A method and system for identifying traffic encrypted by a transport layer security protocol

Abstract

A kind of identification method and system of transport layer security protocol encrypted traffic, comprising: obtaining detected encrypted traffic data;Data preprocessing is carried out based on the detected encrypted traffic data, and flow information is extracted and converted into histogram;The histogram is input into pre-trained classification model, and traffic classification is carried out, to realize the identification of encrypted traffic;Wherein, the pre-trained classification model is trained to convolutional neural network with the histogram as input, and the message type corresponding to the histogram is output to obtain.This application mainly aims at the network flow information of transport layer security protocol, and realizes encrypted traffic identification by extracting the features such as type, length, sequence and interaction of transport layer security protocol record.The network flow information can better reflect user behavior, and has better identification degree for different network applications.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and more specifically to a method and system for identifying encrypted traffic using transport layer security protocols. Background Technology

[0002] In recent years, the use of encryption technology in network traffic has surged, accounting for over 70% of network traffic. Given that encrypted network data cannot be directly decrypted and detected in many cases, encrypted communication security detection faces severe challenges in the field of network security. The most commonly used encryption technology in encrypted communication utilizes the Transport Layer Security (TLS) protocol to encrypt the communication process. The purpose of TLS is to establish an encrypted channel for information transmission between clients and servers. This protocol mainly consists of two layers: the TLS record protocol and the TLS handshake protocol.

[0003] There are currently three main types of encrypted communication identification technologies: rule detection based on plaintext features, model detection based on machine learning, and model detection based on deep learning.

[0004] Plaintext-based rule detection checks determine whether incoming traffic is malicious by matching the certificate fingerprints of X.509 certificates used by known malicious encrypted traffic with their domain names. Mature detection systems based on this method exist, such as Snort and Suricata. The advantage of this method is its ability to quickly detect known malicious traffic, but it cannot identify new or unknown threats. Specifically, when encrypted traffic uses session recovery, it does not contain certificates, making certificate fingerprint rules unsuitable for detection. Similarly, when encrypted traffic does not use DNS requests to obtain server addresses, domain name rules cannot be used for detection.

[0005] Cisco employs a supervised machine learning model to detect malicious encrypted traffic, leveraging the unique and diverse characteristics of network flow data. Featured data includes transport layer security protocol handshake metadata, DNS environment flows associated with encrypted traffic, and HTTP header information from HTTP environment flows originating from the same source network address within the past five minutes. This machine learning-based model detection represents a significant breakthrough in malicious encrypted communication detection technology.

[0006] Deep learning-based model detection involves training a deep learning model for detection. A representative example is gene mapping technology, which maps malicious code to grayscale images, builds a convolutional neural network deep learning model, and trains the convolutional neural network using a set of grayscale images to generate a detection model. This technology can effectively detect malicious traffic generated by malicious code packaged using specific packaging tools.

[0007] For identifying encrypted communication using transport layer security protocols, the aforementioned solutions exist. However, these methods present the following problems: First, some encrypted traffic data does not transmit certificates and domain names. Are there any other usable information besides certificate and domain name information? Second, are there better invariants to adapt to multiple versions of transport layer security protocols? Third, how can the interpretability of the detection results be further improved? Summary of the Invention

[0008] To address the questions of whether there are other usable information besides certificates and domain information, whether there are better invariants to adapt to multiple versions of transport layer security protocols, and how to further improve the interpretability of detection results, this invention proposes a method for identifying transport layer security protocol encrypted traffic, comprising:

[0009] Obtain the encrypted traffic data being detected;

[0010] Based on the detected encrypted traffic data, data preprocessing is performed to extract flow information and convert it into a histogram;

[0011] The histogram is input into a pre-trained classification model to classify traffic and identify encrypted traffic.

[0012] The pre-trained classification model is obtained by training a convolutional neural network with the histogram as input and the message type corresponding to the histogram as output.

[0013] Preferably, the training of the classification model includes:

[0014] A training set is constructed based on the histogram and the message type corresponding to the histogram;

[0015] The convolutional neural network is trained by using the histograms in the training set as input and the message types corresponding to the histograms as output.

[0016] Preferably, the convolutional neural network includes: an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer.

