A quic traffic website fingerprinting method and system based on a dual-view hypergraph neural network

Abstract

The application belongs to the field of network space security and encrypted traffic analysis, and provides a QUIC traffic website fingerprint identification method and system based on a double-view hypergraph neural network, mainly solving the problem that the existing website fingerprint identification method cannot effectively represent the complex timing and resource interweaving caused by the multiplexing mechanism in the QUIC protocol, resulting in the defects of insufficient identification accuracy and robustness. The main scheme includes: cleaning and dividing the QUIC encrypted traffic, extracting statistical features as nodes with Burst as the granularity; constructing a double-view hypergraph from the timing context and resource similarity dimensions, explicitly modeling the high-order association in the traffic; designing a double-channel hypergraph neural network to extract features in parallel, and adaptively fusing double-view information through an attention mechanism; finally, realizing high-precision classification of the target website by using graph pooling and a fully connected layer.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security and encrypted traffic analysis, specifically relating to a QUIC traffic website fingerprinting method and system based on a dual-view hypergraph neural network. Background Technology

[0002] With the development of internet technology, the demand for security and efficiency in network transmission is increasing. Traditional TCP-based HTTPS protocols suffer from high handshake latency and complex congestion control mechanisms, making them unsuitable for the transmission needs of mobile internet and IoT scenarios. QUIC (Quick UDP Internet Connections), as the underlying transport protocol of HTTP / 3, is implemented based on UDP and integrates the core features of TCP and TLS. It boasts advantages such as 0-RTT handshake, multiplexing, and optimized congestion control, and has been widely adopted by major internet companies such as Google, Facebook, and Alibaba Cloud, gradually becoming the mainstream protocol for encrypted transmission.

[0003] However, the encryption features of the QUIC protocol also present challenges for network oversight and security auditing. Website fingerprinting (WF), as a passive traffic analysis technique, can infer the target website a user visits by analyzing the side-channel characteristics of encrypted traffic (such as packet size, time interval, and transmission direction) without cracking the encryption key, making it one of the key technologies for addressing encrypted traffic oversight. However, the multiplexing mechanism of the QUIC protocol introduces new challenges to traditional website fingerprinting methods:

[0004] (1) The problem of traffic interleaving is prominent: The QUIC protocol allows multiple streams to be transmitted concurrently in a single connection. Data packets of different resources (such as HTML documents, images, scripts, and video clips) are interleaved at the transport layer, making it difficult for traditional sequence model-based methods (such as CNN and LSTM) to distinguish the traffic characteristics of different resources, and feature extraction is easily interfered with.

[0005] (2) Insufficient modeling of higher-order relationships: Existing graph neural network (GNN) based methods mostly construct simple graphs, which can only model pairwise relationships between nodes. However, during webpage loading, multiple bursts usually work together to complete the transmission of a certain resource. This kind of "many-to-many" higher-order relationship cannot be effectively represented by ordinary edges, resulting in limited feature representation capabilities;

[0006] (3) Single view limitation: Most existing methods only focus on the temporal characteristics of traffic (such as the time sequence of bursts), ignoring the structural similarity of traffic in the feature space (such as the same type of resources transmitted at different times may have similar burst characteristics), resulting in a single feature dimension and insufficient model robustness.

[0007] (4) Weak anti-interference capability: In complex network environments (such as packet loss and delay jitter), the timing characteristics of QUIC traffic are easily distorted. The accuracy of identification methods that rely solely on timing views will decrease significantly, making it difficult to meet the needs of actual application scenarios. Summary of the Invention

[0008] This method uses Burst as the basic analysis unit, constructs a dual-view hypergraph of "temporal context" and "resource similarity", utilizes the powerful high-order association modeling capability of Hypergraph Neural Network (HGNN) and combines attention mechanism to adaptively fuse multi-view features to achieve accurate identification of QUIC encrypted traffic.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network includes the following steps:

[0011] Step 1: Obtain the network traffic data of the QUIC protocol to be detected, parse the data packets and preprocess them, filter the handshake phase messages, and retain only the data of the encrypted transmission phase;

[0012] Step 2: Aggregate and segment the traffic data after preprocessing in Step 1 based on time threshold and transmission direction to generate Burst sequences, and extract the statistical attributes of each Burst as the initial node feature vector.

[0013] Step 3: Based on the Burst sequence and node features obtained in Step 2, construct the temporal context hypergraph and the resource similarity hypergraph using the sliding window mechanism and the K-nearest neighbor algorithm respectively, forming a dual-view hypergraph topology;

[0014] Step 4: Construct a dual-view collaborative hypergraph neural network model. This model contains two parallel hypergraph convolution channels, which take the temporal context hypergraph and resource similarity hypergraph generated in Step 3 as inputs to perform high-order information transmission and updating of node features.

[0015] To address the information silo problem in single-view architecture, a cross-view interaction module is designed. The correlation matrix between intermediate features of two views is calculated, and an improved dual-view collaborative hypergraph neural network model is constructed. This model includes two parallel hypergraph convolution channels, featuring parallel temporal and structural convolution channels, and introduces a cross-view information interaction mechanism. First, the temporal context hypergraph correlation matrix and resource similarity hypergraph correlation matrix generated in step 3 are input into the corresponding channels. Next, in each convolutional operation, not only is high-order feature aggregation of "node-hyperedge-node" within the current view performed, but a cross-view feature soft alignment module is also introduced. This module embeds and projects nodes from the temporal view into the space of the structural view for auxiliary correction, alleviating the feature sparsity problem under single-view architecture, ultimately resulting in an enhanced node representation containing multimodal complementary information.

[0016] Step 5: During the feature extraction process in Step 4, a view-level attention mechanism is introduced to automatically calculate the weight scores of the temporal view and the structural view, and to perform weighted fusion of the features output from the two channels to generate enhanced node representations.

