CN114510615A - A fine-grained encrypted website fingerprint classification method and device based on graph attention pooling network - Google Patents

Abstract

The invention relates to a fine-grained encrypted website fingerprint classification method and device based on a graph attention pooling network. The method comprises the steps of establishing a flow trace graph for describing a network flow mode, wherein nodes in the flow trace graph represent network flows, and edges represent context relations of the network flows; automatically learning the intra-flow characteristics and the inter-flow characteristics in the flow trace diagram by using the graph neural network model to obtain effective embedded representation of the flow trace diagram; the effective embedded representation of the traffic trace graph is utilized for website fingerprint classification. The invention provides a flow trace graph capable of reasonably describing a network flow pattern, the method is based on a graph neural network algorithm, complex artificial feature selection is not needed, the global feature and the local feature of the network flow can be effectively learned at the same time, important flow nodes can be automatically learned and paid more attention to, and the negative effects of similar flow nodes and noise flow nodes among classes are reduced. The method is suitable for various granularity website fingerprint scenes, the performance is better, and the number of required training samples is less.

Description

A fine-grained encrypted website fingerprint classification method and device based on graph attention pooling network

technical field

The invention relates to a fine-grained encrypted website fingerprint classification method and device based on a graph attention pooling network, and belongs to the technical field of computer software.

Background technique

With the increasing awareness of network security, encryption protocols such as HTTPS are widely used in various websites. These encryption protocols bring great challenges to network management (such as QoS and malicious behavior tracking, etc.) while protecting data privacy. In recent years, with the revival and development of artificial intelligence, website fingerprinting technology that uses machine learning algorithms to identify specific web pages in encrypted traffic has become a hot research point in the field of network security.

Early research mines effective statistical features in encrypted traffic from various perspectives such as data packet size and packet arrival time interval, and uses traditional machine learning algorithms, such as K-nearest neighbors, support vector machines, random forests and other algorithm models as classifiers. better performance. In recent years, due to the rapid development of deep learning technology, some studies have used models such as convolutional neural networks and recurrent neural networks to automatically extract effective features from encrypted traffic and achieve high-precision website fingerprint classification. These deep learning methods have better performance and no longer require complex manual feature selection, thus becoming mainstream website fingerprinting methods.

However, existing research mainly focuses on the classification scenario of website homepage. In fact, people won't be limited to just visiting the homepage. Usually many websites contain several sub-pages, and these pages represent different services and network behaviors. Therefore, the problem of fine-grained webpage classification is also of great significance to network management such as QoS. However, since different web pages within the same website often have similar layout and content, the traffic features extracted manually or automatically by traditional methods are no longer distinguishable, which in turn leads to performance degradation of existing methods.

A few studies have proposed some methods to improve the performance of fine-grained webpage classification by combining global and local features of traffic. For example, global characteristics such as the total number of bytes and total packets of the network flow, time slice characteristics such as the number of bytes and packets in each time slice, and local characteristics such as the long sequence of n data packets before and after are counted. Compared with the global features in the traditional homepage fingerprint scenario, these local features can well represent the small differences between fine-grained web traffic. However, these methods employ machine learning algorithms and require complex manual feature selection and extraction processes. Although the deep learning-based website fingerprinting method can automatically learn potential traffic patterns, it is difficult to find the differences in fine-grained local features, and the performance also drops significantly in fine-grained scenarios. Therefore, additional knowledge is needed to help deep learning models learn small feature differences between similar samples.

SUMMARY OF THE INVENTION

The present invention aims to provide a method and device for effectively solving fine-grained encrypted website fingerprints. The present invention is a deep learning algorithm without complicated manual feature selection, and can simultaneously learn global and local features of network traffic.

