Encrypted traffic identification method, apparatus, device, and storage medium

Abstract

The application provides an encrypted traffic identification method and device, equipment and a storage medium, wherein the method comprises: identifying traffic to determine encrypted traffic, and sending the encrypted traffic to a corresponding hierarchical identification model for feature extraction and traffic source prediction, which can more finely identify and predict different types of encrypted traffic, effectively improving the identification rate of encrypted traffic and reducing the misidentification rate. Moreover, in the application, a hierarchical identification model is used to extract features from encrypted traffic, and identification is performed according to the features, avoiding the problem that existing identification technologies cannot be applied to all encrypted traffic, and improving the universality of different types of encrypted traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an encrypted traffic identification method and device, equipment and storage medium. BACKGROUND

[0002] Encrypted traffic transmission provides security for the privacy and integrity of data, and becomes an important means to ensure communication security and privacy. However, malicious traffic hides itself through encryption technology, which may bring great security risks to network security, so how to identify encrypted traffic through non-decryption means has become the focus of attention.

[0003] At present, there are many identification methods for encrypted traffic, such as port feature identification, fingerprint matching identification, statistical identification and machine learning identification.

[0004] However, port feature identification and fingerprint matching identification have great limitations and low applicability; statistical identification requires the experience of developers and is time-consuming and laborious; the existing machine learning has a high misidentification rate, so how to improve the identification efficiency of encrypted traffic has become a problem to be solved. SUMMARY

[0005] The present application aims to solve the problems of low identification efficiency and high misidentification rate of encrypted traffic in the prior art by providing an encrypted traffic identification method, device, equipment and storage medium.

[0006] To achieve the above-mentioned purpose, the technical scheme adopted by the present application is as follows:

[0007] In a first aspect, the present application provides an encrypted traffic identification method, which comprises:

[0008] Identifying traffic in a deep packet analysis engine to determine at least one encrypted traffic in the traffic, wherein the encrypted traffic is a data stream that cannot be identified as belonging to an application;

[0009] According to the protocol type of the encrypted traffic, a target layered identification model corresponding to the encrypted traffic is determined, wherein the target layered identification model is one of the layered identification models in a model set, and each layered identification model in the model set is used to identify the source of encrypted traffic of one protocol type.

[0010] The encrypted traffic is input into the target layered identification model, at least one traffic feature of the encrypted traffic is extracted, and a prediction result of the encrypted traffic is determined and output according to the traffic feature of the encrypted traffic, wherein the prediction result includes the application to which the encrypted traffic belongs.

[0011] Optionally, the inputting the encrypted traffic into the target hierarchical identification model, extracting at least one traffic feature of the encrypted traffic, and determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic comprises:

[0012] starting from receiving a first data packet of the encrypted traffic, obtaining N continuous data packets after the first data packet;

[0013] inputting the first data packet and the N data packets into the target hierarchical identification model, and extracting at least one traffic feature of the encrypted traffic according to the first data packet and the N data packets by the target hierarchical identification model, and determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic.

[0014] Optionally, the extracting at least one traffic feature of the encrypted traffic according to the first data packet and the N data packets by the target hierarchical identification model comprises:

[0015] performing feature extraction on the first data packet and the N data packets according to a preset feature type in the target hierarchical identification model by the target hierarchical identification model, determining a target feature corresponding to the feature type in the first data packet and the N data packets, and taking the target feature as the traffic feature of the encrypted traffic.

[0016] Optionally, the determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic comprises:

[0017] combining each traffic feature of the encrypted traffic into a traffic array according to a preset order by the target hierarchical identification model, and predicting the traffic array to obtain the prediction result of the encrypted traffic.

[0018] Optionally, the predicting the traffic array to obtain the prediction result of the encrypted traffic comprises:

[0019] predicting the traffic array by the target hierarchical identification model, and outputting a prediction value of the encrypted traffic;

[0020] if the number of the prediction value of the encrypted traffic is one, taking the prediction value as the prediction result of the encrypted traffic;

[0021] if the number of the prediction value of the encrypted traffic is multiple, determining the prediction result of the encrypted traffic according to a preset evaluation strategy and the multiple prediction values.

[0022] Optionally, the identifying traffic in the deep packet analysis engine to determine at least one encrypted traffic in the traffic comprises:

[0023] In the deep packet analysis engine, the traffic is screened to determine the application to which each of the traffic belongs;

[0024] If the application to which the traffic belongs is not identified, the deep packet analysis engine determines the traffic as the encrypted traffic.