[0017] Step 6: Perform global graph pooling on the graph structure data fused in Step 5, aggregate node-level features into graph-level feature vectors, input them into the classifier for probability prediction, and output the website category to which QUIC traffic belongs.

[0018] In the above technical solution, the dual-view collaborative hypergraph neural network model is:

[0019] It features a dual-parallel channel architecture, including two parallel hypergraph convolution channels: a temporal convolution channel and a structural convolution channel. It also includes a cross-view feature soft alignment module and a view-level attention fusion module.

[0020] The input to the temporal convolution channel is the temporal context hypergraph correlation matrix and the initial node feature matrix;

[0021] The input to the structured convolutional channel is the resource similarity hypergraph association matrix and the initial node feature matrix;

[0022] Both channels perform multi-layer hypergraph convolution operations. In each convolution operation, the high-order feature aggregation of "node-hyperedge-node" in the current view is first completed. Then, through the cross-view feature soft alignment module, the temporal view nodes output by the temporal convolution channel are embedded and projected into the feature space of the structural convolution channel for auxiliary correction, which alleviates the feature sparsity problem under single view and outputs the intermediate node features of the corresponding view.

[0023] The view-level attention fusion module receives intermediate node features from the outputs of two channels, automatically calculates the weight scores of the temporal view and the structural view, and performs weighted fusion of the features output from the two channels to generate an enhanced node representation containing multimodal complementary information.

[0024] In the above technical solution, the specific steps of step 2 are as follows:

[0025] Step 2.1: Traverse the preprocessed data packet sequence and set a time interval threshold Δt;

[0026] Step 2.2: If the time interval between the current data packet and the previous data packet exceeds Δt, or if the transmission direction of the current data packet is different from that of the previous data packet, then truncate the current sequence and generate a new Burst node;

[0027] Step 2.3: For each Burst node, extract multidimensional statistical features including cumulative byte count, duration, number of packets, average packet size, variance of packet size, and peak rate, and perform log normalization to obtain the node feature vector.

[0028] In the above technical solution, step 3 specifically involves the following steps:

[0029] Step 3.1: Construct a temporal context hypergraph: Receive a sequence of Burst nodes arranged in chronological order, set the sliding window size W (W is an integer from 3 to 10); slide the window along the sequence with a step size of 1, and bind the W consecutive Burst nodes covered by each window position into a temporal hyperedge; traverse the entire sequence to generate a set of temporal hyperedges, form a temporal context hypergraph, and output its hypergraph association matrix;

[0030] Step 3.2: Construct a resource similarity hypergraph: Based on the statistical feature vectors of each Burst node, calculate the Euclidean distance between any two nodes; for each Burst node, select the K nearest neighbor nodes in the feature space (K is an integer from 2 to 5), and bind the current node to the K neighbor nodes as a structural hyperedge; traverse all nodes to generate a set of structural hyperedges, form a resource similarity hypergraph, and output its hypergraph association matrix;

[0031] Step 3.3: Integrate the hypergraph association matrix obtained in Step 3.1 with the temporal context hypergraph association matrix and the resource similarity hypergraph association matrix obtained in Step 3.2 to form a dual-view hypergraph topology containing both temporal dependencies and resource structure similarity connections, which serves as the input data for the dual-view collaborative hypergraph neural network model.

[0032] In the above technical solution, step 4 involves a dual-view collaborative hypergraph neural network model:

[0033] It features a dual-parallel channel architecture, including two parallel hypergraph convolution channels: a temporal convolution channel and a structural convolution channel. It also includes a cross-view feature soft alignment module and a view-level attention fusion module.

[0034] The input to the temporal convolution channel is the temporal context hypergraph correlation matrix and the initial node feature matrix;

[0035] The input to the structured convolutional channel is the resource similarity hypergraph association matrix and the initial node feature matrix;

[0036] Both channels perform multi-layer hypergraph convolution operations. In each convolution operation, the high-order feature aggregation of "node-hyperedge-node" in the current view is first completed. Then, through the cross-view feature soft alignment module, the temporal view nodes output by the temporal convolution channel are embedded and projected into the feature space of the structural convolution channel for auxiliary correction, which alleviates the feature sparsity problem under single view and outputs the intermediate node features of the corresponding view.

[0037] The view-level attention fusion module receives intermediate node features from the outputs of two channels, automatically calculates the weight scores of the temporal view and the structural view, and performs weighted fusion of the features output from the two channels to generate an enhanced node representation containing multimodal complementary information.

[0038] In the above technical solution, step 5 specifically involves the following steps:

[0039] Step 5.1: Initialize the learnable attention vectors, which are randomly initialized and then updated through model training;

[0040] Step 5.2: Perform global mean pooling on the features output from the time-series channel and the features output from the structure channel respectively to obtain the view-level feature vector;

[0041] Step 5.3: Calculate the attention score;

[0042] Step 5.4: Normalize the attention score using the Softmax function to obtain the weight coefficients;

[0043] Step 5.5: Based on the weight coefficients, perform weighted fusion of the features of the two views to generate the final node feature matrix.

[0044] In the above technical solution, step 6 specifically involves the following steps:

[0045] Step 6.1: Perform global mean pooling and global max pooling operations on the fused node feature matrix;

[0046] Step 6.2: Concatenate the two pooled vectors to obtain the graph-level feature vector;

[0047] Step 6.3: Input the graph-level feature vector into a fully connected classifier, which contains two fully connected layers.

[0048] First layer: Input dimension 256, output dimension 128, activation function is LeakyReLU;

[0049] Second layer: Input dimension 128, output dimension is the predefined number of website categories M, activation function is Softmax;

[0050] Step 6.4: Output the probability value for each website category, and select the category with the highest probability as the final recognition result.

