Attack flow tracing method and device in anonymous communication network

Abstract

The embodiment of the application discloses a method and device for attack flow tracing in an anonymous communication network, and relates to the technical field of Internet data analysis.The method comprises the following steps: obtaining data flows of each node on a communication link during anonymous communication, wherein the each node comprises an entry node, each intermediate node and an exit node; extracting key features in the node data flow, and constructing an input vector matrix corresponding to the node; performing operation on the input vector matrix through a time convolution network (TCN) and a multi-head bidirectional attention network to obtain a description matrix corresponding to the node; for any two nodes in the each node, calculating a similarity matrix between the two nodes according to the description matrices corresponding to the two nodes respectively; and based on each similarity matrix, selecting a preset number of most matched mutual adjacent node pairs therefrom to reconstruct an intermediate link of the anonymous communication.The application can improve the identification accuracy and reliability of attack behaviors in the anonymous communication process.

Description

Technical Field

[0001] This invention relates to the field of Internet data analysis technology, specifically to a method and apparatus for tracing attack flows in anonymous communication networks. Background Technology

[0002] With the continuous development of internet data analysis technology, users are particularly concerned about privacy issues arising when accessing the network. Therefore, anonymous communication systems, using specific software, configurations, or authorized access, conceal communication relationships within the communication flow, making it difficult for others to obtain or infer the relationship and content of the communication between the parties. The purpose of anonymous communication is to conceal the identities or communication relationships of the communicating parties and protect the personal communication privacy of network users.

[0003] However, due to the anonymity and difficulty in tracing inherent in anonymous communication systems, anonymous communication technology has been frequently used in attack activities in recent years. Simultaneously, with the increase and complexity of anonymous communication activities, traditional network tracing techniques are unable to meet the new challenges, resulting in low accuracy in identifying attack behaviors during anonymous communication. Summary of the Invention

[0004] The purpose of this invention is to solve the problems existing in the prior art and to provide a method and apparatus for tracing attack flows in anonymous communication networks.

[0005] The attack flow tracing method in anonymous communication networks provided by this invention is implemented through the following technical solution: During anonymous communication, the data flow of each node on the communication link is acquired, wherein each node includes an entry node, each intermediate node, and an exit node; key features in the node data flow are extracted, and an input vector matrix corresponding to the node is constructed; the input vector matrix is ​​processed by a temporal convolutional network (TCN) and a multi-head bidirectional attention network to obtain a description matrix corresponding to the node; for any two nodes among the nodes, a similarity matrix between the two nodes is calculated based on the description matrices corresponding to the two nodes respectively; based on each similarity matrix, a preset number of the most matched neighboring node pairs are selected to reconstruct the intermediate link of anonymous communication.

[0006] Furthermore, the step of extracting key features from the node data stream and constructing the input vector matrix corresponding to the node includes: acquiring all node data streams within a preset time period and normalizing the data streams; dividing the normalized data streams according to a preset number of data packets to obtain multiple two-dimensional matrices of a preset size; concatenating the multiple two-dimensional matrices into a three-dimensional matrix as the input vector matrix; the shape of the three-dimensional matrix is ​​[B, N, W, H], where B represents the size of the batch, W represents the preset number of data packets, N represents the total number of data packets within the preset time period divided by W, and H represents the number of numerical features.

[0007] Furthermore, the method also includes: setting tag information for the data stream, where the tag is y. iajb =1 is used to characterize that the data stream a of node i and the data stream b of node j are related data streams, and the label y iajb =0 is used to indicate that the data flow a of node i and the data flow b of node j are not related data flows; a deep learning model is trained based on a dataset containing label information, the deep learning model including the temporal convolutional network TCN and the multi-head bidirectional attention network.

[0008] Furthermore, the step of processing the input vector matrix through a Temporal Convolutional Network (TCN) and a Multi-Head Bidirectional Attention Network (MTN) to obtain the description matrix corresponding to the node includes: extracting the corresponding feature vectors from the input vector matrix through the TCN corresponding to the node and downsampling them; calculating the attention scores of each data stream by processing the feature vectors through the MCN; multiplying the attention scores by the feature vectors and upsampling them through the TCN to obtain the description matrix.