[0017] The input layer is used to crop the histogram to a set size and normalize it before outputting a color image matrix as the input data matrix, and at the same time, the input data matrix is ​​transmitted to the convolutional layer.

[0018] The convolutional layer is used to perform convolution operations from left to right and from top to bottom based on the input data matrix using a pre-set convolutional kernel and a pre-set stride to obtain convolutional features, and then transmit the convolutional features to the pooling layer.

[0019] The pooling layer is used to perform a pooling operation on the convolutional features from left to right and from top to bottom using a pre-set pooling kernel with a pre-set stride, outputting the maximum value of the area covered by the pooling kernel as the pooling result, and transmitting the pooling result to the fully connected layer.

[0020] The fully connected layer is used to fully connect each neuron in the fully connected layer with all neurons in the pooling layer, flatten the pooling result of the last layer of the pooling layer to obtain the neuron vector of the first layer of the fully connected layer, calculate the neuron vector of the second layer of the fully connected layer using the neuron vector of the first layer of the fully connected layer, calculate the neuron vector of the last layer of the fully connected layer in sequence, and pass the neuron vector of the last layer of the fully connected layer to the output layer.

[0021] The output layer is used to classify the neuron vectors of the last layer of the fully connected layer using the softmax function.

[0022] Preferably, the convolutional features are calculated using the following formula:

[0023]

[0024] In the formula, H i Let f(x) be the feature map of the i-th layer of the convolutional feature map, f(x) be the nonlinear activation function, and H be the feature map of the i-th layer. i-1 For the feature map of the (i-1)th layer of the convolutional feature, the operator... W represents the convolution operation between the convolution kernel and the image or feature map of layer i-1. i Let b be the weight vector of the i-th convolutional kernel. i This is the offset vector.

[0025] Preferably, the maximum value of the confluence core coverage area is calculated using the following formula:

[0026] H i+1 =max_pooling(H i )

[0027] In the formula, H i+1 H represents the maximum value of the confluence core coverage area. i Let be the feature map of the i-th layer of the convolutional features.

[0028] Preferably, the neuron vector is calculated using the following formula:

[0029]

[0030] In the formula, y i Let g(x) be the neuron vector of the i-th layer of the fully connected layer, g(x) be the neuron activation function, and y be the neuron activation function. i-1Let y0 be the neuron vector of the (i-1)th layer of the fully connected layer, and ω be the feature map obtained from the last pooling layer. l Let d be the weight vector of the l-th layer of the fully connected layer. l b is a randomly generated 0 or 1. l This is the offset vector.

[0031] Preferably, the softmax function is as follows:

[0032] Y = softmax(y ξ )

[0033] In the formula, Y is the probability distribution of each category label, y ξ This represents the neuron vector of the last layer in a fully connected layer.

[0034] Preferably, the step of performing data preprocessing based on the detected encrypted traffic data, extracting flow information and converting it into a histogram, includes:

[0035] Based on the detected encrypted traffic data, the message type, byte length, message transfer sequence, and interaction information of the transport layer security protocol record layer are extracted from the transport layer security protocol record layer.

[0036] The range of values ​​for the horizontal axis of the histogram is determined based on the message transfer sequence of the transport layer security protocol, and the range of values ​​for the vertical axis of the histogram is determined based on the byte length of the record layer of the transport layer security protocol.

[0037] In the two-dimensional coordinate system constructed from the horizontal and vertical coordinate ranges of the histogram, the message type of the transport layer security protocol record layer is represented by color, the byte length of the transport layer security protocol record layer is represented by height, the transport layer security protocol message transfer sequence is arranged in the histogram according to the interaction order, and the interaction of the transport layer security protocol record layer is represented by the positive and negative directions of the histogram, thereby realizing the extraction of stream information and its conversion into a histogram;

[0038] The stream information includes: the message type of the Transport Layer Security (TLS) record layer, the byte length of the TLS record layer, the TLS message transfer sequence, and the interaction information of the TLS record layer.

[0039] Based on the same inventive concept, the present invention also provides a system for identifying transport layer security protocol encrypted traffic, comprising:

[0040] The acquisition module is used to acquire the encrypted traffic data being detected.

[0041] The preprocessing module is used to perform data preprocessing based on the detected encrypted traffic data, extracting flow information and converting it into a histogram;

[0042] The classification module is used to input the histogram into a pre-trained classification model to classify traffic and identify encrypted traffic.

