基于多任务特征学习的网络加密流量识别算法  

Network Encrypted Traffic Identification Based on Multi-task Feature Learning

作　　者：孟娟 孟鹏 缪志敏 李晨溪 钱明远 MENG Juan;MENG Peng;MIAO Zhi-min;LI Chen-xi;QIAN Ming-yuan(PLA 31108,Nanjing 210016,China;Hubei University of Science and Technology,Xianning 437000,China;Army Engineering University of PLA,Nanjing 210007,China)

机构地区：[1]解放军31108部队,江苏南京210016 [2]湖北科技学院,湖北咸宁437000 [3]解放军陆军工程大学,江苏南京210007

出　　处：《计算机技术与发展》2021年第6期112-117,共6页Computer Technology and Development

基　　金：江苏省自然科学基金青年基金面上资助项目(BK20140075)。

摘　　要：加密数据流难以从其数据内容进行监管,但却是非法数据、敏感信息监管的重要对象。目前对加密数据流识别的研究大多依据特定的加密传输协议,主要通过端口匹配识别、深度包检测、深入流检测等来进行识别,这些方法实施的前提是加密协议已知,并未给出一种通用的加密数据流识别方法。对当前加密数据流识别技术进行了分析,分析加密数据流外在数据形式中所蕴含的内在属性信息,遵循"随机性特征——盲识别"的研究思路,研究一种通用的网络加密流量识别方法,利用加密流量的随机性特征,提出基于多任务特征学习的网络加密流量识别算法。该算法利用?2,1正则化项对一组相关任务进行联合特征学习。实验结果表明:该算法可有效识别网络加密流量,识别精度可达到80%以上。It’s difficult to regulate the encrypted traffic from the content, but it is an important target to regulate the illegal data and sensitive information. Current researches on the encrypted traffic identification are more for specific encryption protocol, mainly through port information, load characteristics and flow characteristics. The implementation premise of these methods is that the encryption protocol is known. There is not a general method for the encrypted traffic identification. The technology of encrypted traffic identification is analyzed, followed the "randomness feature-protocol independent identification" research idea by analyzing the encrypted traffic inherent attribute information, and a general method of encrypted traffic identification is studied. Utilizing the randomness characteristics, a multi-task feature learning formulation is proposed to identify encrypted traffic, which captures the intrinsic relatedness among different tasks by a ?2,1-norm regularized multi-task feature learning model. Experiment shows that the identification accuracy of the proposed algorithm can get above 80% for encrypted traffic identification.

关 键 词：加密流量识别 随机性 NIST检验 特征选择 多任务特征学习 

分 类 号：TP181摇摇摇摇摇摇摇文献标识码:A摇摇摇摇摇摇文章编号:1673-629X(2021)06-0112-06[自动化与计算机技术—控制理论与控制工程]