A malicious encrypted traffic detection method and system based on ciphertext entropy value
By analyzing the ciphertext entropy of encrypted traffic data packets and constructing a dynamic entropy threshold, the problems of high false positive rate and poor scenario adaptability of existing malicious encrypted traffic detection schemes are solved, and accurate identification and practical detection of malicious encrypted traffic are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-26
- Publication Date
- 2026-05-12
AI Technical Summary
Existing malicious encrypted traffic detection solutions suffer from high false positive rates, are unable to accurately identify malicious encrypted traffic, and fail to meet the security detection needs of real-world network scenarios. Furthermore, non-decryption detection solutions lack targeted modeling of the randomness of malicious traffic.
By acquiring encrypted traffic data packets, parsing and extracting ciphertext data, dividing it into ciphertext blocks of a preset size, calculating the information entropy value of each ciphertext block, and matching the ciphertext entropy features with preset judgment conditions, a dynamic entropy threshold is constructed to identify malicious traffic.
It effectively reduces the false positive rate, improves detection accuracy and scenario adaptability, and enables accurate identification and practical detection of malicious encrypted traffic.
Smart Images
Figure CN121396686B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of encryption technology, and in particular to a method and system for detecting malicious encrypted traffic based on ciphertext entropy. Background Technology
[0002] With the increasing prevalence of encryption in network communication, encryption protocols such as SSL / TLS and SSH are widely used in various network scenarios, effectively ensuring the security of data transmission. However, they also provide covert channels for malicious encrypted traffic (such as encrypted traffic generated by malware propagation and data theft), posing a serious threat to network security.
[0003] To address this issue, existing technologies mainly consist of two categories of malicious encrypted traffic detection schemes: decryption detection and non-decryption detection. Decryption detection schemes require obtaining the encryption key or cracking the encryption protocol, converting the encrypted traffic into plaintext, and then analyzing it using traditional methods such as deep packet inspection. However, in practical applications, obtaining the key is extremely difficult, and brute-force attacks pose legal compliance risks, making large-scale deployment challenging.
[0004] Non-decryption detection schemes, which do not require decryption of traffic, have become the mainstream research direction, mainly including two implementation methods: feature extraction-based and machine learning-based. Feature extraction-based schemes parse the packet header and then use the extracted information to perform detection by matching with a rule base; machine learning-based schemes use supervised learning, unsupervised learning, deep learning, or ensemble learning models to mine the temporal, spatial, or abnormal cluster characteristics of traffic. However, existing non-decryption detection schemes still have significant shortcomings: on the one hand, some schemes do not consider the different characteristics of traffic under different network scenarios, resulting in a high false positive rate; on the other hand, existing thresholds lack targeted modeling of the randomness of malicious traffic, making it difficult to accurately identify malicious encrypted traffic, thus failing to effectively reflect the stability of traffic randomness and locate abnormal positions, further affecting the detection accuracy and failing to meet the security detection needs of real-world network scenarios. Summary of the Invention
[0005] Therefore, it is necessary to provide a method and system for detecting malicious encrypted traffic based on ciphertext entropy value to address the above-mentioned technical problems, thereby solving at least one of the problems existing in the prior art.
[0006] Firstly, the embodiments of this application provide a method for detecting malicious encrypted traffic based on ciphertext entropy, comprising:
[0007] Get the current encrypted traffic data packets;
[0008] The current encrypted traffic data packet is parsed, and the ciphertext data is extracted;
[0009] The encrypted data is divided into encrypted blocks of a preset size, and the information entropy value corresponding to each encrypted block is calculated.
[0010] Based on the information entropy value corresponding to each ciphertext block, determine the ciphertext entropy characteristics of the current encrypted traffic;
[0011] The current encrypted traffic ciphertext entropy feature is matched with preset judgment conditions, and the current encrypted traffic is determined to be malicious encrypted traffic based on the matching result.
[0012] In one possible implementation, before matching the ciphertext entropy feature of the current encrypted traffic with preset judgment conditions and determining whether the current encrypted traffic is malicious encrypted traffic based on the matching result, the method further includes:
[0013] Based on malware samples, determine the ciphertext entropy characteristics of malware;
[0014] Based on normal encrypted traffic data, determine the ciphertext entropy characteristics of normal encrypted traffic;
[0015] Based on the theoretical probability distribution of bytes in the ciphertext data, determine the theoretical maximum entropy value;
[0016] Based on the ciphertext entropy characteristics of the malicious software, the ciphertext entropy characteristics of normal encrypted traffic, and the theoretical maximum entropy value, the preset judgment conditions are constructed.
[0017] In one possible implementation, the preset determination conditions include at least one of the following: a threshold range related to the theoretical maximum entropy value, a normal threshold range related to the entropy characteristics of normal encrypted traffic ciphertext, a first malicious threshold range and a second malicious threshold range related to the entropy characteristics of malicious software ciphertext, a first entropy value fluctuation threshold, a second entropy value fluctuation threshold, and a paired entropy value difference threshold.
[0018] In one possible implementation, the current encrypted traffic ciphertext entropy feature includes at least one of the following: the average current encrypted traffic ciphertext entropy, the standard deviation of the current encrypted traffic ciphertext entropy, the forward entropy value, and the backward entropy value.
[0019] In one possible implementation, the step of matching the ciphertext entropy feature of the current encrypted traffic with preset judgment conditions, and determining whether the current encrypted traffic is malicious encrypted traffic based on the matching result, includes:
[0020] If the average ciphertext entropy of the current encrypted traffic is within a threshold range related to the theoretical maximum entropy value, then the current encrypted traffic is normal encrypted traffic; or
[0021] If the average ciphertext entropy of the current encrypted traffic is within the normal threshold range, then the current encrypted traffic is normal encrypted traffic; or
[0022] If the average ciphertext entropy of the current encrypted traffic is within the first malicious threshold range, then the current encrypted traffic is malicious encrypted traffic; or
[0023] If the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the first entropy value fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or
[0024] If the average ciphertext entropy of the current encrypted traffic is within the second malicious threshold range, and the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the second entropy fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or
[0025] If the absolute value of the difference between the forward entropy value and the backward entropy value is greater than or equal to the threshold value of the pairwise entropy difference, then the current encrypted traffic is malicious encrypted traffic.
