training time) and recognition accuracy (average precision) under different website label numbers (multi-flow concurrent scenario), and directly reveals the superior balance ability of the method in efficiency and accuracy when dealing with different sizes of concurrent traffic. DETAILED DESCRIPTION

[0064] The application will be specifically described below in conjunction with the drawings and examples. Obviously, the described examples are only part of the examples of the application, not all examples. Based on the examples in the application, all other examples obtained by those skilled in the art without creative labor belong to the scope of protection of the application.

[0065] Embodiment 1: Method embodiment

[0066] This embodiment provides a specific implementation of the website fingerprinting method, based on the step-by-step process of S1 to S13, each step is implemented with specific technical means and parameters. As shown in Figure 1 , which shows the basic process framework from raw traffic data collection to final feature output. Specifically, the following steps are included:

[0067] Step S1, obtaining network traffic trajectory data.

[0068] First, use a network interface card with promiscuous mode function or a special traffic monitoring device to call the underlying capture driver (such as libpcap or WinPcap) to obtain raw packets in real time on the link; then, the system associates the captured packets based on five-tuple information (source IP, destination IP, source port, destination port, transport layer protocol), and combines with the TCP state machine to track TCP three-way handshake and sequence number changes, thereby realizing complete bidirectional traffic tracking and recombination of specific TCP connections; then, the captured raw data is organized into a sequence: . Wherein each data packet is defined as a two-tuple, i.e. , containing the following information:

[0069] Timestamp : records the time, with a precision of microseconds;

[0070] Packet information : a signed value, whose sign indicates the direction of the packet ( outbound record, inbound record), and its absolute value represents the packet size, in bytes.

[0071] This data representation method can completely preserve the space-time characteristics of traffic. In actual deployment, the system establishes an independent data tracking structure for each TCP connection and configures a reasonable timeout mechanism (for example, set the idle connection timeout to 60 seconds) to prevent memory leakage and resource exhaustion.

[0072] Step S2, set the maximum trajectory length and perform truncation processing.

[0073] Based on the network traffic trajectory obtained in step S1, the obtained traffic trajectory is truncated according to the application scenario. The maximum trajectory length The threshold is dynamically adjusted between 5000 and 10000: 5000 is used for single-stream applications to optimize memory consumption, and 10000 is used for multi-stream applications to capture more complex interaction patterns. The truncation mechanism explicitly stipulates that the truncated subsequence must completely contain the beginning and end packets of the original traffic trajectory. Through this truncation logic that includes the complete lifecycle, the fingerprint characteristics of encrypted traffic can be maximized while ensuring computational efficiency.

[0074] If the actual trajectory length Then, the trajectory data is truncated. Specifically, the process involves truncating the sequence... Directly extract the previous part Data packets, to obtain subsequences Subsequent data packets will be discarded.

[0075] This operation aims to ensure the consistency and comparability of traffic trajectories of different lengths in terms of feature dimensions, and to effectively control the computational complexity of subsequent processing.

[0076] Step S3: Filter invalid records.

[0077] This step aims to perform a validity check on the truncated data packet sequence to remove timestamp anomalies (i.e., (data packets).

[0078] A vectorized parallel processing mechanism is employed to filter the original traffic sequence. Specifically, a Boolean mask is constructed to extract traffic samples that meet the time interval requirement in one step. Furthermore, valid data packets with a payload greater than zero constitute the index set of valid data packets. .

[0079] This operation can effectively filter out noisy data caused by capture device malfunctions or packet parsing errors, effectively eliminating the interference of noisy data on feature extraction, thereby providing high-quality input for subsequent feature extraction steps.

[0080] Step S4: Extract valid timestamp and packet information data.

[0081] If the valid record index set If not empty, then based on the index set. Extract the corresponding valid timestamp data from the original data sequence. With valid package information data ,in Indicates the first The timestamp of each data packet Indicates the first The signed packet information of each data packet. This separation operation facilitates the subsequent separate processing of time information and packet content information;

[0082] If is empty, directly skip the subsequent feature extraction and other related steps, and enter the special case processing flow defined in step S13.

[0083] Step S5, normalize the timestamp.

[0084] The timestamp feature is normalized and filtered based on a preset threshold. First, define the maximum loading time hyperparameter , which is set according to the application scenario: 80s for single-stream scenarios and 120s for multi-stream scenarios.

[0085] Subsequently, perform normalization calculation: linearly map each element in the original timestamp sequence to obtain the normalized timestamp sequence . The specific mapping formula is as follows: , where is the kth element in the normalized timestamp sequence , representing the value (or relative time position) of the timestamp relative to the maximum loading time . In the calculation process, boundary truncation logic is executed: if the timestamp of a data packet exceeds the preset , it is determined that the data packet is redundant data outside the observation window and is discarded. This processing method eliminates the influence of the absolute time scale by introducing a global consistent time reference (normalization processing), and ensures the high consistency of model input features in the time dimension through hard truncation (Hard Truncation), thereby enhancing the adaptability of the method.

