Tor network exit flow identification system and method fusing multi-scale LSTM (Long Short Term Memory) and Transform network

Abstract

The invention discloses a Tor network exit traffic identification system and method fusing a multi-scale LSTM and a Transform network, and belongs to the technical field of anonymous network traffic analysis and network security. The system comprises five core components, namely a multi-scale feature extraction module, a feature fusion module, a global dependency modeling module, a dynamic weighted aggregation module and a classification module. The multi-scale feature extraction module adopts parallel bidirectional LSTM branches with different time resolutions to capture a microcosmic burst mode and a macroscopic session behavior at the same time; the feature fusion module unifies the scale features to the same time sequence length and splices the scale features; the global dependence modeling module utilizes a multi-head self-attention mechanism to learn long-distance time sequence dependence; the dynamic weighted aggregation module highlights a key time slice through adaptive weight pooling; and the classification module outputs website category labels. According to the system, the recognition accuracy on a GTT23 data set is remarkably improved compared with that of an existing method, and good recognition capability and robustness are shown for various flow defense mechanisms.

Description

Technical Field

[0001] This invention relates to anonymous network traffic analysis and network security technology, specifically to a Tor network egress traffic identification system and method that integrates multi-scale LSTM and Transformer networks. Background Technology

[0002] Tor (The Onion Router), an anonymous network, serves as an important privacy protection tool, providing users with anonymous communication services through multi-layered encryption and routing mechanisms. However, malicious users may exploit the Tor network for illegal activities, making effective identification of Tor traffic a crucial requirement for network security protection.

[0003] Website fingerprinting technology infers the websites visited by users by analyzing the temporal characteristics of encrypted traffic, and is the main method of Tor traffic analysis. Existing website fingerprinting technologies mainly suffer from the following technical bottlenecks:

[0004] 1. Limited time scale: Traditional methods cannot simultaneously capture micro-level bursts of traffic and macro-level conversational behavior, making it difficult to utilize multi-granular temporal features.

[0005] 2. Imbalance between local and global features: CNN lacks long-range dependency modeling, RNN performs poorly on long sequences, and Transformer is insensitive to local burst patterns.

[0006] 3. Weak anti-interference ability: Defense mechanisms such as traffic filling and timing interference significantly change traffic characteristics, leading to a decrease in the recognition performance of existing methods.

[0007] 4. Insufficient generalization ability: Existing methods have limited adaptability to new types of flow data (such as high proportion of short-circuit flow and large differences in circuit distribution).

[0008] In recent years, deep learning methods have made significant progress in the field of website fingerprinting. The Deep Fingerprinting (DF) method extracts traffic features through deep convolutional neural networks and has achieved good recognition results on multiple datasets. However, the DF method uses a single CNN architecture, which still has limitations when processing Tor traffic with complex temporal dependencies.

[0009] LSTM-based methods model temporal dependencies using recurrent neural networks and can handle variable-length sequences, but they suffer from low computational efficiency and difficulty in gradient propagation when dealing with long sequences.

[0010] Transformer-based methods utilize self-attention mechanisms to achieve parallel computation and long-distance dependency modeling, but require a large amount of training data and are highly dependent on the positional encoding of the input sequence.

[0011] Currently, there is a lack of a Tor traffic identification method that can effectively integrate multi-scale temporal feature extraction and global dependency modeling, especially a dedicated solution for novel Tor traffic data and traffic defense scenarios. Summary of the Invention

[0012] To address the shortcomings of existing technologies, this invention provides a Tor network egress traffic identification system and method that integrates multi-scale LSTM and Transformer networks, aiming to solve the technical problems of existing single-scale time series models in processing Tor traffic with complex time series characteristics.

[0013] The technical solution of the present invention is as follows:

[0014] A Tor network egress traffic identification system integrating multi-scale LSTM and Transformer networks includes:

[0015] Multi-scale feature extraction module: Employing a parallel architecture, it includes several bidirectional LSTM branches with different temporal resolutions. Each branch obtains the corresponding feature granularity through configurable temporal abstraction operations; fine-grained branches focus on local pattern capture, while coarse-grained branches concentrate on global trend extraction. The network capacity of each branch is adaptively configured according to feature importance and computational resources to ensure that key features are fully represented.

[0016] Feature fusion module: This module unifies the features from each branch output by the multi-scale feature extraction module. It uses adaptive feature alignment technology to unify features of different granularities into the target feature space, and then employs various fusion strategies (including feature concatenation, weighted fusion, etc.) to form a fused feature representation containing multi-granularity temporal information.

