基于数据分类的恶意加密流量检测方法  

Malicious Encrypted Traffic Detection Method Based on Data Classification

作　　者：华漫[1] 王昭 庄建勋 HUA Man;WANG Zhao;ZHUANG Jianxun(School of Computer Science,Civil Aviation Flight University of China,Guanghan Sichuan 618307,China)

机构地区：[1]中国民用航空飞行学院计算机学院,四川广汉618307

出　　处：《信息安全与通信保密》2025年第1期67-77,共11页Information Security and Communications Privacy

基　　金：四川省科技厅科技项目(2023YFG0171)。

摘　　要：为提高恶意加密流量的检测精度,针对传统检测方法存在的特征提取不足、区分度较差等问题,提出了一种基于数据分类的检测策略。该模型首先采用K-means方法对流量数据进行分类,然后结合卷积神经网络与双向门控循环单元的深度学习模型,通过优化卷积位置来增强关键特征的提取能力。此方法能够同时捕获流量数据的空间和时间特征,实现对恶意加密流量的二分类检测。实验结果显示,相较于卷积神经网络、长短期记忆网络等单一深度学习模型及支持向量机、逻辑回归等传统机器学习模型,该方法在精确率、召回率和F1值等方面均有提升,准确率达到96.78%。In order to improve the detection accuracy of malicious encrypted traffic,a detection strategy based on data classification is proposed to address the problems of insufficient feature extraction and poor discrimination in conventional detection methods.First,the K-means method is used to classify the traffic data,and then the deep learning model combining convolutional neural network with bidirectional gated recurrent unit(CNN-BiGRU)is used to enhance the extraction ability of key features by optimizing the convolution position.This method can capture the spatial and temporal features of traffic data at the same time,and achieve the binary detection of malicious encrypted traffic.Experimental results indicate that compared with single deep learning models such as CNN,LSTM and conventional machine learning models such as SVM and logistic regression,the proposed method has improved precision,recall and F1 score,with an accuracy rate of 96.78%.

关 键 词：网络安全 加密恶意流量 特征选择 深度学习 聚类模型 

分 类 号：TP393.0[自动化与计算机技术—计算机应用技术]