[0086] Step S6, map the normalized timestamp to the window index.

[0087] This step maps the continuous normalized timestamp to discrete window indexes through linear transformation and floor function. The specific calculation is as follows:

[0088] The calculation formula of the window index is:

[0089] ;

[0090] where denotes the floor function, is the preset maximum window number. This formula uniformly divides the interval into windows, and the window index range is 0 to .

[0091] Subsequently, to ensure that all indices are within the valid range, a boundary clipping operation is performed:

[0092] ;

[0093] In processing the timestamp or length features, the present application invokes the numerical clipping (Clip) operator in NumPy, which sets values less than 0 to 0 and values greater than to .

[0094] The above mapping process achieves the conversion from continuous time to discrete windows.

[0095] Step S7, based on the packet information symbol, separate the outbound and inbound records.

[0096] This step aims to divide the packet indices into outbound and inbound sets according to the sign of each element in the valid packet information data . The specific implementation is as follows: calculate the sign of each element in the traversal set through vectorization operation:

[0097] If , add the index to the outbound packet index set ;

[0098] If , add the index to the inbound packet index set .

[0099] This operation lays the foundation for subsequent separate statistics of outbound and inbound traffic features.

[0100] Step S8, use the histogram operation to calculate the number of packets in each window.

[0101] This step aims to count the number of outbound or inbound packets in each aggregation window based on the window index array , and use it as the basis for subsequent analysis. In the specific implementation, first, select the feature sequence to be counted according to the detection target: if outbound behavior is detected, the feature sequence X is the outbound packet number sequence ; if inbound behavior is detected, X is the inbound packet number sequence . Then, use the vectorized frequency statistical function (such as the np.bincount function in the NumPy library) to combine the window index array to quantify the feature sequence Perform distribution statistics. When calling the np.bincount function, explicitly set the minlength parameter to the predefined maximum window number (1800 in this embodiment) to ensure that the length of the statistical result vector is uniform, facilitating subsequent processing. This operation finally outputs the quantitative statistical result of the number of packets in each window.

[0102] For the special case of no data packets falling into the window, the operator follows the zero-padding strategy: if no original data meeting the conditions is retrieved in a certain index interval, the statistical value at that position is automatically set to the default value 0. By fixing the output sequence length, the generated histogram feature vector is aligned in spatial dimensions, thereby avoiding the problems of index out-of-bound or inconsistent tensor dimensions caused by data sparsity. The specific implementation logic is as follows:

[0103] ① Outbound packet quantity feature :

[0104] First, according to the outbound record index set , the corresponding window index array is obtained;

[0105] Subsequently, the function is called, which counts the number of occurrences of each window index in and returns an array of length , where the th element of the array is the number of outbound packets in window .

[0106] ② Inbound packet quantity feature :

[0107] Its calculation method is similar to , the difference is the use of inbound index set , that is, calling .

[0108] The resulting feature reflects the packet intensity distribution of traffic in the time dimension.

[0109] Step S9, calculate the total packet size feature of each window using the weighted histogram operation.

[0110] This step aims to separately count the total size of outbound and inbound packets in each window. The calculation is implemented using the weighted histogram statistical method. The specific calculation process is as follows:

[0111] ① Outbound packet total size feature :

[0112] First, according to the outbound index set Get the corresponding window index array And the packet size array (The latter as a weight);

[0113] Then, call the weighted histogram function (for example: can be realized by np.bincount combined with the weight parameter) to calculate: The function accumulates all the weights (i.e. packet sizes) corresponding to each window index.

[0114] ②Total size of outbound packet feature :

[0115] Since the packet information of the inbound packet is negative, in order to get a positive feature value, the weight needs to be taken negative when calculating. Specifically: .

[0116] Step S10, identify non-empty windows and get the sorted index set.

[0117] This step aims to identify all windows containing at least one packet (outbound or inbound), i.e. non-empty windows. The specific operation is:

[0118] First, find all unique window indices in the window index array ;

[0119] Then, use the np.unique operator in the NumPy library to process the original window index sequence. This operator extracts the unique index values in ascending order through the underlying efficient sorting and deduplication logic. For empty windows, since this operator only acts on existing (i.e. containing packets) index sequences, the "empty window" indices that are not assigned to packets will not appear in the input data, so when generating the set , they will be automatically filtered, ensuring the non-emptiness, uniqueness and order of the result set. This set provides the necessary foundation for subsequent calculation of inter-window dependency features.

[0120] Step S11, calculate the window interval feature.

[0121] This step aims to calculate the index difference between consecutive non-empty windows when the number of non-empty windows , to represent the burst mode and time dynamic characteristics of the traffic. The implementation uses the following rules to calculate the window interval feature: for the first non-empty window, its interval feature value is set to the index value of the window itself; for subsequent non-empty windows, the interval feature value is calculated using the improved interval definition , where represents the index position of the current non-empty window in the sequence, representing the current window corresponding interval feature value, representing the window the index of the previous nearest non-empty window. The specific calculation process is as follows:

[0122] ①Calculate the difference value of the continuous window index: calculate the difference array of the continuous non-empty window index , where ;

[0123] ②Initialize the feature array: initialize an array with a length of , and the value is all 0;

[0124] ③Assign values to the first non-empty window: for the first non-empty window , the interval feature value is set to the window index itself, that is , which represents the interval from the beginning of the trajectory to the first non-empty window.

