A method for active induction and identification of encrypted traffic in a noise background

Abstract

The application discloses a kind of encrypted traffic active induction and identification method under noise background, it is related to network security field.The method first stores target quintuple rule base, according to random time point, matched connection tracking entry is removed, and unmatching data packet is discarded silently, triggers client TCP reconnection to generate controllable encrypted traffic peak, and is collected and packaged as network packet capture file;Again, through file-level double-strategy joint decision algorithm analysis and identification, data packet is input into model to obtain confidence distribution, and first candidate result is obtained by majority voting aggregation, second candidate result is obtained by threshold scanning confidence stability analysis, and target encrypted application identification result is output after rule arbitration fusion.The application realizes flow concealment controllable induction, and improves the precision and anti-noise of encrypted traffic identification under noise background.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for actively inducing and identifying encrypted traffic in a noisy environment. Background Technology

[0002] The encrypted traffic identification involved in this invention is one of the important technologies in the field of network security. With the popularization of traffic encryption technology, identification methods based on plaintext data packet payloads have basically become ineffective, and identification methods based on implicit traffic characteristics have become the mainstream. However, existing active inducement and identification technologies for encrypted traffic still have significant defects in real network noise environments, making it difficult to meet the actual needs of concealment and high accuracy.

[0003] Existing traffic triggering methods mostly rely on direct interaction with the target application, inducing traffic by actively sending control messages. This method leaves traceable interaction traces on the link, which are easily identified and blocked by network monitoring and protection systems. At the same time, it may interfere with the normal service of the target application. The success rate of triggering is low in high-protection networks, and the concealment of cross-domain triggering is poor.

[0004] In the traffic identification process, existing technologies mostly adopt packet-level decision granularity. The classifier is easily affected by common noise in real networks, such as application heartbeat packets, parallel session mixing, occasional packet loss and retransmission, which can easily lead to false positive and false negative decisions and a high misjudgment rate. Moreover, a single decision strategy is difficult to balance recognition response speed and noise resistance. It is either fast but sensitive to noise, or strong in noise resistance but complex and time-consuming execution process, which cannot be adapted to real network application scenarios with complex noise. Summary of the Invention

[0005] This invention provides a method for actively inducing and identifying encrypted traffic under noisy conditions, comprising: storing a target quintuple rule base issued by an upper-layer system, wherein the target quintuple rule base contains the quintuple features of TCP connections to be disturbed; clearing connection tracking entries in the connection tracking table that match the target quintuple rule base according to a set of random time points that satisfy constraints generated by a time-domain randomly triggered customized script; performing quintuple matching on data packets passing through the gateway, silently discarding data packets whose quintuples do not have a valid match with the connection tracking table, triggering the client to initiate TCP reconnection due to application-layer heartbeat timeout, and generating a controllable encrypted traffic spike; collecting the encrypted traffic spike and encapsulating it into a network packet capture file; and analyzing and identifying the network packet capture file using a dual-strategy joint decision algorithm at the network packet capture file level; wherein the dual-strategy joint decision algorithm includes frequency-dominated majority voting aggregation and confidence stability analysis based on threshold scanning, and the decision results output by the two are fused to obtain the target encrypted application identification result corresponding to the encrypted traffic spike.

[0006] According to one embodiment of the present invention, the controlled gateway of the local area network where the client is located stores the target five-tuple rule base issued by the upper-layer system. The target five-tuple rule base contains five-tuple features corresponding to the TCP connections to be disturbed in cross-domain transmission. The five-tuple consists of source IP address, destination IP address, source port number, destination port number and protocol type. Each five-tuple uniquely identifies a TCP connection and corresponds one-to-one with a connection tracking entry in the connection tracking table maintained by the controlled gateway.

[0007] According to one embodiment of the present invention, the constraint satisfies orderliness, and the interval between adjacent time points is not less than a preset duration.

[0008] According to one embodiment of the present invention, the silent discard means simply discarding the data packet without returning any form of network receipt message to the client and the server.

[0009] According to one embodiment of the present invention, the heartbeat timeout is based on the application layer heartbeat mechanism and is triggered when the connection active state fails due to the failure to receive a valid message from the peer within a preset tolerance period; the preset tolerance period is the product of the application layer heartbeat period and the tolerance coefficient, and the application layer heartbeat period is much shorter than the TCP protocol keep-alive period.

[0010] According to one embodiment of the present invention, the controllability of the controllable encrypted traffic spike includes controllable triggering timing, controllable traffic characteristics, and controllable disturbance range; the triggering timing is controlled by the preset time constraint of the time-domain random triggering customized script; the controllable traffic characteristics are a combination of predictable TCP reconnection handshake traffic and the initial data of the application layer, which is controlled by adjusting the intensity and timing of the link-induced disturbance; the controllable disturbance range is limited to the cross-domain transmission TCP connection to be disturbed by the precise matching of the target five-tuple rule base.

[0011] According to one embodiment of the present invention, the analysis and identification of the network packet capture file using a dual-strategy joint decision algorithm at the network packet capture file level includes: inputting each individual data packet in the network packet capture file into a pre-trained encrypted traffic classification model, and having the encrypted traffic classification model output the confidence distribution of each encrypted application category corresponding to each data packet; wherein the confidence distribution of the real encrypted application category is in a high-value region, and the confidence distribution of categories not learned by the model is uniformly distributed or left-skewed; by performing the frequency-dominated majority voting aggregation, the encrypted application category with the highest frequency is obtained as the first candidate decision result; by performing the confidence stability analysis based on threshold scanning, the encrypted application category with the slowest decay is obtained as the second candidate decision result; and by fusing the first candidate decision result and the second candidate decision result through rule arbitration, the final decision result is the target encrypted application category corresponding to the encrypted traffic spike.

[0012] According to one embodiment of the present invention, the frequency-driven majority voting aggregation specifically includes: based on the confidence distribution of each data packet corresponding to each encrypted application category in the network packet capture file, assigning an encrypted application category label corresponding to its maximum confidence to each data packet, counting the occurrence frequency of each category label, and outputting the encrypted application category with the highest frequency as the first candidate decision result.

[0013] According to one embodiment of the present invention, the confidence stability analysis based on threshold scanning specifically includes: based on the confidence distribution of each data packet corresponding to each encrypted application category in the network packet capture file, traversing a preset range of confidence thresholds, and counting the number of valid samples with a confidence level not lower than the threshold for each category under each confidence threshold; constructing a decay curve for the number of valid samples increasing with the confidence threshold for each encrypted application category according to the correspondence between the number of valid samples and the confidence threshold; quantifying the decay rate of each decay curve, characterizing the decay rate by calculating the area under the curve of the decay curve within the preset threshold range, filtering out the encrypted application category corresponding to the decay curve with the slowest decay rate, and outputting the encrypted application category as the second candidate decision result.

