VPN (Virtual Private Network) traffic quick recognition method for high-speed network

Abstract

The invention provides a VPN (Virtual Private Network) traffic quick recognition method for a high-speed network. The method comprises the following specific steps: model training and model use. During model training, traffic sampling collection is performed in a controllable network environment, related features capable of being used for VPN traffic recognition and classification after sampling are selected, and a small-scale traffic data training set is constructed for model training. When the model is used, traffic sampling is carried out in a high-speed network, long-flow traffic is filtered out through a Count Bloom Filter algorithm, statistical information is stored in a hash table through a link method, feature values are extracted according to the recorded statistical information, and traffic feature records are obtained and used for traffic detection. According to the method, the VPN traffic existing in the high-speed network can be quickly and accurately recognized, the agent tools used by the VPN traffic are classified, and the detection capability of the network traffic is effectively improved.

Description

technical field [0001] The invention belongs to the technical field of network space security, and relates to a high-speed network-oriented VPN traffic fast identification method. Background technique [0002] With the rapid development of information technology, the rapid expansion of the scale of the Internet, and the continuous increase of various types of network services, the issue of information security has attracted increasing attention. In order to ensure the security of data transmission, more and more traffic is transmitted after being encrypted. Encryption offers many benefits to users to ensure end-to-end confidentiality and confidentiality of data. While ensuring information security, encryption technology also allows malicious users to hide their information and whereabouts in this way, which brings new challenges to traffic auditing. [0003] As one of the main technologies for encrypting network traffic, virtual private network (VPN) technology is widely u...

AI Technical Summary

Problems solved by technology

The SSL VPN traffic identification method based on time-domain features and handshake protocol features takes continuous duration as the traffic feature, and the feature-enhanced VPN traffic identification method completes the feature extraction of the surge period according to the traffic density. These features have strong time Correlation, because different network states will lead to different traffic characteristics, it is easily affected by the network state of the sample traffic and thus affects the accuracy of recognition

The method of traffic characteristics based on density data extraction does not involve specific protocol content, and the identification of VPN traffic lacks strong pertinence, resulting in poor accuracy and practicability

There are also methods that use Bit-level DPI fingerprint generation technology. However, this method involves analyzing the plaintext in the payload of the data packet, which is not efficient in calculation and is not suitable for mass flow detection of high-speed networks. With the encryption protocol With the development of the TLS1.3 protocol and the widespread application of the TLS1.3 protocol, the plaintext fingerprint features that can be analyzed by DPI have rarely appeared, making this method unapplicable

In addition, there is another method for the identification of encrypted traffic protocols in VPN, using deep learning technology, but this method does not give a description of the identification process of VPN

Images