APP traffic privacy leakage assessment method and system based on traffic fingerprint representation

Abstract

The invention discloses a privacy leakage assessment method and system based on a traffic fingerprint representation vector space. The method comprises the following steps: acquiring APP traffic data, and performing data packet analysis and preprocessing on the acquired APP traffic data to obtain traffic sequence data; obtaining a dependency relationship in the traffic sequence data based on the double-layer long-short-term memory network, and applying Euclidean norm penalty to a full-connection layer weight matrix in the obtained dependency relationship; according to the method, the time sequence dependency relationship of the traffic sequence is autonomously captured through the double-layer LSTM network, standardized vector space construction is combined, a model structure or a preset rule does not need to be adjusted for a single APP, traffic data of different types of APPs can be uniformly mapped to the same feature space, and cross-APP and cross-scene privacy leakage evaluation is realized. According to the method, the dependence on prior knowledge is broken through, the scene universality of the privacy disclosure evaluation method is remarkably improved, and the problem that the prior art depends on traffic mode prior knowledge of a specific APP or manual rule extraction features and is difficult to adapt to diversified APP scenes is solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of APP traffic analysis, and particularly relates to a privacy leakage evaluation method and system based on a traffic fingerprint representation vector space. BACKGROUND

[0002] With the development of information technology, mobile applications (APPs) have become an indispensable part of people's daily life and work. Various APPs provide convenient services while continuously and massively collecting and processing massive amounts of user data. APP traffic data is frequently exchanged between the client and the server through network transmission. However, attackers can obtain traffic data by listening and use traffic fingerprint analysis technology to infer user privacy information. APP traffic faces serious security challenges, and user privacy security has serious hidden dangers.

[0003] However, the existing APP traffic privacy leakage evaluation method has significant limitations. Existing technologies often rely on prior knowledge of specific types or traffic patterns, making it difficult to effectively migrate to diverse APP application scenarios. Specifically, existing evaluation methods mostly use feature extraction based on artificial rules or models trained for a single APP, making it difficult to universally capture and quantify the common privacy exposure risks inherent in different APP traffic. This limitation makes it difficult to comprehensively and objectively evaluate the overall privacy leakage risk of the mobile application ecosystem. Therefore, there is an urgent need for an evaluation method that can quantify the degree of privacy leakage in a unified feature space. SUMMARY

[0004] The application provides an APP traffic privacy leakage evaluation method based on a traffic fingerprint representation vector space, aiming to solve the problem of existing evaluation methods relying on prior knowledge and being unable to quantify and compare.

[0005] To achieve the above-mentioned purposes, the technical solutions adopted by the application are as follows: A privacy leakage evaluation method based on a traffic fingerprint representation vector space, comprising the following steps: S1, obtaining APP traffic data and performing packet analysis and preprocessing on the obtained APP traffic data to obtain traffic sequence data; S2, obtaining the dependency relationship in the traffic sequence data based on a double-layer long short-term memory network, and imposing a Euclidean norm penalty on the full connection layer weight matrix in the obtained dependency relationship; S3, performing linear transformation on the high-order features after imposing the Euclidean norm penalty to realize dimension reduction, removing the unified feature matrix representation of the traffic after removing the output classification layer, and constructing a standardized feature vector space; S4, dividing the sample point set by APP category in the standardized feature vector space, and calculating the internal density, point set difference, and confidence; S5, according to the preset weight coefficient, weighting and summing the internal density, point set difference, and confidence to generate the exposure index.

[0006] Preferably, a lightweight traffic capture agent is deployed on the mobile terminal to capture raw APP traffic data, and the obtained APP traffic data is packet parsed and preprocessed.

[0007] Preferably, the obtained APP traffic data is packet parsed, specifically including: In the transport layer, the transport layer protocol type, source / destination IP address, and port five-tuple are extracted; in the application layer, the server name indication and JA3 fingerprint are extracted for TLS traffic, and the Host header field and X-Requested-With identifier are parsed for HTTP traffic; based on the extracted features in the application layer, each traffic is accurately bound to a specific APP process to obtain the preprocessed normalized traffic.

[0008] Preferably, a double-layer long short-term memory network is trained to capture the dependency relationship of the preprocessed traffic sequence data, specifically including: inputting the preprocessed traffic sequence data into the double-layer long short-term memory network to capture the dependency relationship in the data through a neuron structure with a hidden layer dimension of 128.