[0043] The pre-trained classification model is obtained by training a convolutional neural network with the histogram as input and the message type corresponding to the histogram as output.

[0044] Preferably, the preprocessing module includes:

[0045] The stream information extraction submodule is used to extract the message type, byte length, message transfer sequence, and interaction information of the transport layer security protocol record layer based on the detected encrypted traffic data.

[0046] The coordinate interval determination submodule is used to determine the range of values ​​for the horizontal coordinate of the histogram based on the message transfer sequence of the transport layer security protocol, and to determine the range of values ​​for the vertical coordinate of the histogram based on the byte length of the record layer of the transport layer security protocol.

[0047] The histogram conversion submodule is used to represent the message type of the Transport Layer Security Protocol (TLS) record layer with color, the byte length of the TLS record layer with height, arrange the TLS message transfer sequence in the histogram according to the interaction order, and represent the interaction of the TLS record layer with the positive and negative directions of the histogram in a two-dimensional coordinate system constructed from the horizontal and vertical coordinate ranges of the histogram, thereby realizing the extraction of stream information and conversion into a histogram.

[0048] The stream information includes: the message type of the Transport Layer Security (TLS) record layer, the byte length of the TLS record layer, the TLS message transfer sequence, and the interaction information of the TLS record layer.

[0049] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0050] A method for identifying encrypted traffic of a Transport Layer Security (TLS) protocol includes: acquiring detected encrypted traffic data; preprocessing the detected encrypted traffic data to extract flow information and convert it into a histogram; inputting the histogram into a pre-trained classification model to classify the traffic and identify the encrypted traffic; wherein the pre-trained classification model is obtained by training a convolutional neural network with the histogram as input and the message type corresponding to the histogram as output. Encrypted traffic identification is achieved by extracting features such as the type, length, sequence, and interaction of the TLS record layer. Compared with traditional techniques for identifying encrypted traffic based on handshake features during the TLS key negotiation phase, this invention is applicable to all versions of TLS and to encrypted traffic data using session recovery, while also improving the interpretability of the results. Attached Figure Description

[0051] Figure 1 This is a flowchart of a method for identifying encrypted traffic using a transport layer security protocol according to the present invention.

[0052] Figure 2 This is a flowchart of the deep learning recognition method for encrypted communication based on histograms according to the present invention. Detailed Implementation

[0053] To better understand this invention, the following description, in conjunction with the accompanying drawings and examples, further illustrates the invention. This invention proposes a method and system for identifying encrypted traffic from Transport Layer Security (TLS) protocols. It primarily targets network flow information from TLS protocols, achieving encrypted traffic identification by extracting features such as the type, length, sequence, and interactions of the TLS record layer.

[0054] Example 1:

[0055] A method for identifying encrypted traffic using a transport layer security protocol, the implementation process of which is as follows: Figure 1 As shown, it includes:

[0056] Step 1: Obtain the encrypted traffic data to be detected;

[0057] Step 2: Based on the detected encrypted traffic data, perform data preprocessing, extract flow information and convert it into a histogram;

[0058] Step 3: Input the histogram into the pre-trained classification model to classify traffic and identify encrypted traffic;

[0059] The following describes a method for identifying encrypted traffic using a transport layer security protocol according to the present invention, in conjunction with... Figure 2 A detailed introduction will be provided.

[0060] Before step 1, a dataset of encrypted traffic from a known type of transport layer security protocol is used as training data to train the convolutional neural network model. The parameters in the model can be trained using the traditional gradient descent method. The trained model can learn the features in the original data and perform feature extraction and classification.

[0061] The convolutional neural network includes an input layer, convolutional layers, pooling layers, fully connected layers, and an output layer. The parameters of each layer in the convolutional neural network architecture are shown in Table 1.

[0062]

[0063] Table 1 Convolutional Neural Network Architecture Parameters

[0064] The training of the convolutional neural network model includes:

[0065] Input layer: Preprocesses the histogram. The histogram is cropped to an appropriate size and normalized, outputting a 64*64*3 dimension color image, which serves as the input data for the convolutional neural network architecture, using a matrix... Let represent , where q∈[0,m], m is the number of input data for the model, and n*n*d represents the matrix structure.

