Density weighted encrypted malicious traffic detection method

Abstract

The invention relates to the technical field of network security, and provides a density weighted encrypted malicious traffic detection method. The method comprises the following steps: carrying out quantization processing on an information measurement sample set F to generate an encrypted traffic description feature set A, and carrying out dimensionality reduction on the encrypted traffic sample set A to obtain an encrypted traffic sample set containing encrypted benign traffic examples and encrypted malicious traffic examples; and then, training a logistic regression detection model constructed based on a logistic regression algorithm through a density weighted query strategy and the encrypted traffic sample set so as to detect the encrypted malicious traffic. Therefore, density weighting is carried out on the uncertainty of the samples, the lightweight training set is constructed, a small number of annotation instances are utilized to enable the model to have high performance, and lightweight detection of the TLS encrypted malicious traffic is achieved from the data level.

Description

Technical Field

[0001] This application relates to the field of network security technology, and particularly relates to a density-weighted encrypted malicious traffic detection method. Background Art

[0002] With the wide application of communication encryption technology, not only legal application programs use encryption technology to protect privacy, but also malicious software uses encryption technology to conceal its attack behavior, making traditional detection methods based on deep packets and payloads ineffective. In recent years, computer technology and artificial intelligence have developed rapidly, and the research on TLS encrypted malicious traffic detection methods based on machine learning and deep learning has received extensive attention.

[0003] The detection method based on machine learning mainly depends on feature engineering and model selection. It mainly selects features by extracting TLS handshake features, traffic features, DNS responses, and HTTP header message features of encrypted traffic, and then uses a machine learning model to train these features. However, the features selected manually have the problem of multicollinearity, which affects the detection effect of the machine learning model.

[0004] The method based on deep learning mainly directly learns the rules and extracts features from the traffic through an autoencoder network, a convolutional neural network, or a long short-term memory neural network, and then uses a deep network to train the automatically extracted features. However, this method increases the computational complexity and is not conducive to local deployment. And clustering through unsupervised learning methods can achieve good results, but this method is sensitive to outliers. Summary of the Invention

[0005] The purpose of this application is to provide a density-weighted encrypted malicious traffic detection method to solve or alleviate the problems existing in the above-mentioned prior art.

[0006] To achieve the above purpose, this application provides the following technical solutions:

[0007] This application provides a density-weighted encrypted malicious traffic detection method, including:

[0008] Reducing the dimension of the encrypted traffic description feature set A generated by quantifying the informative metric sample set F to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances;

[0009] Training a logistic regression detection model constructed based on the logistic regression algorithm through a density-weighted query strategy and the encrypted traffic sample set to detect encrypted malicious traffic.

[0010] Preferably, the encrypted traffic description feature set A generated by quantifying the informative metric sample set F includes:

[0011] The informative metric sample set F contains N encrypted traffic instances, and each of the encrypted traffic instances uses the flow features associated with the flow fingerprint and the TLS handshake features as traffic sample features; where N is a positive integer;

[0012] Process the flow features and the TLS handshake features of each encrypted traffic instance to generate the encrypted traffic description feature set A.

[0013] Preferably, the processing of the flow features and the TLS handshake features of each encrypted traffic instance includes

[0014] Perform standardization processing on the flow features in the encrypted traffic instance, perform discretization and normalization processing on the encryption algorithm selected by the server when the Client Hello initiates the handshake request for the first time in the TLS handshake features of the encrypted traffic instance, and perform TF-IDF coding processing on the certificate subject features and certificate issuer features selected by the server when the Client Hello initiates the handshake request for the first time in the TLS handshake features.

[0015] Preferably, perform dimensionality reduction on the generated encrypted traffic description feature set A to obtain an encrypted traffic sample set, including:

[0016] Through a preset minimum variance For the variance of each feature in the encrypted traffic description feature set A calculated based on the variance analysis method Perform screening to generate an intermediate feature set F m ;

[0017] According to a preset maximum correlation threshold For the correlation of each feature in the intermediate feature set F calculated based on the maximum information coefficient method m Perform screening to generate the encrypted traffic sample set.