[0025] Optionally, before the encrypted traffic is input into the corresponding target hierarchical identification model, the method comprises:

[0026] Feature extraction is performed on the sample traffic to obtain a plurality of sample traffic features of each of the sample traffic;

[0027] The plurality of sample traffic features of the sample traffic are combined into a sample feature set of the sample traffic;

[0028] The sample feature set is screened based on an adaptive feature selection algorithm to determine a target feature subset;

[0029] Model training is performed according to the target feature subset, and a test result of the trained model is determined;

[0030] If the test result meets a preset condition, the trained model is used as a hierarchical identification model corresponding to the protocol type to which the sample traffic belongs, otherwise, the trained model is modified and the steps of screening the sample feature set based on the adaptive feature selection algorithm to determine the target feature subset are re-executed.

[0031] In a second aspect, the present application provides an encrypted traffic identification device, the device comprising:

[0032] An identification module is configured to identify traffic in a deep packet analysis engine to determine at least one encrypted traffic in the traffic, wherein the encrypted traffic is a data stream that cannot identify the application to which it belongs;

[0033] A determination module is configured to determine a target hierarchical identification model corresponding to the encrypted traffic according to the protocol type of the encrypted traffic, wherein the target hierarchical identification model is one hierarchical identification model in a model set, and each hierarchical identification model in the model set is used to identify the source of encrypted traffic of one protocol type.

[0034] A prediction module is configured to input the encrypted traffic into the target hierarchical identification model, extract at least one traffic feature of the encrypted traffic, and determine and output a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic, wherein the prediction result comprises the application to which the encrypted traffic belongs.

[0035] Optionally, the prediction module is specifically configured to:

[0036] starting from receiving a first data packet of the encrypted traffic, obtaining N continuous data packets after the first data packet;

[0037] inputting the first data packet and the N data packets into the target hierarchical identification model, extracting at least one traffic feature of the encrypted traffic according to the first data packet and the N data packets by the target hierarchical identification model, and determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic.

[0038] Optionally, the prediction module is specifically configured to:

[0039] performing feature extraction on the first data packet and the N data packets according to a preset feature type in the target hierarchical identification model, determining a target feature corresponding to the feature type in the first data packet and the N data packets, and taking the target feature as the traffic feature of the encrypted traffic.

[0040] Optionally, the prediction module is specifically configured to:

[0041] combining each traffic feature of the encrypted traffic into a traffic array according to a preset order by the target hierarchical identification model, and performing prediction on the traffic array to obtain the prediction result of the encrypted traffic.

[0042] Optionally, the prediction module is specifically configured to:

[0043] performing prediction on the traffic array by the target hierarchical identification model, and outputting a prediction value of the encrypted traffic;

[0044] if the number of the prediction value of the encrypted traffic is one, taking the prediction value as the prediction result of the encrypted traffic;

[0045] if the number of the prediction value of the encrypted traffic is multiple, determining the prediction result of the encrypted traffic according to a preset evaluation strategy and the multiple prediction values.

[0046] Optionally, the identification module is specifically configured to:

[0047] performing screening on the traffic in the deep packet analysis engine to determine the application to which each traffic belongs;

[0048] if the application to which the traffic belongs is not identified, determining the traffic as the encrypted traffic by the deep packet analysis engine.

[0049] In a third aspect, the present application provides an electronic device, comprising a processor, a storage medium and a bus, the storage medium storing machine readable instructions executable by the processor, the processor and the storage medium communicating through the bus when the electronic device is running, and the processor executing the machine readable instructions to perform the steps of the encrypted traffic identification method described above.

[0050] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium storing a computer program, the computer program being executed by a processor to perform the steps of the encrypted traffic identification method described above.

[0051] The present application has the beneficial effect that by identifying the traffic to determine the encrypted traffic and sending the encrypted traffic to the corresponding hierarchical identification model for feature extraction and traffic source prediction, different types of encrypted traffic can be more finely identified and predicted, effectively improving the identification rate of encrypted traffic and reducing the misidentification rate. Moreover, the present application uses a hierarchical identification model to extract features from encrypted traffic and identify them according to the features, avoiding the problem that existing identification techniques cannot be applied to all encrypted traffic, improving the universality of different types of encrypted traffic. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0053] Figure 1 Fig. 1 shows an architecture schematic diagram of an encrypted traffic identification system provided by an embodiment of the present application;

[0054] Figure 2 Fig. 2 shows a flowchart of an encrypted traffic identification method provided by an embodiment of the present application;

