A network fingerprint defense method and system based on adaptive gating unit and medium

Abstract

The application relates to a network fingerprint defense method and system based on an adaptive gating unit, which encodes a website category label into a vector; generates a candidate perturbation vector based on random noise by using multiple expert perturbation generators; generates a gating selection vector according to the category vector by the adaptive gating unit; obtains a final perturbation by weighting and fusing the candidate perturbation vector; and applies the perturbation to uplink traffic after masking and rounding. The application dynamically schedules multiple expert generators through the gating unit, does not need to train a model for each website category, significantly reduces the training and storage overhead, designs a loss function containing a dispersion constraint, makes the perturbation distribution more uniform, improves the defense concealment, realizes low bandwidth consumption and high generalization capability under the premise of guaranteeing effective resistance to website fingerprint identification attack, and is suitable for privacy protection in a large-scale network environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network and information security, and particularly relates to a network fingerprint defense method and system based on an adaptive gate unit and a medium. BACKGROUND

[0002] With the increasing severity of Internet privacy security threats, an anonymous communication system has become an important tool for protecting the privacy of user network behavior. Tor (The Onion Router) effectively hides the source and destination of communication by forwarding user data through multiple relay nodes through multi-layer encryption technology, and is widely used in privacy protection scenarios. However, Tor only encrypts the communication content and does not hide the traffic pattern. Attackers can still analyze the traffic characteristics in the Tor network through website fingerprinting (WF) attacks to infer the websites visited by users, which is a major means of threatening the privacy of Tor users.

[0003] Website fingerprinting attacks belong to a type of traffic analysis attacks. Attackers monitor the encrypted traffic between the client and the Tor entry node, extract features such as packet timing, direction, length, and use machine learning or deep learning models for classification to infer the specific website visited by the user. Website fingerprinting attacks do not require decryption of communication content and have strong concealment and feasibility. Early WF attacks were mostly based on manual features and traditional machine learning models such as support vector machines (SVM) and k-nearest neighbors (k-NN), and the recognition accuracy was limited. In recent years, with the development of deep learning technology, WF attack methods based on convolutional neural networks (CNN) and recurrent neural networks (RNN) have emerged, and the recognition performance has been significantly improved. For example, the Deep Fingerprinting (DF) method uses a deep neural network to automatically extract traffic features, and the recognition accuracy on some public data sets exceeds 98%, which seriously threatens the privacy protection ability of anonymous communication systems.

[0004] To effectively defend against website fingerprinting attacks and protect the privacy of Tor network users, existing technologies can be mainly divided into the following two categories:

[0005] Traffic obfuscation methods, traditional traffic obfuscation methods such as WTF-PAD, FRONT and BuFLO, usually disturb the traffic characteristics by inserting fake packets or introducing transmission delays, making it difficult for attackers to accurately identify websites; however, these methods generally have large bandwidth overhead and poor user experience, especially in the face of WF attacks using deep learning models, the effectiveness of these traditional defense methods is greatly reduced; with the rapid development of deep learning technology, WF attack methods have gradually shifted from traditional machine learning models to advanced attack techniques based on deep neural networks, which can automatically extract deep features of traffic, significantly improving attack accuracy and even breaking through existing traffic obfuscation defense methods.

[0006] Adversarial sample generation methods can effectively confuse the classifier of the deep learning model by introducing a small perturbation (i.e., adversarial perturbation) to the original traffic, causing the attack model to produce incorrect classification and reducing the accuracy of WF attacks; this method can modify traffic features to deceive the classifier without changing the original traffic pattern, and has good adaptability; however, inserting operations on the direction sequence will change its length and structure, making the input space discontinuous, and it is difficult to directly use gradient information to optimize the perturbation, therefore, this method relies on heuristic search (such as MiniPatch), custom gradient function (such as Blanket) or random sampling strategy (such as WTF-PAD), which is inefficient and difficult to stably generate high-quality adversarial samples;

[0007] Therefore, some studies represent traffic as a burst sequence, and implement continuous perturbation of traffic features by inserting co-directional dummy packets in specific bursts, so that gradient information can be used to optimize adversarial generation, such as AWA, ALERT and other methods; these methods can effectively reduce the recognition accuracy of deep learning WF attack models while maintaining low bandwidth overhead, however, this method still faces two key challenges: existing defense methods mostly rely on class-by-class training of perturbation generation models, i.e., training a perturbation generator for each website category, this method performs well in defense accuracy, but has significant training overhead and storage cost; as the number of website categories increases, training multiple independent models not only requires huge computing resources and storage space, but also results in high maintenance and update costs of the model, severely limiting its application in large-scale network environments; secondly, most traditional defense methods confuse traffic features by inserting fake packets, this approach can effectively interfere with the WF classifier, but the perturbation generated usually has high concentration, i.e., a large number of fake packets are inserted into certain traffic features, this centralized perturbation pattern makes the defended traffic have obvious difference characteristics, reducing the concealment and long-term effectiveness of the defense.

