基于M-序列检验的加密流量识别  

M-serial test based encrypted traffic identification

作　　者：王炜[1] 程东年[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,河南郑州450002

出　　处：《计算机工程与设计》2014年第11期3712-3716,共5页Computer Engineering and Design

基　　金：国家973重点基础研究发展计划基金项目(2012CB315901;2012CB315906);国家863高技术研究发展计划基金项目(2011AA01A103)

摘　　要：为更好地进行网络管理和网络安全维护,通过研究加密流量的内容统计特征,提出基于M-序列检验的网络数据随机性评估算法(network data randomness estimation,NDRE)以识别加密流量。采用M-序列检验方法对序列随机性进行量化;根据负载序列长度,自适应训练得到最优化参数集;利用最小风险贝叶斯准则,对加密流量进行识别。实验结果表明,与基于熵的方法相比,在控制一定计算复杂度的情况下,NDRE精确度有较大提高。To manage the network and maintain the network security, the study on identifying the network encrypted traffic was carried out and the M-serial test based network data randomness estimation algorithm （NDRE） was proposed by studying the content statistical characteristics. The M-serial test method was used to quantify the randomness of the sequence. The most optimized set of parameters was self-adaptively trained and obtained depending on the length of the payload sequence. The minimum risk Bayes was utilized to identify the encrypted traffic. Experimental results show that compared with the entropy-based me- thod, the precision of the NDRE is better when the computational complexity was controlled within a certain reasonable range.

关 键 词：加密流量 流量识别 M-序列检验 随机性 贝叶斯准则 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]