APP traffic security reinforcement method and system based on interpretable AI

Abstract

The invention discloses an interpretable AI-based APP traffic security reinforcement method and system. The method comprises the steps of capturing original APP traffic data, performing data packet analysis and preprocessing on the traffic data, constructing a traffic fingerprint model based on deep learning, and converting the preprocessed APP traffic into a high-dimensional feature vector; an integral gradient is adopted as an interpretable AI method, the contribution degree of each time step of the APP flow to privacy leakage is quantified, and a key fragile time window is positioned; according to the method, an interpretable AI technology is introduced to carry out fine-grained analysis on APP traffic, a key time window which contributes to privacy leakage most can be accurately identified, and low-invasion disturbance is only carried out on the fragile fragments, so that the traffic fingerprint-based identification capability of an attacker is effectively destroyed, and the influence of global noise addition on APP performance is avoided; the method has good universality and mobility, is suitable for multiple types of APPs, significantly reduces the customization cost of security reinforcement, and improves the privacy protection efficiency and user experience.

Description

Technical Field

[0001] This invention belongs to the field of APP traffic analysis, and in particular relates to a method and system for APP traffic security reinforcement based on interpretable AI. Background Technology

[0002] With the development of the mobile internet, mobile applications (APPs) have become the core carrier for users to obtain services and transmit data. Their traffic data contains a large amount of user privacy information, such as login credentials, behavioral preferences, and sensitive data transmission content. Currently, attackers can use traffic fingerprinting technology to extract features from encrypted or unencrypted APP traffic, such as timing patterns, protocol fields, and payload statistics, to accurately identify APP types, user behavior, and even recover private data, posing a serious threat to user privacy and security.

[0003] However, existing methods for assessing app traffic privacy leaks have significant limitations. Current technologies often employ strategies such as global random noise addition, fixed-format padding, or protocol field tampering, failing to distinguish between critical vulnerable segments and ordinary segments in the traffic, resulting in poor hardening effects or impacting app functionality. Different types of apps exhibit significantly different traffic characteristics, and existing hardening methods have weak portability, requiring customized solutions for each app, leading to high development and maintenance costs. Therefore, a targeted and portable app traffic security hardening method is urgently needed. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for strengthening the security of APP traffic based on interpretable AI, so as to overcome the problems of poor targeting, poor compatibility and lack of interpretability of existing security strengthening solutions.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for strengthening app traffic security based on explainable AI includes the following steps: S1: Deploy a lightweight traffic capture agent on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the traffic data; S2: Construct a traffic fingerprint model based on deep learning to convert preprocessed APP traffic into high-dimensional feature vectors, providing a feature basis for interpretable AI to locate key windows; S3: Using integral gradient as an interpretable AI method, we quantify the contribution of APP traffic at each time step to privacy leakage and locate key vulnerable time windows. S4 constructs a low-intrusion feature perturbation strategy targeting critical vulnerable windows, disrupting the attacker's traffic fingerprinting capabilities while avoiding impacting the normal functionality of the app.

[0006] Preferably, a lightweight traffic capture proxy is deployed on the mobile terminal to capture raw APP traffic data. The traffic data is then parsed and preprocessed, specifically including: Deploy a lightweight traffic capture agent on mobile terminals to meet the traffic collection needs of Android and iOS apps; perform deep protocol parsing on PCAP files based on the DPKT library to extract multi-level features of app traffic; and perform flow normalization and time-series processing on app traffic data.

[0007] Preferably, the integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient of each time step, i.e., the importance score. The importance of traffic data at each time step is visualized, and a heatmap of the importance of APP traffic at each time step is generated. The importance scores of each time step are summed using a sliding window to obtain the window-level importance score. The windows are sorted in descending order according to the window-level importance score, and the top k windows are selected as the critical and vulnerable time windows.

[0008] Preferably, the APP traffic data is subjected to flow normalization and timing processing, specifically including: in order to eliminate feature redundancy caused by bidirectional transmission in the same session, flow normalization processing based on IP address numerical comparison is adopted: the IP address is converted into a 32-bit integer form, and when the integer corresponding to the source IP address is greater than the integer corresponding to the destination IP address, the source / destination IP address and source / destination port information are automatically exchanged.

