A method and system for adaptive encrypted traffic obfuscation based on web runtime state

Abstract

The application discloses a kind of adaptive encrypted traffic obfuscation method and system based on Web runtime state, belong to network security and privacy protection technical field.The present application is to solve the technical problem that existing encrypted traffic obfuscation relies on fixed strategy or network packet statistics, it is difficult to combine page running state, resource loading state, cache state and protocol state in adaptive decision between privacy protection and performance overhead, by establishing page session, collecting Web runtime state vector and transmission state vector, constructing leakage risk vector and determining comprehensive risk score, determining target obfuscation strategy according to page stage, privacy budget and performance budget, executing obfuscation on encrypted traffic and updating obfuscation strategy based on effect evaluation result and constraint monitoring result feedback.The present application can weaken the volume baseline, time rhythm and burst fragmentation fingerprint characteristics under controllable bandwidth and time delay overhead.

Description

Technical Field

[0001] This invention relates to the field of network security and privacy protection technology, specifically to an adaptive encrypted traffic obfuscation method and system based on Web runtime state. Background Technology

[0002] While TLS, HTTPS, and ECH can hide plaintext content and some explicit identifiers in network communication, packet length, transmission direction, packet interval, number of bursts, burst size, connection establishment rhythm, and cache re-authentication traffic can still be obtained by external observers. Website fingerprinting attacks infer the websites or pages visited by users by analyzing these side-channel characteristics. Therefore, although encrypted communication can protect transmitted content, it cannot completely eliminate the page access characteristics carried by the traffic pattern. With the widespread application of modern Web mechanisms such as JavaScript execution, asynchronous resource loading, page rendering, cache reuse, and HTTP / 3, the formation process of encrypted traffic is further affected by the page running state and resource delivery state.

[0003] To address the impact of modern web optimization mechanisms on the observability of encrypted traffic, related measurements analyzed 1,173 websites, approximately 17,600 encrypted traffic traces, and 23 Web QoS, QoE, and runtime metrics from the Tranco Top100k stratified sample. The analysis results show that total bytes and burst size primarily form coarse-grained volumetric characteristics, while runtime dynamics generated by JavaScript execution, layout calculations, rendering, and resource scheduling further form fine-grained characteristics such as packet intervals, burst quantity, and direction sequences. HTTP / 3 and caching mechanisms can reduce traffic identifiability in some scenarios, while client-side runtime complexity may produce more identifiable burst structures. Existing defenses typically employ fixed padding, timed padding, or network layer padding. While QUIC provides padding frames and flow-level and connection-level flow control mechanisms, it does not specify a concrete method for implementing traffic privacy protection in conjunction with the runtime state of web pages.

[0004] Existing traffic obfuscation solutions primarily rely on fixed packet lengths, fixed periods, preset padding strategies, or network packet statistics for defense. This makes it difficult to dynamically adjust obfuscation actions based on page loading stages, long JavaScript tasks, main thread blocking, layout changes, resource priorities, and cache status. Consequently, unnecessary bandwidth and latency overhead may occur during low-risk time windows, and insufficient obfuscation may occur during runtime-induced high-risk windows. Furthermore, browsers, client proxies, VPNs, CDNs, and servers typically implement performance optimizations or security controls separately, lacking a collaborative decision-making mechanism based on unified leakage risk, QoS, and QoE constraints. Caching, prefetching, and HTTP / 3 or QUIC padding capabilities are also not integrated into the system to simultaneously weaken the baseline formed by the total traffic volume and burst size, as well as the timing and fragmented characteristics of JavaScript execution, layout rendering, and resource scheduling. Summary of the Invention

[0005] The purpose of this invention is to propose an adaptive encrypted traffic obfuscation method and system based on Web runtime state, in order to solve the technical problem that existing encrypted traffic obfuscation relies on fixed strategies or network packet statistics, and it is difficult to make adaptive decisions between privacy protection and performance overhead by combining page runtime state, resource loading state, cache state and protocol state. The goal is to achieve the effect of reducing the volume baseline, timing rhythm and burst fragmentation fingerprint characteristics under controllable bandwidth and latency overhead.

[0006] To achieve the above objectives, the present invention adopts the following technical solution.

[0007] An adaptive encrypted traffic obfuscation method based on Web runtime state includes the following steps: Establish a page session and initialize the privacy budget, performance budget, and obfuscation policy library corresponding to the page session; The page execution state, page rendering state, resource loading state, and cache state of the page session are collected to form a Web runtime state vector; The protocol status, connection status, and transmission traffic status of the page session are collected to form a transmission status vector; Based on the Web runtime state vector and the transmission state vector, a leakage risk vector is constructed to characterize the risk of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and a comprehensive risk score is determined. Based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget, and the performance budget, a target obfuscation strategy is determined from the obfuscation strategy library; The encrypted traffic of the page session is obfuscated according to the target obfuscation strategy to obtain obfuscated encrypted traffic. Service quality constraints and user experience constraints are monitored during the traffic obfuscation process to obtain constraint monitoring results. The effectiveness of traffic obfuscation is evaluated based on the traffic characteristics of the obfuscated encrypted traffic, and an effectiveness evaluation result is obtained. The target obfuscation strategy is adjusted based on the effect evaluation results and the constraint monitoring results, and the obfuscation strategy library is updated.

[0008] Further, the privacy budget, performance budget, and obfuscation policy library corresponding to the page session are initialized, including: The privacy budget is determined based on at least one of the following constraints: fingerprint similarity, classification confidence, and leakage risk, corresponding to the page session. The performance budget is determined based on the additional bandwidth constraints, additional latency constraints, cache usage constraints, and computational overhead constraints corresponding to the page session. The set of preset obfuscation policies is configured according to the privacy budget and the performance budget to form the obfuscation policy library.

