基于时间特征的HTTPS中间人攻击检测方法  

Man-in-the-Middle Attack Detection Method for HTTPS Based on Temporal Features

作　　者：姜博 林伟 JIANG Bo;LIN Wei(Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2024年第2期189-195,共7页Journal of Information Engineering University

基　　金：国家重点研发计划前沿科技创新专项基金资助项目(2019QY1300)。

摘　　要：中间人攻击是网络攻击的一种常用手段,其中超文本传输安全(Hypertext Transfer Protocol Secure,HTTPS)协议的中间人攻击危害较大,已有检测方法主要面向单客户端,以证书匹配验证为主要手段,部署成本和性能开销较高。通过分析SSL(Secure Sockets Layer)握手阶段的密钥协商、证书验证等关键报文,提出基于时间特征的HTTPS中间人攻击检测方法,从流量角度提供了一种检测思路,具有更广泛的适用场景。实验结果表明,该方法在互联网环境测试数据集下具有较高的准确率。Man-in-the-middle attack is a common means of network attacks,in which attacks on HTTPS protocols are more harmful.Existing detection methods are mainly oriented to single clients,with certificate matching verification as the main means but with high deployment cost and performance overhead.By analyzing key packets such as key negotiation and certificate verification during the SSL handshake phase,we propose a man-in-the-middle HTTPS attack detection method based on temporal characteristics,which provides a detection idea from the traffic perspective and has a broader application scenario.Experimental results show that the proposed method has high accuracy under the Internet environment test dataset.

关 键 词：HTTPS协议 流量劫持 中间人攻击 攻击检测 机器学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]