[0055] Figure 3 Fig. 3 shows a flowchart of determining a prediction result provided by an embodiment of the present application;

[0056] Figure 4 Fig. 4 shows another flowchart of determining a prediction result provided by an embodiment of the present application;

[0057] Figure 5 Fig. 5 shows a flowchart of determining encrypted traffic provided by an embodiment of the present application;

[0058] Figure 6 Fig. 6 shows a flowchart of model training provided by an embodiment of the present application;

[0059] Figure 7 A flow chart of an adaptive feature algorithm provided by an embodiment of the present application is shown;

[0060] Figure 8 A structural schematic diagram of an encrypted traffic identification device provided by an embodiment of the present application is shown;

[0061] Figure 9 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0062] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application are only intended to illustrate and describe the present application, and are not intended to limit the protection scope of the present application. In addition, it should be understood that the schematic drawings are not drawn according to the actual proportions. The flow charts show the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flow charts can not be implemented in sequence, and the steps without logical context relationship can be reversed in sequence or implemented simultaneously. In addition, one or more other operations can be added to the flow charts or removed from the flow charts by those skilled in the art under the guidance of the content of the present application.

[0063] In addition, the described embodiments are only some of the embodiments of the present application, not all the embodiments. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0064] It should be noted that the term “comprising” will be used in the embodiments of the present application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0065] The existing encrypted traffic identification technology mainly includes:

[0066] Port feature identification, such as OpenVPN identification according to port 1194. However, port features are easy to disguise, and after disguise, they may not be identified;

[0067] Fingerprint matching is used, but only standard TLS protocol can have fingerprint features, many encrypted traffic does not have fingerprint features, so this method has great limitations;

[0068] Statistical identification method, feature mining stage needs to rely on the experience of developers, and is time-consuming and laborious;

[0069] Machine learning method, all use an algorithm model to analyze various traffic, so there is a high problem of misidentification rate.

[0070] Based on the above problems, the present application provides an encrypted traffic identification method, the execution subject can be an electronic device, such as Figure 1 As shown in the figure, the present application provides a system architecture schematic diagram, referring to Figure 1 , the obtained traffic data is preliminarily identified by using a deep packet analysis engine (Deep packet inspection, abbreviated as DPI), and the identified encrypted traffic is input into the corresponding hierarchical identification model to obtain the identification result of each encrypted traffic.

[0071] Next, combined with Figure 2 , the encrypted traffic identification method of the present application is further described, as shown in Figure 2 , the method comprises:

[0072] S201: identifying the traffic in the deep packet analysis engine to determine at least one encrypted traffic in the traffic, wherein the encrypted traffic is a data stream that cannot be identified as belonging to an application.

[0073] Optionally, the traffic can be a data packet or a data stream composed of multiple data packets, for example, the electronic device can obtain the traffic data generated in the user session process and analyze and identify the traffic data.

[0074] It is worth noting that the traffic data obtained by the electronic device can include encrypted traffic and non-encrypted traffic. For non-encrypted traffic, the deep packet analysis engine can directly identify the application and service to which the traffic data belongs, while the encrypted traffic cannot directly identify the application and service to which it belongs.

[0075] Optionally, the application to which the encrypted traffic belongs can be an application program to which the encrypted traffic belongs, and a service corresponding to the encrypted traffic, for example, the application program to which the encrypted traffic belongs can be WeChat, email, etc., and the service corresponding to the encrypted traffic can be chat, email, audio, video, etc.

[0076] S202: Determine the target layered identification model corresponding to the encrypted traffic according to the protocol type of the encrypted traffic, wherein the target layered identification model is one of the layered identification models in the model set, and each layered identification model in the model set is used for source identification of encrypted traffic of one protocol type.

[0077] Optionally, the encrypted traffic can be pre-classified according to its protocol type in the application, and the target layered identification model corresponding to the encrypted traffic is determined.

[0078] For example, the encrypted traffic detected by randomness can be classified into layered identification model 1, the encrypted traffic using the transmission control protocol (TCP) based OPENVPN tunnel protocol can be classified into layered identification model 2, the encrypted traffic using the user datagram protocol (UDP) based OPENVPN tunnel protocol can be classified into layered identification model 3, and the encrypted traffic using the secure shell protocol (SSH) tunnel protocol can be classified into layered identification model 4, and so on.

[0079] Optionally, the deep packet analysis engine can be connected to the model set, and the model set can include a plurality of layered identification models, each of which is used for source identification of encrypted traffic of one protocol type.