[0018] Preferably, training the logistic regression detection model constructed based on the logistic regression algorithm by using the density-weighted query strategy and the encrypted traffic sample set includes:

[0019] Divide the encrypted traffic instances in the encrypted traffic sample set into a training set and a test set according to a preset ratio, and label some of the encrypted traffic instances in the training set to generate an initial training set L, and the unlabeled encrypted traffic instances form a sample pool;

[0020] Circularly query the encrypted traffic instances in the sample pool through the density-weighted query strategy, and combine with the initial training set L to generate a sample annotation set;

[0021] ​Train the logistic regression detection model with the encrypted traffic instances in the sample annotation set, and calculate the prediction accuracy of the trained logistic regression detection model through the test set.

[0022] In response to the prediction accuracy being greater than or equal to the preset accuracy threshold A cc , or, if the number of queries for the encrypted traffic instances in the sample pool is greater than the preset query number threshold c, then output the corresponding logistic regression detection model.

[0023] Preferably, the generation of the initial training set L by annotating some encrypted traffic instances in the training set includes:

[0024] Sort the encrypted benign traffic instances and encrypted malicious traffic instances in the training set, and annotate some encrypted traffic instances in the sorted training set according to the equal-interval sampling strategy to generate the initial training set L.

[0025] Preferably, it includes: selecting m encrypted traffic instances from the sample pool through a density-weighted query strategy for annotation to generate an intermediate sample annotation set q m , and adding the intermediate sample annotation set q m to the initial training set L to generate the sample annotation set Q; meanwhile, deleting the corresponding m encrypted traffic instances in the sample pool; where m is a positive integer;

[0026] Train the logistic regression detection model with the encrypted traffic instances in the sample annotation set Q, and judge the prediction accuracy of the trained logistic regression detection model ;

[0027] In response to the prediction accuracy of the logistic regression detection model trained with the sample annotation set Q being less than the preset accuracy threshold A cc , then based on the sample annotation set Q, select m encrypted traffic instances from the sample pool after deleting m encrypted traffic instances again through a density-weighted query strategy for annotation, generate a new intermediate sample annotation set and add it to the sample annotation set Q to generate a sample annotation set Q′, and train the logistic regression detection model with the generated sample annotation set Q′ until the prediction accuracy of the trained logistic regression prediction model is greater than or equal to the preset accuracy threshold A cc , or, if the number of queries for the encrypted traffic instances is greater than the preset query number threshold c, then output the corresponding logistic regression detection model.

[0028] Preferably, the query strategy weighted by density selects m encrypted traffic instances from the sample pool for annotation, including:

[0029] Using the Euclidean distance as the distance metric function of the encrypted traffic instance, calculate the uncertainty φ of the encrypted traffic instances in the sample pool x and the information density I(x);

[0030] For the uncertainty φ of each encrypted traffic instance in the sample pool x Weight according to the corresponding information density I(x) to obtain the information degree X of each encrypted traffic instance in the sample pool * ;

[0031] Select the first m information degrees X in the sample pool in descending order * Corresponding encrypted traffic instances for annotation.

[0032] Preferably, according to the formula:

[0033] φ x =-∑P θ (y i |x)·lnP θ (y i |x)

[0034] Calculate the uncertainty φ of the encrypted traffic instance x in the sample pool x ; In the formula, P θ (y i |x) is the posterior probability that the encrypted traffic instance x is predicted to be the i-th category; y i is the encrypted traffic that the encrypted traffic instance x is predicted to be the i-th category; where, when i = 1, y i =y1, indicating that the encrypted traffic instance x is predicted to be encrypted benign traffic; when i = 2, y i =y2, indicating that the encrypted traffic instance x is predicted to be encrypted malicious traffic;

[0035] According to the formula:

[0036]

[0037] Calculate the information density I(x) of the encrypted traffic instance x in the sample pool; In the formula, X u represents all encrypted traffic instances in the sample pool, |X u | represents the average similarity between the encrypted traffic instance x and other encrypted traffic instances in the sample pool; x' represents other encrypted traffic instances in the sample pool except the encrypted traffic instance x; sim(x, x') represents the sum of the Euclidean distances between the encrypted traffic instance x and all other encrypted traffic instances x';

[0038] According to the formula:

[0039] X * = φ x × [I(x)] β

[0040] Calculate the information degree X of the encrypted traffic instance x in the sample pool * ; where β is the information density control parameter, and its value is a constant.

