Malicious encrypted traffic detection method based on graph analysis

Abstract

The embodiment of the invention provides a malicious encrypted traffic detection method based on graph analysis, and relates to the technical field of network communication. The malicious encrypted traffic detection method based on graph analysis comprises the following steps: extracting features of marked encrypted traffic; training the GraphSAGE graph model by adopting the characteristics of the encrypted traffic; and extracting features of encrypted traffic to be detected, and inputting the trained GraphSAGE graph model to judge whether the encrypted traffic is malicious or not. According to the detection method, whether the encrypted traffic is malicious or not can be quickly and accurately judged, and the encrypted traffic does not need to be decrypted.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a method for detecting malicious encrypted traffic based on graph analysis. Background technique [0002] As the scale of Internet applications expands, the awareness of network security risk prevention continues to increase. More and more applications use encryption to protect private data, and the proportion of encrypted traffic in the network is getting higher and higher. At the same time, attackers also use encryption to hide their own information. Malicious codes using encrypted communication and malicious attacks on encrypted channels emerge in an endless stream, which brings great challenges to traditional rule-based traffic detection methods. [0003] Currently, there are two mainstream encryption traffic attack detection methods: detection after decryption and detection without decryption. Gateway devices in the industry mainly use the method of decrypting...

AI Technical Summary

Problems solved by technology

However, in the current network environment, with the introduction and use of port hopping technology, dynamic port technology, and tunnel technology, traffic detection methods based on quintuple information such as ports have been unable to meet the detection requirements.

Images