[0080] S203: Input the encrypted traffic into the target layered identification model, extract at least one traffic feature of the encrypted traffic, and determine and output the prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic, wherein the prediction result includes the application to which the encrypted traffic belongs.

[0081] Optionally, the traffic feature can be the feature data of each dimension of the encrypted traffic, such as uplink and downlink time interval, average load length of packet, load length variance, uplink window size, downlink window size, transport layer security (TLS) algorithm suite number, etc.

[0082] Optionally, the prediction result of the encrypted traffic can be the application to which the encrypted traffic belongs.

[0083] Optionally, the layered identification model can extract the traffic feature of the encrypted traffic, and determine the application to which the encrypted traffic belongs according to the traffic feature of the encrypted traffic.

[0084] In the embodiments of the present application, the encrypted traffic is determined by identifying the traffic, and the encrypted traffic is sent to the corresponding hierarchical identification model for feature extraction and traffic source prediction, so that different types of encrypted traffic can be more finely identified and predicted, effectively improving the identification rate of encrypted traffic and reducing the misidentification rate. In the present application, the hierarchical identification model is used to extract features for encrypted traffic, and the features are used for identification, which avoids the problem that the existing identification technology cannot be applied to all encrypted traffic, and improves the universality of different types of encrypted traffic.

[0085] Next, the step of inputting the encrypted traffic into the target hierarchical identification model, extracting at least one traffic feature of the encrypted traffic, and determining and outputting the prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic is described, as shown in Figure 3 The S203 step includes:

[0086] S301: Taking the first data packet of the received encrypted traffic as the starting point, the first N data packets after the first data packet are obtained.

[0087] Optionally, the encrypted traffic can be predicted in real time in the initial stage of traffic transmission. The first N data packets of the received encrypted traffic are first extracted and identified to improve the real-time performance of encrypted traffic identification. N can be a positive integer. The specific value of N can be set in advance. For example, N can be 19, which means that the electronic device can determine the application to which the encrypted traffic belongs by analyzing the first 20 data packets of the encrypted traffic.

[0088] For example, the first N data packets of the received encrypted traffic can be executed by the above S202-S203 steps to obtain the application to which the first N data packets belong.

[0089] S302: The first data packet and the N data packets are input into the target hierarchical identification model, and at least one traffic feature of the encrypted traffic is extracted by the target hierarchical identification model according to the first data packet and the N data packets, and the prediction result of the encrypted traffic is determined and output according to the traffic feature of the encrypted traffic.

[0090] As a possible implementation, when the protocol types of the current N data packets are the same, they can be input into the same hierarchical identification model to extract features of the data packets, obtain at least one traffic feature of the encrypted traffic, and determine and output the prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic.

[0091] As another possible implementation, when the current N data packet protocol types are different, they can be respectively input into the corresponding type of hierarchical identification model to extract features of the data packets, obtain at least one traffic feature of the encrypted traffic, and determine and output the prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic.

[0092] It should be noted that the encrypted traffic can correspond to multiple hierarchical identification models, and when the traffic feature of the encrypted traffic is extracted by multiple hierarchical identification models, each hierarchical identification model can identify and predict the encrypted traffic, and obtain the prediction result of the encrypted traffic in each hierarchical identification model.

[0093] It is worth noting that existing machine learning methods are usually faced with backtracking analysis scenarios, that is, the identification result cannot be given until all the traffic ends, while in actual application, it is necessary to detect the dark web traffic quickly to take corresponding alarm, blocking and other strategies.

[0094] In the embodiments of the present application, by extracting and identifying the first N data packets of the encrypted traffic, the effectiveness can be improved, and the encrypted traffic can be identified in the initial stage of traffic transmission to control it, effectively solving the timeliness problem in the prior art.

[0095] The following is a description of the steps of extracting at least one traffic feature of the encrypted traffic from the first data packet and N data packets by the target hierarchical identification model. The S302 step includes:

[0096] The target hierarchical identification model extracts features from the first data packet and N data packets according to the preset feature type in the target hierarchical identification model, determines the target feature corresponding to the feature type in the first data packet and N data packets, and takes the target feature as the traffic feature of the encrypted traffic.

[0097] Optionally, the preset feature type can be a feature type determined according to spatial dimension features and time dimension features of each traffic data.

[0098] For example, the preset feature type can include uplink and downlink time interval, average load length of message, load length variance, uplink window size, downlink window size, number of TLS algorithm suites, etc.

