A density-weighted encrypted malicious traffic detection method

Abstract

The application relates to the technical field of network security, and provides a density-weighted encrypted malicious traffic detection method. In the method, an information metric sample set F is quantitatively processed to generate an encrypted traffic description feature set A, and the encrypted traffic sample set A is reduced in dimension to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances; then, a logic regression detection model constructed based on a logic regression algorithm is trained by using a density-weighted query strategy and the encrypted traffic sample set to detect encrypted malicious traffic. Therefore, the uncertainty of samples is density-weighted, a lightweight training set is constructed, a model can have high performance by using a small amount of labeled instances, and lightweight detection of TLS encrypted malicious traffic is realized at a data level.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a density-weighted encrypted malicious traffic detection method. BACKGROUND

[0002] With the wide application of communication encryption technology, not only legal application programs adopt encryption technology to protect privacy, but also malicious software adopts encryption technology to cover up its attack behavior, so that the traditional detection method based on deep packet and payload is invalid. In recent years, computer technology and artificial intelligence have developed rapidly, and the research on TLS encrypted malicious traffic detection method based on machine learning and deep learning has attracted widespread attention.

[0003] The detection method based on machine learning mainly depends on feature engineering and model selection, and mainly selects features by extracting TLS handshake features, traffic features, DNS response and HTTP header message features of encrypted traffic, and then trains the features by using a machine learning model. However, the manually selected features have the problem of multicollinearity, which affects the detection effect of the machine learning model.

[0004] The method based on deep learning mainly learns rules and extracts features from traffic directly through auto-encoding network, convolutional neural network or long short-term memory neural network, and then trains the automatically extracted features by using a deep network. However, this way increases the computational complexity and is not conducive to local deployment. Although the clustering by the unsupervised learning method can achieve good results, this method is sensitive to abnormal points. SUMMARY

[0005] The present application aims to provide a density-weighted encrypted malicious traffic detection method to solve or alleviate the problems in the prior art.

[0006] In order to achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0007] The present application provides a density-weighted encrypted malicious traffic detection method, comprising:

[0008] The encrypted traffic description feature set A generated by quantizing the informative metric sample set F is dimensionally reduced to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances;

[0009] The logistic regression detection model constructed based on a logistic regression algorithm is trained by a density-weighted query strategy and the encrypted traffic sample set to detect encrypted malicious traffic.

[0010] Preferably, the encrypted traffic description feature set A generated by quantizing the informative metric sample set F comprises:

[0011] The information metric sample set F contains N encrypted traffic instances, and each of the encrypted traffic instances adopts flow fingerprint associated flow features and TLS handshake features as traffic sample features; wherein N is a positive integer;

[0012] The flow features and the TLS handshake features of each of the encrypted traffic instances are processed to generate the encrypted traffic description feature set A.

[0013] Preferably, the processing of the flow features and the TLS handshake features of each of the encrypted traffic instances includes

[0014] The flow features in the encrypted traffic instances are standardized, the encryption algorithm selected by the server when the Client Hello first initiates the handshake request in the TLS handshake features of the encrypted traffic instances is discretized and normalized, and the certificate subject features and the certificate issuer features selected by the server when the Client Hello first initiates the handshake request in the TLS handshake features are processed using TF-IDF encoding.

[0015] Preferably, the encrypted traffic description feature set A generated is reduced in dimension to obtain an encrypted traffic sample set, including:

[0016] By presetting the minimum variance The variance of each feature in the encrypted traffic description feature set A calculated based on the variance analysis method is screened to generate an intermediate feature set F m ;

[0017] According to a preset maximum correlation threshold The correlation of each feature in the intermediate feature set F calculated based on the maximum information coefficient method m is screened to generate the encrypted traffic sample set.

[0018] Preferably, the encrypted traffic sample set and the density-weighted query strategy are used to train a logistic regression detection model constructed based on a logistic regression algorithm, including:

[0019] The encrypted traffic instances in the encrypted traffic sample set are divided into a training set and a test set according to a preset proportion, and part of the encrypted traffic instances in the training set are labeled to generate an initial training set L, and the unlabeled encrypted traffic instances constitute a sample pool;

[0020] The encrypted traffic instances in the sample pool are cyclically queried through the density-weighted query strategy, and combined with the initial training set L, a sample labeled set is generated;

[0021] ​training the logistic regression detection model through the encrypted traffic instances in the sample labeled set, and calculating the prediction accuracy of the trained logistic regression detection model through the test set

[0022] in response to the prediction accuracy being greater than or equal to a preset accuracy threshold A cc , or the number of queries to the encrypted traffic instances in the sample pool being greater than a preset query number threshold c, outputting the corresponding logistic regression detection model.

