Network traffic identification method and apparatus

Abstract

The embodiment of the invention provides a network traffic identification method and apparatus, and relates to the technical field of the Internet. The method comprises the following steps: identifying cloud service traffic in the received network traffic; determining traffic that satisfies a bridge keep-alive mechanism in the cloud service traffic to serve as the target traffic; extracting a feature value of the target traffic for a traffic feature in a traffic feature set; inputting the extracted feature value into a pre-trained anonymous network traffic identification model to identify whether the target traffic is anonymous network traffic, wherein the anonymous network traffic identification model is a random forest trained according to a part of traffics in a sample network traffic set and a part of traffics in the traffic feature set, the random forest comprises at least one decision tree, one node of the decision tree corresponds to one traffic feature, and the traffic featurecorresponding to the node has a value range. By application of the network traffic identification method provided by the embodiment of the invention, the workload in a network traffic identification process can be reduced, and the identification efficiency can be improved.

Description

technical field [0001] The present application relates to the technical field of the Internet, in particular to a method and device for identifying network traffic. Background technique [0002] With the rapid development of Internet technology, the Internet has entered the lives of most people, and people rely more and more on the Internet. In the process of communication based on the Internet, people pay more and more attention to the confidentiality of information in addition to the integrity and authenticity of information. There are more and more applications based on this anonymous communication network. [0003] However, while anonymous communication networks provide identity information protection for legitimate users, they may also be abused by illegal or criminal acts, which poses a huge threat to network security, especially traffic based on anonymous communication networks (referred to as anonymous network traffic). Masquerade as cloud service traffic to resist...

AI Technical Summary

Problems solved by technology

[0005] However, when identifying cloud service traffic based on node access analysis technology, it is necessary to track the cloud service traffic to know which nodes this network traffic has accessed through the network, and to perform statistical analysis on subsequent access nodes. During the network traffic, a large part of the network traffic has already been transmitted. It can be seen that the workload of network traffic identification using the above method is heavy, which leads to low identification efficiency and unsatisfactory blocking effect.

Images