[0014] According to one embodiment of the present invention, the step of obtaining a final judgment result by fusing the first candidate judgment result and the second candidate judgment result through rule arbitration specifically includes: confirming that the first candidate judgment result is consistent with the second candidate judgment result, and outputting the first candidate judgment result as the final judgment result; confirming that the first candidate judgment result is inconsistent with the second candidate judgment result, and outputting the second candidate judgment result as the final judgment result; wherein the final judgment result is the target encrypted application category corresponding to the encrypted traffic surge.

[0015] The proposed method for proactively inducing and identifying encrypted traffic in noisy environments effectively addresses the shortcomings of existing technologies, such as insufficient concealment, poor controllability, and weak noise resistance, in the traffic triggering and identification stages. It achieves multiple technological improvements in both the induction and collection of encrypted traffic and the identification and analysis in noisy environments, demonstrating excellent practical application results. This method relies on link disturbances to proactively induce encrypted traffic, without direct interaction with the target application throughout the process, leaving no traceable interaction records in the network link. This effectively circumvents identification and blocking by network monitoring and protection systems. Furthermore, by leveraging the precise matching of a five-tuple rule base and the time constraints of time-domain random triggering of customized scripts, the timing of encrypted traffic spikes, traffic characteristics, and disturbance range are precisely controlled. Traffic induction is only implemented for the TCP connections to be disturbed, minimizing the impact on normal network service operations and achieving concealed and controllable collection of encrypted traffic in cross-domain scenarios.

[0016] In the encrypted traffic identification process, this invention elevates the decision granularity from the data packet level to the network packet capture file level, fundamentally reducing the interference of common real-world network noise on the identification results. It combines frequency-driven majority voting aggregation with threshold-based confidence stability analysis to form a dual-strategy joint decision mechanism. Utilizing the area under the curve to accurately quantify the decay rate, it effectively distinguishes between real encrypted application categories and noise categories. It exhibits significant resilience against real-world network noise such as application heartbeat packets, parallel session mixing, occasional packet loss, and retransmissions, greatly reducing false positives and false negatives and significantly improving the accuracy of encrypted traffic identification in noisy environments. The fusion logic of the dual-strategy joint decision achieves a balance between identification efficiency and robustness. In network scenarios with low noise levels, majority voting aggregation enables rapid output of identification results, ensuring efficient response. In complex scenarios with high noise levels, the results of confidence stability analysis serve as a fallback, ensuring the accuracy of the identification results. This mechanism can flexibly adapt to real-world network application scenarios with varying noise levels.

[0017] Overall, this invention organically integrates link-induced controllable traffic triggering technology with a dual-strategy noise-resistant identification algorithm at the network packet capture file level. While achieving concealed, controllable, and cross-domain collection of encrypted traffic, it significantly improves the accuracy and noise resistance of encrypted traffic identification in noisy environments, while also taking into account the response efficiency of identification. It provides an efficient and reliable technical solution for encrypted traffic analysis and identification in the field of network security, expands the application scenarios of encrypted traffic identification technology in high-protection and high-noise network environments, and has good practical application value and promotion prospects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the method for actively inducing and identifying encrypted traffic under noisy conditions provided by the present invention.

[0020] Figure 2 This is a flowchart illustrating the execution process of the dual-strategy joint decision algorithm provided by this invention.

[0021] Figure 3 This is a schematic diagram of the confidence stability analysis based on threshold scanning provided by the present invention.

[0022] Figure 4 This is a schematic diagram of the process by which the final judgment result is obtained through rule arbitration fusion provided by the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0024] The following is combined Figures 1 to 4 This invention describes a method for actively inducing and identifying encrypted traffic in a noisy environment. Figure 1 This is a flowchart illustrating the active inducement and identification method for encrypted traffic under noisy conditions provided by the present invention. Figure 1As shown, the method for actively inducing and identifying encrypted traffic under noisy background provided by the present invention includes: in step S100, storing a target five-tuple rule base issued by the upper-layer system, the target five-tuple rule base containing the five-tuple features of TCP connections to be disturbed; in step S200, clearing connection tracking entries in the connection tracking table that match the target five-tuple rule base according to a set of random time points that satisfy constraints generated by a time-domain randomly triggered customized script; in step S300, performing five-tuple matching on data packets passing through the gateway, and silently discarding five-tuples that do not match the connection tracking table. Data packets that effectively match the entry trigger the client to initiate TCP reconnection due to application layer heartbeat timeout, and generate a controllable encrypted traffic spike; in step S400, the encrypted traffic spike is collected and encapsulated into a network packet capture file; in step S500, the network packet capture file is analyzed and identified through a dual-strategy joint decision algorithm at the network packet capture file level; wherein, the dual-strategy joint decision algorithm includes frequency-dominated majority voting aggregation and confidence stability analysis based on threshold scanning, and the decision results output by the two are fused to obtain the target encrypted application identification result corresponding to the encrypted traffic spike.

[0025] Specifically, the encrypted traffic active inducement and identification method of the present invention relies on a controlled gateway to complete the entire process of traffic inducement. The controlled gateway in the local area network where the client is located pre-stores the target five-tuple rule base issued by the upper-layer system. This rule base contains the five-tuple characteristics corresponding to the cross-domain transmission TCP connections to be disturbed. The five-tuple consists of source IP address, destination IP address, source port number, destination port number, and protocol type. Each five-tuple can uniquely identify a TCP connection and forms a one-to-one matching relationship with the connection tracking entries in the connection tracking table maintained by the controlled gateway. The time-domain random triggering customized script generates a set of random time points that meet the constraints. These constraints require that the time points be ordered and that the interval between adjacent time points be no less than a preset duration. The controlled gateway will accurately clear the connection tracking entries in the connection tracking table that match the target five-tuple rule base according to this set of random time points, laying the foundation for subsequent link disturbance operations.

[0026] After clearing the connection tracking entries, the controlled gateway will perform a 5-tuple matching operation on all packets passing through it. For packets whose 5-tuples do not have a valid match in the connection tracking table, a silent discard operation will be performed. This operation only discards the packets and does not return any form of network receipt message to the client or server. Such discarding operations will directly cause the client to fail to receive valid packets from the peer within the preset tolerance period, thereby triggering the application layer's heartbeat timeout mechanism. The preset tolerance period is the product of the application layer's heartbeat period and the tolerance coefficient. Moreover, the application layer's heartbeat period is much shorter than the TCP protocol's keep-alive period. Heartbeat timeout will directly cause the client's connection activity state to fail, ultimately triggering the client to actively initiate TCP reconnection. This process will generate controllable encrypted traffic spikes. Its controllability is reflected in three aspects: triggering timing, traffic characteristics, and disturbance range. The triggering timing is controlled by the preset time constraints of the time-domain randomly triggered customized script. The traffic characteristics are a combination of predictable TCP reconnection handshake traffic and application layer initial data, which can be controlled by adjusting the link-induced disturbance intensity and timing. The disturbance range is limited by precise matching of the target five-tuple rule base, and it only applies to the cross-domain transmission TCP connection to be disturbed.

