TLS协议恶意加密流量识别研究综述

随着5G时代的来临，以及公众对互联网的认识日益加深，公众对个人隐私的保护也越来越重视。由于数据加密过程中存在着恶意通信，为确保数据安全，维护社会国家利益，加密流量识别的研究工作尤为重要。针对TLS流量详细的阐述，分析了早期识别方法的改进技术，包括常见的流量检测技术、DPI检测技术、代理技术以及证书检测技术。介绍了选取不同TLS加密流量特征的机器学习模型，以及无需特征选择的深度学习模型等诸多最新研究成果。对相关研究工作的不足进行总结，并对未来技术的研究工作和发展趋势进行了展望。

TLS Malicious Encrypted Traffic Identification Research

With the advent of the 5G era and the increasing public awareness of the Internet, the public has paid more and more attention to the protection of personal privacy. Due to malicious communication in the process of data encryption, to ensure data security and safeguard social and national interests, the research work on encrypted traffic identification is particularly important. Therefore, this paper describes the TLS traffic in detail and analyzes the improved technology of early identification method, including common traffic detection technology, DPI detection technology, proxy technology, and certificate detection technology. It also introduces machine learning models for selecting different TLS encrypted traffic characteristics, as well as many recent research results of deep learning models without feature selection. The deficiencies of the related research work are summarized, and the future research work and development trend of the technology have been prospected.