[0023] Preferably, the labeling of part of the encrypted traffic instances in the training set generates an initial training set L, comprising:

[0024] The encrypted benign traffic instances and encrypted malicious traffic instances in the training set are sorted, and part of the encrypted traffic instances in the sorted training set are labeled according to an equal-interval sampling strategy to generate the initial training set L.

[0025] Preferably, it comprises: selecting m encrypted traffic instances from the sample pool for labeling through a density-weighted query strategy to generate an intermediate sample labeled set q m , and adding the intermediate sample labeled set q m to the initial training set L to generate the sample labeled set Q; at the same time, deleting the corresponding m encrypted traffic instances in the sample pool; wherein m is a positive integer;

[0026] training the logistic regression detection model through the encrypted traffic instances in the sample labeled set Q, and judging the prediction accuracy of the trained logistic regression detection model .

[0027] in response to the prediction accuracy of the logistic regression detection model trained through the sample labeled set Q being less than a preset accuracy threshold A cc , based on the sample labeled set Q, selecting m encrypted traffic instances from the sample pool after deleting m encrypted traffic instances for labeling again through a density-weighted query strategy to generate a new intermediate sample labeled set and add it to the sample labeled set Q to generate a sample labeled set Q', and training the logistic regression detection model through the generated sample labeled set Q', until the prediction accuracy of the trained logistic regression prediction model is greater than or equal to a preset accuracy threshold A cc , or the number of queries to the encrypted traffic instances is greater than a preset query number threshold c, outputting the corresponding logistic regression detection model.

[0028] Preferably, the query strategy by density weighting selects m encrypted traffic instances from the sample pool for labeling, comprising:

[0029] The Euclidean distance is used as the distance measurement function of the encrypted traffic instance, and the uncertainty φ of the encrypted traffic instance in the sample pool is calculated x and the information density I(x);

[0030] The uncertainty φ of each encrypted traffic instance in the sample pool is calculated x According to the corresponding information density I(x), the information degree X of each encrypted traffic instance in the sample pool is weighted * ;

[0031] The first m information degrees X * corresponding encrypted traffic instances in the sample pool are selected from large to small, and the encrypted traffic instances are labeled.

[0032] Preferably, according to the formula:

[0033] φ x =-∑P θ (y i |x)·lnP θ (y i |x)

[0034] The uncertainty φ of the encrypted traffic instance x in the sample pool is calculated x ; In the formula, P θ (y i |x) is the posterior probability that the encrypted traffic instance x is predicted as the i-th class; y i is the encrypted traffic instance x predicted as the i-th class; where i=1, y i =y1, indicating that the encrypted traffic instance x is predicted as encrypted benign traffic; i=2, y i =y2, indicating that the encrypted traffic instance x is predicted as encrypted malicious traffic;

[0035] According to the formula:

[0036]

[0037] The information density I(x) of the encrypted traffic instance x in the sample pool is calculated; In the formula, X u represents all encrypted traffic instances in the sample pool, |X u | represents the average similarity of the encrypted traffic instance x and other encrypted traffic instances in the sample pool; x' represents other encrypted traffic instances in the sample pool except the encrypted traffic instance x; sim(x, x') represents the sum of the Euclidean distances between the encrypted traffic instance x and all other encrypted traffic instances x';

[0038] According to the formula:

[0039] X * = φ x x [I(x)] β

[0040] Calculate the information degree X of the encrypted traffic instance x in the sample pool * ; In the formula, β is an information density control parameter, which is a constant.

[0041] Advantages:

[0042] The density-weighted encrypted malicious traffic detection method provided by the embodiments of the application quantitatively processes the information measurement sample set F, generates an encrypted traffic description feature set A, and reduces the dimension of the encrypted traffic sample set A to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances. Then, the density-weighted query strategy and the encrypted traffic sample set are used to train a logistic regression detection model based on a logistic regression algorithm to detect encrypted malicious traffic.