[0026] In one possible implementation, determining the ciphertext entropy characteristics of the current encrypted traffic based on the information entropy value corresponding to each ciphertext block includes:
[0027] Based on the information entropy value corresponding to each ciphertext block, the average ciphertext entropy of the current encrypted traffic is calculated;
[0028] Based on the information entropy value corresponding to each ciphertext block and the average ciphertext entropy of the current encrypted traffic, the variance of the ciphertext entropy of the current encrypted traffic is calculated.
[0029] Based on the variance of the current encrypted traffic ciphertext entropy, the standard deviation of the current encrypted traffic ciphertext entropy is calculated.
[0030] In one possible implementation, determining the ciphertext entropy characteristics of the current encrypted traffic based on the information entropy values corresponding to each ciphertext block further includes:
[0031] According to the preset segmentation rules, the ciphertext data is segmented into front-end ciphertext data and back-end ciphertext data;
[0032] Extract the front-end ciphertext block corresponding to the front-end ciphertext data, and the back-end ciphertext block corresponding to the back-end ciphertext data;
[0033] The forward entropy value is calculated based on the information entropy value corresponding to each front-end ciphertext block;
[0034] The backward entropy value is calculated based on the information entropy value corresponding to each subsequent ciphertext block.
[0035] In one possible implementation, determining the malware ciphertext entropy features based on malware samples includes:
[0036] Obtain a preset number of malware samples and convert the malware samples into bytecode;
[0037] The bytecode is encrypted using a preset number of different encryption algorithms to obtain multiple malicious ciphertext data.
[0038] Calculate the information entropy value corresponding to each malicious ciphertext data;
[0039] Based on the information entropy value corresponding to each malicious ciphertext data, the average entropy value and standard deviation of the malicious ciphertext entropy are calculated.
[0040] In one possible implementation, determining the ciphertext entropy characteristics of normal encrypted traffic based on normal encrypted traffic data includes:
[0041] Obtain normal encrypted traffic data packets, parse the normal encrypted traffic data packets, and extract normal ciphertext data;
[0042] The normal ciphertext data is divided into normal ciphertext blocks of a preset size, and the information entropy value corresponding to each normal ciphertext block is calculated.
[0043] Based on the information entropy value corresponding to each normal ciphertext block, the average ciphertext entropy of normal encrypted traffic is calculated.
[0044] Secondly, a malicious encrypted traffic detection system based on ciphertext entropy is provided, including:
[0045] The current encrypted traffic data packet acquisition unit is used to acquire the current encrypted traffic data packet;
[0046] The ciphertext data extraction unit is used to parse the current encrypted traffic data packet and extract the ciphertext data;
[0047] The information entropy value determination unit is used to divide the ciphertext data into ciphertext blocks of a preset size and calculate the information entropy value corresponding to each ciphertext block.
[0048] The current encrypted traffic ciphertext entropy feature determination unit is used to determine the current encrypted traffic ciphertext entropy feature based on the information entropy value corresponding to each ciphertext block.
[0049] The malicious encrypted traffic determination unit is used to match the ciphertext entropy feature of the current encrypted traffic with preset determination conditions, and determine whether the current encrypted traffic is malicious encrypted traffic based on the matching result.
[0050] The aforementioned method and system for detecting malicious encrypted traffic based on ciphertext entropy includes the following steps: acquiring current encrypted traffic data packets; parsing the current encrypted traffic data packets and extracting ciphertext data; dividing the ciphertext data into ciphertext blocks of a preset size and calculating the information entropy value corresponding to each ciphertext block; determining the ciphertext entropy feature of the current encrypted traffic based on the information entropy value corresponding to each ciphertext block; matching the ciphertext entropy feature of the current encrypted traffic with preset judgment conditions, and determining whether the current encrypted traffic is malicious encrypted traffic based on the matching result. In this embodiment, information entropy is used to measure the randomness of traffic data, and ciphertext entropy features are incorporated into the judgment criteria to quantify the stability of randomness. Simultaneously, a fixed threshold design is abandoned, and a dynamic entropy threshold is constructed by combining malicious software sample features. This achieves targeted modeling of the randomness of malicious traffic, effectively reducing the false positive rate and improving scenario adaptability. It overcomes the deficiency of existing solutions that ignore the entropy feature of malicious traffic, significantly improving the accuracy and practicality of malicious encrypted traffic detection. Attached Figure Description
[0051] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0052] Figure 1 This is a first-class malicious encrypted traffic detection method based on ciphertext entropy in one embodiment of this application.
[0053] Figure 2 This is a schematic diagram of a malicious encrypted traffic detection system based on ciphertext entropy in one embodiment of this application;
[0054] Figure 3 This is a schematic diagram of a computer device according to one embodiment of this application. Detailed Implementation
[0055] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0056] In one embodiment, such as Figure 1 As shown, a method for detecting malicious encrypted traffic based on ciphertext entropy is provided, including the following steps:
[0057] In step S110, the current encrypted traffic data packet is obtained;
[0058] Optionally, current encrypted traffic data can be collected according to preset collection rules (such as network card mirroring technology, dynamic binary instrumentation technology, etc.). Taking network card mirroring (i.e., port mirroring) technology as an example, all transmission traffic (including received and sent data packets) of the target network card in the network can be copied in real time, and the required traffic data packets can be collected completely without interfering with the original network communication or affecting the integrity of data transmission.
[0059] The current encrypted traffic data packets may include unencrypted network layer / transport layer header information (such as source and destination IP, port number, protocol type, etc.), encrypted protocol header information transmitted in plaintext (such as protocol version, cipher suite negotiation information, etc.), encrypted ciphertext data that is the core analysis object (such as the Application-Data field data of the TLS encryption protocol), encryption protocol control information that ensures the legitimacy of encrypted communication (such as identity authentication fragments, integrity check codes, etc.), and optional network transmission management auxiliary information (such as QoS identifiers), etc.