[0017] Global Dependency Modeling Module: Based on the Transformer encoder architecture, this module utilizes a multi-head self-attention mechanism to model the global contextual relationships of the fused feature sequences. It achieves efficient long-distance dependency learning through parallel computation, with each attention head focusing on different types of temporal dependency patterns, enhancing the model's ability to understand complex temporal relationships.

[0018] Dynamic weighted aggregation module: Addressing the uneven information density in Tor traffic, a self-attention-based dynamic weighted pooling mechanism is designed. By learning the importance weights at each time step, it adaptively aggregates information from key time segments, suppressing the influence of redundant and noisy segments and improving the discriminative power of feature representations.

[0019] The classification module includes feature normalization and classifier components. It stabilizes feature distribution through layer normalization, outputs the probability distribution of each website category using a fully connected classifier, and optimizes the model using a label-based smooth cross-entropy loss function to improve generalization performance.

[0020] The present invention also provides a method for identifying Tor network egress traffic based on the above system, comprising:

[0021] (1) Traffic data preprocessing: Obtain the data packet sequence of Tor network egress traffic, extract timestamps and transmission direction information to form a one-dimensional time series feature sequence;

[0022] (2) Feature standardization: The mean and variance of the input sequence are normalized for each sample to eliminate the scale difference between samples with different flow rates.

[0023] (3) Multi-scale feature extraction: Temporal features of different granularities are extracted simultaneously through parallel multi-resolution bidirectional LSTM branches;

[0024] (4) Feature fusion and mapping: Unify and stitch together features at various scales, and map them to a unified feature space through linear transformation;

[0025] (5) Global dependency modeling: The Transformer encoder is used to learn the long-distance temporal dependencies of feature sequences;

[0026] (6) Dynamic weighted aggregation: Adaptive weighted aggregation of key time segments is performed through a self-attention mechanism;

[0027] (7) Category output: After normalization, the category tags of the target website are output.

[0028] The beneficial effects of this invention include:

[0029] (1) Advantages of multi-granularity feature fusion: By simultaneously extracting micro and macro temporal features through parallel multi-scale LSTM architecture, the limitations of single-scale modeling are overcome, and the complex temporal patterns of Tor traffic can be captured more comprehensively.

[0030] (2) Architectural synergy: The innovative integration of LSTM’s local feature extraction capability and Transformer’s global modeling capability enables collaborative modeling of local details and global dependencies, significantly improving the quality of feature representation.

[0031] (3) Adaptive aggregation mechanism: The dynamic weighted aggregation module automatically identifies and highlights key time segments, effectively suppressing redundant information and noise interference, and improving the discriminativeness and robustness of the model.

[0032] (4) Strong anti-interference capability: The robust feature extraction and aggregation strategy designed for various traffic defense mechanisms enables the model to maintain high recognition performance when facing defense technologies such as traffic filling and time-series interference.

[0033] (5) High-efficiency training optimization: It supports advanced optimization techniques such as mixed precision training and adaptive learning rate scheduling, achieving a dual improvement in training efficiency and model performance.

[0034] (6) Wide applicability: The system architecture has good scalability and versatility, and is suitable for various types of Tor traffic data and different application scenarios. Attached Figure Description

[0035] Figure 1 The schematic diagram of the overall system architecture of this invention shows the connection relationship between the multi-scale feature extraction module, feature fusion module, global dependency modeling module, dynamic weighted aggregation module and classification module.

[0036] Figure 2 Detailed structure diagram of the multi-scale LSTM module, including the parallel architecture design of branches with different time resolutions, demonstrating the downsampling, bidirectional LSTM processing and upsampling processes.

[0037] Figure 3 : Transformer encoder structure diagram, showing the specific implementation of multi-head self-attention mechanism and feedforward network, including position encoding and residual connection.

[0038] Figure 4 A schematic diagram of the dynamic weighted aggregation module, illustrating the implementation process of self-attention weight calculation and weighted pooling.

[0039] Figure 5 : A schematic diagram of the basic process of this invention. Detailed Implementation

[0040] The specific embodiments of the present invention will be described in conjunction with the appendix. Figures 1-5 The invention will be described in detail so that those skilled in the art can understand and implement it.