[0009] Furthermore, the step of calculating the similarity matrix between any two nodes based on their respective description matrices includes: for any node i and node j, calculating the similarity matrix between them according to the formula... Calculate the similarity matrix between node i and node j; where D i Let D be the description matrix of node i. j Let S be the description matrix of node j, and let S be the similarity matrix between node i and node j.

[0010] The attack flow tracing device in the anonymous communication network provided by this invention is implemented through the following technical solutions: a data flow acquisition module, used to acquire the data flow of each node on the communication link during anonymous communication, wherein each node includes an entry node, each intermediate node, and an exit node; a feature extraction module, used to extract key features from the node data flow and construct the input vector matrix corresponding to the node; a description matrix operation module, used to operate the input vector matrix through a temporal convolutional network (TCN) and a multi-head bidirectional attention network to obtain the description matrix corresponding to the node; a similarity matrix calculation module, used to calculate the similarity matrix between any two nodes based on the description matrices corresponding to the two nodes; and a selection module, used to select a preset number of the most matched neighboring node pairs based on the similarity matrices to reconstruct the intermediate link of the anonymous communication.

[0011] Furthermore, the feature extraction module includes: a normalization processing submodule, used to acquire all node data streams within a preset time period and normalize the data streams; a segmentation submodule, used to segment the normalized data streams according to a preset number of data packets to obtain multiple two-dimensional matrices of a preset size; and a splicing submodule, used to splice the multiple two-dimensional matrices into a three-dimensional matrix as the input vector matrix; the shape of the three-dimensional matrix is ​​[B, N, W, H], where B represents the size of the batch, W represents the preset number of data packets, N represents the total number of data packets within the preset time period divided by W, and H represents the number of numerical features.

[0012] Furthermore, the device also includes: a tag setting module, used to set tag information for the data stream, tag y iajb =1 is used to characterize that the data stream a of node i and the data stream b of node j are related data streams, and the label y iajb =0 is used to indicate that the data flow a of node i and the data flow b of node j are not related data flows; the training module is used to train the deep learning model based on the dataset containing label information, the deep learning model includes the temporal convolutional network TCN and the multi-head bidirectional attention network.

[0013] Furthermore, the description matrix operation module includes: a feature extraction submodule, used to extract corresponding feature vectors from the input vector matrix through the temporal convolutional network (TCN) corresponding to the node, and perform downsampling; an attention calculation submodule, used to calculate the attention score of each data stream by passing the feature vector through the multi-head bidirectional attention network; and a description matrix operation submodule, used to multiply the attention score by the feature vector and perform upsampling through the temporal convolutional network (TCN) to obtain the description matrix.

[0014] Furthermore, the similarity matrix calculation module is also used to calculate the similarity matrix for any node i and node j among the nodes, according to the formula... Calculate the similarity matrix between node i and node j; where D i Let D be the description matrix of node i. j Let S be the description matrix of node j, and let S be the similarity matrix between node i and node j.

[0015] Compared with the prior art, the beneficial effects of the present invention include:

[0016] 1. This invention analyzes and processes the data streams captured at each communication node, enabling it to match each node in the intermediate data transmission link while matching the traffic at both ends, and reconstruct the intermediate link of anonymous communication. This improves the accuracy and reliability of identifying attack behaviors during anonymous communication in complex anonymous communication environments.

[0017] 2. This invention models the flow matching problem as a three-dimensional image matching problem, and incorporates the inherent temporal characteristics of the flow sequence on this basis. It simultaneously associates all node data streams within a certain period of time and improves the flow matching rate through parallel computing.

[0018] 3. This invention, by inputting input vectors from different nodes into the improved Temporal Convolutional Network (TCN) corresponding to those nodes, can transform discrete high-dimensional input vectors into dense low-dimensional vectors while preserving the temporal features of the stream itself. Since the computational complexity of the attention mechanism is quadratically related to the length and dimension of the input sequence, dimensionality reduction of the input vectors can significantly reduce the computational cost of the attention network, thereby greatly improving the model's computational efficiency and scalability.

