Unsupervised encrypted malicious flow detection method and apparatus, device and medium

Abstract

Embodiments of the invention provide an unsupervised encrypted malicious flow detection method and apparatus, a device and a medium. The method comprises the following steps that a needed data featureset is collected based on network flow; a bipartite graph between a client and a server is built by utilizing the collected data feature set; primary clustering is carried out on client and server nodes through a graph segmentation method; vectorization processing is carried out on the client and server nodes in a relatively large connected sub-graph in the primary clustering; vectorized data isclustered again by using a DBScan algorithm; and malicious flow and nodes are judged by utilizing a clustering result after re-clustering. By utilizing a graph-based unsupervised learning model, encrypted flow can be directly detected without priori knowledge and a labeling sample set; different types of clusters are obtained by carrying out binary segmentation on the graph; a large cluster is converted into small clusters; and the malicious flow is identified by performing check through flow characteristics. The method is simple and easy to operate.

Description

technical field [0001] The present disclosure relates to the technical field of traffic data detection, in particular to an unsupervised encrypted malicious traffic detection method, device, electronic equipment and storage medium. Background technique [0002] Network communication is an information application that almost all enterprises and individuals will involve. As enterprises and individual users pay more and more attention to information security, there are more and more usage scenarios of encryption technology in network communication. That is, the communication content cannot be identified by other users on the network except the communication parties through the encryption method. [0003] At the same time, when various malicious programs such as network Trojan horses and worms communicate with the control terminal, in order to avoid the identification of network detection equipment, they often use encrypted traffic communication. This causes the problem that n...

AI Technical Summary

Problems solved by technology

[0006] (1) Model training relies on a large number of black samples, and the insufficient number of samples may lead to inaccurate detection models obtained through training;

[0007] (2) Relying on expert knowledge to analyze and extract traffic features, if the expert experience is unreliable, there may be major problems in the final classification results;

[0008] (3) Because it is based on previous experience and knowledge, the detection ability for new attack samples is relatively poor;

Images