Method and system for detecting malicious communication behavior in encrypted traffic

Abstract

The invention provides a malicious communication behavior detection method and system in encrypted traffic, and belongs to the technical field of network security. The method comprises the following steps: acquiring historical encrypted traffic, screening normal communication traffic samples, and constructing a normal communication behavior model; and training the model by using a support vector machine classifier. And then collecting a real-time encrypted traffic data packet sequence, extracting a feature vector set, inputting the feature vector set into the trained classification model, quantifying the deviation degree with a normal communication sample, screening out abnormal traffic exceeding a preset threshold value, and forming an abnormal traffic set. Key abnormal indexes such as the data packet sending and receiving rate difference ratio and the data packet size standard deviation are determined based on the set, and if any index exceeds the standard, the malicious communication behavior is judged. In this way, high-concealment malicious behaviors can be accurately recognized without decryption, normal communication and malicious communication are effectively distinguished, and zero-trust chain collapse is avoided.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method and system for detecting malicious communication behavior in encrypted traffic. Background Technology

[0002] Currently, detecting malicious communication behavior in encrypted traffic is a crucial research direction in the field of cybersecurity. With the widespread encryption of network communications, traditional detection methods are gradually becoming ineffective, making the protection of data security and user privacy an urgent need. Especially under zero-trust architectures, every link in the communication chain must be rigorously verified, and any potential threat could lead to the collapse of the system's trust chain. Most methods for detecting encrypted traffic rely on known attack patterns or simple traffic statistical analysis, but these methods are often unable to adapt to complex and ever-changing network environments, especially when facing new threats. They lack a systematic approach in uncovering the deep characteristics of communication behavior and struggle to capture subtle anomalies hidden behind encrypted data. This limitation causes many potential threats to be overlooked, especially in highly covert malicious communications, making it impossible to accurately distinguish the subtle differences between normal and malicious communication.

[0003] The information provided in the background section of this application is only for enhancing the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] In view of this, this application provides a method and system for detecting malicious communication behavior in encrypted traffic, which can accurately identify malicious communication behavior.

[0005] In a first aspect, embodiments of this application provide a method for detecting malicious communication behavior in encrypted traffic. The method includes: acquiring historical encrypted traffic and determining normal communication traffic samples based on the historical encrypted traffic; constructing a normal communication behavior model based on the normal communication traffic samples; training a classification model using a support vector machine classifier based on the normal communication behavior model; acquiring real-time encrypted traffic data and determining a feature vector set based on the encrypted traffic data; inputting the feature vector set into the trained classification model to determine the deviation between the feature vectors in the feature vector set and the normal communication traffic samples; determining whether the deviation exceeds a preset deviation threshold; if it exceeds the preset deviation threshold, marking the current encrypted traffic data as abnormal traffic and determining an abnormal traffic set based on the abnormal traffic; determining abnormal traffic indicators based on the abnormal traffic set, the abnormal traffic indicators including the difference ratio between the data packet sending rate and the data packet receiving rate and the standard deviation of the data packet size; if any one of the abnormal traffic indicators exceeds the traffic indicator threshold corresponding to the abnormal traffic indicator, determining the current communication behavior pattern based on the abnormal traffic set and identifying the current communication behavior pattern as malicious communication behavior.

[0006] Secondly, embodiments of this application provide a malicious communication behavior detection system in encrypted traffic. The system includes: a first determining module, a first constructing module, a second constructing module, a second determining module, a third determining module, a first judging module, a fourth determining module, and a second judging module. The first determining module is used to acquire historical encrypted traffic and determine normal communication traffic samples based on the historical encrypted traffic. The first constructing module is used to construct a normal communication behavior model based on the normal communication traffic samples. The second constructing module is used to train a classification model using a support vector machine classifier based on the normal communication behavior model. The second determining module is used to acquire real-time encrypted traffic data and determine a feature vector set based on the encrypted traffic data. The third determining module is used to input the feature vector set into the trained classification model to determine the deviation between the feature vectors in the feature vector set and the normal communication traffic samples. The first judging module is used to judge... The system first determines whether the deviation exceeds a preset deviation threshold. If it does, the current encrypted traffic data is marked as abnormal traffic, and an abnormal traffic set is determined based on the abnormal traffic. The fourth determining module is used to determine abnormal traffic indicators based on the abnormal traffic set. The abnormal traffic indicators include the difference ratio between the data packet sending rate and the data packet receiving rate and the standard deviation of the data packet size. The second determining module determines the current communication behavior mode based on the abnormal traffic set if any one of the abnormal traffic indicators exceeds the traffic indicator threshold corresponding to the abnormal traffic indicator. The current communication behavior mode is then determined as malicious communication behavior.

[0007] This application provides a method and system for detecting malicious communication behavior in encrypted traffic. It involves acquiring historical encrypted traffic to filter normal communication traffic samples; constructing a normal communication behavior model based on these samples, clarifying the behavioral characteristics and boundaries of normal communication, and forming a reference standard for normal communication; training the normal communication behavior model using a support vector machine (SVM) classifier, leveraging the advantages of SVM in high-dimensional data processing and nonlinear feature fitting to improve the model's adaptability and classification accuracy to complex encrypted traffic features. Next, real-time encrypted traffic data is acquired and a feature vector set is determined, achieving effective acquisition and feature extraction of real-time encrypted traffic data; the feature vector set is input into the trained classification model to determine the deviation between the feature vectors in the feature vector set and the normal communication traffic samples, achieving a quantitative assessment of the difference between real-time encrypted traffic and the normal communication benchmark; by judging whether the deviation exceeds a preset deviation threshold, if it does, the encrypted traffic data is marked as abnormal traffic and an abnormal traffic set is determined, completing the initial screening of suspected abnormal traffic and effectively narrowing the scope of subsequent detection; based on the abnormal traffic set, the following are determined: the difference ratio between the data packet sending rate and the data packet receiving rate, and the standard deviation of the data packet size. The abnormal traffic indicators focus on key feature dimensions that can reflect malicious communication behavior. By judging whether any one of the abnormal traffic indicators exceeds the corresponding abnormal traffic indicator threshold, if it exceeds, the current communication behavior pattern is determined based on the abnormal traffic set and identified as malicious communication behavior. In this way, highly covert malicious communication behaviors in encrypted traffic, such as periodically sending small data packets, appear no different from normal heartbeat packets but have abnormal time interval distribution and data directionality, can be accurately captured. This accurately distinguishes between normal and malicious communication behaviors, avoids the spread of potential threats that could lead to the collapse of the zero trust chain, and provides a reliable and effective solution for detecting malicious communication in encrypted traffic in complex network environments. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic provided in an exemplary embodiment of this application.