[0066] Convolutional layer: Feature extraction is performed through convolution operations. The kernel size is preset to 3*3 and the stride is 1. The kernel performs convolution operations on the input data matrix from left to right and from top to bottom according to the stride size, and outputs convolutional features.

[0067]

[0068] In the formula, H i Let W be the feature map of the i-th layer. i Let i be the weight vector of the i-th convolutional kernel, and let the operators be... For convolution operations between the convolution kernel and the image or feature map of layer i-1, b i Let f(x) be the offset vector, and f(x) be the nonlinear excitation function.

[0069] Pooling layer: It performs maximum value merging on the input of the previous layer to achieve dimensionality reduction. The pooling kernel size is pre-set to 3*3 and the stride is 2. The pooling kernel performs the merging operation on the feature map from left to right and from top to bottom according to the stride. The maximum value of the region covered by the pooling kernel is output as the merging result.

[0070] H i+1 =max_pooling(H i )

[0071] In the formula, H i+1 To output the maximum value of the region covered by the merging kernel, H iLet be the feature map of the i-th layer.

[0072] Fully connected layer: Each neuron in the fully connected layer is fully connected to all neurons in the pooling layer, which can integrate local information with class discrimination in the convolutional layer or pooling layer. The pooling result of the last layer of the pooling layer is flattened to obtain the neuron vector of the first layer of the fully connected layer. The neuron vector of the second layer of the fully connected layer is calculated using the neuron vector of the first layer of the fully connected layer. The neuron vector of the last layer of the fully connected layer is calculated in sequence and then passed to the output layer.

[0073]

[0074] In the formula, y i (i = 0…n) is the neuron vector of the i-th layer of the fully connected layer, y i-1 Let y0 be the neuron vector of the (i-1)th layer of the fully connected layer, y0 be the tiled feature map obtained from the last layer of the pooling layer, and ω be the feature map vector of the (i-1)th layer of the fully connected layer. l Let d be the weight vector of the l-th layer of the fully connected layer. l b is a randomly generated 0 or 1. l Let g(x) be the offset vector, and g(x) be the neuron activation function.

[0075] Output layer: The vectors of the last neurons in the fully connected layer are passed to the output layer, and the softmax function is used for classification.

[0076] Y = softmax(y ξ )

[0077] In the formula, Y is the probability distribution of each category label, y ξ This is the output value of the last layer in the connection layer.

[0078] Step 1: Obtain the encrypted traffic data to be detected;

[0079] Step 2: Based on the detected encrypted traffic data, perform data preprocessing, extract flow information and convert it into a histogram, specifically for:

[0080] Based on the detected encrypted traffic data, the type, length, sequence, and interaction information of the Transport Layer Security (TLS) record layer are extracted. First, a protocol parsing tool is used to extract the source network address, destination network address, TLS record layer message type, protocol, and TLS record layer length fields from the encrypted traffic, and these are recorded in a file. The TLS information is then filtered from the parsed information using the protocol field. The interaction direction is determined through the TLS handshake process, and the data is sorted chronologically. The byte length of the TLS record layer corresponding to each message type is recorded.

[0081] The histogram's horizontal and vertical axis value ranges are determined based on the type, length, sequence, and interaction information of the Transport Layer Security (TLS) record layer. The ranges of the histogram's horizontal and vertical axes are determined according to the extracted flow information, ensuring that the ranges cover the vast majority of values ​​in the dataset. The horizontal axis value range is determined by statistically analyzing the length of the TLS message transfer sequence in the dataset. The TLS message transfer sequence refers to TLS record layer messages arranged in chronological order. The vertical axis value range is determined by statistically analyzing the byte length of the TLS record layer in the encrypted traffic; positive values ​​represent the byte length of uplink packets, and negative values ​​represent the byte length of downlink packets. The uplink packets represent network communication from the client to the server, and the downlink packets represent network communication from the server to the client.

[0082] For example, the message transfer sequence in a certain encrypted traffic is [Client Hello,Server Hello,Certificate,Application Data,Application Data], and its message transfer sequence length is 5, corresponding to the byte length sequence [184,-89,3000,64,-64].