[0043] Therefore, through the quantitative processing of the information measurement sample set, the encrypted traffic instances contained therein are dimensionally unified, the effectiveness of the measurement features is improved, and the problems of feature redundancy and multicollinearity are solved. By reducing the dimension of the encrypted traffic sample set A, the computational complexity is effectively reduced while eliminating redundancy and noise and avoiding overfitting, thereby saving computing resources. The density-weighted query strategy takes into account the uncertainty of the sample and the data distribution in the spatial domain, which makes up for the shortcomings of the single uncertainty strategy that easily queries abnormal points due to considering information, and thus queries traffic instances with large information quantity and strong representativeness in the unlabeled sample pool. By combining these traffic instances, a lightweight training set is constructed. The lightweight training set constructed by the density-weighted query strategy is used to train the logistic regression detection model using a small number of labeled instances, so that the logistic regression detection model achieves high performance, greatly reduces the artificial labeling cost and computational overhead, and realizes lightweight detection of encrypted malicious traffic at the data level. BRIEF DESCRIPTION OF DRAWINGS

[0044] The drawings accompanying the specification of the present application are used to provide a further understanding of the present application, the illustrative embodiments of the present application and the description thereof serve to explain the present application, and do not constitute an improper limitation of the present application. Among them:

[0045] Fig. 1 A flowchart of a density-weighted encrypted malicious traffic detection method according to some embodiments of the present application is shown in the drawings;

[0046] Fig. 2A logical diagram of a density-weighted encrypted malicious traffic detection method according to some embodiments of the present application is provided;

[0047] Fig. 3 A schematic diagram of a density-weighted query strategy for labeling encrypted traffic instances according to some embodiments of the present application is provided.

[0048] Fig. 4 A schematic diagram of the results of three different query strategies according to some embodiments of the present application is provided. DETAILED DESCRIPTION

[0049] The present application will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments. Each example is provided by way of explanation of the present application, rather than limitation of the present application. In fact, those skilled in the art will appreciate that modifications and variations can be made in the present application without departing from the scope or spirit of the present application. For example, features shown or described as part of one embodiment can be used in another embodiment to produce yet another embodiment. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0050] In the prior art, the traffic detection methods based on machine learning and deep learning have a common problem, i.e., they all need a large number of labeled sample data for model training, and when the labeled samples are few, the performance of the detection model will be greatly reduced. However, in a real network environment, obtaining a large number of high-quality labeled samples requires a lot of manpower and material resources, which not only has a high cost but also results in a low detection efficiency of the trained model.

[0051] Based on this, the present specification provides a density-weighted encrypted malicious traffic detection method, which constructs a lightweight training set by density weighting the uncertainty of samples, and uses a small number of labeled instances to enable the model to have high performance, thereby realizing lightweight detection of TLS encrypted malicious traffic from the data level and effectively solving the sample labeling problem in the prior art.

[0052] As shown in the Figs. 1 to 4 The density-weighted encrypted malicious traffic detection method includes:

[0053] Step S101, dimension reduction is performed on the encrypted traffic description feature set A generated by quantization processing of the informative metric sample set F, to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances.

[0054] The flow fingerprint is a unique representation generated for each encrypted traffic instance according to the five-tuple (a set of source IP, destination IP, source port, destination port and protocol) of network traffic. The flow fingerprint is used to associate the flow characteristics and the TLS handshake characteristics of each encrypted traffic instance. The flow characteristics include the characteristics and reaching process of the bidirectional TLS encrypted flow, specifically including the double-end connection state of TCP, the traffic of data packets, the duration of traffic, the number of bytes of headers, the ratio of the number of backward data packets and the number of forward data packets, and the size of the payload. The TLS handshake characteristics include the encryption algorithm selected by the server when the ClientHello initiates the handshake request for the first time, the certificate subject, and the certificate issuer.

[0055] The flow characteristics and the TLS handshake characteristics associated by the flow fingerprint are used as the traffic sample characteristics of the encrypted traffic instance, and N (N is a positive integer) encrypted traffic instances are used to construct an informative metric sample set F. The flow characteristics and the TLS handshake characteristics of each encrypted traffic instance in the informative metric sample set F are processed. The flow characteristics in the encrypted traffic instance are standardized, the encryption algorithm selected by the server when the ClientHello initiates the handshake request for the first time in the TLS handshake characteristics of the encrypted traffic instance is discretized and normalized, and the certificate subject characteristics and the certificate issuer characteristics in the TLS handshake characteristics are processed by TF-IDF encoding. The flow characteristics and the TLS handshake characteristics after processing constitute an encrypted traffic description feature set A.

