Multi-feature DNS (Domain Name System) and HTTPS (Hyper Text Transfer Protocol Security) combined malicious encrypted traffic identification method

Abstract

The invention relates to a multi-feature DNS (Domain Name System) and HTTPS (Hyper Text Transfer Protocol Security) combined malicious encrypted traffic identification method. The method comprises thefollowing steps: 1, extracting all sample DNS communication protocols in a learning network, analyzing a DNS communication protocol; 2, extracting all malicious / non-malicious HTTPS communication protocol handshake parts (non-encrypted contents) in the learning network, analyzing a handshake part of the HTTPS communication protocol; 3, extracting session related feature information of a malicious / non-malicious HTTPS protocol session, 4, correlating the DNS protocol with the HTTPS protocol related content; 5, extracting normal encrypted communication data features through data learning of normal encrypted traffic, 6, carrying out classification processing on the data by using a regression method, and 7, storing weight data to a persistent medium through a training result for subsequent use;8, performing feature extraction and substitution solution on the related encrypted traffic data in the current network by using the solution result.

Description

technical field

[0001] The invention relates to an identification method, in particular to a multi-feature DNS combined with HTTPS malicious encrypted traffic identification method, which belongs to the technical field of software encryption identification. Background technique

[0002] With the continuous development of encryption technology and the upgrading of computer security attack and defense technology, the content transmitted in plain text in the network is getting less and less, while the proportion of encrypted traffic is getting higher and higher. According to statistics, more than 60% of Internet transmission content currently uses encryption methods, among which HTTPS encrypted transmission accounts for the highest proportion; what follows is that unlike before, hackers often use encryption algorithms to encrypt the control commands and data they transmit, so as to evade the inspection of various anti-virus tools. This makes detection of such malicious network ...

Images