Mobile hotspot detection method based on multi-dimensional traffic characteristics and machine learning

Abstract

The invention discloses a mobile hotspot behavior detection method based on multi-dimensional flow characteristics and machine learning, and the method comprises the steps: monitoring a network outbound IP message flow in a preset time window; extracting a multi-dimensional feature set including TTL statistical features, TTL dynamic association features and IP ID sequence features, and constructing a feature vector of the time window; and inputting the feature vector into a pre-trained and optimized random forest classifier for judgment, and determining whether the corresponding terminal equipment has a mobile hotspot behavior or not. According to the method, the statistical characteristic, the dynamic characteristic and the protocol underlying sequence characteristic of the flow are fused, so that a characteristic space with high discrimination capability is constructed, the strong dependence on network topology based on TTL absolute value comparison in the prior art is effectively overcome, and the problem of high false alarm rate caused by'statistical fuzziness' in a complex network scene is solved. According to the method and the device, the message sent by the terminal accessing the network through the hotspot can be accurately identified, and finer data is provided for network security management and control and service system evaluation.

Description

Technical Field

[0001] This invention relates to the field of computer network security and traffic analysis technology, specifically to a method and system for detecting mobile hotspot behavior, which is particularly suitable for solving the problems of high false alarm rate and reliance on known network topology in traditional detection methods in complex network environments. Background Technology

[0002] Mobile hotspots, or the act of a mobile device (such as a smartphone) enabling its personal hotspot function to share its network connection as a router, offer convenience but also introduce cybersecurity risks. For example, within a company or organization, unauthorized hotspot activation may bypass network security policies, introduce unauthorized devices, or become a springboard for external attacks. Therefore, accurate and efficient detection of mobile hotspot behavior is crucial for maintaining network security.

[0003] In existing technologies, methods for detecting mobile hotspots primarily rely on the Time To Live (TTL) field in the IP packet header. Since the TTL value decreases by 1 each time a packet passes through a routing device, packets forwarded through a hotspot typically have an additional 1 less TTL value compared to packets directly accessing the network. A common approach is to pre-calculate the theoretical TTL value (system default value) of packets from legitimate terminal devices arriving at the detection point based on the known LAN topology. Then, the presence of hotspot behavior is determined by comparing the actual monitored packet TTL value with this system default value (e.g., determining if it is less than or equal to the system default value minus 1).

[0004] However, this detection method based on absolute TTL values ​​and known topology has significant limitations in practical applications:

[0005] 1. Reliance on known network topology: This method requires precise knowledge of the network topology beforehand to calculate the default TTL system values. However, in real-world networks, the topology may be complex, dynamically changing, or difficult to fully know, limiting the applicability and deployment flexibility of this method.

[0006] 2. Inability to handle differences in initial TTL values: Different operating systems (such as Windows, Linux, iOS) or devices may set different initial TTL values, causing comparison methods based on fixed default values ​​to fail.

[0007] 3. Inability to distinguish between complex and normal traffic (statistical ambiguity): When a device without a hotspot enabled is engaged in highly complex network activities (e.g., simultaneously conducting video conferencing, downloading files, and browsing the web), its traffic may exhibit similar statistical characteristics to the mixed traffic generated by a device with a hotspot enabled (from both the hotspot device itself and access devices). Relying solely on absolute TTL values ​​or simple statistical characteristics is insufficient to effectively distinguish between these two scenarios, leading to the misclassification of complex and normal traffic as hotspot behavior, i.e., a high false alarm rate.

[0008] Therefore, there is an urgent need for a more robust and accurate mobile hotspot detection method that does not rely on precise network topology information, can adapt to different device types, and can effectively distinguish between complex normal traffic and real hotspot traffic. Summary of the Invention

[0009] To address the aforementioned issues, this invention proposes a mobile hotspot detection method based on multi-dimensional traffic features and machine learning.