[0009] Furthermore, the page execution state, page rendering state, resource loading state, and cache state of the page session are collected to form a Web runtime state vector, including: Monitor script execution events and page rendering events in the page session to obtain the page execution status and the page rendering status; Monitor resource loading events and cache access events in the page session to obtain the resource loading status and the cache status; The page execution state, the page rendering state, the resource loading state, and the cache state are combined to form the Web runtime state vector.

[0010] Furthermore, by monitoring script execution events and page rendering events in the page session, the page execution state and the page rendering state are obtained, including: The execution status of the page is obtained by collecting the script execution time, the number of long tasks, and the idle ratio of the main thread. The page rendering state is obtained by collecting style recalculation, layout, drawing, layout offset, and page load milestones.

[0011] Furthermore, by monitoring resource loading events and cache access events in the page session, the resource loading state and the cache state are obtained, including: The resource loading status is obtained by collecting the start and end times of resource loading, resource type, resource priority, and cross-domain resource ratio. The cache status is obtained by collecting the cache hit status, Service Worker status, and cache revalidation status.

[0012] Furthermore, the protocol state, connection state, and transmission traffic state of the page session are collected to form a transmission state vector, including: Collect the protocol version, protocol usage ratio, handshake phase, connection multiplexing status, and connection identifier status to obtain the protocol status and the connection status; The transmission traffic status is obtained by collecting round-trip delay, congestion window, packet interval, number of bursts, burst size, and uplink / downlink sequence. The protocol state, the connection state, and the transmission traffic state are combined to form the transmission state vector.

[0013] Furthermore, based on the Web runtime state vector and the transport state vector, a leakage risk vector is constructed representing the risks of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and a comprehensive risk score is determined, including: The volume baseline risk is determined based on the total number of bytes and burst size represented by the transmission state vector; The runtime fragmentation risk and the timing stability risk are determined based on the Web runtime state vector and the packet interval, burst count, and uplink / downlink direction sequence represented by the transmission state vector. The protocol rhythm risk is determined based on the protocol state and the connection state, and the cache exposure risk is determined based on the cache state and the cache re-verification state. The risk of volume baseline, the risk of runtime fragmentation, the risk of timing stability, the risk of protocol rhythm, and the risk of cache exposure are combined to form the leakage risk vector and determine the comprehensive risk score.

[0014] Further, based on the Web runtime state vector and the packet interval, burst count, and uplink / downlink sequence represented by the transmission state vector, the runtime fragmentation risk and the timing stability risk are determined, including: Based on the page execution state and the page rendering state, determine the runtime event window formed by long tasks or layout changes; The runtime event window is associated with the corresponding packet interval, burst count, burst size, and uplink / downlink direction sequence to obtain the window traffic structure; Based on the degree of fragmentation and the degree of repetition stability of the window traffic structure, the runtime fragmentation risk and the timing stability risk are determined.

[0015] Further, based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget, and the performance budget, a target obfuscation strategy is determined from the obfuscation strategy library, including: Based on the comprehensive risk score and the page stage, determine the target time window; Based on the leakage risk vector corresponding to the target time window, the page stage, the privacy budget, the performance budget, and the transmission state vector, a set of candidate obfuscation actions is determined; The target obfuscation strategy is formed by determining the obfuscation action type, action intensity, execution time window, and execution location from the candidate obfuscation action set.

[0016] Further, based on the leakage risk vector corresponding to the target time window, the page stage, the privacy budget, the performance budget, and the transmission state vector, a set of candidate obfuscation actions is determined, including: Based on the page stage, the performance budget, the runtime fragmentation risk, and the timing stability risk, timing obfuscation actions including delayed sending, batch release, burst merging, burst splitting, sending rhythm adjustment, and direction balancing are determined. Based on the volume baseline risk, the protocol rhythm risk, the cache exposure risk, and the transmission state vector, volume obfuscation actions are determined, including virtual fill request, protocol layer fill, resource prefetch, cache prefill, cache re-verification merging, third-party resource collaborative fill, and server pseudo resource response. The timing obfuscation action and the volume obfuscation action are combined to form the candidate obfuscation action set.

[0017] Furthermore, traffic obfuscation is performed on the encrypted traffic of the page session according to the target obfuscation strategy to obtain obfuscated encrypted traffic. Service quality constraints and user experience constraints are monitored during the traffic obfuscation process to obtain constraint monitoring results, including: Based on the execution location and execution time window of the target obfuscation strategy, at least one execution node and its corresponding execution period are determined; Issue obfuscation actions, action strength, and budget constraints to the execution node; During the execution period, the execution node performs traffic obfuscation on the encrypted traffic according to the obfuscation action, the action strength, and the budget constraint to obtain the obfuscated encrypted traffic; The additional bandwidth, additional latency, cache usage, and computational overhead generated by the execution node are monitored to obtain the constraint monitoring results.

[0018] Furthermore, obfuscation actions, action strengths, and budget constraints are issued to the execution node, including: Obfuscation coordination information is generated based on the target obfuscation strategy and the Web runtime state vector. The obfuscation coordination information includes a runtime digest, obfuscation level, and performance budget. The obfuscation coordination information is sent to the execution node via a local secure channel, request header, encryption token, or policy negotiation field, so that the execution node obtains the obfuscation action, the action strength, and the budget constraint.

