Cross-position traffic shaping method, model training method and related equipment
By performing burst segmentation reconstruction on the downlink traffic of the Onion Router client, the problem of feature inconsistency in the cross-location traffic identification model is solved, achieving higher identification accuracy and consistency, and supporting deanonymization attacks on hidden services.
Patent Information
- Application Number
- CN202511289059.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-10
- Publication Date
- 2026-03-03
AI Technical Summary
In existing technologies, traffic fingerprinting models for cross-location traffic exhibit significant structural differences between training and testing scenarios, resulting in low recognition accuracy and difficulty in effectively supporting deanonymization attacks on hidden services.
By identifying burst segments in the downlink traffic of the Onion Router client, the underlying encapsulation logic of the Onion Router protocol is simulated for reconstruction, replacing the original burst segments, so as to align the reconstructed traffic with the target traffic characteristics and improve the consistency of cross-location traffic.
It improves the performance of the traffic fingerprinting model, enhances the accuracy and consistency of cross-location traffic identification, supports a wider range of practical applications, and has high identification accuracy and low false alarm capability, especially in hidden service tracing scenarios.
Smart Images
Figure CN121603446A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of communication technology, and in particular to a cross-location traffic shaping method, a model training method, and related equipment. Background Technology
[0002] It should be noted that the above description of the technical background is only for the purpose of providing a clear and complete explanation of the technical solutions of the present invention and facilitating understanding by those skilled in the art. It should not be assumed that the above technical solutions are known to those skilled in the art simply because they have been described in the background section of this invention.
[0003] The second-generation Onion Router (Tor) is an anonymous communication system that allows hidden services to provide services to users without exposing their Internet Protocol (IP) addresses through their top-level domain ".onion". However, Tor's anonymity also creates numerous security vulnerabilities. Therefore, identifying the IP addresses of specific hidden service domains is of significant research importance in combating deanonymization attacks on hidden services.
[0004] Among related technologies, traffic fingerprinting attacks and neural network techniques are combined to identify the real IP addresses of hidden services. Based on the attacker's location, these technologies can be divided into two categories: identifying hidden services accessed by Tor clients and tracing the origins of hidden services.
[0005] The second type of method, due to the difficulty in obtaining labeled hidden service traffic, often relies on alternative traffic to train the model. Furthermore, in these scenarios, training and testing traffic frequently utilize cross-location traffic data. However, current Tor traffic fingerprinting technologies have not studied cross-location traffic representation; cross-location traffic also exhibits variability, and cross-location traffic pairs can degrade the performance of traffic fingerprinting models. Therefore, improving the ability of traffic fingerprinting models to identify cross-location traffic has become an urgent problem to be solved. Summary of the Invention
[0006] In view of the above, the purpose of one or more embodiments of this disclosure is to provide a cross-location traffic shaping method, a model training method, and related equipment to solve the problems raised in the background art.
[0007] In a first aspect, one or more embodiments of this disclosure provide a cross-location traffic shaping method, including:
[0008] Collect downlink traffic generated when the proxy hidden service is successfully accessed through the Onion Router client;
[0009] Based on preset judgment conditions, burst segments in the downlink traffic are identified;
[0010] The underlying encapsulation logic of the simulated onion routing protocol is used to perform burst reconstruction on the burst segments to obtain reconstructed burst segments;
[0011] The reconstructed burst segment replaces the burst segment to align the reconstructed downlink traffic with the target downlink traffic characteristics, where the target downlink traffic is the downlink traffic generated by successfully accessing the target hidden service through the Onion Router client.
[0012] Optionally, based on preset judgment conditions, burst segments in the downlink traffic are identified, including:
[0013] Based on the fixed characteristics of control cells in the Onion routing protocol, identify control cells with boundary control functions in the downlink traffic;
[0014] Based on the location of the control cell, burst segments in the downlink traffic are identified.
[0015] Optionally, based on preset judgment conditions, burst segments in the downlink traffic are identified, including:
[0016] Calculate the arrival time difference between each data packet in the downlink traffic and the previous data packet;
[0017] In response to any of the time differences being greater than a preset threshold, the data packet is determined to be the starting data packet of a new burst segment;
[0018] In response to any time difference being less than or equal to a preset threshold, it is determined that the data packet and the previous data packet belong to the same burst segment.
[0019] Optionally, by simulating the underlying encapsulation logic of the Onion routing protocol, the burst segments are reconstructed to obtain reconstructed burst segments, including:
[0020] Count the TCP payload bytes in the burst segments;
[0021] Determine the default encapsulation rules of the Onion routing protocol that the downlink traffic generated by the target hidden service follows;
[0022] According to the encapsulation requirements, the payload bytes are re-encapsulated to obtain reconstructed burst segments.
