Encrypted malicious traffic detection device and method supporting variable-length input

Abstract

The invention belongs to the technical field of network security, and discloses an encrypted malicious traffic detection device and method supporting variable-length input, and the device comprises anetwork traffic capturing module, a data preprocessing module, a one-dimensional convolutional neural network module, a pyramid pooling layer module, a full connection layer module, a classifier module, and a malicious traffic processing module. According to the invention, a pyramid pooling mechanism is introduced, so the detection mechanism has the capability of processing variable-length networkflow data, i.e., effective detection can be implemented when the network flow data of any dimension is input into the detection model; since the flow data does not need to be additionally processed,and the adopted data is the original flow data, the flow data is more completely and accurately reflected, and the problems of damage and loss of network data flow characteristics do not exist.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an encrypted malicious traffic detection device and method supporting variable-length input. Background technique [0002] With the rapid development of information and communication technology, network security issues have become increasingly prominent. In order to protect communication security, various encryption technologies are widely used in the communication process. However, traffic encryption also gives criminals an opportunity. Attackers use encryption technology to hide malicious intentions, evade detection systems, and carry out covert attacks. [0003] Due to the requirements of privacy protection, the current processing methods for encrypted traffic focus on malicious traffic detection without decryption, while machine learning, deep learning and other methods are favored by more and more enterprises and technical personnel due to their superio...

AI Technical Summary

Problems solved by technology

[0006] The core of the method for extracting data traffic characteristics and slicing original traffic for application feature engineering in the present invention is to transform variable-length network traffic data into a fixed length to match the input dimension requirements of the detection model. In this process, some loss is inevitable. Traffic characteristics, which in turn affect the detection accuracy of encrypted malicious traffic, propose a device and method for encrypted malicious traffic detection that supports variable-length input

Images