Method and device for detecting malicious encrypted traffic

Abstract

The present invention provides a method and device for detecting malicious encrypted traffic. The method constructs an encrypted graph by mining the correlation between encrypted sessions in the encrypted traffic, and converts single-stream isolated analysis to multi-stream collaborative analysis. At the same time, two types of attributes are proposed to describe the encrypted malicious traffic, one is the credibility of the evaluation based on the handshake information, and the other is the stationarity of the evaluation based on the TLS record length sequence. Confidence value and stationarity value, and input the pre-trained feed-forward neural network to get malicious score to identify encrypted malicious traffic. The invention detects the malicious encrypted traffic more accurately and has higher robustness by mining the relationship between encrypted sessions.

Description

technical field [0001] The present invention relates to the technical field of network security, and in particular, to a method and device for detecting malicious encrypted traffic. Background technique [0002] Encrypted traffic in the network is increasing rapidly. Security protocols such as SSL (secure Socket Layer) and upgraded TLS (Transport Layer Security) are widely used to establish trusted encrypted connections, which effectively ensure the confidentiality and integrity of network communications. Google's Transparency Report shows that more than 95% of traffic passing through Google is encrypted. Encryption as a security measure leaves a grey area of ​​traffic for attackers to hide their malicious activities, such as malware delivery, Command & Control Channel (Command & Control Channel), and data return. Related reports show that since 2019, the number of cyberattacks using encrypted channels to bypass traditional security controls has rapidly increased by 260%. ...

AI Technical Summary

Problems solved by technology

[0008] Embodiments of the present invention provide a malicious encrypted traffic detection method and device to eliminate or improve one or more defects existing in the prior art, and to solve the problem that the prior art detects malicious encrypted traffic with large calculation and time overheads , relying too much on human expertise, paying too much attention to the statistical characteristics or data representation of a single stream leads to unsatisfactory detection results

Images