[0125] For the sake of clarity, the above calculation process is illustrated by an example: assuming that the window index starts from 0, if the 1st window (Idx0) has data packets, the 2nd-5th windows (Idx 1-4) are empty, and the 6th window (Idx 5) has data packets, then:

[0126] First non-empty window: , indicating that there is traffic at the beginning;

[0127] Empty window position: , which is filled with 0 by default;

[0128] Subsequent non-empty window: , indicating that there are 4 empty windows between this window and the previous non-empty window;

[0129] ⑤Value range constraint: the interval feature takes a non-negative integer between , where is the preset maximum total number of windows. This feature quantifies the sparse and dense distribution of encrypted traffic in the time dimension (such as the length of the silent period) by recording the offset between non-empty windows;

[0130] ⑥Assign values to subsequent non-empty windows: for each subsequent non-empty window , the calculated difference value is assigned to the corresponding position, that is .

[0131] If the number of non-empty windows , then the array remains all zero.

[0132] Step S12, constructing a feature matrix.

[0133] This step concatenates the five feature vectors calculated in steps S8, S9, S11 by column, thereby constructing the final feature matrix .

[0134] Specifically, the feature matrix is concatenated by the five feature vectors by column, that is, , the data type of the matrix is Float32, and it is directly stored in the memory. Each row of the matrix corresponds to a time window, and contains five core features of the window: the number of outbound packets, the number of inbound packets, the total outbound size, the total inbound size, and the window interval.

[0135] The feature matrix thus obtained comprehensively captures the microscopic statistical characteristics and macroscopic time-dependent relationship of the traffic, and completely represents the statistical characteristics of the traffic.

[0136] Step S13: Logarithmic transformation of the feature matrix.

[0137] This step performs an element-wise logarithmic transformation on the constructed feature matrix , that is, calculates as the final feature representation. Either natural logarithm or common logarithm can be used for the transformation, and in this embodiment, the transformation is performed with base 10.

[0138] Its main functions include the following points:

[0139] ① Compress the dynamic range: compress the possible range of feature values to a smaller interval (for example, compress the value range from to );

[0140] ② Enhance numerical stability: alleviate the numerical problems that extreme values may cause in subsequent model calculations;

[0141] ③ Maintain the relative size relationship between features: after this change, the features are more convenient for subsequent machine learning models (such as support vector machines, random forests, or neural networks) to process.

[0142] For the special case where the valid record set V in step S4 is empty, the logarithmic transformation result of the zero matrix is directly returned, thereby ensuring the robustness and format consistency of the method output.

[0143] To further improve the engineering landing ability of the method of the present application, the following performance optimization measures are supplemented on the basis of the above S1-S13 based implementation steps, which are suitable for large-scale traffic processing scenarios:

[0144] (1) In terms of computational efficiency optimization, the scheme discards the traditional explicit loop for high-frequency statistical operations (such as histogram and weighted histogram statistics) in steps S8 and S9, and instead uses NumPy (version 1.24.0 or higher) driven vectorization operators. The operator calls multiple SIMD instruction sets at the bottom layer to realize element-level parallel counting (such as np.bincount) through the single instruction stream multi-data stream mechanism;

[0145] (2) In terms of memory management, the system performs memory pre-allocation strategy (Memory Pre-allocation) according to the preset feature dimension during the program initialization phase , which uses np.empty or np.zeros to allocate continuous physical memory space in advance, avoiding memory fragmentation and data migration overhead caused by dynamic data append (Append);

[0146] (3) In terms of numerical stability, strict boundary checking is added in step S6 (window index mapping) to ensure that the index falls within the effective range of [0, ] through the clip function; invalid timestamps such as negative values and abnormally large values are filtered before step S5 (timestamp normalization); numerical clipping (limiting the maximum value to 10 6 ) is performed on the feature values in step S13 (log transformation) to avoid calculation errors such as infinity or NaN, ensuring the stability of the output features;

[0147] (4) For large-scale traffic scenarios, GPU acceleration based on CUDA technology is supported, and core operations such as histogram statistics and matrix splicing are reconstructed through PyTorch or CuPy framework to accelerate hardware-intensive tasks, further improving traffic processing throughput and meeting real-time analysis requirements.