[0099] It is worth noting that the preset feature types in different hierarchical identification models can be the same or different. For example, the feature type in the hierarchical identification model 1 can be 20, and the feature type in the hierarchical identification model 2 can be 33. The number of feature types in each hierarchical identification model is not limited in the present application.

[0100] Next, the step of determining and outputting the prediction result of the encrypted traffic according to the traffic characteristics of the encrypted traffic is described. The step S203 includes:

[0101] The traffic characteristics of the encrypted traffic are combined into a traffic array according to a preset order by the target hierarchical identification model, and the traffic array is predicted to obtain the prediction result of the encrypted traffic.

[0102] Optionally, the target hierarchical identification model can combine the traffic characteristics of the encrypted traffic to obtain the traffic array of the encrypted traffic.

[0103] It is worth noting that if the encrypted traffic includes multiple protocol types, i.e., is sent into multiple hierarchical identification models, then the encrypted traffic can be extracted from multiple traffic characteristics in multiple hierarchical identification models, and the traffic characteristics are combined according to the preset order of each hierarchical identification model to obtain the traffic array of the encrypted traffic in each hierarchical identification model, and each traffic array is predicted by each hierarchical identification model to obtain the prediction result of the encrypted traffic in each hierarchical identification model.

[0104] The step of predicting the traffic array to obtain the prediction result of the encrypted traffic is described as follows, as shown in FIG. 4, the step includes: Figure 4

[0105] S401: The target hierarchical identification model predicts the traffic array and outputs the prediction value of the encrypted traffic.

[0106] Optionally, the prediction value of the encrypted traffic can be the application to which the encrypted traffic belongs output by the hierarchical identification model.

[0107] Optionally, the hierarchical identification model can predict the traffic array and determine the application to which the encrypted traffic belongs.

[0108] As a possible implementation, the hierarchical identification model can also identify the service type to which the encrypted traffic belongs, such as chat service, email service, audio service, video service, etc.

[0109] S402: If the number of prediction values of the encrypted traffic is one, the prediction value is taken as the prediction result of the encrypted traffic.

[0110] Optionally, when the encrypted traffic is only sent to one hierarchical identification model for data prediction, the prediction value is the final prediction result.

[0111] S403: If the number of prediction values of the encrypted traffic is multiple, the prediction result of the encrypted traffic is determined according to a preset evaluation strategy and the multiple prediction values.

[0112] ​Optionally, when the encrypted traffic is sent to multiple hierarchical identification models for data prediction, the multiple predicted values can be calculated according to a preset evaluation strategy to determine the final prediction result.

[0113] For example, assuming that the encrypted traffic has multiple outputs as predicted values in multiple hierarchical identification models, the electronic device can determine the final prediction result, i.e., the application to which the encrypted traffic belongs, according to the correlation between the traffic characteristics of the encrypted traffic and each hierarchical identification model.

[0114] In the embodiments of the present application, by evaluating the predicted values of the encrypted traffic in the hierarchical identification models, the final prediction result of the encrypted traffic is determined, which can improve the accuracy of identifying the encrypted traffic.

[0115] The following describes the steps of identifying the traffic in the deep packet analysis engine and determining at least one encrypted traffic in the traffic, as shown in Figure 5 The S201 step includes:

[0116] S501: In the deep packet analysis engine, the traffic is filtered to determine the application to which each traffic belongs.

[0117] Optionally, the deep packet analysis engine, as a data packet filtering technology, can perform deep analysis on the data packet to determine the application type to which the data packet belongs.

[0118] It should be noted that after the deep packet analysis engine identifies the application type to which the data packet belongs, the electronic device can directly forward the traffic data.

[0119] S502: If the application to which the traffic belongs is not identified, the deep packet analysis engine determines the traffic as encrypted traffic.

[0120] Optionally, if the application to which the traffic belongs is not identified, it means that the traffic is encrypted traffic, and at this time, the traffic can be determined as encrypted traffic and the S202-S203 steps are executed to determine the application to which the encrypted traffic belongs by using the hierarchical identification model of the present application.

[0121] In the embodiments of the present application, the DPI engine is used to preliminarily filter the obtained traffic, and the encrypted traffic is identified in layers, which can quickly lock the encrypted traffic and improve the efficiency of identifying the encrypted traffic.

[0122] Next, the steps of training the hierarchical identification model using sample data before inputting the encrypted traffic into the corresponding target hierarchical identification model are described, as shown in Figure 6 Before the S203 step, the steps include:

[0123] S601: Feature extraction is performed on the sample traffic to obtain a plurality of sample traffic features of each sample traffic.

