Network application encrypted traffic recognition method and device based on protocol attributes

Abstract

The invention relates to a network application encrypted traffic recognition method and device based on protocol attributes, and belongs to the technical field of computer network service security. The device comprises an offline training module and an online identification module. The offline training module is composed of a data set obtaining module, a message type fingerprint establishment module based on a second order Markov chain and a certificate length clustering module. A training set is obtained through a data set obtaining module. Application fingerprints are obtained and stored according to the training set by the message type fingerprint establishment module based on the second order Markov chain; clustering results and application certificate cluster distribution probability are obtained and stored according to the training set by the certificate length clustering module. The offline training module is composed of a network traffic capturing module and a recognition module. The recognition module matches the network traffic obtained by the capturing module with a stored application fingerprint library one by one; moreover, the certificate clustering results are taken into consideration, thus obtaining a recognition probability; the recognition result is an application corresponding to the highest probability. Compared with the prior art, the method and the device have the advantage of improving the recognition accuracy and efficiency.

Description

technical field [0001] The invention relates to a method for identifying network application encrypted traffic based on protocol attributes, which aims at identifying the source of network traffic, discovering and shielding malicious traffic, and improving network security, and belongs to the technical fields of machine learning and network service security. Background technique [0002] Traffic is the carrier of network communication, network services, and even network attacks. Malicious programs hidden in traffic can easily cause network failures. Traffic identification technology refers to the technology of identifying the network service or application to which massive traffic in the network belongs. Through traffic identification, it is the key to ensure the normal operation of the network to detect malicious traffic in time and implement effective interception and shielding. In practical applications, systems equipped with traffic classification and identification fun...

AI Technical Summary

Problems solved by technology

Since the state used for modeling corresponds to the limited message types in the handshake phase of the SSL / TLS protocol, the difference of the generated application fingerprints is not ideal, and the fingerprints of different network services or applications overlap or are similar to each other from time to time, resulting in this In this case, the accuracy of encrypted network flow classification and identification is greatly reduced

[0007] To sum up, in terms of encrypted network flow classification and identification, neither of the two methods can achieve high accuracy, and there is still a certain distance from the standards required for practical application, and experiments have shown that in some cases, the second method above method has a high probability of exhibiting very low recognition accuracy

Images