[0148] Embodiment 2: System embodiment

[0149] This embodiment provides a website fingerprinting system based on statistical window features and cross-window tracking, which is used to implement the method described in embodiment 1. The system adopts modular design, and each module corresponds closely to the processing steps described in embodiment 1, and cooperates to complete efficient conversion from raw traffic to identified features. The specific composition of the system is as follows:

[0150] (1) Data preprocessing module

[0151] This module is responsible for collecting, cleaning and structuring raw traffic data, corresponding to steps S1 to S4 in embodiment 1, and contains the following units inside:

[0152] ​​① Flow capture and reassembly unit: performs step S1, captures raw packets through underlying network drivers (e.g. libpcap) and reassembles into complete network flow traces based on five-tuple and TCP state machine ;

[0153] ② Trace truncation unit: performs step S2, truncates flow traces according to pre-defined maximum trace length (5000 for single-flow scenario, 10000 for multi-flow scenario) and keeps the first packets;

[0154] ③ Invalid record filtering unit: performs step S3, removes invalid packets with timestamp zero and generates valid index set ;

[0155] ④ Valid data extraction unit: performs step S4, extracts valid timestamp data and valid packet information data from valid index set if it is not empty .

[0156] (2) Window partition engine

[0157] This module is responsible for discretizing continuous time stream into standard time windows, corresponding to steps S5 and S6 in embodiment 1, and is composed of the following units:

[0158] ① Time normalization unit: performs step S5, calculates maximum loading time (80 seconds for single-flow, 120 seconds for multi-flow) and linearly maps each element in original timestamp sequence to get normalized timestamp sequence , the specific mapping formula is: ;

[0159] ② Index mapping and clipping unit: performs step S6, maps normalized timestamp to window index through linear transformation and floor function, and clips to interval.

[0160] (3) Dual-level feature extractor

[0161] This module is the business logic core of the system, used to extract statistical features within windows and time series dependent features between windows, corresponding to steps S7 to S9 in embodiment 1, mainly including:

[0162] ① Flow direction identification unit: performs step S7, identifies flow direction based on valid packet information data The symbols of each element are automatically distinguished from the outbound traffic and the inbound traffic, and the outbound record index set is defined The symbols of each element are automatically distinguished from the outbound traffic and the inbound traffic, and the outbound record index set is defined ;

[0163] The counting statistical unit executes step S8, calls a histogram statistical function, counts the number of outbound and inbound data packets in each time window, and generates an outbound data packet number feature and an inbound data packet number feature The counting statistical unit executes step S8, calls a histogram statistical function, counts the number of outbound and inbound data packets in each time window, and generates an outbound data packet number feature and an inbound data packet number feature ;

[0164] The size statistical unit executes step S9, calls a weighted histogram function, accumulatively calculates the total size of outbound and inbound data packets in each time window, and generates an outbound data packet total size feature and an inbound data packet total size feature The size statistical unit executes step S9, calls a weighted histogram function, accumulatively calculates the total size of outbound and inbound data packets in each time window, and generates an outbound data packet total size feature and an inbound data packet total size feature ;

[0165] The time-dependent modeling unit is responsible for defining the core business logic and calculation rules of cross-window tracking, and clearly describes how to describe the time dynamic characteristics of the traffic through the distribution mode of the non-empty window. It provides clear input specifications and logical definitions for the specific calculation of the subsequent step (S10), that is, it indicates “what needs to be calculated” (obtains the unique ordered set of non-empty windows );

[0166] The empty window processing unit is responsible for defining the complete logical rules for handling the case of continuous empty windows, to ensure the accuracy of the calculation of the window interval feature . It provides rigorous business rules (such as assigning values to the interval features of the first non-empty window, defining the interval calculation method of continuous empty windows, etc.) for the specific calculation of the subsequent step (S11), and clearly describes “how to calculate”.

[0167] (4) Vectorized computation engine

[0168] This module serves as the general computing support of the system, and is responsible for efficiently executing steps S10 and S11 in embodiment 1. It converts the business logic defined in steps S10 (identifying non-empty windows and obtaining the ordered set) and S11 (calculating window interval features) into high-concurrency matrix operations through four internally integrated special optimization units, achieving high-speed calculation of features. Its internal composition is as follows:

[0169] ① Parallel processing unit: using a multi-core processor architecture, the non-empty window identification (sorting, deduplication) and interval difference calculation operations are task-decomposed and parallel-scheduled, realizing the synchronous processing of multiple traffic traces or different window segments in the same trace;

[0170] ②Memory optimization unit: By matrix pre-allocation and memory reuse technology, pre-allocate continuous memory space for window index set, difference array and final interval feature vector data structure before calculation, significantly reduce the dynamic memory allocation overhead and fragmentation problem in the calculation process;

[0171] ③Computing acceleration unit: integrate underlying hardware acceleration library (such as SIMD instruction set for CPU or CUDA kernel function for GPU), accelerate the sorting, unique value extraction, difference calculation and other core operators involved in steps S10 and S11 at hardware level, greatly improve the computing throughput;

[0172] ④Numerical stability unit: In the process of calculating the interval feature, boundary check and numerical constraint are performed on the input data and intermediate results to prevent index out-of-bounds or invalid difference value from occurring, ensuring the numerical stability of subsequent feature matrix construction and logarithmic transformation.