[0051] This invention also provides a QUIC traffic website fingerprinting system based on a dual-view hypergraph neural network, characterized by comprising the following functional modules:

[0052] Traffic Acquisition and Preprocessing Module: Responsible for capturing raw traffic data from the network environment, cleaning out irrelevant background traffic and control messages, and segmenting continuous data packet streams into discrete Burst node sequences to provide standardized input data for subsequent processing;

[0053] Dual-view hypergraph construction module: It receives the Burst node sequence and node feature matrix, constructs a temporal context hypergraph through a sliding window mechanism and a resource similarity hypergraph through the K-nearest neighbor algorithm, and outputs the association matrix of the two hypergraphs.

[0054] Dual-channel hypergraph model module: used to load a pre-trained dual-view collaborative hypergraph neural network. The association matrix and node feature matrix of the two hypergraphs are respectively input into two parallel hypergraph convolution channels to extract high-order features and perform adaptive fusion through a view-level attention mechanism, and output the fused node feature matrix.

[0055] Classification Decision Module: This module performs graph pooling on the fused node feature matrix to generate graph-level feature vectors. These vectors are then input into a fully connected classifier for probability prediction, and the output is the website category label and confidence level corresponding to the QUIC traffic.

[0056] In the above technical solution, the specific implementation of the program analysis module is as follows:

[0057] Use Androguard to perform static decompilation on Android APK files to obtain their dex files and so library files.

[0058] In the above technical solution, the specific implementation of the traffic acquisition and preprocessing module is as follows:

[0059] Traffic capture: Using traffic capture tools developed based on the libpcap or WinPcap library, network packets are mirrored in real time at the network card interface and saved as PCAP format files.

[0060] Protocol parsing and filtering: The PCAP file is traversed, first identifying UDP protocol packets based on the Ethernet frame header and IP header. Next, the header fields of the UDP payload are examined to identify the QUIC protocol's Public Header. Based on this, handshake phase packets such as Initial, Handshake, and Retry, as well as pure ACK acknowledgment packets and PING heartbeat packets, are removed, retaining only 1-RTT encrypted short packets carrying application data.

[0061] Burst segmentation: Iterates through the preserved sequence of data packets. A time threshold is set (e.g., 50 milliseconds). If, during the iteration, the arrival time interval between the current data packet and the previous data packet exceeds this threshold, or if the transmission direction (upload / download) of the current data packet is different from that of the previous data packet, then a new Burst transmission is considered to have started, and the previously accumulated data packets are divided into a Burst node.

[0062] Feature extraction: For each Burst node, statistical measures are taken, including the total number of data packets, total number of bytes, duration, and the mean, variance, maximum, and minimum size of the data packets contained within it. Finally, these values ​​are log-normalized to generate the feature vector of that Burst node.

[0063] In the above technical solution, the specific implementation of the dual-view hypergraph construction module is as follows:

[0064] Temporal view construction: Define a fixed-length sliding window (e.g., window size 5). Slide this window across the Burst sequence with a step size of 1. For each window position, treat all Burst nodes contained within the window as a set and connect them to the same "temporal hyperedge". In this way, each Burst node participates in multiple temporal hyperedges, thereby capturing its local temporal context information.

[0065] Structural view construction: Calculate the Euclidean distance between the feature vectors of all Burst nodes. For each Burst node, find its K nearest neighbors (e.g., K=3) in the entire sequence. Treat this node and its K nearest neighbors as a set and connect them to the same "structural hyperedge". In this way, even Burst nodes that are far apart in time will be connected together as long as they represent similar resource types (e.g., both are image data blocks).

[0066] Correlation matrix generation: Based on the connection relationships constructed above, an correlation matrix describing temporal connection relationships and an correlation matrix describing structural similarity relationships are generated respectively, which serve as inputs to the subsequent neural network.

[0067] In the above technical solution, the specific implementation of the dual-channel hypergraph model module is as follows:

[0068] Parallel Convolution: Two hypergraph convolutional channels with identical structures are constructed. The first channel receives the temporal correlation matrix and the node feature matrix, while the second channel receives the structural correlation matrix and the node feature matrix. Within each channel, a "node-hyperedge-node" message passing mechanism is executed: first, node features are aggregated onto the hyperedge (updating hyperedge features), then the hyperedge features are distributed back to the nodes (updating node features), and processed by a non-linear activation function. This process is repeated multiple times to extract deep semantic features.

[0069] Attention Calculation: A learnable global attention vector is introduced. The feature matrices output from both channels are processed with this attention vector to obtain the attention score for each view. The scores are then normalized using the Softmax function to obtain the weight coefficients for the temporal view and the structural view.

[0070] Feature fusion: Based on the calculated weight coefficients, the node feature matrices output from the two channels are weighted and summed. If a certain view (such as a structural view) has a higher weight, the fused features will retain more information about that view. The final output is an enhanced node feature matrix that fuses information from both views.

[0071] In the above technical solution, the specific implementation of the classification decision module is as follows:

[0072] Graph Pooling (Readout): Receives the fused node feature matrix. Performs global mean pooling (calculating the average of all node features) and global max pooling (selecting the maximum value among all node features) respectively. Concatenates the results of these two pooling operations to form a fixed-length graph embedding vector that comprehensively represents the features of the entire traffic sample.

[0073] Fully connected classification: The graph embedding vector is input into a multilayer perceptron (MLP) classifier. This classifier contains several fully connected layers and dropout layers (to prevent overfitting).

[0074] Probability Output: The last fully connected layer connects to a Softmax activation function, outputting a probability distribution vector. The dimension of the vector equals the predefined number of website categories, with each dimension representing the probability that traffic belongs to the corresponding website. The category with the highest probability value is selected as the final recognition result output.

[0075] Compared with the prior art, the beneficial effects of this invention are as follows:

[0076] 1. Enhanced representation capabilities: By using Burst as the granularity and constructing a hypergraph, it can effectively overcome the bottleneck of traditional sequence models when processing QUIC multiplexed traffic. The hyperedge mechanism perfectly matches the high-order relationship of multiple Bursts co-loading web page resources in QUIC traffic.

