A method and system for feature repair of anonymous perturbation traffic
By combining self-similarity constraints and category consistency constraints, feature repair of anonymous perturbation traffic is achieved, which solves the reliance on prior knowledge in existing technologies and improves the accuracy and generalization ability of anonymous traffic analysis.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- INSTITUTE OF INFORMATION ENGINEERING CHINESE ACADEMY OF SCIENCES
- Filing Date
- 2026-05-20
- Publication Date
- 2026-07-31
AI Technical Summary
Existing anonymous perturbation flow analysis methods rely heavily on prior knowledge, lack blind analysis capabilities, and are unable to cope with unknown perturbation methods, resulting in a decline in analysis performance.
By combining a generation module with self-similarity constraints and a discrimination module with category consistency constraints, the system reconstructs and restores highly identifiable traffic features by repairing the features of anonymous perturbation traffic, thus enabling blind analysis without the need for predictive perturbation methods.
It effectively eliminates the reliance on prior knowledge of perturbation methods, improves the accuracy and generalization performance of downstream behavior analysis, and enhances the ability to identify and classify in adversarial environments.
Smart Images
Figure CN122496280A_ABST
Abstract
Description
Technical Field
[0001] This invention discloses a method and system for feature restoration of anonymous perturbation traffic, belonging to the field of network security technology. Background Technology
[0002] With the widespread adoption of internet services, online privacy protection has gained increasing attention. Anonymous networks, as a privacy protection mechanism built on the internet, utilize various technologies such as traffic forwarding, traffic encryption, and traffic obfuscation to make the relationships between communicating entities and the content of their communications unpredictable, thus allowing users to operate anonymously in cyberspace. However, while protecting user privacy, anonymous networks also pose a risk of being abused by illegal online activities. Based on the needs of cyberspace security governance, anonymous network behavior analysis methods aimed at discovering and tracing anonymous network behavior have become a current research hotspot. Most academic methods for anonymous network behavior analysis focus on Tor Anonymous Network traffic, primarily including anonymous traffic fingerprinting for behavior discovery and anonymous traffic correlation for behavior tracing.
[0003] In the battle between anonymous network behavior analysis and anti-analysis, various anti-analysis methods have been proposed to counter monitoring techniques such as traffic association and fingerprinting. These methods alter traffic patterns through traffic perturbation to weaken the effectiveness of traffic association and fingerprinting. Existing anti-perturbation traffic association methods mainly fall into two categories. One is to implant traffic markers, represented by Active Flow Watermarking, which theoretically can associate perturbed traffic. However, when the implanted signal strength needs to overwhelm the traffic perturbation, it is easily detected and can lead to a huge network load. The other is to refine the association granularity, segmenting the ingress and egress data streams by time window and predicting the correlation between the segments. Fine-grained comprehensive decision-making weakens the impact of perturbation, but this method requires perturbed samples as training data. Meanwhile, existing anti-perturbation traffic fingerprinting methods also include two types: targeted identification that analyzes specific perturbation methods, and non-targeted identification that retrains the model using perturbed samples. The latter is applicable to almost all traffic perturbation methods.
[0004] However, the existing methods for identifying and associating anonymous perturbation traffic fingerprints have significant limitations in practical applications. Current analysis methods heavily rely on prior knowledge of the perturbation techniques. In real-world governance scenarios, analysts are often unaware of the perturbation methods, find it difficult to obtain details beforehand, and struggle to collect genuine perturbation traffic data for model retraining. Due to the lack of blind analysis capabilities against unknown perturbation techniques, the performance of existing analysis models deteriorates significantly when faced with unknown traffic perturbation technologies. Therefore, designing a perturbation-resistant traffic analysis method that is independent of perturbation techniques and possesses blind analysis capabilities, rather than relying on prior knowledge and specific perturbation samples, is a critical technical problem urgently needing to be solved in the field of anonymous network security. Summary of the Invention
[0005] The purpose of this invention is to address the technical problems of existing anonymous perturbation flow analysis methods that rely on prior knowledge and lack blind analysis capabilities. This invention proposes a feature repair method for anonymous perturbation flow, which achieves the effect of restoring highly identifiable flow features and improving the accuracy of downstream behavior analysis by reconstructing and repairing damaged flow features without the need for prior knowledge of the perturbation.
[0006] To achieve the above objectives, the present invention adopts the following technical solution.
