A website fingerprinting defense method and system for multiple-page concurrent access of an onion routing network Tor

Abstract

The application provides a website fingerprint defense method and system for multiple-page concurrent access of an onion routing network Tor, and the method comprises the following steps: constructing a length distribution model for a real single-page traffic statistical packet quantity, sampling a length threshold value, globally shaping pluggable transport layer traffic at a window level fixed rate, triggering an upper layer decision maker to determine a target boundary position when a cumulative number of sent packets reaches the length threshold value, generating an end boundary and an early burst induction segment, and selecting a boundary induction segment combination according to the target boundary position by a lower layer decision maker, constructing an end and start induction boundary on the basis of global shaping, and continuing global shaping after the induction boundary is constructed; and making the multiple-page concurrent mixed long traffic observed by an attacker as multiple single-page traffic length flows after shaping. The application can interfere with the identification of a webpage by a local attacker at an onion routing network Tor entry node and control the communication overhead caused by defense.

Description

Technical Field

[0001] This invention belongs to the field of anonymous communication and network traffic privacy protection technology, specifically relating to a website fingerprinting defense method and system for concurrent access to multiple pages on the Tor routing network. Background Technology

[0002] Tor, the onion routing network, protects users' communication content and access relationships through multi-hop forwarding and encrypted transmission. However, the encryption process cannot completely hide the direction of traffic transmission, arrival time, burst structure, and duration. A local passive observer located between the user and the Tor entry point can record these external traffic characteristics and use website fingerprinting attack models to infer the websites the user visits.

[0003] Most website fingerprinting defenses target a single, complete page visit, typically assuming that the traffic trajectory has identifiable start and end points. However, in actual browsing, users visit multiple pages at once. Methods for defending against single-page traffic have clear traffic boundaries, making it easy for attackers to separate the traffic from a single page. Furthermore, single-page defense methods can also lead to wasted resources.

[0004] Currently, website fingerprinting defense methods based on the Tor routing network mainly fall into two categories: traffic regularization and lightweight padding. Traffic regularization sends real data and padding data at a preset rate, effectively hiding traffic direction, bursts, and length characteristics, but typically requires maintaining the sending state for a long time, resulting in high bandwidth and latency overhead. Lightweight methods, represented by WTF-PAD and FRONT, mainly add random padding to real traffic, with little or no delay to real data, offering better deployment feasibility, but retaining some of the original traffic structure. With the development of deep learning attacks and robust traffic representation methods, attackers can still extract residual features from the defended traffic, and the contradiction between defense effectiveness and communication overhead has not yet been fully resolved.

[0005] Therefore, existing technologies still have the following limitations in multi-page concurrent scenarios: First, the single-page assumption does not conform to reality and is easily detected by attackers; second, regularization and lightweight shaping are difficult to balance defense effectiveness and communication overhead; third, existing perturbations do not cover the key features that the attack model actually relies on, and as the attack model is updated, stable identifiable information is still retained in the defense traffic; fourth, most defenses rely on fixed thresholds or empirical rules, making it difficult to adjust the defense strategy in real time according to changes in traffic characteristics and queue status, and lacking dynamic adaptive capabilities. Summary of the Invention

[0006] Purpose of the invention: The technical problem to be solved by the present invention is to address the shortcomings of the existing technology by providing a website fingerprinting defense method and system for multi-page concurrent access of the Tor routing network. This method hides the page boundaries and number by window-level fixed-rate shaping and then forges the page boundaries to cause attackers to misclassify the page.

[0007] The method includes the following steps:

[0008] Step S1: Obtain real single-page traffic samples, construct a real webpage length distribution model, perform sensitivity analysis, and obtain the sensitivity weights of the start feature, end feature, and boundary position.

[0009] Step S2: Tor (The Onion Router) is an anonymous communication network based on the onion routing mechanism. It hides the direct communication relationship between users and target websites through multi-hop relay forwarding and layered encryption. Pluggable transport proxies are set up on both the Tor client and server sides of the onion routing network. The encrypted traffic of the Tor network is divided into fixed-length pluggable transport layer data units, generating uplink real data queues and downlink real data queues. The client pluggable transport proxy and the server pluggable transport proxy coordinate to send real data units and padding units according to a fixed time window and a preset fixed uplink and downlink sending rate. The length threshold is sampled from the length distribution model, and the encrypted traffic of the Tor network is globally shaped. At the same time, the number of packets sent is accumulated.

[0010] Step S3: Generate candidate boundary inducement positions, construct upper-level state features, and train the upper-level decision-maker with skip, early trigger, confirmation trigger, and delayed trigger as action sets; when the number of data units sent is close to the length threshold, determine the current position as the candidate boundary inducement position, extract the state features of the candidate boundary inducement position and input them into the trained upper-level decision-maker to determine the target boundary inducement position;

[0011] Step S4: Use the start feature sensitive weight and end feature sensitive weight as weighting factors for the training loss of the two-branch diffusion model. The two-branch diffusion model generates an end boundary induction template for simulating the end feature of web page access and an early burst induction template for simulating the start feature of web page access. A boundary induction template library is established based on the model generation results.

[0012] Step S5: Combine the end boundary inducement template and the early burst inducement template into a candidate boundary inducement set, construct the lower-level state features, train the lower-level decision-maker with the selection of the candidate combination as the action set, input the candidate boundary inducement combination into the lower-level decision-maker, and after completing the target boundary inducement shaping, continue to process the subsequent traffic with global shaping.

[0013] Step S1 specifically includes:

[0014] Step S1-1: Obtain real single-page traffic samples, count the number of packets contained in each traffic, and obtain the length sample set D of single-page traffic;

[0015] Step S1-2: Calculate two or more quantiles in the length sample set D, divide the single-page traffic length into different length ranges based on the two or more quantiles, and generate a real webpage length distribution model M.

[0016] Steps S1-3 involve inputting single-page traffic into three website fingerprinting attack models: DF, TikTok, and ARES. The traffic start segment, traffic end segment, and local windows near different candidate boundary positions are occluded. The decrease in the confidence of the correct class prediction before and after occlusion is calculated. For the r-th attack model and the local window w, let the confidence of the attack model's prediction of the true class of the i-th sample before occlusion be denoted as . After partially occluding the window w, the attack model's prediction confidence for the same real class is... Then the sensitivity score of the r-th attack model corresponding to the local window w. Represented as: For two or more attack models, the average value is used to obtain the comprehensive sensitivity score of the local window w. Where R represents the number of attack models, After normalization, we obtain the start feature sensitive weight, end feature sensitive weight, and boundary position sensitive weight.

