加密流量实体行为内视  

Insight of Encrypted Network Traffic within Process Entity Behavior

作　　者：王强 尹鹏 刘畅[4] 乔可春 王文 刘峰[1] 胡春卉 WANG Qiang;YIN Peng;LIU Chang;QIAO Kechun;WANG Wen;LIU Feng;HU Chunhui(Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China;School of Cyber Security,University of Chinese Academy of Sciences,Beijing 100049,China;Defence Industry Secrecy Examination and Certification Center,Beijing 100089,China;Unit 61035 of PLA,Beijing 100094,China;Zhongguancun Laboratory,Beijing 100094,China)

机构地区：[1]中国科学院信息工程研究所,北京100093 [2]中国科学院大学网络空间安全学院,北京100049 [3]军工保密资格审查认证中心,北京100089 [4]中国人民解放军61035部队,北京100094 [5]中关村实验室,北京100094

出　　处：《网络空间安全科学学报》2023年第3期35-43,共9页Journal of Cybersecurity

基　　金：国家重点研发计划(2021YFB3101400);国防基础科研计划(JCKY2021906B002,JCKY2023906C001)。

摘　　要：网络流量检测和识别是一个持久的话题,但是对网络流量行为与实体的关联研究较少,流量主体不明。由于加密流量的广泛应用,在安全运营中较难获取对网络通信传输的可见性,而检测网络攻击和异常行为通常需要获取加密流量对应的底层明文信息。在本文中,我们探索了通过进程行为实体运行时采集上下文信息的方式,对加密流量行为测量提供信息增益,实现加密流量的实体行为内视。我们的工作为加密流量的测量和可见性,增加了观测维度,提供精准的平行安全监测和高效的实体行为回溯分析能力,能够在一定程度上缓解网络空间防御视角下的遥测难题,从而有效提高加密流量隐蔽威胁监测的预警能力,并提升威胁实体恶意行为分析工作的回溯取证效率。Network traffic detection and identification remains a perennial topic,yet studies on the correlation between network traffic behavior and entities are limited,leading to an ambiguity regarding the source of traffic.The widespread adoption of encrypted traffic poses challenges in securing operational visibility,as detecting cyberattack typically requires access to the plaintext information of encrypted traffic.In this paper,we explore the method of collecting contextual message through the runtime process entities,which provides infogain for encrypted traffic measurement.Our work achieve an observing view into the behavior encrypted traffic from process entities,enhance the efficiency of parallel security misson and backtracking analysis.Such advancements could mitigate the telemetry challenges in cybersecurity defense,improving the early warning for APT threats in encrypted traffic.

关 键 词：实体行为 投影测量 加密流量内视 

分 类 号：TN915.08[电子电信—通信与信息系统]