[0007] A method for feature restoration of anonymous perturbation traffic includes the following steps: The acquired raw traffic is preprocessed and masked to generate a masked traffic sequence; The masked traffic sequence is reconstructed and restored by the generation module based on self-similarity constraints to obtain the masked restored sequence. The discrimination module performs discrimination processing on the mask restoration sequence based on category consistency information to obtain the discrimination probability that the sample is a real sample or a generated sample; The generation module and the discrimination module are jointly trained and optimized based on the discrimination probability. The optimized generation module is used to perform feature repair on the anonymous perturbation traffic to be analyzed, and the repaired traffic feature sequence is output.
[0008] Furthermore, the acquired raw traffic is preprocessed and masked to generate a masked traffic sequence, including: The original traffic sequence is transformed into a burst sequence consisting of the sum of consecutive cells in the same direction or the number of bytes in the data packets; The burst sequence containing uplink and downlink characteristics is decomposed and masked to generate a masked flow sequence with a length twice that of the original flow sequence.
[0009] Furthermore, the burst sequence containing uplink and downlink features is decomposed and masked, including: Obtain a comprehensive burst sequence formed by non-disturbance traffic that simultaneously contains information about both uplink and downlink flows; Each burst feature in the integrated burst sequence is split according to a set ratio to obtain a retained portion and a mask portion used to fill in noise data.
[0010] Furthermore, the masked traffic sequence is reconstructed and restored based on self-similarity constraints by the generation module to obtain a masked restored sequence, including: Separate the retained portion corresponding to the index position and the masked portion corresponding to the index position on the masked traffic sequence; The separated retained portion and masked portion are divided into sub-sequence data blocks with a fixed step size, and the sub-sequence data blocks are used as input for reconstruction and restoration.
[0011] Further, the subsequence data block is used as input for reconstruction and restoration processing, including: Linear mapping and hidden layer representation extraction are performed on the subsequence data blocks corresponding to the retained portion; The extracted hidden layer representation is concatenated with the linear mapping vector corresponding to the mask portion, and then the restored value of the corresponding mask position is obtained through mapping transformation.
[0012] Furthermore, the discrimination module performs discrimination processing on the mask reconstruction sequence based on category consistency information to obtain the discrimination probability that a sample is a real sample or a generated sample, including: The generated mask restoration sequence is combined with the retained portion to form a complete sample; The probability of a complete sample being a real sample or a generated sample is determined based on category characteristic information, thus obtaining the discrimination probability.
[0013] Further, the generated mask restoration sequence is combined with the preserved portion to synthesize a complete sample, including: The retained portion is mapped to obtain an abstract vector that reflects the characteristics of the sample category; The abstract vector is used as conditional information, and combined with the mask restoration sequence and the retained portion to synthesize a complete sample.
[0014] Further, the generation module and the discrimination module are jointly trained and optimized based on the discrimination probability, including: Calculate the reconstruction loss of the masked sequence at the corresponding positions of the masked portion in the original traffic sequence; The generation module and the discrimination module are jointly trained by combining the reconstruction loss and the discrimination probability.
[0015] Further, the reconstruction loss is calculated between the masked reconstruction sequence and the corresponding positions of the masked portion in the original traffic sequence, including: Obtain the generated mask reconstruction sequence and the corresponding original observations of the mask portion; The mean square error between the masked reconstruction sequence and the original observations is calculated to obtain the reconstruction loss characterizing the self-similarity constraint.
[0016] A feature restoration system for anonymous perturbation traffic includes: The mask construction module is used to preprocess the acquired raw traffic and construct a mask to generate a masked traffic sequence. The generation module is used to reconstruct and restore the masked traffic sequence based on self-similarity constraints to obtain the masked restored sequence; The discrimination module is used to perform discrimination processing on the mask restoration sequence based on category consistency information to obtain the discrimination probability that the sample is a real sample or a generated sample; An optimized training module is used to jointly train and optimize the generation module and the discrimination module based on the discrimination probability. The feature repair module is used to repair the features of the anonymous perturbation traffic to be analyzed using the optimized generation module, and output the repaired traffic feature sequence.
[0017] The present invention has achieved the following beneficial effects.
[0018] 1. This invention employs a Burst-level full masking strategy, which solves the problems of incrementality and randomness caused by traffic perturbation. By processing unperturbed training data and perturbed test data indiscriminately, it enhances the transferability of sequence pattern knowledge, effectively eliminates the dependence on prior knowledge of perturbation methods, and achieves a more realistic blind analysis objective.