The invention proposes a fine-grained encrypted website fingerprint classification method based on graph attention pooling network. The graph structure is used to describe website access traffic, all nodes represent global traffic information, edges represent local context information of network flow, and a graph neural network is used. Algorithms automatically learn efficient graph representations. In webpage access traffic, different flows represent different types of resource requests, and the method in the present invention can automatically learn the importance of different flows for final classification, and has interpretability. The present invention also has the advantage of better classification performance in the case of fewer training samples.

Specifically, the technical scheme adopted in the present invention is as follows:

A fine-grained encrypted website fingerprint classification method based on graph attention pooling network, including the following steps:

Build a traffic trace graph to describe the network traffic pattern. The nodes in the traffic trace graph represent the network flow, and the edges represent the context of the network flow;

Using the graph neural network model to automatically learn the intra-flow features and inter-flow features in the traffic trace graph, and obtain the effective embedding representation of the traffic trace graph;

Website Fingerprinting Using Efficient Embedding Representations of Traffic Trace Graphs.

Further, in the traffic trace graph, for two flows generated by the same client, whether the two nodes have an edge is determined according to whether the start time interval of the two flows is less than an empirical threshold.

Further, the graph neural network model is used to automatically learn the intra-flow features and the inter-flow features in the traffic trace graph to obtain an effective embedded representation of the traffic trace graph, including:

The multi-head graph attention layer is used to learn the attention weight of nodes, so that the model pays more attention to important nodes in the traffic trace graph, and reduces the negative effects of similar nodes and noisy nodes between classes;

The self-attention pooling layer is used to further filter important nodes, while reducing the amount of model parameters.

Further, in the multi-head graph attention layer, the traffic trace graph first extracts the shallow abstract representation through the single-layer fully connected network, and then learns the node attention weight through the K-head graph attention network to obtain K kinds of node representations, and then uses the K-head graph attention network to learn the node attention weight. K kinds of node representations are accumulated and sent to the self-attention pooling layer.

Further, the self-attention pooling layer uses a graph convolutional network to calculate the importance of each node and retains topK nodes, so as to further screen important nodes and reduce the amount of model parameters.

Further, global max pooling and global average pooling are performed on the topK node graph, and the two pooling results are spliced to obtain the global embedding representation of the graph, which is used as the output of a convolution block. Finally, the two convolution blocks are combined. The output results are spliced to obtain the final effective embedding.

Further, using the effective embedded representation of the traffic trace graph to perform website fingerprint classification includes: using a single-layer fully connected network in conjunction with a Log Softmax function as a classifier to obtain a webpage classification result, wherein using Dropout to prevent training overfitting, using NLLLoss as a loss function.

A fine-grained encrypted website fingerprint classification device based on graph attention pooling network, comprising:

The composition module is used to establish a traffic trace graph for describing the network traffic pattern, the nodes in the traffic trace graph represent the network flow, and the edges represent the context relationship of the network flow;

The graph attention level pooling module is used to automatically learn the intra-flow features and inter-flow features in the traffic trace graph by using the graph neural network model, and obtain an effective embedded representation of the traffic trace graph;

An output module for fingerprinting a website using an efficient embedded representation of the traffic trace graph.

The key points of the present invention are:

1. Aiming at the problem of fine-grained website fingerprints, a classification method of encrypted website fingerprints based on graph attention pooling network is proposed. The method uses the traffic trace graph to represent the context of the flow in the web page access traffic, which can simultaneously represent the global and local characteristics of the network traffic. And use the graph neural network model to automatically learn the intra-stream features and inter-stream features of the trace graph, and finally obtain the effective embedding representation of the trace graph.

2. The multi-head graph attention mechanism is used to learn the attention weight of nodes, which makes the model pay more attention to the important nodes in the traffic trace graph, and reduces the negative effects of similar nodes and noisy nodes between classes. And use the self-attention pooling module to further filter important nodes, while reducing the amount of model parameters.

3. The method can automatically adapt to website fingerprinting scenarios of various granularities. The best classifier that can achieve the target metric under various granularity datasets. At the same time, this method can obtain better classification performance with fewer training samples.