[0027] After generating a controllable encrypted traffic spike, the system will collect the entire spike and encapsulate the collected traffic data into a network packet capture file. Subsequent identification and analysis operations will be carried out on a file-by-file basis. The dual-strategy joint decision algorithm at the network packet capture file level will perform in-depth analysis and identification on the file. First, each individual data packet in the network packet capture file is input into a pre-trained encrypted traffic classification model. The model will output the confidence distribution of each data packet for each encrypted application category. The confidence distribution of the real encrypted application categories is concentrated in the high-value region, while the confidence distribution of categories not learned by the model shows a uniform or left-skewed distribution. Based on this confidence distribution, the system executes two strategies to obtain candidate decision results. Frequency-driven majority voting aggregation assigns a cryptographic application category label corresponding to the highest confidence level to each data packet, then counts the frequency of each category label, and selects the cryptographic application category with the highest frequency as the first candidate decision result. Threshold-based confidence stability analysis iterates through a preset range of confidence thresholds, counts the number of valid samples with a confidence level not lower than the threshold for each category under each confidence threshold, and then constructs a decay curve for the number of valid samples as the confidence threshold increases for each cryptographic application category based on the correspondence between the number of valid samples and the confidence threshold. Subsequently, the decay rate of each decay curve is quantified, and the decay rate is represented by the area under the curve within the preset threshold range. The cryptographic application category corresponding to the decay curve with the slowest decay rate is selected as the second candidate decision result.

[0028] After obtaining the two candidate judgment results, the system will merge the two results through rule arbitration to obtain the final judgment result. First, the consistency between the first candidate judgment result and the second candidate judgment result will be confirmed. If the two results are consistent, the result will be directly used as the final judgment result. If the two results are inconsistent, the second candidate judgment result will be used as the final judgment result. The final judgment result is the target encrypted application category corresponding to this encrypted traffic surge, thus completing the entire process of active induction and identification of encrypted traffic in a noisy background.

[0029] According to an embodiment of the present invention, the controlled gateway of the local area network where the client is located stores a target five-tuple rule base issued by the upper-layer system. The target five-tuple rule base contains the five-tuple features corresponding to the TCP connection to be disturbed in cross-domain transmission. The five-tuple consists of source IP address, destination IP address, source port number, destination port number and protocol type. Each five-tuple uniquely identifies a TCP connection and corresponds one-to-one with a connection tracking entry in the connection tracking table maintained by the controlled gateway.

[0030] Specifically, in this invention, the active inducement operation of encrypted traffic is executed through the controlled gateway of the local area network where the client is located. The target five-tuple rule base is uniformly configured by the upper-layer system and distributed to the controlled gateway. After the gateway completes the local storage of the rule base, it uses it as the basis for subsequent link disturbance, packet matching and connection tracking entry operations. The rule base only includes the five-tuple features corresponding to the cross-domain transmission TCP connection to be disturbed, thereby limiting the scope of disturbance induced by encrypted traffic from the source.

[0031] In this invention, the five-tuple used to identify a TCP connection is a feature set, and its expression is: , In the formula, Represents the source IP address, which is the network address identifier of the client that initiated the TCP connection; Represents the destination IP address, which is the identifier of the server network address to which the TCP connection points; This represents the source port number, which is the port identifier for the corresponding TCP connection on the client side. This represents the destination port number, which is the port identifier for the corresponding TCP connection on the server side. The protocol type is represented by TCP in this invention, which is used to clearly define the protocol type characteristics of network transmission.

[0032] The five feature dimensions of the aforementioned quintuple together constitute a unique identifier for TCP connections. Each cross-domain TCP connection to be disrupted corresponds to a unique set of quintuple features. Different TCP connections have no duplicate feature combinations in their quintuples, ensuring that the controlled gateway can accurately identify and distinguish cross-domain TCP connections. The controlled gateway synchronously maintains a connection tracking table, which stores connection tracking entries corresponding to all TCP connections within the gateway's monitoring range. Each connection tracking entry contains the minimum subset of information required for the corresponding TCP connection to undergo stateful processing on the gateway. Furthermore, there is a one-to-one correspondence between connection tracking entries and quintuples in the target quintuple rule base; that is, a quintuple feature set matches only one connection tracking entry in the connection tracking table, and a connection tracking entry corresponds to only one quintuple in the target quintuple rule base.

[0033] This one-to-one matching relationship can be represented as: , In the formula, The first quintuple in the target rule base A set of features for a quintuple, Represents the first in the controlled gateway connection tracking table One connection tracking entry, This represents a unique two-way matching relationship between the two.

[0034] This matching relationship lays the foundation for subsequent precise clearing of connection tracking entries and execution of link disturbance operations. It avoids the problem of unrelated TCP connection disturbances caused by mismatching chaos, and enables the controlled gateway to accurately locate the cross-domain TCP connections to be disturbed. This ensures that all link disturbance operations are only executed on TCP connections within the target five-tuple rule base, minimizing the impact on normal network connections and business operations. At the same time, it keeps the disturbance range of encrypted traffic spikes in a precise and controllable state, perfectly adapting to the need for covert inducement of encrypted traffic in cross-domain scenarios.

[0035] According to an embodiment of the present invention, the constraints satisfy the requirement of orderliness, and the interval between adjacent time points is not less than a preset duration.

[0036] Specifically, the set of random time points generated by the time-domain random triggering customized script in this invention is not a random combination of time points. Its generation process must follow constraints, which are specifically reflected in the orderliness of time points and the lower limit requirement of time interval. The two types of constraints together ensure that the execution rhythm of the link-induced operation is controllable, avoid network fluctuations caused by continuous execution of disturbance operations in a short period of time, and further improve the concealment of the triggering behavior, so that the time distribution of disturbance operations has no obvious regularity.

[0037] The time-domain random triggering customized script generates a set of random time points to be executed within a set total time span. All time points in this set must satisfy the order constraint. Arranging the elements in the time point set in chronological order yields an ordered time point sequence, the expression of which is: , In the formula, Represents the set of random time points that satisfy the constraints. Represents the first in the set At a certain point in time, This represents the total number of time points in the set. The requirement for orderliness dictates that the time points within the set must be arranged strictly in chronological order. < < <…< This ensures that the link-guided operations are executed sequentially according to time, avoiding disturbances and failures caused by disordered operation execution timing.