[0124] Optionally, the sample traffic can be sample data of encrypted traffic of different applications collected according to an implementation purpose of the configuration system.

[0125] Optionally, the DPI engine can be used to pre-classify the traffic type of the sample traffic, and the encrypted traffic sample data can be subjected to invalid data cleaning and sample data labeling, and the like, and the feature extraction operation in different dimensions is performed based on the cleaned encrypted traffic sample data, to obtain a plurality of sample traffic features of each sample traffic. The sample traffic features may, for example, include uplink time interval, average packet load length, load length variance, uplink window size, downlink window size, TLS algorithm suite number, and the like.

[0126] S602: The plurality of sample traffic features of the sample traffic are combined into a sample feature set of the sample traffic.

[0127] Optionally, the sample feature set can be a plurality of arrays obtained by combining the plurality of sample traffic features of the sample traffic in different preset orders.

[0128] S603: The sample feature set is filtered based on an adaptive feature selection algorithm to determine a target feature subset.

[0129] Optionally, the process of the adaptive feature selection algorithm can be as shown in Figure 7 Based on the adaptive feature selection algorithm, the optimal feature combination based on the current training sample and test sample can be selected from the sample feature set as the target feature subset.

[0130] S604: Model training is performed according to the target feature subset, and a test result of the trained model is determined.

[0131] Optionally, the model training of the encrypted traffic recognition can be performed using a plurality of machine learning algorithms according to the filtered feature subset, to generate a corresponding training model, and the test result of the model is determined.

[0132] Optionally, the test result of the model can be an evaluation result of the actual use effect of the model by a user or an electronic device.

[0133] S605: If the test result meets a preset condition, the trained model is taken as a hierarchical recognition model corresponding to the protocol type to which the sample traffic belongs, otherwise, the trained model is modified and the steps of filtering the sample feature set based on the adaptive feature selection algorithm to determine the target feature subset are re-executed.

[0134] Optionally, if the test result meets the preset condition, it can be understood that the actual use effect of the model meets the expectation, that is, the identification accuracy of the model for the encrypted traffic reaches the expected value, and then the trained model can be used as the hierarchical identification model corresponding to the protocol type of the sample traffic.

[0135] Optionally, if the test result does not meet the preset condition, that is, the identification accuracy of the model for the encrypted traffic does not reach the expected value, then the trained model can be corrected, and the steps of filtering the sample feature set based on the adaptive feature selection algorithm and determining the target feature subset are re-executed, and the feature selection and model iteration optimization are performed again until a satisfactory training model is obtained.

[0136] In the embodiments of the present application, the training model is obtained by training the encrypted traffic sample, and the trained model is corrected, which can improve the accuracy of the model for identifying different encrypted traffic.

[0137] Based on the same inventive concept, the embodiments of the present application also provide an encrypted traffic identification device corresponding to the encrypted traffic identification method. Since the principle of solving problems in the device of the embodiments of the present application is similar to the above-mentioned encrypted traffic identification method of the embodiments of the present application, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described here.

[0138] Referring to Figure 8 Fig. 1 is a schematic diagram of an encrypted traffic identification device provided by the embodiments of the present application, which includes an identification module 801, a determination module 802, and a prediction module 803, wherein:

[0139] The identification module 801 is configured to identify the traffic in the deep packet analysis engine to determine at least one encrypted traffic in the traffic, wherein the encrypted traffic is a data stream that cannot be identified as belonging to an application.

[0140] The determination module 802 is configured to determine a target hierarchical identification model corresponding to the encrypted traffic according to the protocol type of the encrypted traffic, wherein the target hierarchical identification model is one of the hierarchical identification models in the model set, and each hierarchical identification model in the model set is used for source identification of encrypted traffic of one protocol type.

[0141] The prediction module 803 is configured to input the encrypted traffic into the target hierarchical identification model, extract at least one traffic feature of the encrypted traffic, and determine and output a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic, wherein the prediction result includes an application to which the encrypted traffic belongs.

[0142] Optionally, the prediction module 803 is specifically configured to:

[0143] Start from the first packet of the encrypted traffic received, obtain N continuous packets after the first packet;

[0144] input the first packet and the N packets into the target hierarchical identification model, and the target hierarchical identification model extracts at least one traffic feature of the encrypted traffic according to the first packet and the N packets, and determines and outputs the prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic.