[0019] 4. This invention extracts feature vectors through a Temporal Convolutional Network (TCN) to obtain the correlation within channels, and calculates the attention scores of each data stream through a multi-head bidirectional attention network to obtain the correlation between channels. Therefore, it can capture the bidirectional relationship between the ingress and egress streams while also capturing the contextual feature information of the ingress and egress streams themselves.

[0020] 5. This invention marks the correlation between data streams between nodes by adding label information to some stream data, which enables effective training of the model through semi-supervised learning. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating the attack flow tracing method in an anonymous communication network according to this specific embodiment.

[0022] Figure 2 This is another flowchart illustrating the attack flow tracing method in the anonymous communication network in this specific embodiment;

[0023] Figure 3 This is a schematic diagram of the input vector matrix in this specific embodiment;

[0024] Figure 4 This is a schematic diagram of the temporal convolutional network in this specific embodiment;

[0025] Figure 5 This is a schematic diagram of the collaborative attention mechanism calculation in this specific embodiment;

[0026] Figure 6 This is a schematic diagram of the attack flow tracing device in the anonymous communication network in this specific embodiment;

[0027] Figure 7 This is a schematic diagram of the feature extraction module in this specific embodiment;

[0028] Figure 8 This is another structural schematic diagram of the attack flow tracing device in the anonymous communication network in this specific embodiment;

[0029] Figure 9 This is a schematic diagram illustrating the structure of the matrix operation module in this specific embodiment. Detailed Implementation

[0030] The present invention will now be described in further detail with reference to the accompanying drawings:

[0031] refer to Figure 1 As shown, the attack flow tracing method in the anonymous communication network in this specific embodiment includes:

[0032] 101. In anonymous communication, the data streams of each node on the communication link are obtained, and each node includes an entry node, each intermediate node and an exit node.

[0033] 102. Extract key features from the node data stream and construct the input vector matrix corresponding to the node.

[0034] 103. The input vector matrix is ​​processed by a temporal convolutional network (TCN) and a multi-head bidirectional attention network to obtain the description matrix corresponding to the node.

[0035] In this embodiment of the invention, by inputting input vectors from different nodes into the improved Temporal Convolutional Network (TCN) corresponding to those nodes, discrete high-dimensional input vectors can be transformed into dense low-dimensional vectors while preserving the temporal features of the stream itself. Since the computational complexity of the attention mechanism is quadratically related to the length and dimension of the input sequence, dimensionality reduction of the input vectors can significantly reduce the computational cost of the attention network, thereby greatly improving the model's computational efficiency and scalability.

[0036] 104. For any two nodes among the nodes, calculate the similarity matrix between the two nodes based on the description matrices corresponding to the two nodes respectively.

[0037] In this embodiment of the invention, feature vectors are extracted using a Temporal Convolutional Network (TCN) to obtain the correlation within channels, and attention scores for each data stream are calculated using a multi-head bidirectional attention network to obtain the correlation between channels. Thus, it is possible to capture the bidirectional relationship between the ingress and egress streams while also capturing the contextual feature information of each ingress and egress stream separately.

[0038] 105. Based on each similarity matrix, select a preset number of the most matching neighboring node pairs to reconstruct the intermediate link for anonymous communication.

[0039] The embodiments of the present invention provide a method to perform two-way source tracing and matching based on data streams, and to match the flow in the intermediate link as much as possible while matching the traffic at both ends, thereby depicting the path of anonymous communication as completely as possible.

[0040] Compared to existing technologies, this invention models the flow matching problem as a three-dimensional image matching problem and incorporates the inherent temporal characteristics of the flow sequence. It simultaneously correlates all node data streams within a given time period and improves the flow matching rate through parallel computation. Furthermore, this invention can analyze and process the data streams captured at each communication node, matching both ends of the traffic while identifying nodes in the intermediate data transmission link, thus reconstructing the intermediate link of anonymous communication. This improves the accuracy and reliability of identifying attacks during anonymous communication in complex environments.