[0010] Figure 2 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic provided in another exemplary embodiment of this application.

[0011] Figure 3 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic, provided in yet another exemplary embodiment of this application.

[0012] Figure 4 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic, provided in yet another exemplary embodiment of this application.

[0013] Figure 5 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic, provided in yet another exemplary embodiment of this application.

[0014] Figure 6 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic, provided in yet another exemplary embodiment of this application.

[0015] Figure 7 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic, provided in yet another exemplary embodiment of this application.

[0016] Figure 8 This is a flowchart illustrating a method for detecting malicious communication behavior in encrypted traffic, provided in yet another exemplary embodiment of this application. Detailed Implementation

[0017] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this application will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this application.

[0018] The terms “a,” “one,” and “the” are used to indicate the existence of one or more elements / components / etc.; the terms “including” and “having” are used to indicate an open-ended inclusion and that other elements / components / etc. may exist in addition to those listed. The terms “first” and “second” are used only as markers and are not a limitation on the number of objects.

[0019] Currently, detecting malicious communication behavior in encrypted traffic is a crucial research direction in the field of cybersecurity. With the widespread encryption of network communications, traditional detection methods are gradually becoming ineffective, making the protection of data security and user privacy an urgent need. Especially under zero-trust architectures, every link in the communication chain must be rigorously verified, and any potential threat could lead to the collapse of the system's trust chain. Most methods for detecting encrypted traffic rely on known attack patterns or simple traffic statistical analysis, but these methods are often unable to adapt to complex and ever-changing network environments, especially when facing new threats. They lack a systematic approach in uncovering the deep characteristics of communication behavior and struggle to capture subtle anomalies hidden behind encrypted data. This limitation causes many potential threats to be overlooked, especially in highly covert malicious communications, making it impossible to accurately distinguish the subtle differences between normal and malicious communication.

[0020] For example, seemingly trivial information such as handshake duration and data packet arrival intervals during communication may conceal clues to malicious behavior, but this information is often overlooked or fails to be effectively linked. The lack of in-depth analysis of the inherent connections within this metadata makes it impossible to accurately distinguish the subtle differences between normal and malicious communication. In certain business scenarios, malware may maintain covert communication by periodically sending small data packets. This communication behavior appears identical to normal heartbeat packets on the surface, but its time interval distribution and data directionality may exhibit anomalies. If these differences cannot be accurately captured, it is difficult to prevent the spread of potential threats.

[0021] Therefore, how to deeply mine the behavioral characteristics of metadata in encrypted traffic and accurately identify hidden malicious communication patterns through multi-dimensional analysis to meet the stringent requirements of zero-trust architecture for communication security has become the key technical problem to be solved in this application.

[0022] This application provides a method for detecting malicious communication behavior in encrypted traffic, such as... Figure 1 The method for detecting malicious communication behavior in encrypted traffic is shown. This method may include the following steps: Step S110: Obtain historical encrypted traffic and determine normal communication traffic samples based on historical encrypted traffic; Step S120: Construct a normal communication behavior model based on normal communication traffic samples; Step S130: Based on the normal communication behavior model, a classification model is trained using a support vector machine classifier; Step S140: Obtain real-time encrypted traffic data and determine the feature vector set based on the encrypted traffic data; Step S150: Input the feature vector set into the trained classification model to determine the deviation between the feature vectors in the feature vector set and the normal communication traffic samples; Step S160: Determine whether the deviation exceeds the preset deviation threshold. If it exceeds the preset deviation threshold, mark the current encrypted traffic data as abnormal traffic and determine the abnormal traffic set based on the abnormal traffic. Step S170: Determine abnormal traffic indicators based on the abnormal traffic set. Abnormal traffic indicators include the difference ratio between the data packet sending rate and the data packet receiving rate and the standard deviation of the data packet size. Step S180: If any one of the abnormal traffic indicators exceeds the traffic indicator threshold of the corresponding abnormal traffic indicator, then determine the current communication behavior mode based on the abnormal traffic set, and determine the current communication behavior mode as malicious communication behavior.

[0023] According to the method for detecting malicious communication behavior in encrypted traffic provided in this application, this method can filter normal communication traffic samples by acquiring historical encrypted traffic; construct a normal communication behavior model based on the normal communication traffic samples, clarify the behavioral characteristics and boundaries of normal communication, and form a referenceable normal communication standard; use a support vector machine classifier to train the normal communication behavior model, leveraging the advantages of support vector machines in high-dimensional data processing and nonlinear feature fitting to improve the model's adaptability and classification accuracy to complex encrypted traffic features. Next, real-time encrypted traffic data is acquired and a feature vector set is determined, realizing effective acquisition and feature extraction of real-time encrypted traffic data; the feature vector set is input into the trained classification model to determine the deviation between the feature vectors in the feature vector set and the normal communication traffic samples, realizing a quantitative assessment of the difference between real-time encrypted traffic and the normal communication benchmark; by judging whether the deviation exceeds a preset deviation threshold, if it does, the encrypted traffic data is marked as abnormal traffic and an abnormal traffic set is determined, completing the initial screening of suspected abnormal traffic and effectively narrowing the scope of subsequent detection; based on the abnormal traffic set, abnormal traffic including the difference ratio between the data packet sending rate and the data packet receiving rate and the standard deviation of the data packet size is determined. The metrics focus on key characteristic dimensions that can reflect malicious communication behavior. By judging whether any one of the abnormal traffic metrics exceeds the corresponding abnormal traffic metric threshold, if it exceeds, the current communication behavior pattern is determined based on the abnormal traffic set, and the current communication behavior pattern is identified as malicious communication behavior. In this way, highly covert malicious communication behaviors in encrypted traffic, such as periodically sending small data packets, appear no different from normal heartbeat packets, but have abnormal time interval distribution and data directionality, can be accurately captured. This accurately distinguishes between normal and malicious communication behaviors, avoids the spread of potential threats that could lead to the collapse of the zero-trust chain, and provides a reliable and effective solution for detecting malicious communication in encrypted traffic of zero-trust architecture in complex network environments.

[0024] The steps of the malicious communication behavior detection method in encrypted traffic provided in the embodiments of this application are described in detail below: In one embodiment of this application, step S110, which involves acquiring historical encrypted traffic and determining normal communication traffic samples based on the historical encrypted traffic, further includes the following steps: Figure 2 As shown, the specific content is as follows: Step S210: Standardize the historical encrypted traffic to determine the standardized historical encrypted traffic; Step S220: Based on standardized historical encrypted traffic, use the isolated forest algorithm to filter normal communication traffic samples.