[0019] 2. This invention employs a data generation method based on self-similarity constraints. By calculating the mean square error between the reconstructed value and the original Burst value, the reconstruction loss is optimized, ensuring that the reconstructed sequence is infinitely close to the original flow characteristics in local distribution. Compared with the simple identity transformation model, it has higher reconstruction accuracy and feature fidelity.
[0020] 3. This invention employs a data discrimination method based on category consistency constraints. By introducing category characteristics as conditional information to guide the discrimination module, the generated samples not only possess individual accuracy but also tend towards the common features of their respective clusters. This ensures that the restored data has significant category representativeness, thereby significantly improving the performance of downstream recognition and classification models.
[0021] 4. This invention integrates a generation module based on self-similarity constraints with a discrimination module based on class consistency constraints, and uses an adversarial training mechanism to relax the optimization conditions at the class level, making the generated synthetic samples more consistent with the actual business distribution. Compared with traditional autoencoder networks, it has stronger generalization performance and adversarial defense capabilities. Attached Figure Description
[0022] Figure 1 This is a flowchart of the feature repair method for anonymous perturbation traffic in the embodiment; Figure 2 This is a framework diagram of the feature repair method for anonymous perturbation traffic in the embodiment; Figure 3 This is a system module diagram of the feature repair method for anonymous perturbation traffic in the embodiment. Detailed Implementation
[0023] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, detailed descriptions are provided below through embodiments.
[0024] This invention provides a method for feature repair of anonymous perturbation traffic, such as... Figure 1 and Figure 2 As shown, the specific steps include:
[0025] Step S1: Preprocess the acquired raw traffic and construct a mask to generate a masked traffic sequence.
[0026] Specifically, this invention mainly achieves blind analysis by eliminating the incremental perturbation in the flow, so that the undisturbed training data and the perturbated test data retain similar data distributions.
[0027] In an optional embodiment of the present invention, step S1 may include: Step S11: The original traffic sequence is transformed into a burst sequence consisting of the sum of the number of consecutive cells in the same direction or the number of bytes in the data packets.
[0028] Specifically, for the cell direction sequence used in fingerprint recognition methods, the Burst feature in the Burst sequence refers to the number of consecutive cells in the same direction; for the packet size and packet time sequence used in traffic association methods, the Burst feature is used to refer to the sum of the byte sizes of consecutive packets in the same direction. Meanwhile, the Burst sequence retains the positive or negative sign indicating the direction of the cell unit or packet.
[0029] Step S12: The Burst sequence containing uplink and downlink flow features is decomposed and masked to generate a masked flow sequence with a length twice that of the original flow sequence.
[0030] In an optional embodiment of the present invention, step S12 may include: Step S121: Obtain a comprehensive Burst sequence formed by non-disturbance traffic that simultaneously contains information about uplink and downlink traffic.
[0031] Step S122: Split each Burst feature in the synthesized Burst sequence according to a set ratio to obtain a retained portion and a mask portion for filling noise data.
[0032] Specifically, during the training phase, a sequence containing uplink and downlink flows is formed using undisturbed traffic. Each Burst feature in the above sequence is then decomposed into a retained portion and a masked portion according to a set ratio, thereby constructing a masked traffic sequence that is twice the length of the original sequence.
[0033] In an optional embodiment of the present invention, the set ratio is typically between 0.1 and 0.5. In this embodiment, the set ratio is 0.5. The accompanying drawings illustrate the upstream flow as an example.
[0034] Step S2: The mask traffic sequence is reconstructed and restored by the generation module based on self-similarity constraints to obtain the mask restoration sequence.
[0035] Specifically, the masked traffic sequence is input into a generation module based on self-similarity constraints for reconstruction. Referring to the retained portion, under the constraints of self-similarity and class consistency, the random noise filling the masked portion is restored to its corresponding original distribution.
[0036] In an optional embodiment of the present invention, step S2 may include: Step S21: Separate the reserved portion corresponding to the index position and the mask portion corresponding to the index position on the mask traffic sequence.
[0037] Specifically, in the masked one-dimensional Burst sequence, the values at all even-indexed positions, i.e. the retained parts of each Burst feature, are separated from the values at all odd-indexed positions, i.e. the masked parts of each Burst feature.
[0038] Step S22: Divide the separated retained part and masked part into sub-sequence data blocks (Patch) with a fixed step size, and use the sub-sequence data blocks as input for reconstruction and restoration processing.
[0039] Specifically, the separated sequence is divided into subsequences with a fixed step size, which are then used as data blocks and input into the generation module as different branches. The subsequence data blocks serve as the most basic data unit for processing.
