Purpose-based malicious encrypted traffic identification method and device

Abstract

The invention provides a purpose-based malicious encrypted traffic identification method and device, and the method comprises the steps: obtaining target encrypted traffic and the traffic characteristics of the target encrypted traffic, and enabling the target encrypted traffic to be encrypted traffic based on an SSL / TLS protocol and generated by a malicious program identified by a dynamic sandbox; sequentially performing parent program detection, malicious program detection, white site detection and black control end detection on the target encrypted traffic according to the traffic characteristics, and identifying the purpose of the target encrypted traffic; and determining whether the target encrypted traffic is malicious encrypted traffic or not according to the purpose of the target encrypted traffic. According to the invention, the purpose of the encrypted traffic is automatically identified, the malicious encrypted traffic is further identified according to the purpose of the encrypted traffic, and the identification efficiency and accuracy of the malicious encrypted traffic are improved.

Description

technical field [0001] The present invention relates to the technical field of information security, and more specifically, to a method and device for identifying malicious encrypted traffic based on usage. Background technique [0002] Malicious traffic identification is an important task in the field of computer network security. Its purpose is to judge whether there is malicious behavior based on network traffic data on the network boundary. If malicious behavior is found, security measures such as blocking are taken in time to ensure that end users network security. In recent years, with the widespread application of encrypted communication protocols, many malicious traffic has also begun to use encrypted communication. Since malicious behavior is hidden in encrypted data, it is difficult to identify malicious traffic, and malicious encrypted traffic has become a difficult problem and bottleneck in security monitoring. [0003] To study the detection of malicious encry...

AI Technical Summary

Problems solved by technology

Since malicious behavior is hidden in encrypted data, it is difficult to identify malicious traffic, and malicious encrypted traffic has become a difficult problem and bottleneck for security monitoring

[0003] To study the detection of malicious encrypted traffic, one must first determine the attack purpose of the samples using encrypted communication. At present, it is generally necessary to manually classify the attack purpose of encrypted traffic, and identify malicious encrypted traffic according to the attack purpose, which is inefficient and has low accuracy.

Images