Encrypted traffic identification method and device and equipment

Abstract

The invention discloses an encrypted traffic identification method and device and equipment, an AI model is used to identify encrypted traffic, and the training process of the AI model comprises the following steps: S100, establishing a plurality of primary AI training models related to different features of a data stream, and training the primary AI training models through the data stream; S200, fusing the primary AI training models by using a multi-model fusion set algorithm; S300, performing secondary AI training by using a supervised learning algorithm based on a fusion result of S200, and obtaining a secondary AI training model; and S400, when an output result obtained after target data flow flows through the secondary AI training model is out of a threshold range of a normal output result of the secondary AI training model, determining that the target data flow is malicious flow. The encrypted traffic is detected by using a multi-dimensional and multi-model method, and the problems of high false alarm rate and poor interpretability caused by dependence on a single AI model are well solved.

Description

technical field [0001] The present application relates to the technical field of malicious traffic analysis, and more specifically, relates to a method, device and equipment for identifying encrypted traffic. Background technique [0002] With the rapid development of the Internet and the wide application of encryption technology, the proportion of encrypted traffic continues to increase. Relevant agencies predict that more than 80% of enterprise network traffic will be encrypted, but the vast majority of network devices are helpless against encrypted traffic such as network attacks and malware. When attackers use SSL encrypted channels to complete the delivery and distribution of malware payloads and exploits, as well as the communication between infected hosts and command and control (C&C) servers, existing detection methods cannot identify them. Detection technology is still scarce, mainly for the following reasons: [0003] On the one hand, there are also behavioral ch...

AI Technical Summary

Problems solved by technology

[0003] On the one hand, there are also behavioral characteristics between malicious traffic and network flows. These characteristics have not been extracted due to the design structure of the detection device. Traditional rule-based detection methods cannot detect encrypted traffic. encrypted malicious traffic;

[0004] On the other hand, the traffic in the live network is very complex, and the detection by a single AI model has a high false alarm rate and poor explainability

[0005] Because AI can greatly improve the recognition accuracy and efficiency, the identification of malicious network traffic using AI methods has become a popular research topic in recent years. However, the traffic in the network is complex and diverse, and different data formats Network traffic often has different characteristics, and building an AI model requires a lot of training

Images