[0017] Step S2 specifically includes:

[0018] Step S2-1: The client-side pluggable transport agent divides the uplink encrypted byte stream output by the Tor client into uplink real payload packets according to the outer encapsulation rules aligned with Tor units, and places them into the uplink real payload queue. The pluggable transport proxy on the server side divides the downlink encrypted byte stream output by the Tor server of the Tor routing network into downlink real payload packets according to the outer encapsulation rules aligned with the Tor unit of the Tor routing network, and puts them into the downlink real payload queue. The uplink real payload queue and the downlink real payload queue are represented as follows: ,in, This represents the i-th uplink actual payload packet to be sent. This represents the j-th downlink actual payload packet to be sent;

[0019] Step S2-2: At the start of the session and after the target boundary induction is completed, sample the new target traffic length L from the real webpage length distribution model M generated in the offline phase, and initialize the cumulative number of packets sent in the current traffic segment. Continuously updated during the overall plastic surgery process ,when and When the difference between the two values ​​falls within a preset length range, the current position is determined as the candidate boundary induction position. : ,in, This indicates the preset length tolerance threshold; This represents the target traffic length sampled from the webpage length distribution model;

[0020] Step S2-3, set the fixed time window length as Δ, and the preset uplink transmission rate as... The preset downlink transmission rate is The number of uplink transmission packets to be sent within the h-th time window and downlink transmission packet count They are respectively: ,in It is a function used for rounding numerical values;

[0021] Total number of sending slots within this time window ,according to and Generate K candidate direction sequences Where k takes values ​​from 1 to K, and the k-th candidate direction sequence Represented as: ,in, Indicates the k-th candidate direction sequence. The transmission direction corresponding to each sending slot 1 represents an uplink transmission slot, -1 represents a downlink transmission slot, and each candidate direction sequence satisfies , where I() represents the indicator function, and the number of uplink slots and downlink slots in each candidate direction sequence are the same, but the slot arrangement order is different;

[0022] Step S2-4, for each candidate direction sequence Perform local simulations to calculate candidate direction sequences. Number of populated packets required for execution Actual payload packet waiting time Changes in uplink and downlink queue backlogs and directional characteristic deviation ,right , , and Normalization was performed separately:

[0023] ,

[0024] in, It is a function used for index normalization. express , , or Any one of the indicators, and These represent the minimum and maximum values ​​of the same index in the K candidate direction sequences, respectively. To prevent constants with zero denominators, the execution cost of candidate direction sequences... Represented as:

[0025] ,

[0026] in, and To preset the weight parameters, the candidate direction sequence with the lowest execution cost is selected as the target direction sequence. ,in, It is the set of candidate direction sequences generated within the h-th time window, according to the target direction sequence. The transmission packets are sent sequentially in the direction of the slots.

[0027] Step S3 specifically includes:

[0028] Step S3-1, for the q-th candidate boundary induced position Around this location Extract length features, local flow pattern features, queue state features, and boundary interval features to construct the state feature vector of the upper-level decision-maker. : ,in, This represents the normalized deviation in packet count between the current traffic segment and the target pseudo-webpage segment, calculated as follows: ;

[0029] Local flow pattern characteristics include the local average time interval near the candidate boundary induction location. , rate of change of direction Sudden Density and boundary position sensitive weights Queue status characteristics include uplink queue backlog. Downlink queue backlog and remaining expense amount Boundary spacing features This indicates the interval between the current candidate boundary inducement position and the previous target boundary inducement position;

[0030] Step S3-2, Feature Vector Inputting the state encoding network yields a state vector that induces the positions of the state candidate boundaries. : ,in, The parameter is State coding network;

[0031] The state vector Input Action Scoring Network The scores for each action in action set A are obtained: ,in, Indicates skipping an action. This indicates that the action is triggered in advance. This indicates confirmation of the triggered action. This indicates that the triggering action is delayed. Indicates the induced position at the candidate boundary. Select action Action scoring, The parameter is Action scoring network;

[0032] Step S3-3: The motion constraint module generates a motion mask according to preset rules. Used to block non-executable actions: ,in, Indicates action Executable =0 indicates an action Blocked;

[0033] When any of the following conditions are met: , , , The action constraint module will block prematurely triggered actions and confirmed trigger actions. The confirmation action is blocked at the time, among which, This represents the minimum interval between the induced positions of adjacent boundaries. and These represent the upper limit of the up queue backlog and the upper limit of the down queue backlog, respectively. Indicates the minimum remaining expenditure amount. This indicates the upper limit of the flow length deviation allowed for confirming the target boundary induced location;

[0034] Steps S3-4: Select the final action based on the action score and motion mask. ,when To induce an action in advance or to confirm the triggering of an action, the current candidate boundary position is induced. Alternatively, the corrected position can be determined as the target boundary induced position. ;when To postpone the triggering action, continue performing global reshaping and wait for subsequent candidate boundary induction positions. When skipping an action, abandon the current candidate boundary induced position and continue global shaping, waiting for a candidate boundary position that meets the conditions.

[0035] Step S4 specifically includes:

[0036] Step S4-1: Extract the start segment and end segment of webpage access from the traffic sample, and represent each segment as a time sequence X composed of the time interval between adjacent transmission units and the transmission direction: , , This represents the characteristics of the k-th transmission unit, where N represents the segment length. This represents the time interval between the k-th transmission unit and the previous transmission unit. Indicates the transmission direction of the k-th transmission unit;

[0037] Step S4-2: Gradually add random perturbations to the time series X to obtain a noisy time series. :

[0038] ,

[0039] in, Indicates the first The noise scheduling coefficient corresponding to each diffusion time step This represents a random perturbation that follows a standard normal distribution, and it relates to noisy time series sequences. The corresponding contextual features c are input into the bi-branch diffusion generation model. The diffusion generation model is trained to recover the original time series. The start feature sensitive weights and end feature sensitive weights are introduced into the local reconstruction loss to obtain the weighted diffusion training loss. :

[0040] ,

[0041] in, These are the parameters of the diffusion generation model. This represents the attack sensitivity weight corresponding to the k-th position. This represents the random perturbation at position k. This represents the random perturbation at the k-th position predicted by the diffusion generation model;

[0042] Step S4-3: The dual-branch diffusion generation model includes a shared context encoder, an end boundary generation branch, and an early burst generation branch. The shared context encoder is used to encode the flow length, direction change, and time interval near the candidate boundary position. The end boundary generation branch is used to generate low-density flow, increased time interval, and short pause features before the end of the webpage. The early burst generation branch is used to generate high-density flow and direction change features at the beginning of the webpage.

[0043] Step S4-4: Introduce boundary consistency constraints to the final boundary generation branch and the early burst generation branch. The boundary consistency constraint loss... Loss is represented as: ,in, This represents the local statistical characteristics of the end boundary template. This represents the local statistical characteristics of the early burst template, with the ending boundary template being... Early outbreak template is This ensures continuity between generated results at the same candidate boundary position, and constrains and corrects the generated results based on the number of fill cells and the expected delay. The expected number of fill cells in the generated template is... The expected delay is The preset fill limit is The preset delay limit is The generated result must satisfy: ≤ and ≤ When the generated result does not meet the constraints, the generated fragment is truncated, the time interval is scaled, or it is resampled to make the generated result meet the limits of the number of filling units and the expected delay. The generated result that meets the constraints is saved to the boundary induced template library.

[0044] Step S5 specifically includes:

[0045] Step S5-1: Select two or more termination boundary-inducing templates and early burst-inducing templates from the boundary-inducing template library to form the termination boundary-inducing template set. Early outbreak-induced template set Where I represents the number of termination boundary induced templates, This indicates the number of early burst induced templates, and each termination boundary induced template... Each early outbreak-inducing template Combining these elements yields the candidate boundary induced set. in, Indicates by the first A termination boundary inducement template and the An early-stage induction template The candidate boundary induced combination;

[0046] Step S5-2: Extract candidate boundary-induced combinations Template parameters, target boundary induced position Based on the local flow state and remaining cost, construct the candidate combination feature vector and input it into the candidate combination encoding network. The candidate combination vector is obtained. ,in, The parameter is The candidate combination encoding network performs offline simulation of each candidate boundary-induced combination on the local traffic of the current global shaped traffic. The simulation execution results are obtained. ,in, This indicates the similarity between the local traffic after execution and the actual end boundary shape of the webpage. This indicates the similarity between the localized traffic after execution and the early burst patterns of the actual webpage. This indicates the boundary consistency between the end boundary-induced template and the start burst-induced template. This indicates that the attack misled the recipients of the benefits. Indicates the estimated queue waiting time;

[0047] Step S5-3, select candidate combination vectors and simulation execution results Input combined scoring network Calculate candidate boundary induced combinations Overall rating The overall score is expressed as a weighted scoring function: ,in, , , , , , , To preset the weight parameters, the constraint filtering module is used to perform executability filtering on each candidate boundary induced combination;

[0048] Step S5-4, at the target boundary induction position Previously, according to the target end boundary induced template The transmission time of local transmission packets is progressively delayed, and a short pause is set when the constraints are met to form externally visible traffic characteristics as webpage access nears its end, thus inducing a position at the target boundary. Subsequently, according to the target's early sudden induction template The transmission direction sequence and time interval sequence are sent to fill packets to form burst features at the beginning of the webpage. After the boundary induction is completed, the new target traffic length is resampled from the webpage length distribution model for the next candidate boundary induction position triggering, and global shaping continues.