[0023] Optionally, replacing the burst segment with the reconstructed burst segment includes:
[0024] Determine the start and end positions of the burst segment, as well as the start and end timestamps;
[0025] According to the start position and the end position, the burst segment is replaced by the reconstructed burst segment;
[0026] Based on the start timestamp and the end timestamp, a timestamp is reassigned to each data packet in the reconstructed burst segment.
[0027] Secondly, one or more embodiments of this disclosure also provide a cross-location flow shaping apparatus, comprising:
[0028] The data acquisition module is configured to collect downlink traffic generated when the proxy hidden service is successfully accessed through the Onion Router client;
[0029] The identification module is configured to identify burst segments in the downlink traffic based on preset judgment conditions;
[0030] The reconstructing module is configured to simulate the underlying encapsulation logic of the Onion routing protocol, and performs burst reconstruction on the burst segments to obtain reconstructed burst segments;
[0031] The embedded module is configured to replace the burst segment with the reconstructed burst segment to align the reconstructed downlink traffic with the target downlink traffic characteristics, wherein the target downlink traffic is the downlink traffic generated by successfully accessing the target hidden service through the Onion Router client.
[0032] Thirdly, one or more embodiments of this disclosure provide a model training method, including:
[0033] Collect the first downlink traffic generated by successfully accessing the proxy hidden service through the Onion Router client, and perform traffic shaping on the first downlink traffic using the cross-location traffic shaping method disclosed in the first aspect.
[0034] Collect secondary downlink traffic generated when the target hidden service is successfully accessed via the Onion Router client;
[0035] Using the first downlink traffic as training data and the second downlink traffic as test data, a neural network model is trained with the goal of minimizing the loss between the predicted labels of the training data and the true labels of the test data to obtain a traffic fingerprinting model.
[0036] Fourthly, one or more embodiments of this disclosure also provide a model training apparatus, including:
[0037] The first data preparation module is configured to collect the first downlink traffic generated by successfully accessing the proxy hidden service through the Onion Router client, and to perform traffic shaping on the first downlink traffic using the cross-location traffic shaping method disclosed in the first aspect.
[0038] The second data preparation module is configured to collect second downlink traffic generated by successful access to the target hidden service through the Onion Router client.
[0039] The training module is configured to use the first downlink traffic as training data and the second downlink traffic as test data to train a neural network model with the goal of minimizing the loss value between the predicted label of the training data and the true label of the test data, thereby obtaining a traffic fingerprinting model.
[0040] Fifthly, one or more embodiments of this disclosure also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the cross-location traffic shaping method and model training method as described in any of the preceding claims.
[0041] In a sixth aspect, one or more embodiments of this disclosure also provide a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute any of the cross-location flow shaping methods and model training methods described above.
[0042] One embodiment of the above-described embodiments of this disclosure has the following beneficial effects: Based on the differences in protocol encapsulation and data scheduling between different observation locations in the Tor network, the burst structure of traffic is identified and reconstructed, achieving feature alignment between downlink traffic generated by the proxy hiding service and downlink traffic generated by the target hiding service, thereby improving the consistent representation capability of cross-location traffic. Training and testing the traffic fingerprinting model based on the aforementioned cross-location traffic with consistent representation capability can further improve the performance of the traffic fingerprinting model. Attached Figure Description
[0043] To more clearly illustrate the technical solutions in one or more embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only one or more embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0044] Figure 1 This is a flowchart illustrating one or more embodiments of the cross-location flow shaping method disclosed herein;
[0045] Figure 2 This is a schematic diagram illustrating the parsing process of a relay node according to an embodiment of this disclosure;
[0046] Figure 3 This is a schematic diagram of a cross-location flow shaping process according to an embodiment of the present disclosure;
[0047] Figure 4 This is a schematic diagram comparing the flow shaping results of one embodiment of the present disclosure;
[0048] Figure 5 This is a schematic diagram of the structure of a cross-location flow shaping device according to one or more embodiments of the present disclosure;
[0049] Figure 6 This is a flowchart illustrating a model training method according to one or more embodiments of the present disclosure;
[0050] Figure 7 This is a schematic diagram of the structure of a model training apparatus according to one or more embodiments of the present disclosure;
[0051] Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to one or more embodiments of this disclosure. Detailed Implementation
[0052] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.
[0053] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar words used in one or more embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.