[0019] Further, during the execution period, the execution node performs traffic obfuscation on the encrypted traffic according to the obfuscation action, the action strength, and the budget constraint to obtain the obfuscated encrypted traffic, including: Based on the runtime fragmentation risk and the timing stability risk, the request sending time, burst release time, or padding data sending time are adjusted within the target time window; Based on the baseline risk and cache exposure risk, adjust the traffic volume corresponding to resource requests, cached data, re-verification requests, or pseudo-resource responses; Based on the protocol pacing risk and the connection status, insert protocol layer padding data or align the transmission pacing of multiple resources into the existing connection; The encrypted traffic, after being adjusted in terms of timing, volume, and transmission rhythm, is sent to obtain the obfuscated encrypted traffic.

[0020] Furthermore, the traffic obfuscation effect is evaluated based on the traffic characteristics of the obfuscated encrypted traffic to obtain an effect evaluation result, including: Extract packet length sequence, uplink / downlink direction sequence, and time sequence from the obfuscated encrypted traffic; The packet length sequence, the uplink / downlink direction sequence, and the time series sequence are evaluated by at least one of fingerprint classification, similarity measurement, entropy measurement, and historical baseline comparison to obtain traffic fingerprint deviation results; The performance evaluation result is generated based on the deviation of the traffic fingerprint.

[0021] Further, the target obfuscation strategy is adjusted based on the effect evaluation results and the constraint monitoring results, and the obfuscation strategy library is updated, including: The privacy budget deviation is determined based on the comparison between the effect evaluation results and the privacy budget, and the performance budget deviation is determined based on the comparison between the constraint monitoring results and the performance budget. Based on the privacy budget deviation and the performance budget deviation, the action type, action intensity, execution time window or execution location of the target obfuscation strategy are adjusted to obtain the updated target obfuscation strategy; The obfuscation strategy library is updated according to the updated target obfuscation strategy.

[0022] An adaptive encrypted traffic obfuscation system based on Web runtime state includes: The runtime state acquisition module is used to collect the page execution state, page rendering state, resource loading state, and cache state of the page session to form a Web runtime state vector; The transmission status acquisition module is used to acquire the protocol status, connection status, and transmission traffic status of the page session to form a transmission status vector. The leakage risk assessment module is used to construct a leakage risk vector based on the Web runtime state vector and the transmission state vector, representing the risk of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and to determine the comprehensive risk score. The strategy decision module is used to establish the page session, initialize the privacy budget, performance budget and obfuscation strategy library corresponding to the page session, and determine the target obfuscation strategy from the obfuscation strategy library based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget and the performance budget; The obfuscation execution module is used to perform traffic obfuscation on the encrypted traffic of the page session according to the target obfuscation strategy, obtain the obfuscated encrypted traffic, and monitor the service quality constraints and user experience constraints during the traffic obfuscation process to obtain constraint monitoring results. The feedback learning module is used to evaluate the traffic obfuscation effect based on the traffic characteristics of the obfuscated encrypted traffic, obtain the effect evaluation result, and adjust the target obfuscation strategy and update the obfuscation strategy library based on the effect evaluation result and the constraint monitoring result.

[0023] The present invention has achieved the following beneficial effects.

[0024] 1. This invention collects JavaScript execution, layout changes, drawing, resource loading, and caching states, and uses the Web runtime state and transmission state together for leakage risk assessment. This enables obfuscation actions to be implemented in high-risk time windows formed by runtime events, reducing the problem of inaccurate obfuscation timing when relying solely on network packet statistics for defense.

[0025] 2. This invention constructs risk assessment mechanisms for volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure. It can simultaneously obfuscate both coarse-grained fingerprints formed by total byte count and burst size, and fine-grained fingerprints formed by packet interval, burst number, and direction sequence.

[0026] 3. This invention determines the type, intensity, execution time window, and execution location of obfuscation actions based on page stage, privacy budget, and performance budget, and makes feedback adjustments in conjunction with service quality constraints and user experience constraints, which can reduce the additional bandwidth, additional latency, cache usage, and computational overhead caused by fixed padding.

[0027] 4. This invention can select QUIC PADDING frames, TLS record layer padding, transmission rhythm adjustment, burst shaping, resource prefetching, and cache pre-filling according to protocol state, connection state, and congestion state. It can also perform obfuscation using existing connections and connection reuse states. It is applicable to HTTPS, HTTP / 2, HTTP / 3 / QUIC, VPN, and enterprise proxy tunnels.

[0028] 5. This invention supports traffic obfuscation at at least one of the following: browser, embedded WebView, client proxy, enterprise security gateway, CDN edge node and origin server. It can also synchronize obfuscation intent, budget and execution results among the client, edge node and server to achieve collaborative protection for first-party resources and some third-party resources.

[0029] 6. This invention performs fingerprint classification, similarity measurement, entropy measurement, or historical baseline comparison on the obfuscated packet length sequence, uplink / downlink sequence, and time sequence, and updates the risk threshold, strategy parameters, and obfuscation strategy library based on the effect evaluation results and constraint monitoring results, which can adapt to different websites, network environments, and attack models. Attached Figure Description

[0030] Figure 1 This is a framework diagram of the adaptive encrypted traffic obfuscation method based on Web runtime state in the embodiment; Figure 2 This is a flowchart of the adaptive encrypted traffic obfuscation method based on Web runtime state in the embodiment; Figure 3 This is a schematic diagram illustrating the high-risk window obfuscation during runtime in the embodiment. Detailed Implementation

[0031] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, detailed descriptions are provided below through embodiments.

