Multistage classification detection method for remote desktop protocol traffic behaviors

Abstract

The invention discloses a multistage classification detection method for remote desktop protocol traffic behaviors, and the method comprises the steps: firstly screening out encrypted RDP protocol traffic which comprises the recognition of a TLS protocol, an SSH protocol and HTTP tunnel traffic; then, identifying the encrypted RDP flow according to the message length sequence characteristics of the RDP protocol in the connection establishment stage; and finally, for behaviors contained in the encrypted RDP protocol traffic, extracting features from three levels of traffic length, load randomness and interactivity, and classifying by using a machine learning method to realize identification of internal fine grit of the RDP protocol traffic, i.e., identification of RDP protocol traffic behaviors. On the premise of ensuring privacy, RDP protocol flow identification and classification of specific operation behaviors generated when a user remotely controls a server can be effectively realized through multi-stage classification processing of flow.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a multi-level classification detection method for remote desktop protocol traffic behavior. Background technique [0002] Remote Desktop Protocol (RDP) is currently the most widely used secure remote desktop protocol. This protocol service provides convenience for remote office, remote maintenance, and remote call system sharing resources, which greatly improves the management efficiency of enterprises and individuals. Therefore, It has been used more and more widely in today's highly informationized world. At the same time, for enterprise security or statistical needs, the audit work of the RDP protocol becomes particularly important. [0003] While the RDP protocol is becoming more and more popular, network privacy issues and network security issues involving enterprises and individuals also follow. For example, there may be users who remotely control the ...

AI Technical Summary

Problems solved by technology

As a result, the traditional "flat" identification and classification scheme becomes inappropriate when the traffic category is divided into finer-grained categories. The identification of RDP protocol traffic behavior belongs to the fine-grained classification of target traffic, which has great impact on network security. Audit work has important theoretical significance and application value

Images