[0025] Specifically, historical encrypted traffic includes multiple dimensions of features, such as traffic size, communication duration, number of data packets, and data packet arrival time interval. However, the units of measurement for these different features differ. For example, traffic size is measured in MB, while communication duration is measured in seconds. This can lead to subsequent algorithmic filtering being influenced by the numerical scale, making it impossible to fairly measure the importance of each feature. Therefore, standardization eliminates the dimensional differences between features, mapping all feature values ​​to a uniform numerical range. The Isolation Forest algorithm is an efficient unsupervised anomaly detection algorithm. By randomly selecting features and partitioning thresholds, it gradually isolates data samples. Anomaly samples, due to their deviating features, are isolated more quickly (shorter path length), while normal samples, with their concentrated feature distribution, require more partitioning steps to isolate (longer path length). Based on this characteristic, by calculating the anomaly score for each sample in the standardized historical encrypted traffic, samples with anomaly scores below a preset threshold are selected as normal communication traffic samples, laying a reliable data foundation for normal communication benchmarks under a zero-trust architecture.

[0026] For example, historical encrypted traffic includes 1000 samples. Each sample includes three core feature indicators: traffic size (in MB), communication duration (in seconds), and number of data packets (in units). The original data for the three samples are [80, 40, 1200], [60, 60, 800], and [100, 30, 1500], respectively. The Z-score method is used to determine the mean and standard deviation of each feature indicator, and the mean traffic size is... =80, standard deviation =20, average communication duration =43.33, standard deviation =15.27, average number of data packets =1166.67, standard deviation =321.47. Standardization is performed on each sample, resulting in sample 1 ([0, -0.22, 0.10]), sample 2 ([-1.00, 1.10, -1.14]), and sample 3 ([1.00, -0.87, 1.04]). This calculation is performed on each of the 1000 samples, ultimately yielding standardized historical encrypted traffic with all feature values ​​distributed within the range of [-3, 3]. After standardization, based on the 1000 standardized historical encrypted traffic samples, the Isolation Forest algorithm is used to filter normal communication traffic samples, with the number of decision trees configured accordingly. There are 100 decision trees, with 256 samples per tree and a feature sampling ratio of 1.0. Anomaly scores are calculated for each sample through ensemble learning of multiple decision trees (score range: [0,1], where a score closer to 1 is more likely to be abnormal and closer to 0 is more likely to be normal). An anomaly score threshold of 0.2 is set, and 820 samples with anomaly scores ≤ 0.2 are selected (e.g., the anomaly scores of the three samples mentioned above are 0.08, 0.15, and 0.12, respectively). These samples are judged as normal communication traffic samples, and the remaining 180 samples with anomaly scores higher than 0.2 are identified as abnormal samples and removed.

[0027] In one embodiment of this application, step S120, constructing a normal communication behavior model based on normal communication traffic samples, further includes the following steps: Figure 3 As shown, the specific content is as follows: Step S310: Based on normal communication traffic samples, use a Gaussian mixture model to determine the probability of each normal communication traffic sample belonging to a cluster; Step S320: Determine the mean vector and covariance matrix based on the probability of each normal communication traffic sample belonging to its cluster; Step S330: Construct a normal communication behavior model based on the mean vector and covariance matrix.

[0028] Specifically, normal communication traffic samples are not uniformly distributed in the feature space, but rather consist of multiple subgroups with different characteristic patterns (e.g., normal communication under different business scenarios, normal communication on different terminal devices, etc.). Using a Gaussian mixture model, the complex distribution characteristics of the data can be fitted through a linear combination of multiple Gaussian distributions. By clustering normal communication traffic samples using this algorithm, the probability of each sample belonging to each cluster can be obtained, thus accurately identifying different characteristic patterns in normal communication traffic. After obtaining the cluster probability of each normal communication traffic sample, the sample features within each cluster are weighted using probability as weights to obtain the mean vector and covariance matrix of each cluster. The mean vector reflects the feature level of the normal communication pattern corresponding to the cluster, with each element corresponding to the average value of a feature; the covariance matrix reflects the dispersion of sample features within the cluster and the correlation between features, quantifying the fluctuation range of normal communication patterns. Together, they constitute the key parameters describing the normal communication behavior model.

[0029] For example, after screening, 800 normal communication traffic samples are obtained. Each sample includes standardized values ​​for traffic size, communication duration, and number of data packets. A Gaussian mixture model is used to cluster these normal communication traffic samples, with a cluster size of 3. The model parameters are optimized through 10 iterations using the Expectation-Maximization (EM) algorithm. After iteration, the probability of each sample belonging to one of the three clusters is obtained. For example, the probability distribution of sample 1 is [0.92, 0.05, 0.03], sample 2 is [0.08, 0.89, 0.03], and sample 3 is [0.02, 0.05, 0.93]. This process is used to calculate the cluster probability of all 800 samples. Then, using the cluster probability of each sample as a weight, the mean vector and covariance matrix of each of the three clusters are calculated. Finally, based on the mean vector and covariance matrix of the three clusters, a normal communication behavior model is constructed using a Gaussian mixture model.

[0030] In one embodiment of this application, in step S130, a classification model is trained using a support vector machine (SVM) classifier based on a normal communication behavior model. Specifically, based on the constructed normal communication behavior model, the high-dimensional data processing capability and non-linear classification advantage of the SVM classifier are utilized to train a classification model capable of accurately distinguishing between normal and abnormal communication behaviors. The normal communication behavior model has determined the probability distribution characteristics of normal communication (such as the multi-mode distribution corresponding to the mean vector and covariance matrix), and the SVM classifier constructs the optimal decision boundary by learning the differences between these normal and abnormal communication characteristics, enabling subsequent input communication traffic feature vectors to be accurately determined as normal or abnormal.

[0031] In one embodiment of this application, step S140, which involves acquiring a real-time encrypted traffic data packet sequence and determining a feature vector set based on the encrypted traffic data packet sequence, further includes the following steps: Figure 4 As shown, the specific content is as follows: Step S410: Determine the encrypted traffic packet sequence based on the encrypted traffic data; Step S420: Determine the packet feature set based on the encrypted traffic packet sequence. The packet feature set includes the source IP, destination IP, packet length, and timestamp. Step S430: Based on the data packet feature set, the sliding window analysis algorithm is used to determine the feature vector set.