[0060] In step S120, the current encrypted traffic data packet is parsed and the ciphertext data is extracted;
[0061] Optionally, after obtaining the current encrypted traffic data packet, the traffic data packet can be parsed according to the TLS protocol specification: first, the collected current encrypted traffic data packet is parsed layer by layer, and the header information of the network layer and transport layer (such as IP address, port number, TCP / UDP header, etc.) is identified and stripped in turn. Then, for the encryption protocol (such as TLS, SSL, SSH, etc.) corresponding to the data packet, its exclusive protocol header (such as TLS record layer, handshake layer header) and control information are parsed. Finally, the core ciphertext data processed by the encryption algorithm (such as the encrypted content of the Application-Data field in the TLS protocol, which is presented in hexadecimal form) is accurately extracted from the data packet.
[0062] In step S130, the ciphertext data is divided into ciphertext blocks of a preset size, and the information entropy value corresponding to each ciphertext block is calculated;
[0063] Optionally, the ciphertext data extracted from the encrypted traffic (such as the hexadecimal data of the ApplicationData field of the TLS protocol) is first evenly divided into several independent ciphertext blocks according to a preset fixed size (such as 1KB / block), ensuring that the length of each block is consistent to guarantee the comparability of entropy value calculations. Then, for each ciphertext block, based on the formula for calculating information entropy (such as the Shannon entropy formula), the probability of occurrence of different bytes in the block is statistically analyzed, and the information entropy value corresponding to each ciphertext block is calculated through probability distribution, thereby quantifying the randomness characteristics of each block of data.
[0064] The information entropy can be calculated using the following formula:
[0065] ;
[0066] in, It represents the probability of the ciphertext byte appearing, and b is the logarithmic base (usually taken as 2, with the unit being bits / byte).
[0067] In step S140, the ciphertext entropy characteristics of the current encrypted traffic are determined based on the information entropy value corresponding to each ciphertext block.
[0068] The current encrypted traffic ciphertext entropy features include at least one of the following: the average current encrypted traffic ciphertext entropy, the standard deviation of the current encrypted traffic ciphertext entropy, the forward entropy value, and the backward entropy value.
[0069] Optionally, firstly, the average entropy value of all ciphertext blocks is calculated to reflect the overall randomness level of the encrypted traffic. Secondly, by calculating the deviation (i.e., variance) of the entropy value of each ciphertext block from the average, the standard deviation of the entropy value is obtained to measure the stability of the traffic randomness fluctuation. Furthermore, ciphertext blocks can be grouped according to preset rules (such as segmentation by the order of ciphertext blocks), and the average entropy value of each group can be calculated to obtain the forward and backward entropy values, reflecting the differences in randomness in different parts of the traffic. By integrating these indicators, a set of ciphertext entropy features that can comprehensively characterize the randomness of the current encrypted traffic is finally formed, providing specific and multi-dimensional analytical basis for subsequent malicious traffic identification.
[0070] In step S150, the ciphertext entropy feature of the current encrypted traffic is matched with preset judgment conditions, and the current encrypted traffic is determined to be malicious encrypted traffic based on the matching result.
[0071] The preset judgment conditions include at least one of the following: a threshold range related to the theoretical maximum entropy value, a normal threshold range related to the entropy characteristics of normal encrypted traffic ciphertext, a first malicious threshold range and a second malicious threshold range related to the entropy characteristics of malicious software ciphertext, a first entropy value fluctuation threshold, a second entropy value fluctuation threshold, and a paired entropy value difference threshold.
[0072] It should be noted that the preset judgment conditions can be dynamically generated based on sample characteristics and adjusted collaboratively with changes in the scenario. That is, all thresholds in the preset judgment conditions (such as the normal threshold range, the first / second malicious threshold range, entropy fluctuation threshold, etc.) are generated based on the ciphertext entropy characteristics of malware samples and normal encrypted traffic. When new malicious samples are added (such as new malware variants) or the normal traffic scenario changes (such as an upgrade to the encryption protocol causing a change in the randomness of normal ciphertext), the corresponding thresholds in the preset judgment conditions can be updated synchronously by recalculating the core characteristics such as the average and standard deviation of the ciphertext entropy of the samples. For example, if the entropy value of newly added malicious samples is generally higher than that of historical samples, the upper limit of the first malicious threshold range will be dynamically increased; if normal traffic experiences greater entropy fluctuations due to the expansion of application scenarios, the range of the normal threshold range will also be widened accordingly. This mechanism of dynamic adjustment based on sample characteristics ensures that the thresholds in the preset judgment conditions always adapt to the actual traffic characteristics, avoiding the rigidity problem of fixed thresholds.
[0073] Optionally, the current encrypted traffic ciphertext entropy features, such as the average ciphertext entropy, standard deviation, forward entropy, and backward entropy, are matched with pre-defined judgment conditions (such as threshold intervals related to the theoretical maximum entropy, normal threshold intervals related to the ciphertext entropy features of normal encrypted traffic, first malicious threshold intervals and second malicious threshold intervals related to the ciphertext entropy features of malicious software, first entropy fluctuation threshold, second entropy fluctuation threshold, and paired entropy difference threshold, etc.) constructed based on the ciphertext entropy features of malicious software samples, normal encrypted traffic, and theoretical maximum entropy. By judging whether the specific indicators of the ciphertext entropy features meet the corresponding dynamic ciphertext entropy thresholds in the judgment conditions, the matching result is finally output, thereby accurately determining whether the current encrypted traffic is malicious encrypted traffic.
[0074] Furthermore, if the current encrypted traffic is determined to be malicious, a timely response can be taken. For example, the source or destination IP of the malicious encrypted traffic can be blocked in real time to prevent its continued transmission; the communication behavior log of the malicious IP (including communication time, number of bytes transmitted, associated ports, etc.) can be recorded to provide data support for subsequent source tracing analysis; the IP can be added to a dynamic blacklist to block all connection requests initiated by it within a certain period of time (e.g., 24 hours) to prevent it from penetrating again after changing the encryption method; alarm information can be pushed to the network management system to remind administrators to pay attention to abnormal activities in the network segment to which the IP belongs, and to conduct security checks on relevant terminals when necessary; for malicious IPs that appear repeatedly, the firewall or intrusion prevention system (IPS) can be upgraded with enhanced protection policies, such as limiting the encrypted traffic transmission rate of the network segment to which the IP belongs, or conducting stricter certificate verification on the TLS handshake requests initiated by it, to block the spread path of malicious traffic from multiple dimensions and improve the overall network protection capabilities.