[0077] 2. Multidimensional perspective modeling: The innovative introduction of a dual-view collaboration mechanism not only preserves the temporal dependence of traffic (temporal view) but also explores the resource homogeneity within traffic (structural view), significantly improving the richness of features.

[0078] 3. Adaptive Fusion: Through the view-level attention mechanism, the model can automatically determine which view is more important for the classification of the current sample, effectively suppressing the interference of noisy views and improving the robustness of the model in complex network environments.

[0079] 4. High-precision recognition: Compared with traditional CNN or LSTM models, this method can achieve higher classification accuracy on the QUIC encrypted traffic dataset, especially when dealing with dynamic web pages and long-tail websites. Attached Figure Description

[0080] Figure 1 This is a schematic diagram of the overall workflow of the present invention. Detailed Implementation

[0081] The embodiments of the present invention will be described in detail below. Although the present invention will be described and illustrated in conjunction with some specific embodiments, it should be noted that the present invention is not limited to these embodiments. On the contrary, any modifications or equivalent substitutions made to the present invention should be covered within the scope of the claims of the present invention.

[0082] Furthermore, to better illustrate the present invention, numerous specific details are set forth in the following detailed embodiments. Those skilled in the art will understand that the present invention can be practiced without these specific details.

[0083] This invention provides 1. A QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network, characterized by comprising the following steps:

[0084] Step 1: Obtain the network traffic data of the QUIC protocol to be detected, parse the data packets and preprocess them, filter the handshake phase messages, and retain only the data of the encrypted transmission phase;

[0085] Step 2: Aggregate and segment the traffic data after preprocessing in Step 1 based on time threshold and transmission direction to generate Burst sequences, and extract the statistical attributes of each Burst as the initial node feature vector.

[0086] Step 3: Based on the Burst sequence and node features obtained in Step 2, construct the temporal context hypergraph and the resource similarity hypergraph using the sliding window mechanism and the K-nearest neighbor algorithm respectively, forming a dual-view hypergraph topology;

[0087] Step 4: Construct a dual-view collaborative hypergraph neural network model. This model contains two parallel hypergraph convolution channels, which take the temporal context hypergraph and resource similarity hypergraph generated in Step 3 as inputs to perform high-order information transmission and updating of node features.

[0088] To address the information silo problem in single-view architecture, a cross-view interaction module is designed. The correlation matrix between intermediate features of two views is calculated, and an improved dual-view collaborative hypergraph neural network model is constructed. This model includes two parallel hypergraph convolution channels, featuring parallel temporal and structural convolution channels, and introduces a cross-view information interaction mechanism. First, the temporal context hypergraph correlation matrix and resource similarity hypergraph correlation matrix generated in step 3 are input into the corresponding channels. Next, in each convolutional operation, not only is high-order feature aggregation of "node-hyperedge-node" within the current view performed, but a cross-view feature soft alignment module is also introduced. This module embeds and projects nodes from the temporal view into the space of the structural view for auxiliary correction, alleviating the feature sparsity problem under single-view architecture, ultimately resulting in an enhanced node representation containing multimodal complementary information.

[0089] Step 5: During the feature extraction process in Step 4, a view-level attention mechanism is introduced to automatically calculate the weight scores of the temporal view and the structural view, and to perform weighted fusion of the features output from the two channels to generate enhanced node representations.

[0090] Step 6: Perform global graph pooling on the graph structure data fused in Step 5, aggregate node-level features into graph-level feature vectors, input them into the classifier for probability prediction, and output the website category to which QUIC traffic belongs.

[0091] In the above technical solution, the present invention converts continuous, massive data packet streams into discrete, semantically functional "traffic blocks," aiming to solve the following problems:

[0092] Directly processing excessively long raw data packet sequences (sequence length explosion) leads to low computational efficiency and makes it difficult for models to capture long-distance dependencies. Meanwhile, Burst often corresponds to a complete action at the application layer (such as loading an image or requesting a video segment), making it more semantically interpretable.

[0093] Therefore, the specific steps for step 2 are provided:

[0094] Step 2.1: Traverse the preprocessed data packet sequence and set a time interval threshold Δt;

[0095] Step 2.2: If the time interval between the current data packet and the previous data packet exceeds Δt, or if the transmission direction of the current data packet is different from that of the previous data packet, then truncate the current sequence and generate a new Burst node;

[0096] Step 2.3: For each Burst node, extract multidimensional statistical features including cumulative byte count, duration, number of packets, average packet size, variance of packet size, and peak rate, and perform log normalization to obtain the node feature vector.

[0097] As one possible implementation, step 2 includes:

[0098] For the preprocessed traffic data in step 1, aggregation and segmentation are performed based on a preset time interval threshold and data packet transmission direction change rules to generate a Burst sequence. Specifically, the preprocessed data packet sequence is first traversed and an appropriate time interval threshold Δt is set. During the traversal, the time interval between the current data packet and the previous data packet is continuously calculated, and it is determined whether the transmission direction of the current data packet is consistent with that of the previous data packet. If the time interval between the current data packet and the previous data packet exceeds the preset Δt, or the transmission direction of the current data packet is different from that of the previous data packet, the previously accumulated data packet sequence is truncated to generate a new Burst node. Then, the subsequent data packets are traversed and judged until the Burst segmentation of all data packets is completed. After obtaining the Burst sequence, multi-dimensional statistical attributes, including the cumulative number of bytes, duration, number of packets, average packet size, packet size variance, and peak rate, are extracted for each Burst node. These statistical attributes can comprehensively characterize the transmission characteristics of the Burst node. Then, the extracted multi-dimensional statistical attributes are logarithmically normalized to eliminate the differences in dimensionality and numerical range between different dimensions of features, and finally, a standardized initial node feature vector is obtained.

[0099] The detailed explanation of step 3 is as follows:

[0100] The QUIC protocol features "multiplexing." This means that when accessing a website, traffic from different resources such as images, text, and videos is transmitted concurrently within a single connection, and the order may be out of order.