[0040] In an optional embodiment of the present invention, the size of the subsequence data block is 1*10, and the number is 16.
[0041] In an optional embodiment of the present invention, step S22 may include: Step S221: Perform linear mapping and hidden layer representation extraction processing on the subsequence data blocks corresponding to the retained portion.
[0042] Specifically, the encoder of the generation module performs a linear mapping on the subsequence data blocks derived from the retained part and processes them using multiple Transformer layers to obtain their hidden layer representation; for the subsequence data blocks derived from the random noise of the mask part, the encoder only performs a linear mapping transformation.
[0043] In an optional embodiment of the present invention, the Transformer layer can be 8 layers, with a hidden layer dimension of 32.
[0044] Step S222: The extracted hidden layer representation is concatenated with the linear mapping vector corresponding to the mask part, and the restored value of the corresponding mask position is obtained through mapping transformation.
[0045] Specifically, the decoder in the generation module concatenates the hidden layer representation of the retained portion with the linear mapping vector of the mask portion, and processes it through a Transformer layer and a fully connected (Dense) layer to output a vector with a length half the length of the mask flow sequence. This vector is the restored value of each Burst feature according to a set ratio. All restored values constitute the mask restoration sequence.
[0046] Step S3: The discrimination module performs discrimination processing on the mask restoration sequence based on the category consistency information to obtain the discrimination probability that the sample is a real sample or a generated sample.
[0047] Specifically, the discrimination module adopts a discrimination architecture composed of multiple fully connected layers and leakage correction linear unit (LeakyReLU) layers stacked together. In this embodiment, the discrimination architecture includes three sets of cascaded fully connected layers and leakage correction linear unit layers.
[0048] In an optional embodiment of the present invention, step S3 may include: Step S31: Combine the generated mask restoration sequence with the retained portion to form a complete sample.
[0049] In an optional embodiment of the present invention, step S31 may include: Step S311: The retained portion is mapped to obtain an abstract vector that reflects the characteristics of the sample category.
[0050] Specifically, the abstract vector is the output of the retained values after processing by a fully connected network, and it serves as conditional information to indicate its category.
[0051] Step S32: Based on the category characteristic information, determine the probability that the complete sample is a real sample or a fake sample, and obtain the discrimination probability.
[0052] Step S312: The abstract vector is used as conditional information, and combined with the mask restoration sequence and the retained part to synthesize a complete sample.
[0053] Specifically, the discrimination module accepts two inputs: one is the complete sample synthesized from the restored value of the masked portion and the retained portion; the other is an abstract vector that reflects the category characteristics of the sample. Based on the above two inputs, the discrimination module determines the probability that the synthesized sample is a real sample or a generated sample under the given category condition.
[0054] Specifically, due to the addition of class consistency discrimination processing, the optimization conditions are relaxed to the class level. Therefore, the generation module no longer only fits a single distribution to minimize the reconstruction loss, but generates synthetic samples that conform to the characteristics of the class.
[0055] Step S4: Perform joint training and optimization on the generation module and the discrimination module based on the discrimination probability.
[0056] Specifically, during the training phase, the original, undisturbed dataset is used. On one hand, the undisturbed data is used to train network behavior analysis models such as traffic fingerprinting and traffic correlation; on the other hand, the repair and restoration process is constructed based on the training data, i.e., the generation and discrimination modules are trained. In this process, the model does not need to consider whether the data has been disturbed or how it has been disturbed, thus eliminating reliance on prior knowledge and achieving the goal of blind analysis.
[0057] In an optional embodiment of the present invention, step S4 may include: Step S41: Calculate the reconstruction loss of the mask restoration sequence and the corresponding positions of the mask portion in the original traffic sequence.
[0058] Specifically, the reconstruction loss measures the similarity between the generated data and the original data at the corresponding positions, i.e., the self-similarity constraint. The generation module is trained by optimizing the reconstruction loss so that the reconstructed sequence is infinitely close to the original sequence.
[0059] In an optional embodiment of the present invention, step S41 may include: Step S411: Obtain the generated mask restoration sequence and the corresponding original observations of the mask portion.
[0060] Step S412: Calculate the mean square error (MSE) between the masked reconstruction sequence and the original observations to obtain the reconstruction loss characterizing the self-similarity constraint.
[0061] Specifically, the formula for calculating the reconstruction loss is as follows: Where n represents the number of samples; masked_data represents the masked portion of the original sequence; and G(noise) represents the output of the generation module after reconstructing and restoring the random noise.