[0009] Preferably, a gradient clipping technique is introduced between the two layers of LSTM in the double-layer long short-term memory network; at the same time, the weight matrix is initialized with He normal distribution; during training, the learning rate is dynamically adjusted with the Adam optimizer, and the cross-entropy loss function is minimized.

[0010] Preferably, the sample point set is divided by APP category in the standardized feature vector space, and the internal density, point set difference, and confidence are calculated, the internal density is calculated as: The cosine similarity between all sample feature vectors in the target APP point set is calculated The internal density index is obtained by arithmetic averaging aggregation, which reflects the clustering tightness of the same APP traffic pattern.

[0011] Preferably, the point set difference is calculated as: First, the probability density distribution function of each point set is generated by kernel density estimation; then the symmetric KL divergence and multi-dimensional Wasserstein distance between the current point set and each of the remaining point sets are calculated; finally, all mixed metric values Based on quantile normalization, the 25% quantile of the difference degree of all point sets is taken as the lower limit and the 75% quantile is taken as the upper limit for linear scaling , eliminate dimensional differences and take the arithmetic mean as the final difference .

[0012] Preferably, the confidence calculation: The prediction confidence score of each sample in the flow fingerprint analysis original classification model in the aggregation point set, that is, the maximum probability value of the Softmax layer output, takes the arithmetic mean as the overall confidence .

[0013] A privacy leakage evaluation system based on flow fingerprint representation vector space, comprising a preprocessing module, a weighting module, a feature vector module, an index calculation module and an evaluation module: The preprocessing module obtains APP flow data and performs packet analysis and preprocessing on the obtained APP flow data to obtain flow sequence data; The weighting module obtains the dependency relationship in the flow sequence data based on a double-layer long short-term memory network, and applies a Euclidean norm penalty to the full connection layer weight matrix in the obtained dependency relationship; The feature vector module performs linear transformation on the high-order features after the Euclidean norm penalty to realize dimension reduction, removes the unified feature matrix representation of the flow after removing the output classification layer, and constructs a standardized feature vector space; The index calculation module divides the sample point set according to the APP category in the standardized feature vector space, and calculates the internal density, the difference between the point sets and the confidence; The evaluation module weights and sums the internal density, the difference between the point sets and the confidence according to the preset weight coefficient to generate an exposure index.

[0014] Preferably, the obtained APP flow data is packet parsed, specifically including: Extracting the transport layer protocol type, source / destination IP address and port five-tuple in the transport layer; extracting the server name indication and JA3 fingerprint for TLS flow, and parsing the Host header field and X-Requested-With identifier for HTTP flow; based on the features extracted in the application layer, each flow is accurately bound to a specific APP process to obtain the normalized flow after preprocessing.

[0015] Compared with the prior art, the present application has the following beneficial technical effects: This invention provides a privacy leakage assessment method based on a traffic fingerprint representation vector space. It acquires APP traffic data and performs packet parsing and preprocessing to obtain traffic sequence data. Dependencies in the traffic sequence data are obtained using a two-layer Long Short-Term Memory (LSTM) network, and Euclidean norm penalties are applied to the weight matrices of the fully connected layers in the acquired dependencies. The method autonomously captures the temporal dependencies of the traffic sequence through a two-layer LSTM network, combined with the construction of a standardized vector space. This eliminates the need to adjust the model structure or pre-set rules for a single APP, and can uniformly map traffic data from different types of APPs to the same feature space, achieving cross-APP and cross-scenario privacy leakage assessment. This invention overcomes the reliance on prior knowledge, significantly improving the scenario versatility of the privacy leakage assessment method. It solves the problem that existing technologies often rely on prior knowledge of traffic patterns of specific APPs or manually extracted features, making it difficult to adapt to diverse APP scenarios. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of a method for assessing APP traffic privacy leakage based on traffic fingerprint representation vector space in an embodiment of the present invention. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0018] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] like Figure 1As shown, this invention provides a method for assessing app traffic privacy leakage based on a traffic fingerprint representation vector space. This method overcomes the problems of existing assessment methods relying on prior knowledge and lacking quantitative comparison capabilities. By mapping raw traffic data to a unified feature space through a traffic fingerprint representation model, and fusing mean cosine distance, Kullback-Leibler divergence, Wasserstein distance, and confidence level within this space, a unified exposure index is defined, enabling objective quantitative assessment and comparison of the degree of privacy information exposure in traffic data. Specifically, it includes the following steps: S1, acquire APP traffic data and perform packet parsing and preprocessing on the acquired APP traffic data to obtain traffic sequence data; S2, based on a two-layer long short-term memory (LSTM) network, obtains the dependencies in the traffic sequence data, and applies Euclidean norm penalty to the weight matrix of the fully connected layer in the obtained dependencies; S3 achieves dimensionality reduction by performing a linear transformation on the high-order features after applying Euclidean norm penalty through a fully connected layer, and retains the unified feature matrix representation of the flow after removing the output classification layer, thus constructing a standardized feature vector space. S4, divide the sample point sets into APP categories in the standardized feature vector space, and calculate the internal density, the difference between point sets, and the confidence level. S5 generates an exposure index by weighting and summing the internal density, inter-set difference, and confidence level according to preset weight coefficients.