[0145] Optionally, the prediction module 803 is specifically configured to:

[0146] The target hierarchical identification model extracts features from the first packet and the N packets according to the preset feature type in the target hierarchical identification model, determines the target feature corresponding to the feature type in the first packet and the N packets, and takes the target feature as the traffic feature of the encrypted traffic.

[0147] Optionally, the prediction module 803 is specifically configured to:

[0148] The target hierarchical identification model combines each traffic feature of the encrypted traffic into a traffic array according to a preset order, and predicts the traffic array to obtain the prediction result of the encrypted traffic.

[0149] Optionally, the prediction module 803 is specifically configured to:

[0150] The target hierarchical identification model predicts the traffic array and outputs the prediction value of the encrypted traffic;

[0151] If the number of prediction values of the encrypted traffic is one, the prediction value is taken as the prediction result of the encrypted traffic;

[0152] If the number of prediction values of the encrypted traffic is more than one, the prediction result of the encrypted traffic is determined according to a preset evaluation strategy and the plurality of prediction values.

[0153] Optionally, the identification module 801 is specifically configured to:

[0154] In the deep packet analysis engine, the traffic is filtered to determine the application to which each traffic belongs;

[0155] If the application to which the traffic belongs is not identified, the deep packet analysis engine determines the traffic as encrypted traffic.

[0156] Optionally, the encrypted traffic identification device of the present application can further include a training module, configured to:

[0157] extract features from the sample traffic to obtain a plurality of sample traffic features of each sample traffic;

[0158] Combine the plurality of sample traffic features of the sample traffic into a sample feature set of the sample traffic.

[0159] The sample feature set is filtered based on an adaptive feature selection algorithm to determine the target feature subset;

[0160] The model is trained based on a subset of the target features, and the test results of the trained model are determined.

[0161] If the test results meet the preset conditions, the trained model will be used as the hierarchical identification model corresponding to the protocol type of the sample traffic; otherwise, the trained model will be corrected and the steps of filtering the sample feature set based on the adaptive feature selection algorithm to determine the target feature subset will be re-executed.

[0162] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0163] This application identifies encrypted traffic by analyzing traffic flow and then sends the encrypted traffic to a corresponding hierarchical identification model for feature extraction and traffic source prediction. This allows for more precise identification and prediction of different types of encrypted traffic, effectively improving the identification rate and reducing the false identification rate. Furthermore, this application uses a hierarchical identification model to extract features from encrypted traffic and identifies it based on these features, avoiding the problem that existing identification technologies are not applicable to all encrypted traffic and improving the universality for different types of encrypted traffic.

[0164] This application also provides an electronic device, such as... Figure 9 The diagram shown is a schematic representation of an electronic device structure provided in an embodiment of this application, including: a processor 91, a memory 92, and a bus. The memory 92 stores machine-readable instructions executable by the processor 91 (e.g., ...). Figure 8 The device includes the identification module 801, the determination module 802, the prediction module 803, and the corresponding execution instructions, etc. When the computer device is running, the processor 91 and the memory 92 communicate via a bus. When the machine-readable instructions are executed by the processor 91, the above-mentioned encrypted traffic identification method is processed.

[0165] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the encrypted traffic identification method described above.

[0166] Those skilled in the art can clearly understand the specific working process of the system and the device described above for the convenience and brevity of description, which can refer to the corresponding process in the method embodiment, and will not be repeated herein. In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented by other ways. The device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and the actual implementation can have another division, for example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some communication interface, device or module, which can be electrical, mechanical or other forms.

[0167] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. When the functions are realized in the form of software functional units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or say the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of software products, which are stored in a storage medium and include a plurality of instructions for making a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0168] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application.

Claims

1. A method for identifying encrypted traffic, characterized in that, The application relates to a method for identifying encrypted traffic in a deep packet analysis engine. The method comprises the following steps: identifying traffic in a deep packet analysis engine to determine at least one encrypted traffic in the traffic, wherein the encrypted traffic is a data stream that cannot be identified as belonging to an application; determining a target hierarchical identification model corresponding to the encrypted traffic according to a protocol type of the encrypted traffic, wherein the target hierarchical identification model is one hierarchical identification model in a model set, and each hierarchical identification model in the model set is used for source identification of encrypted traffic of one protocol type; inputting the encrypted traffic into the target hierarchical identification model, extracting at least one traffic feature of the encrypted traffic, and determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic, wherein the prediction result comprises an application to which the encrypted traffic belongs, and the traffic feature is characteristic data of each dimension of the encrypted traffic, and comprises at least one of the following: uplink and downlink time interval, average packet load length, load length variance, uplink window size, downlink window size, and secure transmission layer protocol algorithm suite number; the step of inputting the encrypted traffic into the target hierarchical identification model, extracting at least one traffic feature of the encrypted traffic, and determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic comprises the following steps: starting from a first data packet received in the encrypted traffic, obtaining continuous N data packets after the first data packet; 2. The method of claim 1, wherein, inputting the first data packet and the N data packets into the target hierarchical identification model, and extracting at least one traffic feature of the encrypted traffic according to the first data packet and the N data packets by the target hierarchical identification model, and determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic. the step of extracting at least one traffic feature of the encrypted traffic according to the first data packet and the N data packets by the target hierarchical identification model comprises the following steps:

