Encrypted traffic identification method and device based on characteristic self-learning

Abstract

The invention discloses an encrypted traffic identification method and device based on characteristic self-learning and is used for improving an identification rate of encrypted traffic in the prior art. The method comprises the steps of converting obtained current network traffic data packets into normalized numerical values or normalized gray values; storing the normalized numerical values corresponding to the current network traffic data packets in a text file; or generating a gray image according to the normalized gray values corresponding to the current network traffic data packets and storing the gray image in an image file; taking the text file or the image file as pre-trained test input of an encrypted traffic classifier; and identifying a traffic type of the current network traffic data packets through the encrypted traffic classifier.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and device for identifying encrypted traffic based on feature self-learning. Background technique [0002] With the continuous development and popularization of the network, it is required that the network supervisory agency can effectively identify, classify and control various network traffic, thereby greatly improving the effectiveness and security of network management. However, with the development of the network, the forms of traffic are ever-changing, which increases the complexity of traffic identification. Among them, encrypted traffic occupies a considerable proportion in the network, which brings new challenges to traffic identification. [0003] Drawbacks of existing traffic identification technologies include: [0004] 1. It is impossible to identify traffic using dynamic ports and commonly used protocol ports. In order to avoid detection and supervision, so...

AI Technical Summary

Problems solved by technology

[0004] 1. It is impossible to identify traffic using dynamic ports and commonly used protocol ports. In order to avoid detection and supervision, some application software will use hidden or counterfeit port numbers, such as changing to dynamic ports or commonly used protocol ports, which reduces the accuracy of port-based identification methods.

[0005] 2. The above method identifies traffic by performing feature matching on the application layer data of the data packet, but the content of the data packet of encrypted traffic cannot be accessed in plain text, making it impossible to extract features, and thus cannot be effectively identified

[0006] 3. Reverse cracking technology requires manual analysis based on experience, which is relatively labor-intensive and cannot achieve large-scale processing

[0007] 4. The features used in the existing technology need to be manually extracted and selected in advance based on experience

With the increase of traffic complexity, the labor cost caused by manual extraction and selection of features is too high, especially when the scale of traffic data is large, there is also the problem that the selected features are not accurate enough due to subjectivity

Images