[0173] (5) Feature post-processing module

[0174] This module is responsible for integrating and normalizing the extracted original features, corresponding to steps S12 and S13 in embodiment 1, specifically including:

[0175] ①Feature matrix construction unit: execute step S12, concatenate the five feature vectors by column to construct the final feature matrix ;

[0176] ②Logarithmic transformation and standardization unit: execute step S13, perform element-wise logarithmic transformation on the feature matrix , and optionally perform standardization processing, outputting the final feature representation that meets the input requirements of the machine learning model.

[0177] The workflow of the system is as follows: the original network traffic data flows through the above modules for processing. First, the data preprocessing module executes steps S1 to S4 to complete traffic capture, trajectory truncation, invalid record filtering and effective data extraction; then the window division engine executes steps S5 and S6 to normalize the timestamps and map them to discrete window indices; then the double-level feature extractor executes steps S7 to S9 to extract traffic direction, window packet count and packet size features, and define the calculation rules for subsequent time-dependent features; then the vectorization calculation engine executes steps S10 and S11 according to the aforementioned rules to efficiently complete non-empty window identification and interval feature calculation; finally, the feature post-processing module executes steps S12 and S13 to construct a complete feature matrix and perform logarithmic transformation and standardization, outputting the final feature representation that can be used by the machine learning model. Through modular architecture design and clear process collaboration, the system completely implements the website fingerprinting method described in embodiment 1.

[0178] Example 3: Experimental verification

[0179] To verify the recognition ability and performance of the method, system testing and comparative analysis were conducted on specific experimental platforms and different data sets.

[0180] 1. Experimental basic settings

[0181] (1) Hardware platform: AMD Ryzen 7 5800H CPU with 16GB of memory was used in the experiment;

[0182] (2) Software environment: The operating system is Windows 10, and the programming environment is Python3.7;

[0183] (3) Data set: To verify the recognition ability of the method in complex network environment and defense confrontation scene, a comprehensive test set containing benchmark traffic and defense traffic was constructed.

[0184] ① Benchmark traffic collection: For the controlled benchmark environment, the experiment selected the top 100 websites in Alexa global ranking, and used 10 low-configuration hosts deployed in the campus network environment as collection terminals. In order to capture the long-term and short-term deviations of physical network at different times and avoid access restrictions on the server side, the collection process strictly followed the batch polling mechanism, and 1250 accesses were made to each website.

[0185] ② Data cleaning: In the data cleaning stage, by excluding abnormal or empty trajectories containing less than 50 data packets, 95 types of websites were finally retained, each containing 1000 high-quality encrypted traffic trajectories.

[0186] ③ Defense traffic construction: In order to further simulate real-world security confrontation, the experiment introduced RB, BD, BWR, WTF-PAD, Front and RegulaTor, etc. mainstream defense mechanisms. Based on the representative public benchmark data set, the above defense strategies were loaded on the original traffic data by algorithm simulation. Specifically, by calling the standard algorithm implementation of each defense mechanism, the original traffic sequence in the benchmark data set was resampled and filled with confusion, generating confrontation samples in the simulated defense environment. This method of constructing confrontation scene based on standard data set not only avoids the uncontrollable noise interference caused by network environment fluctuation in real crawling, but also ensures the standardization of experimental data and the reproducibility of results, so as to rigorously test the effectiveness and robustness of the invention in the face of various traffic confusion defense technologies from multiple dimensions.

[0187] (4) Key parameters: In terms of experimental parameter configuration, according to the statistical analysis of traffic feature distribution in the preprocessing stage, different threshold settings were adopted for different application scenarios. Specifically:

[0188] For single-stream (single-tab) scenarios, the maximum duration is set to 80 seconds (corresponding to the maximum number of windows). The maximum duration is 1800 seconds. For multi-stream (multi-tab) scenarios, considering the increased data flow interaction and latency caused by concurrent loading of multiple web pages, the maximum duration is extended to 120 seconds.

[0189] The above settings are based on statistical analysis of collected campus network traffic. An 80-second threshold covers over 95% of the complete single-page loading cycles in the dataset, while a 120-second threshold effectively encompasses the vast majority of active windows in multi-tab mixed traffic. This differentiated configuration ensures that key identification features are preserved while effectively eliminating background noise from abnormally long connections, and avoids feature loss in multi-stream scenarios due to uniform truncation times. Furthermore, for temporal feature extraction of traffic, the sliding window step size is uniformly and precisely set to 44ms, aiming to capture the dynamic evolution patterns of encrypted traffic at a microscale with high temporal resolution.

[0190] (5) Specific execution process of the experiment: First, extract metadata such as message direction and timestamp from the original trajectory, and then... and The boundary is truncated and padded according to standardization of the traffic trajectory; then, a 44ms sliding window is used to perform feature vectorization mapping on the processed sequence to construct a multi-dimensional feature matrix; finally, the generated features are input into the classifier and cross-validated multiple times on a composite dataset containing real-machine deployed defenses (such as WTF-Pad) to comprehensively evaluate the recognition performance of the method in adversarial environment through metrics such as precision and recall.

