面向加密流量的社交软件用户行为识别  

Social Software User Behavior Identification for Encrypted Traffic

作　　者：吴桦 王磊[1] 黄瑞琪 程光 胡晓艳 Wu Hua;Wang Lei;Huang Ruiqi;Cheng Guang;Hu Xiaoyan(School of Cyber Science and Engineering,Southeast University,Nanjing 211189;Purple Mountain Laboratories for Network and Communication Security,Nanjing 211111;International Governace Researach Base of Cyberspace(Southeast University),Nanjing 211189;Jiangsu Provincial Engineering Research Center of Security for Ubiquitous Network(Southeast University),Nanjing 211189)

机构地区：[1]东南大学网络空间安全学院,南京211189 [2]网络通信与安全紫金山实验室,南京211111 [3]网络空间国际治理研究基地(东南大学),南京211189 [4]江苏省泛在网络安全工程研究中心(东南大学),南京211189

出　　处：《计算机研究与发展》2024年第9期2321-2333,共13页Journal of Computer Research and Development

基　　金：国家重点研发计划项目(2021YFB3101403)。

摘　　要：随着智能终端和社交网络越来越融入人们的日常生活,针对社交软件的用户行为识别在网络管理、网络环境监管和市场调研等方面发挥越来越重要的作用.社交软件普遍使用端到端加密协议进行加密数据传输,现有方法通常提取加密数据的统计特征进行行为识别.但这些方法识别的性能不稳定且需要的数据量多,这些缺点影响了方法的实用性.提出了一种面向加密流量的社交软件用户行为识别方法.首先,从加密流量中识别出稳定的控制流数据,并提取控制服务数据分组负载长度序列.然后设计了2种神经网络模型,用于自动从控制流负载长度序列中提取特征,细粒度地识别用户行为.最后,以WhatsApp为例进行了实验,2种神经网络模型对WhatsApp用户行为的识别精准率、召回率和F1-score均超过96%.与类似工作的实验比较证明了该方法识别性能的稳定性,此外,该方法能够通过很少的控制流数据分组达到较高的识别精准率,对实时行为识别的研究具有重要的现实意义.As smart terminals and social networks are increasingly integrated into people’s daily life,user behavior identification for social software plays an increasingly important role in network management,network environment supervision,and market research.Social software commonly uses end-to-end encryption protocols for encrypted data transmission,and existing methods usually extract statistical features of the encrypted data for behavior identification.However,these methods have unstable identification performance and require a large amount of data,and these drawbacks affect the practicality of these methods.We propose a social software user behavior identification method for encrypted traffic.First,stable control flow data are identified from the encrypted traffic,and the control service packet payload length sequence is extracted.Then,two neural network models are then designed to automatically extract features from control flow payload length sequences to identify user behavior at a fine granularity.Finally,experiments are conducted with WhatsApp as an example,and the precision,recall,and F1-score of the two neural network models for recognizing WhatsApp user behavior are over 96%.The experimental comparison with similar work proves the stability of the identification performance of the method.In addition,the method can achieve high identification precision with a few control packets,which is of great relevance to the study of real-time behavior identification.

关 键 词：社交网络 用户行为 服务频次 控制流 长度序列 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]