[0041] First Implementation Example: Infrastructure Implementation

[0042] like Figure 1 As shown, the Tor network egress traffic identification system of the present invention mainly includes five core modules:

[0043] 1. Input preprocessing and standardization module

[0044] To address the characteristics of Tor traffic data, the input traffic sequence is first preprocessed. Let the original input traffic sequence be... Each element Indicates the first The product of the timestamp and transmission direction of each data packet. Due to significant scale differences between different traffic samples, a sample-by-sample standardization method is used: ;

[0045] in, To represent the flow sequence after sample-by-sample standardization, that is, the dimensionless feature sequence obtained by multiplying the timestamp of each sample by the direction value, subtracting its own mean and dividing by the standard deviation. and These are the mean and standard deviation of the current sample, respectively. To prevent division by zero by small constants. This standardization method can effectively eliminate scale differences caused by different circuit lengths and improve the stability of model training.

[0046] 2. Detailed Design of Multi-Scale Feature Extraction Module

[0047] like Figure 2 As shown, the multi-scale feature extraction module adopts a parallel architecture, containing multiple branches with different feature granularities. The core design is based on a dual-branch architecture.

[0048] Fine-grained branch: processes high-resolution features, focusing on capturing local temporal patterns and bursty behavioral features.

[0049] Coarse-grained branches: process features that have undergone time abstraction to extract global trends and long-term dependency patterns.

[0050] Each branch employs a bidirectional LSTM architecture, with network capacity optimized based on feature importance and computational efficiency. The forward and backward outputs of the bidirectional LSTM are fused to form a complete bidirectional feature representation.

[0051] 3. Feature fusion and mapping mechanism

[0052] The outputs of each branch need to be unified to a compatible feature space for subsequent processing. An adaptive feature alignment method is used to unify features of different granularities into the target feature space, followed by feature integration through a configurable fusion strategy: ;

[0053] in, This refers to the unified feature representation obtained after integrating features from multiple branches, which is used as input for subsequent global modeling and classification. This refers to an adaptive feature alignment and fusion operator, which may include interpolation alignment, linear mapping, and configurable splicing / weighted aggregation processes. This represents the set of feature sequences output by each branch of the multi-scale feature extraction module. To indicate the first Each temporal resolution branch represents the feature sequence before or after alignment, with subscripts... ;

[0054] The fused features are projected onto a unified representation space through a learnable mapping transformation:

[0055] ;

[0056] in, This represents the target feature representation after mapping transformation, which is used in the subsequent global dependency modeling process. A learnable mapping operator is performed on input features. It can be composed of fully connected layers, trainable projection matrices, or small feedforward networks, and is used to unify feature dimensions or semantic space.

[0057] 4. Global Dependency Modeling Module

[0058] like Figure 3 As shown, the global dependency modeling module is based on the Transformer encoder architecture. Each encoder layer contains a multi-head self-attention mechanism and a feedforward network:

[0059] Multi-head self-attention calculation:

[0060] ;

[0061] ;

[0062] in This represents the scaled dot product attention output; the input is the query matrix. Key matrix Value matrix Each attention head focuses on a different dependency pattern, enabling efficient long-distance dependency modeling through parallel computation. , , These represent the query, key, and value matrices, respectively, all obtained from the input features through linear transformation. This represents matrix multiplication, which calculates the similarity between the query (Q) and all keys (K). The result is a similarity score matrix, representing the degree of matching between each query position and all key positions. Indicates the scaling factor. It is the dimension of the key vector; the purpose is to prevent the dot product result from being too large. The gradient vanishes, especially in high-dimensional spaces, and the variance of the dot product increases with increasing dimension. This means converting the similarity scores into a probability distribution, ensuring that all attention weights are positive and sum to 1; highlighting high similarity values ​​and suppressing low similarity values. : Using the calculated weighted value matrix Weighted summation is performed, and positions with higher weights contribute more to the final output. Indicates that there is Each attention head independently computes self-attention (i.e., each head has its own parameters and projection). This means concatenating the outputs of all attention heads along the feature dimension to form a large feature vector. It is a learnable linear transformation weight matrix used to map the concatenated features back to the original feature space dimension.

[0063] 5. Dynamic weighted aggregation module

[0064] like Figure 4 As shown, a self-attention pooling mechanism is designed to address the uneven information density in the traffic sequence:

[0065] Weight calculation: ;

[0066] Weighted aggregation: ;

[0067] in For learnable weight vectors, Indicates the first The importance weight of each time step. express The transpose of is used to perform an inner product operation with the input features. Indicates the first The feature vectors at each time step. The dot product of the weight vector and the feature vector is represented by the projection of the feature vector onto the weight direction, which can be understood as the original score of the importance of that time step. The index is calculated from the original score to ensure that the result is positive. : The sum of the scores at all time steps, used as a normalization factor. :pass The function transforms the original scores into a probability distribution, ensuring that the sum of all weights is 1.

[0068] 6. Classification Module Design

[0069] The classification module includes a layer normalization and a fully connected classifier, and the loss function uses label-smoothed cross-entropy.