[0075] In one embodiment of this application, a method for detecting malicious encrypted traffic based on ciphertext entropy is provided, comprising: acquiring a current encrypted traffic data packet; parsing the current encrypted traffic data packet and extracting ciphertext data; dividing the ciphertext data into ciphertext blocks of a preset size and calculating the information entropy value corresponding to each ciphertext block; determining the ciphertext entropy feature of the current encrypted traffic based on the information entropy value corresponding to each ciphertext block; matching the ciphertext entropy feature of the current encrypted traffic with preset judgment conditions, and determining whether the current encrypted traffic is malicious encrypted traffic based on the matching result. In this embodiment of the application, information entropy is used to measure the randomness of traffic data, and ciphertext entropy features are included in the judgment criteria to quantify the stability of randomness. At the same time, the fixed threshold design is abandoned, and a dynamic entropy threshold is constructed by combining the features of malicious software samples, so as to achieve targeted modeling of the randomness of malicious traffic, effectively reduce the false judgment rate and improve the adaptability of the scenario, make up for the defect of existing solutions that ignore the entropy features of malicious traffic, and significantly improve the accuracy and practicality of malicious encrypted traffic detection.
[0076] In one embodiment of this application, before matching the ciphertext entropy feature of the current encrypted traffic with preset judgment conditions and determining whether the current encrypted traffic is malicious encrypted traffic based on the matching result, the method further includes:
[0077] Based on malware samples, determine the ciphertext entropy characteristics of malware;
[0078] Based on normal encrypted traffic data, determine the ciphertext entropy characteristics of normal encrypted traffic;
[0079] Based on the theoretical probability distribution of bytes in the ciphertext data, determine the theoretical maximum entropy value;
[0080] Based on the ciphertext entropy characteristics of the malicious software, the ciphertext entropy characteristics of normal encrypted traffic, and the theoretical maximum entropy value, the preset judgment conditions are constructed.
[0081] Optionally, by analyzing malware samples, malware ciphertext entropy features (such as the average ciphertext entropy and standard deviation of malware ciphertext entropy) that reflect the characteristics of malicious encrypted traffic are extracted and determined. Secondly, normal encrypted traffic data is collected, and ciphertext entropy features of normal encrypted traffic (such as the average ciphertext entropy and standard deviation of normal encrypted traffic ciphertext entropy) are extracted and determined. Simultaneously, based on the theoretically uniform distribution probability of bytes (such as 0-255 bytes) of ciphertext data in the current encrypted traffic data, the theoretical maximum entropy value is calculated (as an ideal reference benchmark for data randomness). Finally, by combining the malware ciphertext entropy features, normal encrypted traffic ciphertext entropy features, and the theoretical maximum entropy value obtained above, preset judgment conditions for subsequent detection are constructed, providing a standardized comparison basis for accurately identifying malicious encrypted traffic.
[0082] It should be noted that when all bytes (0x00-0xFF) in the ciphertext data are distributed with equal probability (such as a theoretically encrypted random byte stream), the entropy reaches its theoretical maximum value, i.e. ,calculate The theoretical maximum value of entropy is obtained. It is 8.
[0083] In one embodiment of this application, the step of matching the ciphertext entropy feature of the current encrypted traffic with preset judgment conditions, and determining whether the current encrypted traffic is malicious encrypted traffic based on the matching result, includes:
[0084] If the average ciphertext entropy of the current encrypted traffic is within a threshold range related to the theoretical maximum entropy value, then the current encrypted traffic is normal encrypted traffic; or
[0085] If the average ciphertext entropy of the current encrypted traffic is within the normal threshold range, then the current encrypted traffic is normal encrypted traffic; or
[0086] If the average ciphertext entropy of the current encrypted traffic is within the first malicious threshold range, then the current encrypted traffic is malicious encrypted traffic; or
[0087] If the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the first entropy value fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or
[0088] If the average ciphertext entropy of the current encrypted traffic is within the second malicious threshold range, and the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the second entropy fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or
[0089] If the absolute value of the difference between the forward entropy value and the backward entropy value is greater than or equal to the threshold value of the pairwise entropy difference, then the current encrypted traffic is malicious encrypted traffic.
[0090] Optionally, if the average ciphertext entropy of the current encrypted traffic falls within a threshold range related to the theoretical maximum entropy value (i.e., close to an ideal random distribution, conforming to the randomness characteristics of normal encrypted data), or falls within a normal threshold range constructed based on the characteristics of normal encrypted traffic (matching the entropy value range of regular legitimate traffic), it is directly determined to be normal encrypted traffic; conversely, if any of the following situations occur, it is determined to be malicious encrypted traffic: if the average ciphertext entropy falls within the first malicious threshold range (matching the entropy value level of typical malicious traffic); if the standard deviation of the ciphertext entropy reaches or exceeds the first entropy value fluctuation threshold (reflecting drastic entropy value fluctuations, deviating from the stability characteristics of normal encrypted traffic); if the average ciphertext entropy is within the second malicious threshold range (covering the entropy value range of mutated or special malicious traffic) and simultaneously satisfies that the standard deviation of the ciphertext entropy reaches or exceeds the second entropy value fluctuation threshold (verifying malicious attributes through fluctuation characteristics); if the absolute value of the difference between the forward entropy value and the backward entropy value reaches or exceeds the pairwise entropy value difference threshold (indicating significant differences in the randomness of traffic segments, conforming to the abnormal characteristics of malicious traffic caused by payload splicing and other behaviors).
[0091] For example, if the theoretical maximum entropy value is calculated... Then the threshold range related to the theoretical maximum entropy value can be: If the average ciphertext entropy of normal encrypted traffic is calculated... Then the normal threshold range can be: If the average entropy of the malware ciphertext is calculated... Then the first malicious threshold range can be: The second malicious threshold range can be: The first entropy value fluctuation threshold can be a specific value, such as 0.5. The second entropy value fluctuation threshold can also be a specific value, such as 0.2, which can be dynamically adjusted according to the standard deviation s of the ciphertext entropy of the encrypted traffic. The pairwise entropy value difference threshold can be a specific value, such as 0.5, which can be dynamically adjusted according to the absolute value of the difference between the forward entropy value and the backward entropy value.