[0049] In step S5-3, the constraint filtering module is implemented by rule constraints and action masking mechanism. The rule constraints are used to determine whether the candidate boundary induction scheme meets the preset conditions. The action masking mechanism converts the judgment result of the rule constraints into an executable flag: when the flag value is 1, it means that selection is allowed, and when the value is 0, selection is blocked.

[0050] The constraint filtering module selects candidate boundary-induced combinations that meet the conditions. The executable mask is ,when and and , ,otherwise ,in, Indicates the maximum number of fill cells. Indicates the expected upper limit of delay. Indicates the maximum waiting time for the queue, delete. The candidate boundary-induced combinations are selected, and the combination with the highest comprehensive score among the remaining candidate boundary-induced combinations is selected as the target boundary-induced combination. .

[0051] The present invention also provides a website fingerprinting defense system for concurrent multi-page access to the Tor routing network for implementing the method described above, comprising:

[0052] The basic windowing shaping module generates multiple candidate direction sequences within each fixed time window based on the preset uplink and downlink transmission rates. It performs normalized weighted scoring on the number of padding packets, actual payload packet waiting time, uplink and downlink queue backlog changes, and direction feature deviations of each candidate direction sequence, and executes the candidate direction sequence with the lowest score.

[0053] The length distribution and attack sensitivity analysis module is used to acquire two or more real single-page traffic samples, count the number of transmission packets corresponding to the traffic samples, construct a webpage length distribution model, and convert the traffic samples into the input representation of the website fingerprint attack model. Using the pre-trained DF, TikTok and ARES website fingerprint attack models, the module performs occlusion sensitivity analysis on the beginning segment of the webpage, the end segment of the webpage and the window near the candidate boundary position, and obtains the sensitivity weight of early feature, sensitivity weight of end feature and sensitivity weight of boundary position.

[0054] The boundary-induced template generation module extracts the start and end segments of web pages from the traffic sample set and constructs a two-branch diffusion generation model with boundary consistency constraints. This model includes a shared context encoder, an end boundary generation branch, and an early burst generation branch. The shared context encoder encodes the traffic length, direction changes, time intervals, attack sensitivity weights, and remaining overhead near the candidate boundary position. The end boundary generation branch generates the end boundary induced template before the target boundary induced position, and the early burst generation branch generates the start burst induced template after the target boundary induced position. The boundary-induced template generation module uses the early feature sensitivity weights and the end feature sensitivity weights as weighting factors for the local reconstruction loss of the diffusion model and corrects the generation results through boundary consistency constraints and overhead constraints to establish a boundary-induced template library.

[0055] The two-layer constraint decision-making module includes an upper-layer decision-maker and a lower-layer decision-maker. The upper-layer decision-maker includes a state encoding network, an action scoring network, and an action constraint filtering module. The state encoding network encodes the current traffic information of the candidate boundary inducement position and the interval from the previous target boundary inducement position into a state vector. The action scoring network outputs scores for four types of actions: skip, early trigger, confirmed trigger, and delayed trigger. The action constraint filtering module blocks unexecutable actions based on the minimum boundary interval, queue backlog limit, remaining overhead amount, and length deviation range, and determines the target boundary inducement position from the unblocked actions. The lower-layer decision-maker combines the end boundary inducement template and the early burst inducement template into two or more candidate boundary inducement schemes, and selects the target boundary inducement combination based on the end boundary similarity, start burst similarity, boundary consistency, attack misleading benefit, filling overhead, delay overhead, and queue waiting time.

[0056] The boundary location determination module samples the target traffic length from the webpage length distribution model at the start of the session or after the target boundary guidance scheme is completed. During the basic windowing shaping process, it accumulates the number of transmission packets sent by the current traffic. When the accumulated number of sent packets is close to the target traffic length, it marks the current location as a candidate boundary guidance location and calls the upper-layer decision-maker to determine whether to use the candidate boundary guidance location as the target boundary guidance location.

[0057] The boundary guidance execution module, based on the target boundary guidance scheme selected by the lower-level decision-maker, progressively delays the sending time of local transmission packets and sets short pauses according to the end boundary guidance template before the target boundary guidance position to construct webpage access end features. After the target boundary guidance position, it sends filling packets in the corresponding direction according to the direction sequence and time interval sequence in the early burst guidance template to construct early webpage features. After the boundary guidance execution is completed, it restores the basic windowed reshaping.

[0058] The present invention also provides an electronic device comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein the programs, when executed by the processors, implement the steps of the method.

[0059] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described herein.

[0060] Compared with the prior art, the present invention has the following beneficial effects:

[0061] (1) By using windowed fixed-rate shaping, the start-up mutations, quantity changes, and end pauses caused by concurrent access to multiple pages are transformed into a unified window-level sending form, increasing the difficulty for attackers to separate mixed traffic. The distribution of real webpage length is used as the basis for inducing boundary triggering, so that the pseudo-boundary position is close to the real webpage length in terms of packet quantity, inducing attackers to perform incorrect traffic separation.

[0062] (2) Sensitive weights are obtained by using attack model occlusion analysis, so that the generation of induced fragments and boundary decisions focus on the start fragments, end fragments and windows near the boundary that are easily exploited by the attack model, so as to achieve targeted defense and improve the defense effect. The dual-branch diffusion generation model generates the end boundary induced template and the early burst induced template at the same time, and the boundary consistency constraint ensures that the two are connected naturally, so that attackers can more easily mistake the false boundary for the real end of the webpage and the beginning of the new webpage. A two-layer decision-maker is introduced: the upper decision-maker determines the target boundary induced position, and the lower decision-maker selects the boundary induced scheme, and makes a constraint choice between the attack misleading effect, cost and queue waiting, so as to improve the defense effect and control the cost. Attached Figure Description

[0063] Figure 1 This is a flowchart of the overall process of the method of the present invention.

[0064] Figure 2 This is a schematic diagram of the length distribution model and window-level fixed-rate shaping corresponding to steps S1-S2 of the present invention.

[0065] Figure 3 This is a schematic diagram of the upper-level decision-maker training and online decision-making corresponding to step S3 of the present invention.

[0066] Figure 4 This is a schematic diagram of the bi-branch diffusion model training and boundary-induced template generation corresponding to step S4 of the present invention.

[0067] Figure 5 This is a schematic diagram of the lower-level decision-maker training and online decision-making corresponding to step S5 of the present invention.

