Malicious encrypted traffic detection method and system based on AI model

Abstract

The invention relates to the technical field of encrypted traffic and tracing countering, in particular to a malicious encrypted traffic detection method and system based on an AI model. Matching and collecting encrypted traffic samples from a Hash source, and dynamically analyzing the collected encrypted traffic samples through a sandbox environment; performing data behavior verification through a malicious software detection tool, extracting network behavior characteristics from the processed sample, generating a pcap file of network traffic, analyzing the pcap file, and identifying and extracting malicious behavior indexes; and training and optimizing a malicious traffic detection machine learning model by using the extracted features. The malicious encrypted traffic detection capability is improved, the intelligence and automation level of network security protection is enhanced, and a safer and more reliable network environment is provided for users.

Description

Technical Field

[0001] The present invention relates to the field of encrypted traffic and tracking and tracing countermeasure technology, and in particular to a malicious encrypted traffic detection method and system based on an AI model. Background Art

[0002] At present, the global network is moving towards the era of full encryption. The proportion of encrypted traffic in domestic network communications is close to 70%, and more than 40% of malware or attack behaviors have turned to encrypted communications. The proportion of encrypted communications for APT attacks with higher technical levels is basically 100%. With the encryption of a large amount of traffic, it also brings great challenges to security detection. At present, hiding malicious attack behaviors and attack payloads in encrypted traffic is also a key research direction in industry and academia.

[0003] Research on protection technologies for new and unknown threats at home and abroad mainly focuses on identifying attacks and responses based on signature features and behavior detection models, and annotating attack stages and techniques in combination with the ATT&CK framework. However, network malicious traffic detection faces the difficulties of dynamic network environment and imbalanced traffic data, which makes it impossible to effectively detect malicious behaviors hidden in massive traffic. Although there have been many studies on feature processing and detection methods for malicious traffic detection, these methods are still insufficient in solving data imbalance and model detection accuracy at the same time. At the same time, malicious network behaviors are increasingly hidden, collaborative, and group-based. It is difficult to perceive cross-domain collusion behaviors only from a local perspective. Therefore, it is necessary to build a panoramic perspective of network entity interaction to support cross-domain malicious traffic detection and tracing.

[0004] At present, there are still problems with encrypted traffic and tracking and tracing countermeasure technologies, such as difficulty in malicious traffic analysis and identification, asynchronous tracking and tracing countermeasure technologies, and low degree of integration with threat intelligence. After preliminary analysis and verification, encrypted traffic based on cryptographic analysis and traffic identification and detection based on intelligent analysis features, combined with technical analysis of threat intelligence, can greatly improve the feasibility of malicious traffic detection and provide good application scenarios, which is helpful to clearly grasp the attack chain stage of the attacker and the probability of successful tracing. Summary of the invention

[0005] In view of the above problems existing in the prior art, the present invention is proposed.

[0006] Therefore, the present invention provides a malicious encrypted traffic detection method based on an AI model, which can solve the problem that traditional security systems cannot detect malicious behavior in encrypted traffic. The method of the present invention can intelligently analyze the behavior characteristics of encrypted traffic, identify hidden attack behaviors, and improve the detection capabilities of advanced persistent threats (APTs) and covert communication traffic, effectively prevent data leakage and illegal data transmission, and enhance network security.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: a malicious encrypted traffic detection method based on an AI model, comprising: matching and collecting encrypted traffic samples from a hash source, and dynamically analyzing the collected encrypted traffic samples through a sandbox environment; performing data behavior verification through a malware detection tool, extracting network behavior features from the processed samples and generating a pcap file of the network traffic, analyzing the pcap file, identifying and extracting malicious behavior indicators; and using the extracted features to train and optimize a machine learning model for malicious encrypted traffic detection.

[0008] As a preferred solution of the malicious encrypted traffic detection method based on the AI ​​model described in the present invention, the matching and collection of encrypted traffic samples from the Hash source includes the initial data source being screened by multiple Hash sources, identifying potential malicious samples, and the selected samples obtained by Hash matching are sent to the sandbox environment for dynamic analysis, and detection is performed at the same time to confirm malicious attributes.

[0009] As a preferred solution of the malicious encrypted traffic detection method based on the AI ​​model described in the present invention, the dynamic analysis includes generating a related network data packet capture file PCAP according to the analysis results of the sandbox and virus scanning platform VT, and the data in the PCAP file will be used for traffic analysis to identify potential malicious behaviors or generate threat indicators IOCs.