[0092] If the average ciphertext entropy of the encrypted traffic is calculated Standard deviation s of encrypted traffic ciphertext entropy, forward entropy value Backward entropy ,like This indicates that the current encrypted traffic is normal encrypted traffic;
[0093] like This indicates that the current encrypted traffic is normal encrypted traffic;
[0094] like If the current encrypted traffic is malicious, then it indicates that the encrypted traffic is malicious.
[0095] like If the current encrypted traffic is malicious, then it indicates that the encrypted traffic is malicious.
[0096] like and If the current encrypted traffic is malicious, then it indicates that the encrypted traffic is malicious.
[0097] like If the value is 0, it indicates that the current encrypted traffic is malicious encrypted traffic.
[0098] In one embodiment of this application, determining the ciphertext entropy characteristics of the current encrypted traffic based on the information entropy value corresponding to each ciphertext block includes:
[0099] Based on the information entropy value corresponding to each ciphertext block, the average ciphertext entropy of the current encrypted traffic is calculated;
[0100] Based on the information entropy value corresponding to each ciphertext block and the average ciphertext entropy of the current encrypted traffic, the variance of the ciphertext entropy of the current encrypted traffic is calculated.
[0101] Based on the variance of the current encrypted traffic ciphertext entropy, the standard deviation of the current encrypted traffic ciphertext entropy is calculated.
[0102] Optionally, the information entropy values of all ciphertext blocks are averaged to obtain the average ciphertext entropy of the current encrypted traffic, thus reflecting the overall randomness level of the data. Secondly, based on the deviation of the information entropy value of each ciphertext block from the above average ciphertext entropy, the variance of the ciphertext entropy of the current encrypted traffic is calculated to quantify the dispersion of the entropy value of each ciphertext block relative to the overall average level. Finally, the square root of the variance of the ciphertext entropy is taken to obtain the standard deviation of the ciphertext entropy of the current encrypted traffic, so as to intuitively reflect the fluctuation range and stability of the ciphertext block entropy value. The three together constitute the key dimensions for characterizing the randomness of the current encrypted traffic.
[0103] For example, the information entropy values corresponding to n ciphertext blocks are respectively The average ciphertext entropy of the current encrypted traffic can be calculated using the following formula:
[0104] ;
[0105] The variance of the current encrypted traffic ciphertext entropy is the entropy value of each ciphertext. The average of the squares of the differences between (i = 1-n) and the average entropy value is calculated using the following formula:
[0106] ;
[0107] The standard deviation of the ciphertext entropy value in the current encrypted traffic is the square root of the variance of the ciphertext entropy value, calculated using the following formula:
[0108] .
[0109] In one embodiment of this application, determining the ciphertext entropy characteristics of the current encrypted traffic based on the information entropy value corresponding to each ciphertext block further includes:
[0110] According to the preset segmentation rules, the ciphertext data is segmented into front-end ciphertext data and back-end ciphertext data;
[0111] Extract the front-end ciphertext block corresponding to the front-end ciphertext data, and the back-end ciphertext block corresponding to the back-end ciphertext data;
[0112] The forward entropy value is calculated based on the information entropy value corresponding to each front-end ciphertext block;
[0113] The backward entropy value is calculated based on the information entropy value corresponding to each subsequent ciphertext block.
[0114] Optionally, according to a preset segmentation rule (such as dividing the ciphertext data into a front segment based on the first 1 / 3 of the ciphertext block and a back segment based on the last 1 / 3 of the ciphertext block (the middle 1 / 3 of the ciphertext block can be ignored or included in auxiliary analysis)), the front segment ciphertext data and the back segment ciphertext data are extracted from the ciphertext data; then, from the segmented ciphertext data, the ciphertext blocks belonging to the front segment (front segment ciphertext blocks) and the ciphertext blocks belonging to the back segment (back segment ciphertext blocks) are extracted respectively; finally, based on the information entropy values of all front segment ciphertext blocks, the forward entropy value (reflecting the overall randomness level of the first half of the ciphertext data) is calculated, and based on the information entropy values of all back segment ciphertext blocks, the backward entropy value (reflecting the overall randomness level of the second half of the ciphertext data) is calculated. These two segmented entropy values further characterize the randomness differences of encrypted traffic in different data segments, enriching the dimensions of ciphertext entropy features.
[0115] In one embodiment of this application, determining the ciphertext entropy features of malware based on malware samples includes:
[0116] Obtain a preset number of malware samples and convert the malware samples into bytecode;
[0117] The bytecode is encrypted using a preset number of different encryption algorithms to obtain multiple malicious ciphertext data.
[0118] Calculate the information entropy value corresponding to each malicious ciphertext data;
[0119] Based on the information entropy value corresponding to each malicious ciphertext data, the average entropy value and standard deviation of the malicious ciphertext entropy are calculated.
[0120] Optionally, a preset number of malware samples are first obtained and converted into bytecode. Then, the bytecode of each sample is encrypted using a preset number of different encryption algorithms (such as AES, RSA, etc.) to generate multiple malicious ciphertext data under different encryption methods. Next, the information entropy value corresponding to each malicious ciphertext data is calculated to quantify its randomness characteristics. Finally, based on the information entropy values of all malicious ciphertext data, the average entropy of the malware ciphertext (reflecting the overall randomness level of the malicious ciphertext) and the standard deviation of the malware ciphertext entropy (reflecting the degree of fluctuation of randomness between different malicious ciphertexts) are obtained through statistical calculation. The two together constitute the core indicators of the malware ciphertext entropy characteristics.
[0121] It should be noted that common symmetric encryption algorithms used in the TLS protocol are shown in Table 1 below. Table 1: Examples of Encryption Algorithms
[0122]
[0123] The above 7 algorithms are respectively labeled as .
[0124] For example, a certain number (e.g., 50) of malware samples are randomly selected from a malware sample library (the original malware, in plaintext), the malware is converted into bytecode (hexadecimal), and marked as... Encryption algorithm employed. , respectively Encryption calculations were performed, resulting in 350 ciphertext data. The entropy value for each of the 350 encrypted data points is calculated using a preset entropy algorithm, such as Shannon entropy. Then, by taking the average, the average entropy of the malware ciphertext can be obtained. Based on the entropy value corresponding to each ciphertext data and the average entropy of the malware ciphertext. To determine the degree of deviation, the variance of 350 ciphertext entropy values was calculated. Finally, the square root of the ciphertext entropy variance was taken to obtain the standard deviation of the malware ciphertext entropy. .