3. The method of claim 1, wherein, extracting features of the first data packet and the N data packets according to a preset feature type in the target hierarchical identification model by the target hierarchical identification model, determining target features corresponding to the feature type in the first data packet and the N data packets, and taking the target features as the traffic feature of the encrypted traffic. the step of determining and outputting a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic comprises the following steps:

4. The method of claim 3, wherein, combining each traffic feature of the encrypted traffic into a traffic array according to a preset order by the target hierarchical identification model, and predicting the traffic array to obtain the prediction result of the encrypted traffic. the step of predicting the traffic array to obtain the prediction result of the encrypted traffic comprises the following steps: predicting the traffic array by the target hierarchical identification model to output a prediction value of the encrypted traffic; if the number of the prediction value of the encrypted traffic is one, taking the prediction value as the prediction result of the encrypted traffic; if the number of the prediction value of the encrypted traffic is multiple, determining the prediction result of the encrypted traffic according to a preset evaluation strategy and the multiple prediction values.

5. The method of claim 1, wherein, The identifying the traffic in the deep packet analysis engine comprises: In the deep packet analysis engine, screening the traffic to determine the application to which each of the traffic belongs; If the application to which the traffic belongs is not identified, the deep packet analysis engine determines the traffic as the encrypted traffic.

6. The method according to any one of claims 1 to 5, characterized in that, Before the inputting the encrypted traffic into the target layered identification model, comprising: Extracting features of sample traffic to obtain a plurality of sample traffic features of each of the sample traffic; Combining the plurality of sample traffic features of the sample traffic into a sample feature set of the sample traffic; Screening the sample feature set based on an adaptive feature selection algorithm to determine a target feature subset; Model training according to the target feature subset, and determining a test result of the trained model; If the test result meets a preset condition, the trained model is used as a layered identification model corresponding to the protocol type to which the sample traffic belongs, otherwise, the trained model is modified and the steps of screening the sample feature set based on the adaptive feature selection algorithm to determine the target feature subset are re-executed.

7. An encrypted traffic identification apparatus characterized by comprising: Comprising: An identifying module configured to identify traffic in a deep packet analysis engine to determine at least one encrypted traffic in the traffic, wherein the encrypted traffic is a data stream that cannot identify the application to which it belongs; A determining module configured to determine a target layered identification model corresponding to the encrypted traffic according to the protocol type of the encrypted traffic, wherein the target layered identification model is one of a plurality of layered identification models in a model set, and each of the plurality of layered identification models in the model set is used to identify the source of encrypted traffic of one protocol type; A predicting module configured to input the encrypted traffic into the target layered identification model, extract at least one traffic feature of the encrypted traffic, and determine and output a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic, wherein the prediction result includes the application to which the encrypted traffic belongs, and the traffic feature is feature data of each dimension of the encrypted traffic, including at least one of the following: uplink and downlink time interval, average packet load length, load length variance, uplink window size, downlink window size, and Secure Sockets Layer (SSL) algorithm suite number. The predicting module is configured to: Take the first data packet of the encrypted traffic as the starting point, and obtain N consecutive data packets after the first data packet; Input the first data packet and the N data packets into the target layered identification model, and extract at least one traffic feature of the encrypted traffic according to the first data packet and the N data packets by the target layered identification model, and determine and output a prediction result of the encrypted traffic according to the traffic feature of the encrypted traffic.

8. An electronic device, comprising: Comprising: A processor, a storage medium storing program instructions executable by the processor, and a bus for communication between the processor and the storage medium when the electronic device is running, the processor executes the program instructions to perform the steps of the encrypted traffic identification method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer readable storage medium storing a computer program, the computer program being executed by a processor to perform the steps of the encrypted traffic identification method according to any one of claims 1 to 6.

Images