[0191] 2. Experimental Design and Comparison Scheme

[0192] (1) Experimental objective: To verify the advantages of this invention in four aspects: recognition accuracy, computational efficiency, anti-defense capability, and scalability;

[0193] (2) Comparison methods: To comprehensively evaluate performance, the experiment selected several representative cutting-edge and classic methods for comparison, including:

[0194] ① Deep learning-based methods: such as VarCNN (based on convolutional neural networks), ARES (based on attention mechanisms), and TikTok (focusing on temporal pattern learning);

[0195] ② Methods based on statistical feature extraction: such as RF (aggregate matrix);

[0196] ③ New method: CountMamba (based on state space model), and the lightweight cross-window fingerprinting method proposed in this application (named "LitePrint" to reflect its high efficiency).

[0197] All comparative methods use their official default parameters for reproduction to ensure fairness of comparison, for example, the number of layers of ARES network is set to 5 layers, and the window size of CountMamba is set to 44 ms.

[0198] (3) Evaluation index: average precision mean (MAP), F1 value (harmonic mean of precision and recall), training time per round (Epoch time), and feature extraction speed.

[0199] (4) Experimental scenario:

[0200] ① Scalability analysis: test under different website tab numbers (2 / 3 / 4 / 5 tabs);

[0201] ② Robustness evaluation: verify under various attack and defense environments, including no defense scenario, and various active interference measures: traffic splitting (RB, BD, BWR), confusion padding (WTF-PAD, RegulaTor), and combined defense method mixed with splitting and confusion (Front);

[0202] ③ Ablation experiment: to analyze the contribution of each feature module, test the performance of using only window-in features, only window interval features, and using complete feature set.

[0203] 3. Performance test and result analysis

[0204] (1) Robustness verification

[0205] As shown in Figure 2 , under the random delay defense scenario, the sending order of the data packets may be rearranged (such as the order of D and E packets is exchanged). The traditional "Fine Grain" and "RF" feature extraction methods lack tolerance to timing disturbance, resulting in failure of feature matching; while the method of the present application (with LitePrint logic as the core) can still achieve effective feature matching in the case of packet order rearrangement by capturing timing gap features.

[0206] (2) Comparison of recognition accuracy

[0207] Figure 3 The comparison shows that as the number of website tabs to be identified increases from 2 to 5, the recognition performance of all methods shows a downward trend, but the method of the present application shows strong stability:

[0208] ①MAP@K indicator: the method (LitePrint) of the application only slightly decreases from 92.8% to 89.74%, and the overall decrease is only 3.06 percentage points; while the traditional mainstream method such as VarCNN, its MAP@K decreases from 78.1% to about 16.5%, and the decrease is more than 60 percentage points; the methods such as RF and DF also fall from about 70% to below 40%;

[0209] ②P@K indicator: as the scale expands, the P@K of the method of the application always remains above 85.12%; while the suboptimal methods such as CountMamba and ARES fall to about 60% and 70% respectively when the number of labels is 5, and the remaining methods even fall below 30%.

[0210] The experimental results quantitatively prove that the method of the application has high basic precision when processing large-scale website sets, and the precision decay amplitude is significantly smaller than that of traditional methods, and has stronger scalability.

[0211] Figure 5 Further analysis shows that the method of the application maintains a relatively high average precision under different label scales, and at the same time, as the number of labels increases, the training time of the traditional method increases exponentially, while the training time of the method of the application increases relatively gently.

[0212] (3) Training efficiency and comprehensive performance comparison

[0213] Figure 4 It is shown that under various defense measures, the method of the application has relatively shorter training time while maintaining a high F1 value.

[0214] As shown in Table 1, LitePrint shows excellent computing efficiency in various defense scenarios. When no defense measures are taken, the single-cycle time of LitePrint is only 69.61s, which is reduced by about 53.4% compared with TikTok (149.25s) which is the most efficient in the benchmark method, and is about 8.5 times faster than CountMamba (593.83s). When facing the disturbance flow defense (such as Regulator), LitePrint can still stabilize the time consumption at 60.67s, while the time consumption of ARES and RF methods is 301.01s and 253.94s respectively. Even in the split flow defense (such as BD) scene with dramatic increase in computing overhead, the training efficiency of LitePrint (161.73s) is still about 73.1% higher than that of the mainstream deep learning model VarCNN (602.03s), which fully proves that the method of the application has high computing efficiency and engineering landing potential in complex defense environment.

[0215] The data in Table 2 shows that when the number of labels increases from 2 to 5, the training time of the traditional method increases significantly, while the training time of the method of the present application decreases from 32.10 seconds to 27.24 seconds (about 5 seconds less), showing better scalability.

[0216] Table 1: Epoch time comparison of different methods under different defense measures (unit: seconds)

[0217]

[0218] Table 2: Epoch time comparison of different methods under different number of labels (unit: seconds)

[0219]

[0220] (4) Feature extraction efficiency and contribution of key components

[0221] As shown in Table 3, under the experimental setting of processing 5000 samples, the vectorized feature extraction method proposed by the present application achieves a speedup of 12 to 51 times compared to the traditional iterative benchmark method. This significant performance improvement fully verifies the superiority of the method in terms of feature extraction efficiency.

