CN118861795A - Tor traffic detection classification method and system based on time series conversion - Google Patents

Abstract

The invention provides a method and a system for detecting and classifying Tor flow based on time sequence conversion, which are used for modeling network flow into a high-dimensional time sequence on a session level, converting the time sequence into a two-dimensional tensor according to a main period aiming at the characteristic of periodicity of the time sequence, and repeating the operation by taking lines in the two-dimensional tensor as the time sequence based on the characteristic of multiple periods of the time sequence, so that the line vector in the two-dimensional tensor is continuously converted into the two-dimensional tensor, and the expression capacity of time sequence data is improved.

Description

Tor traffic detection classification method and system based on time series conversion

Technical Field

The present invention belongs to the technical field of cyberspace security and encrypted traffic detection classification and application type identification, and specifically relates to a Tor traffic detection classification method and system based on time series conversion.

Background Art

The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

In the early days of the Internet, technical research on traffic classification has begun. General network traffic classification methods include port-based classification, deep packet inspection-based classification, and machine learning or deep learning-based classification. Network traffic classification refers to the classification of network traffic according to service type or application type, such as email, video, Facebook, Firefox, Google, etc. Network traffic classification is conducive to network management and maintaining the security of cyberspace. For example, by identifying the application type of traffic, it can be divided into different priorities to achieve quality service control and improve user experience. In the field of network security, the detection or classification of malicious traffic and abnormal traffic often needs to be achieved through network traffic classification technology.

As encrypted traffic becomes the main form of traffic on the Internet, the performance of many network traffic classification technologies has declined to varying degrees. However, with the use of network proxy tools, encrypted traffic is encrypted and forwarded again multiple times, which increases the difficulty of encrypted traffic classification tasks. Among them, Tor, a popular anonymous communication tool, is often used in the dark web, which brings huge security risks. New encrypted traffic classification technologies are needed to identify and classify Tor traffic.

In previous studies on encrypted traffic classification, extracting packet-level, flow-level, session-level and statistical features and inputting them into machine learning or deep learning models for classification has been proven to be effective. However, these feature-based methods require manual design of features, and different features may need to be designed for different types of traffic, which is generally time-consuming and labor-intensive. Recently, due to the superior performance of the end-to-end deep learning framework, the method of feeding raw traffic into deep learning models for representation learning has become increasingly popular. Through deep learning models, high-level abstract features of traffic are automatically extracted to classify traffic, which not only reduces the model's dependence on manually designed features, but also is applicable to various network traffic and has universal applicability. However, most existing methods directly convert network traffic data into one-dimensional data or image data for processing, which limits the model's ability to represent network traffic. Therefore, how to combine the characteristics of network traffic data to improve the performance of encrypted traffic detection classification and application type identification tasks has become an urgent problem to be solved.

Summary of the invention

In order to solve the above problems, the present invention proposes a Tor traffic detection and classification method and system based on time series conversion. The present invention models network traffic as a high-dimensional time series at the session level. In view of the periodicity of time series, the time series is converted into a two-dimensional tensor according to the main period. In addition, based on the multi-period characteristics of time series, the rows in the two-dimensional tensor are regarded as time series. This operation is repeated to further convert the row vectors in the two-dimensional tensor into a two-dimensional tensor, thereby improving the expression ability of time series data.

According to some embodiments, the present invention adopts the following technical solutions:

A Tor traffic detection and classification method based on time series conversion includes the following steps:

Obtain network traffic data in the network environment to be tested;

The network traffic data is modeled as a time series with high-dimensional features at the session level. Based on the periodicity of the time series and the frequency selection strategy, the time series is converted into a two-dimensional tensor.

Treat the rows in the two-dimensional tensor as sub-time series, convert the sub-time series into a two-dimensional tensor according to the frequency selection strategy, repeat this operation to convert the time series into a set of two-dimensional tensors, perform feature learning on each two-dimensional tensor, and aggregate the learned feature maps into a new one-dimensional sequence with high-dimensional features;

The one-dimensional sequence is classified to obtain an identification result of whether there is network traffic.

As an optional implementation, the process of modeling network traffic at the session level as a time series with high-dimensional features includes: considering the number of data packets in a session as the length of the time series, considering the data packet as a time point vector, and unifying the time series length and the feature dimension.

As an optional implementation, the specific process of converting a time series into a two-dimensional tensor includes converting the original time series into a two-dimensional tensor, treating the rows of the two-dimensional tensor as sub-time series through dimension compression operations and dimension conversion operations, and continuing to generate a new two-dimensional tensor.