[0068] Figure 6 This is a flowchart of the online operating system of the present invention. Detailed Implementation

[0069] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0070] This invention provides a website fingerprinting defense method for concurrent multi-page access via the Tor routing network. It defends against concurrent multi-page traffic based on a window-level fixed-rate global shaping and boundary-induced local shaping mechanism. The method first establishes a webpage length distribution model using the number of data packets in real single-page traffic, and analyzes sensitive features near the start, end, and candidate boundary positions of the webpage using a website fingerprinting attack model. Then, it trains a dual-branch diffusion generation model to generate end-boundary-induced templates and start-burst-induced templates, while simultaneously training an upper-layer boundary position decision-maker and a lower-layer inducement scheme decision-maker. During online operation, a pluggable transport proxy between the client and server defends against the hybrid encrypted stream formed by multiple pages multiplexed via the Tor routing network. Global shaping is performed using a fixed time window and fixed uplink / downlink rates. Subsequently, candidate boundary positions are generated based on the length distribution model. The upper-layer decision-maker determines the target boundary position, and the lower-layer decision-maker selects a combination of the end-boundary-induced template and the early burst-induced template. Under limited communication overhead, it constructs external traffic characteristics similar to the start of another webpage after the end of one webpage access. After boundary construction, it continues to perform global shaping on subsequent traffic. (Refer to...) Figure 1 The method specifically includes the following steps:

[0071] Step S1: Obtain two or more real single-page traffic samples. First, count the number of packets in the single-page traffic to construct a sample set of real webpage lengths. Then, use the website fingerprint attack model to perform sensitivity analysis on the start segment, end segment, and traffic segments near the candidate boundary position of the single-page traffic to obtain the sensitivity weight of the start feature, the sensitivity weight of the end feature, and the sensitivity weight of the boundary position.

[0072] In this embodiment, step S1 specifically includes:

[0073] Step S1-1: Obtain real single-page traffic samples, count the number of packets contained in each traffic stream, and obtain the length sample set D of single-page traffic.

[0074] Step S1-2: Calculate multiple quantiles (Q25, Q50, Q75, Q90, Q95) of the traffic length sample set, divide the single-page traffic length into different length ranges based on multiple quantiles, and generate a real webpage length distribution model M.

[0075] Steps S1-3 involve inputting single-page traffic into three website fingerprinting attack models: DF, TikTok, and ARES. The traffic start segment, traffic end segment, and local windows near different candidate boundary positions are occluded. The decrease in the confidence of the correct class prediction before and after occlusion is calculated. For the r-th attack model and the local window w, let the confidence of the attack model's prediction of the true class of the i-th sample before occlusion be denoted as . After partially occluding the window w, the attack model's prediction confidence for the same real class is... Then the sensitivity score of the r-th attack model corresponding to the local window w. Represented as:

[0076] ,

[0077] For multiple attack models, the average value is used to obtain the comprehensive sensitivity score of the local window w:

[0078] ,

[0079] Where R represents the number of attack models, After normalization, we obtain the start feature sensitive weight, end feature sensitive weight, and boundary position sensitive weight.

[0080] Step S2: Set up pluggable transport proxies on the Tor client and server sides of the Tor network respectively. Divide the encrypted traffic of the Tor network into fixed-length pluggable transport layer data units, generate uplink real data queues and downlink real data queues. The client pluggable transport proxy and the server pluggable transport proxy send real data units and padding units in a coordinated manner according to a fixed time window and a preset fixed uplink and downlink sending rate. Sample the length threshold from the length distribution model, and perform global shaping on the encrypted traffic of the Tor network. At the same time, accumulate the number of packets sent.

[0081] Reference Figure 2 In this embodiment, step S2 specifically includes:

[0082] Step S2-1: The client-side pluggable transport proxy divides the uplink encrypted byte stream output by the Tor client into uplink real payload packets according to the outer encapsulation rules aligned with Tor units, and places them into the uplink real payload queue. The pluggable transport proxy on the server side divides the downlink encrypted byte stream output by the Tor server of the Tor routing network into downlink real payload packets according to the outer encapsulation rules aligned with the Tor unit of the Tor routing network, and puts them into the downlink real payload queue. The uplink real payload queue and the downlink real payload queue are represented as follows:

[0083] ,

[0084] in, This represents the i-th uplink actual payload packet to be sent. This represents the j-th downlink real payload packet to be sent.

[0085] Step S2-2: At the start of the session and after the target boundary inducement is completed, sample the new target traffic length L from the webpage length distribution set M generated in the offline phase, and initialize the cumulative number of packets sent in the current traffic segment. Continuously updated during the overall plastic surgery process ,when and When the difference between the two values ​​falls within a preset length range, the current position is determined as the candidate boundary induction position. :

[0086] , ,

[0087] in, This indicates the preset length tolerance threshold. This is the length tolerance ratio, with a default value of 0.5.

[0088] Step S2-3, set the fixed time window length as... The preset uplink transmission rate is The preset downlink transmission rate is The number of uplink transmission packets to be sent within the h-th time window and downlink transmission packet count They are respectively:

[0089] ,

[0090] in This is a function used for rounding numerical values; the total number of transmission slots within this time window:

[0091] ,

[0092] according to and Generate K candidate direction sequences The k-th candidate direction sequence is represented as:

[0093] ,

[0094] in, Indicates the k-th candidate direction sequence. The transmission direction corresponding to each sending slot 1 represents an uplink transmission slot, -1 represents a downlink transmission slot, and each candidate direction sequence satisfies:

[0095] ,

[0096] Where I() represents the indicator function, and the number of uplink slots and downlink slots in each candidate direction sequence are the same, but the slot arrangement order is different.

[0097] Step S2-4, for each candidate direction sequence Perform a local simulation to calculate the number of padding packets required for its execution. Actual payload packet waiting time Changes in uplink and downlink queue backlogs and directional characteristic deviation ,right , , and Normalization was performed separately:

[0098] ,

[0099] in, It is a function used for index normalization. express , , or Any one of the indicators, and These represent the minimum and maximum values ​​of the same index in the K candidate direction sequences, respectively. Take 10 -8 To prevent constants with zero denominators, the execution cost of candidate direction sequences... Represented as:

[0100] ,

[0101] in, and The default weight parameters are preset. , Select the candidate direction sequence with the lowest execution cost as the target direction sequence:

[0102] ,

[0103] According to the target direction sequence The transmission packets are sent sequentially in the direction of the slots.

[0104] Step S3: Based on the length distribution model and the mixed traffic samples in global shaping, candidate boundary inducement positions are generated. Upper-layer state features are constructed by combining boundary position sensitive weights, cumulative packet count, local packet interval, direction change, uplink / downlink queue backlog, and remaining overhead. The upper-layer decision-maker is trained using skip, early trigger, acknowledgment trigger, and delayed trigger as action sets. When the number of transmitted data units approaches the length threshold, the current position is determined as a candidate boundary inducement position. The state features of the candidate boundary inducement position are extracted and input into the trained upper-layer decision-maker to determine the target boundary inducement position.

[0105] Reference Figure 3 In this embodiment, step S3 specifically includes:

[0106] Step S3-1, for the first Candidate boundary induced positions The length features, local flow pattern features, queue state features, and boundary interval features are extracted around this location to form the state feature vector of the upper-level decision-maker. :

[0107] ,

[0108] in, This represents the normalized deviation in packet count between the current traffic segment and the target pseudo-webpage segment, calculated as follows:

[0109] ,

[0110] In the formula, This indicates the cumulative number of packets sent in the current traffic segment. This represents the target traffic length sampled from the webpage length distribution model. Local traffic morphology features include the local average time interval near the candidate boundary inducement position. , rate of change of direction Sudden Density and boundary position sensitive weights Queue status characteristics include uplink queue backlog. Downlink queue backlog and remaining expense amount Boundary spacing features This indicates the interval between the current candidate boundary inducement position and the previous target boundary inducement position.