[0038] In addition to satisfying the requirement of orderliness, adjacent time points within the time point set must also satisfy the constraint that the interval between them is not less than a preset duration. The expression for this constraint is: , In the formula, Representing the +1 time point, Representing the At a certain point in time, This represents the preset minimum time interval, a pre-configured fixed duration threshold. This constraint requires that between any two adjacent execution points of the link-induced operation, a time interval of no less than [a certain value] must be maintained. The time interval is set to avoid performing continuous connection tracking entry clearing operations on the gateway within a short period of time, thus preventing frequent link disturbances from causing unnecessary impact on normal network transmission. At the same time, it avoids the formation of identifiable time patterns due to overly intensive operation execution, further reducing the detectability of link-induced operations.

[0039] The above two constraints form the basis for the time-domain random triggering customized script to generate a set of time points. After generating the initial random time point candidate set, the script first sorts the time points in the candidate set to ensure order, and then checks the interval between adjacent time points. If there is an interval between adjacent time points that is less than the preset duration... In cases where the relevant time points are not satisfied, they are either removed or regenerated until a final set of time points that fully satisfies both constraints is obtained. This constrained random time point generation method ensures that the timing of link-induced operations is both random and controllable. It effectively breaks the predictability brought by fixed-period triggering and avoids the additional burden on the network caused by unconstrained random triggering, ensuring that the triggering timing of encrypted traffic spikes is always under precise control.

[0040] According to an embodiment of the present invention, silent dropping means only dropping data packets and not returning any form of network receipt message to the client and server.

[0041] Specifically, the silent discarding in this invention is an operation method for achieving encrypted traffic covert inducement in the link inducement process. This operation only applies to data packets that have passed through the controlled gateway and whose five-tuple has no valid matching entry with the connection tracking table. It is a special processing method that is different from the conventional network data packet discarding. Its characteristic is that it only performs the data packet discarding action without any network acknowledgment message feedback. It eliminates the detectable traces of link disturbances from the operation level and ensures the covertness of the traffic inducement process.

[0042] In conventional network data transmission, if a gateway determines a data packet to be invalid and discards it, it typically returns a corresponding network receipt message to the sender of the data packet according to network protocol specifications, thereby informing the sender of the data packet's transmission status. However, the silent discard operation in this invention completely abandons this kind of receipt feedback mechanism. After identifying a data packet without a valid matching entry, the controlled gateway simply discards the data packet directly. It neither returns any form of network receipt message to the sender of the data packet, i.e., the client, nor provides any status information to the receiver of the data packet, i.e., the server. Neither the client nor the server can obtain any notification that the data packet has been discarded from the gateway side, nor can they perceive the link disturbance operation performed by the controlled gateway through the network receipt message.

[0043] This silent, non-acknowledgment-based packet dropping method prevents the client from promptly detecting packet dropping. Instead, it relies on the application-layer heartbeat mechanism's established logic: if no valid packet is received from the peer within a preset tolerance period, the client determines the connection's activity has failed and initiates a TCP reconnection. Throughout this process, the client does not trigger additional network anomaly handling procedures due to receiving drop receipts from the gateway, nor does the server detect any disturbances in the link, effectively avoiding traces caused by receipt packets. Simultaneously, the non-acknowledgment-based design prevents network monitoring and protection systems from detecting link disturbances in the controlled gateway by capturing abnormal receipt packets, significantly reducing the probability of traffic manipulation being identified and blocked. This keeps the generation of encrypted traffic spikes hidden, while also preventing additional traffic interference to normal network services caused by the exchange of receipt packets. This ensures that link disturbances only affect the TCP connection to be disturbed, minimizing the impact on overall network transmission.

[0044] According to an embodiment of the present invention, the heartbeat timeout is based on the application layer heartbeat mechanism and is triggered when the connection active state fails due to the failure to receive a valid message from the peer within a preset tolerance period; the preset tolerance period is the product of the application layer heartbeat period and the tolerance coefficient, and the application layer heartbeat period is much shorter than the TCP protocol keep-alive period.

[0045] Specifically, the heartbeat timeout in this invention is the main mechanism for triggering client TCP reconnection. It relies on the application layer's own heartbeat maintenance logic rather than the TCP protocol layer's keep-alive mechanism, ensuring that controllable encrypted traffic spikes are accurately induced without additional interference with the network protocol.

[0046] After a TCP connection is established between the client and the server, the application layer initiates a continuous heartbeat mechanism to maintain the connection's activity. The validity of this activity depends entirely on the client receiving valid packets from the peer within a set period. The application layer heartbeat mechanism pre-sets a fixed heartbeat period, which serves as the basic time unit for the application layer to determine whether the connection is normal. This period is much shorter than the TCP keep-alive period, which is typically measured in hours, while the application layer heartbeat period is usually measured in seconds or minutes. This difference in duration allows the application layer heartbeat mechanism to detect changes in connection status more quickly, ensuring rapid reconnection and mitigating traffic spikes.

[0047] To avoid misjudgments caused by instantaneous network fluctuations, the application-layer heartbeat mechanism introduces a tolerance coefficient. The preset tolerance duration is determined by multiplying the application-layer heartbeat period by the tolerance coefficient, and its expression is as follows: .

[0048] In the formula, This represents the preset tolerance period. This represents the tolerance coefficient, a preset integer greater than 1. This represents the application layer heartbeat cycle. The preset tolerance period is the longest time the client can allow without receiving any valid packets. If the client does not receive any valid packets from the server within this period, regardless of whether the TCP connection status is normal, the application layer will determine that the connection activity status is invalid, thereby triggering a heartbeat timeout.

[0049] In the link induction process of this invention, the silent discard operation performed by the controlled gateway blocks the effective packet transmission between the client and the server, preventing the client from obtaining effective packets from the other end within a preset tolerance period, directly triggering the application layer heartbeat timeout. Since the application layer heartbeat period is much shorter than the TCP protocol keep-alive period, the TCP protocol layer connection has not yet been broken, but the application layer has actively determined that the connection has failed and triggered reconnection. This design not only ensures the rapid generation of traffic spikes but also avoids the induction delay caused by relying on the TCP protocol keep-alive mechanism. At the same time, it allows the reconnection behavior to be initiated entirely by the client without involving direct interaction with the server, further improving the concealment of traffic induction.

[0050] The introduction of the tolerance coefficient allows for flexible adjustment of the preset tolerance time, which can be adapted to the heartbeat characteristics of different applications and the stability of the network transmission environment. This ensures that heartbeat timeouts are not triggered erroneously under normal network fluctuations, and can reliably trigger client reconnection when the controlled gateway performs silent discard operations, providing a stable guarantee for the generation of controllable encrypted traffic spikes.

