Behavior-detection-based network traffic identification method and device

Abstract

The invention discloses a behavior-detection-based network traffic identification method and a behavior-detection-based network traffic identification device. The method comprises the following steps of capturing data packet information of network traffic, and performing TCP (transmission control protocol) session recombination to extract information of each TCP session stream respectively; extracting information about session statistical characteristics of the information of each TCP session stream according to session characteristics of Trojan communication, and establishing corresponding TCP session characteristic matrix information; optimally clustering the TCP session characteristic matrix information to generate optimally-clustered information by adopting a bacterial foraging optimization-based clustering method; obtaining information about the network traffic type of each TCP session stream according to the optimally-clustered information. According to the method and the device, the TCP session streams are extracted to a data packet of the network traffic, the information about the TCP session statistical characteristics is obtained according to the session characteristics of Trojan communication to generate the TCP session characteristic matrix information, and the bacterial foraging optimization-based clustering method is used for optimally clustering the TCP session characteristic matrix information to obtain the information about the network traffic types of the TCP session streams.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and device for realizing network traffic identification based on behavior detection. Background technique [0002] As hacker attacks become increasingly organized and profitable, Advanced Persistent Threat (APT) has become the biggest threat to the information systems of governments and major enterprises. Trojan horse, as one of the important links of various intrusions, has become the focus of research on security issues. According to the sampling monitoring results of CNCERT / CC in 2012, the number of domestic and foreign Trojan horse or bot control server IPs reached 286,977, and the number of overseas Trojan horse or bot control server IPs reached 73,286, an average increase of 13.1% and 56.9% respectively compared with 2011. increase. my country's important information systems are also facing serious threats of cyber attacks. [0003] Unlike other malicious softwar...

AI Technical Summary

Problems solved by technology

[0006] (2) The Trojan horse control terminal plays the role of resource requester in the communication, so the session uploads a large amount of data

Therefore, due to the influence of initial value selection and local optimum, once the initial value selection is unreasonable, the analysis results of using this type of algorithm for Trojan horse detection are often very unsatisfactory

[0010] To sum up, although the current behavior-based detection technology is the best choice for Trojan horse detection, it has limited information on session features, and the current processing methods for session feature information are limited in terms of initial value selection and local optimization. characteristics, which seriously affect the detection of Trojan horses by behavior-based detection technology

Images