[0101] Addressing the timing obfuscation problem: Traditional sequence models assume strictly linear traffic, but QUIC traffic is concurrent. By using "timing hyperedges," the focus shifts from strict sequential order to "this cluster of data packets arriving together," thus better simulating the concurrent loading behavior of web page resources.

[0102] Addressing long-distance dependencies: The transmission of a large file may be divided into many bursts, scattered across different positions in the sequence. Traditional local convolutions struggle to connect these bursts. Through "structural hyperedges" (KNN similarity), we can directly connect the bursts at the beginning and end of the sequence (because they have similar features and may belong to the same large file), thereby capturing the global flow pattern.

[0103] Therefore, in the above technical solution, step 3 specifically involves the following steps:

[0104] Step 3.1: For the temporal context hypergraph, set the sliding window size to W, slide it over the Burs sequence, and connect all Burst nodes within the window to the same temporal hyperedge to capture local temporal dependencies;

[0105] Step 3.2: For the resource similarity hypergraph, calculate the Euclidean distance between the feature vectors of any two Burst nodes. For each node, select the K nearest neighbor nodes and connect them to the same structural hyperedge to aggregate traffic resource blocks with similar functions.

[0106] Step 3.3: Integrate the connection relationships of the generated "temporal context hypergraph" and "resource similarity hypergraph" to form a dual-view hypergraph topology containing two different types of connection relationships, which will serve as the input data for the subsequent neural network model.

[0107] In the above technical solution, the specific formula for the hypergraph convolution operation of the dual-view collaborative hypergraph neural network model in step 4 is as follows:

[0108]

[0109] in:

[0110] X(l) is the node feature matrix of the l-th layer (when l=0, it is the initial feature matrix obtained in step 2);

[0111] H is the hypergraph incidence matrix;

[0112] W is the hyperedge weight matrix, initialized as the identity matrix, and adaptively updated through model training;

[0113] Dv is the node degree matrix, which is a diagonal matrix. , representing the number of superedges to which the i-th node belongs;

[0114] De is the node degree matrix, which is a diagonal matrix. , where represents the number of nodes contained in the j-th superedge;

[0115] Θ(l) is the learnable parameter matrix of the l-th layer;

[0116] σ is a non-linear activation function, using the LeakyReLU function.

[0117] In the above technical solution, step 5 specifically involves the following steps:

[0118] Step 5.1: Initialize the learnable attention vector, which is randomly initialized and then updated through model training;

[0119] Step 5.2: Perform global mean pooling on the features output from the time-series channel and the features output from the structure channel respectively to obtain the view-level feature vector;

[0120] Step 5.3: Calculate the attention score;

[0121] Step 5.4: Normalize the attention score using the Softmax function to obtain the weight coefficients;

[0122] Step 5.5: Based on the weight coefficients, perform weighted fusion of the features of the two views to generate the final node feature matrix.

[0123] In the above technical solution, step 6 specifically involves the following steps:

[0124] Step 6.1: Perform global mean pooling and global max pooling operations on the fused node feature matrix;

[0125] Step 6.2: Concatenate the two pooled vectors to obtain the graph-level feature vector;

[0126] Step 6.3: Input the graph-level feature vector into a fully connected classifier, which contains two fully connected layers.

[0127] First layer: Input dimension 256, output dimension 128, activation function is LeakyReLU;

[0128] Second layer: Input dimension 128, output dimension is the predefined number of website categories M, activation function is Softmax;

[0129] Step 6.4: Output the probability value for each website category, and select the category with the highest probability as the final recognition result.

[0130] The above technical solution includes the following modules:

[0131] Traffic Acquisition and Preprocessing Module: Responsible for capturing raw traffic data from the network environment, cleaning out irrelevant background traffic and control messages, and segmenting continuous data packet streams into discrete Burst node sequences to provide standardized input data for subsequent processing;

[0132] Dual-view hypergraph construction module: It receives the Burst node sequence and node feature matrix, constructs a temporal context hypergraph through a sliding window mechanism and a resource similarity hypergraph through the K-nearest neighbor algorithm, and outputs the association matrix of the two hypergraphs.

[0133] Dual-channel hypergraph model module: used to load a pre-trained dual-view collaborative hypergraph neural network. The association matrix and node feature matrix of the two hypergraphs are respectively input into two parallel hypergraph convolution channels to extract high-order features and perform adaptive fusion through a view-level attention mechanism, and output the fused node feature matrix.

[0134] Classification Decision Module: This module performs graph pooling on the fused node feature matrix to generate graph-level feature vectors. These vectors are then input into a fully connected classifier for probability prediction, and the output is the website category label and confidence level corresponding to the QUIC traffic.

[0135] In the above technical solution, the specific implementation of the program analysis module is as follows:

[0136] Use Androguard to perform static decompilation on Android APK files to obtain their dex files and so library files.

[0137] In the above technical solution, the specific implementation of the traffic acquisition and preprocessing module is as follows:

[0138] Traffic capture: Using traffic capture tools developed based on the libpcap or WinPcap library, network packets are mirrored in real time at the network card interface and saved as PCAP format files.

[0139] Protocol parsing and filtering: The PCAP file is traversed, first identifying UDP protocol packets based on the Ethernet frame header and IP header. Next, the header fields of the UDP payload are examined to identify the PublicHeader of the QUIC protocol. Based on this, handshake phase packets such as Initial, Handshake, and Retry, as well as pure ACK acknowledgment packets and PING heartbeat packets, are removed, retaining only 1-RTT encrypted short packets carrying application data.

[0140] Burst segmentation: Iterates through the preserved sequence of data packets. A time threshold is set (e.g., 50 milliseconds). If, during the iteration, the arrival time interval between the current data packet and the previous data packet exceeds this threshold, or if the transmission direction (upload / download) of the current data packet is different from that of the previous data packet, then a new Burst transmission is considered to have started, and the previously accumulated data packets are divided into a Burst node.