[0056] Then, the encrypted traffic description feature set A is reduced in dimension. First, the variance of each feature in the informative metric sample set F is calculated by using the variance analysis method and the minimum variance is set. The variance of each feature in the informative metric sample set F is filtered, and the features with are removed, to obtain an intermediate feature set F m . Next, the correlation of each feature in the intermediate feature set F m is calculated by using the maximum information coefficient method and the maximum correlation threshold is set. The correlation of each feature in the intermediate feature set F m is filtered, and the features with are removed, to obtain an encrypted traffic sample set.

[0057] In step S102, the logistic regression detection model constructed based on the logistic regression algorithm is trained by using the density-weighted query strategy and the encrypted traffic sample set, to detect encrypted malicious traffic.

[0058] The dimensionality reduction of the encrypted traffic description feature set A is performed by variance analysis and maximum information coefficient method, and the features with significant variance changes are retained Weak correlation The encrypted traffic sample set is composed of the features. The encrypted traffic sample set includes encrypted benign traffic instances and encrypted malicious traffic instances, and the ratio of the encrypted benign traffic instances to the encrypted malicious traffic instances is 1:1. The encrypted traffic instances in the encrypted traffic sample set are divided into a training set and a test set according to a preset ratio of 7:3. When the training set and the test set are divided, the ratio of the encrypted benign traffic instances to the encrypted malicious traffic instances in the training set and the test set is 1:1.

[0059] A part of the encrypted traffic instances in the training set are labeled, and the labeled encrypted traffic instances are used to form an initial labeled training set L. Another part of the unlabeled encrypted traffic instances form an unlabeled sample pool. Specifically, the encrypted traffic instances in the training set are arranged in the order of the first part being encrypted benign traffic instances and the second part being encrypted malicious traffic instances, and the number of encrypted traffic instances in the two parts is 0.35N. According to the equal-interval sampling strategy, 0.5% of the total number of encrypted traffic instances in the arranged training set are labeled to form the initial training set L. The other 99.5% of the encrypted traffic instances in the training set form the unlabeled sample pool.

[0060] When the encrypted traffic instances in the training set are sampled according to the equal-interval sampling strategy, 0.5% of the encrypted benign traffic instances are extracted from the first part of 0.35N encrypted benign traffic instances, and 0.5% of the encrypted malicious traffic instances are extracted from the second part of 0.35N encrypted malicious traffic instances. The extracted 0.0035N encrypted traffic instances from the two parts form the initial training set L.

[0061] In this application, a logistic regression detection model based on a logistic regression algorithm is constructed to detect whether the encrypted traffic is encrypted malicious traffic. Before the logistic regression detection model is trained by a small sample labeled set, it is only an algorithm with default parameters and cannot be directly used to detect encrypted malicious traffic. After the logistic regression detection model is trained by the small sample labeled set, the parameters of the logistic regression detection model are updated, and the logistic regression detection model can be used to detect whether the encrypted traffic is encrypted malicious traffic.

[0062] The logistic regression detection model is trained by a density-weighted query strategy and an encrypted traffic sample set. Specifically, the encrypted traffic instances in the sample pool are queried in a loop by the density-weighted query strategy, and the initial training set L is combined to generate a sample labeled set. The density-weighted query strategy selects m encrypted traffic instances from the sample pool for labeling to generate an intermediate sample labeled set q m m ​An initial training set L is added to generate a sample label set Q. At the same time, m (m is a positive integer) encrypted traffic instances corresponding to the sample pool are deleted to form a new sample pool.

[0063] Wherein, when m encrypted traffic instances are selected from the sample pool for labeling by the density-weighted query strategy, first, the Euclidean distance is used as the distance measurement function of the encrypted traffic instance to calculate the uncertainty φ x and information density I(x) of the encrypted traffic instance in the sample pool. Specifically, according to the formula:

[0064] φ x =-∑P θ (y i |x)·lnP θ (y i |x)

[0065] The uncertainty φ x of the encrypted traffic instance in the sample pool is calculated; in the formula, P θ (y i |x) is the posterior probability that the encrypted traffic instance x is predicted as the i-th category; y i is the encrypted traffic instance x predicted as the i-th category; when i = 1, y i =y1, indicating that the encrypted traffic instance x is predicted as the first category of encrypted traffic, i.e., the encrypted traffic instance x is predicted as encrypted benign traffic; when i = 2, y i =y2, indicating that the encrypted traffic instance x is predicted as the second category of encrypted traffic, i.e., the encrypted traffic instance x is predicted as encrypted malicious traffic.