[0111] Step S3-2, Feature Vector Input State Coding Network This yields the state vector that induces the position of the candidate boundary:

[0112] ,

[0113] in, The parameter is A state-encoding network. The state vector... Input Action Scoring Network The scores for each action in action set A are obtained:

[0114] ,

[0115] in, Indicates skipping an action. This indicates that the action is triggered in advance. This indicates confirmation of the triggered action. This indicates that the triggering action is delayed. Indicates the induced position at the candidate boundary. Select action Action scoring, The parameter is Action scoring network.

[0116] Step S3-3: The motion constraint module generates a motion mask according to preset rules. Used to block non-executable actions: ,in, Indicates action Executable =0 indicates an action The action constraint module is blocked: when , , , Both premature triggering and confirmed triggering actions will be blocked if either of these conditions is met. The confirmation action is blocked at the time, among which, Indicates the minimum interval between adjacent boundary induced positions, defaulting to =900, and These represent the upper limit of the up queue backlog and the upper limit of the down queue backlog, respectively. Indicates the minimum remaining cost amount, default. , This indicates the upper limit of the flow length deviation allowed for confirming the target boundary induced location; setting... .

[0117] Steps S3-4: Select the final action based on the action score and action mask.

[0118] ,

[0119] when To induce an action in advance or to confirm the triggering of an action, the current candidate boundary position is induced. Alternatively, the corrected position can be determined as the target boundary induced position. ;when To postpone the triggering action, continue performing global reshaping and wait for subsequent candidate boundary induction positions. When skipping an action, abandon the current candidate boundary induced position and continue global shaping, waiting for a candidate boundary position that meets the conditions.

[0120] Step S4: Use the start feature sensitive weight and end feature sensitive weight as weighting factors for the training loss of the two-branch diffusion model. The two-branch diffusion model generates an end boundary induction template for simulating the end feature of web page access and an early burst induction template for simulating the start feature of web page access. Establish a boundary induction template library based on the model generation results.

[0121] Reference Figure 4 In this embodiment, step S4 specifically includes:

[0122] Step S4-1: Extract the start segment and end segment of webpage access from the traffic sample, and represent each segment as a time sequence composed of the time interval between adjacent transmission units and the transmission direction:

[0123] ,

[0124] ,

[0125] in This represents the characteristics of the k-th transmission unit, where N represents the segment length. This represents the time interval between the k-th transmission unit and the previous transmission unit. This indicates the transmission direction of the k-th transmission unit.

[0126] Step S4-2: Gradually add random perturbations to the time series X to obtain a noisy time series:

[0127] ,

[0128] Where τ represents the diffusion time step, The noise dispatch coefficient varies with the diffusion time step. This represents a random perturbation that follows a standard normal distribution, and it relates to noisy time series sequences. The corresponding contextual features c are input into the bi-branch diffusion generation model. The diffusion generation model is trained to recover the original time series. The start feature sensitive weights and end feature sensitive weights are introduced into the local reconstruction loss to obtain the weighted diffusion training loss:

[0129] ,

[0130] Where N represents the segment length, These are the parameters of the diffusion generation model. This represents the attack sensitivity weight corresponding to the k-th position. This represents the random perturbation at position k. This represents the random perturbation at the k-th position predicted by the diffusion generation model.

[0131] Step S4-3: The dual-branch diffusion generation model includes a shared context encoder, an end boundary generation branch, and an early burst generation branch. The shared context encoder is used to encode the flow length, direction change, and time interval near the candidate boundary position. The end boundary generation branch is used to generate low-density flow, increased time interval, and short pause features before the end of the webpage. The early burst generation branch is used to generate high-density flow and direction change features at the beginning of the webpage.

[0132] Step S4-4: Introduce boundary consistency constraints to the final boundary generation branch and the early burst generation branch. The boundary consistency constraint loss is expressed as:

[0133] ,

[0134] in, This represents the local statistical characteristics of the end boundary template. This represents the local statistical characteristics of the early burst template, with the ending boundary template being... Early outbreak template is This ensures continuity between generated results at the same candidate boundary position, and constrains and corrects the generated results based on the number of fill cells and the expected delay. The expected number of fill cells in the generated template is... The expected delay is The preset fill limit is The preset delay limit is The generated result must satisfy the following conditions: ≤ and ≤ When the generated result does not meet the constraints, the generated fragment is truncated, the time interval is scaled, or it is resampled to meet the limits of the number of filling units and the expected delay. The generated result that meets the constraints is then saved to the boundary induced template library.

[0135] Step S5: Combine the end boundary inducement template and the early burst inducement template into a candidate boundary inducement set. Construct lower-level state features by combining template parameters, local states at candidate positions, and remaining overhead. Train the lower-level decision-maker using the selection of candidate combinations as the action set. Select the boundary inducement combination under the constraints of padding overhead, delay overhead, and queue waiting time. Input the candidate boundary inducement combination into the lower-level decision-maker and select the target boundary inducement combination that satisfies the constraints and has the highest score. Adjust the transmission timing of pluggable transport layer data units before the target boundary inducement position to form the traffic features at the end of web page access. Send padding units after the target boundary inducement position to form the early burst features at the beginning of web page access. After completing the target boundary inducement shaping, continue to process the subsequent traffic using global shaping.

[0136] Reference Figure 5 In this embodiment, step S5 specifically includes:

[0137] Step S5-1: Select multiple termination boundary induction templates and early burst induction templates from the boundary induction template library. The termination boundary induction template set is as follows: Early outbreak induction template set Where I represents the number of termination boundary induced templates, This indicates the number of early burst induced templates, and each termination boundary induced template... Each early outbreak-inducing template Combining these elements yields the candidate boundary induced set.

[0138]

[0139] in, Indicates by the first A termination boundary inducement template and the An early-stage induction template The candidate boundary induced combination is formed;

[0140] Step S5-2: Extract candidate boundary induction schemes Template parameters, target boundary induced position Based on the local flow state and remaining cost, construct the candidate combination feature vector and input it into the candidate combination encoding network. The candidate combination vector is obtained. ,in, The parameter is The candidate combination encoding network performs offline simulation of each candidate boundary-induced combination on the local traffic of the current global shaped traffic. The simulation execution results are obtained. ,in, This indicates the similarity between the local traffic after execution and the actual end boundary shape of the webpage. This indicates the similarity between the localized traffic after execution and the early burst patterns of the actual webpage. This indicates the boundary consistency between the end boundary-induced template and the start burst-induced template. This indicates that the attack misled the recipients of the benefits. Indicates the expected number of fill cells. This indicates an expected delay. This indicates the estimated queue waiting time.

[0141] Step S5-3, select candidate combination vectors and simulation execution results Input combined scoring network Calculate candidate boundary induced combinations Overall rating The overall score is expressed as a weighted scoring function: , in, to The default weight parameters are preset. , , , , , , ; The constraint filtering module selects candidate boundary-induced combinations that meet the conditions. The executable mask is ,when and and , ,otherwise ,in, Indicates the maximum number of fill cells. Indicates the expected upper limit of delay. Indicates the maximum waiting time for the queue, delete. The candidate boundary-induced combinations are selected, and the combination with the highest comprehensive score among the remaining candidate boundary-induced combinations is selected as the target boundary-induced combination. .

[0142] Step S5-4, at the target boundary induction position Previously, according to the target end boundary induced template The transmission time of local transmission packets is progressively delayed, and a short pause is set when the constraints are met to form externally visible traffic characteristics as webpage access nears its end, thus inducing a position at the target boundary. Subsequently, according to the target's early sudden induction template The transmission direction sequence and time interval sequence are used to send padding packets to form burst features at the beginning of the webpage. After boundary induction is completed, the new target traffic length is resampled from the webpage length distribution model for the next candidate boundary induction location triggering, and global shaping continues.