[0141] Feature extraction: For each Burst node, statistical measures are taken, including the total number of data packets, total number of bytes, duration, and the mean, variance, maximum, and minimum size of the data packets contained within it. Finally, these values ​​are log-normalized to generate the feature vector of that Burst node.

[0142] In the above technical solution, the specific implementation of the dual-view hypergraph construction module is as follows:

[0143] Temporal view construction: Define a fixed-length sliding window (e.g., window size 5). Slide this window across the Burst sequence with a step size of 1. For each window position, treat all Burst nodes contained within the window as a set and connect them to the same "temporal hyperedge". In this way, each Burst node participates in multiple temporal hyperedges, thereby capturing its local temporal context information.

[0144] Structural view construction: Calculate the Euclidean distance between the feature vectors of all Burst nodes. For each Burst node, find its K nearest neighbors (e.g., K=3) in the entire sequence. Treat this node and its K nearest neighbors as a set and connect them to the same "structural hyperedge". In this way, even Burst nodes that are far apart in time will be connected together as long as they represent similar resource types (e.g., both are image data blocks).

[0145] Correlation matrix generation: Based on the connection relationships constructed above, an correlation matrix describing temporal connection relationships and an correlation matrix describing structural similarity relationships are generated respectively, which serve as inputs to the subsequent neural network.

[0146] In the above technical solution, the specific implementation of the dual-channel hypergraph model module is as follows:

[0147] Parallel Convolution: Two hypergraph convolutional channels with identical structures are constructed. The first channel receives the temporal correlation matrix and the node feature matrix, while the second channel receives the structural correlation matrix and the node feature matrix. Within each channel, a "node-hyperedge-node" message passing mechanism is executed: first, node features are aggregated onto the hyperedge (updating hyperedge features), then the hyperedge features are distributed back to the nodes (updating node features), and processed by a non-linear activation function. This process is repeated multiple times to extract deep semantic features.

[0148] Attention Calculation: A learnable global attention vector is introduced. The feature matrices output from both channels are processed with this attention vector to obtain the attention score for each view. The scores are then normalized using the Softmax function to obtain the weight coefficients for the temporal view and the structural view.

[0149] Feature fusion: Based on the calculated weight coefficients, the node feature matrices output from the two channels are weighted and summed. If a certain view (such as a structural view) has a higher weight, the fused features will retain more information about that view. The final output is an enhanced node feature matrix that fuses information from both views.

[0150] In the above technical solution, the specific implementation of the classification decision module is as follows:

[0151] Graph Pooling (Readout): Receives the fused node feature matrix. Performs global mean pooling (calculating the average of all node features) and global max pooling (selecting the maximum value among all node features) respectively. Concatenates the results of these two pooling operations to form a fixed-length graph embedding vector that comprehensively represents the features of the entire traffic sample.

[0152] Fully connected classification: The graph embedding vector is input into a multilayer perceptron (MLP) classifier. This classifier contains several fully connected layers and dropout layers (to prevent overfitting).

[0153] Probability Output: The last fully connected layer connects to a Softmax activation function, outputting a probability distribution vector. The dimension of the vector equals the predefined number of website categories, with each dimension representing the probability that traffic belongs to the corresponding website. The category with the highest probability value is selected as the final recognition result output.

[0154] To make the objectives, technical solutions, and advantages of this invention clearer, examples are provided below for illustration.

[0155] Example 1

[0156] Step 1: Obtain the QUIC protocol network traffic data (PCAP file) to be inspected, parse the data packets, and preprocess them. Use a parsing library to identify the UDP protocol payload. According to the QUIC protocol specification, filter out the Initial and Handshake messages in the handshake phase, and only retain the 1-RTT type short message sequence that carries the data in the encrypted transmission phase.

[0157] Step 2: The preprocessed traffic data from Step 1 is aggregated and segmented based on time thresholds and transmission direction to generate a Burst sequence and extract features, specifically:

[0158] Step 2.1: Traverse the data packet sequence, setting the time interval threshold Δt to 50 milliseconds.

[0159] Step 2.2: If the time interval between the current data packet and the previous data packet exceeds 50 milliseconds, or if the transmission direction of the current data packet is different from that of the previous data packet (e.g., from uploading to downloading), then truncate the current sequence and generate a new Burst node.

[0160] Step 2.3: For each Burst node, extract its six statistical features: cumulative byte count, duration, number of packets, average packet size, variance of packet size, and peak rate. Then, perform logarithmic normalization on these numerical features to obtain the initial node feature vector matrix.

[0161] Step 3: Construct a dual-view hypergraph topology based on the Burst sequence and node features:

[0162] Step 3.1 (Constructing the temporal view): Set the sliding window size W=5, slide the window along the Burst sequence with a step size of 1, bind the 5 consecutive Burst nodes in each window into a temporal hyperedge to form a temporal context hypergraph, and output the temporal context hypergraph association matrix.

[0163] Step 3.2 (Constructing the structural view): Calculate the Euclidean distance between the feature vectors of any two Burst nodes, select the K=3 nearest neighbor nodes in the feature space, bind the current node to these 3 neighbors as a structural hyperedge to form a resource similarity hypergraph, and output the resource similarity hypergraph association matrix.

[0164] Step 3.3: Integrate the two association matrices above to form a dual-view hypergraph topology containing dual connectivity relationships.

[0165] Step 4: Construct a dual-view collaborative hypergraph neural network model. Input the temporal hypergraph association matrix, structural hypergraph association matrix, and initial node feature matrix from Step 3 into the model. The model performs multi-layer hypergraph convolution operations in parallel temporal and structural convolution channels. In each convolution layer, the "node-hyperedge-node" aggregation within each channel is first completed. Then, through a cross-view feature soft alignment module, the nodes output by the temporal convolution channel are embedded and projected into the feature space of the structural convolution channel for auxiliary correction to alleviate the single-view feature sparsity problem.