[0051] According to an embodiment of the present invention, the controllability of controllable encrypted traffic spikes includes controllable triggering timing, controllable traffic characteristics, and controllable disturbance range. The triggering timing is controlled by a preset time constraint of a customized script that is randomly triggered in the time domain. The controllable traffic characteristics are a combination of predictable TCP reconnection handshake traffic and initial data from the application layer, which is controlled by adjusting the intensity and timing of the link-induced disturbance. The controllable disturbance range is limited to the cross-domain TCP connection to be disturbed by precise matching of the target five-tuple rule base.

[0052] Specifically, the encrypted traffic spikes generated by this invention are not random traffic fluctuations, but rather achieve precise control over the triggering timing, traffic characteristics, and disturbance range through multi-layered technical design. This ensures that the traffic induction process meets the identification requirements while minimizing the impact on normal network services, and at the same time improves the targeting and effectiveness of traffic collection.

[0053] The controllability of the triggering timing relies on the preset time constraints of the time-domain random triggering customized script. The set of random time points generated by the script must satisfy the constraints of orderliness and minimum interval between adjacent time points. This breaks the predictability brought by fixed-period triggering and avoids network fluctuations caused by frequent disturbances in a short period of time. By adjusting the total time span of the script, the preset minimum interval duration, and the number of time points, the execution rhythm of the link-induced operation can be flexibly adjusted, thereby precisely controlling the timing of the client's TCP reconnection. This ensures that the occurrence time of encrypted traffic spikes is within a predictable and controllable range, adapting to traffic collection needs in different scenarios.

[0054] The controllability of traffic characteristics stems from the compositional characteristics and control mechanisms of traffic spikes. These spikes consist of TCP reconnection handshake traffic and initial application layer data, both of which exhibit predictable transmission patterns. TCP reconnection handshake traffic follows the TCP protocol's connection establishment specifications, with fixed message formats and transmission sequences. Initial application layer data, on the other hand, consists of the initial interactive data sent by the client to the server after reconnection; its data structure and transmission order are related to the target application's communication logic and are therefore predictable. By adjusting the intensity of link-induced disturbances, the number of data packets and transmission rate of traffic spikes can be controlled. Furthermore, by adjusting timing parameters, the transmission interval between TCP reconnection handshake traffic and initial application layer data can be adjusted, thereby achieving precise control over the overall characteristics of traffic spikes and ensuring that the collected traffic data possesses distinct target application identification characteristics.

[0055] The controllability of the disturbance range is achieved through a precise matching mechanism of the target 5-tuple rule base. This rule base only includes the 5-tuple characteristics corresponding to the cross-domain TCP connections to be disturbed. The 5-tuple consists of the source IP address, destination IP address, source port number, destination port number, and protocol type, which can uniquely identify each TCP connection. The controlled gateway only performs link-inducing operations on TCP connections that match the 5-tuple characteristics in the rule base, including clearing the corresponding connection tracking entries and silently discarding packets without matching entries. Other TCP connections not included in the rule base are unaffected. This limitation method based on precise 5-tuple matching ensures that traffic disturbance only affects the target connection, effectively avoiding accidental disturbance of irrelevant network connections. It ensures that the generation range of encrypted traffic spikes is strictly limited to the TCP connections corresponding to the target application to be identified, improving the targeting and effectiveness of traffic collection while minimizing interference with normal network transmission.

[0056] The three types of controllable characteristics work together to make the encrypted traffic inducement process of this invention both covert and highly controllable. It can stably generate traffic spikes containing the characteristics of the target application, providing a high-quality data foundation for subsequent identification, and can flexibly adapt to the needs of different network environments and application scenarios, demonstrating good practicality and adaptability.

[0057] Figure 2 This is a flowchart illustrating the execution process of the dual-strategy joint decision algorithm provided by this invention. Figure 2 As shown, according to an embodiment of the present invention, a dual-strategy joint decision algorithm at the network packet capture file level is used to analyze and identify network packet capture files, including: in step S511, each individual data packet in the network packet capture file is input into a pre-trained encrypted traffic classification model, and the encrypted traffic classification model outputs the confidence distribution of each encrypted application category corresponding to each data packet; wherein, the confidence distribution of the real encrypted application category is in the high value region, and the confidence of the category not learned by the model is uniformly distributed or left-skewed; in step S512, the encrypted application category with the highest frequency is obtained as the first candidate decision result by performing frequency-dominated majority voting aggregation; in step S513, the encrypted application category with the slowest decay is obtained as the second candidate decision result by performing confidence stability analysis based on threshold scanning; in step S514, the first candidate decision result and the second candidate decision result are fused by rule arbitration to obtain the final decision result, and the final decision result is the target encrypted application category corresponding to the encrypted traffic spike.

[0058] Specifically, the dual-strategy joint decision algorithm is the core of this invention for achieving accurate identification in noisy backgrounds. It uses network packet capture files as the processing unit and the confidence distribution of the model output as the basis. First, it conducts decision-making in parallel through dual strategies, and then completes the result fusion through rule arbitration, taking into account both recognition efficiency and noise resistance, and ensuring the accuracy and reliability of the final decision result.

[0059] Step S511, as the basic data preparation step of the algorithm, obtains the confidence distribution characteristics of each data packet. The network packet capture file encapsulates all data packets from the encrypted traffic spike. The system inputs these packets one by one into a pre-trained encrypted traffic classification model according to their transmission sequence. This model has been trained with a large number of encrypted application traffic samples and has the ability to extract implicit features of data packets and map them to corresponding application categories. The confidence distribution output by the model represents the probability that each data packet belongs to a certain type of encrypted application. The confidence of the true encrypted application category is concentrated in the high-value region because the model has fully learned its feature patterns. Categories not learned by the model, lacking feature matching basis, show a uniform or left-skewed confidence distribution. This difference in distribution provides a key basis for subsequently distinguishing between the true category and the noise category.

[0060] Step S512 uses frequency-based majority voting aggregation to achieve rapid candidate decision-making by statistically analyzing frequency. Based on the confidence distribution output in step S511, the system assigns an encrypted application category label corresponding to the highest confidence level to each data packet, meaning each data packet corresponds to only one most likely application category. Subsequently, frequency statistics are performed on the category labels of all data packets. This statistical process covers all data packets within the network packet capture file to ensure the representativeness of the statistical results. Finally, the category with the highest frequency is selected as the first candidate decision. The advantage of this strategy is its fast execution speed. In scenarios where noise is not dominant and the target application data packets account for a high proportion, it can quickly output stable and reliable candidate results, ensuring efficient identification response.

