基于可信列表的启发式流量检测模型  

A Heuristic Traffic Identification Method Based on Trusted List

作　　者：王蛟[1] 周亚建[1] 杨义先[1] 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室信息安全中心,北京100876

出　　处：《北京邮电大学学报》2008年第2期95-98,共4页Journal of Beijing University of Posts and Telecommunications

基　　金：国家"973计划"项目(2007CB310704);国家自然科学基金与香港研究资助局联合科研基金项目(60731160626);国家自然科学基金项目(60673098)

摘　　要：在分析了现有流量检测技术不足的基础上,提出了一种基于可信列表的启发式流量检测方法.该方法采用了"记忆"技术,通过将已识别的连接加入到一个可信列表中,并实时优化该列表,使得比较活跃的网络连接始终能在列表中优先检测到,从而加快流量检测速度,提高准确度.实验证明,该方法对加密流量的检测效果非常理想,相比现有检测方法更具效率,识别率可达到95%以上.The insufficient of current traffic identification technique was analyzed, and then a heuristic traffic identification method based on trusted list was proposed. This method uses a ＂memory＂ technique, adds the discerned connection into a trusted list. Moreover, a real-time optimized method was developed to make sure that the more active connections can be measured to primarily in the trusted list all the time, thus will accelerate the traffic identification speed and improve the accuracy. The experiment results show that this method can identify the encrypted traffic perfectly, and more effectively than existed methods

关 键 词：对等网络 流量检测 可信列表 深度包检测 

分 类 号：TN911.22[电子电信—通信与信息系统]