[0010] Before describing the invention in detail, the key terms used in the invention are first defined:

[0011] A time window refers to a fixed time period, such as 40 seconds, for dividing and analyzing continuous network traffic. This invention extracts a set of features within each time window to represent the traffic profile for that period.

[0012] TTL (Time To Live): Time to Live, a field in the IP packet header, which decreases by 1 each time the packet passes through a router.

[0013] IP ID (IP Identification): An identification field in the IP packet header. The operating system typically assigns an incrementing value to each sent packet for IP packet fragmentation and reassembly.

[0014] Random Forest: An ensemble learning algorithm that performs classification or regression by constructing multiple decision trees and summing their voting results.

[0015] The main objective of this invention is to achieve accurate and robust detection of mobile hotspot behavior by collaboratively analyzing multiple feature dimensions of traffic, including basic TTL statistical features, IP ID sequence features, and TTL dynamic features, and by utilizing the powerful nonlinear modeling capabilities of machine learning models.

[0016] To achieve the objectives of this invention, the specific technical steps of this solution are as follows: A mobile hotspot detection method based on multi-dimensional traffic features and machine learning, the method comprising the following steps:

[0017] Step (1) Traffic collection and windowing: Continuously monitor the outbound IP packet flow at the connection between the local area network and the external network in a specific network environment (such as enterprise intranet, home WiFi); and continuously window the monitored packet flow with a preset time window (W) to obtain the time window sample to be analyzed.

[0018] Step (2) Multidimensional feature collaborative extraction and vector construction: From the time window samples, collaboratively extract and integrate the basic TTL statistical features, IP ID sequence features and TTL dynamic features that can jointly characterize the traffic statistical distribution, protocol underlying sequence and network path dynamic changes under hot spot behavior, and construct the multi-layer feature vector corresponding to the time window.

[0019] Step (3) Customized nonlinear decision: Input the multi-layer feature vector into a pre-trained and tuned random forest classifier. Use this model to accurately model the nonlinear relationship between the three types of features to overcome the detection limitations caused by unknown network topology or fuzzy traffic statistics in the existing technology, obtain the decision output, and determine whether the corresponding terminal device has enabled mobile hotspot behavior.

[0020] Preferably, the random forest classifier is obtained by using a dataset containing normal traffic collected under a specific network environment and hotspot traffic simulating multi-terminal access, and by performing k-fold cross-validation and hyperparameter tuning through methods such as GridSearchCV, to ensure that the model achieves optimal performance for the specific detection task.

[0021] The present invention also provides a mobile hotspot behavior detection system, comprising: a traffic acquisition module, a feature extraction module and a model decision module, which are used to implement steps (1), (2) and (3) of the above method, respectively.

[0022] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0023] (1) Not dependent on known network topology: This invention eliminates the strong dependence on accurate network topology information by analyzing the statistical and dynamic characteristics of the traffic itself, rather than relying on the pre-set TTL default value or network hop count, and has stronger universality and deployment flexibility.

[0024] (2) Effectively reduce false alarm rate: By collaboratively analyzing three types of features—basic TTL statistics, IP ID sequence, and TTL dynamics—and utilizing the nonlinear modeling capabilities of random forests, this invention can more accurately distinguish between complex single-device normal traffic and real multi-device hotspot traffic, significantly reducing false alarms caused by "statistical fuzziness".

[0025] (3) Strong robustness: The use of time window mechanism and ensemble learning model (random forest) makes the detection results less susceptible to instantaneous network fluctuations or individual abnormal messages, thus improving the stability and reliability of detection.

[0026] (4) Applicable to encrypted traffic detection: This invention relies only on the statistical characteristics of the IP packet header for judgment, without the need for deep packet inspection (DPI) or parsing of application layer payload content. Therefore, it is naturally applicable to encrypted traffic environments such as HTTPS, and the detection process is lightweight, efficient and easy to deploy on high-speed network devices. Attached Figure Description

[0027] Figure 1 This is a structural block diagram of the mobile hotspot behavior detection system described in this invention;

[0028] Figure 2 This is a schematic diagram of the collaborative decision principle of the random forest classifier described in this invention;

[0029] Figure 3 This is a confusion matrix diagram of the final optimized model described in this invention, where the horizontal axis represents the predicted label, the vertical axis represents the true label, and the value represents the number of samples of the corresponding category.