[0008] In summary, the current WF defense method still faces problems such as high overhead, low concealment, and poor large-scale adaptability while improving defense effect. SUMMARY

[0009] Therefore, the present application provides a network fingerprint defense method and system based on an adaptive gating unit, which significantly reduces system overhead, improves the dispersion and adaptability of perturbations, and effectively protects against increasingly complex and diverse website fingerprint identification attacks.

[0010] To achieve the above-mentioned purpose, the present application provides a network fingerprint defense method based on an adaptive gating unit, comprising the following steps:

[0011] S1, category information embedding coding to generate an embedding vector: embedding the website category label corresponding to the network traffic to be defended into a category embedding layer to obtain the embedding vector of the category through embedding coding ;

[0012] S2, generating a candidate perturbation vector: sampling a random noise vector from a preset distribution and inputting the random noise vector into K expert perturbation generators, each expert perturbation generator outputting a candidate perturbation vector based on the learned traffic perturbation pattern , wherein ;

[0013] S3, generating a gating selection vector: inputting the embedding vector into an adaptive gating unit to generate a K-dimensional gating selection vector , the gating selection vector is used to represent the contribution weight of each expert perturbation generator to the category label ;

[0014] S4, perturbation weighted selection: according to the gating selection vector , the K candidate perturbation vectors are weighted and summed to obtain the final defense perturbation vector ;

[0015] S5, perturbation application: applying the defense perturbation vector to the network traffic to be defended, and inserting an integer number of virtual data packets in the uplink data packet direction through a perturbation mask;

[0016] S501, setting a mask matrix with the same dimension as the traffic burst sequence Each data point in the network traffic to be defended is marked, with uplink packets set to 1 and downlink packets set to 0. The defense perturbation vector is then used to... With mask matrix Multiply element by element to ensure that the disturbance is applied only to the upstream traffic;

[0017] S502. Perform a rounding operation on each element in the perturbation vector after applying the mask to obtain the integer number of virtual data packet insertions.

[0018] Preferably, the category label is mapped to a [missing information] through embedding encoding. dimensional real vector embedding vector The embedding vector The expression is:

[0019] ;

[0020] in, express 3D real vector space, This indicates an embedding encoding operation.

[0021] Preferably, step S2 specifically includes the following steps:

[0022] S201, the noise vector Based on the preset standard normal distribution Sampled, And input it into K expert perturbation generators;

[0023] S202. Each expert perturbation generator includes a fully connected layer, a ReLU activation function, and a random deactivation layer. The expert perturbation generator applies a perturbation vector to the noise vector. Perform mapping and activation to generate candidate perturbation vectors. The expression is:

[0024] ;

[0025] in, Indicates the first A mapping function for an expert perturbation generator.

[0026] Preferably, the adaptive gating unit includes a fully connected layer and a Softmax activation layer;

[0027] The embedding vector The input is fed into a fully connected layer to generate weight scores for each expert perturbation generator. These scores are then fed into a Softmax activation layer, where the Softmax temperature function normalizes the weight scores into a probability distribution to obtain the gating selection vector. The expression is:

[0028] ;

[0029] wherein, denotes trainable parameters of the fully connected layer, denotes a temperature value of the Softmax activation layer, which controls the dispersion degree of the probability distribution by a preset temperature coefficient.

[0030] Preferably, the final defense perturbation vector is obtained by weighted summation , and the expression is:

[0031] ;

[0032] wherein, denotes the i-th element of the gating selection vector .

[0033] Preferably, a loss function for optimizing the generation of the perturbation is further included , and the loss function includes a classification loss, a bandwidth overhead penalty, and a perturbation dispersion constraint, and the expression is:

[0034] ;

[0035] wherein, denotes the classification loss, denotes the bandwidth overhead penalty, denotes the perturbation dispersion constraint, all denote weight coefficients.