[0009] Preferably, a traffic fingerprint model based on deep learning is constructed to convert preprocessed APP traffic into a high-dimensional feature vector, providing a feature foundation for interpretable AI-based location of key windows. Specifically, the constructed traffic fingerprint model consists of an input layer, an LSTM temporal coding layer, a regularization layer, and a feature output layer. The input layer receives the standardized temporal feature vector output by S1, with a dimension of fixed time steps × number of features. The LSTM temporal coding layer uses a two-layer LSTM network, with the hidden layer dimension set to 128. The first LSTM layer captures short-term temporal dependencies through a gating mechanism, and the second LSTM layer extracts long-term... The associated features; the regularization layer includes Dropout with a zeroing probability of 0.3 and L2 regularization with a weight decay coefficient of 0.0001. Dropout disperses the feature representation ability by randomly masking the output of neurons, and L2 regularization applies Euclidean norm penalty to the weights of the fully connected layer; the feature output layer reduces the dimensionality of the 128-dimensional features to 64-dimensional features through the fully connected layer, where the weight matrix is ​​128×64. The Softmax classification layer is removed, and the 64-dimensional feature vector before the activation of the fully connected layer is retained to form a unified feature matrix of APP traffic, with each row corresponding to a sample and each column corresponding to an implicit feature.

[0010] Preferably, the step of using integral gradient as an interpretable AI method to quantify the contribution of APP traffic to privacy leakage at each time step and to locate key vulnerable time windows includes the following specific steps: S3.1: The integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient at each time step, visualize the importance of traffic data at each time step, and generate a heatmap of the importance of APP traffic at each time step. S3.2: Use a sliding window to sum the importance scores of each time step to obtain a window-level importance score. Sort the windows in descending order of their window-level importance scores and select the top k windows as critical and vulnerable time windows.

[0011] Preferably, this also includes verifying the reinforcement effect and optimizing the strategy for the reinforced traffic.

[0012] An app traffic security hardening system based on explainable AI includes a preprocessing module, a feature extraction module, a critical vulnerability time window location module, and a hardening module. The preprocessing module deploys a lightweight traffic capture agent on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the traffic data. The feature extraction module constructs a traffic fingerprint model based on deep learning, converting preprocessed APP traffic into high-dimensional feature vectors, providing a feature basis for interpretable AI to locate key windows; The critical vulnerability time window location module uses integral gradient as an interpretable AI method to quantify the contribution of APP traffic at each time step to privacy leakage and locate critical vulnerability time windows. The hardening module constructs a low-intrusion feature perturbation strategy for critical vulnerable windows, disrupting the attacker's traffic fingerprint analysis capabilities while avoiding affecting the normal function of the APP.

[0013] Preferably, a lightweight traffic capture proxy is deployed on the mobile terminal to capture raw APP traffic data. The traffic data is then parsed and preprocessed, specifically including: Deploy a lightweight traffic capture agent on mobile terminals to meet the traffic collection needs of Android and iOS apps; perform deep protocol parsing on PCAP files based on the DPKT library to extract multi-level features of app traffic; and perform flow normalization and time-series processing on app traffic data.

[0014] Preferably, the integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient of each time step, i.e., the importance score. The importance of traffic data at each time step is visualized, and a heatmap of the importance of APP traffic at each time step is generated. The importance scores of each time step are summed using a sliding window to obtain the window-level importance score. The windows are sorted in descending order according to the window-level importance score, and the top k windows are selected as the critical and vulnerable time windows.