[0054] Second-generation Onion Routing is a circuit-based low-latency anonymous communication service. Based on end-to-end anonymous communication circuits and multi-layered encryption, it enables anonymous data forwarding between multiple nodes.
[0055] In the Tor network, the client first obtains a list of available relay nodes from the directory server, randomly selects multiple relay nodes as entry nodes, intermediate nodes, and exit nodes (hidden service access nodes), and constructs an encrypted communication circuit from the client to the hidden service. The client negotiates independent session keys with each relay node via the TLS protocol, forming a multi-layered key chain. Then, the client encapsulates the data to be transmitted into Tor cells and encrypts the innermost layer using the key of the exit node (hidden service access node) or the hidden service itself. Subsequently, the outer layers are encrypted sequentially using the keys of the intermediate nodes and the entry node, forming a multi-layered encrypted data structure. Throughout this process, each node only knows the address of the previous hop node, the address of the next hop node, and the inner layer encrypted data, making it impossible to trace the complete communication link, thus achieving anonymity.
[0056] As described in the background section, identifying the IP address of a specific hidden service domain name is of significant research importance in combating deanonymization attacks on hidden services.
[0057] Traffic fingerprinting is a viable deanonymization method. Depending on the attacker's location, traffic fingerprinting attacks can be categorized into client-side traffic fingerprinting attacks and hidden service-side traffic fingerprinting attacks. The first type of method identifies which hidden service a Tor client accesses by analyzing client-side traffic, while the second type traces the hidden service by analyzing traffic from the hidden service itself.
[0058] In related technologies, neural network techniques are often combined to improve deanonymization capabilities. For the second type of method, since it is impossible to obtain labeled hidden service traffic for model training, alternative traffic is typically used to train the model. For example, training can be achieved through hidden service mirror site traffic, client-side test traffic, or traffic proxied to the hidden service. The input traffic for the model in the training scenario and the input traffic in the actual application scenario come from different locations in the circuit; that is, the training traffic and the test traffic are cross-location traffic.
[0059] However, traffic varies across different locations in a circuit, and cross-location traffic pairs can degrade the performance of traffic fingerprinting models. For example, fingerprinting models trained using client-side traffic data will have significantly reduced accuracy when identifying traffic at Tor egress nodes or hidden services.
[0060] In other words, the traffic fingerprinting model trained by the relevant technology has insufficient generalization ability in cross-location scenarios, making it difficult to support effective deanonymization attacks. This limits its applicability and attack effectiveness in a wider range of practical applications, especially in hidden service book tracing scenarios.
[0061] In implementing this disclosure, the applicant discovered that the training effect of cross-location traffic fingerprinting models is limited. The core reason lies in the significant structural differences between training and testing data across locations. As mentioned above, traffic undergoes multiple layers of TLS encryption, Tor cell encapsulation, and TCP segmentation during transmission. Different nodes are at different processing stages, directly determining the differences in data structure. For example, the hidden server, acting as the data source, directly generates the original Tor cell, first encapsulating it into a TLS record according to the default TLS chunk, and then performing TCP segmentation according to MTU rules. The final data does not contain any extra non-MTU small packets. On the client side, as the data receiver, the received data is decrypted by intermediate nodes and affected by bandwidth fluctuations, so the received data may contain a small number of non-MTU fragments.
[0062] This difference in data structure means that the features learned by the traffic fingerprinting model on the training data cannot be adapted to the structure of the test data, resulting in the traffic fingerprinting model having a less than ideal accuracy in real-world applications.
[0063] Traffic representation is a traffic preprocessing method that extracts valid information from captured traffic files and converts it into a special data format as input to a model.
[0064] Therefore, some implementations of this disclosure provide a scheme for cross-location traffic shaping. In this scheme, for downlink traffic generated by an Onion Router client accessing a proxy hidden service, burst segments are identified based on preset judgment conditions. The burst segments are then reconstructed using the underlying encapsulation logic of the Onion Router protocol, and the reconstructed burst segments replace the original burst segments in the complete processing flow. Through this scheme, the reconstructed downlink traffic of the proxy hidden service aligns with the characteristics of the target hidden service's downlink traffic, laying the foundation for subsequent model training based on this reconstructed traffic and improving the accuracy of cross-location traffic identification in hidden service deanonymization attacks.
