A Malicious Encrypted Traffic Identification Method Based on Machine Learning

Abstract

The present invention is a traffic identification technology based on machine learning, and the object of identification is encrypted malicious traffic. The technology is mainly used in the field of traffic identification, and can also be assisted in the field of network attack detection. The technical core of this technology is to use machine learning algorithms to establish a malicious encrypted traffic identification model, and then use the model to identify new traffic. The workflow of this technology is to read a large amount of traffic data with known attributes, extract the statistical characteristics of the traffic, use the characteristics as attributes, use the random forest algorithm to build a model, and finally use the model to identify new input traffic. The identification process of the new input traffic is to extract the statistical characteristics of the traffic, input the model for identification, and obtain the identification result. This technology is mainly aimed at encrypted and encoded traffic. The data involved in modeling are all composed of normal encrypted traffic and malicious encrypted traffic. This is because the identification technology of non-encrypted traffic is very mature, but the identification of encrypted or encoded traffic is not. It is very difficult, and this technology provides a new solution for the identification of encrypted traffic.

Description

technical field [0001] The present invention relates to the field of encrypted traffic identification and traffic statistical feature modeling. The main core is to collect the statistical features of a large number of traffic data samples, use the data to establish a machine learning model, and use the constructed model to identify malicious encrypted traffic. [0002] technical background [0003] At present, most traditional traffic identification technologies mainly rely on feature matching and are widely used in plaintext traffic identification. However, due to the encrypted or encoded malicious traffic, its related features cannot be directly extracted, so it is impossible to directly use the matching feature technology to detect and identify encrypted malicious traffic. The premise of traditional traffic identification technology to extract features is to decrypt encrypted traffic, but this involves the issue of privacy violations. The encryption of malicious traffic is...

AI Technical Summary

Problems solved by technology

[0008] "A method for identifying malicious encrypted traffic based on machine learning" is an invention proposed to solve the problem of identifying malicious traffic without decrypting encrypted traffic

The problem that feature matching cannot identify encrypted traffic lies in two points: the feature cannot be extracted, and the matching cannot be performed. In the present invention, statistical features solve the problem of feature extraction, and machine learning solves the problem of matching

Images