[0015] Compared with the prior art, the present invention has the following beneficial technical effects: This invention provides a method for strengthening APP traffic security based on interpretable AI. It involves deploying a lightweight traffic capture agent on a mobile terminal to capture raw APP traffic data, parsing and preprocessing the data packets, constructing a deep learning-based traffic fingerprint model, and converting the preprocessed APP traffic into a high-dimensional feature vector, providing a feature foundation for interpretable AI to locate critical windows. Integral gradient is used as an interpretable AI method to quantify the contribution of APP traffic at each time step to privacy leakage, thus locating critical vulnerable time windows. A low-intrusive feature perturbation strategy targeting these critical vulnerable windows is constructed to disrupt attackers' traffic fingerprint analysis capabilities while avoiding impact on normal APP functionality. By introducing interpretable AI technology for fine-grained analysis of APP traffic, the method can accurately identify the critical time windows that contribute the most to privacy leakage. Low-intrusive perturbations are applied only to these vulnerable segments, effectively disrupting attackers' traffic fingerprint-based identification capabilities while avoiding the impact of global noise on APP performance. This method has good versatility and transferability, is applicable to various types of APPs, significantly reduces the customization cost of security strengthening, and improves privacy protection efficiency and user experience. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the APP traffic security hardening method based on interpretable AI in an embodiment of the present invention. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0018] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] like Figure 1As shown, this invention provides a method for strengthening APP traffic security based on explainable AI, specifically including the following steps: S1: Deploy a lightweight traffic capture agent on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the traffic data; S2: Construct a traffic fingerprint model based on deep learning to convert preprocessed APP traffic into high-dimensional feature vectors, providing a feature basis for interpretable AI to locate key windows; S3: Using integral gradient as an interpretable AI method, we quantify the contribution of APP traffic at each time step to privacy leakage and locate key vulnerable time windows. S4 constructs a low-intrusion feature perturbation strategy targeting critical vulnerable windows, disrupting the attacker's traffic fingerprinting capabilities while avoiding impacting the normal functionality of the app.

[0020] In a specific embodiment of the present invention, the reinforcement effect is verified and the strategy is optimized. An APP traffic security reinforcement monitoring system is constructed, and a dynamic monitoring module is deployed on the security management platform to achieve visualization and automation of the entire reinforcement process.

[0021] In a specific embodiment of the present invention, the deployment of a lightweight traffic capture agent on the mobile terminal to capture raw APP traffic data, and the packet parsing and preprocessing of the traffic data specifically include: Deploy a lightweight traffic capture agent on mobile terminals to meet the traffic collection needs of Android and iOS apps; perform deep protocol parsing on PCAP files based on the DPKT library to extract multi-level features of app traffic; and perform flow normalization and time-series processing on app traffic data.

[0022] Integrated gradients are used as an interpretable AI method to quantify the contribution of each time step of APP traffic to privacy leakage and to locate key vulnerable time windows. Specifically, this includes: calculating the integrated gradient using the Riemann approximation integral to obtain the integrated gradient of each time step, i.e., the importance score; visualizing the importance of traffic data time steps to generate a heatmap of the importance of APP traffic time steps; summing the importance scores of time steps using a sliding window to obtain the window-level importance score; sorting the windows in descending order of the window-level importance score; and selecting the top k windows as key vulnerable time windows.

[0023] A lightweight traffic capture proxy is deployed on mobile terminals. For Android systems, global traffic hijacking without root privileges is achieved through the VPNService framework. No modification to underlying system files is required; all traffic between the app and the server can be captured simply by requesting application-level permissions. For iOS systems, a traffic capture extension is created based on the NetworkExtension framework. After user authorization, device-level app network traffic is obtained, ensuring that the collection scope covers all third-party apps and system apps. The captured traffic is uniformly stored in PCAP format files, fully preserving the timestamps, protocol fields, payload content, and other information of the original data packets, providing a complete data foundation for subsequent analysis.

[0024] Based on the DPKT library, deep protocol parsing of PCAP files is performed to extract multi-level features of APP traffic. Specifically, this includes: Deep protocol parsing of PCAP format data packets using the DPKT library; beyond extracting the "five-tuple" consisting of transport layer protocol type (TCP / UDP / ICMP), source IP address, destination IP address, source port, and destination port, further extracting multi-level application layer features: For TLS 1.2 / 1.3 encrypted traffic, the Server Name Indicator (SNI) field, JA3 fingerprint, and ALPN protocol list are extracted; for HTTP / HTTPS traffic, the Host header field (to determine the target server domain name) and the X-Requested-With identifier (to distinguish between APP and browser traffic, such as "com.tenc") are parsed. The code snippet identifies the WeChat app ("ent.wechat"), API interface paths (e.g., " / api / login", " / api / pay"), and HTTP response codes (200 / 401 / 500, etc.). For WebSocket traffic, the Sec-WebSocket-Key field and frame type (text frame / binary frame) are extracted from the handshake request. Simultaneously, for each session block, key characteristic indicators are statistically analyzed, including API call sequence patterns (e.g., the login process " / api / getToken → / api / login → / api / getUserInfo"), HTTP response code distribution ratio, packet length statistics (maximum packet length, minimum packet length, average packet length), and payload entropy value. The formula for calculating the payload entropy value is... ,in Let be the probability of the i-th byte in the payload, to ensure accurate association of traffic to specific APP processes and extraction of multi-dimensional features.