[0066] According to the formula:

[0067]

[0068] The information density I(x) of the encrypted traffic instance in the sample pool is calculated; in the formula, X u represents all encrypted traffic instances in the sample pool (current sample pool), |X u | represents the average similarity of the encrypted traffic instance x and other encrypted traffic instances in the sample pool (current sample pool); x' represents other encrypted traffic instances in the sample pool (current sample pool) except the encrypted traffic instance x; sim(x, x') represents the sum of the Euclidean distances between the encrypted traffic instance x and all other encrypted traffic instances x'.

[0069] After obtaining the uncertainty φ x and the information density I(x) of each encrypted traffic instance in the sample pool, the uncertainty φ xAccording to the corresponding information density I(x), the information degree X of each encrypted traffic instance in the sample pool is weighted * , specifically, according to the formula:

[0070] X * = β x × [I(x)] β

[0071] The information degree X of each encrypted traffic instance in the sample pool is calculated * ; wherein, β is an information density control parameter, which is a constant. In this application, the information density control parameter β = 1. Then, the first m information degrees X * corresponding to the encrypted traffic instances in the sample pool are selected from large to small, and the encrypted traffic instances are labeled to generate an intermediate sample label set q m . That is, the intermediate sample label set q m contains the first m information degrees X * corresponding to the encrypted traffic instances in the sample pool.

[0072] Finally, the m encrypted traffic instances contained in the intermediate sample set q m are added to the initial training set L to generate a sample label set Q, and the logistic regression detection model is trained through the encrypted traffic instances in the sample label set Q, and the prediction accuracy of the trained logistic regression detection model is calculated through the test set If the prediction accuracy of the logistic regression detection model trained through the sample label set Q is less than a preset accuracy threshold A cc , then based on the sample label set Q, the density-weighted query strategy is used to select m encrypted traffic instances from the sample pool after deleting the m encrypted traffic instances to generate a new intermediate sample label set and add it to the sample label set Q to generate a sample label set Q', and the logistic regression detection model is trained through the generated sample label set Q', until the prediction accuracy of the trained logistic regression prediction model is greater than or equal to the preset accuracy threshold A cc , or the number of queries of the encrypted traffic instance is greater than a preset query number threshold c, then the corresponding logistic regression detection model is output.

[0073] Compared with existing uncertainty sampling query strategy (UNSM) and graph density query strategy (UNGD), the density-weighted query strategy (UNID) has better superiority in detecting the encrypted traffic instance to be classified by the logistic regression detection model trained by the density-weighted query strategy (UNID) to determine whether it is encrypted malicious traffic, and the performance of the logistic regression detection model can gradually and steadily improve with the increase of the number of queries, that is, the more the number of queries, the more accurate the detection of the logistic regression detection model, and the higher the precision, so as to realize efficient and lightweight encrypted malicious traffic detection.

[0074] In the present application, when the informative metric sample set F of the encrypted traffic instance is established, the metric features in the informative metric sample set F are dimensionally unified, the variance analysis method and the maximum information coefficient method are used to improve the effectiveness of the features in the informative metric sample set F, and the problems of feature redundancy and multicollinearity are solved; the Euclidean distance is used to calculate the distance between the encrypted traffic instances, accurately reflect the distance between two encrypted traffic instances in the spatial domain, improve the accuracy of the description of the distribution of the encrypted traffic instances in the spatial domain, and make the density-weighted query strategy better reflect the representativeness of the encrypted traffic instance.

[0075] The density-weighted query strategy can consider the uncertainty of the encrypted traffic instance and the data distribution in the spatial domain at the same time, which is beneficial to avoid the abnormal points in the unlabeled sample pool, and then query the instances with large information quantity and strong representativeness in the sample pool, and construct a lightweight training set for the training of the logistic regression detection model; at the same time, using the density-weighted query strategy can use a small amount of labeled encrypted traffic instances to make the logistic regression detection model reach a high performance, greatly reduce the cost of manual labeling and the calculation overhead of hardware, and realize lightweight detection of TLS encrypted malicious traffic at the data level.

[0076] In the description of the present application, it should be understood that the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present application, the illustrative description of the above terms is not necessarily for the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples.