[0222] Table 3: Comparison of feature extraction speeds of different statistical feature extraction methods (unit: seconds)

[0223]

[0224] Note: The "x" in the last row of the table represents the speedup, LitePrint is the vectorized method used in the present application; the speedup is the improvement of LitePrint relative to traditional methods such as TAM.

[0225] To further verify the contribution of cross-window dependency modeling to system performance, an ablation experiment was conducted to compare "only intra-window statistical features", "only cross-window interval features", and "LitePrint complete features" integrating both. The experiment aims to decouple local traffic distribution and macro temporal logic to determine the independent contribution and synergistic effect of each feature module on recognition accuracy.

[0226] The experimental results show that the complete feature configuration is significantly better than the single feature variant in all performance indicators, which not only reveals the key role of cross-window dependency modeling in capturing long-range traffic patterns, but also effectively supports the core innovation of the present application, i.e. using the robustness of time series shift to offset the distortion of microscopic features caused by traffic defense (such as random delay), thereby maintaining high recognition accuracy in complex environments.

[0227] The ablation experiment of Table 4 compares the "only window features", "only interval features" and "complete features" three configurations, and intuitively reveals the key role of "cross-window dependency modeling" in improving system performance.

[0228] Table 4 Ablation experiment results (index is MAP@K)

[0229]

[0230] The above experimental results show that the method of the present application not only maintains a high recognition accuracy of about 90% in an anti-defense environment, but also has a performance decay (about 3.06%) that is much lower than that of traditional deep learning models under a large-scale label set, and the single-cycle training efficiency is improved by 6.87 to 25.51 times. This all-round performance leap is mainly due to two major innovations: first, the vectorization and parallelization optimization of the computing architecture, which completely eliminates the computing bottleneck of traditional loop traversal by converting intensive statistical operations into vectorized matrix operations and cooperating with multi-process parallel processing; second, the introduction of cross-window dependency modeling and time interval features, which can effectively capture long-range traffic patterns and tolerate microscopic packet sequence disorder disturbances, solving the problem of traditional methods being extremely sensitive to random delay defense from the feature representation level, thereby ensuring the high robustness of the system in complex dynamic environments. In summary, the method of the present application has significant advantages in recognition accuracy, robustness, processing efficiency and scalability.

[0231] Although the embodiments of the present application have been disclosed as above, they are not limited to the applications listed in the specification and embodiments, and can be fully applied to various fields suitable for the present application. For those skilled in the art, for those skilled in the art, various changes, modifications, replacements and modifications can be made to these embodiments without departing from the principles and spirits of the present application. Therefore, the present application is not limited to specific details under the general concept defined by the claims and the equivalent scope.

Claims

1. A website fingerprinting method based on cross-window feature extraction, characterized in that, The method comprises the following steps: Step S1, obtaining network traffic trajectory data wherein each data packet contains a timestamp and signed packet information , the sign identifying the direction of packet transmission, representing an outbound packet, representing an inbound packet, denoting the size of the packet; Step S2: Based on the network traffic trajectory , the maximum trajectory length Set as a hyperparameter, if the actual trajectory length If the time is right, then a truncation operation is performed on the trajectory data, retaining only the preceding data. One data packet; Step S3, invalid record filtering is performed on the track data processed in step S2, and the data packets with timestamps are removed to obtain a valid record index set ; Step S4, if the valid record index set obtained in step S3 is not empty, then based on the valid record index set, a valid record set is obtained is not empty, then based on extracting valid timestamp data from the original track and valid packet information data ; Step S5: Perform normalization calculation: based on the preset maximum loading time. The original timestamp sequence extracted in step S4 Each element in Perform a linear mapping to obtain a normalized timestamp sequence. The specific mapping formula is as follows: ,in, Represents a normalized timestamp sequence The k-th element in; Step S6, normalizing the time stamp sequence obtained in step S5 mapping to discrete window indices by a linear transformation and a floor operation: where is a preset maximum number of windows; then clipping so that all its elements have values in the interval . Step S7, extracting the valid packet information data according to step S4 The symbols of the elements distinguish the outbound records from the inbound records and correspondingly define the outbound record index set and the inbound record index set ; Step S8, based on the window index obtained in step S6 and the index set defined in step S7 and The number of outbound packets feature of each time window is calculated respectively by using vectorized histogram statistics operation and the number of inbound packets feature The specific calculation formula is as follows: ； ； wherein, is the corresponding window index array obtained from the outbound index set is the corresponding window index array obtained from the inbound index set is the corresponding window index array obtained from the outbound index set is the corresponding window index array obtained from the inbound index set () is a vectorized histogram statistics function invoked; Step S9, calculating the total size of outbound packets of each time window based on the window index obtained in step S6 , the valid packet information data extracted in step S4 , and the index set defined in step S7 and , the total size of inbound packets of each time window and the total size of outbound packets of each time window The specific calculation formula is as follows: ； ； wherein, is the corresponding array of packet sizes obtained from the outbound index set is the corresponding array of packet sizes obtained from the inbound index set is the corresponding array of packet sizes obtained from the inbound index set is the corresponding array of packet sizes obtained from the inbound index set () is the invoked weighted histogram function on taking the negative sign is intended to guarantee that the inbound data packet total size feature value is positive; Step S10, identify all non-empty windows containing at least one data packet, obtain a unique ordered set of their window indices, denoted as wherein () is an ascending order sorting function called; Step S11, when the number of non-empty windows is greater than 1, calculate the index difference between consecutive non-empty windows where Diff() is the method representation of calculating the difference array of consecutive non-empty window indexes, and assigning the difference to the interval feature of the corresponding window where, represents the interval feature vector corresponding to all windows, represents the subsequence after removing the first element in the non-empty window index sequence . Step S12, constructing a feature matrix where each row corresponds to a time window, containing five features of the number of outgoing packets, the number of incoming packets, the total size of outgoing packets, the total size of incoming packets, and the window interval, corresponding to the vector: ; Step S13, log transformation is performed on the feature matrix, and the transformed result As a feature representation, to improve numerical stability and facilitate subsequent machine learning model processing.