[0032] Specifically, encrypted traffic data can be acquired in real time via a network interface using an automated script from a network packet capture tool. A 5-minute collection window can be set, capturing 100 packets per second for a total of 30,000 packets, forming an encrypted traffic packet sequence. This sequence is then parsed to extract four core features: source IP (e.g., 192.168.3.10, 192.168.3.15), destination IP (e.g., 10.0.0.8, 10.0.0.12), packet length (obtained by parsing header information using Scapy, in bytes, with an average length of 500 bytes and a standard deviation of 50 bytes, specifically 450 bytes or 520 bytes), and millisecond-level timestamps. These features are arranged in the order of acquisition to form a packet feature set containing 30,000 records. Based on these packet features... The dataset employs a sliding window analysis algorithm, setting the window size to 10 seconds and the step size to 5 seconds. Multidimensional statistical calculations are performed on the features within each window, including the total number of data packets (e.g., 980 packets in a given window), the average packet length (e.g., 495 bytes) and standard deviation (e.g., 48 bytes), the variance of the time interval between adjacent data packets (e.g., 0.04 seconds), the number of unique source IPs (e.g., 2), and the number of unique destination IPs (e.g., 3). These statistical results are integrated into a 6-dimensional feature vector, such as [980, 495, 48, 0.04, 2, 3]. All data packet feature sets are processed sequentially according to the sliding window order. A total of 59 feature vectors are generated from the 5-minute traffic, ultimately forming a feature vector set containing 59 6-dimensional feature vectors.

[0033] In the above method, a sliding window analysis algorithm based on packet feature sets is used to integrate the features of discrete individual packets into window-level statistical features with time-series characteristics. This effectively captures the overall pattern and dynamic changes of communication behavior within a specific time period, avoiding the problem of failing to identify complex abnormal patterns such as periodicity and suddenness caused by isolated analysis of individual packets. The constructed feature vector set includes multi-dimensional statistical features such as the number of packets, length distribution, time interval fluctuation, and number of communication nodes, comprehensively characterizing the key dimensions of the current communication behavior. This provides effective input data for subsequent classification models, adapts to the needs of real-time detection of encrypted traffic, lays a solid feature foundation for the entire malicious communication behavior detection process, and significantly improves the accuracy and efficiency of subsequent anomaly identification and malicious judgment.

[0034] In one embodiment of this application, step S150, which involves inputting a feature vector set into a trained classification model to determine the deviation between the feature vectors in the feature vector set and normal communication traffic samples, further includes the following steps: Figure 5 As shown, the specific content is as follows: Step S510: Obtain the first feature value corresponding to the feature vector and the second feature value corresponding to the normal communication traffic sample respectively. The first feature value includes the traffic packet size and traffic packet length corresponding to the feature vector, and the second feature value includes the traffic packet size and traffic packet length corresponding to the normal communication traffic sample. Step S520: Determine the mean and standard deviation of the first feature based on the first feature value, and determine the mean and standard deviation of the second feature based on the second feature value; Step S530: Calculate the Euclidean distance between the mean and standard deviation of the first feature and the mean and standard deviation of the second feature; Step S540: Use the Euclidean distance as the deviation between the feature vectors in the feature vector set and the normal communication traffic samples.

[0035] Specifically, for example, a feature vector is obtained through step S140, whose corresponding traffic packet size (unit: bytes) and traffic packet length (unit: bytes) feature values ​​are both 480. Simultaneously, 10 samples are extracted from 800 normal communication traffic samples as the calculation benchmark. The first feature values ​​corresponding to these 10 samples are [450,450], [520,520], [490,490], [470,470], [510,510], [460,460], [485,485], [500,500], [440,440], and [495,495]. Then, the first... The first feature of the feature vector has a mean of 480 and a standard deviation of 0. Simultaneously, the second feature of 10 normal communication traffic samples has a mean of 482 and a standard deviation of 25.3. Next, a two-dimensional parameter space is constructed using the first feature mean, first feature standard deviation, second feature mean, and second feature standard deviation. The parameter point of the feature vector is (480, 0), and the parameter point of the normal samples is (482, 25.3). The Euclidean distance between the parameter point of the feature vector and the parameter point of the normal samples is calculated to be 25.4. Finally, this Euclidean distance of 25.4 is taken as the deviation between the feature vector and the normal communication traffic samples.

[0036] In the above method, by separately obtaining the feature vector and the feature values ​​of the packet size and packet length of the normal communication traffic sample, the core dimension that can reflect the scale of communication data transmission is focused on, providing targeted and low-interference basic data for deviation calculation. By transforming discrete feature values ​​into statistical parameters that can reflect the overall distribution characteristics, the random errors of comparing single feature values ​​are avoided, and the reliability of deviation calculation is improved. The difference between the two sets of statistical parameters is calculated by using Euclidean distance, taking into account the multidimensional differences between the average level and the fluctuation range, comprehensively quantifying the degree of distribution deviation between real-time communication and normal communication, overcoming the one-sidedness of single-dimensional comparison, effectively solving the technical problem that traditional methods are unable to accurately capture the subtle differences between normal communication and malicious communication, and significantly improving the accuracy of subsequent anomaly identification and malicious judgment.

[0037] In one embodiment of this application, in step S160, it is determined whether the deviation exceeds a preset deviation threshold. If it is determined that the deviation exceeds the preset deviation threshold, the current encrypted traffic data is marked as abnormal traffic, and an abnormal traffic set is determined based on the abnormal traffic. Specifically, for example, there are 1000 samples of encrypted traffic data. Each sample of encrypted traffic data includes a feature vector set of 59 feature vectors (corresponding to 59 real-time encrypted communication data of 10-second sliding windows). The deviation of each feature vector from the normal communication traffic sample is calculated in step S150. Some deviation values ​​are as follows: feature vector 1 deviation 22.3, feature vector 2 deviation 28.7, feature vector 3 deviation 19.5, feature vector 4 deviation 31.2, feature vector 5 deviation 26.8, feature vector 6 deviation 35.6, feature vector 7 deviation 21.1, etc. The average of the above deviations is taken, for example, 35. Next, based on the deviation statistics of 800 normal communication traffic samples, the mean deviation of the normal samples was calculated to be 18.5, and the standard deviation was 6.2. To cover 95% of normal communication scenarios, a preset deviation threshold of 30.9 was set (which can be dynamically adjusted according to actual network security needs). It can be seen that the deviation of the feature vector in the feature vector set of the current sample's encrypted traffic data from the normal communication traffic samples exceeds the preset deviation threshold of 35. Therefore, the encrypted traffic data corresponding to the current sample is marked as abnormal traffic. Finally, the above steps are performed on each of the 1000 samples to filter out the abnormal traffic and integrate it into an abnormal traffic set.