[0077] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A density-weighted encrypted malicious traffic detection method, characterized in that, The method comprises the following steps: Informational metric sample set A set of encrypted traffic descriptive features generated by performing quantization processing Dimension reduction is performed to obtain an encrypted traffic sample set containing encrypted benign traffic instances and encrypted malicious traffic instances; Training a logistic regression detection model based on a logistic regression algorithm by a density-weighted query strategy and the encrypted traffic sample set to detect encrypted malicious traffic; The encrypted traffic instances in the encrypted traffic sample set are divided into a training set and a test set according to a preset proportion, and part of the encrypted traffic instances in the training set are labeled to generate an initial training set , and the unlabeled encrypted traffic instances constitute a sample pool; selecting, from the sample pool, by a density-weighted query strategy encrypted traffic instances for labeling to generate an intermediate sample labeled set ; wherein the selecting, from the sample pool, by a density-weighted query strategy encrypted traffic instances for labeling, comprises: adopting Euclidean distance as a distance measurement function of the encrypted traffic instances, and according to a formula: computing encrypted traffic instances in the sample pool of uncertainty ; where, is an encrypted traffic instance predicted to be of the first category; is an encrypted traffic instance predicted to be of the first category; where, when, , indicates that the encrypted traffic instance is predicted to be encrypted benign traffic; when, , indicates that the encrypted traffic instance is predicted to be encrypted malicious traffic; According to the formula: Calculate the encrypted traffic instances in the sample pool. Information density In the formula, This represents all encrypted traffic instances in the sample pool. Indicates encrypted traffic instance Average similarity with other encrypted traffic instances in the sample pool; This indicates that the sample pool contains instances of encrypted traffic. Other encrypted traffic instances besides; Indicates encrypted traffic instance Compared to all other encrypted traffic instances The sum of the Euclidean distances between them; According to the formula: uncertainty for each instance of encrypted traffic in the sample pool according to the corresponding information density weighting to obtain the information degree of each instance of encrypted traffic in the sample pool ; information density control parameter, constant value According to selecting the sample pool in the descending order of the information degree Annotate the corresponding encrypted traffic instance; annotating the intermediate sample set adding the initial training set generating the sample set ; meanwhile, deleting the corresponding encrypted traffic instances in the sample pool; is a positive integer; Through the sample label set The logic regression detection model is trained by the encrypted traffic instance in the sample label set, and the prediction accuracy of the trained logic regression detection model is judged ; in response to the sample labeling set the prediction accuracy of the trained logistic regression detection model is less than a preset accuracy threshold , then based on the sample labeling set , select again encrypted traffic instances from the sample pool after the encrypted traffic instances are deleted for labeling to generate a new intermediate sample labeling set and add the new intermediate sample labeling set to the sample labeling set to generate a sample labeling set , and train the logistic regression detection model based on the generated sample labeling set until the prediction accuracy of the trained logistic regression detection model is greater than or equal to the preset accuracy threshold , or the number of queries of the encrypted traffic instances is greater than a preset query number threshold , output the corresponding logistic regression detection model.

2. The density-weighted encrypted malicious traffic detection method of claim 1, wherein, The pair of information metric sample sets The encrypted traffic description feature set generated by performing quantization processing , comprising: The informative metric sample set contains Each of the encrypted traffic instances adopts flow features associated with the flow fingerprints and TLS handshake features as traffic sample features; wherein, is a positive integer; processing the flow features and the TLS handshake features of each of the encrypted traffic instances to generate the encrypted traffic description feature set .

3. The density-weighted encrypted malicious traffic detection method of claim 2, wherein, The processing of the flow features and the TLS handshake features of each of the encrypted traffic instances comprises The flow features in the encrypted traffic instances are standardized, the encryption algorithm selected by the server when the Client Hello initiates the handshake request for the first time in the TLS handshake features of the encrypted traffic instances is discretized and normalized, and the certificate subject features and the certificate issuer features selected by the server when the Client Hello initiates the handshake request for the first time in the TLS handshake features are processed by TF-IDF encoding.

4. The density-weighted encrypted malicious traffic detection method of claim 1, wherein, Generated encrypted traffic description feature set Dimension reduction is performed to obtain an encrypted traffic sample set, comprising: by presetting minimum variance the set of encrypted traffic description features calculated based on the variance analysis method variance of each feature in the set of intermediate features perform screening to generate a set of intermediate features ; according to a preset maximum correlation threshold the intermediate feature set calculated based on the maximum information coefficient method the correlation of each feature screening is performed to generate the encrypted traffic sample set.

5. The density-weighted encrypted malicious traffic detection method of claim 1, wherein, The labeling of the part of encrypted traffic instances in the training set generates an initial training set , comprising: The encrypted benign traffic instances and the encrypted malicious traffic instances in the training set are sorted, and part of the encrypted traffic instances in the sorted training set are labeled according to an equal-interval sampling strategy, to generate the initial training set .

Images