[0143] Reference Figure 5 In this embodiment, the constraint filtering module is implemented by rule constraints and an action masking mechanism. The rule constraints are used to determine whether the candidate boundary induction scheme meets the preset conditions. The action masking mechanism converts the judgment result of the rule constraints into an executable flag: when the flag value is 1, it means that the selection is allowed, and when the value is 0, the selection is blocked.

[0144] Reference Figure 6 In this embodiment, compared with existing defense methods, this invention does not simply randomly insert padding packets or fix local traffic disturbances. Instead, based on globally fixed window shaping, it constructs induced boundaries by combining the actual webpage length distribution and attack-sensitive segments. This makes the traffic observed by the attacker more closely resemble a combination of multiple single-page access traffic, thereby weakening the stable correspondence between the original page length, burst position, and tail ending shape. A two-layer decision-making mechanism combining upper-layer boundary position decision and lower-layer template selection is adopted. Under the premise of satisfying queue backlog, minimum boundary interval, and communication overhead constraints, the induced position and induced segment are selected to avoid the patterned features caused by fixed position disturbances. As shown in Table 1, the defense traffic generated by this invention maintains a low recognition accuracy under different attack models such as DF, TikTok, and ARES. Compared with typical methods such as Front, WTF-PAD, and Walkie-Talkie, the defense effect of this invention is significantly improved. The defense effect of this invention is similar to Tamaraw and Adaptive Tamaraw, but the bandwidth and time overhead are lower, especially the bandwidth overhead is significantly reduced, as shown in Table 2.

[0145] Table 1 Comparison of defensive effects

[0146]

[0147] Table 2 Cost Comparison

[0148]

[0149] Based on the same technical concept as the method embodiments, the present invention also provides a boundary-induced construction and two-layer constraint decision defense system for multi-page concurrent traffic in the Tor routing network, including:

[0150] The basic windowing shaping module generates multiple candidate direction sequences within each fixed time window based on the preset uplink and downlink transmission rates. It performs normalized weighted scoring on the number of padding packets, actual payload packet waiting time, uplink and downlink queue backlog changes, and direction feature deviations of each candidate direction sequence, and executes the candidate direction sequence with the lowest score.

[0151] The length distribution and attack sensitivity analysis module is used to acquire two or more real single-page traffic samples, count the number of transmission packets corresponding to the traffic samples, construct a webpage length distribution model, and convert the traffic samples into the input representation of the website fingerprint attack model. Using the pre-trained DF, TikTok and ARES website fingerprint attack models, the module performs occlusion sensitivity analysis on the beginning segment of the webpage, the end segment of the webpage and the window near the candidate boundary position, and obtains the sensitivity weight of early feature, sensitivity weight of end feature and sensitivity weight of boundary position.

[0152] The boundary-induced template generation module extracts the start and end segments of web pages from the traffic sample set and constructs a two-branch diffusion generation model with boundary consistency constraints. This model includes a shared context encoder, an end boundary generation branch, and an early burst generation branch. The shared context encoder encodes the traffic length, direction changes, time intervals, attack sensitivity weights, and remaining overhead near the candidate boundary position. The end boundary generation branch generates the end boundary induced template before the target boundary induced position, and the early burst generation branch generates the start burst induced template after the target boundary induced position. The boundary-induced template generation module uses the early feature sensitivity weights and the end feature sensitivity weights as weighting factors for the local reconstruction loss of the diffusion model and corrects the generation results through boundary consistency constraints and overhead constraints to establish a boundary-induced template library.

[0153] The two-layer constraint decision-making module includes an upper-layer decision-maker and a lower-layer decision-maker. The upper-layer decision-maker includes a state encoding network, an action scoring network, and an action constraint filtering module. The state encoding network encodes the current traffic information of the candidate boundary inducement position and the interval from the previous target boundary inducement position into a state vector. The action scoring network outputs scores for four types of actions: skip, early trigger, confirmed trigger, and delayed trigger. The action constraint filtering module blocks unexecutable actions based on the minimum boundary interval, queue backlog limit, remaining overhead amount, and length deviation range, and determines the target boundary inducement position from the unblocked actions. The lower-layer decision-maker combines the end boundary inducement template and the early burst inducement template into two or more candidate boundary inducement schemes, and selects the target boundary inducement combination based on the end boundary similarity, start burst similarity, boundary consistency, attack misleading benefit, filling overhead, delay overhead, and queue waiting time.

[0154] The boundary location determination module samples the target traffic length from the webpage length distribution model at the start of the session or after the target boundary guidance scheme is completed. During the basic windowing shaping process, it accumulates the number of transmission packets sent by the current traffic. When the accumulated number of sent packets is close to the target traffic length, it marks the current location as a candidate boundary guidance location and calls the upper-layer decision-maker to determine whether to use the candidate boundary guidance location as the target boundary guidance location.

[0155] The boundary guidance execution module, based on the target boundary guidance scheme selected by the lower-level decision-maker, progressively delays the sending time of local transmission packets and sets short pauses according to the end boundary guidance template before the target boundary guidance position to construct webpage access end features. After the target boundary guidance position, it sends filling packets in the corresponding direction according to the direction sequence and time interval sequence in the early burst guidance template to construct early webpage features. After the boundary guidance execution is completed, it restores the basic windowed reshaping.

[0156] It should be understood that the encrypted traffic adaptive update classification system for open network environments in the embodiments of the present invention can implement all the technical solutions in the above method embodiments. The functions of each functional module can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above embodiments, which will not be repeated here.

[0157] The present invention also provides an electronic device comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein the programs, when executed by the processors, implement the steps of the method.

[0158] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described herein.

[0159] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, computer devices, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0160] This invention is described with reference to a flowchart of a method according to embodiments of the invention. It should be understood that each step in the flowchart and combinations thereof can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A device for a function specified in one or more processes.

[0161] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 The function specified in one or more processes.

[0162] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 Steps of a specified function in one or more processes.

[0163] This invention provides a website fingerprinting defense method and system for concurrent multi-page access in the Tor routing network. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A website fingerprinting defense method for concurrent multi-page access in the Tor routing network, characterized in that, Includes the following steps: Step S1: Obtain real single-page traffic samples, construct a real webpage length distribution model, perform sensitivity analysis, and obtain the sensitivity weights of the start feature, end feature, and boundary position. Step S2: By using multi-hop relay forwarding and layered encryption to hide the direct communication relationship between the user and the target website, pluggable transport proxies are set up on the Tor client and server sides of the Tor network respectively. The encrypted traffic of the Tor network is divided into fixed-length pluggable transport layer data units, generating uplink real data queues and downlink real data queues. The client pluggable transport proxy and the server pluggable transport proxy send real data units and padding units in coordination according to a fixed time window and a preset fixed uplink and downlink sending rate. The length threshold is sampled from the length distribution model, and the encrypted traffic of the Tor network is globally shaped. At the same time, the number of packets sent is accumulated. Step S3: Generate candidate boundary inducement positions, construct upper-level state features, and train the upper-level decision-maker with skip, early trigger, confirmation trigger, and delayed trigger as action sets; when the number of data units sent is close to the length threshold, determine the current position as the candidate boundary inducement position, extract the state features of the candidate boundary inducement position and input them into the trained upper-level decision-maker to determine the target boundary inducement position; Step S4: Use the start feature sensitive weight and end feature sensitive weight as weighting factors for the training loss of the two-branch diffusion model. The two-branch diffusion model generates an end boundary induction template for simulating the end feature of web page access and an early burst induction template for simulating the start feature of web page access. A boundary induction template library is established based on the model generation results. Step S5: Combine the end boundary inducement template and the early burst inducement template into a candidate boundary inducement set, construct the lower-level state features, train the lower-level decision-maker with the selection of the candidate combination as the action set, input the candidate boundary inducement combination into the lower-level decision-maker, and after completing the target boundary inducement shaping, continue to process the subsequent traffic with global shaping.