[0166] Step 5: Introduce a view-level attention mechanism to fuse dual-channel features: Initialize a learnable attention vector, and perform global mean pooling on the intermediate node features of the temporal and structural channel outputs to obtain view-level feature vectors; calculate the attention score and normalize it using the Softmax function to obtain the weight coefficients of the two views. Based on the weight coefficients, perform weighted fusion of the node feature matrices of the two channels to generate an enhanced node feature matrix.

[0167] Step 6: Perform graph-level aggregation and classification on the fused node feature matrix:

[0168] Steps 6.1-6.2: Perform global mean pooling and global max pooling operations on the fused node feature matrix, and concatenate the two pooled vectors to obtain the graph-level feature vector.

[0169] Steps 6.3-6.4: Input the graph-level feature vector into a two-layer fully connected classifier (Layer 1: Input 256, Output 128, LeakyReLU activation; Layer 2: Input 128, Output M=100, Softmax activation). Calculate the cross-entropy loss between the classifier output probability and the real website label, update the model parameters using the backpropagation algorithm, and complete the training.

[0170] Example 2:

[0171] Suppose a network administrator captures QUIC encrypted traffic (PCAP format) at the gateway egress point, which appears to be accessing a specific restricted video website. Using the model trained in Example 1, we identify this traffic by following these steps:

[0172] Step 1: We first read the PCAP file for preprocessing, parsing the UDP data stream. We aggregate the packets based on the connection ID, filter out TLS handshake phase messages, and retain only the 1-RTT packets from the encrypted transmission phase, obtaining a clean encrypted data sequence.

[0173] Step 2: We aggregate and segment the data sequence to generate a Burst sequence and extract features. Traversing the sequence, whenever a change in transmission direction is detected, or the time interval between adjacent packets exceeds a set threshold Δt (50 milliseconds), a Burst node is generated (assuming the sample is ultimately segmented into 120 Burst nodes). Then, for these 120 nodes, we extract multi-dimensional features including cumulative byte count, duration, number of packets, mean packet size, packet size variance, and peak rate, and perform logarithmic normalization to obtain an initial node feature matrix with 120 rows of features.

[0174] Step 3: We construct the dual-view hypergraph topology separately. First, we set the sliding window W=5 and the step size to 1 to slide over 120 Burst nodes, generating the temporal context hypergraph and its association matrix; second, we calculate the Euclidean distance of the 120 nodes in the feature space, find the K nearest neighbors for each node to form a hyperedge, and generate the resource similarity hypergraph and its association matrix.

[0175] Step 4: Input the dual-view hypergraph association matrix and the initial feature matrix into the pre-trained dual-view collaborative hypergraph neural network model. The model performs hypergraph convolution according to the formula in parallel temporal and structural channels to extract high-order features; at the same time, the cross-view feature soft alignment module in the model automatically projects the temporal features to the structural space for auxiliary correction.

[0176] Step 5: The model's view-level attention mechanism comes into play. The model performs global mean pooling on the two-channel features and calculates the score using the trained attention vectors, followed by Softmax normalization. Since video website traffic is significant in terms of resource size (such as large chunks of video data), the model automatically calculates a higher weight coefficient for the structured view. Subsequently, the model performs weighted fusion of the two-view features based on this weight, generating an enhanced node feature matrix.

[0177] Step 6: The model performs global mean pooling and global max pooling on the fused node feature matrix simultaneously, and concatenates the two to obtain a unified graph-level feature vector. This vector is then passed through two fully connected classifiers with sizes 256->128 (LeakyReLU activation) and 128->M (Softmax activation). The final output shows that the traffic has the highest probability (e.g., 99%) of belonging to the "a well-known video website" category. This category with the highest probability is selected as the final identification result, successfully identifying the source of the encrypted traffic.

Claims

1. A QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network, characterized in that, Includes the following steps: Step 1: Obtain the network traffic data of the QUIC protocol to be detected, parse the data packets and preprocess them, filter the handshake phase messages, and retain only the data of the encrypted transmission phase; Step 2: Aggregate and segment the traffic data after preprocessing in Step 1 based on time threshold and transmission direction to generate Burst sequences, and extract the statistical attributes of each Burst as the initial node feature vector. Step 3: Based on the Burst sequence and node features obtained in Step 2, construct the temporal context hypergraph and the resource similarity hypergraph using the sliding window mechanism and the K-nearest neighbor algorithm respectively, forming a dual-view hypergraph topology; Step 4: Construct a dual-view collaborative hypergraph neural network model. This model contains two parallel hypergraph convolution channels, which take the temporal context hypergraph and resource similarity hypergraph generated in Step 3 as inputs to perform high-order information transmission and updating of node features. Step 5: During the feature extraction process in Step 4, a view-level attention mechanism is introduced to automatically calculate the weight scores of the temporal view and the structural view, and to perform weighted fusion of the features output from the two channels to generate enhanced node representations. Step 6: Perform global graph pooling on the graph structure data fused in Step 5, aggregate node-level features into graph-level feature vectors, input them into the classifier for probability prediction, and output the website category to which QUIC traffic belongs.

2. The QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network according to claim 1, characterized in that, Dual-view collaborative hypergraph neural network model: It features a dual-parallel channel architecture, including two parallel hypergraph convolution channels: a temporal convolution channel and a structural convolution channel. It also includes a cross-view feature soft alignment module and a view-level attention fusion module. The input to the temporal convolution channel is the temporal context hypergraph correlation matrix and the initial node feature matrix; The input to the structured convolutional channel is the resource similarity hypergraph association matrix and the initial node feature matrix; Both channels perform multi-layer hypergraph convolution operations. In each convolution operation, the high-order feature aggregation of "node-hyperedge-node" in the current view is first completed. Then, through the cross-view feature soft alignment module, the temporal view nodes output by the temporal convolution channel are embedded and projected into the feature space of the structural convolution channel for auxiliary correction, which alleviates the feature sparsity problem under single view and outputs the intermediate node features of the corresponding view. The view-level attention fusion module receives intermediate node features from the outputs of two channels, automatically calculates the weight scores of the temporal view and the structural view, and performs weighted fusion of the features output from the two channels to generate an enhanced node representation containing multimodal complementary information.