[0125] In one embodiment of this application, determining the ciphertext entropy characteristics of normal encrypted traffic based on normal encrypted traffic data includes:
[0126] Obtain normal encrypted traffic data packets, parse the normal encrypted traffic data packets, and extract normal ciphertext data;
[0127] The normal ciphertext data is divided into normal ciphertext blocks of a preset size, and the information entropy value corresponding to each normal ciphertext block is calculated.
[0128] Based on the information entropy value corresponding to each normal ciphertext block, the average ciphertext entropy of normal encrypted traffic is calculated.
[0129] Optionally, normal encrypted traffic data packets can be collected in a normal network environment without malicious traffic, and then the traffic data packets can be parsed according to the TLS protocol specification: first, the collected normal encrypted traffic data packets are parsed layer by layer, and the header information of the network layer and transport layer (such as IP address, port number, TCP / UDP header, etc.) is identified and stripped in turn. Then, the dedicated protocol header (such as TLS record layer, handshake layer header) and control information of the encryption protocol (such as TLS, SSL, SSH, etc.) corresponding to the data packet are parsed. Finally, the core ciphertext data processed by the encryption algorithm (such as the encrypted content of the Application-Data field in the TLS protocol, which is presented in hexadecimal form) is accurately extracted from the data packet.
[0130] Then, according to a preset fixed size (e.g., 1KB / block), the ciphertext data extracted from the normal encrypted traffic data (e.g., hexadecimal data of the ApplicationData field in the TLS protocol) is evenly divided into several independent ciphertext blocks, ensuring that the length of each block is consistent to guarantee the comparability of entropy value calculations. Subsequently, for each ciphertext block, based on the formula for calculating information entropy (e.g., the Shannon entropy formula), the probability of occurrence of different bytes within the block is statistically analyzed, and the information entropy value corresponding to each ciphertext block is calculated through probability distribution, thereby quantifying the randomness characteristics of each block of data.
[0131] Finally, the average information entropy value of all ciphertext blocks is taken to obtain the average ciphertext entropy of normal encrypted traffic. .
[0132] In this embodiment, information entropy is used to measure the randomness of traffic data, and the ciphertext entropy feature is incorporated into the judgment criteria to quantify the stability of randomness. At the same time, the fixed threshold design is abandoned, and a dynamic entropy threshold is constructed by combining the features of malicious software samples. This enables targeted modeling of the randomness of malicious traffic, effectively reducing the false positive rate and improving scenario adaptability. It makes up for the shortcomings of existing solutions that ignore the entropy features of malicious traffic, and significantly improves the accuracy and practicality of malicious encrypted traffic detection.
[0133] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0134] In one embodiment, a malicious encrypted traffic detection system based on ciphertext entropy is provided, which corresponds one-to-one with the malicious encrypted traffic detection method based on ciphertext entropy in the above embodiments. For example... Figure 2As shown, the malicious encrypted traffic detection system based on ciphertext entropy includes a current encrypted traffic data packet acquisition unit 10, a ciphertext data extraction unit 20, an information entropy value determination unit 30, a current encrypted traffic ciphertext entropy feature determination unit 40, and a malicious encrypted traffic judgment unit 50. Detailed descriptions of each functional module are as follows:
[0135] Current encrypted traffic data packet acquisition unit 10 is used to acquire the current encrypted traffic data packet;
[0136] The ciphertext data extraction unit 20 is used to parse the current encrypted traffic data packet and extract the ciphertext data;
[0137] The information entropy value determination unit 30 is used to divide the ciphertext data into ciphertext blocks of a preset size and calculate the information entropy value corresponding to each ciphertext block.
[0138] The current encrypted traffic ciphertext entropy feature determination unit 40 is used to determine the current encrypted traffic ciphertext entropy feature based on the information entropy value corresponding to each ciphertext block;
[0139] The malicious encrypted traffic determination unit 50 is used to match the ciphertext entropy feature of the current encrypted traffic with preset determination conditions, and determine whether the current encrypted traffic is malicious encrypted traffic based on the matching result.
[0140] In one embodiment of this application, the system further includes: a preset judgment condition construction unit, used for:
[0141] Based on malware samples, determine the ciphertext entropy characteristics of malware;
[0142] Based on normal encrypted traffic data, determine the ciphertext entropy characteristics of normal encrypted traffic;
[0143] Based on the theoretical probability distribution of bytes in the ciphertext data, determine the theoretical maximum entropy value;
[0144] Based on the ciphertext entropy characteristics of the malicious software, the ciphertext entropy characteristics of normal encrypted traffic, and the theoretical maximum entropy value, the preset judgment conditions are constructed.
[0145] In one embodiment of this application, the preset judgment conditions include at least one of the following: a threshold range related to the theoretical maximum entropy value, a normal threshold range related to the entropy characteristics of normal encrypted traffic ciphertext, a first malicious threshold range and a second malicious threshold range related to the entropy characteristics of malicious software ciphertext, a first entropy value fluctuation threshold, a second entropy value fluctuation threshold, and a paired entropy value difference threshold.
[0146] In one embodiment of this application, the current encrypted traffic ciphertext entropy feature includes at least one of the following: the average value of the current encrypted traffic ciphertext entropy, the standard deviation of the current encrypted traffic ciphertext entropy, the forward entropy value, and the backward entropy value.
[0147] In one embodiment of this application, the malicious encrypted traffic determination unit 50 is further configured to:
[0148] If the average ciphertext entropy of the current encrypted traffic is within a threshold range related to the theoretical maximum entropy value, then the current encrypted traffic is normal encrypted traffic; or
[0149] If the average ciphertext entropy of the current encrypted traffic is within the normal threshold range, then the current encrypted traffic is normal encrypted traffic; or
[0150] If the average ciphertext entropy of the current encrypted traffic is within the first malicious threshold range, then the current encrypted traffic is malicious encrypted traffic; or
[0151] If the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the first entropy value fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or
[0152] If the average ciphertext entropy of the current encrypted traffic is within the second malicious threshold range, and the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the second entropy fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or
[0153] If the absolute value of the difference between the forward entropy value and the backward entropy value is greater than or equal to the threshold value of the pairwise entropy difference, then the current encrypted traffic is malicious encrypted traffic.
