Encrypted traffic detection method and device, and storage medium

Abstract

The invention provides an encrypted traffic detection method and device, and a storage medium. The encrypted traffic detection method comprises the steps of obtaining an ip address of to-be-detected encrypted traffic; judging whether the ip address is an ip address in a preset malicious encrypted traffic information table or not; if the ip address is an ip address in a preset malicious encrypted traffic information table, determining that the encrypted traffic to be detected is malicious encrypted traffic; if the ip address is not an ip address in a preset malicious encrypted traffic information table, acquiring an issuing organization domain name in a public key certificate corresponding to the encrypted traffic to be detected; judging whether the domain name of the issuing mechanism is the domain name in the preset malicious encrypted traffic information table or not; if the issuing organization domain name is the domain name in the preset malicious encrypted traffic information table, determining that the encrypted traffic to be detected is malicious encrypted traffic. The detection method is used for realizing accurate and efficient detection of malicious encrypted traffic.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to a detection method and device for encrypted traffic, and a storage medium. Background technique [0002] At present, there are more and more network applications, and malicious encrypted traffic is becoming more and more common. Therefore, effective detection of malicious encrypted traffic is required to ensure the security of the network. [0003] In the existing technology, artificial intelligence algorithms such as random forest and neural network are used to analyze and learn the behavior of malicious encrypted traffic samples, build a detection model, and then use the detection model to detect unknown traffic to realize the detection of malicious encrypted traffic. [0004] In this detection method, it is difficult to obtain maliciously encrypted traffic samples, and it is difficult to build a detection model; and the recognition rate of models train...

AI Technical Summary

Problems solved by technology

[0004] In this detection method, it is difficult to obtain maliciously encrypted traffic samples, and it is difficult to build a detection model; and the recognition rate of models trained by different samples is quite different, and there are deviations, which makes the detection model unable to efficiently and accurately detect malicious encryption. flow

Images