Https malicious encrypted traffic detection method and system based on machine learning

Abstract

The invention provides an https malicious encrypted traffic detection method and system based on machine learning, and belongs to the field of malicious encrypted traffic detection. The detection method comprises the following steps: data preprocessing: preprocessing flow data to obtain a quadruple feature vector of the flow data; malicious flow detection: inputting the tetrad feature vector of the flow data into the trained random forest model, and detecting to obtain the malicious probability of the flow data. processing the traffic data into a quadruple feature vector, and inputting the quadruple feature vector into the trained random forest model for detection to obtain a malicious probability of the traffic data, thereby realizing rapid online detection of malicious traffic. The detection system comprises: a data preprocessing unit used for preprocessing flow data to obtain a quadruple feature vector of the flow data; and the malicious flow detection unit which is used for inputting the quadruple feature vector of the flow data into the trained random forest model and detecting the malicious probability of the flow data. The system applies the method.

Description

technical field [0001] The present invention relates to the field of detection of malicious encrypted traffic, in particular to a distributed detection method of https malicious encrypted traffic based on machine learning and a distributed detection system of https malicious encrypted traffic based on machine learning. Background technique [0002] In recent years, with the full popularity of https, in order to ensure communication security and privacy, more and more network traffic has begun to use https encryption. As of today, more than 65% of network traffic has been encrypted using https. The introduction of https is mainly to deal with various eavesdropping and man-in-the-middle attacks, to establish a uniquely secure channel on an insecure network, and to add data packet encryption and server certificate verification. However, with the increase of encrypted network traffic in all the Internet, malware has also begun to use https to protect its communication. Currently...

AI Technical Summary

Problems solved by technology

The problem with using an interceptor is that it's expensive, computationally demanding, while causing network performance degradation, and it doesn't respect the original idea of ​​https to have private and secure communication

[0004] In a real environment, the daily https encrypted traffic data is generally massive. In a stand-alone environment, it takes a long time to process and cache the traffic data, and the data processing efficiency is low. The detection time lags behind in this process, and it cannot be resolved quickly after the occurrence of malicious traffic.

Images