结合报文负载与流指纹特征的恶意流量检测  

Malicious Traffic Detection Combining Features ofPacket Payload and Stream Fingerprint

作　　者：胡斌[1] 周志洪[1,2] 姚立红[1] 李建华[1,2] HU Bin;ZHOU Zhihong;YAO Lihong;LI Jianhua(School of Cyber Science and Engineering,Shanghai Jiao Tong University,Shanghai 200240,China;Shanghai Key Laboratory of Integrated Administration Technologies for Information Security,Shanghai Jiao Tong University,Shanghai 200240,China)

机构地区：[1]上海交通大学网络空间安全学院,上海200240 [2]上海交通大学上海市信息安全综合管理技术研究重点实验室,上海200240

出　　处：《计算机工程》2020年第11期157-163,共7页Computer Engineering

基　　金：国家重点研发计划(2016YFB0800904)。

摘　　要：SSL/TLS协议的恶意流量检测数据集来源单一,而传统检测方法通常将网络流量的五元组特征作为主要分类特征,但其在复杂网络环境下对于恶意流量的检测准确率较低。为此,提出一种改进的加密恶意流量检测方法。采用数据预处理方式将加密恶意流量划分为报文负载和流指纹两个特征维度,在规避五元组信息的情况下根据报文负载和流指纹特征描述网络流量的位置分布,并通过逻辑回归模型实现加密恶意流量检测。实验结果表明,在不依赖五元组特征的条件下,该方法对复杂网络环境下SSL/TLS协议加密恶意流量的检测准确率达到97.60%,相比使用五元组与报文负载特征的传统检测方法约提升36.05%。The data sets for the detection of malicious traffic by the SSL/TLS protocol are single-sourced.Traditional detection methods take the quintuple feature of network traffic as the main feature for classification,which reduces the accuracy of malicious traffic detection in complex network environments.To address the problem,this paper proposes an improved method for encrypted malicious traffic detection.During data pre-processing,the encrypted malicious traffic is divided into two feature dimensions,packet payload and stream fingerprint,which are used to describe the distribution of traffic when the quintuple information is avoided.Also,the logistic regression model is used to realize the detection of encrypted malicious traffic.Experimental results show that,without relying on the five-tuple feature,the detection accuracy of the proposed method for malicious traffic encrypted by the SSL/TLS protocol in the complex network environment reaches 97.60%,which is approximately 36.05%higher than the traditional detection method based on quintuple feature and packet payload feature.

关 键 词：SSL/TLS协议 恶意流量检测 五元组特征 逻辑回归模型 僵尸网络 报文负载特征 流指纹特征 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]