VPN flow identification method based on SSL encryption

Abstract

The invention relates to the field of encrypted flow identification, in particular to a VPN flow identification method based on SSL encryption. A Bit-level DPI fingerprint generation technology is adopted to identify SSL flow aiming at the problem of higher missing identification rate of the traditional SSL encrypted flow fingerprint identification method, and a bit signature is generated througha specific rule after preprocessing data, the running length of the bit signature is coded, an SSL state conversion machine is generated by using the coded bit signature to identify SSL flow, SSL VPNflow is identified by using a bidirectional GRU network flow identification model based on an attention mechanism on the basis of the identified SSL flow, and the SSL VPN flow is sent to the SSL stateconversion machine. The method at least comprises the steps of data set acquisition, data preprocessing, Bit-level DPI fingerprint generation, SSL flow identification, SSL flow set data preprocessing, SSL VPN encrypted flow identification and index result analysis.

Description

technical field [0001] The invention relates to the field of encrypted traffic identification, in particular to a VPN traffic identification method based on SSL encryption. Background technique [0002] The rapid development of Internet technology, while bringing convenience to people's lives, will also be used by some criminals for illegal transmission, which has a great impact on the stability and security of cyberspace. People are paying more and more attention to network security issues. Therefore, global encrypted network traffic continues to soar. Although the traffic is encrypted before being transmitted, the security of the transmitted data is guaranteed, but it also increases the difficulty of traffic auditing. Without decryption technology, IT teams would not be able to view the information contained within the traffic. This means that encryption hides malicious traffic as well as other information, leading to a host of worms, trojans and viruses. Therefore, ide...

AI Technical Summary

Problems solved by technology

[0006] Aiming at the deficiencies in the prior art, the present invention provides a VPN traffic identification method based on SSL encryption. The proposed method not only effectively solves the traditional SSL encrypted traffic fingerprint The recognition method has the problem of high missed recognition rate. At the same time, the improved deep learning model can extract very significant fine-grained features in network traffic, so as to more effectively capture the dependencies existing in network traffic.

Images