Tor network traffic dynamic perception identification method and system
By constructing a node network and learning information branch graphs, quantifying information discrete values and reference weights, and combining grayscale images and attention mechanisms to train the Tor traffic classification network, the problem of redundant information interference in the Tor network traffic recognition model is solved, achieving stable and accurate dynamic perception.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-28
- Publication Date
- 2026-03-13
AI Technical Summary
Existing Tor network traffic identification models suffer from redundant information during the learning process due to the variability of traffic, which affects the accuracy and stability of model updates, especially when user behavior patterns change, making them prone to identification errors.
By constructing a node network and learning information branch graphs, the discrete values of information in the branch transmission stage are quantified. By combining reference weights and saliency correction coefficients, a learning information saliency map is constructed, and the saliency map is adjusted under the updated dataset. The Tor traffic classification network is trained using grayscale images and attention mechanisms to reduce redundant information interference during the training process.
This technology reduces redundant information bias during the training process in Tor network traffic identification, ensuring the model maintains stability and accuracy in dynamic environments, dynamically sensing changes in Tor traffic, and improving identification accuracy.
Smart Images
Figure CN121664675A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data transmission technology, specifically to a method and system for dynamic sensing and identification of Tor network traffic. Background Technology
[0002] Tor (The Onion Router) is one of the most popular and mature anonymous communication systems, designed to protect users' network activity privacy and location information, and prevent network monitoring and traffic analysis. However, Tor's strong anonymity also makes it a breeding ground for network attacks and malware propagation, thus requiring accurate identification of Tor traffic. Deep learning models can automatically learn deep, complex, and potentially dynamic patterns directly from raw network traffic data (such as packet size sequences, timing information, byte distribution, handshake packet characteristics, etc.), without relying on fragile manual feature engineering. This is better suited to the encrypted and masquerading characteristics of Tor traffic.
[0003] In building a Tor network recognition model, it's crucial to accurately learn the dynamic changes in traffic characteristics, especially variations in user behavior patterns. However, during training, due to the variability of network traffic, the model may learn a lot of useless information, potentially mimicking normal network traffic, leading to errors in Tor network traffic identification. Furthermore, as the number of users increases, the Tor network recognition model continuously learns new content, often requiring online learning to constantly update model parameters. Redundant information during training can also cause deviations in the parameter update process. Summary of the Invention
[0004] This invention provides a method and system for dynamic sensing and identification of Tor network traffic, to solve the problem that the variability of Tor network traffic generates redundant information, which affects the learning and updating of neural networks and causes deviations. The specific technical solution adopted is as follows: This invention proposes a method for dynamic perception and identification of Tor network traffic, which includes the following steps: The network data structure is analyzed based on the publicly available ISCX dataset, and several time-series data subsets are obtained. An initial dataset and several updated datasets are constructed, and several data attributes in the initial dataset are recorded. The dataset contains several types of traffic. A node network is constructed based on the network data structure of the initial dataset, and several analytical attributes are extracted. Under the same traffic type, a learning information branch map of each entry node is constructed based on the branches connected to the entry nodes in the node network. The data differences between the analytical attributes of adjacent pixels in the same row of pixels in the learning information branch map are analyzed to obtain the information discrete values of each branch in each transmission stage. Based on the connection relationship of the nodes corresponding to each transmission stage in each branch in the learning information branch diagram, the reference weight of each transmission stage in each branch is determined; combined with the data differences of each analysis attribute between different branches in the learning information branch diagram, the salience correction coefficient of each branch is obtained; the information discrete value is adjusted to obtain the information salience value of each transmission stage in each branch, and the learning information salience map of each entry node is constructed. The Tor traffic classification network is trained by updating the learning information saliency map based on the updated dataset and constructing grayscale images. The grayscale image and learning information saliency map corresponding to the traffic to be detected are input into the trained network for dynamic perception and recognition.
[0005] Optionally, the specific methods for constructing a node network based on the centralized network data structure of the initial dataset and extracting several analytical attributes include: Given the network data structure in the initial dataset, determine the connection order between the source node and the destination node, connect several nodes according to the connection order, and construct a node network; then extract user nodes, transmission nodes, and access nodes from the node network, with user nodes serving as entry nodes and directly connected to transmission nodes; The data attribute containing the amount of data transmitted is used as the analysis attribute; the data of each analysis attribute is standardized.
[0006] Optionally, the specific method for constructing the learning information branch graph of each entry node includes: Based on any traffic type in the initial dataset, for any entry node in the node network, obtain several branches that lead to the access nodes. Each branch is treated as a row of pixels, and the transmission nodes in the same branch are arranged from left to right as pixels to obtain the learning information branch map of the entry node.