3. The QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network according to claim 1, characterized in that, The specific steps of step 2 are as follows: Step 2.1: Traverse the preprocessed data packet sequence and set a time interval threshold Δt; Step 2.2: If the time interval between the current data packet and the previous data packet exceeds Δt, or if the transmission direction of the current data packet is different from that of the previous data packet, then truncate the current sequence and generate a new Burst node; Step 2.3: For each Burst node, extract multidimensional statistical features including cumulative byte count, duration, number of packets, average packet size, variance of packet size, and peak rate, and perform log normalization to obtain the node feature vector.

4. The QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network according to claim 1, characterized in that, The specific steps of step 3 are as follows: Step 3.1: Construct a temporal context hypergraph: Receive a sequence of Burst nodes arranged in chronological order, set the sliding window size W; slide the window along the sequence with a step size of 1, and bind the W consecutive Burst nodes covered by each window position into a temporal hyperedge; Traverse the entire sequence to generate a set of temporal hyperedges, form a temporal context hypergraph, and output its hypergraph association matrix; Step 3.2: Construct a resource similarity hypergraph: Based on the statistical feature vectors of each Burst node, calculate the Euclidean distance between any two nodes; for each Burst node, select the K nearest neighbor nodes in the feature space by Euclidean distance, and bind the current node to the K neighbor nodes as a structural hyperedge; traverse all nodes to generate a set of structural hyperedges, form a resource similarity hypergraph, and output its hypergraph association matrix; Step 3.3: Integrate the hypergraph association matrix obtained in Step 3.1 with the temporal context hypergraph association matrix and the resource similarity hypergraph association matrix obtained in Step 3.2 to form a dual-view hypergraph topology containing both temporal dependencies and resource structure similarity connections, which serves as the input data for the dual-view collaborative hypergraph neural network model.

5. The QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network according to claim 1, characterized in that, The specific formula for the hypergraph convolution operation of the dual-view collaborative hypergraph neural network model in step 4 is as follows: in: Let l be the node feature matrix of the l-th layer. For the hypergraph incidence matrix, The hyperedge weight matrix is ​​initialized as the identity matrix and adaptively updated during model training. The degree matrix is ​​a diagonal matrix. , where represents the number of superedges belonging to the i-th node. The degree matrix is ​​a diagonal matrix. , where represents the number of nodes contained in the j-th superedge. Let l be the learnable parameter matrix of the l-th layer. The activation function is non-linear, using the LeakyReLU function.

6. The QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network according to claim 1, characterized in that, The specific implementation of step 5 includes: Step 5.1: Initialize the learnable attention vectors, which are randomly initialized and then updated through model training; Step 5.2: Perform global mean pooling on the features output from the time-series channel and the features output from the structure channel respectively to obtain the view-level feature vector; Step 5.3: Calculate the attention score; Step 5.4: Normalize the attention score using the Softmax function to obtain the weight coefficients; Step 5.5: Based on the weight coefficients, perform weighted fusion of the features of the two views to generate the final node feature matrix.

7. The QUIC traffic website fingerprinting method based on a dual-view hypergraph neural network according to claim 1, characterized in that, The specific implementation of step 6 includes: Step 6.1: Perform global mean pooling and global max pooling operations on the fused node feature matrix; Step 6.2: Concatenate the two pooled vectors to obtain the graph-level feature vector; Step 6.3: Input the graph-level feature vector into a fully connected classifier, which contains two fully connected layers. The first layer has an input dimension of 256, an output dimension of 128, and uses LeakyReLU as the activation function. Second layer: Input dimension 128, output dimension is the predefined number of website categories M, activation function is Softmax; Step 6.4: Output the probability value for each website category, and select the category with the highest probability as the final recognition result.

8. A QUIC traffic website fingerprinting system based on a dual-view hypergraph neural network, characterized in that, Includes the following functional modules: Traffic Acquisition and Preprocessing Module: Responsible for capturing raw traffic data from the network environment, cleaning out irrelevant background traffic and control messages, and segmenting continuous data packet streams into discrete Burst node sequences to provide standardized input data for subsequent processing; Dual-view hypergraph construction module: It receives the Burst node sequence and node feature matrix, constructs a temporal context hypergraph through a sliding window mechanism and a resource similarity hypergraph through the K-nearest neighbor algorithm, and outputs the association matrix of the two hypergraphs. Dual-channel hypergraph model module: used to load a pre-trained dual-view collaborative hypergraph neural network. The association matrix and node feature matrix of the two hypergraphs are respectively input into two parallel hypergraph convolution channels to extract high-order features and perform adaptive fusion through a view-level attention mechanism, and output the fused node feature matrix. Classification Decision Module: This module performs graph pooling on the fused node feature matrix to generate graph-level feature vectors. These vectors are then input into a fully connected classifier for probability prediction, and the output is the website category label and confidence level corresponding to the QUIC traffic.

9. A QUIC traffic website fingerprinting system based on a dual-view hypergraph neural network according to claim 8, characterized in that, The specific implementation of the dual-view hypergraph construction module is as follows: The sliding window size W is set to 5 by default, and the number of nearest neighbors K is set to 3 by default. Users can manually adjust the range of parameter values ​​according to the actual application scenario.

10. A QUIC traffic website fingerprinting system based on a dual-view hypergraph neural network according to claim 8, characterized in that, The classification decision module also includes a result output submodule, which supports two output modes: Detailed mode: Outputs the probability distribution, final identified tags, and confidence scores for all website categories; Simplified mode: Only outputs the final identified label and confidence score, suitable for real-time detection scenarios.

Images