TLS协议恶意加密流量识别研究综述  

TLS Malicious Encrypted Traffic Identification Research

作　　者：康鹏 杨文忠[1,2] 马红桥 KANG Peng;YANG Wenzhong;MA Hongqiao(College of Information Science and Engineering,Xinjiang University,Urumqi 830046,China;Key Laboratory of Multilingual Information Technology in Xinjiang Uygur Autonomous Region,College of Information Science and Engineering,Xinjiang University,Urumqi 830046,China)

机构地区：[1]新疆大学信息科学与工程学院,乌鲁木齐830046 [2]新疆大学信息科学与工程学院新疆维吾尔自治区多语种信息技术重点实验室,乌鲁木齐830046

出　　处：《计算机工程与应用》2022年第12期1-11,共11页Computer Engineering and Applications

基　　金：国家自然科学基金(U1603115);新疆维吾尔自治区重点科技专项(2020A02001-1);国家重点研发计划项目子课题(2017YFC0820702-3);中国电子科学研究院,社会安全风险感知与防控大数据应用国家工程实验室主任基金(2019680001)。

摘　　要：随着5G时代的来临,以及公众对互联网的认识日益加深,公众对个人隐私的保护也越来越重视。由于数据加密过程中存在着恶意通信,为确保数据安全,维护社会国家利益,加密流量识别的研究工作尤为重要。针对TLS流量详细的阐述,分析了早期识别方法的改进技术,包括常见的流量检测技术、DPI检测技术、代理技术以及证书检测技术。介绍了选取不同TLS加密流量特征的机器学习模型,以及无需特征选择的深度学习模型等诸多最新研究成果。对相关研究工作的不足进行总结,并对未来技术的研究工作和发展趋势进行了展望。With the advent of the 5G era and the increasing public awareness of the Internet,the public has paid more and more attention to the protection of personal privacy.Due to malicious communication in the process of data encryption,to ensure data security and safeguard social and national interests,the research work on encrypted traffic identification is particularly important.Therefore,this paper describes the TLS traffic in detail and analyzes the improved technology of early identification method,including common traffic detection technology,DPI detection technology,proxy technology,and certificate detection technology.It also introduces machine learning models for selecting different TLS encrypted traffic characteristics,as well as many recent research results of deep learning models without feature selection.The deficiencies of the related research work are summarized,and the future research work and development trend of the technology have been prospected.

关 键 词：5G时代 个人隐私 恶意流量 数据安全 TLS加密流量识别 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]