A Method for Quickly and Automatically Identifying Encrypted Network Behavior

Abstract

The invention provides a method capable of rapidly automatically identifying encrypted network behaviors, aiming at solving the problem of difficulty in identification of massive encrypted network behaviors. The method includes: constructing a specific encrypted network behavior model library, acquiring network interaction data in real time, computing correlation coefficients of the network interaction data acquired in real time and the model library, and conducting automatic classification and identification by means of combining the computed correlation coefficients with a preset threshold value. The method has the advantages that the method is capable of making online judgment on encrypted traffic of encrypted data timely, rapidly and efficiently, so that the problem that research and development workload is increased due to frequent upgrading of an encryption protocol is solved effectively.

Description

technical field [0001] The invention relates to a method for identifying encrypted network behavior, in particular to a method for quickly and automatically identifying encrypted network behavior, and belongs to the technical field of network security. Background technique [0002] The emergence of the Internet has greatly changed people's communication methods and brought about earth-shaking changes in people's lives. Different users use various applications in the network, and hundreds of millions of application flows are generated every day. These seemingly normal Various malicious attacks may be hidden in the traffic. Therefore, classifying and identifying network traffic is of great significance to standardize network applications, purify the network environment, and protect the privacy and security of network users. This is also a hot issue in the field of network security, especially how to quickly and accurately identify encrypted network behaviors. is the top prior...

AI Technical Summary

Problems solved by technology

Among them, the principle and implementation of identification based on port numbers are relatively simple, but it is easily affected by dynamic ports and forged ports of encrypted traffic; identification based on payload information is difficult for encrypted application pattern matching, and is easily affected by version upgrades; based on machine learning The recognition accuracy of recognition and flow-based statistical feature recognition is acceptable, but the computational overhead is high and the implementation complexity is high, which cannot meet the requirements of online real-time recognition

Images