Malicious encrypted traffic detection method and device

Abstract

The invention provides a malicious encrypted traffic detection method and device. The method comprises the following steps: building an encrypted graph through mining the incidence relation between encryption sessions in encrypted traffic, and converting single-stream isolation analysis into multi-stream collaborative analysis. Meanwhile, two types of attributes describing the encrypted malicious traffic are provided, one is credibility of evaluation based on handshake information, and the other is stationarity of evaluation based on a TLS record length sequence, and a credibility value and a stationarity value of an encrypted session to be evaluated are comprehensively analyzed and calculated through a graph attention network. The above values are input into a pre-trained feedforward neural network to obtain a maliciousness score so as to identify the encrypted malicious traffic. According to the invention, through mining the relationship between encrypted sessions, the detection of malicious encrypted traffic is more accurate, and the robustness is higher.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for detecting malicious encrypted traffic. Background technique [0002] Encrypted traffic on the web is increasing rapidly. Security protocols such as SSL (secure Socket Layer) and upgraded TLS (Transport Layer Security) are widely used to establish trusted encrypted connections, which effectively guarantee the confidentiality and integrity of network communications. Google's Transparency Report shows that more than 95% of traffic passing through Google is encrypted. Encryption as a security measure leaves a gray area of ​​traffic for attackers to hide their malicious activities, such as malware delivery, C&C channel (Command&Control Channel), and data backhaul. Related reports show that since 2019, the number of cyber attacks using encrypted channels to bypass traditional security controls has increased rapidly by 260%. Meanwhile, nearly a quarte...

AI Technical Summary

Problems solved by technology

[0008] Embodiments of the present invention provide a malicious encrypted traffic detection method and device to eliminate or improve one or more defects existing in the prior art, and to solve the problem that the prior art detects malicious encrypted traffic with large calculation and time overheads , relying too much on human expertise, paying too much attention to the statistical characteristics or data representation of a single stream leads to unsatisfactory detection results

Images