基于随机性特征的加密和压缩流量分类  

Encrypted and compressed traffic classification based on random feature set

作　　者：李光松[1] 李文清 李青[2] LI Guang-song;LI Wen-qing;LI Qing(School of Cyber Security,Information Engineering University,Zhengzhou 450001,China;School of Information Systems Engineering,Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学网络空间安全学院,郑州450001 [2]信息工程大学信息系统工程学院,郑州450001

出　　处：《吉林大学学报（工学版）》2021年第4期1375-1386,共12页Journal of Jilin University:Engineering and Technology Edition

基　　金：国家自然科学基金创新研究群体项目(61521003);河南省重大公益专项项目(201300210200).

摘　　要：当网络传输数据应用加密或压缩算法后,其载荷数据均呈现出较强的随机性,利用现有的流量检测方法,很难将加密和压缩流量有效区分。针对上述问题,基于加密数据与压缩数据随机性的差异性特征,提出了ECF特征集,在不依赖网络传输协议、数据包头、压缩标识等信息的情况下,使用当前主流机器学习算法构建分类模型,实现了有效的加密和压缩流量分类。实验测试表明,本文方法在分类精度上优于现有分类方法,并且具有很好的泛化性和迁移性。When encryption or compression algorithms are used to transmit data over the network,the payload data is generally random.Using existing traffic detection methods,it is difficult to effectively distinguish encrypted traffic from compressed traffic.To solve this problem,based on the differences between randomness of encrypted data and compressed data,this paper proposes the ECF randomness feature set.Without relying on the information of the network protocols,the packet headers,and the compression identifiers,the current mainstream machine learning algorithms are used to achieve accurate identification of encrypted or compressed data.Experiment results show that this method has higher accuracy compared with current methods and it also has good performance with generalization and migration.

关 键 词：流量分类 加密流量 压缩流量 机器学习 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]