As a further implementation, the process of converting the original time series into a two-dimensional tensor includes:

According to the frequency selection strategy, find the appropriate frequency value;

Find a period corresponding to the frequency value, wherein the period and the frequency value are in an inverse relationship;

Convert a one-dimensional time series into a two-dimensional tensor based on period and frequency values.

As a further implementation method, the specific process of the compression dimension operation and the conversion dimension operation includes: treating each row of the two-dimensional tensor as a time series, and performing the compression dimension operation, finding the main period and corresponding frequency of the time series after the compression dimension operation according to the frequency selection strategy and the relationship between the period and the frequency value, and reshaping the two-dimensional tensor;

Repeat the above process (k-1) times to generate (k-1) new two-dimensional tensors, a total of k two-dimensional tensors.

As an optional implementation, the frequency selection strategy is: when generating a new two-dimensional tensor, the time series is subjected to a fast Fourier transform operation, and the _kkth frequency peak with the largest amplitude is found;

When the generated two-dimensional tensor is the _kth , the minimum frequency among the _kth frequency peaks with the largest amplitude is selected;

When the generated two-dimensional tensor is the kth, the frequency with the largest amplitude is directly selected.

A Tor traffic detection and classification system based on time series transformation, including:

An acquisition module is configured to acquire network traffic data in the network environment to be tested;

The time series model module is configured to model the network traffic data as a time series with high-dimensional features at the session level, and convert the time series into a two-dimensional tensor according to a frequency selection strategy based on the periodicity of the time series;

Treat the rows in the two-dimensional tensor as sub-time series, convert the sub-time series into a two-dimensional tensor according to the frequency selection strategy, repeat this operation to convert the time series into a set of two-dimensional tensors, perform feature learning on each two-dimensional tensor, and aggregate the learned feature maps into a new one-dimensional sequence with high-dimensional features;

The classification module is configured to classify the one-dimensional sequence to obtain an identification result of whether there is network traffic.

As an optional implementation, the time series model module includes multiple sequence operation modules stacked and connected in a residual manner, each sequence operation module includes a first conversion module, a two-dimensional feature extractor and an aggregation module, and the first conversion module is used to convert a one-dimensional time series into k two-dimensional tensors;

The two-dimensional feature extractor is used to extract features from k two-dimensional tensors;

The aggregation module is used to aggregate k learned feature maps to generate a new one-dimensional sequence with high-dimensional features.

As an optional embodiment, the two-dimensional feature extractor includes a multi-scale two-dimensional kernel block and an axis attention mechanism block, wherein the multi-scale two-dimensional kernel block is used to extract spatial features, and the axis attention mechanism block is used to extract change features between and within cycles of a time series.

An electronic device comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the above method are completed.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention proposes a method for modeling network traffic data as a time series. At the session level, the data packet is regarded as a time point vector, and the number of data packets is regarded as the length of the time series, which reduces the feature embedding operations commonly used in the time series model. In addition, the present invention also proposes a time series model for encrypted traffic classification. According to the characteristics of time series periodicity and multi-period, the network traffic data is subjected to dimensionality increase operation and converted into a set of two-dimensional tensors, and multi-scale two-dimensional kernel blocks and axis attention mechanism blocks are used for feature extraction, which improves the data expression ability and the model's learning ability, and improves the accuracy of traffic classification problems.

In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

FIG1 is a schematic diagram of converting original traffic into a time series with high-dimensional features provided by Embodiment 1 of the present invention;

FIG2 is a schematic diagram of converting a one-dimensional time series into a two-dimensional tensor provided by Embodiment 1 of the present invention;

FIG3 is a schematic diagram of the structure of the Squeeze and reshape Block provided in Example 1 of the present invention;

FIG4 is a schematic diagram of the TitNet model structure provided in Example 1 of the present invention.

DETAILED DESCRIPTION

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and/or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and/or combinations thereof.

Embodiment 1

This embodiment provides a Tor traffic detection and classification method based on time series conversion, including:

Obtain network traffic data in the network environment to be tested;

The trained Tor traffic classification model is used to classify the network traffic data to obtain the identification result of whether there is network traffic;

The Tor traffic classification model is built based on a time series model. The training process includes: modeling network traffic as a time series with high-dimensional features at the session level, and then converting the time series into a two-dimensional tensor based on the periodic characteristics of the time series according to the frequency selection strategy. Based on the multi-period characteristics of the time series, the rows in the two-dimensional tensor are regarded as sub-time series. According to the frequency selection strategy, the sub-time series is also converted into a two-dimensional tensor. Repeating this operation can convert the time series into a set of k two-dimensional tensors, and then using a two-dimensional feature extractor for feature learning to aggregate into a new one-dimensional sequence with high-dimensional features. This operation is a TitBlock operation. TitBlock modules are stacked L times to form a TitNet. Finally, a fully connected layer is used for classification, and the TitNet model is trained based on the label.

