Dark network user behavior detection method and system based on network traffic

Abstract

The invention discloses a dark network user behavior detection method and system based on network traffic, and relates to the field of computer network security. Analysis and research are carried outon user behaviors in four mainstream dark networks of Tor, I2P, ZeroNet and Freenet. User behaviors are divided into eight classes, and a hierarchical classification model is trained by establishing adark network data collection environment, collecting real dark network flow data, extracting flow characteristics in the data. According to the method, model training is carried out by adopting a hierarchical classification method, and the method is good in performance in dark network traffic identification scenes of four dark network types and 25 user behaviors and has relatively high accuracy.Meanwhile, the base classifiers in the hierarchical classifiers are independent of each other and do not interfere with each other, so that the method and the system have good expandability and can adapt to dark network environments with different ages. The system can be deployed at a flow outlet of an actual production environment and linked with an IDS and a firewall, and a solution is providedfor control and traceability of a dark network.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a method and system for detecting dark network user behavior based on network traffic. Background technique [0002] Darknet refers to a network that can only be accessed through special configurations, software, authorization, or non-standard communication protocols and ports, but cannot be accessed through ordinary browsers or search engines. The server address and data transmission of the dark web are usually anonymous and invisible. With the maturity of various dark web service protocols, the dark web has gradually become a "hotbed" for terrorism and crimes. At the same time, due to the technical structure of the dark web The anonymity of the Internet also makes it a platform for the circulation of various political intelligence and private data. In view of the danger and high value of the dark web, the analysis of dark web traffic has gradually become the focus of r...

AI Technical Summary

Problems solved by technology

Using the differences in network traffic characteristics, a good dark network user behavior detection model can be established, thereby solving the problem of high concealment of dark network traffic on the Internet and difficulty in building a comprehensive network security system

Images