[0030] Figure 4 This is a ranking chart of the importance of model features described in this invention. The horizontal axis represents the numerical value of feature importance, and the vertical axis represents the name of each feature, which intuitively shows the degree of contribution of different features to the detection task. Detailed Implementation

[0031] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments and accompanying drawings. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0032] Example 1: Mobile Hotspot Behavior Detection Method

[0033] This embodiment describes the specific steps of a mobile hotspot behavior detection method:

[0034] (1) Traffic Acquisition and Windowing Processing

[0035] (1.1) In this embodiment, the detection device is deployed at the egress gateway of the enterprise LAN and continuously monitors all outbound IP packets (TCP / UDP) flowing to the external network.

[0036] (1.2) The monitored packet stream is divided into fixed time windows of 40 seconds. All outbound packets captured within each 40-second window constitute a time window sample. The preferred 40-second window strikes a balance between real-time detection and statistical stability.

[0037] (2) Multidimensional feature collaborative extraction and vector construction

[0038] (2.1) For each 40-second time window sample, iterate through all IP packets and extract the TTL value, IP Identification (IP ID) value, and total packet length (optional, used for certain feature calculations) of each packet.

[0039] (2.2) Based on the information extracted in (2.1), calculate the following three types of core features:

[0040] Basic TTL statistical characteristics:

[0041] TTL distribution entropy: Calculates the Shannon entropy of all TTL values ​​within a window, quantifying the disorder of the TTL distribution. Enabling hotspots introduces TTL values ​​from different paths or operating systems, typically increasing the entropy value. Its calculation is shown in formula (1):

[0042]

[0043] Where Ti is the i-th different TTL value observed, and P(Ti) is the frequency of the occurrence of this Ti value.

[0044] Mean TTL: The arithmetic mean of all TTL values ​​within the calculation window. Hotspot forwarding is equivalent to adding a hop, which may result in a lower mean TTL compared to normal traffic. Its calculation is shown in formula (2):

[0045]

[0046] Among them, T j Let M be the TTL value of the j-th message within the window, and M be the total number of messages within the window.

[0047] TTL interquartile range: Calculate the difference between the upper and lower quartiles of the TTL value. Mixed flow rates may lead to a more dispersed distribution of TTL values ​​and an increase in IQR. Its calculation is shown in formula (3):

[0048] IQR TTL =Q3-Q1

[0049] Q3 and Q1 are the 75th and 25th percentiles of the TTL value, respectively.

[0050] TTL dynamic characteristics:

[0051] TTL main path percentage: The percentage of the most frequent TTL value (mode) within the calculation window. This percentage is higher if a stable main path exists; the TTL of multiple paths introduced by hotspots or access devices may decrease this percentage. Its calculation is shown in formula (4):

[0052]

[0053] Wherein, Count(Mode) TTL ) represents the count of the most frequently occurring TTL value, and M represents the total number of messages within the window.

[0054] TTL volatility: The standard deviation of the difference between the TTL values ​​of consecutive messages arranged in chronological order within a calculation window. Processing delays introduced by network jitter or hotspot forwarding may increase TTL volatility. Its calculation is shown in formula (5):

[0055] Vol TTL =StdDev(ΔT)

[0056] Where ΔT is the sequence of differences in TTL values ​​of consecutive messages within the window, and StdDev is the standard deviation.

[0057] IP ID sequence characteristics:

[0058] IP ID wraparound count: The number of times a later ID value is less than a previous ID value in a sequence of IP IDs arranged chronologically within a statistical window. Since IP IDs are usually assigned incrementally by the operating system, wraparound rarely occurs in normal single-device traffic. Under hotspot conditions, multiple devices (the hotspot itself and the access devices) send packets through the same network interface, each maintaining its own IP ID counter. When they are mixed together, ID wraparound is very likely to occur, which is a key feature for identifying multi-source concurrency. Its calculation is shown in formula (6):

[0059]

[0060] Among them, ID j Let j be the IP ID value of the j-th packet. This is an indicator function that takes the value 1 when the condition is true.