[0041] refer to Figure 2 As shown, another method for tracing attack flows in an anonymous communication network in this specific embodiment includes:

[0042] 201. In anonymous communication, obtain the data stream of each node on the communication link.

[0043] Each node includes an entry node, intermediate nodes, and an exit node.

[0044] 202. Obtain all node data streams within a preset time period and normalize the data streams.

[0045] In this embodiment of the invention, traffic data from ingress nodes, intermediate nodes, and egress nodes can be collected, and the uplink data packet time interval, downlink data packet time interval, uplink data packet size, and downlink data packet size within a certain period (e.g., within 5 seconds) can be extracted. Then, according to the formula... The packet size in the streaming data is normalized to adjust its numerical characteristic range. In this embodiment of the invention, normalization can accelerate training, improve numerical stability, enhance generalization ability, and simplify the optimization process.

[0046] 203. The normalized data stream is divided into multiple two-dimensional matrices of a preset size according to the preset number of data packets.

[0047] 204. Concatenate the multiple two-dimensional matrices into a three-dimensional matrix, which serves as the input vector matrix.

[0048] refer to Figure 3 As shown, the input vector matrix constructed in this embodiment of the invention is a three-dimensional matrix with the shape [B, N, W, H]. Here, B represents the size of the batch, W represents the preset number of data packets, N represents the total number of data packets within the preset time period divided by W, and H represents the number of numerical features.

[0049] For an embodiment of the present invention, exemplarily, streaming data within a certain period of time (e.g., within 5 seconds) can be segmented into small two-dimensional matrices at intervals of W = 300 packets, and these matrices can be concatenated into a three-dimensional input matrix as shown in the figure below. Considering that the length of the stream captured at different nodes is different, N = 12 can be set, and padding can be used to complete the data where it is insufficient. At this time, the specific values ​​of the shape and size of the input vector matrix are [512, 12, 300, 4].

[0050] In this embodiment of the invention, it may further include: setting tag information for the data stream, the tag being y. iajb =1 is used to characterize that the data stream a of node i and the data stream b of node j are related data streams, and the label y iajb =0 is used to indicate that the data flow a of node i and the data flow b of node j are not related data flows; and the deep learning model is trained based on the dataset containing label information, the deep learning model including the temporal convolutional network TCN and the multi-head bidirectional attention network.

[0051] In this embodiment of the invention, by adding label information to some stream data, the correlation between data streams between nodes is marked, which enables effective training of the model through semi-supervised learning.

[0052] 205. The input vector matrix is ​​passed through the temporal convolutional network (TCN) corresponding to the node to extract the corresponding feature vector and then downsampled.

[0053] In this embodiment of the invention, input vectors from different nodes can be fed into the corresponding improved temporal convolutional network (TCN), thereby converting discrete high-dimensional input vectors into denser low-dimensional vectors with higher information content while preserving the temporal characteristics of the stream itself, so as to enable efficient computation of subsequent multi-head bidirectional attention networks.

[0054] In this embodiment of the invention, the Temporal Convolutional Network (TCN) is a deep learning model specifically designed for processing sequential data. It combines the parallel processing capabilities of a Convolutional Neural Network (CNN) with the long-term dependency modeling capabilities of a Recurrent Neural Network (RNN). (Reference) Figure 4 The diagram shows a temporal convolutional network. In this embodiment of the invention, the temporal convolutional network (TCN) is improved by setting the Kernekl size to 2 (the points in the next layer are composed of 2 points from the previous layer) and dilation to [1, 2, 4, 8] (a total of 4 layers, each layer takes 2 values ​​from the previous layer to form a new value at intervals of 1, 2, 4, and 8 points).