[0062] Step S42: Combine the reconstruction loss and the discrimination probability to perform joint training on the generation module and the discrimination module.
[0063] Specifically, the formula for calculating the reconstruction and restoration optimization objective is as follows: Where m is the number of samples; MSE_loss represents the reconstruction loss; D represents the discriminant module; real represents the real sample sequence; and gen represents the complete sample after merging the retained part with the restored value.
[0064] Specifically, the formula for calculating the complete sample gen is as follows: Where, unmasked_data represents the retained portion of the original sequence; G(noise) represents the masked portion reconstructed from random noise; and the symbol... This indicates a vector merging operation.
[0065] Step S5: Use the optimized generation module to perform feature repair on the anonymous perturbation traffic to be analyzed, and output the repaired traffic feature sequence.
[0066] Specifically, during the testing phase, the preprocessing process is repeated for the test data after anonymizing traffic perturbation, converting it into a Burst sequence and constructing a full mask sequence. The test sequence is then repaired and restored according to the trained generation module, and the resulting masked restored sequence is ensured to have a preset discriminative degree by using the discrimination criteria determined by the discrimination module.
[0067] In an optional embodiment of the present invention, the restored high-quality traffic feature sequence is input into a behavioral analysis base model to achieve accurate identification, classification, or anomaly detection of anonymous perturbation traffic. The behavioral analysis base model can be a traffic fingerprinting model, a traffic classification model, or an anomaly detection model. The present invention, by utilizing the restored traffic features, achieves effective analysis of anonymous perturbation traffic without requiring prior knowledge.
[0068] This invention also provides a feature repair system for anonymous perturbation traffic, such as... Figure 3 As shown, it includes: The mask construction module is used to preprocess the acquired raw traffic and construct a mask to generate a masked traffic sequence. The generation module is used to reconstruct and restore the masked traffic sequence based on self-similarity constraints to obtain the masked restored sequence; The discrimination module is used to perform discrimination processing on the mask restoration sequence based on category consistency information to obtain the discrimination probability that the sample is a real sample or a generated sample; An optimized training module is used to jointly train and optimize the generation module and the discrimination module based on the discrimination probability. The feature repair module is used to repair the features of the anonymous perturbation traffic to be analyzed using the optimized generation module, and output the repaired traffic feature sequence.
[0069] Method performance testing: To verify the effectiveness of the method of the present invention, comparative experiments were conducted on the test set, and the relevant performance test results are shown in Table 1 and Table 2.
[0070] 1. The experiment uses a publicly available dataset for the Deep Fingerprinting (DF) method to test the accuracy of anonymous network traffic classification. The experiment compares the original DF, the proposed method (DEDE), the Gaussian model, and the Ensemble model. The experimental results are shown in Table 1.
[0071] Table 1 Performance test results for anonymous traffic classification scenario Table 1 shows that when there is no disturbance (0% overhead), the recognition accuracy of each method is basically the same; however, as the disturbance ratio increases from 10% to 50%, the advantage of the method of this invention gradually expands. Under a high-intensity disturbance of 50%, the accuracy of the original DF model has dropped to 43.88%, while the recognition accuracy after being repaired by the method of this invention remains at 54.96%, significantly higher than the Gaussian-assisted (43.07%) and Ensemble-assisted (38.59%) methods. This indicates that the method of this invention has extremely strong robustness against anonymized traffic feature disturbances.
[0072] 2. The experiment uses a publicly available dataset from the DeepCorr method to evaluate traffic correlation performance in typical anonymized networks. The experiment also compares the recognition performance of the DeepCorr base model with three auxiliary methods; the results are shown in Table 2. Table 2 Performance test results for anonymous traffic association scenarios As shown in Table 3, the method of this invention performs best under all perturbation gradients. Within the perturbation range of 0% to 50%, the recognition accuracy of the method of this invention is consistently higher than that of the original model and other auxiliary schemes. In particular, under the 50% perturbation condition, the method of this invention achieves an association accuracy of 41.44%, which is better than the 35.78% of the original DeepCorr model. The experimental results further confirm that the feature repair scheme proposed in this invention also has significant performance gains in traffic association scenarios, and can effectively improve the accuracy of downstream analysis models in adversarial environments.
[0073] Experimental results show that the method of this invention exhibits consistent high-performance gains across different dataset types. Through accurate reconstruction of perturbed features, the method effectively reduces data distribution bias and significantly enhances the classification reliability and generalization level of downstream analysis models in complex anonymized adversarial environments. The anonymized perturbation traffic adversarial analysis method (DEDE) proposed in this invention outperforms existing comparative methods in terms of recognition performance.