[0010] As a preferred solution of the malicious encrypted traffic detection method based on the AI ​​model described in the present invention, wherein: the encrypted traffic detection includes traffic decryption detection and traffic non-decryption detection;

[0011] The traffic decryption detection includes decrypting the traffic and performing security detection, using the security detection device as an agent for both communicating parties or providing both communicating parties with separate decryption certificates.

[0012] As a preferred solution of the malicious encrypted traffic detection method based on the AI ​​model described in the present invention, the non-decryption detection of traffic includes performing security detection without decryption, and using a machine learning method to identify malicious encrypted traffic.

[0013] As a preferred solution of the malicious encrypted traffic detection method based on an AI model described in the present invention, the training and optimization of the machine learning model includes extracting basic TCP session characteristics and statistical characteristics of TLS / SSL protocol data, introducing relevant contextual information, and training and optimizing the machine learning model.

[0014] As a preferred solution of the malicious encrypted traffic detection method based on the AI ​​model described in the present invention, wherein: the basic TCP session features include the packet length sequence of the data packet, the packet time detection sequence and the statistical features of the packet payload byte distribution;

[0015] The statistical features of the TLS / SSL protocol data include client-server encryption algorithm and certificate extraction information;

[0016] The related context information includes extracting statistical features of the DNS context by locating the DNS context of the communication destination server before TLS / SSL communication.

[0017] Another object of the present invention is to provide a malicious encrypted traffic detection system based on an AI model to solve the problem that traditional security systems cannot detect malicious behaviors hidden in encrypted traffic. The present invention introduces a machine learning model, combines encrypted traffic samples collected from a hash source and dynamic analysis of a sandbox environment, and can intelligently analyze traffic behavior characteristics and identify hidden attack behaviors. Network behavior characteristics are extracted through malware detection tools, and PCAP files are generated for further analysis, ultimately optimizing the machine learning model and improving detection accuracy. The present invention uses AI technology to not only intelligently analyze encrypted traffic behavior characteristics, but also improve the recognition rate and defense capabilities of malicious attack behaviors, effectively prevent data leakage and illegal data transmission, and thus greatly enhance network security.

[0018] As a preferred solution of a malicious encrypted traffic detection system based on an AI model described in the present invention, it includes: a sample collection and analysis module, an encrypted traffic detection module and a machine learning model training module;

[0019] The sample collection and analysis module screens and identifies potential malicious samples from multiple hash sources, and sends the selected samples to the sandbox environment for dynamic analysis through hash matching technology, while detecting and confirming malicious attributes;

[0020] The encrypted traffic detection module is verified by a malware detection tool, extracts network behavior features from processed samples and generates pcap files of network traffic, analyzes the pcap files, and identifies and extracts malicious behavior indicators;

[0021] The machine learning model training module extracts basic TCP session features and statistical features of TLS / SSL protocol data, and introduces relevant context information to train and optimize the machine learning model to improve the accuracy of malicious traffic detection.

[0022] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of any one of the methods for detecting malicious encrypted traffic based on an AI model are implemented.

[0023] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of any one of the methods for detecting malicious encrypted traffic based on an AI model are implemented.

[0024] Beneficial effects of the present invention: The present invention uses AI technology to construct a feature set based on the behavior pattern of malicious traffic, uses machine learning and other methods to solve the problem of malicious encrypted traffic detection and identification in the scenario of non-decryption, and uses adaptive learning technology to dynamically update the model. In terms of intelligent analysis technology, deep learning and machine learning are introduced, and machine learning is selected to solve the problem of malicious encrypted traffic identification. XGBoost, LightGBM, and RandForest algorithms with high usage rate and effect in ensemble learning are selected for model training, and the default parameters of the algorithm model are used for training and optimization, which improves the generalization ability and rapid adaptability of the model algorithm. On the basis of the common certificate unloading and traffic analysis capabilities of encrypted traffic acquisition and identification, SSL, TLS, VPN, and DNS context analysis technologies are added to perform feature analysis and analysis on the encrypted traffic behavior characteristics, and AILab technology is used to obtain malicious samples from various channels such as the own threat intelligence malware library, the online antivirus website library, and the network malware open source library to achieve model training, verification, and optimization, which greatly improves the accuracy of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0026] Figure 1 A flowchart of a malicious encrypted traffic detection method based on an AI model is provided for one embodiment of the present invention.

[0027] Figure 2 An AILab data collection diagram of a malicious encrypted traffic detection method based on an AI model provided by an embodiment of the present invention.

[0028] Figure 3 A diagram of an encrypted traffic orchestration device for a malicious encrypted traffic detection method based on an AI model provided in one embodiment of the present invention.