[0065] refer to Figure 1 The present disclosure discloses a cross-location traffic shaping method according to one or more embodiments, including the following steps:
[0066] Step S101: Collect downlink traffic generated by successfully accessing the proxy hidden service through the Onion Router client;
[0067] Step S102: Identify burst segments in the downlink traffic based on preset judgment conditions;
[0068] Step S103: Simulate the underlying encapsulation logic of the Onion routing protocol to perform burst reconstruction on the above burst segments to obtain reconstructed burst segments;
[0069] Step S104: Replace the above-mentioned burst segment with the reconstructed burst segment to achieve alignment of the reconstructed downlink traffic with the target downlink traffic characteristics. The target downlink traffic is the downlink traffic generated by successfully accessing the target hidden service through the Onion Router client.
[0070] It should be noted that, in order to further ensure the effectiveness of the traffic fingerprinting model, considering that the downlink traffic generated by the proxy hiding service and the downlink traffic generated by the target hiding service have higher similarity in structure and features, and that the downlink traffic generated by the proxy hiding service is easier to obtain and has a corresponding relationship, the downlink traffic generated by the proxy hiding service is selected as the traffic shaping object in the technical solution disclosed herein.
[0071] This disclosure does not limit the specific construction method of the proxy hiding service. As long as the proxy hiding service can implement the technical solution of this disclosure, its construction method is within the protection scope of the disclosure.
[0072] During data transmission, the data communicated between the client and the target hiding service needs to be forwarded through the proxy hiding service. Therefore, the proxy hiding service can obtain training traffic with tags (corresponding to the target hiding service). Considering that the uplink data packets are relatively sparse and scattered, making it difficult to form a continuous burst structure, and contributing little to the traffic content, this scheme collects downlink traffic.
[0073] In some implementations, a traffic capture tool for the proxy-hidden service can be started before the access begins, and then shut down after the access is complete.
[0074] In some embodiments, the traffic capture tool described above can be tcpdump.
[0075] In some implementations, to improve the traffic shaping effect, the collected downlink power can be further preprocessed.
[0076] The preprocessing process may include: First, the collected traffic data is split into five groups according to the tuple [TCP, source IP, source port, destination IP, destination port] to clarify the source and destination of different traffic; then, combined with the recorded entry node IP address, the traffic related to the target hidden service is filtered out to ensure that the training data is the core data associated with the target hidden service; finally, the payload sequence of TCP packets is extracted based on the filtered traffic, and this sequence is used as the object for subsequent traffic shaping.
[0077] In some embodiments, the IP address of the aforementioned entry node can be recorded via stem. If the access is successful, a traffic file is saved; otherwise, the traffic file is not recorded.
[0078] In this solution, burst segmentation refers to continuous message fragments in downlink traffic, which are different from scattered and isolated control messages. This type of data carries the core response data of the proxy hidden service.
[0079] In some implementations, identifying burst segments in the downlink traffic based on preset judgment conditions may include: identifying control cells with boundary control functions in the downlink traffic based on the fixed characteristics of control cells in the Tor protocol; and identifying burst segments in the downlink traffic based on the location of the control cells.
[0080] The Tor protocol contains control cells with fixed characteristics. For example, the sendme control cell used for congestion control, or relay_begin and relay_end control cells, have fixed lengths. The sendme control cell has a fixed length of 536 bytes, while relay_begin and relay_end control cells have a fixed length of 1050 bytes. These control cells can effectively identify burst segment boundaries in the aforementioned downlink traffic.
[0081] For example, the sendme control cell can be used to determine burst boundaries, collect all burst boundaries in the traffic, and determine a burst segment based on the data packets before each burst boundary and after the previous burst boundary.
[0082] For example, the relay_begin and relay_end control cells can be used to determine the start and end boundaries of a burst segment, collect all start and end boundaries of the traffic, and determine a burst segment based on the data packets in two adjacent start and end boundaries.
[0083] In some implementations, identifying burst segments in the downlink traffic based on preset judgment conditions may include: calculating the arrival time difference between each data packet in the downlink traffic and the previous data packet; determining that the data packet is the starting data packet of a new burst segment in response to any of the time differences being greater than a preset threshold; and determining that the data packet and the previous data packet belong to the same burst segment in response to any of the time differences being less than or equal to the preset threshold.
[0084] It should be noted that this disclosure can identify burst segments by using fixed feature control cells, or by using the time difference of arrival of data packets, or by using a combination of fixed feature control cells and time difference of arrival.
[0085] This disclosure does not impose specific limitations on the method for identifying sudden segmentation. Any method for identifying sudden segmentation that can be implemented is within the scope of protection of this disclosure.
[0086] The above threshold can be set according to the actual situation. For example, if the arrival time interval of two data packets observed by the observation node is affected by network jitter and latency to a greater extent, the above threshold can be increased.