[0036] Preferably, the expression of the perturbation dispersion constraint is:

[0037] ;

[0038] wherein, denotes the penalty term, denotes the number of data packets in which the perturbation vector is inserted in the i-th burst plan, denotes a preset concentration threshold. The application further provides a network fingerprint defense system based on an adaptive gating unit, which comprises a category information embedding module, a candidate perturbation generation module, a gating vector generation module, a perturbation weighting selection module, and a perturbation application module, wherein the category information embedding module, the candidate perturbation generation module, the gating vector generation module, the perturbation weighting selection module, and the perturbation application module are sequentially connected.

[0039]

[0040] ​​The category information embedding module is configured to receive a website category label corresponding to the network traffic to be defended, and convert the category label into an embedding vector through embedding coding.

[0041] The candidate perturbation generation module comprises K expert perturbation generators with the same structure and independent parameters, configured to receive a random noise vector sampled from a preset distribution, and output a candidate perturbation vector from each expert perturbation generator.

[0042] The gating vector generation module comprises an adaptive gate unit, configured to receive the embedding vector, and generate a gating selection vector corresponding to the expert perturbation generator through full connection layer and Softmax activation layer normalization processing.

[0043] The perturbation weighting selection module performs weighted summation on all candidate perturbation vectors according to the gating selection vector, to obtain a final defense perturbation vector.

[0044] The perturbation application module applies the final defense perturbation vector to the network traffic to be defended, limits the perturbation to be applied only to the uplink traffic through a masking operation, and performs integerization processing on the perturbation data.

[0045] The application further provides a computer readable storage medium, wherein the storage medium stores a computer program for executing the network fingerprint defense method based on the adaptive gating unit.

[0046] Compared with the prior art, the application has the following beneficial effects:

[0047] By introducing the adaptive gating network mechanism, the application can dynamically fuse the outputs of multiple expert perturbation generators according to the label information of the input network traffic to be defended, avoids the redundant operation of training a model for each website category in the traditional method, significantly improves the generalization ability of defense, removes the need to train a model for each website category, and greatly reduces the model training and storage overhead.

[0048] By designing a loss function containing a dispersion constraint, the application effectively suppresses the phenomenon of inserting a large number of virtual data packets in a few burst positions, avoids the concentration of a large number of virtual data packets in some burst sequences, makes the perturbed traffic feature closer to the real distribution, and enhances the concealment and long-term defense effectiveness of the adversarial sample.

[0049] The application limits the perturbation to be applied only to the uplink traffic through a masking mechanism, and optimizes the bandwidth overhead penalty term, to ensure that the generation of the perturbation not only effectively defends against attacks, but also maintains low bandwidth consumption, meets the demand for bandwidth in the actual network environment, and is significantly superior to similar adversarial sample defense methods.

[0050] The application generates a process of feedback information optimization disturbance based on a substitute model, can theoretically approach the optimal defense effect, and has strong practicability and operability in actual deployment, and has strong practical application value and deployment feasibility.

[0051] In conclusion, the WF defense method provided by the application has strong generalization, low overhead, dispersion and strong defense capability, has significant advantages in improving defense effect, reducing bandwidth consumption and optimizing disturbance concealment, and can provide reliable technical support for privacy protection in diversified network environments. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 It is a whole flow schematic diagram of the network fingerprint defense method based on the adaptive gating unit of the application.

[0053] Figure 2 It is a network fingerprint defense system structure schematic diagram based on the adaptive gating unit of the application.

[0054] Figure 3 It is a working principle framework diagram of the network fingerprint defense system based on the adaptive gating unit of the application.

[0055] Figure 4 It is a disturbance vector virtual data packet insertion distribution intensity diagram generated by randomly selecting 10 websites in the embodiment of the application. DETAILED DESCRIPTION

[0056] In order to further illustrate the technical means and effects adopted by the application to achieve the predetermined application purposes, the specific embodiments, structures, features and effects according to the application are described in detail as follows in combination with the drawings and preferred embodiments.

[0057] The application provides a network fingerprint defense method based on an adaptive gating unit, referred to as Moe-Gen, aiming at solving the problems of high training overhead and centralized disturbance existing in the existing network fingerprint defense method, and the core of the application is the introduction of the gating unit and the design of the centralized disturbance loss function, so that Moe-Gen can guarantee that the method realizes effective network fingerprint defense for all categories of website traffic as low overhead as possible on the premise of avoiding centralized disturbance.

