Encrypted traffic identification method based on ensemble learning

Abstract

The invention discloses an encrypted traffic identification method based on ensemble learning. The encrypted traffic identification method is characterized by comprising the following steps of: (1) collecting a data set; (2) preprocessing the data; (3) balancing the data set; (4) automatically extracting features; (5) identifying the flow; (6) and analyzing an obtained index result, selecting proper parameters, and optimizing a algorithm. According to the encrypted traffic identification method, the problem of model under-fitting or over-fitting caused by imbalance of sample categories is solved, the recognition rate is high, the false alarm rate is low, and the encrypted traffic identification method is suitable for encrypted traffic recognition of category imbalance and difficult featureextraction of the data set.

Description

technical field [0001] The invention relates to a method for identifying encrypted traffic based on integrated learning. Background technique [0002] Traffic classification and identification are the basis for improving network management and security monitoring, improving service quality, and also the prerequisite for network behavior such as network design and planning. With the rapid development of network technology, more and more network applications use encryption protocols to ensure the safe transmission of information in the network, and encrypted traffic occupies an increasing proportion of actual network traffic. However, due to the concealment of encrypted traffic, it often becomes the carrier of network attacks. In recent years, network security incidents have intensified. The reason for this is that network security issues have not received enough attention. Network attacks often use encrypted network traffic as a carrier to continuously attack the system netwo...

AI Technical Summary

Problems solved by technology

However, the data stream distribution of various encryption applications in the actual network is very uneven. For example, the audio and video streams carried by encrypted protocols are much larger than instant messaging and pure web encrypted streams, etc. The data streams of encryption protocols such as SSH and IPsec are far less than HTTPS protocol

Network application flow category imbalance refers to the imbalance in the number of category samples in the data set. Through training, these classification algorithms may ignore the flow samples of a few categories, resulting in underfitting, or pay attention to the differences of minority categories, resulting in overfitting

Images