[0041] Beneficial effects:

[0042] In the density-weighted encrypted malicious traffic detection method provided by the embodiment of the present application, the informative metric sample set F is quantized to generate the encrypted traffic description feature set A, and the encrypted traffic sample set A is dimensionally reduced to obtain an encrypted traffic sample set including encrypted benign traffic instances and encrypted malicious traffic instances; then, a logistic regression detection model constructed based on the logistic regression algorithm is trained through a density-weighted query strategy and the encrypted traffic sample set to detect encrypted malicious traffic.

[0043] Therefore, through the quantization of the informative metric sample set, the dimension of the encrypted traffic instances it contains is unified, the effectiveness of the metric features is improved, and the problems of feature redundancy and multicollinearity are solved; by reducing the dimension of the encrypted traffic sample set A, the calculation complexity is effectively reduced while eliminating redundancy and noise and avoiding overfitting, saving computing resources. The density-weighted query strategy takes into account both the uncertainty of the samples and the data distribution in the spatial domain, making up for the shortcoming that a single uncertainty strategy is prone to querying outliers due to considering informativeness, and thus querying traffic instances with large amounts of information and strong representativeness in the unlabeled sample pool. By combining these traffic instances, a lightweight training set is constructed. The lightweight training set constructed by the density-weighted query strategy is used to train the logistic regression detection model with a small number of labeled instances, enabling the logistic regression detection model to achieve high performance, greatly reducing the manual labeling cost and computing overhead, and realizing lightweight detection of encrypted malicious traffic at the data level. Description of the Drawings

[0044] The schematic diagram of the drawings forming a part of this application is used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an improper limitation to this application. Among them:

[0045] Figure 1 is a schematic flowchart of a density-weighted encrypted malicious traffic detection method provided according to some embodiments of this application;

[0046] Figure 2Schematic diagram of a density-weighted encrypted malicious traffic detection method provided according to some embodiments of the present application;

[0047] Figure 3 Schematic diagram of annotating encrypted traffic instances using a density-weighted query strategy provided according to some embodiments of the present application;

[0048] Figure 4 Schematic diagram of the results of three different query strategies provided according to some embodiments of the present application. Detailed implementation manners

[0049] The present application will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments. Each example is provided by way of explanation of the present application rather than limiting the present application. In fact, those skilled in the art will clearly understand that modifications and variations can be made to the present application without departing from the scope or spirit of the present application. For example, features shown or described as part of one embodiment can be used in another embodiment to yield yet another embodiment. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention shall fall within the scope of protection of the embodiments of the present invention.

[0050] In the prior art, traffic detection methods based on machine learning and deep learning have a common problem, that is, they all require a large amount of labeled sample data for model training. When the number of labeled samples is small, the performance of the detection model will be greatly reduced. However, in a real network environment, obtaining a large number of high-quality labeled samples requires a large amount of manpower and material resources, which not only has a high cost but also the detection efficiency of the trained model is very low.

[0051] Based on this, this specification provides a density-weighted encrypted malicious traffic detection method. By density-weighting the uncertainty of samples, a lightweight training set is constructed, and the model can have high performance using a small number of labeled instances, realizing lightweight detection of TLS encrypted malicious traffic from the data level and effectively solving the sample annotation problem in the prior art.

[0052] As Figures 1 to 4 shown, the density-weighted encrypted malicious traffic detection method includes:

[0053] Step S101: Dimension reduction is performed on the encrypted traffic description feature set A generated by quantifying the informative metric sample set F to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances.

