Encrypted anonymous network traffic identification method

Abstract

The invention discloses an encrypted anonymous network traffic identification method. The method comprises the following steps: 1) extracting multi-granularity level characteristics of each flow filefrom an encrypted anonymous network flow data set, wherein the multi-granularity level characteristics comprise flow characteristics, packet characteristics, host behavior characteristics, TCP headerrelated characteristics and IP header related characteristics; 2) filtering the features obtained in the step (1), and filtering redundant features and features irrelevant to flow identification or features with the relevancy lower than a set threshold value; and 3) training an XGBoost model by utilizing the characteristics selected in the step 2), and then identifying the anonymous network traffic to be identified by utilizing the XGBoost model. The method is superior to the existing baseline identification method in the aspects of overall accuracy, precision rate, recall rate and F1 value onmodel performance.

Description

technical field [0001] The invention proposes an effective encrypted anonymous network traffic identification method. The method combines a new hybrid feature selection algorithm and extreme gradient boosting (XGBoost) classification algorithm, which belongs to the cross-technical field of combining machine learning and information security. Background technique [0002] As the Internet penetrates into all aspects of society, economy and politics, the situation of Internet security and privacy protection is becoming more and more severe. Traditional information encryption technology can protect the transmission content, but cannot hide the information, geographical location and communication method of the communicating parties. In this context, researchers have proposed a large number of encrypted anonymous network technologies. The more popular low-latency anonymous communication tools at this stage include Tor, I2P, and JonDonym. [0003] Although encrypted anonymous ne...

AI Technical Summary

Problems solved by technology

However, during the construction process of the C4.5 algorithm, the data set needs to be scanned and sorted multiple times in sequence, which leads to the inefficiency of the algorithm

At the same time, when selecting a split point, the C4.5 algorithm tends to choose the median of all values ​​of the corresponding attribute as the split threshold, which will also affect the final classification effect

Images