Encrypted traffic identification method based on load adjacent probability model

Abstract

The invention discloses an encrypted traffic identification method based on a load adjacent probability model, and aims to provide a high-accuracy universal encrypted traffic identification method which utilizes a non-encrypted flow characteristic. The encrypted traffic identification method is technologically characterized by comprising the steps of first step, inputting a non-encrypted network traffic, counting a number of times in which message data load bytes are adjacent, selecting number points for differentiating a high-probability adjacent relationship and a low-probability adjacent relationship, and constructing an adjacent probability relationship model; a second step, inputting a network session traffic, extracting an adjacent characteristic and a random characteristic, and simultaneously acquiring a data random characteristic based on an information entropy; and a third step, transmitting the adjacent characteristics and the random characteristics of the non-encrypted traffic and the encrypted traffic as an input into a classification engine based on machine learning, and furthermore performing encrypted traffic identification based on the adjacent characteristic and the random characteristic of an unknown traffic. Compared with an existing principal encrypted traffic identification method, the encrypted traffic identification method has advantages of realizing universal identification on unknown encrypted protocol traffic and effectively improving identification accuracy.

Description

technical field [0001] The invention relates to a network traffic identification method, in particular to an encrypted traffic identification method based on a load adjacent probability model. Background technique [0002] Currently, more and more network protocols adopt encryption mechanism. On the one hand, communication encryption contributes to security and privacy protection, and on the other hand, it also becomes a barrier for criminals to evade security monitoring and management. Encrypted traffic identification is of great significance to the analysis of cybercrime behavior. [0003] Encryption is the process of converting plaintext into unrecognizable ciphertext, making it impossible for unauthorized people to identify and tamper with it. The essence of encrypted traffic is encrypted data generated by encryption protocol interaction. Encrypted traffic identification methods are mainly divided into two categories: (1) identification based on data payload features....

AI Technical Summary

Problems solved by technology

[0004] Aiming at the problem that in the existing encrypted traffic identification method, the encrypted traffic identification method based on data load feature identification cannot identify the encryption protocol that has not customized protocol identification rules, and the encrypted traffic identification method based on data randomness identification is not accurate enough, the present invention On the basis of the existing data randomness identification method, for the first time, the encrypted traffic identification is improved by using the load adjacent characteristics of non-encrypted network traffic, and an encrypted traffic identification method based on the load adjacent probability model is provided.

Images