[0038] In one embodiment of this application, after determining the abnormal traffic set based on the abnormal traffic in step S160, the following steps are further included: Figure 6 As shown, the specific content is as follows: Step S610: Determine whether the occurrence of abnormal traffic has a fixed recurring cycle; Step S620: If it is determined that there is a fixed repetition period, then obtain the transmission path of the abnormal traffic; Step S630: Determine the source node of the abnormal traffic based on the transmission path of the abnormal traffic.

[0039] Specifically, abnormal traffic can be categorized into occasional and periodic anomalies. Periodic anomalies are often associated with malware maintaining covert communication (such as sending heartbeat packets or periodically transmitting stolen data), and their risk level is far higher than that of occasional anomalies. Determining whether abnormal traffic exhibits a fixed recurring cycle can accurately distinguish between high-risk persistent threats and low-risk temporary anomalies, providing a basis for targeted tracing of the source node. Time series analysis tools can be used to model the timestamp data corresponding to abnormal traffic, uncovering whether there is a fixed recurring pattern in the time intervals. This prevents the continued spread of malicious communication due to overlooked periodic anomalies, which could threaten the security of zero-trust architectures. Once a fixed recurring cycle of abnormal traffic is confirmed, its transmission path can be obtained to pinpoint the source. The transmission path includes complete routing information from the sender to the receiver, including the source IP address, intermediate routing node IP addresses, the destination IP address, the communication port, and routing forwarding records. This information clearly reflects the propagation trajectory of the abnormal traffic, eliminates interference from intermediate nodes, and provides raw data support for accurately locating the source node, avoiding misjudgments of the source due to relying solely on surface IP addresses.

[0040] For example, taking the abnormal traffic set containing 8 abnormal traffic instances obtained in step S160 as an example, each abnormal traffic instance corresponds to a 10-second sliding window, and their millisecond-level timestamps are 1699987200000, 1699987500000, 1699987800000, 1699988100000, 1699988400000, 1699988700000, 1699989000000, and 1699989300000. Autocorrelation function (ACF) analysis can be performed using Python's StatsModels library. When the lag time is 300 seconds (5 minutes), the autocorrelation coefficient is 0.91, and the autocorrelation coefficient remains above 0.85 for every subsequent 300-second lag, indicating that these abnormal traffic instances have a fixed recurrence period of 5 minutes. Then, the transmission date of this periodic abnormal traffic is retrieved through the network traffic monitoring system. The analysis revealed that the transmission path for all abnormal traffic was: source IP address 192.168.5.25 → first relay router node 192.168.5.1 → second relay router node 203.0.113.10 → destination IP address 198.51.100.45, with the communication port being the non-standard port 7999 and no additional relay nodes. Finally, by querying the device information corresponding to the source IP address 192.168.5.25 using the network topology management system, it was determined that it was a terminal computer used by an employee of a certain department (device number: PC-20230510, MAC address: 00-1E-37-8D-6A-2F). This terminal was directly connected to the first relay router node and no other devices shared this IP address. Checking its network access logs revealed that the terminal was online and had data transmission records when all periodic abnormal traffic occurred. Ultimately, this terminal computer was determined to be the source node of the abnormal traffic.

[0041] In one embodiment of this application, in step S170, abnormal traffic indicators are determined based on the abnormal traffic set. These indicators include the ratio of the difference between the data packet sending rate and the data packet receiving rate, and the standard deviation of the data packet size. Specifically, for example, the abnormal traffic set determined in step S160 includes eight abnormal traffic records. Each abnormal traffic record corresponds to a 10-second sliding window of communication data, and the number of data packets sent, received, and the specific size (in bytes) of each data packet within each window are recorded. For these eight abnormal traffic records, two abnormal traffic indicators are calculated: when calculating the ratio of the difference between the data packet sending rate and the receiving rate, the sending rate (total number of data packets sent within the window / 10) and the receiving rate (total number of data packets received within the window / 10) are calculated based on a 10-second window duration. For example, the difference ratio of abnormal traffic record 1 (500 sent, 200 received) is (500 / 10) / (200 / 10) = 2.5; abnormal traffic record 2 (600 sent, 150 received) is (600 / 10) / (150 / 10) = 4.0; and abnormal traffic record 3 (300 sent, 50 received) is (300 / 10) / (50 / 10) = 6.0. For example, the mean of abnormal traffic record 1 is 431 bytes, with a standard deviation of approximately 18.2 bytes; the mean of abnormal traffic record 2 is 492 bytes, with a standard deviation of approximately 107.3 bytes; and the mean of abnormal traffic record 3 is 526 bytes, with a standard deviation of approximately 263.5 bytes. This ultimately forms the complete abnormal traffic metric for each abnormal traffic record, such as abnormal traffic record 1 having a difference ratio of 2.5 and a packet size standard deviation of 18.2 bytes.

[0042] In one embodiment of this application, step S180, if it is determined that any one of the abnormal traffic indicators exceeds the traffic indicator threshold of the corresponding abnormal traffic indicator, then the current communication behavior pattern is determined based on the abnormal traffic set, and the current communication behavior pattern is determined to be malicious communication behavior. The step also includes the following steps: Figure 7 As shown, the specific content is as follows: Step S710: Based on the abnormal traffic set, use a time series analysis algorithm to determine the communication behavior characteristics, including traffic request frequency, data packet size distribution, and communication port occupancy rate. Step S720: Based on communication behavior characteristics, the K-means clustering algorithm is used to determine different types of communication behavior patterns, including high-frequency short connections, low-frequency high-volume communication, and abnormal port communication. Step S730: Based on communication behavior patterns, use the support vector machine algorithm to determine the malice score of each type of communication behavior pattern; Step S740: Determine whether the malice score exceeds the preset malice score threshold; Step S750: If the malice score threshold is exceeded, the current communication behavior pattern is finally determined to be malicious communication behavior.