[0007] Optionally, the discrete values of information for each branch at each transmission stage are obtained using the following method: For any two adjacent pixels in any branch of the learning information branch graph of any entry node, which correspond to a transmission stage in that branch, obtain the data of any analysis attribute in that transmission stage, and obtain the average data of that analysis attribute in each transmission stage of the learning information branch graph. The absolute value of the difference between the data of the analysis attribute in the transmission stage and the mean of the data is taken as the data discrete value of the analysis attribute in the transmission stage; the mean of the data discrete values of all analysis attributes in the transmission stage is taken as the information discrete value of the transmission stage for the branch.
[0008] Optionally, the reference weights for each transmission stage of each branch are obtained using the following method: For any transmission stage in any branch of the learning information branch graph of any entry node, the two adjacent pixels of the transmission stage in the learning information branch graph correspond to a source node and a destination node in the node network. The number of destination nodes connected to the source node is obtained as the number of connections of the source node. The ratio of the number of connections of the source node to the maximum number of connections of all nodes in the node network other than user nodes and access nodes that are source nodes is used as the branch influence factor of the transmission stage. The difference between 1 and the branch influence factor is used as the reference weight of the transmission stage of the branch.
[0009] Optionally, the specific method for obtaining the protrusion correction coefficients for each branch includes: For any branch in the learning information branch graph of any entry node, take all other branches in the learning information branch graph except for that branch as the comparison branch of that branch, obtain the data of each analysis attribute in the same transmission stage of that branch and any comparison branch, and construct the data sequence of each analysis attribute of that branch in the transmission stage, as well as the data sequence of each analysis attribute of that comparison branch in the transmission stage. Take the Pearson correlation coefficient of the two data sequences as the correlation coefficient between that branch and that comparison branch in the transmission stage. Using the reference weights of each transmission stage of the branch, the correlation coefficients of the branch and each comparison branch in that transmission stage are weighted and averaged. The result is used as the transmission correlation coefficient between the branch and the comparison branch. The transmission correlation coefficients of the branch and each comparison branch are obtained, and the standard deviation of all transmission correlation coefficients is used as the prominence correction coefficient of the branch.
[0010] Optionally, the specific method for obtaining the information salience values of each branch at each transmission stage and constructing the learning information saliency map of each entry node includes: For any transmission stage in any branch of the learning information branch graph of any entry node, the sum of the prominence correction coefficient of that branch plus 1 is multiplied by the discrete information value of that transmission stage of that branch, and the information prominence value of that transmission stage is used as the prominence value of that transmission stage of that branch. The information prominence value of that transmission stage is used as the significance value of the next pixel among the two adjacent pixels of that transmission stage. Obtain the saliency value of each pixel in the learning information branch graph, and use the sum of the pixel value and the saliency value of the corresponding pixel as the updated pixel value. The learning information branch graph obtained after updating the pixel values of all pixels is used as the learning information saliency graph of the entry node.
[0011] Optionally, the method for updating the saliency map of the learned information based on the updated dataset includes: In the initial dataset, principal component analysis is performed on all data attributes, and the principal components with the highest number of principal components are selected as the data dimensions for classification. Each user is then classified based on these data dimensions to obtain several user categories. After treating the users in the updated dataset as new users and obtaining the saliency map of the learning information of the new users, for any new user, after adding a transmission data, calculate the Euclidean distance between the new user and the center of each user category. For any user category, obtain the Euclidean distance between the newly added user and the center of the user category after each additional data transmission. Subtract the previous Euclidean distance from the next Euclidean distance to obtain the difference. If the difference is greater than or equal to 0, mark the number of data transmissions corresponding to the next Euclidean distance as 1. If the difference is less than 0, mark it as -1. For each instance of data transmission for a new user under this user category, the marker value of the transmission process corresponding to the data transmission for each instance whose marker value is different from the previous marker value is marked as an adjustment branch, thus obtaining several adjustment branches under this user category. Obtain several adjustment branches for the new user, and arrange the adjustment branches in order of increasing the transmission data. In the learning information saliency map of the new user, adjust the adjustment branches one by one in order. The adjustment process is to update the pixel value of all pixels in the adjustment branch to the maximum pixel value in the current learning information saliency map of the new user.
[0012] Optionally, the specific method for constructing grayscale images based on the learned information saliency map for each data attribute includes: For any entry node's learning information branch graph and any data attribute, the data of that data attribute in any transmission stage of any branch in the learning information branch graph is used as the updated pixel value of the next pixel among the two adjacent pixels in that transmission stage. The updated pixel values of each pixel in the learning information branch graph are obtained, and the image composed of the updated pixel values of all pixels is used as the grayscale image of that data attribute of the entry node.