[0025] The app's traffic data undergoes flow normalization and time-series processing. Specifically, to eliminate feature redundancy caused by bidirectional transmission within the same session, flow normalization based on IP address numerical comparison is employed: IP addresses are converted to 32-bit integers. When the integer corresponding to the source IP address is greater than the integer corresponding to the destination IP address, the source / destination IP addresses and source / destination port information are automatically exchanged, ensuring that forward and reverse traffic within the same session is uniformly merged into a unidirectional data stream. The normalized traffic is then subjected to time-series processing: First, traffic is segmented according to a dynamic transaction window. TCP traffic is segmented with the connection lifecycle (SYN packet to FIN / RST packet) as the window boundary, while UDP traffic is segmented at fixed 5-second intervals. Next, the packet timestamp sequence is differentially converted to calculate the time interval between adjacent packets. , For the timestamp of the i-th data packet, the absolute time encoding is converted into a relative time series; then, the variable-length time series is uniformly aligned to a fixed dimension (default 256 time steps) using a zero-padding operation; finally, a standard normalization formula is applied. Eliminating dimensional differences, among which The characteristic mean, The feature standard deviation provides standardized data for subsequent model input.

[0026] In a specific embodiment of the present invention, a traffic fingerprint model based on deep learning is constructed to convert preprocessed APP traffic into a high-dimensional feature vector, providing a feature foundation for interpretable AI-based location of key windows. Specifically, the constructed traffic fingerprint model consists of an input layer, an LSTM temporal coding layer, a regularization layer, and a feature output layer. The input layer receives the standardized temporal feature vector output by S1, with a dimension of "fixed time step × number of features," such as 256 × 8. The 8 features include relative time intervals, packet length, HTTP response codes, payload information entropy, etc. The LSTM temporal coding layer uses a two-layer LSTM network, with the hidden layer dimension set to 128. The first LSTM layer captures short-term temporal dependencies, such as data packet interval patterns, through a gating mechanism (input gate, forget gate, output gate). The second LSTM layer extracts long-term correlated features, such as session-level API call sequences. Gradient clipping is introduced between the two layers to prevent gradient explosion, with a threshold of 1.0. The regularization layer includes Dropout with a zeroing probability of 0.3 and L2 regularization with a weight decay coefficient of 0.0001. Dropout disperses the feature representation ability by randomly masking the output of neurons, and L2 regularization applies Euclidean norm penalty to the weights of the fully connected layer to jointly suppress overfitting. The feature output layer reduces the 128-dimensional features to 64-dimensional features through the fully connected layer, with a weight matrix of 128×64. The Softmax classification layer is removed, and the 64-dimensional feature vector before the activation of the fully connected layer is retained to form a unified feature matrix of APP traffic, with each row corresponding to a sample and each column corresponding to an implicit feature. The model training uses traffic datasets of at least 20 types of apps, with ≥500 samples for each type of app. The Adam optimizer minimizes the cross-entropy loss. The optimizer's initial learning rate is 0.001, which decays by 50% every 10 rounds. An early stopping mechanism, which terminates the model if the loss does not decrease after 5 consecutive rounds of validation, ensures generalization ability. The final output feature matrix satisfies translation invariance and scale stability, laying the foundation for interpretable analysis.

[0027] The method employs integrated gradients as an interpretable AI approach to quantify the contribution of app traffic at each time step to privacy breaches and pinpoint critical vulnerable time windows. The specific steps include: S3.1: The integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient (i.e., importance score) for each time step, visualizes the importance of traffic data at each time step, and generates a heatmap of the importance of APP traffic at each time step. We select a zero vector as the baseline input x', with dimensions 256×8, representing the "empty flow". We consider the straight-line path from the baseline x' to the actual sample x. The integral gradient is calculated using the Riemann approximation integral, and the formula is as follows: Where IG_i^{approx}(x) is the importance score at the i-th time step, F(·) is the traffic fingerprint model constructed by S2, and m=50 is the number of integration steps. Let be the partial derivative of the model with respect to the feature at the i-th time step. After calculation, a heatmap of the time step importance of APP traffic is generated, with the heatmap color depth corresponding to... Positive correlation visually displays the distribution of high-risk time steps; the darker the color, the greater the contribution of that time step to privacy breaches.