[0055] In this embodiment of the invention, the Temporal Convolutional Network (TCN) also uses residual connections to alleviate the vanishing gradient problem and facilitate the training of deeper networks. Residual connections are a key component of ResNets, addressing the vanishing / exploding gradient problem in deep neural network training and improving network training efficiency and performance.

[0056] In this embodiment of the invention, by inputting input vectors from different nodes into the improved Temporal Convolutional Network (TCN) corresponding to those nodes, discrete high-dimensional input vectors can be transformed into dense low-dimensional vectors while preserving the temporal features of the stream itself. Since the computational complexity of the attention mechanism is quadratically related to the length and dimension of the input sequence, dimensionality reduction of the input vectors can significantly reduce the computational cost of the attention network, thereby greatly improving the model's computational efficiency and scalability.

[0057] 206. The feature vector is passed through the multi-head bidirectional attention network to calculate the attention score of each data stream.

[0058] In this embodiment of the invention, a bidirectional attention mechanism is employed. This mechanism combines collaborative attention and self-attention to simultaneously establish associations between two input sequences and within a single sequence. Therefore, it considers both the interaction between input sequences and the associations within sequences. (See reference...) Figure 5 The diagram shown is a schematic of the computation of the collaborative attention mechanism.

[0059] 207. Multiply the attention score by the feature vector and upsample it through the temporal convolutional network (TCN) to obtain the description matrix.

[0060] In this embodiment of the invention, feature vectors are extracted using a Temporal Convolutional Network (TCN) to obtain the correlation within channels, and attention scores for each data stream are calculated using a multi-head bidirectional attention network to obtain the correlation between channels. Thus, it is possible to capture the bidirectional relationship between the ingress and egress streams while also capturing the contextual feature information of each ingress and egress stream separately.

[0061] 208. For any node i and node j among the aforementioned nodes, according to the formula... Calculate the similarity matrix between node i and node j.

[0062] Among them, D i Let D be the description matrix of node i. j Let S be the description matrix of node j, and let S be the similarity matrix between node i and node j.

[0063] The embodiments of the present invention provide a method to perform two-way source tracing and matching based on data streams, and to match the flow in the intermediate link as much as possible while matching the traffic at both ends, thereby depicting the path of anonymous communication as completely as possible.

[0064] Compared to existing technologies, this invention models the flow matching problem as a three-dimensional image matching problem and incorporates the inherent temporal characteristics of the flow sequence. It simultaneously correlates all node data streams within a given time period and improves the flow matching rate through parallel computation. Furthermore, this invention can analyze and process the data streams captured at each communication node, matching both ends of the traffic while identifying nodes in the intermediate data transmission link, thus reconstructing the intermediate link of anonymous communication. This improves the accuracy and reliability of identifying attacks during anonymous communication in complex environments.

[0065] refer to Figure 6 As shown, the attack flow tracing device in the anonymous communication network of this specific embodiment includes:

[0066] The data stream acquisition module 61 is used to acquire the data streams of each node on the communication link during anonymous communication. The nodes include an entry node, each intermediate node, and an exit node.

[0067] The feature extraction module 62 is used to extract key features from the node data stream and construct the input vector matrix corresponding to the node.

[0068] The description matrix operation module 63 is used to perform operations on the input vector matrix through a temporal convolutional network (TCN) and a multi-head bidirectional attention network to obtain the description matrix corresponding to the node.

[0069] The similarity matrix calculation module 64 is used to calculate the similarity matrix between any two nodes based on the description matrices corresponding to the two nodes.

[0070] Selection module 65 is used to select a preset number of the best-matching neighboring node pairs based on each similarity matrix to reconstruct the intermediate link for anonymous communication.

[0071] refer to Figure 7 As shown, the feature extraction module 62 further includes: a normalization processing submodule 6201, a segmentation submodule 6202, and a splicing submodule 6203.

[0072] The normalization processing submodule 6201 is used to obtain all node data streams within a preset time period and perform normalization processing on the data streams.

[0073] The segmentation submodule 6202 is used to segment the normalized data stream according to the preset number of data packets to obtain multiple two-dimensional matrices of preset size.