[0013] The present invention also proposes a Tor network traffic dynamic sensing and identification system, which includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the above method.
[0014] The beneficial effects of this invention are as follows: After constructing a node network based on a network data structure, this invention extracts analytical attributes that can reflect changes in transmitted data during branch transmission for subsequent branch analysis; based on the branches of the node network, a learning information branch graph is constructed, representing the Tor routing process accessed by users in the node network in the form of an image matrix; and based on the data differences of analytical attributes in the transmission stages of the branches, the information discrete value of the transmission stages in the branches is quantified, initially reflecting the salience of the transmission stages; by analyzing the branches in the transmission stages of the branches, it is ensured that smaller branches have greater reference weight while maintaining stability, and the correlation between the data changes of analytical attributes between branches and other branches is weighted and analyzed, thereby quantifying the correlation between branches and other branches. The regularity of relationships necessitates that branches with less regularity require greater adjustment of information discrete values, meaning they need to ensure the learning of relevant information in subsequent processes. This allows for the construction of a learned information saliency map based on the learned information branch map. After constructing learned information saliency maps for a large number of users in the initial dataset, the learned information saliency maps are further updated for new users and transmitted data based on the updated dataset. This serves as the basis for the attention map in network training. Simultaneously, grayscale images are constructed from the data attributes of each user. Through the attention mechanism, the Tor traffic classification network learns more relevant information about Tor traffic analysis, thereby reducing the bias interference of redundant information in the training process. Ultimately, this achieves dynamic perception of Tor network traffic based on deep learning. Attached Figure Description
[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0016] Figure 1 This is a schematic diagram of a Tor network traffic dynamic sensing and identification method according to an embodiment of the present invention; Figure 2 This is a diagram illustrating the Tor routing access mechanism. Detailed Implementation
[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0018] Please see Figure 1 The diagram illustrates a flowchart of a Tor network traffic dynamic sensing and identification method according to an embodiment of the present invention. The method includes the following steps: Step S001: Based on the publicly available ISCX dataset, parse the network data structure, divide it into several time series data subsets, construct the initial dataset and several updated datasets, and record several data attributes in the initial dataset.
[0019] The purpose of this embodiment is to train a dynamic perception network using user data attributes after parsing the network data structure in the publicly available ISCX dataset, thereby constructing a Tor traffic perception network. First, it is necessary to acquire the ISCX dataset and extract the initial dataset and the updated dataset. At the same time, through parsing the network data structure, several user data attributes are extracted.
[0020] Specifically, the publicly available ISCX dataset is obtained as the data for analysis. The dataset mainly consists of network packet structures. The data information in the network data structure is parsed to obtain several data attributes, including "appName", "totalSourceBytes", "totalDestinationBytes", "totalDestinationPackets", "totalSourcePackets", "sourcePayloadAsBase64", "destinationPayloadAsUTF", "direction", "sourceTCPFlagsDescription", "Source IP Address", and "DestinationIP Address", etc. This embodiment does not impose specific limitations.
[0021] It should be further noted that the ISCX dataset includes Tor network traffic as well as regular traffic, which can be divided into various categories, including web browsing, email, chat, video playback, file transfer, VoIP, and P2P.
[0022] Furthermore, based on the chronological order of the time labels in the dataset, several data subsets are divided (the data in multiple data subsets are not duplicated). The dataset is divided into two-thirds of the data subsets in the time series as the initial dataset, and the remaining one-third is also divided into 20 equal parts in the time series as several update datasets in the incremental learning process.
[0023] Step S002: Construct a node network based on the network data structure of the initial dataset and extract several analysis attributes; under the same traffic type, construct the learning information branch map of each entry node according to the branches connected by the entry nodes in the node network; analyze the data differences between the analysis attributes of adjacent pixels in the same row of pixels in the learning information branch map corresponding to the transmission stage, and obtain the information discrete value of each branch in each transmission stage.
[0024] Preferably, in one embodiment of the present invention, a node network is constructed based on the network data structure of the initial dataset, and several analytical attributes are extracted, including the following specific methods: It should be noted that the Tor routing mechanism mainly constructs the node network by randomly selecting several onion routers as transmission nodes in the network, encrypting the data at the nodes it passes through, and based on the data attributes in the initial dataset.
[0025] Specifically, for the network data structure in the initial dataset, a node network is constructed based on the time sequence of data packet transmission. User nodes, transmission nodes, and access nodes are extracted from the node network. User nodes serve as entry nodes (i.e., traffic initiators), and access nodes serve as exit nodes. It should be noted that due to the anonymity of the Tor network, physical relay routes cannot be directly detected; therefore, this embodiment maps time-series data segments during traffic transmission to logical transmission nodes.