[0029] Figure 4 An encrypted traffic decryption diagram of a malicious encrypted traffic detection method based on an AI model provided by an embodiment of the present invention.

[0030] Figure 5 An encrypted traffic detection diagram based on an AI model of a malicious encrypted traffic detection method based on an AI model provided by an embodiment of the present invention.

[0031] Figure 6 A technical roadmap for encryption attack detection of a malicious encrypted traffic detection method based on an AI model is provided for one embodiment of the present invention.

[0032] Figure 7 A data processing and model training diagram of a malicious encrypted traffic detection method based on an AI model provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0034] Example 1, reference Figure 1-Figure 7 , which is the first embodiment of the present invention, and provides a malicious encrypted traffic detection method based on an AI model, comprising:

[0035] S1: Match and collect encrypted traffic samples from the hash source, and dynamically analyze the collected encrypted traffic samples through the sandbox environment.

[0036] It should be noted that in the existing encrypted traffic identification model, malicious encrypted traffic AI intelligent algorithm detection model training and testing are carried out. The model training of this embodiment is practiced based on the AI ​​platform, and the process is as follows:

[0037] like Figure 2As shown in the figure, during the data collection phase, we simulated attacks on various platforms / versions through hacker tool traffic simulation, attack data collection, our own threat intelligence malware library, online antivirus website library, and network malware open source library, and then analyzed encrypted traffic, classified usage, and stored file hashes. During the classification and detection phase, we used a variety of scanning and detection technologies, such as stream signature detection, scanning detection, rule detection, and fingerprint detection, to identify abnormal behaviors in SSL (Secure Sockets Layer) encrypted traffic. AILab also performed behavioral analysis on encrypted traffic, including vertical and horizontal behavior detection of RDP (Remote Desktop Protocol) and SSH (Secure Shell Protocol) to confirm attack threats, and identified the name, version, operating environment, blasting success judgment, and slow attack judgment of the attack tool.

[0038] The processed data is used to train AI models to improve the accuracy and efficiency of malicious encrypted traffic detection. The entire process is designed to achieve automated and intelligent malicious encrypted traffic detection to effectively respond to increasingly complex network security threats.

[0039] S2: Verify data behavior through malware detection tools, extract network behavior features from processed samples and generate pcap files of network traffic, analyze pcap files, identify and extract malicious behavior indicators;

[0040] It should be noted that, for the detection of encrypted traffic, this embodiment mainly studies 2 encrypted traffic methods, which are as follows:

[0041] The first is to decrypt the traffic and perform security detection. The security detection device acts as a proxy for both parties in the communication or the security detection device provides a separate decryption certificate (both parties in the communication trust the same decryption certificate and can only decode the encrypted traffic corresponding to the certificate). Figure 3 As shown in the figure, the encrypted HTTPS (Hypertext Transfer Protocol Security) traffic transmitted between the client and the server is first captured by the traffic scheduling platform. TLS (Transport Layer Security Protocol) decryption is performed through hardware devices to convert the encrypted data into an analyzable format. This process includes full-stack decryption, decryption acceleration technology, and recursive decoding to improve the efficiency of data processing.

[0042] The decrypted data stream will be sent to the traffic scheduling platform, including the data stream conversion module, data scheduling and mirror diversion module, for further inspection and analysis. The platform makes threat judgments on these data and identifies malicious files and unknown encrypted threats through threat detection devices. The threat detection device also has dynamic detection capabilities, which can monitor traffic in real time and detect potential advanced persistent threats and other unknown threats.

[0043] like Figure 4The figure shows the encrypted communication process between the client and the server. The client sends a handshake message to the server, including the client random number and the encryption suite supported by the client. The server responds with a handshake message, including the server random number and the server certificate. Based on asymmetric encryption, the client encrypts the pre-master key using the public key provided by the server and sends the encrypted pre-master key to the server. The server decrypts the pre-master key using the private key to complete the key exchange. After the handshake between the two parties is completed, in the data transmission phase, the client and server use the same master key for encryption based on symmetric encryption to ensure the secure transmission of information.

[0044] The second is to perform security detection without decryption. This embodiment will use machine learning methods to identify malicious encrypted traffic.

[0045] like Figure 5 The figure shows the multi-model machine learning decision-making process of the AI ​​algorithm model in encrypted traffic detection. The AI ​​algorithm model integrates data from different dimensions such as network behavior analysis, certificate analysis, fingerprint feature recognition, packet feature sequence analysis, background traffic, and event association. Through these data, the model can identify abnormal patterns in encrypted traffic, such as covert communication behaviors such as rebound shells, DNS tunnels, ICMP tunnels, and HTTP tunnels. This multi-dimensional analysis method improves the model's detection accuracy for malicious encrypted traffic, enabling it to effectively identify and respond to various complex network threats, thereby enhancing network security protection capabilities.

