面向加密流量的社交软件用户行为识别
Social Software User Behavior Identification for Encrypted Traffic
吴桦 1王磊 2黄瑞琪 2程光 3胡晓艳1
作者信息
- 1. 东南大学网络空间安全学院 南京 211189;网络通信与安全紫金山实验室 南京 211111;网络空间国际治理研究基地(东南大学) 南京 211189
- 2. 东南大学网络空间安全学院 南京 211189
- 3. 东南大学网络空间安全学院 南京 211189;网络通信与安全紫金山实验室 南京 211111;江苏省泛在网络安全工程研究中心(东南大学) 南京 211189
- 折叠
摘要
随着智能终端和社交网络越来越融入人们的日常生活,针对社交软件的用户行为识别在网络管理、网络环境监管和市场调研等方面发挥越来越重要的作用.社交软件普遍使用端到端加密协议进行加密数据传输,现有方法通常提取加密数据的统计特征进行行为识别.但这些方法识别的性能不稳定且需要的数据量多,这些缺点影响了方法的实用性.提出了一种面向加密流量的社交软件用户行为识别方法.首先,从加密流量中识别出稳定的控制流数据,并提取控制服务数据分组负载长度序列.然后设计了2种神经网络模型,用于自动从控制流负载长度序列中提取特征,细粒度地识别用户行为.最后,以WhatsApp为例进行了实验,2种神经网络模型对WhatsApp用户行为的识别精准率、召回率和Fl-score均超过96％.与类似工作的实验比较证明了该方法识别性能的稳定性,此外,该方法能够通过很少的控制流数据分组达到较高的识别精准率,对实时行为识别的研究具有重要的现实意义.
Abstract
As smart terminals and social networks are increasingly integrated into people's daily life,user behavior identification for social software plays an increasingly important role in network management,network environment supervision,and market research.Social software commonly uses end-to-end encryption protocols for encrypted data transmission,and existing methods usually extract statistical features of the encrypted data for behavior identification.However,these methods have unstable identification performance and require a large amount of data,and these drawbacks affect the practicality of these methods.We propose a social software user behavior identification method for encrypted traffic.First,stable control flow data are identified from the encrypted traffic,and the control service packet payload length sequence is extracted.Then,two neural network models are then designed to automatically extract features from control flow payload length sequences to identify user behavior at a fine granularity.Finally,experiments are conducted with WhatsApp as an example,and the precision,recall,and Fl-score of the two neural network models for recognizing WhatsApp user behavior are over 96％.The experimental comparison with similar work proves the stability of the identification performance of the method.In addition,the method can achieve high identification precision with a few control packets,which is of great relevance to the study of real-time behavior identification.
关键词
社交网络/用户行为/服务频次/控制流/长度序列Key words
social network/user behavior/service frequency/control flow/length sequence引用本文复制引用
基金项目
国家重点研发计划(2021YFB3101403)
出版年
2024
NETL
NSTL
万方数据