Malicious encrypted traffic detection method based on logistic regression enhancement model

Abstract

The invention provides a malicious encrypted traffic detection method based on a logistic regression enhancement model, which is used for improving recall ratio on the premise of ensuring malicious encrypted traffic detection precision ratio. The method comprises the following steps: acquiring a training sample set S' and a test sample set X '; constructing a classifier set H (x) based on logisticregression; training the classifier set H (x) based on logistic regression; and obtaining a detection result of the malicious encrypted traffic. According to the method, the malicious encrypted traffic existing in the encrypted network traffic is distinguished by optimizing a cost function and adopting an iterative enhancement model of a plurality of cost sensitive classifiers. The method is usedfor solving the technical problem that in the prior art, due to the fact that abnormal encrypted traffic data is far smaller than benign encrypted traffic, the recall ratio is difficult to improve onthe premise that the precision ratio is guaranteed.

Description

technical field [0001] The invention belongs to the technical field of cyberspace security, and relates to a method for detecting malicious encrypted traffic, in particular to a method for detecting malicious encrypted traffic based on an enhanced model of logistic regression, which can be used to detect malicious encrypted traffic under the condition of unbalanced traffic in a real environment. Background technique [0002] Malicious attacks occur frequently in the network environment, resulting in infringement of user privacy and a large amount of property loss. Malicious attacks are often accompanied by the generation of malicious traffic. By detecting malicious traffic in the network, malicious attacks in the network can be discovered in time, and corresponding defense measures can be taken. The existing main detection technologies are: 1) rule-based deep packet detection technology and content recognition technology; 2) using machine learning methods to build detection ...

AI Technical Summary

Problems solved by technology

[0009] The purpose of the present invention is to overcome the deficiencies in the prior art above, and propose a method for detecting malicious encrypted traffic based on an enhanced model of logistic regression, which is used to solve the problem in the prior art that abnormal encrypted traffic data is far less than benign encrypted traffic Caused by the technical problem that it is difficult to improve the recall rate under the premise of ensuring the precision rate

Images