[0046] S3: Use the extracted features to train and optimize the machine learning model for malicious encrypted traffic detection.

[0047] It should be noted that if Figure 6 As shown in the figure, during the training of the machine learning model, the data collection phase detects different types of security threats including Trojans, APT attacks, connection C&C (command and control traffic) traffic, weaponized tools, viruses, and downloaders. Abnormal activities in the network are identified by integrating multiple spatiotemporal behavior features, such as temporal behavior and spatial behavior, as well as features of specific events, such as handshake features. Certificate features, server and client fingerprints, and time distribution features of traffic are analyzed to help identify potential malicious activities. The machine learning model also takes into account the use of hacker tools, single-stream and multi-stream behaviors, and covert means of transit through white sites. Through this multi-dimensional feature engineering, the model is able to extract deep features from time distribution features and load distribution features and use them for prediction.

[0048] Furthermore, this embodiment mainly uses three types of machine learning methods for detecting malicious encrypted traffic, including:

[0049] The first is to extract statistical features of the basic TCP (Transmission Control Protocol) session features of the data stream and build an AI model for detection. The main features extracted are statistical features such as the packet length sequence, packet time detection sequence, and packet payload byte distribution. The differences between encrypted communication and normal communication at the data stream level are utilized.

[0050] The second is to introduce statistical features of TLS / SSL application layer protocol data based on the data stream TCP session features. Although TLS / SSL data communication is encrypted, key negotiation and identity authentication are performed before data communication begins. The data transmitted in this process is in plain text. The extracted statistical features are mostly client and server encryption algorithms, certificate extraction information, etc. The combination of these two types of features greatly improves the accuracy of AI model detection. At the same time, some encryption fingerprints (such as JA3 / JA3S / SSL certificate fingerprints) and certificate anomaly analysis technologies can be used to effectively reduce false positives in AI model detection.

[0051] The third method is to introduce the context information of TLS / SSL data flow based on the first two methods. For example, before TLS / SSL communication, the DNS (Domain Name System) context of the communication destination server will be located. Further extracting the statistical features of the DNS context can further improve the accuracy of the AI ​​model. The available context also includes HTTP context.

[0052] Furthermore, the model training of this embodiment is performed based on an AI modeling platform, starting from collecting various types of encrypted data, through multiple steps of traffic packet analysis, traffic data processing, traffic feature extraction, and AI model training, finally obtaining an identification model for malicious encrypted traffic.

[0053] like Figure 7 As shown in the figure, to ensure the accuracy and timeliness of the detection engine, the accuracy and coverage of data collection are key. Data needs to be collected from different sources in detailed classification and data volume. The traffic packet data is parsed and extracted from the traffic engine in the AI ​​modeling platform to extract the AI ​​model pre-training samples, and then the extracted pre-training samples are screened to obtain the final model training samples. After obtaining the AI ​​model training samples, the training samples are classified into data sets according to whether the TLS / SSL session is associated with the session context. The encrypted traffic feature data is analyzed. In order to enable the model to better learn the characteristics of black samples and balance the amount of black and white sample data, all training pairs are sampled to obtain a 1:1 training set distribution. In order to more intuitively see the separability of the data, PCA dimensionality reduction is performed after random sampling of the data in each training, and a two-dimensional plane data dimensionality reduction graph and a three-dimensional space data dimensionality reduction graph are obtained. The degree of black and white sample coefficients of each category of data is visualized to intuitively see the distribution of feature data.

[0054] We chose traditional machine learning to solve the problem of malicious encrypted traffic identification. We selected XGBoost, LightGBM, and RandForest algorithms, which have high usage and effect in ensemble learning, for model training. We used the default parameters of the algorithm model for training and compared the results with the classic linear model LogisticRegression. We used precision, recall, accuracy, and F1 value to comprehensively measure the detection ability of the model. We comprehensively considered the model's training cost, parameter tuning difficulty, and performance evaluation indicators, and compared the performance of the four algorithms RandomForest, XGBoost, LightGBM, and LogisticRegression on the test set, and selected the optimal model algorithm. At the same time, by establishing a feature set of key elements such as the fingerprint characteristics of encrypted traffic, network behavior, certificate interaction, packet size characteristics, packet timing characteristics, payload character characteristics, attack tool characteristics, and human-computer interaction behavior characteristics, an intelligent analysis and discrimination model is constructed using artificial intelligence algorithms. At the same time, abnormal events are associated, which can effectively detect encrypted rebound Shell, ICMP secret tunnel, DNS secret tunnel, HTTP secret tunnel, and encrypted intrusion and communication behaviors using tools such as Ice Scorpion, Ant Sword, Godzilla, CobaltStrike, and Metasploit in scenarios where encrypted traffic is not decrypted.