[0154] In one embodiment of this application, the current encrypted traffic ciphertext entropy feature determination unit 40 is further configured to:
[0155] Based on the information entropy value corresponding to each ciphertext block, the average ciphertext entropy of the current encrypted traffic is calculated;
[0156] Based on the information entropy value corresponding to each ciphertext block and the average ciphertext entropy of the current encrypted traffic, the variance of the ciphertext entropy of the current encrypted traffic is calculated.
[0157] Based on the variance of the current encrypted traffic ciphertext entropy, the standard deviation of the current encrypted traffic ciphertext entropy is calculated.
[0158] In one embodiment of this application, the current encrypted traffic ciphertext entropy feature determination unit 40 is further configured to:
[0159] According to the preset segmentation rules, the ciphertext data is segmented into front-end ciphertext data and back-end ciphertext data;
[0160] Extract the front-end ciphertext block corresponding to the front-end ciphertext data, and the back-end ciphertext block corresponding to the back-end ciphertext data;
[0161] The forward entropy value is calculated based on the information entropy value corresponding to each front-end ciphertext block;
[0162] The backward entropy value is calculated based on the information entropy value corresponding to each subsequent ciphertext block.
[0163] In one embodiment of this application, the preset judgment condition construction unit is further configured to:
[0164] Obtain a preset number of malware samples and convert the malware samples into bytecode;
[0165] The bytecode is encrypted using a preset number of different encryption algorithms to obtain multiple malicious ciphertext data.
[0166] Calculate the information entropy value corresponding to each malicious ciphertext data;
[0167] Based on the information entropy value corresponding to each malicious ciphertext data, the average entropy value and standard deviation of the malicious ciphertext entropy are calculated.
[0168] In one embodiment of this application, the preset judgment condition construction unit is further configured to:
[0169] Obtain normal encrypted traffic data packets, parse the normal encrypted traffic data packets, and extract normal ciphertext data;
[0170] The normal ciphertext data is divided into normal ciphertext blocks of a preset size, and the information entropy value corresponding to each normal ciphertext block is calculated.
[0171] Based on the information entropy value corresponding to each normal ciphertext block, the average ciphertext entropy of normal encrypted traffic is calculated.
[0172] In this embodiment, information entropy is used to measure the randomness of traffic data, and the ciphertext entropy feature is incorporated into the judgment criteria to quantify the stability of randomness. At the same time, the fixed threshold design is abandoned, and a dynamic entropy threshold is constructed by combining the features of malicious software samples. This enables targeted modeling of the randomness of malicious traffic, effectively reducing the false positive rate and improving scenario adaptability. It makes up for the shortcomings of existing solutions that ignore the entropy features of malicious traffic, and significantly improves the accuracy and practicality of malicious encrypted traffic detection.
[0173] For specific limitations regarding the ciphertext entropy-based malicious encrypted traffic detection system, please refer to the limitations of the ciphertext entropy-based malicious encrypted traffic detection method above, which will not be repeated here. Each module in the aforementioned ciphertext entropy-based malicious encrypted traffic detection system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.
[0174] In one embodiment, a computer device is provided, which may be a terminal device, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, and network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a readable storage medium storing computer-readable instructions. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer-readable instructions implement a malicious encrypted traffic detection method based on ciphertext entropy. The readable storage medium provided in this embodiment includes both non-volatile and volatile readable storage media.
[0175] In this application embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, it implements the steps of the malicious encrypted traffic detection method based on ciphertext entropy value as described above.
[0176] In this application embodiment, a readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, they implement the steps of the malicious encrypted traffic detection method based on ciphertext entropy value as described above.
[0177] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0178] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.
[0179] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.
Claims
1. A method for detecting malicious encrypted traffic based on ciphertext entropy, characterized in that, The method includes: Acquiring the current encrypted traffic data packet includes: performing layered parsing on the collected current encrypted traffic data packet, sequentially identifying and stripping the header information of the network layer and transport layer, then parsing the dedicated protocol header and control information for the encryption protocol corresponding to the data packet, and finally accurately extracting the core ciphertext data processed by the encryption algorithm from the data packet; The current encrypted traffic data packet is parsed, and the ciphertext data is extracted; The encrypted data is divided into encrypted blocks of a preset size, and the information entropy value corresponding to each encrypted block is calculated based on the Shannon entropy formula, wherein each encrypted block has the same length. Based on the information entropy value corresponding to each ciphertext block, the ciphertext entropy characteristics of the current encrypted traffic are determined. The current encrypted traffic ciphertext entropy characteristics include at least one of the following: the average ciphertext entropy value of the current encrypted traffic, the standard deviation of the ciphertext entropy of the current encrypted traffic, the forward entropy value, and the backward entropy value. The ciphertext data is divided into front-end ciphertext data and back-end ciphertext data according to a preset segmentation rule. Front-end ciphertext blocks corresponding to the front-end ciphertext data and back-end ciphertext blocks corresponding to the back-end ciphertext data are extracted. The forward entropy value is calculated based on the information entropy value corresponding to each front-end ciphertext block. The backward entropy value is calculated based on the information entropy value corresponding to each back-end ciphertext block. The preset segmentation rule is to take the first 1 / 3 of the ciphertext blocks as the front-end ciphertext data and the last 1 / 3 as the back-end ciphertext data, while the middle 1 / 3 of the ciphertext blocks can be ignored or included in auxiliary analysis. Based on the ciphertext entropy features of malware samples, the ciphertext entropy features of normal encrypted traffic data, and the theoretical maximum entropy value of ciphertext bytes, preset judgment conditions are constructed. The preset judgment conditions include at least one of the following: a threshold range related to the theoretical maximum entropy value, a normal threshold range related to the ciphertext entropy features of normal encrypted traffic, a first malicious threshold range and a second malicious threshold range related to the ciphertext entropy features of malware, a first entropy value fluctuation threshold, a second entropy value fluctuation threshold, and a paired entropy value difference threshold. The current encrypted traffic ciphertext entropy feature is matched with preset judgment conditions, and the current encrypted traffic is determined to be malicious encrypted traffic based on the matching result.