[0028] S3.2: Use a sliding window to sum the importance scores of each time step to obtain a window-level importance score. Sort the windows in descending order of their window-level importance scores and select the top k windows as critical and vulnerable time windows.

[0029] A sliding window approach is used to aggregate the importance scores of each time step, with the window size set to three time steps to suit the concentrated short-term features of the app. The formula for calculating the window-level importance score is as follows: , where j is the window start time step. The data is sorted in descending order, and the top k windows are selected as critical vulnerable time windows. The default value for k is 5, but for financial apps due to their frequent sensitive operations, it can be set to 8. The location results are then validated: the original traffic content corresponding to the critical windows is analyzed, windows without sensitive information are removed, and windows containing high privacy risk behaviors (such as login, payment, and personal information upload) are retained to ensure the accuracy of critical vulnerable window location.

[0030] In a specific embodiment of the present invention, a low-intrusive feature perturbation strategy is constructed targeting critical vulnerable windows to disrupt the attacker's traffic fingerprint analysis capabilities while avoiding impacting the normal functions of the APP. Specifically, the perturbation strategy follows the principles of targeting, compatibility, and adaptability, and includes three types of perturbation methods: first, temporal feature perturbation, targeting the critical window... Gaussian noise is injected at relative time intervals, as shown in the formula. , The system adjusts the latency sensitivity of apps based on their app characteristics: 0.1 for instant messaging apps and 0.3 for utility apps, disrupting the timing fingerprint pattern. Secondly, it perturbs payload characteristics by injecting legitimate dumb packets into the tail of critical window data packets, injecting custom extended fields (e.g., "X-Dummy-Field:random_value") into HTTP traffic, and private extended fields into TLS traffic. Dumb packets are 8-16 bytes long, increasing payload randomness. Thirdly, it fine-tunes protocol characteristics by adjusting non-core protocol fields, such as modifying the minor version number of the HTTP User-Agent ("1.0.0" → "1.0.1") and adjusting the order of the TLS ALPN protocol list, without affecting communication logic but disrupting fixed field fingerprints. Simultaneously, a "perturbation monitoring module" is added to the traffic capture agent to monitor the app's functional anomaly rate and response latency in real time. The anomaly rate is calculated as the number of function failures divided by the total number of operations. If the anomaly rate exceeds 1%, the perturbation intensity is reduced (e.g., ...). (Reduce the latency from 0.3 to 0.1). If the latency increases by more than 100ms, shorten the dumb packet length to ensure normal APP functionality and user experience.

[0031] In a specific embodiment of the present invention, the method further includes verifying the reinforcement effect and optimizing the strategy: The reinforcement effect was verified using multi-dimensional quantitative indicators: one was the privacy protection effect, which involved calculating the exposure index before and after reinforcement. , , , , The strategy requires two aspects: First, a ≥50% reduction in exposure index, and a ≥80% reduction in attacker traffic fingerprint analysis accuracy. Second, functional compatibility testing: The core functions of the app (login, data transmission, payment) must be tested at least 100 times each, with a functional anomaly rate ≤1%. The average response latency after hardening must be measured, with an increase in latency ≤100ms. Strategy optimization includes two aspects: When the app version is updated (new features added, API modified) or traffic characteristics change (protocol upgrade), the S1-S5 update of key vulnerability windows is re-executed; a "App type - perturbation strategy" mapping library is built, with social apps focusing on timing perturbations, financial apps on payload perturbations, and utility apps on protocol perturbations, enabling rapid strategy migration and adaptation to new apps.

[0032] In a specific embodiment of the present invention, an APP traffic security hardening and monitoring system is constructed, and a dynamic monitoring module is deployed on the security management platform to realize the visualization and automation of the entire hardening process, specifically including: The monitoring system deploys an app-level risk heatmap based on the network topology map. Each node corresponds to an app, and the node color is mapped according to the exposure index after hardening: green ( ≤0.3) indicates low risk, yellow indicates (0.3<) ≤0.6) is considered medium risk, orange (0.6<) is considered medium risk. ≤0.75) indicates high risk, red ( A value >0.75 indicates a critical state; node size reflects risk trends, with expansion indicating a week-on-week increase exceeding 10%, and shrinkage indicating a decrease exceeding 15%. A three-dimensional feature radar map is generated simultaneously, with the three vertices representing the internal density. Dissimilarity between point sets Confidence level The filling area is positively correlated with the exposure index. The system has an automatic alarm function. When the exposure index rises above 0.7 or the functional failure rate exceeds 1%, an alarm message containing the APP name, risk indicators, and optimization suggestions will be pushed to the administrator. At the same time, the administrator can manually adjust the perturbation parameters such as window size and noise variance to realize real-time optimization of the hardening strategy and ensure long-term stable security.

