Machine-learning-based flow identification technology

Abstract

The invention relates to a machine-learning-based flow identification technology. An identified object is an encrypted malicious flow. The provided machine-learning-based flow identification technology is not only mainly applied to the flow identification filed but also applied to the field of network attack detection in an assisted manner. The machine-learning-based flow identification technologyis characterized by establishing malicious encrypted flow identification model by using a machine learning algorithm and identifying a new flow by the model. The working flow of the novel technologyis as follows: lots of known attribute flow data are read; statistical characteristics of the flow are extracted and the extracted characteristics are used as attributes; a model is established by using a random forest algorithm; and then a newly inputted flow is identified by using the model. The identification process of the newly inputted flow is as follows: extracting statistical characteristics of the flow, inputting the statistical characteristics into the model for identification, and acquiring an identification result. According to the invention, the technology is oriented at the encrypted and coded flows and data participating in modeling are formed by normal encrypted flow and the malicious encrypted flow. At present, the existing non-encrypted flow identification technology is mature but the encrypted or coded flow identification can not be carried out easily; however, the invention provides a novel solution method for identification of the encrypted flow.

Description

technical field [0001] The present invention relates to the field of encrypted traffic identification and traffic statistical feature modeling. The main core is to collect the statistical features of a large number of traffic data samples, use the data to establish a machine learning model, and use the constructed model to identify malicious encrypted traffic. technical background [0002] At present, most traditional traffic identification technologies mainly rely on feature matching and are widely used in plaintext traffic identification. However, due to the encrypted or encoded malicious traffic, its related features cannot be directly extracted, so it is impossible to directly use the matching feature technology to detect and identify encrypted malicious traffic. The premise of traditional traffic identification technology to extract features is to decrypt encrypted traffic, but this involves the issue of privacy violations. The encryption of malicious traffic is to esca...

AI Technical Summary

Problems solved by technology

[0007] "A Malicious Encrypted Traffic Identification Technology Based on Machine Learning" is an invention proposed to solve the problem of identifying malicious traffic without decrypting encrypted traffic

The problem that feature matching cannot identify encrypted traffic lies in two points: the feature cannot be extracted, and the matching cannot be performed. In the present invention, statistical features solve the problem of feature extraction, and machine learning solves the problem of matching

Images