加密流量中的恶意流量识别技术

网络流量的加密传输是互联网的发展趋势之一,而加密流量中的恶意流量识别是维护网络空间安全的重要手段.识别恶意流量需要将加密流量进行密/非密、应用程序以及加密算法的细粒度区分以提高识别效率,再将不同精细度区分后的流量经过预处理后转化为图像、矩阵和N-gram等形式导入机器学习训练模型中进行训练,实现良性/恶意流量的二分类以...

Research on malicious traffic identification technology in encrypted traffic

The encrypted transmission of network traffic is one of the development trends of the Internet.The identification of malicious traffic in encrypted traffic is an important way to maintain the security of cyberspace.One of the prior tasks of identifying malicious traffic is to classify encrypted traffic into the encrypted/unencrypted,different kinds of the application programs and encryption algorithms in order to improve the efficiency of identification.Then they are transformed into the image,matrix,n-gram or other forms which will be sent into the machine learning training model,so as to realize the binary classification and multi classification of benign malicious traffic.However,the machine learning based way relies seriously on the number and quality of samples,and can not effectively deal with the data after traffic shaping or confusion.Fortunately,cryptography based malicious traffic identification can search malicious keywords over encrypted traffic to avoid such problems,which must integrate searchable encryption technology,deep packet inspection and a provable security model to protect both data and rules.Finally,some unsolved problems of malicious traffic identification technology in encrypted traffic are presented.