[0061] Step S513, the confidence stability analysis based on threshold scanning, achieves noise-resistant fallback decision by quantifying confidence stability. Similarly, based on the confidence distribution in step S511, the system iterates through a preset range of confidence thresholds, typically covering a reasonable interval from 0 to 1, and gradually increases by a fixed step size. For each confidence threshold, the system counts the number of valid samples with a confidence level not lower than that threshold for each category. The more valid samples, the higher the support for that category under that confidence standard. Based on the correspondence between the number of valid samples and the confidence threshold, a decay curve is constructed for each encrypted application category. The horizontal axis of the curve represents the confidence threshold, and the vertical axis represents the number of valid samples. As the confidence threshold increases, the number of valid samples gradually decreases, forming a decay trend. The decay rate is quantified by calculating the area under the curve within the preset threshold range. The larger the area under the curve, the slower the decay rate, indicating stronger confidence stability for that category. The category with the slowest decay rate is then selected as the second candidate decision result. This strategy can effectively resist noise interference. Even if the target application data packets account for a small proportion, it can distinguish between the real category and the noise category through confidence stability.

[0062] Step S514, rule arbitration fusion, combines the candidate results from the previous two steps to output the final decision. The system first checks the consistency between the first and second candidate decisions. If they match, it indicates that this category is the optimal choice from both frequency statistics and confidence stability perspectives, and it is directly used as the final decision. If they don't match, it suggests that there may be significant noise in the current scenario. In this case, the second candidate decision, which has stronger noise resistance, is prioritized as the final decision to ensure accurate identification in complex noisy environments. This final decision accurately corresponds to the target encrypted application category to which the encrypted traffic spike belongs, completing the entire dual-strategy joint decision process.

[0063] Throughout the algorithm process, steps S512 and S513 are executed in parallel, ensuring both rapid response in low-noise scenarios and noise mitigation in high-noise scenarios. The fusion rule in step S514 allows the advantages of the two strategies to complement each other, ultimately achieving efficient and accurate identification of encrypted traffic in noisy environments.

[0064] According to an embodiment of the present invention, frequency-based majority voting aggregation is performed, specifically including: based on the confidence distribution of each data packet in the network packet capture file corresponding to each encrypted application category, assigning an encrypted application category label corresponding to its maximum confidence to each data packet, counting the occurrence frequency of each category label, and outputting the encrypted application category with the highest frequency as the first candidate decision result.

[0065] Specifically, frequency-driven majority voting aggregation is a strategy that balances efficiency in dual-strategy joint decision-making. It relies on the significance of statistical frequency to achieve fast and stable candidate decisions. The whole process is logically clear and efficient, and is fully adaptable to batch data processing scenarios at the file level in network packet capture.

[0066] The strategy is based on the confidence distribution of all data packets within the network packet capture file. First, a category label is assigned to each data packet. For any data packet in the network packet capture file, the encrypted traffic classification model outputs the confidence distribution of all corresponding encrypted application categories. Each confidence value directly reflects the probability that the data packet belongs to the corresponding category. The system selects the highest confidence value from this distribution and determines its corresponding encrypted application category as the unique category label for that data packet. This ensures that each data packet is associated with only one most probable application category, avoiding statistical confusion caused by multiple label assignments.

[0067] After all data packets are assigned category labels, the frequency statistics phase begins. The system iterates through all data packets in the network capture file, accumulating the number of times each encrypted application category label appears. The statistics process covers all data packets in the file, ensuring no label information is missed, and guaranteeing that the statistical results accurately reflect the proportion of each category during the current traffic surge. For example, if the network capture file contains 1000 data packets, with 450 packets labeled as application A, 300 as application B, and 250 as application C, then the label frequencies for applications A, B, and C are 450, 300, and 250, respectively.

[0068] After frequency statistics are completed, the system compares the statistical frequencies of all encrypted application categories and selects the category with the highest frequency. This category represents the application with the highest proportion of data packets in the current network packet capture file, and is statistically the most representative. If there are two or more categories with the same frequency and both being the highest, the final candidate can be determined by preset priority rules or random selection. However, in actual applications, such extreme cases rarely occur because the target traffic spikes are clearly targeted. Finally, the selected category with the highest frequency is used as the first candidate decision result. This result can quickly reflect the main application attribution of the traffic spike and provide an efficient reference for subsequent fusion decision.

[0069] The entire strategy requires no complex calculations, and can be completed in just three steps: label allocation, frequency statistics, and frequency comparison. It boasts high execution efficiency and can process large amounts of data packets in a short time. In scenarios where noise is low and target application data packets dominate, the strategy's decision results exhibit extremely high reliability. This provides a foundation for rapid response in joint decision-making using dual strategies and ensures the overall efficiency of the identification process.

[0070] Figure 3 This is a schematic diagram of the confidence stability analysis based on threshold scanning provided by the present invention. Figure 3 As shown, according to an embodiment of the present invention, the confidence stability analysis based on threshold scanning specifically includes: in step S521, based on the confidence distribution of each data packet in the network packet capture file corresponding to each encrypted application category, traversing a preset range of confidence thresholds, and counting the number of valid samples with a confidence level not lower than the threshold for each category under each confidence threshold; in step S522, according to the correspondence between the number of valid samples and the confidence threshold, constructing a decay curve for the number of valid samples increasing with the confidence threshold for each encrypted application category; in step S523, quantifying the decay rate of each decay curve, representing the decay rate by calculating the area under the curve of the decay curve within the preset threshold range, filtering out the encrypted application category corresponding to the decay curve with the slowest decay rate, and outputting the encrypted application category as the second candidate decision result.

[0071] Specifically, confidence stability analysis based on threshold scanning is the guarantee of noise resistance in the joint decision of dual strategies. Based on threshold traversal statistics, it advances to the construction of decay curves, and then completes the final screening by quantifying the decay rate. Combined with the established formula, it accurately captures the confidence stability characteristics of real encrypted application categories, effectively resists real network noise interference, and provides a reliable noise-resistant fallback result for the final decision.

[0072] Step S521 focuses on the statistical analysis of the number of valid samples. It uses multi-threshold scanning to uncover the distribution patterns of category confidence scores, and the statistical logic is defined by explicit formulas to avoid ambiguity. This step takes the confidence score distribution of all data packets in the network packet capture file as input. First, it determines the preset confidence score threshold range (usually covering a reasonable range from 0 to 1), and simultaneously sets a fixed threshold step size (e.g., 0.01) to ensure the comprehensiveness and detail of the threshold traversal. The system then iterates through each confidence score threshold sequentially according to the step size. For each threshold, the number of valid samples for each category is counted using the following formula: ; In the formula, Represents encrypted application category At the confidence threshold The number of valid samples; This represents the total number of data packets within the network packet capture file. Representing the Each data packet corresponds to a category Confidence level; For indicator functions, when the first Each data packet corresponds to a category The confidence level is not lower than the confidence threshold. At the time of its establishment, Otherwise, it is 0. The number of valid samples directly reflects the support strength of the category under the corresponding confidence standard. The real encryption application category can still maintain a large number of valid samples even at high thresholds because the confidence is concentrated in the high value area. On the other hand, the number of valid samples of noise category or unlearned category will decrease rapidly after the threshold is increased. This difference lays the data foundation for distinguishing between real category and noise category in the future.