2. The method according to claim 1, characterized in that, Step S1 specifically includes: Step S1-1: Obtain real single-page traffic samples, count the number of packets contained in each traffic, and obtain the length sample set D of single-page traffic; Step S1-2: Calculate two or more quantiles in the length sample set D, divide the single-page traffic length into different length ranges based on the two or more quantiles, and generate a real webpage length distribution model M. Steps S1-3 involve inputting single-page traffic into three website fingerprinting attack models: DF, TikTok, and ARES. The traffic start segment, traffic end segment, and local windows near different candidate boundary positions are occluded. The decrease in the confidence of the correct class prediction before and after occlusion is calculated. For the r-th attack model and the local window w, let the confidence of the attack model's prediction of the true class of the i-th sample before occlusion be denoted as . After partially occluding the window w, the attack model's prediction confidence for the same real class is... Then the sensitivity score of the r-th attack model corresponding to the local window w. Represented as: For two or more attack models, the average value is used to obtain the comprehensive sensitivity score of the local window w. Where R represents the number of attack models, After normalization, we obtain the start feature sensitive weight, end feature sensitive weight, and boundary position sensitive weight.

3. The method according to claim 2, characterized in that, Step S2 specifically includes: Step S2-1: The client-side pluggable transport agent divides the uplink encrypted byte stream output by the Tor client into uplink real payload packets according to the outer encapsulation rules aligned with Tor units, and places them into the uplink real payload queue. The pluggable transport proxy on the server side divides the downlink encrypted byte stream output by the Tor server of the Tor routing network into downlink real payload packets according to the outer encapsulation rules aligned with the Tor unit of the Tor routing network, and puts them into the downlink real payload queue. The uplink real payload queue and the downlink real payload queue are represented as follows: ,in, This represents the i-th uplink actual payload packet to be sent. This represents the j-th downlink actual payload packet to be sent; Step S2-2: At the start of the session and after the target boundary induction is completed, sample the new target traffic length L from the real webpage length distribution model M generated in the offline phase, and initialize the cumulative number of packets sent in the current traffic segment. Continuously updated during the overall plastic surgery process ,when and When the difference between the two values ​​falls within a preset length range, the current position is determined as the candidate boundary induction position. : ,in, This indicates the preset length tolerance threshold; This represents the target traffic length sampled from the webpage length distribution model; Step S2-3, set the fixed time window length as Δ, and the preset uplink transmission rate as... The preset downlink transmission rate is The number of uplink transmission packets to be sent within the h-th time window and downlink transmission packet count They are respectively: ,in It is a function used for rounding numerical values; Total number of sending slots within this time window ,according to and Generate K candidate direction sequences Where k takes values ​​from 1 to K, and the k-th candidate direction sequence Represented as: ,in, Indicates the k-th candidate direction sequence. The transmission direction corresponding to each sending slot 1 represents an uplink transmission slot, -1 represents a downlink transmission slot, and each candidate direction sequence satisfies Where I() represents an indicator function; Step S2-4, for each candidate direction sequence Perform local simulations to calculate candidate direction sequences. Number of populated packets required for execution Actual payload packet waiting time Changes in uplink and downlink queue backlogs and directional characteristic deviation ,right , , and Normalization was performed separately: ， in, It is a function used for index normalization. express , , or Any one of the indicators, and These represent the minimum and maximum values ​​of the same index in the K candidate direction sequences, respectively. To prevent constants with zero denominators, the execution cost of candidate direction sequences... Represented as: ， in, and To preset the weight parameters, the candidate direction sequence with the lowest execution cost is selected as the target direction sequence. ,in, It is the set of candidate direction sequences generated within the h-th time window, according to the target direction sequence. The transmission packets are sent sequentially in the direction of the slots.

4. The method according to claim 3, characterized in that, Step S3 specifically includes: Step S3-1, for the q-th candidate boundary induced position Around this location Extract length features, local flow pattern features, queue state features, and boundary interval features to construct the state feature vector of the upper-level decision-maker. : ,in, This represents the normalized deviation in packet count between the current traffic segment and the target pseudo-webpage segment, calculated as follows: ; Local flow pattern characteristics include the local average time interval near the candidate boundary induction location. , rate of change of direction Sudden Density and boundary position sensitive weights Queue status characteristics include uplink queue backlog. Downlink queue backlog and remaining expense amount Boundary spacing features This indicates the interval between the current candidate boundary inducement position and the previous target boundary inducement position; Step S3-2, Feature Vector Inputting the state encoding network yields a state vector that induces the position of the state candidate boundary. : ,in, The parameter is State coding network; The state vector Input Action Scoring Network The scores for each action in action set A are obtained: ,in, Indicates skipping an action. This indicates that the action is triggered in advance. This indicates confirmation of the triggered action. This indicates that the triggering action is delayed. Indicates the induced position at the candidate boundary Select action Action scoring, The parameter is Action scoring network; Step S3-3: The motion constraint module generates a motion mask according to preset rules. Used to block non-executable actions: ,in, Indicates action Executable =0 indicates an action Blocked; When any of the following conditions are met: , , , The action constraint module will block prematurely triggered actions and confirmed trigger actions. The confirmation action is blocked at the time, among which, This represents the minimum interval between the induced positions of adjacent boundaries. and These represent the upper limit of the up queue backlog and the upper limit of the down queue backlog, respectively. Indicates the minimum remaining expense amount. This indicates the upper limit of the flow length deviation allowed for confirming the target boundary induced location; Steps S3-4: Select the final action based on the action score and motion mask. ,when To induce an action in advance or to confirm the triggering of an action, the current candidate boundary position is induced. Alternatively, the corrected position can be determined as the target boundary induced position. ;when To postpone the triggering action, continue performing global reshaping and wait for subsequent candidate boundary induction positions. When skipping an action, abandon the current candidate boundary induced position and continue global shaping, waiting for a candidate boundary position that meets the conditions.

5. The method according to claim 4, characterized in that, Step S4 specifically includes: Step S4-1: Extract the start segment and end segment of webpage access from the traffic sample, and represent each segment as a time sequence X composed of the time interval between adjacent transmission units and the transmission direction: , , This represents the characteristics of the k-th transmission unit, where N represents the segment length. This represents the time interval between the k-th transmission unit and the previous transmission unit. Indicates the transmission direction of the k-th transmission unit; Step S4-2: Gradually add random perturbations to the time series X to obtain a noisy time series. : ， in, Indicates the first The noise scheduling coefficient corresponding to each diffusion time step This represents a random perturbation that follows a standard normal distribution, and it relates to noisy time series sequences. The corresponding contextual features c are input into the bi-branch diffusion generation model. The diffusion generation model is trained to recover the original time series. The start feature sensitive weights and end feature sensitive weights are introduced into the local reconstruction loss to obtain the weighted diffusion training loss. : ， in, These are the parameters of the diffusion generation model. This represents the attack sensitivity weight corresponding to the k-th position. This represents the random perturbation at position k. This represents the random perturbation at the k-th position predicted by the diffusion generation model; Step S4-3: The dual-branch diffusion generation model includes a shared context encoder, an end boundary generation branch, and an early burst generation branch. The shared context encoder is used to encode the flow length, direction change, and time interval near the candidate boundary position. The end boundary generation branch is used to generate low-density flow, increased time interval, and short pause features before the end of the webpage. The early burst generation branch is used to generate high-density flow and direction change features at the beginning of the webpage. Step S4-4: Introduce boundary consistency constraints to the final boundary generation branch and the early burst generation branch. The boundary consistency constraint loss... Loss is represented as: ,in, This represents the local statistical characteristics of the end boundary template. This represents the local statistical characteristics of the early burst template, with the ending boundary template being... Early outbreak template is This ensures continuity between generated results at the same candidate boundary position, and constrains and corrects the generated results based on the number of fill cells and the expected delay. The expected number of fill cells in the generated template is... The expected delay is The preset fill limit is The preset delay limit is The generated result must satisfy: ≤ and ≤ When the generated result does not meet the constraints, the generated fragment is truncated, the time interval is scaled, or it is resampled to make the generated result meet the limits of the number of filling units and the expected delay. The generated result that meets the constraints is saved to the boundary induced template library.