[0074] The splicing submodule 6203 is used to splice the multiple two-dimensional matrices into a three-dimensional matrix as the input vector matrix; the shape of the three-dimensional matrix is ​​[B,N,W,H], where B is used to represent the size of the batch, W is used to represent the preset number of data packets, N is used to represent the total number of data packets in the preset time period divided by the value of W, and H is used to represent the number of numerical features.

[0075] refer to Figure 8 As shown, the device further includes: a tag setting module 66 and a training module 67.

[0076] Tag setting module 66 is used to set tag information for the data stream, tag y iajb =1 is used to characterize that the data stream a of node i and the data stream b of node j are related data streams, and the label y iajb=0 is used to indicate that the data flow a of node i and the data flow b of node j are not related data flows.

[0077] Training module 67 is used to train a deep learning model based on a dataset containing labeled information, wherein the deep learning model includes the temporal convolutional network TCN and the multi-head bidirectional attention network.

[0078] refer to Figure 9 As shown, the description matrix operation module 63 further includes: a feature extraction submodule 6301, an attention calculation submodule 6302, and a description matrix operation submodule 6303.

[0079] The feature extraction submodule 6301 is used to extract the corresponding feature vectors from the input vector matrix through the temporal convolutional network (TCN) corresponding to the node, and then perform downsampling.

[0080] The attention calculation submodule 6302 is used to calculate the attention score of each data stream by passing the feature vector through the multi-head bidirectional attention network.

[0081] The description matrix operation submodule 6303 is used to multiply the attention score by the feature vector and upsample it through the temporal convolutional network TCN to obtain the description matrix.

[0082] The similarity matrix calculation module 64 is also used to calculate the similarity matrix for any node i and node j among the nodes, according to the formula Calculate the similarity matrix between node i and node j; where D i Let D be the description matrix of node i. j Let S be the description matrix of node j, and let S be the similarity matrix between node i and node j.

[0083] The attack flow tracing device in the anonymous communication network provided in this specific embodiment can implement the method implementation method described above. For specific functional implementation, please refer to the description in the method embodiment, which will not be repeated here.

[0084] The above technical solution is only one embodiment of the present invention. For those skilled in the art, based on the principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the technical solutions described in the specific embodiments of the present invention. Therefore, the foregoing description is only a preferred option and is not restrictive.

Claims

1. A method for tracing attack flows in anonymous communication networks, characterized in that, include: In anonymous communication, the data streams of each node on the communication link are obtained, and each node includes an entry node, each intermediate node and an exit node; Extract key features from the node data stream and construct the input vector matrix corresponding to the node; The input vector matrix is ​​processed by a temporal convolutional network (TCN) and a multi-head bidirectional attention network to obtain the description matrix corresponding to the node. For any two nodes among the nodes, the similarity matrix between the two nodes is calculated based on the description matrices corresponding to the two nodes respectively. Based on each similarity matrix, a preset number of the most matching neighboring node pairs are selected to reconstruct the intermediate link for anonymous communication.

2. The attack flow tracing method in an anonymous communication network according to claim 1, characterized in that, The extraction of key features from the node data stream and the construction of the input vector matrix corresponding to the node include: Acquire all node data streams within a preset time period and normalize the data streams; The normalized data stream is divided into multiple two-dimensional matrices of a preset size according to the preset number of data packets. The multiple two-dimensional matrices are concatenated into a three-dimensional matrix, which serves as the input vector matrix. The shape of the three-dimensional matrix is ​​[B, N, W, H], where B represents the size of the batch, W represents the preset number of data packets, N represents the total number of data packets in the preset time period divided by W, and H represents the number of numerical features.

3. The attack flow tracing method in an anonymous communication network according to claim 2, characterized in that, The method further includes: Set tag information for the data stream, tag y iajb =1 is used to characterize that the data stream a of node i and the data stream b of node j are related data streams, and the label y iajb =0 is used to indicate that data flow a at node i and data flow b at node j are not related data flows; A deep learning model is trained based on a dataset containing labeled information. The deep learning model includes the Temporal Convolutional Network (TCN) and the Multi-Head Bidirectional Attention Network (MBON).

