With the rapid development of web-based applications, clicking on hyperlinks has become a general means for accessing various network services. Understanding the visiting behavior of web users not only helps improve the personalized service quality and user experience, but also plays an important role in network management and early threat detection. Click-stream identification is a fundamental issue for user behavior analysis. However, most existing approaches are designed for non-encrypted HTTP requests and only focus on server-side scenarios, which makes them inapplicable to the increasingly popular HTTPS and network-side management. In this work, we propose an encryption-independent scheme from a network-side perspective that adopts the web traffic collected at the network boundary to identify the HTTP(S) requests generated by the click actions of web users. The proposed scheme employs hidden Markov models (HMMs) to describe the time-varying behavior of click and non-click web traffic. A deep neural network (DNN) is integrated into the HMMs to capture the context of web traffic, which eliminates the limitations caused by the independence hypothesis of the traditional HMMs. Finally, a DNN-based rear classifier is proposed to determine the type of HTTP(S) requests according to the fitting degree between the HTTP(S) requests and the HMM-based behavior models. We derive the algorithms for model learning and click identification. Experiments are conducted to validate the proposed approach. Performance-related issues and comparisons are discussed. Results show that both the average precision and recall rate of the proposed approach exceed 92%, which is better than most existing benchmark methods in terms of performance and stability.

随着基于Web的应用程序的飞速发展，单击超链接已成为访问各种网络服务的通用方法。了解Web用户的访问行为不仅有助于提高个性化服务质量和用户体验，而且在网络管理和早期威胁检测中也起着重要作用。点击流识别是用户行为分析的基本问题。但是，大多数现有方法都是针对非加密的HTTP请求而设计的，并且仅专注于服务器端方案，这使它们不适用于日益流行的HTTPS和网络端管理。在这项工作中 我们从网络方的角度提出一种独立于加密的方案，该方案采用在网络边界收集的Web流量来识别Web用户的点击操作所产生的HTTP（S）请求。所提出的方案采用隐马尔可夫模型（HMM）来描述点击和非点击网络流量的时变行为。将深度神经网络（DNN）集成到HMM中以捕获Web流量的上下文，从而消除了传统HMM的独立性假设所造成的限制。最后，提出了一种基于DNN的后分类器，根据HTTP（S）请求与基于HMM的行为模型之间的契合度来确定HTTP（S）请求的类型。我们推导用于模型学习和点击识别的算法。进行实验以验证所提出的方法。讨论了与性能相关的问题和比较。结果表明，该方法的平均精度和召回率均超过92％，在性能和稳定性方面优于大多数现有基准方法。