[0032] This invention provides an adaptive encrypted traffic obfuscation method based on Web runtime state. This method can be implemented at at least one of the following: a browser, embedded WebView, client proxy, enterprise security gateway, CDN edge node, or origin server. By collecting the Web runtime state and transmission state of the page session, it determines the fingerprint leakage risk corresponding to page access and obfuscates the encrypted traffic under constraints of page performance, bandwidth, congestion control, and user experience. Figure 1 As shown, web runtime state and transport state can be collected from different locations, and obfuscation actions can be performed by the client, proxy, CDN edge node, or origin server; such as Figure 2 As shown, the method includes a closed-loop process of initializing the budget, collecting data, assessing risks, determining strategies, implementing obfuscation, evaluating results, and providing feedback updates.

[0033] Step S1: Establish a page session and initialize the privacy budget, performance budget, and obfuscation policy library corresponding to the page session.

[0034] In an optional embodiment of the present invention, step S1 may include: Step S11: Determine the privacy budget based on at least one of the fingerprint similarity constraint, classification confidence constraint, and leakage risk constraint corresponding to the page session.

[0035] Specifically, the fingerprint similarity constraint can be represented by the decrease in the similarity of the target fingerprint, the classification confidence constraint can be represented by the decrease in the confidence of the target classification, and the leakage risk constraint can be represented by the risk threshold.

[0036] Step S12: Determine the performance budget based on the additional bandwidth constraints, additional latency constraints, cache usage constraints, and computational overhead constraints corresponding to the page session.

[0037] Specifically, the performance budget may include maximum additional bandwidth, maximum additional latency, maximum cache usage, and maximum CPU overhead, which limit the transport, cache, and computing resources that obfuscation actions can occupy in a page session.

[0038] Step S13: Configure a set of preset obfuscation policies according to the privacy budget and performance budget to form an obfuscation policy library.

[0039] Specifically, the preset obfuscation strategy set can record the obfuscation action type, action intensity, execution time window, execution location, and corresponding rollback method, so that it can be selected later according to the page stage and leakage risk.

[0040] Step S2: Collect the page execution state, page rendering state, resource loading state, and cache state of the page session to form a Web runtime state vector.

[0041] In an optional embodiment of the present invention, step S2 may include: Step S21: Monitor script execution events and page rendering events in the page session to obtain the page execution status and page rendering status.

[0042] In an optional embodiment of the present invention, step S21 may include: Step S211: Collect the script execution time, the number of long tasks, and the idle ratio of the main thread to obtain the page execution status.

[0043] Specifically, JavaScript execution can be monitored through the browser kernel, browser extensions, Chrome DevTools Protocol, PerformanceObserver, Long Tasks API, or WebView interface. When using PerformanceObserver for monitoring, you can listen for longtask events and determine the script execution duration and the number of long tasks based on the duration and frequency of the events.

[0044] Step S212: Collect style recalculation, layout, drawing, layout offset and page load milestones to obtain the page rendering status.

[0045] Specifically, page rendering status can include style recalculation count, layout count, paint count, layout shift, maximum content paint (LCP), and time to interact (TTI). When using PerformanceObserver for monitoring, you can listen for the layout-shift, paint, and largest-contentful-paint events.

[0046] Step S22: Monitor resource loading events and cache access events in the page session to obtain resource loading status and cache status.

[0047] In an optional embodiment of the present invention, step S22 may include: Step S221: Collect the start and end time of resource loading, resource type, resource priority, and cross-domain resource ratio to obtain the resource loading status.

[0048] Specifically, the loading start time and loading end time of each resource can be collected through the Resource Timing interface, and a resource loading waterfall corresponding to the page session can be formed according to resource type, resource priority and resource source.

[0049] Step S222: Collect cache hit status, Service Worker status, and cache re-verification status to obtain the cache status.

[0050] Specifically, the cache hit status indicates whether the resource is provided by the local cache, the Service Worker status indicates the intervention status of the Service Worker in resource requests and cache access, and the cache revalidation status indicates a cache revalidation request initiated in the page session.

[0051] Step S23: Combine the page execution state, page rendering state, resource loading state, and cache state to form a Web runtime state vector.

[0052] Specifically, the Web runtime state vector can be continuously updated according to the time progress of the page session to represent the page execution, page rendering, resource loading and cache access within each time window.

[0053] Step S3: Collect the protocol status, connection status, and transmission traffic status of the page session to form a transmission status vector.

[0054] In an optional embodiment of the present invention, step S3 may include: Step S31: Collect the protocol version, protocol usage ratio, handshake phase, connection multiplexing status, and connection identifier status to obtain the protocol status and connection status.

[0055] Specifically, the protocol version may include HTTPS, HTTP / 2, and HTTP / 3; the protocol usage ratio may include the HTTP / 3 ratio; the handshake phase may include a TLS handshake phase or a QUIC handshake phase; and the connection identification status may include the QUIC connection ID status. Protocol and connection states can be obtained from the browser's network stack, proxy, VPN, CDN, or QUIC and HTTP / 3 implementations.

[0056] Step S32: Collect round-trip delay, congestion window, packet interval, number of bursts, burst size, and uplink / downlink sequence to obtain the transmission traffic status.

[0057] Specifically, round-trip time (RTT) can be represented by RTT, and the congestion window can be an estimated value. Transmission traffic status can also characterize packet length, traffic timing, burst distribution within a connection, and transmission status corresponding to cache re-authentication requests.

[0058] Step S33: Combine the protocol state, connection state, and transmission traffic state to form a transmission state vector.

[0059] Step S4: Based on the Web runtime state vector and the transport state vector, construct a leakage risk vector that represents the risk of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and determine the comprehensive risk score.

[0060] In an optional embodiment of the present invention, step S4 may include: Step S41: Determine the volume baseline risk based on the total number of bytes and burst size represented by the transmission state vector.

[0061] Specifically, the total number of bytes can be aggregated based on the burst size corresponding to each page session. The volume baseline risk is used to characterize the stability of the total number of bytes, large object burst size, or burst size distribution.

[0062] Step S42: Based on the Web runtime state vector and the packet interval, burst count, and uplink / downlink sequence represented by the transmission state vector, determine the runtime fragmentation risk and timing stability risk.

[0063] In an optional embodiment of the present invention, step S42 may include: Step S421: Determine the runtime event window formed by long tasks or layout changes based on the page execution state and page rendering state.

[0064] Specifically, when the duration of a long JavaScript task reaches the corresponding threshold, or when the page experiences style recalculation, layout changes, or layout jitter, the time range before and after the corresponding event can be defined as the runtime event window.

[0065] Step S422: Associate the runtime event window with the corresponding packet interval, burst quantity, burst size, and uplink / downlink direction sequence to obtain the window traffic structure.

[0066] Specifically, the association process can match page events in the runtime event window with packet intervals, bursts, and uplink / downlink directions in the encrypted traffic according to timestamps, in order to obtain the traffic patterns formed before and after long tasks or layout changes.

[0067] Step S423: Determine the runtime fragmentation risk and timing stability risk based on the degree of fragmentation and repetition stability of the window traffic structure.

[0068] Specifically, when the number of bursts within the runtime event window increases, or when traffic bursts before and after long tasks and layout changes have repeatable intervals and distributions, the risk of runtime fragmentation or timing stability may be increased accordingly.

[0069] Step S43: Determine the protocol rhythm risk based on the protocol state and connection state, and determine the cache exposure risk based on the cache state and cache re-verification state.

[0070] Specifically, protocol cadence risk can be determined based on protocol version, HTTP / 3 ratio, TLS or QUIC handshake phase, QUIC connection ID status, and connection reuse status. Cache exposure risk can be determined based on the difference in external traffic during cache hits and misses, cache revalidation requests, and Service Worker status.

[0071] Step S44 combines the risk of baseline volume, runtime fragmentation, timing stability, protocol rhythm, and cache exposure to form a leakage risk vector and determine the comprehensive risk score.

[0072] Specifically, the current time window The comprehensive risk score can be expressed as: in, Indicates the current time window The overall risk score; Indicates baseline risk for size; This indicates runtime fragmentation risk; Indicates timing stability risk; This indicates a risk associated with the timing of the agreement; This indicates a risk of cache exposure; to This represents the weight of the corresponding risk. Each weight can be determined based on local strategies, site profiles, or historical training results.

[0073] In an optional embodiment of the present invention, a Web runtime state vector and a transmission state vector can be formed in a sliding window of 50 ms to 500 ms during the page loading process, and a comprehensive risk score can be calculated for each sliding window.

[0074] Step S5: Determine the target obfuscation strategy from the obfuscation strategy library based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget, and the performance budget.

[0075] In an optional embodiment of the present invention, step S5 may include: Step S51: Determine the target time window based on the comprehensive risk score and page stage.

[0076] Specifically, the page phase can include the critical first-screen phase before LCP and the non-critical interaction stabilization phase after the first screen. The target time window can include the time window when the comprehensive risk score reaches the risk threshold, as well as the runtime event window before and after long JavaScript tasks or layout changes.

[0077] Step S52: Determine the set of candidate obfuscation actions based on the leakage risk vector, page stage, privacy budget, performance budget, and transmission state vector corresponding to the target time window.

[0078] In an optional embodiment of the present invention, step S52 may include: Step S521: Based on the page stage, performance budget, and runtime fragmentation and timing stability risks, determine timing obfuscation actions including delayed sending, batch release, burst merging, burst splitting, sending rhythm adjustment, and direction balancing.

[0079] Specifically, during the critical initial screen phase, timing obfuscation actions with lower additional latency can be prioritized; during the stable phase of non-critical interactions, the intensity of sending rhythm adjustments or sudden rearrangements can be increased. For non-critical resource requests, background prefetch requests, and deferred third-party requests, application-layer delayed sending, batch release, or sending rhythm adjustments (pacing) can be identified as candidate timing obfuscation actions.

[0080] Step S522: Based on the volume baseline risk, protocol rhythm risk, cache exposure risk, and transmission state vector, determine the volume obfuscation actions, including virtual fill request, protocol layer fill, resource prefetch, cache prefill, cache re-verification merging, third-party resource collaborative fill, and server pseudo resource response.

[0081] Specifically, protocol layer padding can include QUIC PADDING frames and TLS record layer padding. When the baseline risk is high, resource prefetching, cache pre-filling, server-side pseudo-resource responses, or protocol layer padding can be identified as candidate volume obfuscation actions; when the cache exposure risk is high, cache re-verification merging can be identified as a candidate volume obfuscation action.

[0082] Step S523: Combine the timing obfuscation action and the volume obfuscation action to form a candidate obfuscation action set.

[0083] Specifically, the candidate obfuscation action set may include a single obfuscation action or a combination of different types of obfuscation actions.

[0084] Step S53: Determine the obfuscation action type, action intensity, execution time window, and execution location from the candidate obfuscation action set to form the target obfuscation strategy.

[0085] Specifically, the execution location can include at least one of the following: browser, embedded WebView, client proxy, VPN, enterprise security gateway, CDN edge node, and origin server. The target obfuscation strategy can be set with different action strengths according to the page stage, and a preset fallback method can be used when the performance overhead reaches the performance budget.