[0026] Specifically, the complete traffic data transmission sequence is divided into several consecutive transmission stages according to a preset granularity (such as time window or number of data packets). Each transmission stage corresponds to a transmission node (i.e., a virtual transmission node) in the node network. In this case, the connectivity in the node network represents the state evolution of traffic at different time slices, rather than the physical routing hop count. Therefore, whether it is a public dataset or unknown traffic to be detected, transmission node information can be stably extracted based on temporal characteristics.
[0027] Access node is Figure 2 The surface of the website; Figure 2The system includes entry nodes consisting of users and Tor proxies, gateways that capture traffic, and then several relay onion routers in the Tor network that provide hidden services and access aggregation points. Surface websites are the access nodes. The Tor routing access mechanism allows users to access hidden services through Tor, or access surface websites through Tor, or directly access surface websites without going through the Tor network.
[0028] Furthermore, among the several data attributes obtained from parsing the network data structure, several data attributes such as "totalSourceBytes", "totalDestinationBytes", "totalDestinationPackets", and "totalSourcePackets" contain the size of the transmitted data. Other data attributes are format information or data flow direction, etc. The data attribute containing the size of the transmitted data is used as the analysis attribute, and its corresponding data is the transmitted data volume. The data of each analysis attribute is standardized, that is, the data of each analysis attribute is linearly normalized. In the subsequent analysis process, the normalized value of the data of each analysis attribute is used as the corresponding data to eliminate the influence of units.
[0029] It should be further explained that, since it is necessary to establish an attention mechanism graph for each user's learning process under the same traffic type, it is necessary to construct an attention graph in the form of an image matrix. As an entry node, a user can reach the access node through multiple branches in the Tor network. Therefore, an image matrix is constructed for each user's entry node based on the branches, with one row representing one branch. The transmission nodes in the branch are represented as pixels in the same row. Then, multiple branches are arranged row by row to form a learning information branch graph.
[0030] Preferably, in one embodiment of the present invention, under the same traffic type, a learning information branch graph of each entry node is constructed based on the branches connected to the entry nodes in the node network. The specific method includes: Based on any traffic type in the initial dataset, for any entry node in the node network, obtain several branches that lead to the access nodes. Each branch is treated as a row of pixels, and the transmission nodes in the same branch are arranged from left to right as pixels, thus obtaining the learning information branch map of the entry node; where the pixel value of each pixel in the learning information branch map is set to 0.
[0031] It should be further explained that by analyzing the data of the transmission stages of adjacent pixels in the branch, the smaller the data dispersion value of multiple analysis attributes, the smaller the change of the source node to the destination node, and the more uniform it is. On the other hand, if the data dispersion value of the analysis attributes is larger, the change of the source node after each hop is uneven, the prominence of it relative to the destination node is greater, and the information dispersion value is larger.
[0032] Preferably, in one embodiment of the present invention, the method for analyzing the data differences between the analytical attributes of adjacent pixels in the same row of pixels in each branch of the learning information branch graph at the corresponding transmission stage, and obtaining the information discrete values of each branch at each transmission stage, includes: For any two adjacent pixels in any branch of the learning information branch graph of any entry node, corresponding to a transmission stage in that branch, obtain the data of any analysis attribute in that transmission stage (the normalized value of the data amount transmitted for the corresponding analysis attribute), obtain the mean value of the data of that analysis attribute in each transmission stage of the learning information branch graph; take the absolute value of the difference between the data of that analysis attribute in that transmission stage and the mean value of the data as the discrete value of the data of that analysis attribute in that transmission stage; take the mean value of the discrete values of the data of all analysis attributes in that transmission stage as the discrete value of the information of that branch in that transmission stage.
[0033] It should be noted that since the source node and destination node corresponding to the transmission stage in a branch may also correspond to other transmission stages, i.e., they are in different branches, it is necessary to perform separate analysis of multiple analytical attributes for the transmission stage. The larger the information discrete value, the more prominent it is in that branch, and the more it needs to be learned in the subsequent learning process. The joint analysis of multiple analytical attributes eliminates the problem of information changes caused by possible user interaction habits.
[0034] Thus, after constructing the node network based on the network data structure, the analytical attributes that can reflect the changes in transmitted data during the branch transmission process are extracted for subsequent branch analysis. Based on the branches of the node network, a learning information branch graph is constructed, and the Tor routing process accessed by users in the node network is represented in the form of an image matrix. Based on the data differences of the analytical attributes in the transmission stage of the branch, the information discrete value of the transmission stage in the branch is quantified, which initially reflects the significance of the transmission stage.