In this embodiment, the original network traffic data is collected in advance and saved in the form of pcap packets, and then the network traffic is segmented according to the session, and the traffic is anonymized, the IP address and port are set to zero, and then the session is converted into a high-dimensional time series, and the time series length is unified to 20 and the feature dimension is 120, as shown in Figure 1;

In this embodiment, after the network traffic is converted into a time series with high-dimensional features, the time series is converted into a two-dimensional tensor according to the periodicity of the time series and the frequency selection strategy, as shown in FIG2 ;

In this embodiment, through the Squeeze and reshape Block module, as shown in Figure 3, the rows in the two-dimensional tensor are regarded as sub-time series, and after the squeeze operation, a new two-dimensional tensor is generated according to the frequency selection strategy. After (k-1) times of Squeeze and reshape Block operation, (k-1) new two-dimensional tensors are generated, totaling k two-dimensional tensors.

In this embodiment, the TitNet is composed of L TitBlocks connected by residuals, as shown in Figure 4. The TitBlock includes converting a time series into k two-dimensional tensors, extracting features from the k two-dimensional tensors, obtaining k feature maps, and converting them into a new time series with high-dimensional features after aggregation. The two-dimensional feature extractor includes a classic multi-scale two-dimensional kernel-Inception block and an axial attention mechanism AxialAttention block. The Inception block is used to extract the local spatial features of the two-dimensional tensor. The axial attention mechanism performs attention calculations in both the horizontal and vertical directions, thereby completely extracting the periodic and intra-periodic change features of the time series. In addition, since the k two-dimensional tensors represent the time series according to large and small cycles respectively, the characteristics of the large and small cycles of the time series are also fused by the model during aggregation, and finally classified by the fully connected layer.

Embodiment 2

A Tor traffic detection and classification method based on time series conversion includes the following steps:

Obtain network traffic data in the network environment to be tested;

The network traffic data is modeled as a time series with high-dimensional features at the session level. Based on the periodicity of the time series and the frequency selection strategy, the time series is converted into a two-dimensional tensor.

Treat the rows in the two-dimensional tensor as sub-time series, convert the sub-time series into a two-dimensional tensor according to the frequency selection strategy, repeat this operation to convert the time series into a set of two-dimensional tensors, perform feature learning on each two-dimensional tensor, and aggregate the learned feature maps into a new one-dimensional sequence with high-dimensional features;

The one-dimensional sequence is classified to obtain an identification result of whether there is network traffic.

In this embodiment, network traffic is modeled as a time series with high-dimensional features at the session level. The specific method is as follows: the number of data packets in a session is regarded as the time series length, the data packet is regarded as a time point vector, and the time series length and feature dimension are unified.

In this embodiment, a time series is converted into k two-dimensional tensors, including converting the original time series into one two-dimensional tensor and treating the rows of the two-dimensional tensor as sub-time series through the Squeeze and reshape Block, and continuing to generate new two-dimensional tensors.

The process of converting the original time series into the first two-dimensional tensor is as follows:

1) Find the appropriate frequency value according to the frequency selection strategy

2) According to formula 1, find the frequency value The corresponding cycle

in, represents the length of the _kth time series.

3) Convert one-dimensional time series Converted to a two-dimensional tensor _X0,2D , as shown in Formula 2:

in, Represents each row vector in a two-dimensional tensor.

Squeeze and reshape Block includes squeeze operation and reshape operation. During the operation, the rows of the two-dimensional tensor are regarded as sub-time series, and new (k-1) two-dimensional tensors are generated according to the frequency selection strategy:

1) Treat each row of X _0,2D as a time series and perform a squeeze operation to obtain As shown in Formula 3:

2) According to the frequency selection strategy and formula 1, find the main period of the time series X _1,1D Corresponding frequency And reshape _X0,2D to obtain _X1,2D as shown in Formula 4:

Among them, _kth = 0, 1, ..., k-1.

3) Repeat steps 1 and 2 (k-1) times to generate (k-1) new two-dimensional tensors, for a total of k two-dimensional tensors.

