Journal of Computer Applications ›› 2020, Vol. 40 ›› Issue (7): 1970-1976.DOI: 10.11772/j.issn.1001-9081.2019122063

• Cyber security • Previous Articles     Next Articles

WeChat payment behavior recognition model based on division of large and small burst blocks

LIANG Denggao1, ZHOU Anmin1, ZHENG Rongfeng2, LIU Liang1, DING Jianwei3   

  1. 1. College of Cybersecurity, Sichuan University, Chengdu Sichuan 610065, China;
    2. College of Electronics and Information Engineering, Sichuan University, Chengdu Sichuan 610065, China;
    3. Science and Technology on Communication Security Laboratory, The 30 th Research Institute of China Electronics Technology Group Corporation, Chengdu Sichuan 610041, China
  • Received:2019-12-06 Revised:2020-02-21 Online:2020-07-10 Published:2020-04-23
  • Supported by:
    This work is partially supported by National Key Research and Development Program of China (2016YFE0206700).


梁登高1, 周安民1, 郑荣锋2, 刘亮1, 丁建伟3   

  1. 1. 四川大学 网络空间安全学院, 成都 610065;
    2. 四川大学 电子信息学院, 成都 610065;
    3. 中国电子科技集团公司第三十研究所 保密通信重点实验室, 成都 610041
  • 通讯作者: 郑荣锋
  • 作者简介:梁登高(1995-),男,贵州兴仁人,硕士研究生,主要研究方向:网络流量分析、恶意流量分析;周安民(1963-),男,四川成都人,研究员,主要研究方向:安全防御管理、移动互联网安全;郑荣锋(1990-),男,重庆人,博士研究生,主要研究方向:信息系统安全;刘亮(1982-),男,四川叙永人,高级工程师,博士研究生,主要研究方向:系统安全、恶意代码分析、漏洞挖掘与利用、网络应用安全;丁建伟(1986-),男,四川自贡人,高级工程师,博士,主要研究方向:网络威胁情报、暗网数据分析。
  • 基金资助:

Abstract: For the facts that WeChat red packet and fund transfer functions are used for illegal activities such as red packet gambling and illegal transactions, and the existing research work in this field is difficult to identify the specific numbers of sending and receiving red packets and fund transfers in WeChat, and there are problems of low recognition rate and high resource consumption, a method for dividing large and small burst blocks of traffic was proposed to extract the characteristics of traffic, so as to effectively identify the sending and receiving of red packets and the transfer behaviors. Firstly, by taking advantage of the suddenness of sending and receiving red packets and fund transfers, a large burst time threshold was set to define the burst blocks of such behaviors. Then, according to the feature that the behaviors of sending and receiving red packets and fund transfers consist of several consecutive user operations, a small burst threshold was set to further divide the traffic block into small bursts. Finally, synthesizing the features of small burst blocks in the big burst block, the final features were obtained. The experimental results show that the proposed method is generally better than the existing research on WeChat payment behavior recognition in terms of time efficiency, space occupancy rate, recognition accuracy and algorithm universality, with an average accuracy rate up to 97.58%. The test results of the real environment show that the proposed method can basically accurately identify the numbers of sending and receiving red packets and fund transfers for a user in a period of time.

Key words: WeChat, red packet and fund transfer, traffic burst, encrypted traffic, machine learning

摘要: 针对微信红包与转账功能被用于红包赌博、非法交易等违法活动,且现有的研究工作难以识别微信中收发红包与转账行为的具体次数,以及存在低识别率和高资源消耗的问题,提出了一种划分大、小流量突发块的方法来提取流量特征,从而对收发红包与转账行为进行有效识别。首先,利用收发红包与转账行为流量的突发性,设定大突发时间阈值将这类行为的流量突发块分隔开;然后,针对收发红包与转账行为由多次连续的用户操作组成的特性,设定小突发阈值将流量块进一步细化为小突发块;最后,综合大突发块中各个小突发块的特征,得到最终的特征。实验结果显示,该方法在时间效率、空间占用率、识别准确率、算法普适性等方面普遍优于微信支付行为识别方面的现有研究,平均准确率最高可达97.58%。真实场景的测试结果表明,所提出的方法基本能准确识别出一段时间内用户收发红包与转账行为的次数。

关键词: 微信, 红包与转账, 流量突发块, 加密流量, 机器学习

CLC Number: