A method and device for implementing malicious traffic detection based on deep learning

Abstract

The embodiment of the present invention discloses a method and device for implementing malicious traffic detection based on deep learning. The method may include: obtaining the traffic session of malicious code through dynamic sandbox technology; mapping the traffic session of malicious code into a gene map and extracting the map features, using the map features of traffic sessions to cluster, and mark the clustering results as malicious code families; use the marked genetic maps of malicious code families to train the preset deep learning model to establish a malicious traffic detection model; use malicious The traffic detection model detects the real-time traffic of the network to realize malicious traffic detection. Through this embodiment scheme, many problems existing in the current detection technology, such as difficulty in manual feature extraction, privacy leakage, difficult identification of encryption and confusion, manual extraction of machine learning features, etc., are solved to a certain extent, and the robustness is high, and it has Fast, high accuracy, low false alarm rate, cross-platform detection, etc.

Description

technical field [0001] The embodiment of the present invention relates to computer security technology, especially a method and device for implementing malicious traffic detection based on deep learning. Background technique [0002] The traditional method of detecting malicious (abnormal) traffic is to use the transport layer port to identify most of the malicious (abnormal) traffic. Although there are problems with inaccuracy, it is still a fast and simple method to continuously monitor and report abnormal traffic. [0003] Afterwards, a payload-based method is proposed to identify bytes or strings related to malicious (abnormal) traffic by detecting packet content, or to perform more complex syntax matching. However, this method involves privacy issues, and at the same time cannot deal with encryption, protocol confusion and other issues. [0004] At present, the pattern recognition algorithm using traditional machine learning can solve the privacy problem to a certain e...

AI Technical Summary

Problems solved by technology

[0006] In order to solve the above technical problems, the embodiments of the present invention provide a method and device for implementing malicious traffic detection based on deep learning, which can solve the difficulties in manual feature extraction, privacy leakage, encryption and confusion existing in the current detection technology to a certain extent. Identification, artificial extraction of machine learning features and many other problems, and has high robustness, and has the characteristics of fast, high accuracy, low false positive rate, cross-platform detection, etc.

Images