[0086] Step S6: Perform traffic obfuscation on the encrypted traffic of the page session according to the target obfuscation strategy to obtain the obfuscated encrypted traffic, and monitor the service quality constraints and user experience constraints during the traffic obfuscation process to obtain the constraint monitoring results.

[0087] In an optional embodiment of the present invention, step S6 may include: Step S61: Determine at least one execution node and its corresponding execution period based on the execution location and execution time window of the target obfuscation strategy.

[0088] Specifically, the execution node can be configured as follows: (1) The execution node is set in the browser or embedded WebView to perform obfuscation on resource requests and encrypted traffic within the same connection during page loading.

[0089] (2) The execution node is set on the client proxy, VPN or enterprise security gateway to control the packet length, uplink and downlink direction and sending rhythm of the encrypted tunnel according to the runtime digest provided by the browser.

[0090] (3) The execution node is set at the CDN edge node or the origin server to obfuscate the response traffic according to the resource type, response size, protocol status and cache status.

[0091] Step S62: Issue obfuscation actions, action strengths, and budget constraints to the execution nodes.

[0092] In an optional embodiment of the present invention, step S62 may include: Step S621: Generate obfuscation coordination information based on the target obfuscation strategy and the Web runtime state vector. The obfuscation coordination information includes runtime summary, obfuscation level, and performance budget.

[0093] Specifically, the runtime summary is used to characterize the page phases and page execution, page rendering, resource loading, and cache access, but does not contain specific URLs or page content.

[0094] Step S622: Send obfuscation coordination information to the execution node through a local secure channel, request header, encryption token, or policy negotiation field, so that the execution node obtains the obfuscation action, action strength, and budget constraints.

[0095] Specifically, when the execution node is a client proxy or VPN, the browser can send a runtime digest through a local secure channel; when the execution node is a CDN edge node or origin server, the client can pass the obfuscation level and performance budget through request headers, encryption tokens, or policy negotiation fields. The client, gateway, CDN edge node, and origin server can also synchronize obfuscation intent, budget, and execution results.

[0096] Step S63: During the execution period, the execution node performs traffic obfuscation on the encrypted traffic according to the obfuscation action, action strength and budget constraints to obtain the obfuscated encrypted traffic.

[0097] In an optional embodiment of the present invention, step S63 may include: Step S631: Based on runtime fragmentation risk and timing stability risk, adjust the request sending time, burst release time, or data filling sending time within the target time window.

[0098] Specifically, when a long-running JavaScript task causes the main thread to block and network requests form repeatable bursts before and after the blocking, random delays can be added to low-priority requests within the runtime event windows before and after the long-running task. This can involve delaying the release of some requests, releasing multiple requests in batches, inserting small-sized padding data, or adjusting multiple low-priority resource requests to a unified sending rhythm. When layout changes or layout jitter cause traffic fragmentation, time randomization, batch release, or alignment padding can also be performed within the corresponding runtime event windows. Figure 3 As shown, after the above adjustments, the timing of sudden events and the interval between packages for long JavaScript tasks or layout changes have changed.

[0099] Step S632: Adjust the traffic volume corresponding to resource requests, cached data, re-verification requests, or pseudo-resource responses based on the baseline risk and cache exposure risk.

[0100] Specifically, when the total number of bytes or large object bursts have a stable distribution, the burst size distribution can be changed through resource prefetching, cache pre-filling, pseudo-resource responses, or server-side filling. Where user privacy mode allows, highly reusable static resources can be pre-cached or pre-filled using Service Workers; upon subsequent access, static resources can be provided by the local cache, and cache re-verification requests can be merged, delayed, or disguised to ensure that the difference in external traffic corresponding to cache hits and misses falls within a preset range.

[0101] Step S633: Based on the protocol rhythm risk and connection status, insert protocol layer padding data into the existing connection or align the transmission rhythm of multiple resources.

[0102] Specifically, when HTTP / 3 or QUIC is available and the congestion window allows, QUICPADDING frames can be inserted into existing QUIC connections, or the server can send padding data within the same connection. When using TLS transport, TLS record layer padding can be performed. CDN edge nodes or origin servers can also delay partial responses, add pseudo-response blocks, or align the transmission rhythm of multiple resource responses.

[0103] Step S634: Send the encrypted traffic that has been adjusted in time, volume, and transmission rhythm to obtain the obfuscated encrypted traffic.

[0104] Step S64: Monitor the additional bandwidth, additional latency, cache usage, and computational overhead generated by the execution node to obtain the constraint monitoring results.

[0105] Specifically, the constraint monitoring results can be used to characterize whether the traffic obfuscation process meets performance budget, page performance constraints, congestion control constraints, quality of service constraints, and user experience constraints.

[0106] Step S7: Evaluate the traffic obfuscation effect based on the traffic characteristics of the obfuscated encrypted traffic, and obtain the effect evaluation result.

[0107] In an optional embodiment of the present invention, step S7 may include: Step S71: Extract the packet length sequence, uplink / downlink direction sequence, and time sequence from the obfuscated encrypted traffic.

[0108] Specifically, the time sequence may include packet intervals and burst release times, and the packet length sequence may characterize the length of a single packet and the volume of traffic corresponding to each burst.

[0109] Step S72: The packet length sequence, uplink / downlink direction sequence, and time series sequence are evaluated by at least one of fingerprint classification, similarity measurement, entropy measurement, and historical baseline comparison to obtain the traffic fingerprint deviation result.