[0020] In a specific embodiment of this application, a lightweight traffic capture agent is deployed on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the acquired APP traffic data.

[0021] In a specific embodiment of the present invention, a lightweight traffic capture agent is deployed on the mobile terminal. The Android system uses VPNService to achieve global traffic hijacking without root privileges, and the iOS system captures device network traffic based on the Network Extension framework and generates PCAP format data files.

[0022] The deep protocol parsing of the captured APP traffic data packets specifically includes: extracting the transport layer protocol type, source / destination IP address, and port 5-tuple at the transport layer; extracting the Server Name Indicator (SNI) and JA3 fingerprint for TLS traffic at the application layer, and parsing the Host header field and X-Requested-With identifier for HTTP traffic; and based on the features extracted at the application layer, accurately binding each traffic stream to a specific APP process to obtain preprocessed normalized traffic.

[0023] Deep protocol analysis is performed on data packets in captured APP traffic data. Beyond extracting the transport layer protocol type, source / destination IP address, and port tuple, the system enhances application layer protocol identification capabilities. For TLS traffic, Server Name Indicator (SNI) and JA3 fingerprints are extracted; for HTTP traffic, the Host header field and X-Requested-With identifier are parsed to accurately associate traffic with specific application processes. To eliminate bidirectional redundancy in sessions, flow normalization based on IP address value comparison is adopted: when the source IP address value is greater than the destination IP, source / destination address and port information are automatically exchanged, ensuring that forward and reverse traffic within the same session is uniformly merged into a unidirectional data stream.

[0024] The unidirectional data stream is segmented into dynamic transaction windows, with window boundaries defined as the TCP connection lifecycle (from SYN packet to FIN / RST packet). Within each window, session aggregation is performed based on a composite feature of the application process identifier and a five-tuple. For each session block, key statistical indicators include API call sequence patterns, HTTP response code distribution, and payload information entropy value.

[0025] Further differential transformation is performed on the timestamp sequence of data packets to calculate the time interval between adjacent packets. This method transforms absolute time encoding into relative time series to enhance the dynamic features of the time series. Zero-padding is used to align the variable-length sequence to a fixed dimension, and finally, standard normalization is applied to process the numerical features according to the formula. Eliminating dimensional differences (where μ is the feature mean and σ is the standard deviation) lays the data foundation for subsequent feature space mapping.

[0026] A two-layer Long Short-Term Memory (LSTM) network was trained to capture dependencies in preprocessed traffic sequence data. Specifically, the preprocessed traffic sequence data was input into the two-layer LSTM network, which uses a 128-dimensional hidden layer neuron structure to capture dependencies within the data. The first LSTM layer receives standardized temporal features (including packet intervals and packet length variations), calculates the hidden state at each time step, and passes it to the next time step. Its gating mechanism (input gate, forget gate, output gate) dynamically adjusts the information flow, effectively identifying periodic patterns and anomalous bursts in the traffic. The hidden state sequence output from the first layer serves as the input to the second LSTM layer, extracting cross-time step correlation features at a higher level of abstraction, thus enhancing the representation of app behavior patterns.

[0027] To improve the model's generalization performance, a gradient pruning technique (with a threshold of 1.0) is introduced between the two LSTM layers to prevent gradient explosion during backpropagation. Simultaneously, the weight matrix is ​​initialized using a He normal distribution to accelerate model convergence. During network training, the learning rate is dynamically adjusted using the Adam optimizer (initial value 0.001, decaying by 50% every 10 epochs) to minimize the cross-entropy loss function.

[0028] A random deactivation (Dropout) layer is connected to the output of the LSTM layer to dynamically block the neuron output with a preset probability; at the same time, an L2 regularization term is introduced during the model optimization process to apply Euclidean norm penalty to the weight matrix of the fully connected layer to suppress overfitting.

