一种加密流量行为分析系统的设计研究  

Design and Research of Encrypted Traffic Behavior Analysis System

作　　者：程永新[1] 张德治[1] 廖竣锴[1] 胡华鹏 CHENG Yong-xin;ZHANG De-zhi;LIAO Jun-kai;HU Hua-peng(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2020年第4期976-980,共5页Communications Technology

摘　　要：随着互联网安全形势的日益严峻,采用流量加密方式进行业务传输的比重越来越大,针对加密流量的监管成为挑战。面对加密流量难以监管的难题,提出了一种加密流量行为分析系统。系统基于加密业务的流量特征,采用机器学习算法,无需解密网络流量就能对流量进行行为分析,实现了加密流量的识别和分类,并对系统进行了试验测试。测试结果显示,该系统可以发现隐藏在加密流量中的攻击行为、恶意行为和非法加密行为,对于安全人员掌握网络安全态势、发现网络异常具有重要意义。With the increasingly severe Internet security situation,the proportion of traffic transmission by using traffic encryption is increasing,and supervision of encrypted traffic has become a challenge.Facing the difficult problem of encrypted traffic supervision,an encryption traffic behavior analysis system is proposed.Based on the traffic characteristics of the encrypted business,the system uses machine learning algorithms to analyze the behavior of the traffic without decrypting the network traffic,realize the identification and classification of encrypted traffic.The experiment test indicates that the system can detect attack behaviors,malicious behaviors,and illegal encryption behaviors hidden in the encrypted traffic,which is of great significance for security personnel to grasp the network security situation and discover network anomalies.

关 键 词：加密流量 特征提取 流量分析 机器学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]