[0061] IP ID difference standard deviation: The standard deviation of the difference between the IP ID values ​​of consecutive packets arranged in chronological order within a calculation window. The IP ID difference of single-device traffic is usually relatively stable (e.g., close to 1), while multi-source concurrent mixed traffic will result in a wider distribution of differences and an increased standard deviation. Its calculation is shown in formula (7):

[0062] σ ΔID =StdDev(ΔID)

[0063] Wherein, ΔID is a sequence of differences in IP ID values ​​of consecutive packets.

[0064] The importance of each feature in mobile hotspot behavior detection is ranked as follows: Figure 4As shown, features such as TTL distribution entropy (TTL_hist_entropy) and TTL interquartile range (TTL_IQR) contribute the most to the decision result, verifying the high discriminative power of the feature set selected in this invention. This ranking result is consistent with the design logic of the three types of features in this invention—basic TTL statistical features provide macroscopic distribution signals, IP ID sequence features provide microscopic multi-source concurrent signals, and TTL dynamic features provide path stability calibration signals. These three types of features work together to constitute a highly discriminative feature space.

[0065] Furthermore, in (2.2), the boundary conditions for handling feature calculation are as follows: if the number of IP packets captured within the time window sample is insufficient (e.g., less than 2 packets), and insufficient for statistical or sequence calculation, then all feature values ​​of the window are set to 0 or other preset default values ​​(e.g., TTL distribution entropy is set to 0, IP ID wraparound count is set to 0), and tend to be judged as "non-hotspot" to avoid misjudgment due to insufficient data.

[0066] (2.3) Combine all the feature values ​​calculated in step (2.2) (in this embodiment, the number of features can be expanded to 16) into a fixed-dimensional feature vector, which represents a multi-dimensional profile of the traffic within the 40-second window.

[0067] (3) Customized nonlinear decision

[0068] (3.1) Optimal Model Construction: In the offline phase, the training dataset is prepared. In this embodiment, the training dataset contains 1812 time window samples, and the test dataset contains 272 time window samples. The datasets are sourced from outbound traffic feature vectors generated by various normal user behaviors (browsing web pages, sending and receiving emails, video conferencing, downloading, etc.) collected in an enterprise network environment, labeled as "non-hotspot" (label 0); and outbound traffic feature vectors collected simulating real hotspot usage scenarios (e.g., a mobile phone turns on a hotspot, and multiple different types of devices (PC, iOS, HarmonyOS devices) access and conduct mixed network activities), labeled as "hotspot" (label 1).

[0069] Then, a random forest classifier is trained using this dataset. To achieve optimal performance, 5-fold cross-validation is performed using the GridSearchCV method, searching for the optimal parameter combination within a predefined hyperparameter grid. For example, the parameters searched may include the number of decision trees (e.g., [150, 200, 250]), the maximum tree depth (e.g., [10, 20, None]), the minimum number of samples required for node splits (e.g., [2, 5, 10]), and the minimum number of samples required for leaf nodes (e.g., [1, 2, 4]). Based on the 5-fold cross-validation results, the hyperparameter combination that achieves the highest weighted F1 score (e.g., 0.7632) on the validation set (in this example: number of decision trees = 200, maximum depth = 20, minimum number of samples for node splits = 2, minimum number of samples for leaf nodes = 2) is selected to construct the final classification model.

[0070] (3.2) Collaborative Decision Making: During the online detection phase, the real-time feature vector generated in step (2.3) is input into the optimal random forest classifier constructed in (3.1). Inside the model, this feature vector is fed into each decision tree in the forest.