The frequency selection strategy above is as follows:

1) When generating a new two-dimensional tensor, perform FFT operation on the time series and find the (kk _th ) frequency peaks with the largest amplitude, as shown in Formula 5:

Among them, topK() is to take the largest (kk _th ) value, Amp() is to take the amplitude, peak() is to take the frequency peak, that is, the peak frequency, and FFT is the fast Fourier transform.

2) When the generated two-dimensional tensor is the _kth one, and _kth ∈[0,k-1), select the minimum frequency among the _kth frequency peaks with the largest amplitude, as shown in Formula 6:

3) When the generated two-dimensional tensor is the kth, that is, _kth = k-1, directly select the frequency with the largest amplitude, as shown in formula 7. In addition, it should be noted here that when _kth = k-1, formula 7 is almost equivalent to formula 6 in physical sense, but the computational cost of finding the frequency peak is reduced:

This strategy is also called a dynamic frequency selection strategy. When a new set of two-dimensional tensors is generated from a time series, different numbers of frequency values are considered when generating each two-dimensional tensor, so as to maximize the characteristics of large and small cycles of the time series. For the convenience of representation and reading, the two frequencies are uniformly recorded as As shown in formula 8:

In the above process, the time series conversion is performed by the time series model TitNet for encrypted traffic classification. The TitNet model is composed of L TitBlocks stacked and connected in a residual manner. TitBlock includes converting a one-dimensional time series to generate k two-dimensional tensors, extracting features from the k two-dimensional tensors through a two-dimensional feature extractor, and converting the k learned feature maps back to one-dimensional sequences, and then aggregating them to generate a new one-dimensional sequence with high-dimensional features.

In this embodiment, L TitBlocks are stacked and connected in a residual manner to form TitNet, and the input of the lth layer is The process can be expressed as formula 9:

Among them, the input of the first TitBlock is X _0,1D .

In this embodiment, the two-dimensional feature extractor includes a multi-scale two-dimensional kernel—Inception block and an axial attention mechanism AxialAttention block. The Inception block is used to extract spatial features, and the AxialAttention block is used to extract the change features between and within cycles of the time series. The process of two-dimensional feature extraction can be expressed as Formula 10:

The k learned two-dimensional feature maps are concatenated with row vectors and converted into k one-dimensional sequences, as shown in Formula 11:

Aggregate k one-dimensional sequences to generate a new one-dimensional sequence with high-dimensional features, which is the output of the current TitBlock. The process is shown in Formula 12:

in Yes The Softmax calculation is performed as shown in Formula 13:

Embodiment 3

A Tor traffic detection and classification system based on time series transformation, including:

An acquisition module is configured to acquire network traffic data in the network environment to be tested;

The time series model module is configured to model the network traffic data as a time series with high-dimensional features at the session level, and convert the time series into a two-dimensional tensor according to a frequency selection strategy based on the periodicity of the time series;

Treat the rows in the two-dimensional tensor as sub-time series, convert the sub-time series into a two-dimensional tensor according to the frequency selection strategy, repeat this operation to convert the time series into a set of two-dimensional tensors, perform feature learning on each two-dimensional tensor, and aggregate the learned feature maps into a new one-dimensional sequence with high-dimensional features;

The classification module is configured to classify the one-dimensional sequence to obtain an identification result of whether there is network traffic.

In this embodiment, the time series model module includes a plurality of sequence operation modules stacked and connected in a residual manner, each sequence operation module includes a first conversion module, a two-dimensional feature extractor and an aggregation module, and the first conversion module is used to convert a one-dimensional time series into k two-dimensional tensors;

The two-dimensional feature extractor is used to extract features from k two-dimensional tensors;

The aggregation module is used to aggregate k learned feature maps to generate a new one-dimensional sequence with high-dimensional features.

In this embodiment, the two-dimensional feature extractor includes a multi-scale two-dimensional kernel block and an axis attention mechanism block. The multi-scale two-dimensional kernel block is used to extract spatial features, and the axis attention mechanism block is used to extract change features between and within cycles of a time series.

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The present invention is described with reference to the flowchart and/or block diagram of the method, device (system), and computer program product according to the embodiment of the present invention. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the process and/or box in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principle of the present invention without creative labor shall be included in the protection scope of the present invention.