[0087] The key point of this disclosed technical solution lies in identifying and reconstructing the traffic burst structure by deeply analyzing the differences in protocol encapsulation and data scheduling at different observation locations in the Tor network, aligning traffic characteristics from the protocol layer and transmission behavior layer, and achieving unified processing of collected traffic.
[0088] In the process of developing this disclosure, the applicant discovered that in a Tor network, relay nodes receive TLS-encrypted data from the previous hop relay via an underlying TCP channel. In actual communication, due to the limitation of TCP transmission by the Maximum Transmission Unit (MTU) (typically approximately 1500 bytes), the TLS record encapsulating a Tor cell may be fragmented into multiple TCP segments for transmission.
[0089] When a relay node receives only a partial fragment, it cannot decrypt the TLS record and therefore cannot determine whether it contains a complete Tor cell, nor can it perform cell parsing or processing operations. At this time, the relay node will temporarily store the received data in a TLS decryption buffer, waiting for subsequent fragments to complete the TLS record until a complete, decryptable data block is formed.
[0090] Once the complete TLS record arrives and is successfully decrypted, the relay node can parse the encapsulated Torcell. If the cell is of type RELAY and the current relay is not the exit node of the circuit, it means that the content of the cell is encrypted data, and the current relay does not need to decrypt its payload. At this time, the relay node will perform a symmetric encryption operation (i.e., Onion Forwarding) on the payload of the cell according to the routing state of the circuit, re-encapsulate it into a new Torcell, and then send it to the next relay node through the TLS connection corresponding to the circuit.
[0091] It should be noted that Tor limits the maximum length of a TLS record, and this maximum length may be used to slice cells. That is, a cell may be encapsulated in two adjacent TLS records.
[0092] like Figure 2As shown, in one embodiment, when a relay node receives the first complete TLS record, it can parse all the complete cells within it, but cannot parse the incomplete cells, and temporarily stores them in the TLS decryption buffer. The parsed complete cells are directly sent to the TLS send buffer, encrypted, and sent to the next node via TCP. During this process, a certain difference in the size of the TCP packets can be observed.
[0093] In other words, the downlink traffic generated by the target hiding service follows Tor's default TLS chunk (4096 bytes) encapsulation and MTU (approximately 1448 bytes) TCP segmentation rules, resulting in a regular packet payload sequence. Furthermore, the burst boundaries of the target hiding service traffic are clear, it is less affected by network jitter, and the packet sizes are relatively stable.
[0094] The traffic generated by the proxy hidden service is located in the middle proxy node of the Tor circuit. The fragmentation of the TLS decryption buffer will generate additional non-MTU small packets, resulting in a high proportion of abnormal small packets in the packet size distribution and an incomplete TLS hierarchy.
[0095] Therefore, the technical solution disclosed herein reconstructs the downlink traffic generated by the proxy hiding service by performing burst segmentation, so as to align its traffic characteristics with those of the downlink traffic generated by the target hiding service.
[0096] In some implementations, the underlying encapsulation logic of the Onion routing protocol is simulated to perform burst reconstruction on the burst segments to obtain reconstructed burst segments. This may include: counting the TCP payload bytes in the burst segments; determining the default encapsulation rules of the Onion routing protocol followed by the downlink traffic generated by the target hidden service; and re-encapsulating the payload bytes according to the above encapsulation requirements to obtain reconstructed burst segments.
[0097] For example, firstly, for each burst segment, its TCP payload bytes are counted. Then, based on the TLS chunk encapsulation strategy enabled by default in OpenSSL by the Tor network, the burst byte stream is divided into multiple TLS records. The size of each TLS record is set to the default chunk size (e.g., 4096 bytes) to simulate the process of data streams in Tor being split into small chunks for encapsulation at the TLS layer. Simulated TCP segmentation is then performed on each TLS record, dividing it into equal-length segments according to the MTU size until the remaining portion is less than one MTU, at which point the last TCP segment length is less than the MTU. The reconstructed burst segments are output, each consisting of several TCP packets conforming to the MTU segmentation rules. The payload content of each packet simulates the linkage between TLS encapsulation and TCP segmentation in Tor, significantly improving the protocol consistency of proxy traffic in terms of statistical characteristics, packet size distribution, and TLS hierarchy.
[0098] The reconstructed burst segment replaces the original burst segment in the TCP payload sequence. In other words, the reconstructed burst segment will be rewritten in the original burst segment's position as part of the payload size sequence for subsequent model training.