[0071] Nonlinear correlation modeling: Each tree judges the input feature vector based on hierarchical splitting rules learned during training, based on different feature subsets (e.g., "if TTL entropy > threshold A and IP ID wraparound count > threshold B..."). This reflects the model's ability to model the complex nonlinear relationships between the three types of features.

[0072] Multi-evidence voting: Each tree in the forest independently outputs a decision (0 or 1).

[0073] Collaborative Output: The model tallies the voting results of all trees, and the category receiving the majority of votes is used as the final decision output. For example, if more than half of the trees vote 1, the final output is 1, indicating that mobile hotspot behavior has been detected. This voting process ensures that the final result is based on a collaborative consensus of evidence from three aspects: TTL statistics (macro), IP ID sequence (micro), and TTL dynamics (stable), thus effectively eliminating misjudgments caused by relying solely on a single-dimensional feature anomaly (which may be caused by complex normal traffic). (See reference...) Figure 2 This demonstrates the principle of collaborative decision-making.

[0074] Based on the judgment, the system can implement corresponding policies, such as logging, issuing alarms, or restricting network access.

[0075] In this embodiment, the final model trained using the above-mentioned optimal hyperparameter combination (maximum depth = 20, minimum number of leaf nodes = 2, minimum number of nodes splitting = 2, number of decision trees = 200) achieved an overall accuracy of 82% on an independent test set containing 272 samples. Specifically, the precision for the "unopened hotspot" category (label 0) was 0.82, and the recall was 0.83; the precision for the "opened hotspot" category (label 1) was 0.82, and the recall was 0.80. The confusion matrix of the final model is [[115,24],[26,107]], as shown below. Figure 3 As shown, the model's classification results for "unopened hotspots" and "opened hotspots" are clearly demonstrated, further verifying the model's classification performance stability. Compared with the traditional methods mentioned in the background art that rely on the comparison of absolute TTL values, the method of this invention does not depend on network topology and can effectively deal with "statistical fuzziness".

[0076] Example 2: Mobile Hotspot Behavior Detection System

[0077] Reference Figure 1 The mobile hotspot behavior detection system described in this invention requires that, during system deployment, the packet monitoring interface of the traffic acquisition module be bound to the network egress / gateway egress to continuously capture raw IP packet streams. The data flow path between modules is as follows: Figure 1 As shown, after the traffic acquisition module completes the windowing process, it needs to ensure that the windowed samples are transmitted to the feature extraction module for subsequent processing within a predetermined time (e.g., preferably within 1 second) to guarantee the system's real-time requirements. The system includes:

[0078] Traffic acquisition module: responsible for bypass listening or serial capture of outbound IP packets on network interfaces (such as the interface of the gateway connecting to the external network), and caches and organizes the packets into time window samples according to a preset time window (such as 40 seconds) and passes them to the feature extraction module.

[0079] Feature extraction module: Receives time window samples and performs the function of step (2) in Example 1. This module has built-in algorithm logic for calculating basic TTL statistical features, TTL dynamic features, and IP ID sequence features, and combines the calculation results into a feature vector, which is then sent to the model decision module.

[0080] Model Decision Module: Loads and stores the optimal random forest model trained in step (3.1) of Example 1. Receives the feature vector generated by the feature extraction module, calls the model's prediction interface, executes the collaborative decision process in step (3.2) of Example 1, outputs the final detection result (0 or 1), and can pass the result to the policy execution module (not shown).

[0081] Through its modular design, the system enables automated, real-time monitoring and judgment of mobile hotspot behavior.

[0082] Example 3: Adaptation in a Home Network Environment

[0083] The method of this invention is also applicable to home network environments, used to detect whether any device (e.g., a guest's mobile phone) in the home network is privately turning on a hotspot and sharing it with unauthorized "guest's guest" devices. The main difference between its adaptation logic and Embodiment 1 lies in the traffic collection points and model training data:

[0084] 1. Traffic collection range (step (1) adaptation): The monitoring interface of the detection device is deployed on the WAN port of the home router (i.e. the external network interface connected to the optical modem or ISP) to capture all outbound IP packets sent from the home intranet to the Internet.