[0029] A random dropout layer is connected to the output of the LSTM layer to dynamically mask neuron outputs with a preset probability. The 128-dimensional hidden state vector output at the last time step of the second LSTM layer is randomly masked, mathematically represented by performing binary mask multiplication on the elements of the original vector according to a probability distribution. This operation forces the network to disperse its feature representation capabilities by randomly setting the output values ​​of hidden layer neurons to zero during forward propagation (with a zeroing probability of 0.3), avoiding excessive dependence on specific neural paths. This mechanism effectively simulates the effect of multi-model ensembles and significantly improves the model's robustness to noise interference.

[0030] Simultaneously, L2 regularization constraints are introduced during model optimization, imposing Euclidean norm penalties on the weight matrix of the fully connected layers to suppress overfitting. A regularization term is added to the loss function of the Adam optimizer, expanding the optimization objective to a weighted sum of the cross-entropy loss function and the L2 norm of the weight matrix. The weight decay coefficient is set to 0.0001, compressing the absolute value of the weight parameters through gradient descent to suppress the tendency of complex models to overfit the training data. This structured risk minimization strategy allows the model to retain its ability to recognize key traffic patterns while reducing its sensitivity to random noise features, providing a more generalizable feature representation basis for subsequent privacy exposure index calculations. An early stopping mechanism is incorporated during training (termination occurs if the loss does not improve after 5 consecutive validation rounds) to minimize overtraining while ensuring convergence.

[0031] Dimensionality reduction is achieved by linearly transforming high-order features through a fully connected layer. After removing the output classification layer, a unified feature matrix representation of the flow is retained, and a standardized vector space is constructed. Specifically, a fully connected layer with the classification layer removed is added after the high-order features obtained in the previous step to obtain the standardized vector space. The obtained standardized vector space is the basis for subsequent exposure index calculation.

[0032] Following the high-order features processed by S3's double regularization, feature space compression is achieved through a linear transformation performed by a fully connected layer. This transformation process can be described as a linear combination of the weight matrix and the bias vector: a projection operation of a learnable weight matrix (dimension 128×64) is applied to the input 128-dimensional feature vector, and the bias vector is then superimposed to output a 64-dimensional feature representation after dimensionality reduction. This operation significantly reduces the feature dimensionality while preserving key discriminative information, thereby improving the spatiotemporal efficiency of subsequent computations.

[0033] To adapt to the generalization requirements of privacy exposure assessment, the classification output layer (i.e., the Softmax layer) at the end of the original model was proactively removed. Instead, the feature representation before the activation of the fully connected layer was extracted as a unified encoding of APP traffic. The final output feature matrix condenses the spatiotemporal essential characteristics of the traffic sequence. Each row corresponds to a 64-dimensional feature vector of a traffic sample, and the column vectors represent the implicit correlation patterns across samples, forming the discriminant primitives for subsequent exposure index calculation. This feature space satisfies translation invariance and scale stability, ensuring the objective comparability of privacy risks of different APP traffic.

[0034] In a specific embodiment of the present invention, the sample point set is divided according to the APP category in the feature space, and the following three-level calculations are performed: Internal density calculation: The cosine similarity between each pair of feature vectors of all samples within the target APP point set. The internal density index is obtained by arithmetic average aggregation, which reflects the clustering tightness of traffic patterns among similar apps. When the density is high, it indicates that the app's behavior patterns are highly regular, making it easier for attackers to infer user behavior through traffic fingerprints, and significantly increasing the risk of privacy leaks.

[0035] Calculation of dissimilarity between point sets: First, the probability density distribution function of each point set is generated through kernel density estimation. Then, the symmetric KL divergence and multidimensional Wasserstein distance between the current point set and each of the remaining point sets are calculated; these two measures the similarity of the probability distributions and the transmission distance in the feature space, respectively. Finally, all mixture metrics are... A quantile-based normalization process is implemented, using the 25th quantile of the dissimilarity of the entire point set as the lower bound and the 75th quantile as the upper bound for linear scaling. After eliminating dimensional differences, the arithmetic mean is taken as the final degree of difference. The greater the difference, the higher the distinguishability of features between apps, and the easier it is for attackers to accurately identify a specific app.

[0036] Confidence calculation: The prediction confidence score of each sample within the aggregation point set in the original classification model of traffic fingerprint analysis, i.e., the maximum probability value output by the Softmax layer, is taken as the arithmetic mean of these scores as the overall confidence score. This metric directly reflects the certainty of the classification model in identifying the app. A high confidence level indicates that the attack model can more reliably associate traffic patterns with user privacy information.