[0099] In some implementations, the number of reconstructed burst packets may differ from the original number of burst packets. Therefore, it is necessary to reallocate a reasonable timestamp for each reconstructed packet to maintain the temporal continuity within the burst segment and the overall traffic rhythm. For this purpose, this embodiment uses linear interpolation to reallocate timestamps.
[0100] In other words, replacing the aforementioned burst segment with the reconstructed burst segment can include: determining the start position, end position, start timestamp, and end timestamp of the burst segment; replacing the burst segment with the reconstructed burst segment according to the start position and the end position; and reallocating timestamps for each data packet in the reconstructed burst segment according to the start timestamp and the end timestamp.
[0101] like Figure 3As shown, in some embodiments, the process of traffic shaping for cross-location traffic includes: identifying burst boundaries in the downlink traffic sequence, using typical control cell lengths in the Tor protocol (e.g., 536 bytes and 1050 bytes) and fixed time intervals (e.g., 0.05s or 0.1s) as boundaries; segmenting the total number of bytes in the burst traffic according to the Tor default TLS chunk encapsulation strategy (e.g., 4096 bytes), and reconstructing it by simulating TCP segmentation behavior to form a new packet sequence; embedding the reconstructed burst sequence into the original traffic and performing timestamp reallocation to maintain the temporal consistency of the traffic. This process effectively eliminates additional non-MTU small packets and segmentation biases in PHST, making it closer to the protocol performance of HST.
[0102] Figure 4 This paper compares the downlink traffic of the target hiding service and the proxy hiding service before and after the shaping process described in this disclosure. It can be seen that the difference between the downlink traffic of the proxy hiding service and the target hiding service is reduced after the shaping process using this solution.
[0103] refer to Figure 5 The present disclosure discloses a model training method according to one or more embodiments, including the following steps:
[0104] Step S501: Collect the first downlink traffic generated by successfully accessing the proxy hidden service through the Onion Router client, and perform traffic shaping on the first downlink traffic by any of the methods in steps S101-S104.
[0105] Step S502: Collect the second downlink traffic generated by successfully accessing the target hidden service through the Onion Router client;
[0106] Step S503: Using the first downlink traffic as training data and the second downlink traffic as test data, the neural network model is trained with the goal of minimizing the loss between the predicted label of the training data and the true label of the test data to obtain the traffic fingerprint recognition model.
[0107] In some embodiments, the neural network model described above may be a convolutional neural network, a variational convolutional network, or a deep autoencoder, etc. This disclosure does not limit the choice of neural network; all neural network models capable of implementing the technical solutions of this disclosure are within the protection scope of this disclosure.
[0108] To verify the technical effectiveness of this disclosed solution, the applicant conducted a series of experiments. These experiments used a self-constructed dataset, LCO-dataset, for systematic evaluation, covering both closed and open-world scenarios to ensure the generalizability and reliability of the evaluation results.
[0109] Table 1. Dataset Size
[0110] Closed-world Open-world Proxy-hidden service traffic (training traffic) 16,159 204 Hidden service traffic (test traffic) 14988 3540
[0111] Table 1 shows the dataset size for the experiment. The LCO-dataset (Large-scale Closed and Open-world Scenario Dataset) covers 103 hidden services and can be used to evaluate the generalization ability of the shaping mechanism in large-scale real-world deployments. The dataset includes: PHST (proxy traffic training set) and HST (real traffic test set). In the open-world setting, traffic samples from 2,800 non-target HSs are used to simulate unlabeled background traffic in reality.
[0112] A fingerprint model is constructed using deep learning methods, and the evaluation metrics are defined as follows:
[0113]
[0114] The experimental results of different models under closed world conditions after using the original flow representation and the consistent flow representation are shown in Table 2.
[0115] Table 2
[0116]
[0117]
[0118] The experimental results of the same model under different flow representations in a closed world are shown in Table 3.
[0119] Table 3
[0120] sequence accuracy Accuracy Recall rate F1 Original message size sequence 0.7184 0.7079 0.7024 0.6744 Message size only 0.6433 0.6307 0.6188 0.5799 Message size sum sequence 0.493 0.5088 0.4846 0.5678 Burst Sequence 0.5614 0.5639 0.5434 0.5029 Data Augmentation 0.4582 0.5077 0.4561 0.4256 Consistent flow representation sequence 0.8534 0.8398 0.8264 0.8119
[0121] The experimental results in the open world are shown in Table 4.
[0122]
[0123] The experimental results show that the proposed solution is architecture-independent and has good generalization ability. The proposed shaping method can be seamlessly embedded into various deep model structures and exhibits good performance in large-scale open worlds. It has versatility and deployment value. It has high recognition accuracy and low false alarm capability, with Top-1 accuracy improved by more than 15%, F1 score significantly improved, and open world recognition accuracy maintained above 60%. It can effectively support the deanonymization of hidden services.