6. The method according to claim 5, characterized in that, Step S5 specifically includes: Step S5-1: Select two or more termination boundary-inducing templates and early burst-inducing templates from the boundary-inducing template library to form the termination boundary-inducing template set. Early outbreak induction template set Where I represents the number of termination boundary induced templates, This indicates the number of early burst induced templates, and each termination boundary induced template... Each early outbreak-inducing template Combining these elements yields the candidate boundary induced set. in, Indicates by the first A termination boundary inducement template and the An early-stage induction template The candidate boundary induced combination is formed; Step S5-2: Extract candidate boundary-induced combinations Template parameters, target boundary induced position Based on the local flow state and remaining cost, construct the candidate combination feature vector and input it into the candidate combination encoding network. The candidate combination vector is obtained. ,in, The parameter is The candidate combination encoding network performs offline simulation of each candidate boundary-induced combination on the local traffic of the current global shaped traffic. The simulation execution results are obtained. ,in, This indicates the similarity between the local traffic after execution and the actual end boundary shape of the webpage. This indicates the similarity between the localized traffic after execution and the early burst patterns of the actual webpage. This indicates the boundary consistency between the end boundary-induced template and the start burst-induced template. This indicates that the attack misled the recipients of the benefits. Indicates the estimated queue waiting time; Step S5-3, select candidate combination vectors and simulation execution results Input combined scoring network Calculate candidate boundary induced combinations Overall rating The overall score is expressed as a weighted scoring function: ,in, , , , , , , To preset the weight parameters, the constraint filtering module is used to perform executability filtering on each candidate boundary induced combination; Step S5-4, at the target boundary induction position Previously, according to the target end boundary induced template The transmission time of local transmission packets is progressively delayed, and a short pause is set when the constraints are met to form externally visible traffic characteristics as webpage access nears its end, thus inducing a position at the target boundary. Subsequently, according to the target's early sudden induction template The transmission direction sequence and time interval sequence are sent to fill packets to form burst features at the beginning of the webpage. After the boundary induction is completed, the new target traffic length is resampled from the webpage length distribution model for the next candidate boundary induction position triggering, and global shaping continues.

7. The method according to claim 6, characterized in that, In step S5-3, the constraint filtering module is implemented by rule constraints and action masking mechanism. The rule constraints are used to determine whether the candidate boundary induction scheme meets the preset conditions. The action masking mechanism converts the judgment result of the rule constraints into an executable flag: when the flag value is 1, it means that selection is allowed, and when the value is 0, selection is blocked. The constraint filtering module selects candidate boundary-induced combinations that meet the conditions. The executable mask is ,when and and , ,otherwise ,in, Indicates the maximum number of fill cells. Indicates the expected upper limit of delay. Indicates the maximum waiting time for the queue, delete. The candidate boundary-induced combinations are selected, and the combination with the highest comprehensive score among the remaining candidate boundary-induced combinations is selected as the target boundary-induced combination. .

8. A website fingerprinting defense system for concurrent multi-page access to the Tor routing network, used to implement the method as described in any one of claims 1 to 7, characterized in that, include: The basic windowing shaping module generates multiple candidate direction sequences within each fixed time window based on the preset uplink and downlink transmission rates. It performs normalized weighted scoring on the number of padding packets, actual payload packet waiting time, uplink and downlink queue backlog changes, and direction feature deviations of each candidate direction sequence, and executes the candidate direction sequence with the lowest score. The length distribution and attack sensitivity analysis module is used to acquire two or more real single-page traffic samples, count the number of transmission packets corresponding to the traffic samples, construct a webpage length distribution model, and convert the traffic samples into the input representation of the website fingerprint attack model. Using the pre-trained DF, TikTok and ARES website fingerprint attack models, the module performs occlusion sensitivity analysis on the beginning segment of the webpage, the end segment of the webpage and the window near the candidate boundary position, and obtains the sensitivity weight of early feature, sensitivity weight of end feature and sensitivity weight of boundary position. The boundary-induced template generation module extracts the start and end segments of web pages from the traffic sample set and constructs a two-branch diffusion generation model with boundary consistency constraints. This model includes a shared context encoder, an end boundary generation branch, and an early burst generation branch. The shared context encoder encodes the traffic length, direction changes, time intervals, attack sensitivity weights, and remaining overhead near the candidate boundary position. The end boundary generation branch generates the end boundary induced template before the target boundary induced position, and the early burst generation branch generates the start burst induced template after the target boundary induced position. The boundary-induced template generation module uses the early feature sensitivity weights and the end feature sensitivity weights as weighting factors for the local reconstruction loss of the diffusion model and corrects the generation results through boundary consistency constraints and overhead constraints to establish a boundary-induced template library. The two-layer constraint decision-making module includes an upper-layer decision-maker and a lower-layer decision-maker. The upper-layer decision-maker includes a state encoding network, an action scoring network, and an action constraint filtering module. The state encoding network encodes the current traffic information of the candidate boundary inducement position and the interval from the previous target boundary inducement position into a state vector. The action scoring network outputs scores for four types of actions: skip, early trigger, confirmed trigger, and delayed trigger. The action constraint filtering module blocks unexecutable actions based on the minimum boundary interval, queue backlog limit, remaining overhead amount, and length deviation range, and determines the target boundary inducement position from the unblocked actions. The lower-layer decision-maker combines the end boundary inducement template and the early burst inducement template into two or more candidate boundary inducement schemes, and selects the target boundary inducement combination based on the end boundary similarity, start burst similarity, boundary consistency, attack misleading benefit, filling overhead, delay overhead, and queue waiting time. The boundary location determination module samples the target traffic length from the webpage length distribution model at the start of the session or after the target boundary guidance scheme is completed. During the basic windowing shaping process, it accumulates the number of transmission packets sent by the current traffic. When the accumulated number of sent packets is close to the target traffic length, it marks the current location as a candidate boundary guidance location and calls the upper-layer decision-maker to determine whether to use the candidate boundary guidance location as the target boundary guidance location. The boundary guidance execution module, based on the target boundary guidance scheme selected by the lower-level decision-maker, progressively delays the sending time of local transmission packets and sets short pauses according to the end boundary guidance template before the target boundary guidance position to construct webpage access end features. After the target boundary guidance position, it sends filling packets in the corresponding direction according to the direction sequence and time interval sequence in the early burst guidance template to construct early webpage features. After the boundary guidance execution is completed, it restores the basic windowed reshaping.

9. An electronic device, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.

Images