【作者】 王磊；

【导师】 吴桦； 汤鲲；

【作者基本信息】 东南大学 ， 计算机技术（专业学位）， 2022， 硕士

【摘要】 随着信息安全与用户隐私保护意识的不断增强,越来越多的社交软件开发并使用私有加密协议,并广泛采用端到端的加密技术,这导致一些非法活动通过社交网络无序传播,而监管部门无法对社交网络进行有效监管,因此如何对社交软件的用户行为进行有效识别是亟待解决的问题,具有较高的研究意义。基于流统计特征的机器学习或深度学习方法在社交软件用户行为识别上取得了一定的成效,但这些方法容易受到干扰数据和流量特征波动的影响,加之社交软件用户行为的多样性和这些行为触发流量的复杂性,造成社交软件用户行为识别性能较差,资源消耗较多,不适用于粒度细、实时性要求高的场景。针对上述问题,本文提出了一种新的社交软件用户行为识别方法,该方法可以完成社交软件实时、细粒度的用户行为识别。本文的主要研究内容如下:(1)提出了一种基于服务数据矩阵的社交软件用户行为识别方法。现有的研究大多从社交软件产生的全流量中提取特征,导致容易受干扰数据的影响。本文试图从全流量中筛选更能刻画用户行为的流量数据,提出了控制服务的概念和基于服务数据矩阵的控制服务提取方法。在对Whats App控制服务特征进行研究的基础上,设计了两种神经网络结构——LS-CNN和LS-LSTM,用于从控制服务的数据包负载长度序列中提取特征以识别用户行为。使用该方法对Whats App的14种用户行为进行识别,实验证明相比现有方法,该方法在识别的粒度、稳定性和整体准确性上均有较大的提升。(2)提出了面向持续性用户行为的实时识别方法。为实时识别持续性用户行为,本文使用基于突发阈值的方法切分持续性用户行为的控制服务,获取各子行为对应的控制服务。不同持续性用户行为子行为的控制服务具有较高的相似度,因此不能直接使用LSCNN进行识别。本文在LS-CNN的基础上提出了双层分类模型,基于持续性用户行为的时间依赖性来区分子行为属于哪个持续性用户行为。该模型第一层的主分类器完成用户行为触发的所有样本的识别,并根据识别结果从样本中选择持续性用户行为触发的样本,然后送入第二层分类器,完成持续性用户行为的细粒度识别。实验结果表明该模型可以实时、细粒度的识别持续性用户行为。(3)本文基于上述方法设计并实现了Whats App用户行为实时识别系统。系统主要包含实时流量采集模块、流量处理模块、用户行为实时识别模块以及界面显示模块等。该系统具有简洁的界面,使用者通过简单的参数设置就可以运行系统,并通过界面显示当前网络中Whats App用户正在进行的行为。另外,本文使用流量数据重放来模拟Whats App的实时流量以测试系统性能,通过测试系统运行稳定,识别准确性和实时性符合预期。更多还原

【Abstract】 With the increasing awareness of information security and user privacy protection,more and more social software develops and uses private encryption protocols and widely adopts end-to-end encryption technology,which leads to the disorderly spread of some illegal activities through social networks.As a result,the regulatory departments cannot effectively supervise social networks,so how effectively identify the user behavior of social software is an urgent problem with high research value.Machine learning or deep learning methods based on flow statistical features have achieved specific achievements in social software user behavior identification.Still,these methods are susceptible to interference data in traffic data and fluctuation of traffic features.At the same time,the diversity of social software user behaviors and the complexity of these behaviors triggering traffic further lead to poor social software identification performance and high resource consumption,which are not suitable for scenarios with fine granularity and high real-time requirements.The text proposes a new user behavior identification method for social software to address the above problems,which can accomplish real-time and fine-grained user behavior identification of social software.The main research contents of this paper are as follows.(1)A method for identifying user behavior of social software based on service data matrix is proposed.Most of the existing studies extract features from the total traffic generated by social software,leading to susceptibility to interference data.This paper attempts to filter the traffic data that better portrays user behavior from the total traffic and proposes the concept of control service and a control service extraction method based on the service data matrix.Based on the Whats App control service features,two neural network structures-LS-CNN and LSLSTM-are designed to extract features from packet load length sequences of control services to identify user behaviors.Using this method to identify 14 user behaviors of Whats App,experiments demonstrate that the technique has a more significant improvement in granularity,stability,and overall identification accuracy than existing methods.(2)A real-time identification method for continuous user behavior is proposed.This paper uses a burst threshold-based approach to segment continuous user behaviors and obtain the control services corresponding to each sub behavior to identify continuous user behaviors in real-time.Control services with different continuous user behaviors of sub behaviors have high similarity,so they cannot be placed directly using LS-CNN.In this paper,we propose a twolayer classification model based on LS-CNN to distinguish which continuous user behavior a sub behavior belongs to based on the time dependence of the continuous user behavior.The main classifier in the first layer of the model identifies all samples triggered by user behaviors,and selects samples triggered by continuous user behaviors based on the identification results.Then sends them to the second layer classifier to complete the fine-grained identification of continuous user behaviors.The experimental results show that the model can identify continuous user behaviors in real-time and at fine granularity.(3)In this paper,we design and implement a real-time Whats App user behavior identification system based on the above method.The system mainly contains a real-time traffic collection module,traffic processing module,real-time user behavior identification module and interface display module.The system has a simple interface that allows users to run the system with simple parameter settings and displays the current behavior of Whats App users in the network through the interface.In addition,this paper uses the replayed traffic data to simulate Whats App’s real-time traffic to test the system’s performance.Through the test,the system operates stably,and the identification accuracy and real-time performance meet the expectation.更多还原