基于神经网络的加密恶意流量检测技术研究  

Encrypted malicious traffic detection based on neural network

作　　者：夏龙飞 张琪浩 吴宪云 朱雪田 谷欣 田敏 Xia Longfei;Zhang Qihao;Wu Xianyun;Zhu Xuetian;Gu Xin;Tian Min(School of Communication Engineering,Xidian University,Xi'an 710000,China;China Satellite Network Innovation Co.,Ltd.,Beijing 100029,China)

机构地区：[1]西安电子科技大学通信工程学院,陕西西安710000 [2]中国星网网络创新研究院有限公司,北京100029

出　　处：《电子技术应用》2025年第3期12-16,共5页Application of Electronic Technique

摘　　要：随着加密通信的广泛应用,传统基于内容分析的恶意流量检测方法逐渐失效,如何高效检测加密流量中的恶意行为成为网络安全领域的研究重点。研究提出了一种基于神经网络的加密恶意流量检测方法,通过深度学习模型实现恶意加密流量的分类。首先,将网络流量预处理并提取关键特征,包括包大小分布、时间间隔及协议类型等,随后将特征映射为二维特征图(Feature Map),作为深度学习模型的输入。设计可伸缩的窗口自注意力机制,利用Transfomer神经网络模型对特征图进行分类,实现了对恶意流量的高效检测。实验结果表明,该方法在检测精度、召回率等方面均表现优异,为解决加密流量恶意行为检测问题提供了一种可行方案。With the widespread application of encrypted communications,traditional malicious traffic detection methods based on content analysis have gradually become ineffective.How to efficiently detect malicious behavior in encrypted traffic has become a research focus in the field of network security.This paper proposes a neural network-based encrypted malicious traffic detection method,which realizes the classification of malicious encrypted traffic through a deep learning model.First,the network traffic is preprocessed and key features are extracted,including packet size distribution,time interval,and protocol type.The features are then mapped into a two-dimensional feature map as the input of the deep learning model.A scalable window self-attention mechanism is designed,and the Transfomer neural network model is used to classify feature maps,achieving efficient detection of malicious traffic.Experimental results show that this method performs well in detection accuracy,recall rate,and model robustness,and provides a feasible solution to the problem of malicious behavior detection in encrypted traffic.

关 键 词：加密恶意流量 可伸缩的窗口自注意力 深度学习 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]