[0073] Step S522 constructs the decay curve, transforming statistical data into a visualized and quantifiable feature vector. For each encryption application category, the system uses a confidence threshold... The horizontal axis represents the number of valid samples. Using the vertical axis as the ordinate, the correspondence between the thresholds and the number of effective samples calculated in step S521 is used as data points to fit and form a continuous decay curve. Since the confidence threshold and the number of effective samples are negatively correlated, the number of effective samples gradually decreases as the threshold increases from low to high, and the curve shows an overall decay trend. The decay curve for the real encrypted application category exhibits the characteristic of maintaining a certain number of effective samples even at high thresholds and a gentle decay trend. This is because the confidence of its data packets is generally high and concentrated. In contrast, the decay curve for noise categories or unlearned categories often shows a sharp drop in the number of effective samples at low thresholds, with an overall steep decay. The difference in the shape of the two types of curves becomes a key basis for distinguishing between the real and noise categories.

[0074] Step S523 filters the optimal category by quantifying the decay rate and achieves accurate comparison of decay rates by calculating the area under the curve. First, a preset threshold range is determined. This range is typically selected from a high confidence level, such as 0.7 to 1.0, to focus on the decay characteristics of important confidence regions and avoid interference from invalid data in low-threshold regions. For the decay curve of each category, its area under the curve within the preset threshold range is calculated using the following formula: , In the formula, Represents encrypted application category The area under the decay curve within the preset threshold range; and These represent the lower and upper limits of the preset threshold range, respectively; The number of valid samples counted using the formula in step S521. The differential step size is the threshold. This formula quantifies the decay rate; the larger the area under the curve, the slower the number of valid samples decreases within the high confidence interval, the gentler the decay rate, and the stronger the confidence stability of the corresponding category; conversely, the smaller the area under the curve, the faster the decay rate and the weaker the confidence stability. This is achieved by calculating the area under the curve for all encrypted application categories. By comparing the results, the category with the largest area (i.e., the slowest decay rate) is selected as the second candidate decision. This result fully demonstrates the confidence stability advantage of real-world encrypted application categories. Even when noise interference causes fluctuations in the confidence of some data packets, the overall stability characteristics can still accurately pinpoint the target category, ensuring recognition accuracy in high-noise scenarios.

[0075] The entire process starts with threshold traversal statistics, constructs attenuation curves to achieve data feature generation, and then completes accurate screening through attenuation rate quantification. The statistical rules and quantification logic are clarified through formulas, and the confidence stability is transformed into a calculable and comparable quantitative feature. This effectively removes the impact of noise interference on individual data packets, focuses on the overall confidence distribution pattern of the category, and provides strong noise-resistant candidate results for dual-strategy joint decision-making, ensuring that the target encrypted application can still be accurately identified in complex real-world network noise environments.

[0076] Figure 4 This is a schematic diagram of the process by which the final judgment result is obtained through rule arbitration fusion, as provided by this invention. Figure 4As shown, according to an embodiment of the present invention, a final judgment result is obtained by fusing the first candidate judgment result and the second candidate judgment result through rule arbitration. Specifically, the method includes: in step S1541, confirming that the first candidate judgment result and the second candidate judgment result are consistent, and outputting the first candidate judgment result as the final judgment result; in step S1542, confirming that the first candidate judgment result and the second candidate judgment result are inconsistent, and outputting the second candidate judgment result as the final judgment result; and in step S1543, the final judgment result is the target encrypted application category corresponding to the encrypted traffic surge.

[0077] Specifically, rule arbitration fusion is the final decision-making stage of the dual-strategy joint judgment algorithm. Based on the consistency verification of two types of candidate results, it outputs accurate and reliable final judgments through clear arbitration rules. It takes into account both the efficiency advantages of low-noise scenarios and the noise resistance capability of high-noise scenarios, ensuring that the final result accurately corresponds to the target encrypted application category of the encrypted traffic surge.

[0078] Step S1541 focuses on the decision output when candidate results are consistent, enhancing the credibility and execution efficiency of the result. The system first performs category consistency verification on the first candidate decision result obtained by frequency-dominated majority voting aggregation and the second candidate decision result obtained by confidence stability analysis based on threshold scanning. If the encrypted application categories determined by the two are exactly the same, it indicates that the category possesses both an absolute advantage in statistical frequency and strong noise resistance in confidence stability, representing the optimal solution after verification from different dimensions. In this case, the consistent category is directly output as the final decision result, saving additional complex decision-making processes, ensuring the efficiency of identification response, and improving the reliability of the result through dual verification. This is suitable for typical scenarios where noise is low and target application data packets dominate.

[0079] Step S1542 addresses the arbitration of decisions when candidate results are inconsistent, prioritizing noise robustness to mitigate noise interference. When the first and second candidate decisions differ, it indicates significant real-world network noise, such as application heartbeat packet mixing, parallel session interference, and occasional packet loss and retransmission, affecting the frequency statistics of most vote aggregations. The second candidate decision, obtained through confidence stability analysis, relies on the attenuation rate quantized by the area under the attenuation curve, effectively filtering out noise interference and focusing on the main characteristics of real encrypted application categories, thus exhibiting stronger noise robustness. Therefore, the arbitration rules explicitly prioritize outputting the second candidate decision as the final decision, using a more robust noise-resistant strategy to avoid misjudgments caused by noise and ensure accurate identification in complex noisy environments.

[0080] Step S1543 clarifies the attribution of the final judgment result, achieving precise binding with the encrypted traffic surge. Whether it's the consistent candidate result output in step S1541 or the noise-resistant candidate result output in step S1542, their essence is the precise determination of the target encrypted application category to which the encrypted traffic surge belongs. This encrypted traffic surge is controllable traffic actively generated through link induction. Its traffic characteristics highly match the communication logic of the target encrypted application. The final judgment result after rule arbitration fusion can accurately correspond to the source application of this traffic surge, completing the closed loop from traffic induction to precise identification, providing clear and reliable identification conclusions for encrypted traffic analysis in the field of network security.

[0081] The entire rule arbitration fusion process is logically simple and the judgment is clear. By adopting the rule of accepting the result if there is consistency and providing a noise-resistant fallback if there is inconsistency, it fully leverages the complementary advantages of the two judgment strategies. This not only ensures the recognition efficiency in normal scenarios but also solves the problem of misjudgment in complex noise scenarios, ultimately achieving efficient and accurate recognition of encrypted traffic in noisy backgrounds.