[0037] Based on preset weighting coefficients, the internal density, the difference between point sets, and the confidence level are weighted and summed to generate an exposure index; the sum of the weighting coefficients is 1, and the index value is positively correlated with the risk of privacy leakage.

[0038] Based on the calculated three-dimensional index—density within the point set Dissimilarity between point sets and confidence level A unified privacy exposure index is generated by performing a weighted linear combination based on preset weighting coefficients. The weight configuration satisfies the constraints. The default value is set to α (internal density weight) (Differentiation weight) (Confidence weight).

[0039] The index ranges from [0,1], and its value is positively correlated with the risk of privacy breaches—when High-risk leakage status is indicated by time. The current state is considered low-risk. The final output index serves as a quantitative benchmark for privacy threats, supporting the dynamic triggering of security hardening strategies.

[0040] Based on the generated exposure index and tertiary indicator data, a dynamic risk visualization system is built on the safety management platform.

[0041] This system deploys an app-level risk heatmap using a network topology map as the base map, where each node corresponds to an actual app, and the node color is dynamically mapped according to the exposure index value range: green ( ≤0.3) indicates a low-risk status, yellow (0.3<) indicates a low-risk status. ≤0.6) indicates medium risk, orange indicates (0.6<) ≤0.75) indicates high risk, red ( >0.5) indicates a critical state; the node size reflects the risk change trend, with expansion indicating a week-on-week increase of more than 10% and shrinkage indicating a decrease of more than 15%. A three-dimensional feature index radar chart is generated simultaneously, with its three vertices representing the internal density, the difference between point sets, and the confidence index value, respectively. The filling area is positively correlated with the exposure index.

[0042] In another embodiment of the present invention, a privacy leakage assessment system based on traffic fingerprint representation vector space is provided, including a preprocessing module, a weighting module, a feature vector module, an index calculation module, and an evaluation module: The preprocessing module acquires APP traffic data and performs packet parsing and preprocessing on the acquired APP traffic data to obtain traffic sequence data; The weighting module obtains the dependencies in the traffic sequence data based on a two-layer long short-term memory network, and applies Euclidean norm penalty to the weight matrix of the fully connected layer in the obtained dependencies. The feature vector module achieves dimensionality reduction by performing a linear transformation on the high-order features after applying Euclidean norm penalty through a fully connected layer. After removing the output classification layer, it retains the unified feature matrix representation of the flow and constructs a standardized feature vector space. The indicator calculation module divides the sample point sets according to APP category in the standardized feature vector space, and calculates them according to internal density, inter-set difference and confidence. The evaluation module generates an exposure index by weighting and summing the internal density, inter-set difference, and confidence level according to preset weight coefficients.

[0043] This invention presents a privacy leakage assessment method based on a traffic fingerprint representation vector space. It acquires app traffic data and performs packet parsing and preprocessing to obtain traffic sequence data. A two-layer Long Short-Term Memory (LSTM) network is used to extract dependencies within the traffic sequence data, and Euclidean norm penalties are applied to the weight matrices of the fully connected layers in the acquired dependencies. A two-layer LSTM network autonomously captures the temporal dependencies of the traffic sequence, and a standardized vector space is constructed. This eliminates the need to adjust the model structure or pre-defined rules for a single app, allowing traffic data from different types of apps to be uniformly mapped to the same feature space, achieving cross-app and cross-scenario privacy leakage assessment. This invention overcomes the reliance on prior knowledge, significantly improving the scenario versatility of the privacy leakage assessment method. It solves the problem that existing technologies often rely on prior knowledge of traffic patterns for specific apps or manually extracted features, making it difficult to adapt to diverse app scenarios.

Claims

1. A privacy leakage assessment method based on traffic fingerprint representation vector space, characterized in that, Includes the following steps: S1, acquire APP traffic data and perform packet parsing and preprocessing on the acquired APP traffic data to obtain traffic sequence data; S2, based on a two-layer long short-term memory network, obtains the dependencies in the traffic sequence data, and applies Euclidean norm penalty to the weight matrix of the fully connected layer in the obtained dependencies; S3 achieves dimensionality reduction by performing a linear transformation on the high-order features after applying Euclidean norm penalty through a fully connected layer, and retains the unified feature matrix representation of the flow after removing the output classification layer, thus constructing a standardized feature vector space. S4, divide the sample point sets into APP categories in the standardized feature vector space, and calculate the internal density, the difference between point sets, and the confidence level. S5 generates an exposure index by weighting and summing the internal density, inter-set difference, and confidence level according to preset weight coefficients.

