A Classification Method of Encrypted Traffic Based on Classifier and Network Structure

Abstract

The invention discloses an encrypted traffic classification method based on a classifier and a network structure, belonging to the field of encrypted traffic identification. The steps are as follows: S1. Collect network traffic through the network traffic collection module; S2. Perform traffic data preprocessing through the traffic data preprocessing module; S3. Perform traffic aggregation through the traffic analysis module; S4. The traffic analysis module is used to calculate the cost matrix; S5, the classifier is trained through the classifier training and optimization module; S6, the classifier is optimized through the classifier training and optimization module. The invention can obtain higher performance in a shorter training time, and is suitable for class unbalanced data sets and encrypted traffic classification and recognition where feature extraction is difficult.

Description

technical field [0001] The invention relates to the field of encrypted traffic identification, in particular to an encrypted traffic classification method based on a classifier and a network structure. Background technique [0002] The rapid development of Internet technology, while bringing convenience to people's lives, will also be used by some criminals for illegal transmission, which has a great impact on the stability and security of cyberspace. People are paying more and more attention to network security issues. Therefore, global encrypted network traffic continues to soar. Although the traffic is encrypted before being transmitted, the security of the transmitted data is guaranteed, but it also increases the difficulty of traffic auditing. Without decryption technology, IT teams would not be able to view the information contained within the traffic. This means that encryption hides malicious traffic as well as other information, leading to a host of worms, trojans...

AI Technical Summary

Problems solved by technology

However, the distribution of incoming and outgoing network traffic in actual network gateways is very uneven. For example, audio and video streams carried by encrypted protocols are much larger than instant messaging and pure web encrypted streams.

Images