[0058] Embodiment 1

[0059] The core of this embodiment is to generate a specific weight selection vector for different website categories by using an adaptive gating unit, realize different selections of multiple experts, obtain different disturbance schemes, optimize the redundant operation of training a disturbance vector generator for each website category in the traditional method to only need to train a defense model, and greatly reduce the training overhead of the defense model.

[0060] As Figure 1 shown, the embodiment provides a network fingerprint defense method based on adaptive gating unit, including the following steps:

[0061] S1, category information embedding coding, generating embedding vector: input the website category label corresponding to the network flow to be defended to the category embedding layer, and map it to an embedding vector with a dimension of by embedding coding, the expression is:

[0062] ;

[0063] Among them, represents a real vector space with a dimension of , and represents the embedding coding operation.

[0064] S2, generating candidate perturbation vector: sampling random noise vector from a preset distribution , and inputting the random noise vector to K expert perturbation generators, each expert perturbation generator outputs a candidate perturbation vector based on the learned traffic perturbation mode, wherein

[0065] ; S201, the noise vector is sampled by a preset standard normal distribution , and is input to K expert perturbation generators;

[0066] S202, each expert perturbation generator includes a full connection layer, a ReLU activation function and a random inactivation layer, the structures of each expert are the same, but the parameters are independent of each other, the expert perturbation generator maps and activates the noise vector to generate a candidate perturbation vector , the expression is:

[0067] ;

[0068] Among them, represents the mapping function of the th expert perturbation generator, and multiple expert generators will generate multiple perturbation vectors based on the same input noise, providing different perturbation candidates for the subsequent weighted selection process.

[0069] S3, generating a gating selection vector: input the embedding vector to the adaptive gating unit, the adaptive gating unit includes a full connection layer and a Softmax activation layer, and the embedding vector The input is fed into a fully connected layer to generate weight scores for each expert perturbation generator. These scores are then fed into a Softmax activation layer, where the Softmax temperature function normalizes the weight scores to a probability distribution, yielding a K-dimensional gating selection vector. Gating selection vector Used to represent the category labels of each expert perturbation generator. The contribution weight reflects the degree of contribution of each expert to a specific category, and is expressed as:

[0070] ;

[0071] in, This represents the trainable parameters of the fully connected layer. This represents the temperature value of the Softmax activation layer. By controlling the dispersion of the probability distribution through a preset temperature coefficient, different categories can have more distinguishable expert pairings.

[0072] S4. Perturbation-weighted selection: Based on the gated selection vector... For K candidate perturbation vectors The final defense perturbation vector is obtained by performing a weighted summation. The expression is:

[0073] ;

[0074] in, Represents the gating selection vector The Through a weighted selection mechanism, the model can dynamically adjust the contribution ratio of each expert-generated candidate perturbation based on the category features, ensuring that the final generated perturbation vector is highly matched with the features of the traffic category.

[0075] S5, Disturbance Application: Apply the defensive disturbance vector To ensure the effectiveness and concealment of the perturbation, an integer number of virtual data packets are inserted into the uplink data packet direction using a perturbation mask, which is applied to the network traffic to be defended.

[0076] S501. Use a masking method to ensure that the disturbance is only applied to the uplink data packets, i.e., the traffic from the client to the server: Set a mask matrix with the same dimension as the traffic burst sequence. Each data point in the network traffic to be defended is marked, with uplink packets set to 1 and downlink packets set to 0. The defense perturbation vector is then used to... With mask matrix Multiply element by element to ensure that the disturbance is applied only to the upstream traffic;

[0077] S502. The number of virtual data packets inserted into each burst of the perturbation vector should meet the integer requirement. That is, when applying the perturbation, the number of perturbation data packets inserted into a single burst in the perturbation vector should be an integer: perform a rounding operation on each element in the perturbation vector after applying the mask to obtain an integer number of virtual data packets inserted, ensuring that the final number of perturbation data packets is an integer.

[0078] By using masking and rounding operations, the generated perturbation has met the basic constraints and limitations, and can be directly applied to the network traffic to be defended. This ensures that the attackers are effectively misled while meeting network protocol constraints, thereby achieving the defense objective.

