Training method of traffic detection model, traffic detection method, device and equipment

Abstract

The present application provides a training method for a traffic detection model, a traffic detection method, an apparatus and equipment, and relates to the technical field of information security. The training method of the traffic detection model uses two branch networks to predict encrypted information and abnormal traffic respectively, so that the prediction of abnormal traffic does not depend on the predicted result of encrypted information, even if the predicted result of encrypted information is wrong, it will not affect the abnormal traffic. The prediction of traffic has a direct impact, but multi-task joint optimization will be achieved through model training, thereby improving the accuracy of abnormal traffic detection.

Description

technical field [0001] The present application relates to the technical field of information security, and in particular, to a training method of a traffic detection model, a traffic detection method, an apparatus and equipment. Background technique [0002] To ensure network security, in some application scenarios, the data traffic transmitted in the network can be detected to determine whether there is data in the data stream, such as viruses and attack packets, that may affect network security. An existing detection method is to parse and obtain plaintext features carried in the data stream, and perform feature comparison to detect whether the data stream is abnormal traffic. [0003] However, with the popularization of encrypted transmission technologies such as the Secure Sockets Layer (SSL) protocol and the Transport Layer Security (TLS) protocol, there is still a large amount of encrypted data in the network. The attacker forges the encrypted data in the data stream,...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the embodiments of the present application is to provide a traffic detection model training method, traffic detection method, device, and equipment to improve the inability to perform anomaly detection on encrypted data packets in the prior art, so that the accuracy of anomaly detection is not high The problem

Images