[0043] Specifically, the K-means clustering algorithm is an unsupervised learning algorithm that automatically groups abnormal traffic samples based on the similarity of communication behavior characteristics, forming communication behavior patterns with different features. A K value of 3 is set, corresponding to three preset modes: high-frequency short connections, low-frequency high-volume connections, and abnormal port communication. The core characteristics of the high-frequency short connection mode are high traffic request frequency and small data packet size; the core characteristics of the low-frequency high-volume connection mode are low traffic request frequency and large data packet size; and the core characteristics of the abnormal port communication mode are non-standard service ports with high occupancy rates. Clustering classifies and organizes abnormal traffic, avoiding confusion between different types of abnormal behavior and laying the foundation for targeted malicious assessment. A model can be trained based on labeled malicious / normal communication samples to quantify the maliciousness of the three communication behavior patterns obtained from clustering. The scoring process takes the cluster center feature vector of each pattern and the feature vector of all samples in that pattern as input. The model learns the correlation between different behavioral patterns and malicious communication in historical data and outputs a malice score between 0 and 1. The closer the score is to 1, the higher the probability of the pattern being malicious. The closer the score is to 0, the more likely it is to be a benign anomaly, thus achieving accurate quantification of the malice of the abnormal pattern.

[0044] For example, we can set the difference ratio threshold to 2.5 (normal sample difference ratio mean 1.2 + 2 times standard deviation 0.6) and the data packet size standard deviation threshold to 95 bytes (normal sample standard deviation mean 35 + 3 times standard deviation 20). Then, we compare the metrics for eight abnormal traffic flows one by one. For example, abnormal traffic 1 has a difference ratio of 4.0 and a data packet size standard deviation of 107.3 bytes. We can see that the difference ratio 4.0 > 2.5 (exceeding the difference ratio threshold) and the standard deviation 107.3 bytes > 95 bytes (exceeding the data packet size standard deviation threshold). Abnormal traffic 2 has a difference ratio of 2.3 and a data packet size standard deviation of 102.1 bytes. We can see that the difference ratio 2.3 < 2.5 (not exceeding the difference ratio threshold) and the standard deviation 102.1 bytes > 95 bytes (exceeding the data packet size standard deviation threshold).

[0045] For example, the abnormal traffic set includes 500 abnormal traffic samples, each corresponding to communication data within a 10-second sliding window. Time series analysis is performed to calculate the traffic request frequency (e.g., sample 1: 120 times / 10 seconds, sample 2: 30 times / 10 seconds, overall range 20-150 times / 10 seconds), data packet size distribution (e.g., sample 1: mean 300 bytes, standard deviation 45 bytes, sample 2: mean 2000 bytes, standard deviation 180 bytes), and communication port occupancy rate (e.g., sample 1 uses port 7999, occupancy rate 65%, sample 2 uses port 8080, occupancy rate 40%) for each sample, forming a three-dimensional communication behavior feature vector for each sample. These feature vectors are then input into a K-means clustering algorithm (K=3, 50 iterations, convergence threshold 0.001), resulting in a high-frequency short connection pattern composed of 200 samples. The three modes were: a low-frequency, high-volume mode consisting of 150 samples (request frequency ≥ 100 times / 10 seconds, average data packet size ≤ 500 bytes, port occupancy ≥ 50%), a low-frequency, high-volume mode consisting of 150 samples (request frequency ≤ 50 times / 10 seconds, average data packet size ≥ 1500 bytes, port occupancy ≤ 40%), and an abnormal port communication mode consisting of 150 samples (using non-standard ports, occupancy ≥ 60%). A trained support vector machine classification model (optimal parameters C=2.0, gamma=0.2, radial basis function kernel) was then used to score the maliciousness of each mode. The results showed that the maliciousness score for the high-frequency short connection mode was 0.85, the maliciousness score for the low-frequency, high-volume mode was 0.78, and the maliciousness score for the abnormal port communication mode was 0.92. A preset malice scoring threshold of 0.8 was set. It was determined that the high-frequency short connection mode (0.85 > 0.8) and the abnormal port communication mode (0.92 > 0.8) exceeded the preset malice scoring threshold, while the low-frequency high-volume mode (0.78 < 0.8) did not exceed the preset malice scoring threshold. Finally, the high-frequency short connection and abnormal port communication modes were ultimately identified as malicious communication behaviors, and the corresponding 350 abnormal traffic samples were included in the malicious communication behavior set to provide accurate targets for subsequent abnormal report generation and automated response process.

[0046] In the above method, three core features—traffic request frequency, data packet size distribution, and communication port occupancy rate—are extracted based on anomaly traffic sets using time series analysis algorithms. This reveals the behavioral patterns of abnormal traffic and solves the technical problem of unsystematic feature mining in traditional methods. The K-means clustering algorithm is used to classify abnormal traffic into three distinct patterns: high-frequency short connections, low-frequency high-volume traffic, and abnormal port communication. This achieves classification and sorting of complex abnormal traffic, avoiding confusion between different types of abnormal behavior. The support vector machine algorithm is used to score the malice of each pattern, transforming qualitative behavioral patterns into quantitative malice risk indicators, improving the scientific rigor and objectivity of malice determination. The final judgment is based on a preset malice scoring threshold, effectively distinguishing between benign and malicious anomalies. This reduces network operation interference caused by misjudgments and avoids missing high-risk malicious patterns, significantly improving the accuracy of malicious communication behavior determination and further enhancing the reliability of encrypted traffic malicious communication detection.

[0047] In one embodiment of this application, after determining that the communication behavior is malicious, step S180 further includes the following steps, such as... Figure 8 As shown, the specific content is as follows: Step S810: Determine the malicious behavior pattern based on malicious communication behavior; Step S820: Obtain a preset malicious behavior feature library, and match the malicious behavior pattern with each preset malicious behavior feature in the preset malicious behavior feature library to determine the matching degree between the malicious behavior pattern and each preset malicious behavior feature. Step S830: Obtain the protection measures for the preset malicious behavior characteristics corresponding to the maximum value in the matching degree, and use the protection measures as the solution for the current malicious communication behavior.

[0048] Specifically, for example, based on the core characteristics of malicious communication behavior, malicious behavior patterns are identified as including high-frequency short-connection malicious behavior patterns and abnormal port communication malicious behavior patterns. High-frequency short-connection malicious behavior patterns are characterized by: traffic request frequency ≥ 100 times / 10 seconds, average packet size ≤ 500 bytes, port occupancy rate ≥ 50%, and a sending / receiving rate difference ratio ≥ 2.5; no fixed communication port but primarily non-standard ports. Abnormal port communication malicious behavior patterns are characterized by: using non-standard service ports (such as 7999, 10086, excluding commonly used ports such as 80, 443, and 8080), port occupancy rate ≥ 60%, standard deviation of packet size ≥ 100 bytes, a fixed repetition period of 5 minutes, and a traffic request frequency fluctuation range of 80-120 times / 10 seconds.

