| As user privacy and network experience have been increasingly important in Internet communication in recent years,HTTP/2 has become the current network protocol standard for many web sites and mobile applications due to its low network latency,high bandwidth utilisation and good privacy protection.Since Web browsing and mobile applications are the main entrances for users to access the Internet,and various malicious network behaviors use them as the main way to inject malicious code and publish false information,it is of great practical significance to carry out passive traffic analysis for HTTP/2 for the governance of cyberspace security.Most of the current research on encrypted web traffic analysis has focused on the extraction and application of generic traffic features and less on the impact of the newly introduced binary frames,multiplexing and server push mechanisms in HTTP/2,which has resulted in a low overall accuracy of the identification tasks related to HTTP/2traffic.In order to address the need for fine-grained analysis of HTTP/2 traffic,which is currently growing rapidly and gradually starting to dominate Internet communications,this paper proposes a study of the type of bearer resource and attribution site identification techniques for HTTP/2 traffic.The identification of bearer resources can effectively sense the behavioural patterns of traffic users,while the identification of attribution sites can identify the source of traffic in the context of the current cloud platform and high dynamics of web page deployment,which are both major tasks in the analysis of current encrypted page access traffic.In view of the spatio-temporal characteristics formed by the HTTP/2 handshake and transmission mechanism,the following research is conducted in terms of multi-dimensional spatio-temporal feature mining,deep learning model design for spatio-temporal data for characterisation of traffic and comprehensive design of traffic identification system.The main work of the dissertation is as following:(1)The temporal and spatial characteristics of HTTP/2 traffic are analysed for different bearer resource types and different attribution sites.In the comparative analysis of bearer resource types,the main focus is given to the response delay,inter-packet delay,load length,transmission rate and other characteristics that can characterise the differences in resource characteristics.The comparative analysis of the attribution site,the principal focus is placed on the number and size of uplink packets,downlink TLS record length,packet arrival interval and other characteristics.These two types of comparative analysis can lay the groundwork for the identification of resource types and attribution sites for HTTP/2 traffic.(2)A multi-dimensional spatio-temporal feature-based HTTP/2 bearer resource identification method is proposed.The statistical behavior characteristics of the flow are extracted from five dimensions of data packet delay,data packet length,data packet number,data transmission rate and data interaction characteristics.Based on the established feature set,an integrated feature selection method based on voting mechanism is designed.Three filtering feature selection methods,variance selection,chi-square test and mutual information,are used for integrated feature selection,the problem of identifying HTTP/2 bearer resource types is implemented by combining four typical machine learning methods.The experimental results based on the collected HTTP/2 page traffic datasets of various bearer resource types show that the proposed method can effectively identify HTTP/2 bearer resource types with an accuracy rate of over 98%.(3)A spatio-temporal fusion attention mechanisms based HTTP/2 attribution site identification method is proposed.By extracting the uplink TCP packet sequence,downlink TLS record length sequence and packet arrival interval sequence from the data stream,a unified fine-grained spatio-temporal data representation is thus established for the data stream,and a spatio-temporal fused attention neural network model consisting of global time convolution,local time convolution and self-attention mechanism is designed for the heterogeneous characteristics of its spatio-temporal representation,which can effectively tap the The model can effectively explore the spatio-temporal correlation characteristics between different features.The experimental results based on the collected HTTP/2 page traffic datasets from different sites show that the proposed method can effectively identify the attributed sites of HTTP/2 with an accuracy of over 96%.Finally,the dissertation is summarized,and looks forward to the problems worth further study in the future. |