[0054] Flow fingerprints are unique representations generated for each encrypted traffic instance based on the five-tuple of network traffic (a set of source IP, destination IP, source port, destination port, and protocol). Flow fingerprints are used to associate the flow characteristics and TLS handshake characteristics of each encrypted traffic instance. Flow characteristics include the characteristics and arrival process of bidirectional TLS encrypted flows, specifically including the two-end connection status of TCP, the traffic volume of data packets, the duration of the traffic, the number of bytes in the header, the ratio of the number of backward data packets to the number of forward data packets, and the size of the payload. TLS handshake characteristics include the encryption algorithm selected by the server when the ClientHello initiates the handshake request for the first time, the certificate subject, and the certificate issuer.

[0055] The flow characteristics and TLS handshake characteristics associated by flow fingerprints are used as the traffic sample characteristics of encrypted traffic instances, and N (N is a positive integer) encrypted traffic instances are used to construct an informative metric sample set F of encrypted traffic instances. The flow characteristics and TLS handshake characteristics of each encrypted traffic instance in the informative metric sample set F are processed. Among them, the flow characteristics in the encrypted traffic instance are normalized, the encryption algorithm selected by the server when the ClientHello initiates the handshake request for the first time in the TLS handshake characteristics of the encrypted traffic instance is discretized and normalized, and the certificate subject characteristics and certificate issuer characteristics selected by the server when the ClientHello initiates the handshake request for the first time in the TLS handshake characteristics are processed using TF-IDF encoding. The processed flow characteristics and TLS handshake characteristics constitute the encrypted traffic description feature set A.

[0056] Then, dimensionality reduction is performed on the encrypted traffic description feature set A. First, the variance of each feature in the informative metric sample set F is calculated using the analysis of variance method. And through the set minimum variance for the variance of each feature in the informative metric sample set F is screened, and the features are removed to obtain the intermediate feature set F m . Then, the maximum information coefficient method is used to calculate the correlation of each feature in the intermediate feature set F m and through the set maximum correlation threshold for the correlation of each feature in the intermediate feature set F is screened, and the m features are removed to obtain the encrypted traffic sample set. is removed to obtain the encrypted traffic sample set.

[0057] Step S102: Train the logistic regression detection model constructed based on the logistic regression algorithm through a density-weighted query strategy and the encrypted traffic sample set to detect encrypted malicious traffic.

[0058] After reducing the dimension of the encrypted traffic description feature set A by the analysis of variance method and the maximum information coefficient method, the features with significant variance changes are retained with weak correlation to form an encrypted traffic sample set. The encrypted traffic sample set contains encrypted benign traffic instances and encrypted malicious traffic instances, and the ratio of encrypted benign traffic instances to encrypted malicious traffic instances is 1:1. The encrypted traffic instances in the encrypted traffic sample set are divided into a training set and a test set according to a preset ratio of 7:3. When dividing, the ratio of encrypted benign traffic instances to encrypted malicious traffic instances in the training set and the test set is 1:1.

[0059] A part of the encrypted traffic instances in the training set are labeled, and the labeled encrypted traffic instances are used to form an initial training set L with labels, and the other part of the unlabeled encrypted traffic instances form an unlabeled sample pool. Specifically, the encrypted traffic instances in the training set are arranged in the order that the first part is encrypted benign traffic instances and the second part is encrypted malicious traffic instances, and the number of encrypted traffic instances in both parts is 0.35N; in the arranged training set, 0.5% of the total number of encrypted traffic instances in the sorted training set is labeled according to the equal-interval sampling strategy to form the initial training set L; the other 99.5% of the encrypted traffic instances in the training set form the unlabeled sample pool.

[0060] When sampling the encrypted traffic instances in the training set according to the equal-interval sampling strategy, 0.5% of the encrypted benign traffic instances are equally spaced and extracted from the first part of 0.35N encrypted benign traffic instances, and 0.5% of the encrypted malicious traffic instances are equally spaced and extracted from the second part of 0.35N encrypted malicious traffic instances. The total of 0.0035N encrypted traffic instances extracted from the two parts form the initial training set L.

[0061] In this application, a logistic regression detection model based on the logistic regression algorithm is constructed to detect whether the encrypted traffic is encrypted malicious traffic. Among them, the logistic regression detection model is only an algorithm with default parameters before being trained by a small sample labeled set and cannot be directly used to detect encrypted malicious traffic. After being trained by the small sample labeled set, the parameters of the logistic regression detection model will be updated to be able to detect whether the encrypted traffic is encrypted malicious traffic.