[0085] 2. Model Training Data (Adaptation in Step (3.1)): The training dataset used to train the random forest classifier must be recollected. The collected data should include: (a) traffic from normal home network activities (such as watching streaming media, online games, and communication with smart home devices) as “non-hotspot” samples; and (b) mixed traffic generated when a family member or visitor’s mobile phone turns on a hotspot and other devices connect as “hotspot” samples.

[0086] 3. Feature Extraction and Decision (Steps (2), (3.2) Adaptation): The logic of feature extraction (step (2)), the feature set (e.g., the 16 features in Example 1), and the decision (step (3.2)) process are consistent with Example 1. The time window (step (1.2)) is still preferably 40 seconds. By using the optimal model trained on home scene data, this method can achieve accurate hotspot detection in the home environment.

[0087] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A mobile hotspot detection method based on multi-dimensional traffic features and machine learning, characterized in that, The method includes the following steps: S1: Traffic acquisition and windowing processing; S2: Multidimensional feature collaborative extraction and vector construction: From the time window samples, the basic TTL statistical features, IP ID sequence features and TTL dynamic features that can jointly characterize the traffic statistical distribution, protocol underlying sequence and network path dynamic changes under hot spot behavior are collaboratively extracted and integrated to construct the multi-layer feature vector corresponding to the time window; S3: Customized Nonlinear Decision: Input multi-layer feature vectors into a pre-trained and tuned random forest classifier. Use this model to accurately model the nonlinear correlation between the three types of features, so as to overcome the detection limitations caused by unknown network topology or ambiguity of traffic statistics in the existing technology, obtain the decision output, and determine whether the corresponding terminal device has enabled mobile hotspot behavior.

2. The mobile hotspot detection method based on multi-dimensional traffic features and machine learning according to claim 1, characterized in that, Step S1 specifically includes: S11: The detection device continuously monitors the outgoing IP packet flow at the connection between the local area network and the external network in a specific network environment; S12: The monitored message stream is continuously divided into windows with a preset time window (W) to obtain a time window sample to be analyzed. The preset time window (W) is set to 40 seconds.

3. The mobile hotspot detection method based on multi-dimensional traffic features and machine learning according to claim 1, characterized in that, Step S2 specifically includes: S21: Extract the TTL value, IP ID value, and packet length information of the IP packets from the time window sample; S22: Based on the extracted information, calculate the basic TTL statistical features, TTL dynamic features, and IP ID sequence features; S23: Combine the features obtained in step S22 into the multi-layer feature vector.

4. The mobile hotspot detection method based on multi-dimensional traffic features and machine learning according to claim 1, characterized in that, Step S3 specifically includes the following sub-steps: S31: Optimal Model Construction: Using a training dataset containing normal traffic collected in a specific network environment and hotspot traffic simulating multi-terminal access, the dataset is divided into a training set and a validation set according to a preset ratio. A random forest classifier is used to perform k-fold cross-validation of GridSearchCV. The optimal combination of hyperparameters is evaluated and selected to perform best in the multi-dimensional feature space, and the optimal model is constructed. S32: Collaborative Decision: The feature vector is input into the optimal random forest classifier, which utilizes its integrated decision tree structure to perform nonlinear collaborative analysis on the signals provided by the three types of features. The specific decision process includes: Nonlinear correlation modeling: During training, each decision tree randomly selects a subset of features and performs threshold segmentation on the combination of the basic TTL statistical features, TTL dynamic features and IP ID sequence features through hierarchical nodes, thereby constructing a mapping of the complex nonlinear relationship between the three types of features; Multi-evidence voting: The feature vector is input into all decision trees in the forest, and each tree independently outputs a decision based on the nonlinear associations it has learned; Collaborative output: The voting results of all decision trees are statistically analyzed, and the final decision is determined by the majority vote. This voting mechanism requires that the decision result be based on a nonlinear collaborative consensus based on the basic TTL statistical characteristics, IPID sequence characteristics, and TTL dynamic characteristics. This collaborative consensus mechanism effectively eliminates the statistical ambiguity caused by the complex traffic of a single device, which cannot be solved by relying on fixed network topology assumptions or analyzing only a single statistical characteristic in existing technologies.