[0055] Embodiment 2, the second embodiment of the present invention, is different from the previous embodiment in that:

[0056] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0057] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0058] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0059] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0060] Embodiment 3, the third embodiment of the present invention, provides a malicious encrypted traffic detection system based on an AI model, characterized in that it includes a sample collection and analysis module, an encrypted traffic detection module, and a machine learning model training module;

[0061] The sample collection and analysis module screens and identifies potential malicious samples from multiple hash sources. Through hash matching technology, the selected samples are sent to the sandbox environment for dynamic analysis and detection to confirm malicious attributes.

[0062] The encrypted traffic detection module is verified by a malware detection tool, extracts network behavior features from processed samples and generates pcap files of network traffic, analyzes the pcap files, and identifies and extracts malicious behavior indicators;

[0063] The machine learning model training module extracts basic TCP session features and statistical features of TLS / SSL protocol data, and introduces relevant context information to train and optimize the machine learning model to improve the accuracy of malicious traffic detection.

[0064] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A malicious encrypted traffic detection method based on an AI model, characterized by: include, Match and collect encrypted traffic samples from the hash source, and dynamically analyze the collected encrypted traffic samples in the sandbox environment; Verify data behavior through malware detection tools, extract network behavior features from processed samples and generate pcap files of network traffic, analyze pcap files, identify and extract malicious behavior indicators; The extracted features are used to train and optimize machine learning models for malicious encrypted traffic detection.

2. The malicious encrypted traffic detection method based on an AI model as claimed in claim 1, characterized in that: The matching and collection of encrypted traffic samples from the Hash source includes the initial data source being screened by multiple Hash sources to identify potential malicious samples, and the selected samples obtained by Hash matching are sent to a sandbox environment for dynamic analysis, and detection is performed to confirm malicious attributes.

3. The method for detecting malicious encrypted traffic based on an AI model as claimed in claim 2, characterized in that: The dynamic analysis includes generating relevant network data packet capture files pcap according to the analysis results of the sandbox and virus scanning platform VT. The data in the pcap file will be used for traffic analysis to identify potential malicious behaviors or generate threat indicators IOCs.

4. The method for detecting malicious encrypted traffic based on an AI model as claimed in claim 3, characterized in that: The encrypted traffic detection includes traffic decryption detection and traffic non-decryption detection; The traffic decryption detection includes decrypting the traffic and performing security detection, using the security detection device as an agent for both communicating parties or providing both communicating parties with separate decryption certificates.

5. The method for detecting malicious encrypted traffic based on an AI model as claimed in claim 4, characterized in that: The non-decrypted traffic detection includes performing security detection without decryption and using a machine learning method to identify malicious encrypted traffic.

6. The method for detecting malicious encrypted traffic based on an AI model as claimed in claim 5, characterized in that: The training and optimization of the machine learning model includes extracting basic TCP session features and statistical features of TLS / SSL protocol data, introducing relevant contextual information, and training and optimizing the machine learning model.

7. The method for detecting malicious encrypted traffic based on an AI model as claimed in claim 6, characterized in that: The basic TCP session characteristics include the packet length sequence of the data packet, the packet time detection sequence and the statistical characteristics of the packet payload byte distribution; The statistical features of the TLS / SSL protocol data include client-server encryption algorithm and certificate extraction information; The related context information includes extracting statistical features of the DNS context by locating the DNS context of the communication destination server before TLS / SSL communication.

8. A system based on the AI ​​model-based malicious encrypted traffic detection method according to any one of claims 1 to 7, characterized in that: It includes sample collection and analysis module, encrypted traffic detection module and machine learning model training module; The sample collection and analysis module screens and identifies potential malicious samples from multiple hash sources, and sends the selected samples to the sandbox environment for dynamic analysis through hash matching technology, while detecting and confirming malicious attributes; The encrypted traffic detection module is verified by a malware detection tool, extracts network behavior features from processed samples and generates pcap files of network traffic, analyzes the pcap files, and identifies and extracts malicious behavior indicators; The machine learning model training module extracts basic TCP session features and statistical features of TLS / SSL protocol data, and introduces relevant context information to train and optimize the machine learning model to improve the accuracy of malicious traffic detection.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images