[0070] ;

[0071] in, This represents the overall loss function value, which is the objective to be minimized during model training. Indicates all categories Perform summation. This indicates that the true correct label is 1 for the correct category and 0 for other categories. ŷᵢ represents the model's predicted first (or second) category. Output the probability of each category. Taking the natural logarithm of the predicted probability is a fundamental operation in information theory. This represents the smoothing parameter, which controls the degree of smoothing. This represents the total number of categories, i.e., the total number of websites that the model needs to classify. This represents the smoothed probability that is averaged across all categories.

[0072] Second Implementation Example: System Integration and Deployment;

[0073] I. Hardware Configuration

[0074] GPU: A graphics card that supports CUDA computing with ≥8GB of video memory;

[0075] CPU: Multi-core processor, supporting parallel data loading;

[0076] Memory: ≥16GB, for large-scale data processing;

[0077] II. Software Environment

[0078] Deep learning frameworks: PyTorch or TensorFlow;

[0079] Programming language: Python 3.7+;

[0080] Dependencies: NumPy, SciPy, scikit-learn, etc.

[0081] III. Model Training Strategies

[0082] Mixed precision training: Uses FP16 data type to improve training speed and reduce GPU memory usage;

[0083] Adaptive learning rate: The learning rate is dynamically adjusted using strategies such as OneCycleLR;

[0084] Gradient accumulation: Supports large-batch training and improves model performance;

[0085] Early stopping mechanism: Monitor validation set performance to prevent overfitting;

[0086] Experimental verification and performance analysis are as follows:

[0087] Comprehensive experimental validation was conducted based on the GTT23 dataset:

[0088] (a) Ablation test results:

[0089] To verify the effectiveness of each module, detailed ablation experiments were conducted, as shown in Table 1.

[0090] Table 1 shows the results of the ablation experiment:

[0091] ;

[0092] Experimental results show that:

[0093] The high-resolution branch contributes the most to performance, validating the importance of fine-grained features;

[0094] Each module makes a significant contribution to the final performance, proving the rationality of the architecture design;

[0095] The complete model improves upon the single-branch method by 7.16%, demonstrating the advantages of multi-scale fusion.

[0096] (II) Comprehensive Test of Anti-Defense Capabilities:

[0097] Comparative experiments were conducted on the GTT23 dataset and related traffic defense mechanisms, as shown in Table 2.

[0098] Table 2 presents a comparative experiment of the GTT23 dataset and related traffic defense mechanisms:

[0099] ;

[0100] Key findings:

[0101] 1. In all defense scenarios, this invention significantly outperforms the benchmark method.

[0102] 2. Its advantages are most obvious in scenarios with strong defense (Front, minipatch).

[0103] 3. It can still maintain practical recognition performance even when facing the strongest defense mechanisms.

[0104] Regarding parameter configuration guidelines, based on experimental results, the following configuration suggestions are provided:

[0105] 1. Multi-scale branch configuration:

[0106] It is recommended to use 2-5 branches with different feature granularities.

[0107] The level of feature abstraction is adaptively adjusted according to the characteristics of the data.

[0108] The number of branches must be balanced with computing resources and performance requirements.

[0109] 2. Hidden Unit Configuration:

[0110] The capacity of each branch network is dynamically configured based on the importance of its features.

[0111] Fine-grained branches typically allocate more computational resources.

[0112] The total number of parameters is controlled within the system performance constraints;

[0113] 3. Transformer configuration:

[0114] The recommended number of encoder layers is 2-4. Too many layers can easily lead to overfitting.

[0115] The recommended number of attention heads is 4-16, matching the sequence length.

[0116] The feedforward network dimension is 2-4 times that of the hidden dimension;

[0117] 4. Training strategy configuration:

[0118] The learning rate ranges from 1e-4 to 1e-3, and adaptive scheduling is used.

[0119] Batch size should be selected based on hardware configuration; 16-128 is recommended.

[0120] The number of training rounds is determined based on the convergence results, usually 30-50 rounds.

[0121] The core technological innovations of this invention include: 1. Multi-scale parallel architecture: Innovatively introducing multi-feature granularity parallel processing into Tor traffic recognition, achieving collaborative extraction of local details and global trends. 2. LSTM-Transformer fusion: Innovatively combining the local feature capture capability of LSTM and the global modeling capability of Transformer to achieve architectural synergy. 3. Dynamic weighted aggregation: Proposing an adaptive weight pooling mechanism to automatically identify key time segments and improve feature discriminativeness. 4. Robust design: Designing a dedicated robust strategy for traffic defense mechanisms, maintaining excellent performance even under strong defense scenarios.