2. The privacy leakage assessment method based on traffic fingerprint representation vector space according to claim 1, characterized in that, A lightweight traffic capture agent is deployed on the mobile terminal to capture raw APP traffic data and perform packet parsing and preprocessing on the acquired APP traffic data.

3. The privacy leakage assessment method based on traffic fingerprint representation vector space according to claim 1, characterized in that, The acquired APP traffic data is parsed, specifically including: At the transport layer, the transport protocol type, source / destination IP address, and port 5-tuple are extracted; at the application layer, the server name indicator and JA3 fingerprint are extracted for TLS traffic, and the Host header field and X-Requested-With identifier are parsed for HTTP traffic; based on the features extracted at the application layer, each traffic stream is accurately bound to a specific APP process to obtain preprocessed normalized traffic.

4. The privacy leakage assessment method based on traffic fingerprint representation vector space according to claim 1, characterized in that, Training a two-layer long short-term memory network to capture dependencies in preprocessed traffic sequence data involves: inputting the preprocessed traffic sequence data into the two-layer long short-term memory network and capturing dependencies in the data through a neuron structure with a hidden layer dimension of 128.

5. The privacy leakage assessment method based on traffic fingerprint representation vector space according to claim 4, characterized in that, Gradient pruning is introduced between the two LSTM layers in a two-layer long short-term memory network; the weight matrix is ​​initialized using a He normal distribution; the learning rate is dynamically adjusted using the Adam optimizer during training, and the cross-entropy loss function is minimized.

6. The privacy leakage assessment method based on traffic fingerprint representation vector space according to claim 1, characterized in that, In the standardized feature vector space, sample point sets are divided according to APP category, and the internal density, inter-set difference, and confidence score are calculated. Internal density calculation: The cosine similarity between each pair of feature vectors of all samples within the target APP point set. The internal density index is obtained by arithmetic mean aggregation, which reflects the clustering density of traffic patterns of similar apps.

7. The privacy leakage assessment method based on traffic fingerprint representation vector space according to claim 6, characterized in that, The calculation of the difference between point sets: First, the probability density distribution function of each point set is generated through kernel density estimation; then, the symmetric KL divergence and multidimensional Wasserstein distance between the current point set and each of the other point sets are calculated; finally, all mixture metrics are calculated. A quantile-based normalization process is implemented, using the 25th quantile of the dissimilarity of the entire point set as the lower bound and the 75th quantile as the upper bound for linear scaling. After eliminating dimensional differences, the arithmetic mean is taken as the final degree of difference. .

8. The privacy leakage assessment method based on traffic fingerprint representation vector space according to claim 6, characterized in that, Confidence calculation: The prediction confidence score of each sample within the aggregation point set in the original classification model of traffic fingerprint analysis, i.e., the maximum probability value output by the Softmax layer, is taken as the arithmetic mean of these scores as the overall confidence score. .

9. A privacy leakage assessment system based on traffic fingerprint representation vector space, characterized in that, It includes a preprocessing module, a weighting module, a feature vector module, an index calculation module, and an evaluation module. The preprocessing module acquires APP traffic data and performs packet parsing and preprocessing on the acquired APP traffic data to obtain traffic sequence data; The weighting module obtains the dependencies in the traffic sequence data based on a two-layer long short-term memory network, and applies Euclidean norm penalty to the weight matrix of the fully connected layer in the obtained dependencies. The feature vector module achieves dimensionality reduction by performing a linear transformation on the high-order features after applying Euclidean norm penalty through a fully connected layer. After removing the output classification layer, it retains the unified feature matrix representation of the flow and constructs a standardized feature vector space. The indicator calculation module divides the sample point sets according to APP category in the standardized feature vector space, and calculates them according to internal density, inter-set difference and confidence. The evaluation module generates an exposure index by weighting and summing the internal density, inter-set difference, and confidence level according to preset weight coefficients.

10. A privacy leakage assessment system based on traffic fingerprint representation vector space according to claim 9, characterized in that, The acquired APP traffic data is parsed, specifically including: At the transport layer, the transport protocol type, source / destination IP address, and port 5-tuple are extracted; at the application layer, the server name indicator and JA3 fingerprint are extracted for TLS traffic, and the Host header field and X-Requested-With identifier are parsed for HTTP traffic; based on the features extracted at the application layer, each traffic stream is accurately bound to a specific APP process to obtain preprocessed normalized traffic.

Images