[0035] Step S003: Based on the connection relationship of the nodes corresponding to each transmission stage in each branch in the learning information branch diagram, determine the reference weight of each transmission stage in each branch; combine the data differences of each analysis attribute between different branches in the learning information branch diagram to obtain the prominence correction coefficient of each branch; adjust the information discrete value to obtain the information prominence value of each transmission stage in each branch, and construct the learning information saliency map of each entry node.
[0036] It should be noted that the existence of a branch indicates the existence of a data transmission process, that is, the IP address of an entry node corresponds to the IP address of the access node at the exit, and multiple transmission nodes are passed through in between. Due to the characteristics of Tor routing, the transmission nodes passed through by the same entry node and the same exit node are different; the same type of access will have the same information, and there is also a difference between Tor traffic and normal traffic.
[0037] It should be further explained that the saliency map of the learning information to be constructed should include information distinguishing Tor traffic from normal traffic, as well as information showing the interactive characteristics of users corresponding to IPs. Therefore, it is necessary to consider the changes in multiple paths between the same entry node and the same exit node. Users' browsing behavior is influenced by their browsing habits, which are reflected in changes in transmitted data. For example, the IP corresponding to the exit node may be a webpage, an email address, or a video playback type. For instance, if the IP corresponding to the exit node is a search engine webpage, the search engine webpage has its own webpage elements and resources, while other webpages may have more webpage elements and more resources, resulting in significant differences in the characteristics of transmitted data. Therefore, if users' browsing habits can be reflected in changes in transmitted data, and if the transmission between nodes is affected by layers of encryption (decryption occurs at each hop), then the user's interactive characteristics can be reflected by analyzing the patterns of data changes.
[0038] Preferably, in one embodiment of the present invention, the reference weights of each transmission stage in each branch are determined based on the connection relationships of the nodes corresponding to each transmission stage in each branch in the learning information branch graph within the node network. The specific method includes: For any transmission stage in any branch of the learning information branch graph of any entry node, the two adjacent pixels of this transmission stage in the learning information branch graph correspond to a source node and a destination node in the node network. The number of destination nodes connected to the source node is obtained as the number of connections of the source node. The ratio of the number of connections of the source node to the maximum number of connections of all nodes in the node network other than user nodes and access nodes as source nodes is used as the branch influence factor of this transmission stage. The difference obtained by subtracting the branch influence factor from 1 is used as the reference weight of this transmission stage of this branch.
[0039] It should be noted that data is filtered according to the same entry node and the same exit node, and the regularity of the changes in the transmitted data is analyzed from the time axis. Different transmission stages have different weights. The more branches the source node has in a transmission stage, the more uniform the subsequent transmission nodes are in that stage. The greater the possibility of changes in that stage compared to the entire Tor stage, the smaller the weight it has when calculating regularity.
[0040] Preferably, in one embodiment of the present invention, the salient correction coefficient of each branch is obtained by combining the data differences of each analysis attribute between different branches in the learning information branch graph, including the following specific method: For any branch in the learning information branch graph of any entry node, take all other branches in the learning information branch graph except for that branch as the comparison branch. Obtain the data of each analysis attribute in the same transmission stage (transmission stages with the same order value have the same number of columns in the learning information branch graph) of that branch and any comparison branch. Construct the data sequence of each analysis attribute of that branch in that transmission stage (the data sequence elements are the data of each analysis attribute, and the order of the analysis attributes is set according to the collection order), and the data sequence of each analysis attribute of that comparison branch in that transmission stage. Take the Pearson correlation coefficient of the two data sequences as the correlation coefficient between that branch and the comparison branch in that transmission stage.
[0041] Furthermore, using the reference weights of each transmission stage of the branch, the correlation coefficients of the branch and each comparison branch in that transmission stage are weighted and averaged, and the result is used as the transmission correlation coefficient between the branch and the comparison branch; the transmission correlation coefficients of the branch and each comparison branch are obtained, and the standard deviation of all transmission correlation coefficients is used as the prominence correction coefficient of the branch.
[0042] It should be noted that regularity refers to analyzing the correlation changes of the analytical attributes of a branch with other branches. The greater the fluctuation of the correlation coefficient with other branches, the smaller the regularity of the analytical attributes of the branch, and the more the transmission information it contains needs to be learned. In this way, the information prominence value is obtained by expanding on the information discrete value.
[0043] It should be further explained that the learning information branch map is actually the image matrix basis for the constructed learning information saliency map. By combining the information highlight value with the original pixel value set to 0, the information highlight value is assigned as the saliency value to the learning information branch map, thus obtaining the learning information saliency map.