[0049] For example, a pre-defined malicious behavior signature database can be obtained, which includes three pre-defined malicious behavior signatures. Pre-defined malicious behavior signature 1 (DDoS attack signature): traffic request frequency ≥ 90 times / 10 seconds, average packet size ≤ 600 bytes, sending rate vs. receiving rate difference ratio ≥ 2.0, port occupancy rate ≥ 45%, no fixed communication cycle; Pre-defined malicious behavior signature 2 (malicious software covert communication signature): use of non-standard ports, port occupancy rate ≥ 55%, fixed repetition cycle (3-10 minutes), standard deviation of packet size ≥ 80 bytes; Pre-defined malicious behavior signature 3 (data theft behavior signature): sending rate vs. receiving rate difference ratio ≥ 3.0, average packet size ≤ 400 bytes, no fixed port usage pattern, no obvious repetition cycle. The cosine similarity algorithm is used to calculate the matching degree between the two malicious behavior patterns and the above pre-defined signatures. The high-frequency short connection malicious behavior pattern has a matching degree of 0.93 with pre-defined malicious behavior signature 1, 0.61 with pre-defined malicious behavior signature 2, and 0.75 with pre-defined malicious behavior signature 3. The match rate between the abnormal port communication malicious behavior pattern and the preset malicious behavior feature 1 is 0.58, the match rate between the pattern and the preset malicious behavior feature 2 is 0.91, and the match rate between the pattern and the preset malicious behavior feature 3 is 0.42.

[0050] For example, the maximum match rate of the high-frequency short connection malicious behavior pattern is 0.93 (corresponding to preset malicious behavior feature 1: DDoS attack feature). Its associated protective measures are: ① Automatically blocking the source IP address (e.g., 192.168.5.25) and associated subnets corresponding to this malicious communication; ② Limiting the data packet transmission limit of the corresponding communication port to 500 packets / second; ③ Enabling a traffic scrubbing mechanism to filter the high-frequency short data packets sent by this IP address; ④ Real-time monitoring of the subsequent communication behavior of the source IP address for 12 hours. The maximum match rate of the abnormal port communication malicious behavior pattern is 0.91 (corresponding to preset malicious behavior feature 2: malware covert communication feature). Its associated protective measures are: ① Disabling the external data transmission permissions of non-standard communication ports (e.g., 7999, 10086); ② Isolating the source node (e.g., terminal computer PC-20230610) to a sandbox environment for malware detection and removal; ③ Extracting the data packet characteristics of this malicious communication, updating the preset malicious behavior feature database, and enhancing subsequent detection capabilities; ④ Verifying the system logs of the source node to trace the malware's implantation path. The aforementioned targeted protective measures are presented as solutions for two types of malicious communication behaviors, forming complete handling plan documents. These documents are then simultaneously pushed to the network security management platform, where they are either automatically executed by the system or manually triggered by the administrator. This approach not only quickly curbs the spread of threats but also meets the core requirements of dynamic protection and continuous verification under a zero-trust architecture, further strengthening the zero-trust security system.

[0051] This application also provides a malicious communication behavior detection system in encrypted traffic. The system may include a first determining module, a first constructing module, a second constructing module, a second determining module, a third determining module, a first judging module, a fourth determining module, and a second judging module. The first determining module is used to acquire historical encrypted traffic and determine normal communication traffic samples based on the historical encrypted traffic. The first constructing module is used to construct a normal communication behavior model based on the normal communication traffic samples. The second constructing module is used to train a classification model using a support vector machine classifier based on the normal communication behavior model. The second determining module is used to acquire real-time encrypted traffic data and determine a feature vector set based on the encrypted traffic data. The third determining module is used to input the feature vector set into... The trained classification model determines the deviation between the feature vectors in the feature vector set and normal communication traffic samples. A first judgment module determines whether the deviation exceeds a preset deviation threshold. If it does, the current encrypted traffic data is marked as abnormal traffic, and an abnormal traffic set is determined based on the abnormal traffic. A fourth determination module determines abnormal traffic indicators based on the abnormal traffic set. Abnormal traffic indicators include the difference ratio between the data packet sending rate and the data packet receiving rate, and the standard deviation of the data packet size. A second judgment module determines the current communication behavior pattern based on the abnormal traffic set if any one of the abnormal traffic indicators exceeds the corresponding abnormal traffic indicator threshold, and classifies the current communication behavior pattern as malicious communication behavior.

[0052] It should be noted that the embodiments of the malicious communication behavior detection system in encrypted traffic provided in this application can be used to execute the processing flow of the embodiments of the malicious communication behavior detection method in encrypted traffic in the above embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the above method embodiments.

[0053] This application also provides an electronic device, which includes one or more processors and memory resources represented by a memory for storing instructions executable by the processor, such as application programs. The application programs stored in the memory may include one or more modules, each corresponding to a set of instructions. Furthermore, the processor is configured to execute instructions to perform the aforementioned method for detecting malicious communication behavior in encrypted traffic.

[0054] The electronic device may also include a power supply component configured to perform power management of the electronic device, a wired or wireless network interface configured to connect the electronic device to a network, and an input / output (I / O) interface. The electronic device can be operated based on operating devices stored in memory, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0055] In one embodiment, a computer device, which may be a server, is also provided. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device stores data. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for detecting malicious communication behavior in encrypted traffic.

[0056] In one embodiment, a computer device is provided, which may be a terminal. The computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used for exchanging information between the processor and external devices. The communication interface of the computer device is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a method for detecting malicious communication behavior in encrypted traffic. The display unit of the computer device is used to form a visually visible image and may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0057] This application also provides a non-transitory computer-readable storage medium, which, when the instructions in the storage medium are executed by the processor of the electronic device, enables the electronic device to perform a method for detecting malicious communication behavior in encrypted traffic.

[0058] This application may take the form of a computer program product implemented on one or more storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing program code. Computer-readable storage media include permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information may be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to: phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0059] It should be noted that although the steps of the malicious communication behavior detection method in encrypted traffic of this application are described in a specific order in the accompanying drawings, this does not require or imply that these steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps, such as omitting certain steps, combining multiple steps into one step, and / or breaking down one step into multiple steps, should all be considered part of this application.

[0060] It should be understood that this application is not limited to the detailed structure and arrangement of the modules in the malicious communication behavior detection system in encrypted traffic proposed in this specification. This application can have other implementations and can be implemented and executed in various ways. The foregoing variations and modifications fall within the scope of this application. It should be understood that the application and its definition in this specification extend to all alternative combinations of two or more individual features mentioned or apparent in the text and / or drawings. All these different combinations constitute multiple alternative aspects of this application. The embodiments described in this specification illustrate the best known mode for implementing this application and will enable those skilled in the art to utilize this application.