2. The malicious encrypted traffic detection method based on ciphertext entropy as described in claim 1, characterized in that, The preset judgment conditions are constructed based on the ciphertext entropy features of malware samples, the ciphertext entropy features of normal encrypted traffic data, and the theoretical maximum entropy value of ciphertext bytes, including: Based on malware samples, determine the ciphertext entropy characteristics of malware; Based on normal encrypted traffic data, determine the ciphertext entropy characteristics of normal encrypted traffic; Based on the theoretical probability distribution of bytes in the ciphertext data, determine the theoretical maximum entropy value; Based on the ciphertext entropy characteristics of the malicious software, the ciphertext entropy characteristics of normal encrypted traffic, and the theoretical maximum entropy value, the preset judgment conditions are constructed.
3. The malicious encrypted traffic detection method based on ciphertext entropy as described in claim 2, characterized in that, The step of matching the ciphertext entropy feature of the current encrypted traffic with preset judgment conditions, and determining whether the current encrypted traffic is malicious encrypted traffic based on the matching result, includes: If the average ciphertext entropy of the current encrypted traffic is within a threshold range related to the theoretical maximum entropy value, then the current encrypted traffic is normal encrypted traffic; or If the average ciphertext entropy of the current encrypted traffic is within the normal threshold range, then the current encrypted traffic is normal encrypted traffic; or If the average ciphertext entropy of the current encrypted traffic is within the first malicious threshold range, then the current encrypted traffic is malicious encrypted traffic; or If the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the first entropy value fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or If the average ciphertext entropy of the current encrypted traffic is within the second malicious threshold range, and the standard deviation of the ciphertext entropy of the current encrypted traffic is greater than or equal to the second entropy fluctuation threshold, then the current encrypted traffic is malicious encrypted traffic; or If the absolute value of the difference between the forward entropy value and the backward entropy value is greater than or equal to the threshold value of the pairwise entropy difference, then the current encrypted traffic is malicious encrypted traffic.
4. The malicious encrypted traffic detection method based on ciphertext entropy as described in claim 1, characterized in that, The process of determining the ciphertext entropy characteristics of the current encrypted traffic based on the information entropy value corresponding to each ciphertext block includes: Based on the information entropy value corresponding to each ciphertext block, the average ciphertext entropy of the current encrypted traffic is calculated; Based on the information entropy value corresponding to each ciphertext block and the average ciphertext entropy of the current encrypted traffic, the variance of the ciphertext entropy of the current encrypted traffic is calculated. Based on the variance of the current encrypted traffic ciphertext entropy, the standard deviation of the current encrypted traffic ciphertext entropy is calculated.
5. The malicious encrypted traffic detection method based on ciphertext entropy as described in claim 2, characterized in that, The process of determining the ciphertext entropy characteristics of malware based on malware samples includes: Obtain a preset number of malware samples and convert the malware samples into bytecode; The bytecode is encrypted using a preset number of different encryption algorithms to obtain multiple malicious ciphertext data. Calculate the information entropy value corresponding to each malicious ciphertext data; Based on the information entropy value corresponding to each malicious ciphertext data, the average entropy value and standard deviation of the malicious ciphertext entropy are calculated.
6. The malicious encrypted traffic detection method based on ciphertext entropy as described in claim 2, characterized in that, The process of determining the ciphertext entropy characteristics of normal encrypted traffic based on normal encrypted traffic data includes: Obtain normal encrypted traffic data packets, parse the normal encrypted traffic data packets, and extract normal ciphertext data; The normal ciphertext data is divided into normal ciphertext blocks of a preset size, and the information entropy value corresponding to each normal ciphertext block is calculated. Based on the information entropy value corresponding to each normal ciphertext block, the average ciphertext entropy of normal encrypted traffic is calculated.
7. A malicious encrypted traffic detection system based on ciphertext entropy, characterized in that, The system includes: The current encrypted traffic data packet acquisition unit is used to acquire the current encrypted traffic data packet; The ciphertext data extraction unit is used to parse the current encrypted traffic data packet and extract the ciphertext data, including: performing layered parsing on the collected current encrypted traffic data packet, sequentially identifying and stripping the header information of the network layer and transport layer, then parsing the dedicated protocol header and control information for the encryption protocol corresponding to the data packet, and finally accurately extracting the core ciphertext data processed by the encryption algorithm from the data packet. The information entropy value determination unit is used to divide the ciphertext data into ciphertext blocks of a preset size, and calculate the information entropy value corresponding to each ciphertext block based on the Shannon entropy formula, wherein each ciphertext block has the same length. The current encrypted traffic ciphertext entropy feature determination unit is used to determine the current encrypted traffic ciphertext entropy feature based on the information entropy value corresponding to each ciphertext block. The current encrypted traffic ciphertext entropy feature includes at least one of the following: the current encrypted traffic ciphertext entropy average value, the current encrypted traffic ciphertext entropy standard deviation, the forward entropy value, and the backward entropy value. Specifically, according to a preset segmentation rule, the ciphertext data is segmented into front-end ciphertext data and back-end ciphertext data; the front-end ciphertext blocks corresponding to the front-end ciphertext data and the back-end ciphertext blocks corresponding to the back-end ciphertext data are extracted; the forward entropy value is calculated based on the information entropy value corresponding to each front-end ciphertext block; and the backward entropy value is calculated based on the information entropy value corresponding to each back-end ciphertext block. The preset segmentation rule is to take the first 1 / 3 of the ciphertext blocks as the front-end ciphertext data and the last 1 / 3 as the back-end ciphertext data according to the ciphertext block order, while the middle 1 / 3 of the ciphertext blocks can be ignored or included in auxiliary analysis. The preset judgment condition construction unit is used to construct preset judgment conditions based on the ciphertext entropy features of malware samples, the ciphertext entropy features of normal encrypted traffic data, and the theoretical maximum entropy value of ciphertext bytes. The preset judgment conditions include at least one of the following: a threshold range related to the theoretical maximum entropy value, a normal threshold range related to the ciphertext entropy features of normal encrypted traffic, a first malicious threshold range and a second malicious threshold range related to the ciphertext entropy features of malware, a first entropy value fluctuation threshold, a second entropy value fluctuation threshold, and a paired entropy value difference threshold. The malicious encrypted traffic determination unit is used to match the ciphertext entropy feature of the current encrypted traffic with preset determination conditions, and determine whether the current encrypted traffic is malicious encrypted traffic based on the matching result.