Research And Implementation Of Wechat User Behavior Recognition Based On MMTLS Protocol

As an indispensable Internet application in people’s life,We Chat is one of the social software with the largest number of users,which contains a variety of complex user behaviors such as payment and online chat.Some criminals release malicious remarks and conduct illegal transactions in We Chat,which seriously endangers social stability and user privacy security.Therefore,the study of We Chat user behavior identification is of great significance to the supervision of network environment.With the growth of user demand,the types and complexity of user behaviors are also increasing.The existing user behavior identification methods are difficult to distinguish these user behaviors based on the traditional encrypted traffic characteristics.In addition,We Chat communication traffic usually contains multiple user behaviors,and the sequence composed of multiple user behaviors is the user behavior chain.How to determine the segmentation point between behaviors is a difficult problem in the recognition process.Therefore,it is a challenging to extract effective features from encrypted traffic and accurately identify We Chat user behavior and user behavior chain.Based on the traffic characteristics of MMTLS protocol,this paper proposes a method for We Chat user behavior recognition and user behavior chain recognition.It mainly includes the following research contents:(1)In view of the low recognition accuracy of We Chat user behavior in encrypted traffic and the inability to identify multiple user behaviors,this paper proposes a We Chat user behavior recognition method based on composite statistical features to identify We Chat user behaviors in encrypted traffic from the granularity of data flow.This method studies the traffic characteristics of MMTLS protocol and identifies We Chat user behaviors in encrypted traffic through the composite statistical features composed of MMTLS protocol field features,N-stage statistical features,multi-scale entropy features and random forest classification algorithm.In addition,the method adopts Appium-based automatic tag traffic acquisition method to construct user behavior tag data set.Experimental results show that this method can accurately identify8 user behaviors in We Chat,with an average accuracy of 98.54%,which is better than the existing methods for user behavior recognition in We Chat.(2)In view of the problem that the user behavior chain cannot be identified due to the difficulty in determining the segmentation points between user behaviors,this paper proposes a We Chat user behavior chain recognition method based on time series segmentation of packet granularity.This method can identify the user behavior chain composed of multiple user behaviors from encrypted traffic.The time series segmentation method based on K-means clustering can be used to divide THE MMTLS protocol control flow into multiple subsequences,and the user behavior corresponding to each sub-sequence can be identified with the random forest classification algorithm,and it can be combined according to the order appearing in the MMTLS protocol control flow,and finally obtain the We Chat user behavior chain.Experimental results show that the method can identify We Chat user behavior chain in encrypted traffic with 94.55% accuracy.(3)Based on the above methods of automatic acquisition of We Chat user behavior label traffic,user behavior identification method and user behavior chain identification method,this paper designed and implemented a We Chat user behavior identification system.The system can efficiently construct encrypted traffic label data set,realize user behavior identification and user behavior chain identification respectively,and display the identification results.