User behavior detection method and system based on remote desktop encryption network traffic mode difference

Abstract

The invention provides a user behavior detection method and system based on remote desktop encrypted network flow mode difference, and the method comprises the steps: obtaining the network flow from aremote desktop client to a remote desktop server, and dividing the network flow into independent network flows; dividing each network flow into a plurality of flow spikes, and obtaining a vectorizeddata set according to the packet length sequence and the packet arrival time sequence of each flow spike; and sending the data set to a user behavior detection model, and obtaining a coarse-grained behavior and a fine-grained action of the remote desktop client. According to the method, the encrypted traffic does not need to be decrypted, and the coarse-grained behavior and the fine-grained actionof the user can be detected only by utilizing the packet length sequence and the arrival time sequence of the traffic to extract the statistical characteristics.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a user behavior detection method and system based on differences in remote desktop encrypted network traffic patterns. Background technique [0002] Remote desktop is a technology for remotely controlling other computers through the Internet. This technology is widely used in remote office, remote assistance, remote management and other fields. Typical remote desktop software will capture the control commands issued by the user on the client, and then send the control commands to the controlled host; the controlled host will interactively feed back the graphical results to the client after executing the command. While this real-time interactive working mode brings convenience to users, it also leads to serious privacy leakage problems. In order to prevent the leakage of user behavior privacy, the remote desktop developer will encrypt the network communication flow bet...

AI Technical Summary

Problems solved by technology

[0004] Although there are many studies on side-channel and encrypted traffic classification, these works pay little attention to the privacy leakage of user behavior on remote desktop encrypted traffic.

R.Altschaffel proposed a machine learning method based on statistical features to distinguish TeamViewer's file transfer, voice conference, video conference, text chat and regular conversational network traffic, but the shortcoming of this work is that the five types of actions studied are too coarse, and The four types of actions, file transfer, audio conference, video conference, and text chat, have little to do with remote desktops, because these four types of actions basically do not involve the use of mouse and keyboard to manipulate remote hosts; and their methods are highly dependent on the remote desktop. The selected remote desktop software (TeamViewer) lacks experimental evidence for the behavior recognition effect on other remote desktop traffic, so it lacks universality

Images