基于信息熵的加密会话检测方法  

Encrypted Session Detection Approach Based on Information Entropy

作　　者：陈利[1] 张利[1] 班晓芳[1] 梁杰[1] 

机构地区：[1]中国信息安全测评中心,北京100085

出　　处：《计算机科学》2015年第1期142-143,174,共3页Computer Science

摘　　要：传统协议分析方法在检测网络加密会话时大都通过端口识别,在加密应用使用非常规端口或者在周知明文端口出现加密流量时无法进行有效的检测。为此,提出基于信息熵的加密会话检测方法。该方法先对数据流按端口进行会话重组,再计算会话数据包字符熵,进而统计出整个会话字符熵,判断熵值是否属于训练模型正态分布置信区间,通过信息分布均匀度来检测加密会话。实验表明,该方法无需特征指纹库,且检测准确率高,并能实现实时检测和处理。Traditional protocol analysis algorithms detect the network encrypted session through the port.It cannot work when encrypted session uses unknown port or encrypted traffic appeares at known plaintext port.To this end,we put forward a detection approach of encrypted session based on information entropy.Firstly it reorganizes net flow according to the port,then calculates the entropy of each packet and statistical entropy value of the entire session,at last determines whether the value belongs to the normal distribution confidence interval,and identifies the encrypted session through character distribution uniformity.Experiments show that the approach does not need fingerprint database,and can achieve higher correct detection rate,real-time detection and processing.

关 键 词：信息熵 加密会话 协议识别 正态分布 入侵检测 

分 类 号：TP303.0[自动化与计算机技术—计算机系统结构]