[0079] To achieve effective network fingerprint defense with minimal overhead and avoid concentrated insertion of perturbation vectors, the defense method provided in this implementation also designs a loss function to optimize perturbation generation. Building upon the combination of alternative model feedback and bandwidth overhead penalty, a perturbation dispersion constraint is further introduced. This constraint guides the perturbation to be distributed more evenly in the burst sequence, thus making the perturbed traffic pattern closer to the original distribution of real traffic. This significantly improves the concealment of adversarial examples and reduces the risk of being identified and detected by attackers. The loss function... The expression is:

[0080] ;

[0081] in, This represents the classification loss, which aims to minimize the probability that adversarial examples are misclassified. This represents a bandwidth overhead penalty, limiting the use of additional bandwidth during the disturbance generation process. This represents a perturbation dispersion constraint, guiding the perturbation to be distributed more evenly in the burst sequence to enhance concealment. All represent weighting coefficients;

[0082] Dispersion Constraints The aim is to ensure that the generated perturbations are more evenly distributed throughout the burst sequence, thereby increasing the difficulty for attack models to identify these perturbations, and constraining the perturbation dispersion. By designing a piecewise exponential function, a rapid and forceful penalty is applied when significant perturbation insertion occurs within a set of perturbation data packets, while retaining a certain degree of freedom within a given threshold. The expression is as follows:

[0083] ;

[0084] in, This represents the penalty term, which is the penalty imposed on a sudden disturbance when it exceeds a threshold. The perturbation vector is represented at the th a number of data packets inserted by the burst plan, representing a preset concentration threshold, under a given concentrated disturbance loss design, the defense method can learn effective defense patterns during training, and can also ensure that its disturbance vector avoids the phenomenon of concentrated disturbance.

[0085] Embodiment 2

[0086] As Figure 2 shown, the embodiment provides a network fingerprint defense system based on an adaptive gating unit, which includes a category information embedding module, a candidate disturbance generation module, a gating vector generation module, a disturbance weighting selection module and a disturbance application module. The category information embedding module, the candidate disturbance generation module, the gating vector generation module, the disturbance weighting selection module and the disturbance application module are connected in sequence.

[0087] The category information embedding module performs preprocessing work of website category label information, for receiving a website category label corresponding to the network traffic to be defended, and converting the category label into an embedding vector through embedding coding;

[0088] The candidate disturbance generation module includes K expert disturbance generators with the same structure and independent parameters, for receiving random noise vectors sampled from a preset distribution, and outputting a candidate disturbance vector from each expert disturbance generator;

[0089] The gating vector generation module includes an adaptive gate unit, for receiving the embedding vector, and generating a gating selection vector corresponding to the expert disturbance generator through full connection layer and Softmax activation layer normalization processing. As the core of the system generalization ability source, it is responsible for extracting the unique category features of the website to be defended based on the category information embedding coding, obtaining the expert weight selection vector of the network traffic to be defended, so as to realize the targeted defense disturbance vector for different website categories;

[0090] The disturbance weighting selection module weights and sums all candidate disturbance vectors according to the gating selection vector to obtain the final defense disturbance vector. Each expert disturbance generator has consistent network structure and consistent function, but inconsistent parameters. Each expert disturbance generator learns different disturbance strategies and generates its own candidate disturbance vector for the gating unit to match and select.

[0091] The disturbance application module applies the final defense disturbance vector to the network traffic to be defended, limits the disturbance to be applied only to the uplink traffic through the mask operation, and then performs integerization processing on the disturbance data.

[0092] The system workflow is as Figure 3As shown: when the system is running, first, the category label of the website to be defended is acquired, which is input into the information coding module, and is converted into an embedding vector representation through embedding coding. At the same time, the perturbation generation expert completes the sampling of random noise and maps it to a specific candidate perturbation vector; the category information embedding vector flows to the gating unit, which gives the perturbation expert weight vector specific to the website to be defended according to the category information embedding vector; the weight vector and the candidate perturbation vector have been obtained, and the final perturbation vector is obtained by weighting and summing the candidate perturbation vector according to the weight vector; then the perturbation vector is subjected to a masking operation and a rounding operation to obtain the final perturbation scheme that meets the network protocol constraints. When sending data packets, the specified position virtual data packet is inserted according to the perturbation scheme, and the final network fingerprint defense is achieved.

[0093] The embodiment also provides a computer readable storage medium, the storage medium storing a computer program, when the computer program runs on a computer, the computer program makes the computer can execute the steps in the network fingerprint defense method based on the adaptive gating unit described in the preceding description.