The present invention has the following characteristics and beneficial effects to the solution of the fine-grained website fingerprint problem:

1. A traffic trace graph that can reasonably describe the network traffic pattern is proposed. Nodes are used to represent network flows, and edge information is used to represent the context of network flows.

2. Based on the graph neural network algorithm, there is no need for complex manual feature selection, and it can effectively learn the global and local features of network traffic at the same time.

3. It can automatically learn and pay more attention to important flow nodes, and reduce the negative effects of similar flow nodes and noisy flow nodes between classes.

4. It is suitable for a variety of granular website fingerprinting scenarios, with better performance and fewer training samples.

Description of drawings

Fig. 1 is a basic frame diagram of the method of the present invention.

Detailed ways

In order to make the above objects, features and advantages of the present invention more clearly understood, the present invention will be further described in detail below through specific embodiments and accompanying drawings.

1 is a basic frame diagram of the method of the present invention, which includes three stages, the left side represents the composition phase, the middle represents the training phase, and the right side represents the classification phase. The training phase is the graph attention layer pooling module, which contains 2 convolutional blocks, each of which contains 3 sub-layers. The composition module and the graph attention level pooling module are the most critical technologies of the present invention. The scheme of the present invention includes the following technical steps:

1. Composition stage:

(1) Data preparation: Collect the SSL/TLS encrypted network traffic data packets in the current task scenario (SSL/TLS means that the website adopts the HTTPS encryption protocol), and after labeling it, divide the data set according to a certain proportion, such as the training set :validation set:test set = 6:1:3. The role of the training set is to continuously optimize and adjust the model parameters during the training phase, while the role of the validation set is to help observe whether the training degree of the model is overfitting or meet the expected requirements, so as to judge when to stop training. The test set is used to test the classification performance of the model in real network traffic.

(2) Stream generation: Divide the data packets in (1) according to quintuple, and extract the start time, data packet size (packet length) and data packet arrival time interval of each flow for use in (3) Build node and edge information. The quintuple refers to the source IP address, the destination IP address, the source port number, the destination port number, and the protocol type.

(3) Constructing a traffic trace graph: take each flow in (2) as a node in the graph, and the packet length sequence and packet arrival time interval sequence of the flow as the characteristics of the node. For streams generated by the same client, whether the two nodes have an edge is determined according to whether the start time interval of the two streams is less than an empirical threshold, and the present invention sets the threshold to 2s. As shown in Figure 1, where ClientIP ₁ == ClientIP ₂ indicates that the two streams are generated by the same client, and the start time interval |t ₁ -t ₂ | of the two streams is less than or equal to the empirical threshold t _threshold , and the An edge is added between nodes v ₁ and v ₂ . In Fig. 1, A represents the adjacency matrix of the graph, and X represents the feature matrix.

2. In the training phase, it is mainly a graph attention layer pooling module, which includes 3 sub-layers:

表示学习到的注意力权重。其中K是指对同一个流量踪迹图进行K次相互独立的GAT操作，得到K种不同的节点表示。K次计算目的是学习到更加多样性的权重，从而提升模型的学习能力。(1) Multi-head graph attention layer: The traffic trace graph first extracts a shallow abstract representation through a single-layer fully connected network, and then learns the node attention weight through a K-head graph attention network (GAT) to obtain K kinds of node representations, and then K kinds of nodes are accumulated and sent to (2), as shown in Figure 1, where FC is a fully connected network, Elu is an exponential linear unit activation function,

represents the learned attention weights. Among them, K refers to performing K independent GAT operations on the same traffic trace graph to obtain K different node representations. The purpose of K calculations is to learn more diverse weights, thereby improving the learning ability of the model.