[0033] In a specific embodiment of the present invention, an APP traffic security hardening system based on interpretable AI is provided, including a preprocessing module, a feature extraction module, a critical vulnerability time window location module, and a hardening module: The preprocessing module deploys a lightweight traffic capture agent on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the traffic data. The feature extraction module constructs a traffic fingerprint model based on deep learning, converting preprocessed APP traffic into high-dimensional feature vectors, providing a feature basis for interpretable AI to locate key windows; The critical vulnerability time window location module uses integral gradient as an interpretable AI method to quantify the contribution of APP traffic at each time step to privacy leakage and locate critical vulnerability time windows. The hardening module constructs a low-intrusion feature perturbation strategy for critical vulnerable windows, disrupting the attacker's traffic fingerprint analysis capabilities while avoiding affecting the normal function of the APP.

[0034] Preferably, a lightweight traffic capture proxy is deployed on the mobile terminal to capture raw APP traffic data. The traffic data is then parsed and preprocessed, specifically including: Deploy a lightweight traffic capture agent on mobile terminals to meet the traffic collection needs of Android and iOS apps; perform deep protocol parsing on PCAP files based on the DPKT library to extract multi-level features of app traffic; and perform flow normalization and time-series processing on app traffic data.

[0035] Preferably, the integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient of each time step, i.e., the importance score. The importance of traffic data at each time step is visualized, and a heatmap of the importance of APP traffic at each time step is generated. The importance scores of each time step are summed using a sliding window to obtain the window-level importance score. The windows are sorted in descending order according to the window-level importance score, and the top k windows are selected as the critical and vulnerable time windows.

[0036] In another embodiment of the present invention, a terminal device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve corresponding method flows or corresponding functions. The processor described in this embodiment of the present invention can be used for the operation of an APP traffic security hardening method based on interpretable AI.

[0037] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and extended storage media supported by the terminal device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the APP traffic security hardening method based on interpretable AI in the above embodiments.

[0038] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0039] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0040] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0041] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0042] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for strengthening the security of APP traffic based on explainable AI, characterized in that, Includes the following steps: S1: Deploy a lightweight traffic capture agent on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the traffic data; S2: Construct a traffic fingerprint model based on deep learning to convert preprocessed APP traffic into high-dimensional feature vectors, providing a feature basis for interpretable AI to locate key windows; S3: Using integral gradient as an interpretable AI method, we quantify the contribution of APP traffic at each time step to privacy leakage and locate key vulnerable time windows. S4: Develop a low-intrusive feature perturbation strategy for critical vulnerable windows to disrupt the attacker's traffic fingerprinting capabilities while avoiding impacting the normal functionality of the app.

2. The method for strengthening APP traffic security based on interpretable AI according to claim 1, characterized in that, Deploying a lightweight traffic capture proxy on mobile terminals to capture raw app traffic data, and performing packet parsing and preprocessing on the traffic data specifically includes: Deploy a lightweight traffic capture agent on mobile terminals to meet the traffic collection needs of Android and iOS apps; perform deep protocol parsing on PCAP files based on the DPKT library to extract multi-level features of app traffic; and perform flow normalization and time-series processing on app traffic data.

3. The method for strengthening APP traffic security based on interpretable AI according to claim 2, characterized in that, The integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient of each time step, i.e., the importance score. The importance of traffic data at each time step is visualized, and a heatmap of the importance of APP traffic at each time step is generated. The importance scores of each time step are summed using a sliding window to obtain the window-level importance score. The windows are sorted in descending order according to the window-level importance score, and the top k windows are selected as the critical and vulnerable time windows.

