A malicious traffic detection implementation method and device based on deep learning

Abstract

The embodiment of the invention discloses a malicious traffic detection implementation method and device based on deep learning. The method can include: obtaining the flow session of malicious code through dynamic sandbox technology; mapping the traffic session of malicious code to a gene map and extracting the map features; using the map features of traffic session for clustering and marking theclustering results by a malicious code family; training the preset depth learning model by using the tagged gene map of the malicious code family to establish the malicious traffic detection model; using the malicious traffic detection model to detect real-time network traffic, and realizing malicious traffic detection. Through the embodiment, many problems existing in the conventional detection technology such as artificial feature extraction difficulty, privacy disclosure, encryption and confusion difficult to identify, machine learning feature manual extraction and the like are solved to acertain extent, and the method has the characteristics of high robustness, high speed, high accuracy, low false alarm rate, cross-platform detection and the like.

Description

technical field [0001] The embodiment of the present invention relates to computer security technology, especially a method and device for implementing malicious traffic detection based on deep learning. Background technique [0002] The traditional method of detecting malicious (abnormal) traffic is to use the transport layer port to identify most of the malicious (abnormal) traffic. Although there are problems with inaccuracy, it is still a fast and simple method to continuously monitor and report abnormal traffic. [0003] Afterwards, a payload-based method is proposed to identify bytes or strings related to malicious (abnormal) traffic by detecting packet content, or to perform more complex syntax matching. However, this method involves privacy issues, and at the same time cannot deal with encryption, protocol confusion and other issues. [0004] At present, the pattern recognition algorithm using traditional machine learning can solve the privacy problem to a certain e...

AI Technical Summary

Problems solved by technology

[0006] In order to solve the above technical problems, the embodiments of the present invention provide a method and device for implementing malicious traffic detection based on deep learning, which can solve the difficulties in manual feature extraction, privacy leakage, encryption and confusion existing in the current detection technology to a certain extent. Identification, artificial extraction of machine learning features and many other problems, and has high robustness, and has the characteristics of fast, high accuracy, low false positive rate, cross-platform detection, etc.

Images