[0044] Preferably, in one embodiment of the present invention, the information discrete values are adjusted to obtain the information salience values of each branch and each transmission stage, and a learning information saliency map of each entry node is constructed. The specific method includes: For any transmission stage in any branch of the learning information branch graph of any entry node, the sum of the prominence correction coefficient of that branch plus 1 is multiplied by the discrete information value of that transmission stage of that branch, and this product is used as the information prominence value of that transmission stage of that branch. The information prominence value of that transmission stage is used as the salience value of the next pixel among the two adjacent pixels of that transmission stage. This gives the salience value of each pixel in the learning information branch graph. The sum of the pixel value and the salience value of the corresponding pixel is used as the updated pixel value. The learning information branch graph obtained after updating the pixel values of all pixels is used as the learning information salience map of the entry node. The pixels in the first column of the learning information salience map still have an updated pixel value of 0 because no corresponding salience value has been calculated.
[0045] Thus, by analyzing the branches in the tributary transmission stage, we ensure that smaller branches have greater reference weight while maintaining stability. We also perform weighted analysis on the correlation of data changes in the analytical attributes between branches and other branches to quantify the regularity of the correlation between branches and other branches. This means that branches with smaller regularity need to adjust their information dispersion values to a greater extent, that is, they need to ensure that they can learn relevant information in subsequent processes. In this way, we can construct a learning information saliency map based on the learning information tributary map.
[0046] Step S004: Update the learning information saliency map based on the updated dataset and construct a grayscale image to train the Tor traffic classification network; input the grayscale image and learning information saliency map corresponding to the traffic to be detected into the trained network for dynamic perception and recognition.
[0047] It should be noted that the incremental learning process involves continuously adding new data. During the process of adding new data, the saliency map of the learning information needs to be continuously updated. The information to be learned is constantly improved, and the more complete the information becomes, the more information distributions can be learned. Therefore, we analyze the information differences between new users, that is, the new source IPs of the new dataset and old users, to determine the subsequent update process.
[0048] Specifically, in the initial dataset, principal component analysis is performed on all data attributes. The number of principal components is preset; in this embodiment, the number of principal components is described as 4. The first 4 principal components are selected as the data dimensions for classification. After principal component analysis, each data dimension is a newly generated data attribute (generated by fusion of principal components). Then, the data corresponding to the four data dimensions is obtained for each user, and all users are clustered. The distance metric is the Euclidean distance between the data corresponding to the four data dimensions. In this embodiment, K-means clustering is used, and the K value is described as 8, resulting in several user categories.
[0049] Furthermore, users in the updated dataset are treated as new users. After obtaining the saliency map of the learning information for new users using the method described above, the saliency map needs to be updated after each new transmission data. For any new user, after adding one transmission data, the Euclidean distance between the new user and the centers of each user category is calculated (recalculated after each new transmission data). For any user category, the Euclidean distance between the new user and the center of that user category after each new transmission data is added is obtained. The difference between the previous Euclidean distance and the next Euclidean distance is calculated. If the difference is greater than or equal to 0, the number of transmission data additions corresponding to the next Euclidean distance is marked as 1; if the difference is less than 0, it is marked as -1. Then, for that user category... The marker values of each additional transmission data for the new user are obtained. The branch corresponding to the transmission process of the additional transmission data whose marker value is different from the previous marker value is marked as an adjustment branch, thereby obtaining several adjustment branches under the user category. The adjustment branches of the new user are obtained in the above way, and arranged in order according to the order of the additional transmission data. In the learning information saliency map of the new user, the adjustment branches are adjusted one by one in order. The adjustment process is to update the pixel value of all pixels in the adjustment branch to the maximum pixel value in the current learning information saliency map of the new user, thereby realizing the update of the learning information saliency map of the new user after the addition of transmission data.
[0050] Furthermore, for any entry node's learning information branch graph and any data attribute, the data of that data attribute (original data, non-normalized data) in any transmission stage of any branch in the learning information branch graph is used as the updated pixel value of the next pixel among the two adjacent pixels in that transmission stage. The updated pixel values of each pixel in the learning information branch graph are obtained according to the above method. Since the first column of pixels has not obtained an updated pixel value, the original pixel value 0 is directly used as the updated pixel value. The image composed of the updated pixel values of all pixels is used as the grayscale image of the data attribute of the entry node.
[0051] Furthermore, a dynamic perception network is constructed using the LeNet-5 neural network structure. Grayscale images of all data attributes for any user, along with the learning information saliency map of the corresponding entry node for that user, are input into the neural network. The grayscale images serve as input data, and the classification results of normal traffic data and Tor traffic data are used as output results (each row in the image represents a column of results, with normal traffic data labeled 0 and Tor traffic data labeled 1). The learning information saliency map serves as the attention feature map during the neural network training process. Training the neural network based on the attention feature map is an existing technique and will not be elaborated upon in this embodiment. A large number of users from the dataset are input into the dynamic perception network to train it, thereby obtaining a trained dynamic perception network (Tor traffic classification network).