[0062] Among them, the logistic regression detection model is trained by the density-weighted query strategy and the encrypted traffic sample set. Specifically, the encrypted traffic instances in the sample pool are circularly queried by the density-weighted query strategy, and a sample labeled set is generated in combination with the initial training set L. Among them, m encrypted traffic instances are selected from the sample pool by the density-weighted query strategy for labeling to generate an intermediate sample labeled set q m and the intermediate sample labeled set q mAdd the initial training set L to generate the sample annotation set Q. At the same time, delete the corresponding m (m is a positive integer) encrypted traffic instances in the sample pool to form a new sample pool.

[0063] Among them, when selecting m encrypted traffic instances from the sample pool for annotation through a density-weighted query strategy, first, use the Euclidean distance as the distance metric function for the encrypted traffic instances to calculate the uncertainty φ of the encrypted traffic instances in the sample pool x and the information density I(x). Specifically, according to the formula:

[0064] φ x =-∑P θ (y i |x)·lnP θ (y i |x)

[0065] Calculate the uncertainty φ of the encrypted traffic instances in the sample pool x ; in the formula, P θ (y i |x) is the posterior probability that the encrypted traffic instance x is predicted to be the i-th category; y i is the encrypted traffic instance where the encrypted traffic instance x is predicted to be the i-th category; when i = 1, y i =y1, indicating that the encrypted traffic instance x is the encrypted traffic predicted to be the first category, that is, the encrypted traffic instance x is predicted to be encrypted benign traffic; when i = 2, y i =y2, indicating that the encrypted traffic instance x is the encrypted traffic predicted to be the second category, that is, the encrypted traffic instance x is predicted to be encrypted malicious traffic.

[0066] According to the formula:

[0067]

[0068] Calculate the information density I(x) of the encrypted traffic instances in the sample pool; in the formula, X u represents all encrypted traffic instances in the sample pool (the current sample pool), |X u | represents the average similarity between the encrypted traffic instance x and other encrypted traffic instances in the sample pool (the current sample pool); x' represents other encrypted traffic instances in the sample pool (the current sample pool) except the encrypted traffic instance x; sim(x, x') represents the sum of the Euclidean distances between the encrypted traffic instance x and all other encrypted traffic instances x'.

[0069] After obtaining the uncertainty φ x and the information density I(x) of each encrypted traffic instance in the sample pool, for the uncertainty φ xWeighted according to the corresponding information density I(x) to obtain the information degree X of each encrypted traffic instance in the sample pool * , specifically, according to the formula:

[0070] X * = φ x ×[I(x)] β

[0071] Calculate the information degree X of each encrypted traffic instance in the sample pool * ; in the formula, β is the information density control parameter, and its value is a constant. In this application, the information density control parameter β = 1. Then, select the first m encrypted traffic instances corresponding to the information degree X in the sample pool from large to small for annotation to generate the intermediate sample annotation set q * . That is, the intermediate sample annotation set q m contains the first m encrypted traffic instances corresponding to the information degree X in the sample pool m . *

[0072] Finally, add the m encrypted traffic instances included in the intermediate sample set q m to the initial training set L to generate the sample annotation set Q, and train the logistic regression detection model through the encrypted traffic instances in the sample annotation set Q, and calculate the prediction accuracy of the trained logistic regression detection model through the test set If the prediction accuracy of the logistic regression detection model trained by the sample annotation set Q is less than the preset accuracy threshold A cc , then based on the sample annotation set Q, select m encrypted traffic instances from the sample pool after deleting m encrypted traffic instances again through the density weighted query strategy for annotation, generate a new intermediate sample annotation set and add it to the sample annotation set Q to generate the sample annotation set Q', and train the logistic regression detection model through the generated sample annotation set Q' until the prediction accuracy of the trained logistic regression prediction model is greater than or equal to the preset accuracy threshold A cc , or the number of queries for encrypted traffic instances is greater than the preset query number threshold c, then output the corresponding logistic regression detection model

[0073] ​Compared with the existing uncertainty sampling query strategy (UNSM) and graph density query strategy (UNGD), the logistic regression detection model trained by the density-weighted query strategy (UNID) detects the encrypted traffic instances to be classified and determines whether they are encrypted malicious traffic, which has better superiority. Moreover, as the number of queries increases, the performance of the logistic regression detection model can be gradually and steadily improved, that is, the more queries are made, the more accurate and higher the precision of the logistic regression detection model is, realizing efficient and lightweight encrypted malicious traffic detection.