[0124] Therefore, the technical solution disclosed herein has the following technical effects: it can ensure data and protocol consistency; by analyzing the differences in Tor traffic encapsulation structure and response strategy, it relies on the burst reconstruction mechanism to perform structural alignment on non-MTU bursts, thereby significantly improving traffic representation consistency. Furthermore, it has strong cross-location adaptability, does not require access to the target hidden service, and can build a robust fingerprint model solely with the help of proxy traffic, effectively overcoming the limitation of existing methods that rely on target data.
[0125] It is understandable that this method can be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities.
[0126] It should be noted that the methods of one or more embodiments of this disclosure can be executed by a single device, such as a computer or server. The methods of this embodiment can also be applied in a distributed scenario, where multiple devices cooperate to complete the process. In such a distributed scenario, one of these devices may execute only one or more steps of the methods of one or more embodiments of this disclosure, and the multiple devices will interact with each other to complete the method described.
[0127] It should be noted that the above description pertains to specific embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.
[0128] Corresponding to any of the methods in the above embodiments, this disclosure also provides a cross-location flow shaping device. For example... Figure 6 As shown, it includes:
[0129] Data acquisition module 11 is configured to collect downlink traffic generated when the proxy hidden service is successfully accessed through the Onion Router client;
[0130] The identification module 12 is configured to identify burst segments in the downlink traffic based on preset judgment conditions;
[0131] The reconstruction module 13 is configured to simulate the underlying encapsulation logic of the Onion routing protocol and perform burst reconstruction on the burst segments to obtain reconstructed burst segments;
[0132] Embedded module 14 is configured to replace the burst segment with the reconstructed burst segment in order to align the reconstructed downlink traffic with the target downlink traffic characteristics, wherein the target downlink traffic is the downlink traffic generated by successfully accessing the target hidden service through the Onion Router client.
[0133] Optionally, the recognition module 12 is specifically configured as follows:
[0134] Based on the fixed characteristics of control cells in the Onion routing protocol, identify control cells with boundary control functions in the downlink traffic;
[0135] Based on the location of the control cell, burst segments in the downlink traffic are identified.
[0136] Optionally, the recognition module 12 is specifically configured as follows:
[0137] Calculate the arrival time difference between each data packet in the downlink traffic and the previous data packet;
[0138] In response to any of the time differences being greater than a preset threshold, the data packet is determined to be the starting data packet of a new burst segment;
[0139] In response to any time difference being less than or equal to a preset threshold, it is determined that the data packet and the previous data packet belong to the same burst segment.
[0140] Optionally, refactoring module 13 is specifically configured as follows:
[0141] Count the TCP payload bytes in the burst segments;
[0142] Determine the default encapsulation rules of the Onion routing protocol that the downlink traffic generated by the target hidden service follows;
[0143] According to the encapsulation requirements, the payload bytes are re-encapsulated to obtain reconstructed burst segments.
[0144] Optionally, the embedded module 14 is specifically configured as follows:
[0145] Determine the start and end positions of the burst segment, as well as the start and end timestamps;
[0146] According to the start position and the end position, the burst segment is replaced by the reconstructed burst segment;
[0147] Based on the start timestamp and the end timestamp, a timestamp is reassigned to each data packet in the reconstructed burst segment.
[0148] Corresponding to any of the methods in the above embodiments, this disclosure also provides a model training apparatus. For example... Figure 7 As shown, it includes:
[0149] The first data preparation module 21 is configured to collect the first downlink traffic generated by successfully accessing the proxy hiding service through the Onion Router client, and perform traffic shaping on the first downlink traffic by any of the methods described in steps S101-S104.
[0150] The second data preparation module 22 is configured to collect second downlink traffic generated by successful access to the target hidden service through the Onion Router client.
[0151] Training module 23 is configured to use the first downlink traffic as training data and the second downlink traffic as test data to train a neural network model with the goal of minimizing the loss value between the predicted label of the training data and the true label of the test data, thereby obtaining a traffic fingerprinting model.
[0152] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, when implementing one or more embodiments of this disclosure, the functions of each module can be implemented in one or more software and / or hardware.
[0153] The apparatus described above is used to implement the corresponding methods in the foregoing embodiments and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.
[0154] Figure 8 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.
[0155] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this disclosure.
[0156] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this disclosure are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.
[0157] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.
[0158] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).