[0052] In the practical application (inference) phase, for captured unknown network traffic, the system performs the following steps: 1) Data parsing: Parse the data structure of the traffic, map the time-series data of the traffic to the transmission nodes in the node network according to the method described in step S002, and extract and analyze the attributes; 2) Feature construction: Parse the traffic to be detected, convert it into a transmission node sequence according to the same method as in step S002, and construct grayscale images of each data attribute; 3) Recognition output: Input the constructed grayscale image and the retrieved learning information saliency map into the trained Tor traffic classification network. The model outputs the probability that the traffic belongs to Tor traffic or the specific application category, thereby realizing the dynamic perception and recognition of unknown Tor traffic.
[0053] In this way, the system can not only use historical data to train the model, but also ensure that the model input structure remains consistent during the training and inference phases, thus solving the problem of inference interruption caused by the inability to obtain physical routing information.
[0054] The input process requires inputting saliency maps of learning information and grayscale images of corresponding data attributes for all traffic types, thereby achieving the classification of traffic types.
[0055] Thus, after constructing saliency maps of learning information from a large number of users in the initial dataset, the saliency maps of learning information for new users are further updated based on the updated dataset after adding new users and transmitting data. These updates serve as the basis for the attention maps used in network training. At the same time, grayscale images of each user's data attributes are constructed. Through the attention mechanism, the Tor traffic classification network is ensured to learn more relevant information about Tor traffic analysis, thereby reducing the bias interference of redundant information in the training process. Ultimately, dynamic perception of Tor network traffic based on deep learning is achieved.
[0056] Another embodiment of the present invention provides a Tor network traffic dynamic sensing and identification system, the system including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the above method steps S001 to S004.
[0057] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for dynamic sensing and identification of Tor network traffic, characterized in that, The method includes the following steps: The network data structure is analyzed based on the publicly available ISCX dataset, and several time-series data subsets are obtained. An initial dataset and several updated datasets are constructed, and several data attributes in the initial dataset are recorded. The dataset contains several types of traffic. A node network is constructed based on the network data structure of the initial dataset, and several analytical attributes are extracted. Under the same traffic type, a learning information branch map of each entry node is constructed based on the branches connected to the entry nodes in the node network. The data differences between the analytical attributes of adjacent pixels in the same row of pixels in the learning information branch map are analyzed to obtain the information discrete values of each branch in each transmission stage. Based on the connection relationship of the nodes corresponding to each transmission stage in each branch in the learning information branch diagram, the reference weight of each transmission stage in each branch is determined; combined with the data differences of each analysis attribute between different branches in the learning information branch diagram, the salience correction coefficient of each branch is obtained; the information discrete value is adjusted to obtain the information salience value of each transmission stage in each branch, and the learning information salience map of each entry node is constructed. The Tor traffic classification network is trained by updating the learning information saliency map based on the updated dataset and constructing grayscale images. The grayscale image and learning information saliency map corresponding to the traffic to be detected are input into the trained network for dynamic perception and recognition.
2. The Tor network traffic dynamic sensing and identification method according to claim 1, characterized in that, The specific methods for constructing a node network based on the centralized network data structure of the initial dataset and extracting several analytical attributes include: For the network data structure in the initial dataset, the connection order between the source node and the destination node is determined, and several nodes are connected according to the connection order to construct a node network; and user nodes, transmission nodes and access nodes are extracted from the node network; wherein, the transmission node is a logical node obtained by dividing the network traffic according to the time-series transmission data, and is used to represent the state of traffic at different transmission stages; the user node is the entry node and is connected to the first transmission node. The data attribute containing the amount of data transmitted is used as the analysis attribute; the data of each analysis attribute is standardized.
3. The Tor network traffic dynamic sensing and identification method according to claim 2, characterized in that, The specific method for constructing the learning information branch graph for each entry node is as follows: Based on any traffic type in the initial dataset, for any entry node in the node network, obtain several branches that lead to the access nodes. Each branch is treated as a row of pixels, and the transmission nodes in the same branch are arranged from left to right as pixels to obtain the learning information branch map of the entry node.
4. The Tor network traffic dynamic sensing and identification method according to claim 3, characterized in that, The specific method for obtaining the discrete information values of each branch at each transmission stage is as follows: For any two adjacent pixels in any branch of the learning information branch graph of any entry node, which correspond to a transmission stage in that branch, obtain the data of any analysis attribute in that transmission stage, and obtain the average data of that analysis attribute in each transmission stage of the learning information branch graph. The absolute value of the difference between the data of the analysis attribute in the transmission stage and the mean of the data is taken as the data discrete value of the analysis attribute in the transmission stage; the mean of the data discrete values of all analysis attributes in the transmission stage is taken as the information discrete value of the transmission stage for the branch.