4. The attack flow tracing method in an anonymous communication network according to claim 1, characterized in that, The step of processing the input vector matrix through a temporal convolutional network (TCN) and a multi-head bidirectional attention network to obtain the description matrix corresponding to the node includes: The input vector matrix is ​​passed through the Temporal Convolutional Network (TCN) corresponding to the node to extract the corresponding feature vector, and then downsampled. The feature vectors are passed through the multi-head bidirectional attention network to calculate the attention scores for each data stream. The attention score is multiplied by the feature vector, and then upsampled through the temporal convolutional network (TCN) to obtain the description matrix.

5. The attack flow tracing method in an anonymous communication network according to claim 1, characterized in that, The step of calculating the similarity matrix between any two nodes based on their respective description matrices includes: For any node i and node j among the aforementioned nodes, according to the formula Calculate the similarity matrix between node i and node j; where D i Let D be the description matrix of node i. j Let S be the description matrix of node j, and let S be the similarity matrix between node i and node j.

6. An attack flow tracing device in an anonymous communication network, characterized in that, include: The data stream acquisition module is used to acquire the data streams of each node on the communication link during anonymous communication. The nodes include an entry node, each intermediate node, and an exit node. The feature extraction module is used to extract key features from the node data stream and construct the input vector matrix corresponding to the node; The description matrix operation module is used to perform operations on the input vector matrix through a temporal convolutional network (TCN) and a multi-head bidirectional attention network to obtain the description matrix corresponding to the node. The similarity matrix calculation module is used to calculate the similarity matrix between any two nodes in the nodes, based on the description matrices corresponding to the two nodes respectively. The selection module is used to select a preset number of the most matching neighboring node pairs based on each similarity matrix to reconstruct the intermediate link for anonymous communication.

7. The attack flow tracing device in an anonymous communication network according to claim 6, characterized in that, The feature extraction module includes: The normalization processing submodule is used to obtain all node data streams within a preset time period and perform normalization processing on the data streams; The segmentation submodule is used to segment the normalized data stream according to the preset number of data packets to obtain multiple two-dimensional matrices of preset size; The splicing submodule is used to splice the multiple two-dimensional matrices into a three-dimensional matrix, which serves as the input vector matrix. The shape of the three-dimensional matrix is ​​[B, N, W, H], where B represents the size of the batch, W represents the preset number of data packets, N represents the total number of data packets in the preset time period divided by W, and H represents the number of numerical features.

8. The attack flow tracing device in an anonymous communication network according to claim 7, characterized in that, The device further includes: The tag setting module is used to set tag information for the data stream, tag y iajb =1 is used to characterize that the data stream a of node i and the data stream b of node j are related data streams, and the label y iajb =0 is used to indicate that data flow a at node i and data flow b at node j are not related data flows; The training module is used to train a deep learning model based on a dataset containing labeled information. The deep learning model includes the Temporal Convolutional Network (TCN) and the Multi-Head Bidirectional Attention Network (MNI).

9. The attack flow tracing device in an anonymous communication network according to claim 6, characterized in that, The description matrix operation module includes: The feature extraction submodule is used to extract the corresponding feature vectors from the input vector matrix through the temporal convolutional network (TCN) corresponding to the node, and then perform downsampling. The attention calculation submodule is used to calculate the attention score of each data stream by passing the feature vector through the multi-head bidirectional attention network; The description matrix operation submodule is used to multiply the attention score by the feature vector and upsample it through the temporal convolutional network (TCN) to obtain the description matrix.

10. The attack flow tracing device in an anonymous communication network according to claim 6, characterized in that, The similarity matrix calculation module is also used to calculate the similarity matrix for any node i and node j among the nodes, according to the formula... Calculate the similarity matrix between node i and node j; where D i Let D be the description matrix of node i. j Let S be the description matrix of node j, and let S be the similarity matrix between node i and node j.

Images