5. The mobile hotspot detection method based on multi-dimensional traffic features and machine learning according to claim 3, characterized in that, The basic TTL statistical features calculated in step S22 include at least one of the following features, and are calculated in the following manner: TTL distribution entropy (TTL_hist_entropy): Used to quantify the disorder of TTL value distribution. When a hotspot is enabled, mixed traffic usually leads to an increase in entropy value. Among them, T i Let P(Ti) be the i-th different TTL value observed, and let T be the value of that TTL. i The frequency of the value's occurrence TTL mean (TTL_mean): Reflects the central trend of TTL values. Hotspot forwarding may cause the mean to decrease systematically. Among them, T j Let M be the TTL value of the j-th message within the window, and M be the total number of messages within the window. • TTL Interquartile Range (TTL_IQR): Measures the dispersion of TTL values; mixed flow rates may increase the IQR. IQR TTL =Q3-Q1 Q3 and Q1 are the 75th and 25th percentiles of the TTL value, respectively.

6. The mobile hotspot detection method based on multi-dimensional traffic features and machine learning according to claim 3, characterized in that, The TTL dynamic characteristics calculated in step S22 include at least one of the following characteristics, and are calculated in the following manner: TTL_dominant_path_ratio: This assesses whether there is a dominant TTL value. Multiple paths under hotspot conditions may result in a lower ratio. Wherein, Count(Mode) TTL ) represents the count of the most frequently occurring TTL value, and M represents the total number of messages within the window; TTL volatility (TTL_volatility): measures the magnitude of change in the TTL value of consecutive messages. Additional processing introduced by hotspot forwarding or path changes may increase volatility. vol TTL =StdDev(ΔT) Where ΔT is the sequence of differences in TTL values ​​of consecutive messages within the window, and StdDev is the standard deviation.

7. The mobile hotspot detection method based on multi-dimensional traffic features and machine learning according to claim 3, characterized in that, The IP ID sequence features calculated in step S22 include at least one of the following features, and are calculated in the following manner: IP ID wraparound count (ip_id_wraparounds): Used to identify whether the IP ID sequence is not monotonically increasing. In hotspot scenarios, multiple devices sending packets through the same interface may cause a significant increase in the wraparound count. It is a key underlying protocol feature that distinguishes between single-device and multi-device traffic. Among them, ID j Let I be the IPID value of the j-th packet. This is an indicator function that takes the value 1 when the condition is true. IPID difference standard deviation (ip_id_delta_std): measures the dispersion of IPID differences in consecutive packets. Multi-source concurrency may lead to a wider distribution of differences and an increase in standard deviation. σ ΔID =StdDev(ΔID) Wherein, ΔID is a sequence of differences in IP ID values ​​of consecutive packets.

8. The mobile hotspot detection method based on multi-dimensional traffic features and machine learning according to claim 4, characterized in that, The random forest classifier was optimized using the GridSearchCV method, and its optimal hyperparameter combination includes: The number of decision trees in n_estimators is 200; The maximum depth is 20. The minimum number of samples in a leaf node of min_samples_leaf is 2; min_samples_split(min_samples_split) The minimum number of samples for point splitting is 2.

9. A mobile hotspot behavior detection system, characterized in that, include: Traffic acquisition module: used to implement the function of step S1 as described in claim 2; Feature extraction module: used to implement the feature calculation function as described in claims 5, 6, and 7, and includes the internal logic for the correlation between each feature and hotspot behavior; Model Decision Module: Used to implement the function of step S3 as described in claim 4, and outputs the decision result of hot spot behavior through collaborative analysis.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, the computer instructions implement the mobile hotspot detection method based on multi-dimensional traffic features and machine learning as described in any one of claims 1-8.

Images