Claims (10)

1. A Tor traffic detection and classification method based on time series conversion, characterized in that it includes the following steps: Obtain network traffic data in the network environment to be tested; The network traffic data is modeled as a time series with high-dimensional features at the session level. Based on the periodicity of the time series and the frequency selection strategy, the time series is converted into a two-dimensional tensor. Treat the rows in the two-dimensional tensor as sub-time series, convert the sub-time series into a two-dimensional tensor according to the frequency selection strategy, repeat this operation to convert the time series into a set of two-dimensional tensors, perform feature learning on each two-dimensional tensor, and aggregate the learned feature maps into a new one-dimensional sequence with high-dimensional features; The one-dimensional sequence is classified to obtain an identification result of whether there is network traffic. 2. A Tor traffic detection and classification method based on time series conversion as described in claim 1, characterized in that the process of modeling network traffic as a time series with high-dimensional features at the session level includes: regarding the number of data packets in a session as the time series length, regarding the data packet as a time point vector, and unifying the time series length with the feature dimension. 3. A Tor traffic detection and classification method based on time series conversion as described in claim 1, characterized in that the specific process of converting the time series into a two-dimensional tensor includes converting the original time series into a two-dimensional tensor, and through compression dimension operation and conversion dimension operation, the rows of the two-dimensional tensor are regarded as sub-time series, and a new two-dimensional tensor is continuously generated. 4. A Tor traffic detection and classification method based on time series conversion as claimed in claim 3, characterized in that the process of converting the original time series into a two-dimensional tensor includes: According to the frequency selection strategy, find the appropriate frequency value; Find a period corresponding to the frequency value, wherein the period and the frequency value are in an inverse relationship; Convert a one-dimensional time series into a two-dimensional tensor based on period and frequency values. 5. A Tor traffic detection and classification method based on time series conversion as described in claim 3, characterized in that the specific process of the compression dimension operation and the conversion dimension operation includes: treating each row of the two-dimensional tensor as a time series, and performing the compression dimension operation, according to the frequency selection strategy and the relationship between the period and the frequency value, finding the main period and the corresponding frequency of the time series after the compression dimension operation, and reshaping the two-dimensional tensor; Repeat the above process (k-1) times to generate (k-1) new two-dimensional tensors, a total of k two-dimensional tensors. 6. A Tor traffic detection and classification method based on time series conversion as described in claim 1 or 3 or 4, characterized in that the frequency selection strategy is: when generating a new two-dimensional tensor, the time series is subjected to a fast Fourier transform operation, and the _kkth frequency peak with the largest amplitude is found; When the generated two-dimensional tensor is the _kth , the minimum frequency among the _kth frequency peaks with the largest amplitude is selected; When the generated two-dimensional tensor is the kth, the frequency with the largest amplitude is directly selected. 7. A Tor traffic detection and classification system based on time series conversion, characterized in that it includes: An acquisition module is configured to acquire network traffic data in the network environment to be tested; The time series model module is configured to model the network traffic data as a time series with high-dimensional features at the session level, and convert the time series into a two-dimensional tensor according to a frequency selection strategy based on the periodicity of the time series; Treat the rows in the two-dimensional tensor as sub-time series, convert the sub-time series into a two-dimensional tensor according to the frequency selection strategy, repeat this operation to convert the time series into a set of two-dimensional tensors, perform feature learning on each two-dimensional tensor, and aggregate the learned feature maps into a new one-dimensional sequence with high-dimensional features; The classification module is configured to classify the one-dimensional sequence to obtain an identification result of whether there is network traffic. 8. A Tor traffic detection and classification system based on time series conversion as claimed in claim 7, characterized in that the time series model module includes a plurality of sequence operation modules stacked and connected in a residual manner, each sequence operation module includes a first conversion module, a two-dimensional feature extractor and an aggregation module, and the first conversion module is used to convert a one-dimensional time series into k two-dimensional tensors; The two-dimensional feature extractor is used to extract features from k two-dimensional tensors; The aggregation module is used to aggregate k learned feature maps to generate a new one-dimensional sequence with high-dimensional features. 9. A Tor traffic detection and classification system based on time series conversion as described in claim 8, characterized in that the two-dimensional feature extractor includes a multi-scale two-dimensional kernel block and an axis attention mechanism block, the multi-scale two-dimensional kernel block is used to extract spatial features, and the axis attention mechanism block is used to extract change features between and within cycles of the time series. 10. An electronic device, characterized in that it comprises a memory and a processor and computer instructions stored in the memory and executed on the processor, wherein when the computer instructions are executed by the processor, the steps in any one of the methods of claims 1-6 are completed.