Encrypted traffic identification and classification method and system based on direct push graph

Abstract

The invention discloses an encrypted traffic identification and classification method and system based on a direct push graph. The method comprises the following steps: firstly, collecting encrypted traffic data of a known category in a known network environment and encrypted traffic data of unknown label information in a cross-network environment; then, the collected network flow data is divided into single network sessions; aggregating sessions with the same address information to form a session cluster set; then, by taking session clusters in the session cluster set as node units, calculating feature similarity among nodes, and constructing relation edges among the nodes; constructing a direct push graph according to the relation edges between the node information and the nodes; and then, predicting category information of unknown nodes through an iterative'aggregation diffusion 'graph reasoning algorithm. The method can efficiently and stably identify and classify the network application traffic collected under the general network under the condition that the diversity of the network traffic training samples is insufficient, and identifies the new class of network application traffic data not contained in the training set.

Description

technical field [0001] The invention belongs to the field of network traffic management, relates to the identification and classification technology of encrypted network traffic, and in particular relates to a method and system for identifying and classifying encrypted traffic based on a direct inference graph. Background technique [0002] Encrypted traffic identification and classification technology is one of the main branches of network traffic management technology. This technology establishes identification models for different types of network application traffic by collecting traffic data generated by different network applications, so as to identify and classify the network applications to which the traffic to be measured belongs. With the gradual maturity of symmetric encryption and asymmetric encryption systems, network traffic generally uses standard TLS / SSL encryption technology for data encryption, which makes the data originally transmitted in plaintext opaque...

AI Technical Summary

Problems solved by technology

[0003] Due to the limitations of side channel information and learning models, the current mainstream intelligent encrypted traffic identification and classification technology cannot be well applied to actual deployment

The current training material for encrypted traffic identification and classification technology is the side channel information of encrypted traffic, which is unstable in different network environments, which leads to the fact that the single distribution learned by the model cannot adapt to the disturbed side channel. channel characteristic distribution

The current training and testing methods for encrypted traffic identification and classification models are to initialize the model in a known single network environment, and deploy and test the initialized model in different network environments, which also leads to a single distribution learned by the model Inability to adapt to perturbed side channel characteristic distribution

Therefore, the new intelligent encrypted traffic identification and classification technology has the following difficult challenges: Due to the complexity and uncertainty of the network topology, the current encrypted traffic identification and classification technology cannot guarantee stable universality

Under different network environments, due to unpredictable network fluctuations, network delays, network bandwidth and topology, the feature distribution of encrypted traffic from the same network application under the same group of feature vectors is easily disturbed. The unstable feature distribution makes the current The encrypted traffic identification and classification model initialized under a single network cannot achieve stable identification and classification results

Images