4. The method for strengthening APP traffic security based on interpretable AI according to claim 2, characterized in that, The APP traffic data is normalized and processed in terms of flow direction and timing. Specifically, in order to eliminate feature redundancy caused by bidirectional transmission in the same session, flow normalization processing based on IP address numerical comparison is adopted: the IP address is converted into a 32-bit integer form, and when the integer corresponding to the source IP address is greater than the integer corresponding to the destination IP address, the source / destination IP address and source / destination port information are automatically exchanged.

5. The method for strengthening APP traffic security based on interpretable AI according to claim 1, characterized in that, A deep learning-based traffic fingerprint model is constructed to convert preprocessed APP traffic into a high-dimensional feature vector, providing a feature foundation for interpretable AI-based key window localization. Specifically, the traffic fingerprint model consists of an input layer, an LSTM temporal coding layer, a regularization layer, and a feature output layer. The input layer receives the standardized temporal feature vector output by S1, with a dimension of fixed time steps × number of features. The LSTM temporal coding layer uses a two-layer LSTM network with a hidden layer dimension of 128. The first LSTM layer captures short-term temporal dependencies through a gating mechanism, while the second LSTM layer extracts long-term associations. Features; The regularization layer includes Dropout with a zeroing probability of 0.3 and L2 regularization with a weight decay coefficient of 0.0001. Dropout disperses the feature representation ability by randomly masking the output of neurons, and L2 regularization applies Euclidean norm penalty to the weights of the fully connected layer; The feature output layer reduces the dimensionality of the 128-dimensional features to 64-dimensional features through the fully connected layer, where the weight matrix is ​​128×64. The Softmax classification layer is removed, and the 64-dimensional feature vector before the activation of the fully connected layer is retained to form a unified feature matrix of APP traffic, with each row corresponding to a sample and each column corresponding to an implicit feature.

6. The method for strengthening APP traffic security based on interpretable AI according to claim 1, characterized in that, The method employs integral gradient as an interpretable AI approach to quantify the contribution of app traffic to privacy leaks at each time step and to pinpoint critical vulnerable time windows. The specific steps include: S3.1: The integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient at each time step, visualize the importance of traffic data at each time step, and generate a heatmap of the importance of APP traffic at each time step. S3.2: Use a sliding window to sum the importance scores of each time step to obtain a window-level importance score. Sort the windows in descending order of their window-level importance scores and select the top k windows as critical and vulnerable time windows.

7. The method for strengthening APP traffic security based on interpretable AI according to claim 1, characterized in that, It also includes verifying the reinforcement effect and optimizing the strategy for the reinforced traffic.

8. An APP traffic security hardening system based on explainable AI, characterized in that, It includes a preprocessing module, a feature extraction module, a critical vulnerability time window localization module, and a hardening module: The preprocessing module deploys a lightweight traffic capture agent on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the traffic data. The feature extraction module constructs a traffic fingerprint model based on deep learning, converting preprocessed APP traffic into high-dimensional feature vectors, providing a feature basis for interpretable AI to locate key windows; The critical vulnerability time window location module uses integral gradient as an interpretable AI method to quantify the contribution of APP traffic at each time step to privacy leakage and locate critical vulnerability time windows. The hardening module constructs a low-intrusion feature perturbation strategy for critical vulnerable windows, disrupting the attacker's traffic fingerprint analysis capabilities while avoiding affecting the normal function of the APP.

9. The APP traffic security reinforcement system based on interpretable AI according to claim 8, characterized in that, Deploying a lightweight traffic capture proxy on mobile terminals to capture raw app traffic data, and performing packet parsing and preprocessing on the traffic data specifically includes: Deploy a lightweight traffic capture agent on mobile terminals to meet the traffic collection needs of Android and iOS apps; perform deep protocol parsing on PCAP files based on the DPKT library to extract multi-level features of app traffic; and perform flow normalization and time-series processing on app traffic data.

10. A method for strengthening APP traffic security based on interpretable AI according to claim 9, characterized in that, The integral gradient is calculated using the Riemann approximation integral to obtain the integral gradient of each time step, i.e., the importance score. The importance of traffic data at each time step is visualized, and a heatmap of the importance of APP traffic at each time step is generated. The importance scores of each time step are summed using a sliding window to obtain the window-level importance score. The windows are sorted in descending order according to the window-level importance score, and the top k windows are selected as the critical and vulnerable time windows.

Images