[0074] In this application, when establishing the informative metric sample set F of encrypted traffic instances, the dimensionality of the metric features in the informative metric sample set F is unified, and the analysis of variance method and the maximum information coefficient method are used to improve the effectiveness of the features in the informative metric sample set F, solving the problems of feature redundancy and multicollinearity; the Euclidean distance is used to calculate the distance between encrypted traffic instances, accurately reflecting the distance between two encrypted traffic instances in the spatial domain, improving the accuracy of the description of the distribution of encrypted traffic instances in the spatial domain, and enabling the density-weighted query strategy to better reflect the representativeness of encrypted traffic instances.

[0075] The density-weighted query strategy can simultaneously consider the uncertainty of encrypted traffic instances and the data distribution in the spatial domain, which is beneficial to avoiding outliers in the unlabeled sample pool, and then querying instances with large amounts of information and strong representativeness in the sample pool to construct a lightweight training set for the training of the logistic regression detection model; at the same time, using the density-weighted query strategy can enable the logistic regression detection model to achieve high performance with a small number of labeled encrypted traffic instances, greatly reducing the cost of manual labeling and the computational overhead of hardware, and realizing lightweight detection of TLS encrypted malicious traffic at the data level.

[0076] In the description of the present invention, it should be understood that the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0077] The above are only the preferred embodiments of the present application and are not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A density-weighted encrypted malicious traffic detection method, characterized in that Including: Dimensionality reduction is performed on the encrypted traffic description feature set A generated by quantifying the informative metric sample set F to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances; The logistic regression detection model constructed based on the logistic regression algorithm is trained through a density-weighted query strategy and the encrypted traffic sample set to detect encrypted malicious traffic.

2. The density-weighted encrypted malicious traffic detection method according to claim 1, wherein The encrypted traffic description feature set A generated by quantifying the informative metric sample set F includes: The informative metric sample set F contains N encrypted traffic instances, and each of the encrypted traffic instances uses the flow characteristics associated with the flow fingerprint and the TLS handshake characteristics as traffic sample characteristics; where N is a positive integer; The flow characteristics and the TLS handshake characteristics of each encrypted traffic instance are processed to generate the encrypted traffic description feature set A.

3. The density-weighted encrypted malicious traffic detection method according to claim 1, wherein The processing of the flow characteristics and the TLS handshake characteristics of each encrypted traffic instance includes Normalizing the flow characteristics in the encrypted traffic instance, discretizing and normalizing the encryption algorithm selected by the server when the Client Hello initiates the handshake request for the first time in the TLS handshake characteristics of the encrypted traffic instance, and performing TF-IDF coding on the certificate subject characteristics and certificate issuer characteristics selected by the server when the Client Hello initiates the handshake request for the first time in the TLS handshake characteristics.

4. The density-weighted encrypted malicious traffic detection method according to claim 1, characterized in that Dimensionality reduction is performed on the generated encrypted traffic description feature set A to obtain an encrypted traffic sample set, including: By presetting the minimum variance for each feature in the encrypted traffic description feature set A calculated based on the variance analysis method perform screening to generate an intermediate feature set F m ; According to a preset maximum correlation threshold for the correlation of each feature in the intermediate feature set F calculated based on the maximum information coefficient method m to perform screening and generate the encrypted traffic sample set. ​ 5. The density-weighted encrypted malicious traffic detection method according to claim 1, wherein The training of the logistic regression detection model constructed based on the logistic regression algorithm through the density-weighted query strategy and the encrypted traffic sample set includes: The encrypted traffic instances in the encrypted traffic sample set are divided into a training set and a test set according to a preset ratio, and some of the encrypted traffic instances in the training set are labeled to generate an initial training set L, and the unlabeled encrypted traffic instances form a sample pool; The encrypted traffic instances in the sample pool are circularly queried through a density-weighted query strategy, and combined with the initial training set L, a sample annotation set is generated; Train the logistic regression detection model with the encrypted traffic instances in the sample annotation set, and calculate the prediction accuracy of the trained logistic regression detection model through the test set In response to the prediction accuracy being greater than or equal to a preset accuracy threshold A cc , or the number of queries for the encrypted traffic instances in the sample pool being greater than a preset query number threshold c, then output the corresponding logistic regression detection model.