(2) Self-attention pooling layer: This layer calculates the importance of each node and retains the topK nodes (retaining the top K nodes in the importance score) to further filter important nodes and reduce the amount of model parameters. As shown in Figure 1, where Relu represents the rectified linear unit activation function, GCN represents the graph convolutional network, and score _vi represents the learned node importance score. Among them, the node importance is calculated by the graph convolution network (GCN). The graph convolution operation can not only pay attention to the feature information of the node itself, but also make full use of the structural information of the graph.

(3) Readout layer: This layer performs global maximum pooling (MaxPool) and global average pooling (MeanPool) operations on the topK node graph in (2), and splices the two pooling results to obtain the traffic trace of this layer The graph global embedding representation is used as a convolutional block output (Readout) of the graph attention hierarchical pooling module. Finally, the final effective embedding of the sample can be obtained by splicing the results of the two convolution blocks of the module. As shown in Figure 1, Jumping Knowledge represents jumping connection, that is, the splicing operation of Readout.

3. Classification stage:

This stage is the output module, which uses a single-layer fully connected network (FC) combined with the Log Softmax function as a classifier to obtain webpage classification results. Among them, Dropout is used to prevent training overfitting, and NLLLoss is used as the loss function.

Example of the present invention:

Example 1 Traditional website fingerprint homepage classification scenario

In October 2020, actively collect the raw traffic of HTTPS websites ranked Top 100 in Alexa China. Each webpage is visited 100 times, with a total of 1w traffic samples. After sample labeling and feature extraction, the data set is divided, and the division ratio is training set: validation set: test set = 6:1:3. After composition and training, the algorithm proposed by the present invention obtains a high F1 score of 99.85% in the test set, which is more than 1% higher than the existing state-of-the-art research work. It is illustrated that the present invention is the optimal method in the traditional website homepage classification scenario.

Example 2 Fine-grained web page fingerprinting scenario under a single website

In November 2020, the raw access traffic of a total of 90 popular web pages under 2 representative HTTPS websites was collected. Among them, 60 webpages of website A and 30 webpages of website B are selected, and each webpage is accessed 100 times, for a total of 9k samples. After the traffic samples of A and B are marked, feature extracted and divided into data sets, they are sent to the graph attention pooling network model proposed by the present invention for training. The test set results show that the present invention achieves high F1 values of 96.72% and 91.45% on the two datasets, respectively, which is 3% to 23% higher than the existing state-of-the-art methods.

Example 3 Fine-grained web page fingerprinting scenario under multiple websites

In December 2020, we actively collected the raw access traffic of a total of 100 popular web pages under 9 representative HTTPS websites, each web page was accessed 100 times, and a total of 1w traffic samples were collected. The experimental test results show that the present invention achieves an F1 value of 93.37%, which is more than 14% higher than the existing state-of-the-art methods.

On the whole, the graph attention pooling network model proposed by the present invention performs the best in various granularity website fingerprinting scenarios. At the same time, experiments have found that the present invention only needs a small number of training samples to achieve a high accuracy rate. For example, the home page classification scenario only needs 25 samples to achieve 99% accuracy, while the single website fine-grained webpage classification scenario only needs 15 90% accuracy can be achieved with only one sample.

Based on the same inventive concept, another embodiment of the present invention provides a fine-grained encrypted website fingerprint classification device based on graph attention pooling network, which includes:

The composition module is used to establish a traffic trace graph for describing the network traffic pattern, the nodes in the traffic trace graph represent the network flow, and the edges represent the context relationship of the network flow;

The graph attention level pooling module is used to automatically learn the intra-flow features and inter-flow features in the traffic trace graph by using the graph neural network model, and obtain an effective embedded representation of the traffic trace graph;

An output module for fingerprinting a website using an efficient embedded representation of the traffic trace graph.

For the specific implementation process of each module, refer to the foregoing description of the method of the present invention.

Based on the same inventive concept, another embodiment of the present invention provides an electronic device (computer, server, smart phone, etc.), which includes a memory and a processor, the memory stores a computer program, and the computer program is configured to be The processor is executed, and the computer program includes instructions for performing the steps in the method of the present invention.

Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium (eg, ROM/RAM, magnetic disk, optical disk), where the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer , realize each step of the method of the present invention.

Other embodiments of the present invention:

1. Multi-head attention layer: The method of the present invention can use a graph convolutional network (GCN) or the like to replace the multi-head attention layer in order to reduce computational complexity and achieve higher accuracy.

2. Readout layer: The method of the present invention may use Readout averaging/summation and other methods to replace the splicing operation during specific implementation.

3. Output module: The method of the present invention can customize the output layer structure according to the classification task during specific implementation, such as using a global average pooling layer instead of a fully connected layer.

The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and implement them accordingly. Those skilled in the art can understand that various substitutions, changes and modifications can be made without departing from the spirit and scope of the present invention. Modifications are possible. The present invention should not be limited to the contents disclosed in the embodiments of this specification, and the protection scope of the present invention shall be subject to the scope defined by the claims.

Claims (10)

1. a fine-grained encryption website fingerprint classification method based on graph attention pooling network, is characterized in that, comprises the following steps: Build a traffic trace graph to describe the network traffic pattern. The nodes in the traffic trace graph represent the network flow, and the edges represent the context of the network flow; Using the graph neural network model to automatically learn the intra-flow features and inter-flow features in the traffic trace graph, and obtain the effective embedding representation of the traffic trace graph; Website Fingerprinting Using Efficient Embedding Representations of Traffic Trace Graphs. 2. The method according to claim 1, wherein, in the traffic trace diagram, for two flows generated by the same client, it is determined whether the two nodes have the same flow according to whether the initial time interval of the two flows is less than an empirical threshold. side. 3. method according to claim 1, is characterized in that, described utilizing graph neural network model to automatically learn the intra-flow feature and inter-flow feature in the traffic trace graph, obtain the effective embedded representation of the traffic trace graph, comprising: The multi-head graph attention layer is used to learn the attention weight of nodes, so that the model pays more attention to important nodes in the traffic trace graph, and reduces the negative effects of similar nodes and noisy nodes between classes; The self-attention pooling layer is used to further filter important nodes, while reducing the amount of model parameters. 4. The method according to claim 3, wherein in the multi-head graph attention layer, the traffic trace graph first extracts a shallow abstract representation through a single-layer fully connected network, and then learns nodes through a K-head graph attention network. The attention weight is obtained to obtain K node representations, and then the K node representations are accumulated and sent to the self-attention pooling layer. 5 . The method according to claim 3 , wherein the self-attention pooling layer uses a graph convolutional network to calculate the importance of each node and retains topK nodes, so as to further screen important nodes and reduce the amount of model parameters. 6 . 6. The method according to claim 5, wherein the topK node graph is subjected to global maximum pooling and global average pooling operations, and the two pooling results are spliced to obtain a global embedding representation of the graph, which is used as a volume The output of the accumulation block, and finally the results of the output of the two convolution blocks are spliced to obtain the final effective embedding. 7. method according to claim 1, is characterized in that, described utilizing the effective embedded representation of traffic trace graph to carry out website fingerprint classification, comprising: use single-layer fully connected network in conjunction with Log Softmax function as classifier, obtain webpage classification result , in which Dropout is used to prevent training overfitting, and NLLLoss is used as the loss function. 8. A fine-grained encrypted website fingerprint classification device based on graph attention pooling network, characterized in that, comprising: The composition module is used to establish a traffic trace graph for describing the network traffic pattern, the nodes in the traffic trace graph represent the network flow, and the edges represent the context relationship of the network flow; The graph attention level pooling module is used to automatically learn the intra-flow features and inter-flow features in the traffic trace graph by using the graph neural network model, and obtain an effective embedded representation of the traffic trace graph; An output module for fingerprinting a website using an efficient embedded representation of the traffic trace graph. 9. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes a program for executing claims 1- 7. Instructions for the method of claim 7. 10 . A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is implemented. 11 .

Images