[0082] The technical solution of this invention not only achieves a theoretical revolution in existing encrypted traffic inducement and identification technologies, but also possesses strong operability and compatibility in practical applications. From a deployment perspective, the execution carrier design of the controlled gateway does not require large-scale modifications to the existing network architecture; only the deployment of relevant functional modules on the local area network gateway where the client is located is needed for seamless access to the existing network environment. The target five-tuple rule base supports flexible distribution and dynamic updates from the upper-layer system, enabling rapid adaptation to the disturbance requirements of different cross-domain TCP connections. Key configurations such as the constraint parameters of time-domain random triggering customized scripts and the threshold range of the dual-policy joint decision algorithm can all be adjusted as needed, flexibly adapting to the noise intensity of different network environments and the traffic characteristics of the target application, significantly reducing the threshold for technology implementation.

[0083] From a technical scalability perspective, the architecture of this invention possesses excellent compatibility. In the traffic inducement stage, more dimensions of perturbation constraints can be added based on actual needs, or the matching dimensions of the five-tuple rule base can be expanded to further improve the accuracy and concealment of traffic inducement. In the identification stage, the encrypted traffic classification model can incorporate traffic features of more novel encrypted applications through continuous iterative training, and the dual-strategy joint decision algorithm can also add other decision strategies according to identification needs, forming a multi-strategy fusion identification mechanism to continuously improve the identification generalization ability in noisy environments.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for actively inducing and identifying encrypted traffic under noisy conditions, characterized in that, include: The system stores the target quintuple rule base issued by the upper-layer system, which contains the TCP connection quintuple features to be disturbed. Based on the set of random time points that satisfy the constraints generated by the time-domain randomly triggered customized script, clear the connection tracking entries in the connection tracking table that match the target quintuple rule base; Five-tuple matching is performed on data packets passing through the gateway. Data packets whose five-tuples do not have a valid match with the connection tracking table are silently discarded. The client is triggered to initiate TCP reconnection due to application layer heartbeat timeout, and a controllable encrypted traffic surge is generated. The encrypted traffic spikes are collected and encapsulated into a network packet capture file; The network packet capture file is analyzed and identified using a dual-strategy joint decision algorithm at the file level. The dual-strategy joint decision algorithm includes frequency-driven majority voting aggregation and confidence stability analysis based on threshold scanning. The decision results of the two algorithms are combined to obtain the target encrypted application identification result corresponding to the encrypted traffic spike.

2. The method according to claim 1, characterized in that, The controlled gateway of the local area network where the client is located stores the target five-tuple rule base issued by the upper-layer system. The target five-tuple rule base contains the five-tuple characteristics corresponding to the TCP connection to be disturbed in cross-domain transmission. The five-tuple consists of source IP address, destination IP address, source port number, destination port number and protocol type. Each five-tuple uniquely identifies a TCP connection and corresponds one-to-one with a connection tracking entry in the connection tracking table maintained by the controlled gateway.

3. The method according to claim 1, characterized in that, The constraints satisfy the requirement of orderliness, and the interval between adjacent time points is not less than a preset duration.

4. The method according to claim 1, characterized in that, The silent discard means that the data packet is simply discarded without returning any form of network receipt message to the client and server.

5. The method according to claim 1, characterized in that, The heartbeat timeout is based on the application layer's heartbeat mechanism and is triggered when the connection's active state fails due to the failure to receive a valid message from the peer within a preset tolerance period. The preset tolerance time is the product of the application layer heartbeat period and the tolerance coefficient, and the application layer heartbeat period is much shorter than the TCP protocol keep-alive period.

6. The method according to claim 1, characterized in that, The controllability of the controllable encrypted traffic spikes includes controllable triggering timing, controllable traffic characteristics, and controllable disturbance range; The triggering timing is controlled by the preset time constraints of the time-domain random triggering customized script; The controllable traffic characteristics are a combination of predictable TCP reconnection handshake traffic and the initial data of the application layer, which is achieved by adjusting the intensity of link-induced disturbances and timing control. The disturbance range is controllable and limited to the cross-domain TCP connection to be disturbed through precise matching of the target quintuple rule base.

7. The method according to claim 1, characterized in that, The method of analyzing and identifying network packet capture files using a dual-strategy joint decision algorithm at the file level includes: Each individual data packet in the network packet capture file is input into a pre-trained encrypted traffic classification model. The encrypted traffic classification model outputs the confidence distribution of each data packet for each encrypted application category. The confidence distribution of the real encrypted application category is in the high value region, and the confidence of the category that has not been learned by the model is uniformly distributed or left-skewed. By performing the frequency-driven majority voting aggregation, the cryptographic application category with the highest frequency is obtained as the first candidate judgment result; By performing the confidence stability analysis based on the threshold scan, the encryption application category with the slowest decay is obtained as the second candidate decision result; The final judgment result is obtained by fusing the first candidate judgment result and the second candidate judgment result through rule arbitration. The final judgment result is the target encrypted application category corresponding to the encrypted traffic surge.

8. The method according to claim 7, characterized in that, The execution of the frequency-dominated majority voting aggregation specifically includes: Based on the confidence distribution of each data packet in the network packet capture file corresponding to each encrypted application category, each data packet is assigned an encrypted application category label corresponding to its maximum confidence. The frequency of occurrence of each category label is counted, and the encrypted application category with the highest frequency is output as the first candidate decision result.

9. The method according to claim 7, characterized in that, The confidence stability analysis based on threshold scanning specifically includes: Based on the confidence distribution of each data packet in the network packet capture file corresponding to each encrypted application category, the confidence threshold within a preset range is traversed, and the number of valid samples with a confidence level not lower than the threshold for each category under each confidence threshold is counted. Based on the correspondence between the number of valid samples and the confidence threshold, a decay curve of the number of valid samples as the confidence threshold increases is constructed for each encrypted application category; The decay rate of each decay curve is quantified. The decay rate is represented by the area under the curve of the decay curve within a preset threshold range. The encryption application category corresponding to the decay curve with the slowest decay rate is selected and the encryption application category is output as the second candidate decision result.

10. The method according to claim 7, characterized in that, The process of obtaining the final judgment result by fusing the first candidate judgment result and the second candidate judgment result through rule arbitration specifically includes: Confirm that the first candidate judgment result is consistent with the second candidate judgment result, and output the first candidate judgment result as the final judgment result; If the first candidate judgment result is found to be inconsistent with the second candidate judgment result, the second candidate judgment result is output as the final judgment result. The final judgment result is the target encrypted application category corresponding to the encrypted traffic surge.

Images