[0094] Embodiment 3

[0095] In order to verify the effectiveness and significant effect of the Moe-Gen method, comparative tests are performed.

[0096] Dataset selection: AWF (Alexa-based Website Fingerprinting) dataset with different website category size is used, the traffic sample of the dataset comes from a fixed set of monitoring websites, each website has thousands of access records, which is suitable for evaluating the identification and generalization ability of the model in the known category range; four subsets CW100, CW200, CW500 and CW900 are selected, which contain 100, 200, 500 and 900 different website categories respectively, and each category of website corresponds to 2500 valid traffic samples. This step-by-step expansion of the website category size provides a good experimental basis for evaluating the generalization ability of the model in a large-scale category space.

[0097] Attack method selection: DF is a classic network fingerprint identification method based on neural network, which is often used as a baseline for comparison, and is a representative network fingerprint identification method, therefore, the DF method is selected as the attack method.

[0098] Comparison method selection: In order to effectively evaluate the effectiveness of the application, the latest ALERT method and AWA method based on adversarial samples, and the classic DFD method and WalkieTalkie method are selected.

[0099] Test indicators: defense time overhead, average F1 score, attack model identification accuracy and perturbation bandwidth overhead.

[0100] The experimental results are shown in Table 1 and Table 2:

[0101] Table 1 Comparison of defense effects of different defense methods under the CW100 data set:

[0102]

[0103] As shown in Table 1, among all five defense methods, Moe-Gen not only has a significant advantage in defense performance, but also has lower bandwidth overhead and shorter training time overhead; specifically, Moe-Gen performs significantly better than the two traditional defense methods DFD and Walkie-Talkie in reducing accuracy, and Moe-Gen performs close to ALERT and AWA in reducing accuracy, but has a clear advantage in bandwidth overhead and training time overhead, for example, in defense against DF models, all three methods can reduce ACC to within 5%, but the bandwidth overhead of Moe-Gen (8.62%) is less than half of AWA (19.17%) and ALERT (17.84%).

[0104] Table 2 Defense effect of Moe-Gen under different website category sizes:

[0105]

[0106] As shown in Table 2, Moe-Gen not only has good defense effect in small category size scenarios, but also can still effectively defend against large website category size.

[0107] In addition, in order to verify the intervention effect of the application on suppressing disturbance concentrated insertion and improving traffic anonymity, the experiment additionally displays the distribution of virtual data packet insertion intensity in the disturbance vector on the burst sequence, and the result is shown in Figure 4 The horizontal axis of the distribution intensity diagram represents the burst sequence index inserted by the disturbance vector, and the vertical axis shows 10 randomly selected website category labels in the dataset, and the color depth of each position in the diagram represents the number of virtual data packets inserted by the disturbance vector in the corresponding burst position. It can be observed that the number of data packets inserted by the disturbance vector generated by the defense method of the application in a single burst is within 10, which indicates that the virtual data packets are uniformly distributed in the disturbance vector, ensuring the anonymity of the disturbance.

[0108] The application achieves comprehensive optimal performance in comprehensive defense effect, bandwidth overhead and defense time overhead. The heat map also verifies the guarantee of the application in defense dispersion.

[0109] The above merely describes the preferred embodiments of the present application, and is not intended to limit the present application in any form. Although the present application has been disclosed with the preferred embodiments as above, it is not intended to limit the present application. Any person skilled in the art can make some changes or modifications to the above disclosed technical content to obtain equivalent embodiments with equivalent changes, as long as the changes or modifications do not deviate from the technical solution of the present application. Any modification, change, equivalent change and modification of the above embodiments made according to the technical essence of the present application still belong to the scope of the technical solution of the present application.

Claims

1. A network fingerprinting defense method based on adaptive gating units, characterized in that, Includes the following steps: S1. Category information embedding and encoding to generate embedding vectors: This involves embedding the website category tags corresponding to the network traffic to be defended. The input is fed into the category embedding layer, and the category embedding vector is obtained through embedding encoding. ; S2. Generate candidate perturbation vectors: Sample random noise vectors from a preset distribution. and the random noise vector Input K expert perturbation generators, each of which outputs a candidate perturbation vector based on the learned flow perturbation pattern. ,in ; S3. Generate the gating selection vector: The embedded vector... The input is fed into the adaptive gating unit to generate a K-dimensional gating selection vector. The gate selection vector Used to represent the category labels of each expert perturbation generator. Contribution weight; S4. Perturbation-weighted selection: Based on the gated selection vector... For K candidate perturbation vectors The final defense perturbation vector is obtained by performing a weighted summation. ; S5, Disturbance Application: Apply the defensive disturbance vector It is applied to the network traffic to be defended, and an integer number of virtual packets are inserted in the uplink packet direction through a perturbation mask; S501. Set a mask matrix with the same dimension as the burst sequence of traffic. Each data point in the network traffic to be defended is marked, with uplink packets set to 1 and downlink packets set to 0. The defense perturbation vector is then used to... With mask matrix Multiply element by element to ensure that the disturbance is applied only to the upstream traffic; S502. Perform a rounding operation on each element in the perturbation vector after applying the mask to obtain the integer number of virtual data packet insertions.