[0074] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.
Claims
1. A method for feature restoration of anonymized perturbed traffic, the method comprising: Includes the following steps: The acquired raw traffic is preprocessed and masked to generate a masked traffic sequence; The masked traffic sequence is reconstructed and restored by the generation module based on self-similarity constraints to obtain the masked restored sequence. The discrimination module performs discrimination processing on the mask restoration sequence based on category consistency information to obtain the discrimination probability that the sample is a real sample or a generated sample; The generation module and the discrimination module are jointly trained and optimized based on the discrimination probability. The optimized generation module is used to perform feature repair on the anonymous perturbation traffic to be analyzed, and the repaired traffic feature sequence is output.
2. The method of claim 1, wherein, The acquired raw traffic is preprocessed and masked to generate a masked traffic sequence, including: The original traffic sequence is transformed into a burst sequence consisting of the sum of consecutive cells in the same direction or the number of bytes in the data packets; The burst sequence containing both uplink and downlink flow characteristics is decomposed and masked to generate a masked flow sequence with a length twice that of the original flow sequence.
3. The method of claim 2, wherein, The burst sequence containing both uplink and downlink features is decomposed and masked, including: Obtain a comprehensive burst sequence formed by non-disturbance traffic that simultaneously contains information about both uplink and downlink flows; Each burst feature in the integrated burst sequence is split according to a set ratio to obtain a retained portion and a mask portion used to fill in noise data.
4. The method of claim 1, wherein, The masked traffic sequence is reconstructed and restored by the generation module based on self-similarity constraints to obtain a masked restored sequence, including: Separate the retained portion corresponding to the index position and the masked portion corresponding to the index position on the masked traffic sequence; The separated retained portion and masked portion are divided into sub-sequence data blocks with a fixed step size, and the sub-sequence data blocks are used as input for reconstruction and restoration.
5. The method as described in claim 4, characterized in that, The subsequence data block is used as input for reconstruction and restoration processing, including: Linear mapping and hidden layer representation extraction are performed on the subsequence data blocks corresponding to the retained portion; The extracted hidden layer representation is concatenated with the linear mapping vector corresponding to the mask portion, and then the restored value of the corresponding mask position is obtained through mapping transformation.
6. The method as described in claim 1, characterized in that, The discrimination module performs discrimination processing on the masked reconstruction sequence based on category consistency information to obtain the discrimination probability that a sample is a real sample or a generated sample, including: The generated mask restoration sequence is combined with the retained portion to form a complete sample; The probability of a complete sample being a real sample or a generated sample is determined based on category characteristic information, thus obtaining the discrimination probability.
7. The method as described in claim 6, characterized in that, The generated mask restoration sequence is combined with the retained portion to form a complete sample, including: The retained portion is mapped to obtain an abstract vector that reflects the characteristics of the sample category; The abstract vector is used as conditional information, and combined with the mask restoration sequence and the retained portion to synthesize a complete sample.
8. The method as described in claim 1, characterized in that, The generation module and the discrimination module are jointly trained and optimized based on the discrimination probability, including: Calculate the reconstruction loss of the masked sequence at the corresponding positions of the masked portion in the original traffic sequence; The generation module and the discrimination module are jointly trained by combining the reconstruction loss and the discrimination probability.
9. The method as described in claim 8, characterized in that, Calculating the reconstruction loss of the masked sequence and the corresponding positions of the masked portion in the original traffic sequence includes: Obtain the generated mask reconstruction sequence and the corresponding original observations of the mask portion; The mean square error between the masked reconstruction sequence and the original observations is calculated to obtain the reconstruction loss characterizing the self-similarity constraint.
10. A feature restoration system for anonymous perturbation traffic, characterized in that, include: The mask construction module is used to preprocess the acquired raw traffic and construct a mask to generate a masked traffic sequence. The generation module is used to reconstruct and restore the masked traffic sequence based on self-similarity constraints to obtain the masked restored sequence; The discrimination module is used to perform discrimination processing on the mask restoration sequence based on category consistency information to obtain the discrimination probability that the sample is a real sample or a generated sample; An optimized training module is used to jointly train and optimize the generation module and the discrimination module based on the discrimination probability. The feature repair module is used to repair the features of the anonymous perturbation traffic to be analyzed using the optimized generation module, and output the repaired traffic feature sequence.