Claims

1. A method for detecting malicious communication behavior in encrypted traffic, characterized in that, include: Obtain historical encrypted traffic and determine normal communication traffic samples based on the historical encrypted traffic; A normal communication behavior model is constructed based on the normal communication traffic samples. Based on the normal communication behavior model, a support vector machine classifier is used to train the classification model. Acquire real-time encrypted traffic data and determine a feature vector set based on the encrypted traffic data; The feature vector set is input into the trained classification model to determine the deviation between the feature vectors in the feature vector set and the normal communication traffic samples. Determine whether the deviation exceeds a preset deviation threshold. If it exceeds the preset deviation threshold, mark the current encrypted traffic data as abnormal traffic and determine the abnormal traffic set based on the abnormal traffic. An abnormal traffic index is determined based on the abnormal traffic set. The abnormal traffic index includes the difference ratio between the data packet sending rate and the data packet receiving rate and the standard deviation of the data packet size. If any one of the abnormal traffic indicators is determined to exceed the traffic indicator threshold corresponding to the abnormal traffic indicator, then the current communication behavior pattern is determined based on the abnormal traffic set, and the current communication behavior pattern is determined to be malicious communication behavior.

2. The method for detecting malicious communication behavior in encrypted traffic according to claim 1, characterized in that, The step of determining normal communication traffic samples based on the historical encrypted traffic includes: The historical encrypted traffic is standardized to determine the standardized historical encrypted traffic; Based on the standardized historical encrypted traffic, the isolated forest algorithm is used to filter the normal communication traffic samples.

3. The method for detecting malicious communication behavior in encrypted traffic according to claim 1, characterized in that, The step of constructing a normal communication behavior model based on the normal communication traffic samples includes: Based on the normal communication traffic samples, a Gaussian mixture model is used to determine the probability of each normal communication traffic sample belonging to a cluster. The mean vector and covariance matrix are determined based on the probability of each normal communication traffic sample belonging to its cluster. The normal communication behavior model is constructed based on the mean vector and the covariance matrix.

4. The method for detecting malicious communication behavior in encrypted traffic according to claim 1, characterized in that, Determining the feature vector set based on the encrypted traffic data includes: Determine the encrypted traffic packet sequence based on the encrypted traffic data; A data packet feature set is determined based on the encrypted traffic packet sequence, and the data packet feature set includes source IP, destination IP, data packet length, and timestamp; Based on the data packet feature set, the feature vector set is determined using a sliding window analysis algorithm.

5. The method for detecting malicious communication behavior in encrypted traffic according to claim 1, characterized in that, Determining the deviation between the feature vectors in the feature vector set and the normal communication traffic samples includes: The first feature value corresponding to the feature vector and the second feature value corresponding to the normal communication traffic sample are obtained respectively. The first feature value includes the traffic packet size and traffic packet length corresponding to the feature vector, and the second feature value includes the traffic packet size and traffic packet length corresponding to the normal communication traffic sample. The first feature mean and the first feature standard deviation are determined based on the first feature value, and the second feature mean and the second feature standard deviation are determined based on the second feature value; Calculate the Euclidean distance between the mean and standard deviation of the first feature and the mean and standard deviation of the second feature; The Euclidean distance is used as the deviation between the feature vectors in the feature vector set and the normal communication traffic samples.

6. The method for detecting malicious communication behavior in encrypted traffic according to claim 1, characterized in that, After determining the abnormal traffic set based on the abnormal traffic, the method further includes: Determine whether the occurrence of the abnormal traffic has a fixed recurring period; If it is determined that the fixed repetition period exists, then the transmission path of the abnormal traffic is obtained; The source node of the abnormal traffic is determined based on the transmission path of the abnormal traffic.

7. The method for detecting malicious communication behavior in encrypted traffic according to claim 1, characterized in that, The step of determining the current communication behavior pattern based on the abnormal traffic set and identifying the current communication behavior pattern as malicious communication behavior includes: Based on the abnormal traffic set, a time series analysis algorithm is used to determine the communication behavior characteristics, which include traffic request frequency, data packet size distribution, and communication port occupancy rate. Based on the aforementioned communication behavior characteristics, the K-means clustering algorithm is used to determine different types of communication behavior patterns, including high-frequency short connections, low-frequency high-volume communication, and abnormal port communication. Based on the aforementioned communication behavior patterns, a support vector machine algorithm is used to determine the malice score of each type of communication behavior pattern. Determine whether the malice score exceeds a preset malice score threshold; If the malice score threshold is exceeded, the current communication behavior pattern will be ultimately determined as malicious communication behavior.

8. The method for detecting malicious communication behavior in encrypted traffic according to claim 1, characterized in that, After determining the communication behavior as malicious, the following is also included: Determine the malicious behavior pattern based on the malicious communication behavior; A preset malicious behavior feature library is obtained, and the malicious behavior pattern is matched with each preset malicious behavior feature in the preset malicious behavior feature library to determine the matching degree between the malicious behavior pattern and each preset malicious behavior feature. Obtain the protection measures corresponding to the preset malicious behavior characteristics of the maximum value in the matching degree, and use the protection measures as the solution for the current malicious communication behavior.

9. A system for detecting malicious communication behavior in encrypted traffic, characterized in that, include: The first determining module is used to acquire historical encrypted traffic and determine normal communication traffic samples based on the historical encrypted traffic; The first construction module is used to construct a normal communication behavior model based on the normal communication traffic sample. The second construction module is used to train a classification model using a support vector machine classifier based on the normal communication behavior model. The second determining module is used to acquire real-time encrypted traffic data and determine a feature vector set based on the encrypted traffic data; The third determining module is used to input the feature vector set into the trained classification model to determine the deviation between the feature vectors in the feature vector set and the normal communication traffic samples. The first judgment module is used to determine whether the deviation exceeds a preset deviation threshold. If the deviation exceeds the preset deviation threshold, the current encrypted traffic data is marked as abnormal traffic, and an abnormal traffic set is determined based on the abnormal traffic. The fourth determining module is used to determine abnormal traffic indicators based on the abnormal traffic set. The abnormal traffic indicators include the difference ratio between the data packet sending rate and the data packet receiving rate and the standard deviation of the data packet size. The second judgment module determines the current communication behavior pattern based on the abnormal traffic set if any one of the abnormal traffic indicators exceeds the corresponding traffic indicator threshold, and identifies the current communication behavior pattern as malicious communication behavior.

Images