Malicious encrypted traffic detection method and system based on behavior analysis

Abstract

The invention provides a malicious encrypted traffic detection method and system based on behavior analysis, and the method comprises the steps: carrying out the feature analysis of network traffic data after the network traffic data is obtained, and obtaining a feature sequence based on a session; and inputting the feature sequence into a detection model to obtain a detection result score, and determining whether the network traffic is malicious encrypted traffic or not according to the detection result score. According to the method, behavior characteristic analysis is carried out on the network traffic data, so that normal encrypted traffic in the network can be effectively filtered, malicious encrypted traffic is identified, and the false alarm rate is reduced. Meanwhile, through a detection model constructed in a machine learning mode, unknown data characteristics can be deduced according to known samples, and whether the network traffic data is malicious encrypted traffic or notis accurately judged.

Description

technical field [0001] The present application relates to the technical field of traffic detection, and in particular to a method and system for detecting malicious encrypted traffic based on behavior analysis. Background technique [0002] Encrypted traffic refers to network traffic encrypted by a specific encryption algorithm, which aims to protect the security of Internet traffic, so that user data and privacy cannot be easily obtained by criminals. However, malicious network traffic can also be transmitted through encryption algorithms, and cannot be detected by protective measures such as firewalls and security gateways, so as to launch attacks on target devices and steal target user information. Therefore, how to effectively identify malicious encrypted traffic plays an important role in ensuring the security of user network data and maintaining user privacy. [0003] The same as the normal network traffic encryption method, in the malicious network traffic encryption...

AI Technical Summary

Problems solved by technology

[0005] This application provides a malicious encrypted traffic detection method and system based on behavior analysis to solve the problem of inaccurate traditional encrypted traffic detection results

Images