5. The Tor network traffic dynamic sensing and identification method according to claim 4, characterized in that, The reference weights for each branch and each transmission stage are obtained using the following method: For any transmission stage in any branch of the learning information branch graph of any entry node, the two adjacent pixels of the transmission stage in the learning information branch graph correspond to a source node and a destination node in the node network. The number of destination nodes connected to the source node is obtained as the number of connections of the source node. The ratio of the number of connections of the source node to the maximum number of connections of all nodes in the node network other than user nodes and access nodes that are source nodes is used as the branch influence factor of the transmission stage. The difference between 1 and the branch influence factor is used as the reference weight of the transmission stage of the branch.
6. The Tor network traffic dynamic sensing and identification method according to claim 4, characterized in that, The specific method for obtaining the protrusion correction coefficients for each branch is as follows: For any branch in the learning information branch graph of any entry node, take all other branches in the learning information branch graph except for that branch as the comparison branch of that branch, obtain the data of each analysis attribute in the same transmission stage of that branch and any comparison branch, and construct the data sequence of each analysis attribute of that branch in the transmission stage, as well as the data sequence of each analysis attribute of that comparison branch in the transmission stage. Take the Pearson correlation coefficient of the two data sequences as the correlation coefficient between that branch and that comparison branch in the transmission stage. Using the reference weights of each transmission stage of the branch, the correlation coefficients of the branch and each comparison branch in that transmission stage are weighted and averaged. The result is used as the transmission correlation coefficient between the branch and the comparison branch. The transmission correlation coefficients of the branch and each comparison branch are obtained, and the standard deviation of all transmission correlation coefficients is used as the prominence correction coefficient of the branch.
7. The Tor network traffic dynamic sensing and identification method according to claim 4, characterized in that, The specific methods for obtaining the information salience values of each branch at each transmission stage and constructing the learning information salience map of each entry node are as follows: For any transmission stage in any branch of the learning information branch graph of any entry node, the sum of the prominence correction coefficient of that branch plus 1 is multiplied by the discrete information value of that transmission stage of that branch, and the information prominence value of that transmission stage is used as the prominence value of that transmission stage of that branch. The information prominence value of that transmission stage is used as the significance value of the next pixel among the two adjacent pixels of that transmission stage. Obtain the saliency value of each pixel in the learning information branch graph, and use the sum of the pixel value and the saliency value of the corresponding pixel as the updated pixel value. The learning information branch graph obtained after updating the pixel values of all pixels is used as the learning information saliency graph of the entry node.
8. The Tor network traffic dynamic sensing and identification method according to claim 1, characterized in that, The specific methods for updating the saliency map of the learned information based on the updated dataset are as follows: In the initial dataset, principal component analysis is performed on all data attributes, and the principal components with the highest number of principal components are selected as the data dimensions for classification. Each user is then classified based on these data dimensions to obtain several user categories. After treating the users in the updated dataset as new users and obtaining the saliency map of the learning information of the new users, for any new user, after adding a transmission data, calculate the Euclidean distance between the new user and the center of each user category. For any user category, obtain the Euclidean distance between the newly added user and the center of the user category after each additional data transmission. Subtract the previous Euclidean distance from the next Euclidean distance to obtain the difference. If the difference is greater than or equal to 0, mark the number of data transmissions corresponding to the next Euclidean distance as 1. If the difference is less than 0, mark it as -1. For each instance of data transmission for a new user under this user category, the marker value of the transmission process corresponding to the data transmission for each instance whose marker value is different from the previous marker value is marked as an adjustment branch, thus obtaining several adjustment branches under this user category. Obtain several adjustment branches for the new user, and arrange the adjustment branches in order of increasing the transmission data. In the learning information saliency map of the new user, adjust the adjustment branches one by one in order. The adjustment process is to update the pixel value of all pixels in the adjustment branch to the maximum pixel value in the current learning information saliency map of the new user.
9. The Tor network traffic dynamic sensing and identification method according to claim 7, characterized in that, The specific method for constructing grayscale images based on the learned information saliency map for each data attribute is as follows: For any entry node's learning information branch graph and any data attribute, the data of that data attribute in any transmission stage of any branch in the learning information branch graph is used as the updated pixel value of the next pixel among the two adjacent pixels in that transmission stage. The updated pixel values of each pixel in the learning information branch graph are obtained, and the image composed of the updated pixel values of all pixels is used as the grayscale image of that data attribute of the entry node.
10. A Tor network traffic dynamic sensing and identification system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the Tor network traffic dynamic sensing and identification method as described in any one of claims 1-9.