2. The network fingerprinting defense method based on an adaptive gating unit according to claim 1, characterized in that, The category label is mapped to a [database] through embedding encoding. dimensional real vector embedding vector The embedding vector The expression is: ； in, express 3D real vector space, This indicates an embedding encoding operation.

3. The network fingerprinting defense method based on adaptive gating units according to claim 1, characterized in that, Step S2 specifically includes the following steps: S201, the noise vector Based on the preset standard normal distribution Sampled, And input to K expert perturbation generators; S202. Each expert perturbation generator includes a fully connected layer, a ReLU activation function, and a random deactivation layer. The expert perturbation generator applies a perturbation vector to the noise vector. Perform mapping and activation to generate candidate perturbation vectors. The expression is: ； in, Indicates the first A mapping function for an expert perturbation generator.

4. The network fingerprinting defense method based on an adaptive gating unit according to claim 1, characterized in that, The adaptive gating unit includes a fully connected layer and a Softmax activation layer; The embedding vector The input is fed into a fully connected layer to generate weight scores for each expert perturbation generator. These scores are then fed into a Softmax activation layer, where the Softmax temperature function normalizes the weight scores into a probability distribution to obtain the gating selection vector. The expression is: ； in, This represents the trainable parameters of the fully connected layer. This represents the temperature value of the Softmax activation layer, and the degree of dispersion of the probability distribution is controlled by a preset temperature coefficient.

5. A network fingerprinting defense method based on an adaptive gating unit according to claim 1, characterized in that, The final defense perturbation vector is obtained by weighted summation. The expression is: ； in, Represents the gating selection vector The Each element.

6. The network fingerprinting defense method based on an adaptive gating unit according to claim 1, characterized in that, It also includes a loss function for optimizing perturbation generation. The loss function Including classification loss, bandwidth overhead penalty, and perturbation dispersion constraint, the expression is: ； in, Represents classification loss, This indicates a bandwidth overhead penalty. This indicates a perturbation dispersion constraint. All of these represent weighting coefficients.

7. A network fingerprinting defense method based on an adaptive gating unit according to claim 6, characterized in that, The perturbation dispersion constraint The expression is: ； in, Indicates a penalty item. The perturbation vector is represented at the th The number of data packets inserted in a burst plan. This indicates the preset concentration threshold.

8. A network fingerprinting defense system based on an adaptive gating unit, employing the method described in any one of claims 1-7, characterized in that, It includes a category information embedding module, a candidate perturbation generation module, a gated vector generation module, a perturbation weighted selection module, and a perturbation application module, wherein the category information embedding module, the candidate perturbation generation module, the gated vector generation module, the perturbation weighted selection module, and the perturbation application module are connected in sequence; The category information embedding module is used to receive website category tags corresponding to the network traffic to be defended, and convert the category tags into embedding vectors through embedding encoding. The candidate perturbation generation module includes K expert perturbation generators with identical structures and independent parameters, which are used to receive random noise vectors sampled from a preset distribution, and each expert perturbation generator outputs a candidate perturbation vector. The gate vector generation module includes an adaptive gate unit, which receives the embedded vector and normalizes it through a fully connected layer and a Softmax activation layer to generate a gate selection vector corresponding to the expert perturbation generator. The perturbation weighted selection module performs a weighted summation of all candidate perturbation vectors based on the gating selection vector to obtain the final defense perturbation vector. The disturbance application module applies the final defense disturbance vector to the network traffic to be defended, restricts the disturbance to be applied only to the uplink traffic through masking operations, and then performs integer processing on the disturbance data.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for executing the network fingerprinting defense method based on an adaptive gating unit as described in any one of claims 1-7.

Images