Malicious application detection method and device based on network flow, equipment and medium

Abstract

The invention provides a malicious application detection method and device based on network traffic, equipment and a storage medium. The method comprises the following steps: cleaning network trafficcollected by network access equipment according to a predetermined standard to obtain target traffic; based on the application fingerprint of the target flow, identifying a target application corresponding to the target flow; determining a source device corresponding to the target flow based on the identification flow of the indication address in the target flow; and extracting a first traffic feature from the target traffic, and determining whether the target application on the source device is a malicious application based on the first traffic feature. According to the malicious applicationdetection method and device, malicious application detection of the whole local area network is achieved from the macroscopic level of the local area network rather than the terminal without dependingon specific flow fields, static signatures, statistical characteristics and the like, and the malicious application detection efficiency and precision of the whole local area network are improved.

Description

technical field [0001] The present disclosure relates to the technical field of malicious application detection, and in particular to malicious application detection based on network traffic. Background technique [0002] In order to better protect the personal privacy and property security of mobile terminal users, the detection and identification of malicious applications (Application) is becoming more and more urgent. At present, more research begins to focus on the network traffic generated by malicious applications, and attempts to detect malicious applications from the perspective of network traffic. Among them, most malicious application detection technologies based on network traffic and machine learning algorithms rely too much on features, which may be specific traffic fields, static signatures, and statistical features, and it is extremely difficult to identify these effective features from network traffic. Malicious application detection based on deep neural net...

AI Technical Summary

Problems solved by technology

Among them, most malicious application detection technologies based on network traffic and machine learning algorithms rely too much on features, which may be specific traffic fields, static signatures, and statistical features, and it is extremely difficult to identify these effective features from network traffic

Malicious application detection based on deep neural network, because the model of deep neural network is generally deployed on the terminal side rather than the network side,

Images