[0110] Specifically, fingerprint classification can be performed by an online lightweight fingerprint classifier, which outputs the classification confidence corresponding to the page access category; similarity measurement can compare the similarity between the obfuscated traffic sequence and the original fingerprint template; historical baseline comparison can compare the obfuscated traffic sequence with the historical traffic baseline corresponding to the page session.

[0111] Step S73: Generate performance evaluation results based on traffic fingerprint deviation results.

[0112] Specifically, the effectiveness evaluation results may include the decrease in fingerprint similarity, the decrease in classification confidence, the amount of entropy change, and the degree of deviation of the confused traffic sequence from the original fingerprint template or historical traffic baseline.

[0113] Step S8: Adjust the target obfuscation strategy based on the effect evaluation results and constraint monitoring results, and update the obfuscation strategy library.

[0114] In an optional embodiment of the present invention, step S8 may include: Step S81: Determine the privacy budget deviation based on the comparison between the effect evaluation results and the privacy budget, and determine the performance budget deviation based on the comparison between the constraint monitoring results and the performance budget.

[0115] Specifically, when the effect evaluation results do not reach the decrease in target fingerprint similarity, decrease in target classification confidence, or risk threshold corresponding to the privacy budget, a privacy budget deviation is determined to exist; when the additional bandwidth, additional latency, cache usage, or computational overhead exceeds the performance budget, a performance budget deviation is determined to exist.

[0116] Step S82: Based on the privacy budget deviation and performance budget deviation, adjust the action type, action intensity, execution time window or execution location of the target obfuscation strategy to obtain the updated target obfuscation strategy.

[0117] Specifically, when the obfuscation level is insufficient, the filling intensity within the target time window can be increased or the sending rhythm can be adjusted; when the performance overhead exceeds the performance budget, the action intensity can be reduced, the execution time can be delayed, or a cache-type obfuscation action or a server-side obfuscation action can be switched.

[0118] Step S83: Update the obfuscation policy library according to the updated target obfuscation policy.

[0119] Specifically, risk thresholds, risk weights, policy parameters, and obfuscation policy libraries can be updated based on online assessment results, historical fingerprint templates, and user network environment, and the updated target obfuscation policy can be used in subsequent time windows of page sessions.

[0120] This invention also provides an adaptive encrypted traffic obfuscation system based on Web runtime state, used to execute the above method, including: The runtime state acquisition module is used to collect the page execution state, page rendering state, resource loading state, and cache state of the page session to form a Web runtime state vector; The transmission status acquisition module is used to acquire the protocol status, connection status, and transmission traffic status of the page session to form a transmission status vector. The leakage risk assessment module is used to construct a leakage risk vector based on the Web runtime state vector and the transmission state vector, representing the risk of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and to determine the comprehensive risk score. The strategy decision module is used to establish the page session, initialize the privacy budget, performance budget and obfuscation strategy library corresponding to the page session, and determine the target obfuscation strategy from the obfuscation strategy library based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget and the performance budget; The obfuscation execution module is used to perform traffic obfuscation on the encrypted traffic of the page session according to the target obfuscation strategy, obtain the obfuscated encrypted traffic, and monitor the service quality constraints and user experience constraints during the traffic obfuscation process to obtain constraint monitoring results. The feedback learning module is used to evaluate the traffic obfuscation effect based on the traffic characteristics of the obfuscated encrypted traffic, obtain the effect evaluation result, and adjust the target obfuscation strategy and update the obfuscation strategy library based on the effect evaluation result and the constraint monitoring result.

[0121] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.

Claims

1. An adaptive encrypted traffic obfuscation method based on Web runtime state, characterized in that, Includes the following steps: Establish a page session and initialize the privacy budget, performance budget, and obfuscation policy library corresponding to the page session; The page execution state, page rendering state, resource loading state, and cache state of the page session are collected to form a Web runtime state vector; The protocol status, connection status, and transmission traffic status of the page session are collected to form a transmission status vector; Based on the Web runtime state vector and the transmission state vector, a leakage risk vector is constructed to characterize the risk of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and a comprehensive risk score is determined. Based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget, and the performance budget, a target obfuscation strategy is determined from the obfuscation strategy library; The encrypted traffic of the page session is obfuscated according to the target obfuscation strategy to obtain obfuscated encrypted traffic. Service quality constraints and user experience constraints are monitored during the traffic obfuscation process to obtain constraint monitoring results. The effectiveness of traffic obfuscation is evaluated based on the traffic characteristics of the obfuscated encrypted traffic, and an effectiveness evaluation result is obtained. The target obfuscation strategy is adjusted based on the effect evaluation results and the constraint monitoring results, and the obfuscation strategy library is updated.

2. The method as described in claim 1, characterized in that, The page execution state, page rendering state, resource loading state, and cache state of the page session are collected to form a Web runtime state vector, including: Monitor script execution events and page rendering events in the page session to obtain the page execution status and the page rendering status; Monitor resource loading events and cache access events in the page session to obtain the resource loading status and the cache status; The page execution state, the page rendering state, the resource loading state, and the cache state are combined to form the Web runtime state vector.

3. The method as described in claim 1, characterized in that, Based on the Web runtime state vector and the transport state vector, a leakage risk vector is constructed to characterize the risks of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and a comprehensive risk score is determined, including: The volume baseline risk is determined based on the total number of bytes and burst size represented by the transmission state vector; The runtime fragmentation risk and the timing stability risk are determined based on the Web runtime state vector and the packet interval, burst count, and uplink / downlink direction sequence represented by the transmission state vector. The protocol rhythm risk is determined based on the protocol state and the connection state, and the cache exposure risk is determined based on the cache state and the cache re-verification state. The risk of volume baseline, the risk of runtime fragmentation, the risk of timing stability, the risk of protocol rhythm, and the risk of cache exposure are combined to form the leakage risk vector and determine the comprehensive risk score.