[0083] Based on the range of values ​​for the horizontal and vertical axes of the histogram, the type, length, sequence, and interaction information of the Transport Layer Security (TLS) record layer are converted into a histogram. The message type of the TLS record layer is represented by the color of the bars in the histogram; the byte length of the TLS record layer is represented by the height of the histogram, and if the height range exceeds (or is less than) the aforementioned range, the maximum (or minimum) value within the range is taken; the TLS message transfer sequence is arranged from left to right in the histogram according to the interaction order, and if the length of the message transfer sequence exceeds the aforementioned horizontal axis range, the portion exceeding the range is not represented in the histogram; the interactions of the TLS record layer are represented by the positive and negative axes of the histogram, with the positive axis representing uplink packet interactions and the negative axis representing downlink packet interactions.

[0084] For example, Client Hello is represented in red, Server Hello in purple, Certificate in pink, and so on.

[0085] Step 3: Input the histogram into the pre-trained classification model to classify traffic and identify encrypted traffic.

[0086] Example 2:

[0087] A system for identifying transport layer security protocol encrypted traffic, comprising:

[0088] The acquisition module is used to acquire the encrypted traffic data being detected.

[0089] The preprocessing module is used to perform data preprocessing based on the detected encrypted traffic data, extracting flow information and converting it into a histogram;

[0090] The classification module is used to input the histogram into a pre-trained classification model to classify traffic and identify encrypted traffic.

[0091] The pre-trained classification model is obtained by training a convolutional neural network with the histogram as input and the message type corresponding to the histogram as output.

[0092] The preprocessing module includes:

[0093] The stream information extraction submodule is used to extract the message type, byte length, message transfer sequence, and interaction information of the transport layer security protocol record layer based on the detected encrypted traffic data.

[0094] The coordinate interval determination submodule is used to determine the range of values ​​for the horizontal coordinate of the histogram based on the message transfer sequence of the transport layer security protocol, and to determine the range of values ​​for the vertical coordinate of the histogram based on the byte length of the record layer of the transport layer security protocol.

[0095] The histogram conversion submodule is used to represent the message type of the Transport Layer Security Protocol (TLS) record layer with color, the byte length of the TLS record layer with height, arrange the TLS message transfer sequence in the histogram according to the interaction order, and represent the interaction of the TLS record layer with the positive and negative directions of the histogram in a two-dimensional coordinate system constructed from the horizontal and vertical coordinate ranges of the histogram, thereby realizing the extraction of stream information and conversion into a histogram.

[0096] The stream information includes: the message type of the Transport Layer Security (TLS) record layer, the byte length of the TLS record layer, the TLS message transfer sequence, and the interaction information of the TLS record layer.

[0097] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0099] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0100] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0101] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.

Claims

1. A method for identifying transport layer security protocol encrypted traffic, characterized in that, The method comprises the following steps: obtaining detected encrypted traffic data; performing data preprocessing based on the detected encrypted traffic data, extracting flow information and converting it into a histogram; inputting the histogram into a pre-trained classification model to perform traffic classification and realize encrypted traffic identification; wherein the pre-trained classification model is trained by taking the histogram as input and the message type corresponding to the histogram as output on a convolutional neural network; the data preprocessing based on the detected encrypted traffic data, extracting flow information and converting it into a histogram, comprises the following steps: extracting the message type of the transport layer security protocol record layer, the byte length of the transport layer security protocol record layer, the transport layer security protocol message transfer sequence, and the interaction information of the transport layer security protocol record layer based on the detected encrypted traffic data; determining the horizontal coordinate value interval of the histogram based on the transport layer security protocol message transfer sequence, and determining the vertical coordinate value interval of the histogram based on the byte length of the transport layer security protocol record layer; in the two-dimensional coordinate constructed by the horizontal coordinate value interval of the histogram and the vertical coordinate value interval of the histogram, the message type of the transport layer security protocol record layer is represented by color, the byte length of the transport layer security protocol record layer is represented by height, the transport layer security protocol message transfer sequence is arranged in the histogram according to the interaction order, and the interaction of the transport layer security protocol record layer is represented by the positive and negative directions of the histogram, realizing the extraction of flow information and the conversion into a histogram; wherein the flow information comprises: the message type of the transport layer security protocol record layer, the byte length of the transport layer security protocol record layer, the transport layer security protocol message transfer sequence, and the interaction information of the transport layer security protocol record layer.

