Encrypted malicious traffic identification method, equipment and device

Abstract

The invention discloses an encrypted malicious traffic identification method, equipment and device, and the method comprises the steps: separating encrypted to-be-detected network traffic from networktraffic, and dividing the to-be-detected network traffic into a plurality of traffic packets according to a time sequence, wherein the traffic packets are learned and judged through a first neural network to obtain time sequence features and / or space features of each flow packet; summarizing the time sequence features and / or the space features of all the flow packets into summarized features according to a time sequence, and obtaining the summarized time sequence features of the flow to be detected from the summarized features through learning judgment by a second neural network; and comparing the to-be-detected traffic summary time sequence feature with a preset normal traffic summary time sequence feature to judge whether the to-be-detected network traffic is a malicious feature or not.According to the method, the space and time characteristics of the flow are learned by adopting the neural network, a multi-flow network flow processing mode is introduced, behavior characteristics between flows are fully considered, and the accuracy of malicious flow identification can be more accurate.

Description

technical field [0001] The present application relates to the technical field of malicious traffic analysis, and more specifically, relates to a method, device and device for identifying encrypted malicious traffic. Background technique [0002] With the rapid development of the Internet and the wide application of encryption technology, the proportion of encrypted traffic continues to increase. Relevant agencies predict that more than 80% of enterprise network traffic will be encrypted, of which more than 70% of malicious network traffic will be hidden, and network security issues will be severely tested. How to identify encrypted malicious traffic is a difficult problem faced by regulators and legitimate users. [0003] Encrypted malicious traffic usually uses the same security protocol as normal traffic, which can evade traditional traffic detection technologies during traffic transmission, bringing new challenges to encrypted traffic detection. Most of the existing tra...

AI Technical Summary

Problems solved by technology

In the traditional field of machine learning, the quality of feature engineering often directly determines the effect of machine learning. It usually requires manual extraction and selection of features based on expert experience. However, due to subjectivity, feature engineering inevitably leads to inaccurate selected features. The problem affects the subsequent machine learning effect

How to design a malicious traffic identification method that can efficiently and accurately identify whether the traffic behavior is abnormal and avoid the problem of inaccurate features caused by subjective selection of features has become an urgent problem to be solved

Images