4. The method as described in claim 3, characterized in that, Based on the Web runtime state vector and the packet interval, burst count, and uplink / downlink sequence represented by the transmission state vector, the runtime fragmentation risk and the timing stability risk are determined, including: Based on the page execution state and the page rendering state, determine the runtime event window formed by long tasks or layout changes; The runtime event window is associated with the corresponding packet interval, burst count, burst size, and uplink / downlink direction sequence to obtain the window traffic structure; Based on the degree of fragmentation and the degree of repetition stability of the window traffic structure, the runtime fragmentation risk and the timing stability risk are determined.

5. The method as described in claim 1, characterized in that, Based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget, and the performance budget, a target obfuscation strategy is determined from the obfuscation strategy library, including: Based on the comprehensive risk score and the page stage, determine the target time window; Based on the leakage risk vector corresponding to the target time window, the page stage, the privacy budget, the performance budget, and the transmission state vector, a set of candidate obfuscation actions is determined; The target obfuscation strategy is formed by determining the obfuscation action type, action intensity, execution time window, and execution location from the candidate obfuscation action set.

6. The method as described in claim 5, characterized in that, Based on the leakage risk vector corresponding to the target time window, the page stage, the privacy budget, the performance budget, and the transmission state vector, a set of candidate obfuscation actions is determined, including: Based on the page stage, the performance budget, the runtime fragmentation risk, and the timing stability risk, timing obfuscation actions including delayed sending, batch release, burst merging, burst splitting, sending rhythm adjustment, and direction balancing are determined. Based on the volume baseline risk, the protocol rhythm risk, the cache exposure risk, and the transmission state vector, volume obfuscation actions are determined, including virtual fill request, protocol layer fill, resource prefetch, cache prefill, cache re-verification merging, third-party resource collaborative fill, and server pseudo resource response. The timing obfuscation action and the volume obfuscation action are combined to form the candidate obfuscation action set.

7. The method as described in claim 1, characterized in that, Traffic obfuscation is performed on the encrypted traffic of the page session according to the target obfuscation strategy to obtain obfuscated encrypted traffic. Service quality constraints and user experience constraints are monitored during the traffic obfuscation process to obtain constraint monitoring results, including: Based on the execution location and execution time window of the target obfuscation strategy, at least one execution node and its corresponding execution period are determined; Issue obfuscation actions, action strength, and budget constraints to the execution node; During the execution period, the execution node performs traffic obfuscation on the encrypted traffic according to the obfuscation action, the action strength, and the budget constraint to obtain the obfuscated encrypted traffic; The additional bandwidth, additional latency, cache usage, and computational overhead generated by the execution node are monitored to obtain the constraint monitoring results.

8. The method as described in claim 7, characterized in that, During the execution period, the execution node performs traffic obfuscation on the encrypted traffic according to the obfuscation action, the action strength, and the budget constraint to obtain the obfuscated encrypted traffic, including: Based on the runtime fragmentation risk and the timing stability risk, the request sending time, burst release time, or padding data sending time are adjusted within the target time window; Based on the baseline risk and cache exposure risk, adjust the traffic volume corresponding to resource requests, cached data, re-verification requests, or pseudo-resource responses; Based on the protocol pacing risk and the connection status, insert protocol layer padding data or align the transmission pacing of multiple resources into the existing connection; The encrypted traffic, after being adjusted in terms of timing, volume, and transmission rhythm, is sent to obtain the obfuscated encrypted traffic.

9. The method as described in claim 1, characterized in that, The target obfuscation strategy is adjusted based on the effect evaluation results and the constraint monitoring results, and the obfuscation strategy library is updated, including: The privacy budget deviation is determined based on the comparison between the effect evaluation results and the privacy budget, and the performance budget deviation is determined based on the comparison between the constraint monitoring results and the performance budget. Based on the privacy budget deviation and the performance budget deviation, the action type, action intensity, execution time window or execution location of the target obfuscation strategy are adjusted to obtain the updated target obfuscation strategy; The obfuscation strategy library is updated according to the updated target obfuscation strategy.

10. An adaptive encrypted traffic obfuscation system based on Web runtime state, characterized in that, include: The runtime state acquisition module is used to collect the page execution state, page rendering state, resource loading state, and cache state of the page session to form a Web runtime state vector; The transmission status acquisition module is used to acquire the protocol status, connection status, and transmission traffic status of the page session to form a transmission status vector. The leakage risk assessment module is used to construct a leakage risk vector based on the Web runtime state vector and the transmission state vector, representing the risk of volume baseline, runtime fragmentation, timing stability, protocol rhythm, and cache exposure, and to determine the comprehensive risk score. The strategy decision module is used to establish the page session, initialize the privacy budget, performance budget and obfuscation strategy library corresponding to the page session, and determine the target obfuscation strategy from the obfuscation strategy library based on the comprehensive risk score, the page stage represented by the Web runtime state vector, the privacy budget and the performance budget; The obfuscation execution module is used to perform traffic obfuscation on the encrypted traffic of the page session according to the target obfuscation strategy, obtain the obfuscated encrypted traffic, and monitor the service quality constraints and user experience constraints during the traffic obfuscation process to obtain constraint monitoring results. The feedback learning module is used to evaluate the traffic obfuscation effect based on the traffic characteristics of the obfuscated encrypted traffic, obtain the effect evaluation result, and adjust the target obfuscation strategy and update the obfuscation strategy library based on the effect evaluation result and the constraint monitoring result.

Images