2. The method of claim 1, wherein, The training of the classification model comprises: constructing a training set based on the histogram and the message type corresponding to the histogram; training the convolutional neural network by taking the histogram in the training set as input and the message type corresponding to the histogram as output.

3. The method of claim 2, wherein, The convolutional neural network comprises: an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer: the input layer is used to crop the histogram into a set size, perform normalization processing, and output a color image matrix as an input data matrix, and simultaneously transmit the input data matrix to the convolutional layer; the convolutional layer is used to perform convolution operation on the input data matrix based on a pre-set convolution kernel according to a pre-set step size, obtain convolution features, and transmit the convolution features to the pooling layer; the pooling layer is used to perform pooling operation on the convolution features according to a pre-set pooling kernel according to a pre-set step size, output the maximum value of the pooling kernel coverage area as the pooling result, and simultaneously transmit the pooling result to the fully connected layer; The full connection layer is configured to perform full connection between each neuron in the full connection layer and all neurons in the pooling layer, to obtain a neuron vector of a first layer of the full connection layer by flattening a last layer merging result of the pooling layer, to obtain a neuron vector of a second layer of the full connection layer by calculation based on the neuron vector of the first layer of the full connection layer, to obtain a neuron vector of a last layer of the full connection layer by sequential calculation, and to transmit the neuron vector of the last layer of the full connection layer to the output layer; The output layer is configured to classify the last layer neuron vector of the full connection layer by using a function.

4. The method of claim 3, wherein, The convolution feature is calculated according to the following formula: wherein, is the feature map of the i-th layer of convolutional features, is a non-linear activation function, is the feature map of the i-1-th layer of convolutional features, the operator denotes a convolution operation of the convolution kernel with the i-1-th layer image or feature map, is the weight vector of the i-th layer convolution kernel, is the bias vector.

5. The method of claim 3, wherein, The maximum value of the merging core coverage area is calculated according to the following formula: In the formula, is the maximum value of the converged nuclear coverage area, is the feature map of the i-th layer of the convolution feature.

6. The method of claim 3, wherein, The neuron vector is calculated according to the following formula: wherein, is a neuron vector of the i-th fully connected layer, is a neuron activation function, represents a neuron vector of the i-1-th fully connected layer, is obtained by flattening the feature map obtained by the last pooling layer, is a weight vector of the i-th fully connected layer, is a randomly generated 0 or 1, is an offset vector.

7. The method of claim 3 wherein, The function is shown in the following formula: where Y is the probability distribution of each classification label, is the neuron vector of the last layer of the fully connected layer.

8. A system for identifying transport layer security protocol encrypted traffic, characterized in that, Comprise: An acquisition module is configured to acquire detected encrypted traffic data; A preprocessing module is configured to perform data preprocessing based on the detected encrypted traffic data, and to extract flow information to convert into a histogram; A classification module is configured to input the histogram into a pre-trained classification model, to perform traffic classification, and to realize encrypted traffic identification; The pre-trained classification model is trained by taking the histogram as input and taking a message type corresponding to the histogram as output. The preprocessing module comprises: A flow information extraction submodule is configured to extract a message type of a transport layer security protocol record layer, a byte length of the transport layer security protocol record layer, a transport layer security protocol message transfer sequence, and interaction information of the transport layer security protocol record layer based on the detected encrypted traffic data; A coordinate interval determination submodule is configured to determine a horizontal coordinate value interval of a histogram based on the transport layer security protocol message transfer sequence, and to determine a vertical coordinate value interval of the histogram based on the byte length of the transport layer security protocol record layer; A histogram conversion submodule is configured to represent the message type of the transport layer security protocol record layer by color, to represent the byte length of the transport layer security protocol record layer by height, to arrange the transport layer security protocol message transfer sequence in the histogram according to an interaction order, and to represent the interaction of the transport layer security protocol record layer by a positive direction and a negative direction of the histogram in a two-dimensional coordinate constructed by the horizontal coordinate value interval of the histogram and the vertical coordinate value interval of the histogram, so as to convert the extracted flow information into the histogram. The flow information comprises the message type of the transport layer security protocol record layer, the byte length of the transport layer security protocol record layer, the transport layer security protocol message transfer sequence, and the interaction information of the transport layer security protocol record layer.

Images