6. The density-weighted encrypted malicious traffic detection method according to claim 5, wherein The labeling of some of the encrypted traffic instances in the training set to generate the initial training set L includes: The encrypted benign traffic instances and encrypted malicious traffic instances in the training set are sorted, and some of the encrypted traffic instances in the sorted training set are labeled according to an equal-interval sampling strategy to generate the initial training set L.

7. The density-weighted encrypted malicious traffic detection method according to claim 5, wherein Including: Select m encrypted traffic instances from the sample pool through a density-weighted query strategy for annotation to generate an intermediate sample annotation set q m , and add the intermediate sample annotation set q m to the initial training set L to generate the sample annotation set Q; meanwhile, delete the corresponding m encrypted traffic instances in the sample pool; where m is a positive integer; Train the logistic regression detection model with the encrypted traffic instances in the sample annotation set Q, and determine the prediction accuracy of the trained logistic regression detection model Make a judgment; In response to the prediction accuracy of the logistic regression detection model trained by the sample annotation set Q is less than the preset accuracy threshold A cc , then based on the sample annotation set Q, m encrypted traffic instances are selected again from the sample pool after deleting m encrypted traffic instances through a density-weighted query strategy for annotation, a new intermediate sample annotation set is generated and added to the sample annotation set Q to generate the sample annotation set Q ′ , and the logistic regression detection model is trained through the generated sample annotation set Q ′ until the prediction accuracy of the trained logistic regression prediction model is greater than or equal to the preset accuracy threshold A cc , or the number of queries for encrypted traffic instances is greater than the preset query number threshold c, then the corresponding logistic regression detection model is output.

8. The density-weighted encrypted malicious traffic detection method according to claim 7, wherein The selection of m encrypted traffic instances from the sample pool for labeling through the density-weighted query strategy includes: Use the Euclidean distance as the distance metric function for encrypted traffic instances, and calculate the uncertainty φ of the encrypted traffic instances in the sample pool x and the information density I(x); The uncertainty φ of each encrypted traffic instance in the sample pool x is weighted according to the corresponding information density I(x) to obtain the information degree X of each encrypted traffic instance in the sample pool * ; Select the first m information degrees X in the sample pool in descending order * Perform annotation on the corresponding encrypted traffic instances.

9. The density-weighted encrypted malicious traffic detection method according to claim 8, wherein, According to the formula: φ x = -ΣP θ (y i |x)·lnP θ (y i |x) Calculate the uncertainty φ of the encrypted traffic instance x in the sample pool x ; where P θ (y i |x) is the posterior probability that the encrypted traffic instance x is predicted as the i-th category; y i is the encrypted traffic where the encrypted traffic instance x is predicted as the i-th category; among them, when i = 1, y i = y1, indicating that the encrypted traffic instance x is predicted as encrypted benign traffic; when i = 2, y i = y2, indicating that the encrypted traffic instance x is predicted as encrypted malicious traffic According to the formula: Calculate the information density I(x) of the encrypted traffic instance x in the sample pool; where X u represents all encrypted traffic instances in the sample pool, |X u | represents the average similarity between the encrypted traffic instance x and other encrypted traffic instances in the sample pool; x ′ represents other encrypted traffic instances in the sample pool except the encrypted traffic instance x; sim(x, x′) represents the sum of the Euclidean distances between the encrypted traffic instance x and all other encrypted traffic instances x′; According to the formula: X * = φ x × [I(x)] β Calculate the information degree X of the encrypted traffic instance x in the sample pool * ; where β is the information density control parameter, and its value is a constant.

Images