[0159] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.
[0160] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this disclosure, and not necessarily all the components shown in the figures.
[0161] The electronic devices described above are used to implement the corresponding methods in the foregoing embodiments and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.
[0162] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.
[0163] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.
[0164] Additionally, to simplify the description and discussion, and to avoid obscuring one or more embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring one or more embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which one or more embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuitry) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that one or more embodiments of this disclosure may be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.
[0165] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.
[0166] This disclosure includes one or more embodiments intended to cover all such substitutions, modifications, and variations falling within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this disclosure should be included within the scope of protection of this disclosure.
Claims
1. A method for cross-location flow shaping, characterized in that, include: Collect downlink traffic generated when the proxy hidden service is successfully accessed through the Onion Router client; Based on preset judgment conditions, burst segments in the downlink traffic are identified; The underlying encapsulation logic of the simulated onion routing protocol is used to perform burst reconstruction on the burst segments to obtain reconstructed burst segments; The reconstructed burst segment replaces the burst segment to align the reconstructed downlink traffic with the target downlink traffic characteristics, where the target downlink traffic is the downlink traffic generated by successfully accessing the target hidden service through the Onion Router client.
2. The method according to claim 1, characterized in that, Based on preset judgment conditions, identify burst segments in the downlink traffic, including: Based on the fixed characteristics of control cells in the Onion routing protocol, identify control cells with boundary control functions in the downlink traffic; Based on the location of the control cell, burst segments in the downlink traffic are identified.
3. The method according to claim 1, characterized in that, Based on preset judgment conditions, identify burst segments in the downlink traffic, including: Calculate the arrival time difference between each data packet in the downlink traffic and the previous data packet; In response to any of the time differences being greater than a preset threshold, the data packet is determined to be the starting data packet of a new burst segment; In response to any time difference being less than or equal to a preset threshold, it is determined that the data packet and the previous data packet belong to the same burst segment.
4. The method according to claim 1, characterized in that, Simulating the underlying encapsulation logic of the Onion routing protocol, the burst segments are reconstructed to obtain reconstructed burst segments, including: Count the TCP payload bytes in the burst segments; Determine the default encapsulation rules of the Onion routing protocol that the downlink traffic generated by the target hidden service follows; According to the encapsulation requirements, the payload bytes are re-encapsulated to obtain reconstructed burst segments.
5. The method according to claim 1, characterized in that, Replacing the burst segment with the reconstructed burst segment includes: Determine the start and end positions of the burst segment, as well as the start and end timestamps; According to the start position and the end position, the burst segment is replaced by the reconstructed burst segment; Based on the start timestamp and the end timestamp, a timestamp is reassigned to each data packet in the reconstructed burst segment.
6. A model training method, characterized in that, include: Collect the first downlink traffic generated by successfully accessing the proxy hiding service through the Onion Router client, and perform traffic shaping on the first downlink traffic using any of the methods described in claims 1-5; Collect secondary downlink traffic generated when the target hidden service is successfully accessed via the Onion Router client; Using the first downlink traffic as training data and the second downlink traffic as test data, a neural network model is trained with the goal of minimizing the loss between the predicted labels of the training data and the true labels of the test data to obtain a traffic fingerprinting model.
7. A cross-location flow shaping device, characterized in that, include: The data acquisition module is configured to collect downlink traffic generated when the proxy hidden service is successfully accessed through the Onion Router client; The identification module is configured to identify burst segments in the downlink traffic based on preset judgment conditions; The reconstructing module is configured to simulate the underlying encapsulation logic of the Onion routing protocol, and performs burst reconstruction on the burst segments to obtain reconstructed burst segments; The embedded module is configured to replace the burst segment with the reconstructed burst segment to align the reconstructed downlink traffic with the target downlink traffic characteristics, wherein the target downlink traffic is the downlink traffic generated by successfully accessing the target hidden service through the Onion Router client.
8. A model training device, characterized in that, include: The first data preparation module is configured to collect the first downlink traffic generated by successfully accessing the proxy hiding service through the Onion Router client, and perform traffic shaping on the first downlink traffic using any of the methods described in claims 1-5. The second data preparation module is configured to collect second downlink traffic generated by successful access to the target hidden service through the Onion Router client. The training module is configured to use the first downlink traffic as training data and the second downlink traffic as test data to train a neural network model with the goal of minimizing the loss value between the predicted label of the training data and the true label of the test data, thereby obtaining a traffic fingerprinting model.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executed by the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 6.
10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions for causing the computer to perform the method of any one of claims 1 to 6.