[0122] It should be emphasized that the specific parameter configuration is only an implementation example. The core value of this invention lies in the collaborative architecture design concept of multi-scale LSTM and Transformer, as well as the special optimization strategy for Tor traffic characteristics, rather than specific parameter values.

[0123] In terms of industrial applications, this invention can be widely used in: network security monitoring systems, enterprise-level traffic analysis platforms, anonymous network research tools, malicious traffic detection systems, and network behavior analysis systems.

[0124] Through modular design and standardized interfaces, this invention can be easily integrated into existing network security protection systems, providing strong technical support for ensuring network security.

[0125] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0126] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A Tor network egress traffic identification system integrating multi-scale LSTM and Transformer networks, characterized in that, The system includes a multi-scale feature extraction module, a feature fusion module, a global dependency modeling module, a dynamic weighted aggregation module, a classification module, an adaptive parameter adjustment module, and a model update module, which are used to complete multi-granularity temporal feature extraction, global context modeling, key segment highlighting, category decision and online adaptive upgrading under a unified framework; The multi-scale feature extraction module includes several parallel bidirectional LSTM branches with different temporal resolutions. Each branch configures the number of hidden units according to the importance of the temporal scale and outputs the sequence features before alignment. The feature fusion module performs temporal upsampling of the outputs of each branch to a uniform length and then concatenates them according to the feature dimensions to form a fused sequence. The global dependency modeling module includes a multi-layer Transformer encoder to capture the long-distance dependencies and contextual interactions of the fused sequence. The dynamic weighted aggregation module performs weighted pooling on the Transformer output sequence based on self-attention weights to highlight key time segments. The classification module performs normalization on the aggregated features and maps the output target website category labels. The adaptive parameter adjustment module adjusts the key hyperparameters of each branch and the Transformer online according to the input traffic characteristics. The model update module updates the system parameters in real time through incremental training or weight replacement to adapt to new traffic data.

2. The system according to claim 1, characterized in that: The multi-scale feature extraction module includes multiple branches with different temporal resolutions. Each branch obtains different temporal abstraction granularities through downsampling operations, and the corresponding number of hidden units is configured differently according to the degree of abstraction. The feature fusion module uses an upsampling interpolation method to unify the output of each branch to the original time series length, and performs a splicing operation in the feature dimension. The Transformer encoder of the global dependency modeling module adopts a multi-head self-attention mechanism, with each attention head focusing on different temporal dependency patterns.

3. The system according to claim 1, characterized in that: The dynamic weighted aggregation module calculates attention weights through linear transformation, normalizes them using the softmax function, and then performs a weighted summation with the corresponding feature vectors. The classification module includes a layer normalization unit and a fully connected classifier, which is optimized using the label smooth cross-entropy loss function.

4. The system according to claim 1, characterized in that: The adaptive parameter adjustment module includes a flow characteristic detector and a parameter optimizer, which are used to detect changes in flow characteristics in real time and automatically adjust system architecture parameters. The model update module includes an incremental learning component and an online adaptation component, which are used to learn new traffic patterns online and update model weights.

5. A method for identifying Tor network egress traffic, applied to the system described in any one of claims 1-4, characterized in that, The process includes the following steps: traffic data acquisition, obtaining the timestamps and direction information of Tor network egress traffic to form a one-dimensional time-series feature sequence; Data preprocessing involves standardizing the input sequence sample by sample. Multi-scale feature extraction: Temporal features of different granularities are extracted in parallel through a multi-scale feature extraction module. feature Fusion mapping integrates features from different scales and maps them to a unified feature space; Global dependency modeling: This module learns long-distance temporal relationships between sequences; Dynamic weighted aggregation: This module adaptively aggregates key time segments. The category output uses the category module to output the category tags for the target website.

6. The method according to claim 5, characterized in that: In the traffic data acquisition step, the time-series feature sequence is obtained by multiplying the timestamp of the data packet by the transmission direction.

7. The method according to claim 5, characterized in that: In the data preprocessing step, the standardization process adopts a sample-by-sample mean-variance normalization method.

8. The method according to claim 5, characterized in that: The model training process employs mixed precision training techniques and an adaptive learning rate scheduling strategy for optimization.

9. The method according to claim 5, characterized in that: It further includes a traffic defense detection step to identify and adapt to different types of traffic defense mechanisms.

10. The method according to claim 5, characterized in that: It further includes an incremental learning step for learning new traffic patterns online and dynamically updating model parameters.

Images