2. The method of claim 1, wherein, In step S2, the maximum trajectory length Dynamic adjustment according to application scenarios: in a single-stream application scenario, the value is 5000 to optimize memory consumption; in a multi-stream application scenario, the value is 10000 to capture more complex interaction modes; For an ultra-long flow trajectory whose actual trajectory length exceeds the maximum trajectory length, a sliding window technique is used to perform the truncation operation.

3. The method of claim 1, wherein, In step S5, the maximum loading time According to the business scenario, it is set to 80 seconds for single-stream service and 120 seconds for multi-stream service.

4. The method of claim 1, wherein, In step S6, the window indices are clipped, specifically by performing a boundary check to ensure that all window indices fall within the range [0, ] 5. The method of claim 1, wherein, The histogram operation and the weighted histogram operation in steps S8 and S9 are implemented by using a vectorized bincount operation and are efficiently counted by an optimized routine of NumPy; the weighted histogram operation takes the negative of the weight to ensure that the feature value is positive when calculating the total size feature of the inbound packet; and when a window has no packet, the corresponding histogram statistic value is zero.

6. The method of claim 1, wherein, In step S10, the non-empty window index set U is obtained by acquiring the unique and ascending indexes in the window index array W; and in step S11, the index difference between the continuous non-empty windows is calculated, specifically including: calculating the difference between adjacent non-empty window indexes and assigning the difference to the interval feature position corresponding to the subsequent non-empty window; and for the first non-empty window, the interval feature value is set to the index value of the window.

7. The method of claim 1, wherein, In step S13, the logarithmic transformation of the feature matrix includes: if the effective record index set is empty, directly returning the logarithmic transformation result of the zero matrix; and after step S13, the feature matrix after the logarithmic transformation is further normalized.

8. A website fingerprinting system based on statistical window features and cross- window tracking for performing the method of claim 1, characterized in that, The method comprises the following parts: A data preprocessing module is responsible for performing steps S1-S4, is used for receiving original network flow data, and generates structured flow data sets to be processed through flow cleaning, invalid record filtering and trajectory length standardization processing; A window division engine is responsible for performing steps S5-S6, is used for establishing a time index architecture, and discretizes continuous flow data into a plurality of time window units with a fixed time length through timestamp normalization and linear mapping; A double-level feature extractor, as a business logic core, is responsible for performing steps S7-S9, and is used for extracting micro statistical characteristics in a window and macro time dependence between windows; A vectorized computing engine, as a general computing support, is responsible for performing steps S10-S11, and is used for providing feature calculation capability based on matrix operation; by encapsulating the vectorized operator, the nonlinear iterative logic issued by the double-level feature extractor is converted into high-concurrency matrix operation, so that high-speed calculation of features is realized. The double-level feature extractor further comprises: A count statistic unit that counts the number of outbound and inbound packets in each time window; 9. The system of claim 8, wherein, A size statistic unit that accumulatively calculates the total size of outbound and inbound packets in each time window; A traffic direction recognition unit automatically distinguishes between outbound and inbound traffic based on packet information. ​ A time dependence modeling unit that tracks the distribution mode of non-empty windows to capture the time dynamic characteristics of the flow; An empty window processing unit that is specially used for processing continuous empty windows to ensure the accuracy of interval feature calculation. ​ ​ 10. The system of claim 8, wherein, The vectorized computing engine further comprises: a parallel processing unit for processing feature computation of multiple time windows simultaneously using a multi-core processor architecture; a memory optimization unit for reducing memory footprint by using matrix pre-allocation and memory reuse techniques; a computing acceleration unit for hardware acceleration of histogram operation by integrating GPU acceleration libraries; a numerical stability unit for handling extreme numerical cases to prevent numerical overflow issues in log transformation.

Images