面向网络敏感加密应用通联行为的检测技术研究  

Study on Detection Technology of Communication Behavior for Network Sensitive Encryption Applications

作　　者：俞赛赛 施凡 任传伦 YU Sai-sai;SHI Fan;REN Chuan-lun(No.15 Research Institute of CETC,Bejing 100085,China;National University of Defense Technology,Changsha,Hunan 410073,China;No.36 Research Institute of CETC,Jiaxing,Zhejiang 314033,China)

机构地区：[1]中国电子科技集团公司第十五研究所,北京100083 [2]国防科技大学,湖南长沙410073 [3]中国电子科技集团公司第三十六研究所,浙江嘉兴314033

出　　处：《通信对抗》2024年第4期32-35,51,共5页Communication Countermeasures

摘　　要：网络加密技术已广泛应用于通信领域,尤其在网络敏感加密应用通联行为方面。攻击者通常会采用网络加密流量技术,隐藏其内部恶意应用之间的通信信息,对正常的网络安全通信造成了严重威胁。文章通过对网络敏感加密应用产生的流量数据进行抓取和分析,通过构建面向网络敏感加密应用的多模型组合学习器流量检测模型,利用加密流量检测技术分析流量数据是否为恶意加密流量,以此作为判断网络敏感加密应用通联行为是否合规的依据,实现了面向网络敏感加密应用通联行为的有效检测。Network encryption technology has been widely used in the field of communication,especially in the communication behavior of network sensitive encryption applications.Attackers usually use network encrypted traffic technology to hide the communication information between malicious applications,which poses a serious threat to normal network security communication.To realize the effective detection of the communication behavior of network sensitive encryption applications,this paper captures and analyzes trafic data generated by network sensitive encryption applications,builds a multi-model combined learning traffic detection model for network sensitive encryption applications,and uses encrypted traffic detection technology to analyze whether the generated traffic data is malicious encrypted traffic,so as to judge whether the communication behavior of network sensitive encryption applications is compliant.

关 键 词：网络敏感加密应用 恶意加密流量 多模型组合学习器 流量检测 SSL协议 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]