Scheme for identifying malware traffic with TLS data based on machine learning

Ziming LUO; Shubin XU; Xiaodong LIU

doi:10.11959/j.issn.2096-109x.2020008

您当前的位置：

首页 >

文章列表页 >

Scheme for identifying malware traffic with TLS data based on machine learning

Papers | 更新时间：2024-06-03

- Scheme for identifying malware traffic with TLS data based on machine learning
- Chinese Journal of Network and Information Security Vol. 6, Issue 1, Pages: 77-83(2020)
- 作者机构：
  
  1. 中国电子科技集团公司第五十四研究所，河北石家庄 050081
  2. 石家庄通信测控技术研究所，河北石家庄 050081
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020008
  CLC： TP393
- Online First：2020-02，
  
  Published：15 February 2020
- 稿件说明：
移动端阅览
Ziming LUO, Shubin XU, Xiaodong LIU. Scheme for identifying malware traffic with TLS data based on machine learning[J]. Chinese Journal of Network and Information Security, 2020, 6(1): 77-83.
DOI：

Ziming LUO, Shubin XU, Xiaodong LIU. Scheme for identifying malware traffic with TLS data based on machine learning[J]. Chinese Journal of Network and Information Security, 2020, 6(1): 77-83. DOI： 10.11959/j.issn.2096-109x.2020008.

摘要

首先介绍了安全传输层（TLS，transport layer security）协议的特点、流量识别方法；然后给出了一种基于机器学习的分布式自动化的恶意加密流量检测体系；进而从 TLS 特征、数据元特征、上下文数据特征3个方面分析了恶意加密流量的特征；最后，通过实验对几种常见机器学习算法的性能进行对比，实现了对恶意加密流量的高效检测。

Abstract

Based on analyzing the characteristics of transport layer security (TLS) protocol

a distributed automation malicious traffic detecting system based on machine learning was designed.The characteristics of encrypted malware traffic from TLS data

observable metadata and contextual flow data was extracted.Support vector machine

random forest and extreme gradient boosting were used to compare the performance of the mainstream malicious encryption traffic identification which realized the efficient detection of malicious encryption traffic

and verified the validity of the detection system of malicious encryption traffic.

关键词

Keywords

references

张蕾 , 崔勇 , 刘静 , 等 . 机器学习在网络空间安全研究中的应用 [J ] . 计算机学报 , 2018 ( 9 ): 1943 - 1975 .

ZHANG L , CUI Y , LIU J , et al . Application of machine learning in cyberspace security research [J ] . Journal of Computer , 2018 ( 9 ): 1943 - 1975 .

王伟 . 基于深度学习的网络流量分类及异常检测方法研究 [D ] . 合肥:中国科学技术大学 , 2018 .

WANG W . Deep learning for network traffic classification and anomaly detection [D ] . Hefei:University of Science and Technology of China , 2018

ANDERSON B , MCGREW D , . Identifying encrypted malware traffic with contextual flow data [C ] // ACM Workshop on Artificial Intelligence ＆ Security . 2016 : 36 - 41 .

ANDERSON B , MCGREW D . Machine learning for encrypted malware traffic classification:accounting for noisy labels and non-stationarity [C ] // The 23rd ACM SIGKDD International Conference . 2017 : 1725 - 1729 .

王琳 , 封化民 , 刘飚 , 等 . 基于混合方法的SSL VPN加密流量识别研究 [J ] . 计算机应用与软件 , 2019 , 36 ( 2 ): 321 - 328 .

WANG L , FENG H M , LIU B , et al . SSL VPN encrypted traffic identification based on hybrid method [J ] . Computer Applications and Software , 2019 , 36 ( 2 ): 321 - 328 .

鲁刚 , 郭荣华 , 周颖 , 等 . 恶意流量特征提取综述 [J ] . 信息网络安全 , 2018 , 213 ( 9 ): 7 - 15 .

LU G , GUO R H , ZHOU Y , et al . Review of malicious traffic feature extration [J ] . Netinfo Security , 2018 , 213 ( 9 ): 7 - 15 .

王可 . MD5算法研究 [J ] . 中文信息 , 2002 ( 2 ): 78 - 81 .

WANG K . A research on MD5 [J ] . Chinese Information , 2002 ( 2 ): 78 - 81 .

SHIRAVI A , SHIRACI H , TAVALLAEE M , et al . Toward developing a systematic approach to generate benchmark datasets for intrusion detection [J ] . Computers ＆ Security , 2012 , 31 ( 3 ): 357 - 374 .

LASHKARI A H , DRAPER-GIL G , MAMUN M S I , et al . Characterization of encrypted and VPN traffic using time-related features [C ] // International Conference on Information Systems Security＆ Privacy . 2016 , 407 - 414 .

朴杨 , 鹤然 , 任俊玲 . 基于Stacking的恶意网页集成检测方法 [J ] . 计算机应用 , 2019 , 39 ( 4 ): 153 - 160 .

PIAO Y , HE R , REN J L . Malicious webpage integrated detection method based on stacking ensemble algorithm [J ] . Journal of Computer Applications , 2019 , 39 ( 4 ): 153 - 160 .

刘铭 , 吴朝霞 . 支持向量机理论与应用 [J ] . 科技视界 , 2018 , 245 ( 23 ): 73 - 74 .

LIU M , WU Z X . Theory and application of support vector machine [J ] . Science and Technology Vision , 2018 , 245 ( 23 ): 73 - 74 .

BREIMAN L . Random forest [J ] . Machine Learning , 2001 : 1 - 33 .

CHEN T , GUESTRIN C . XGBoost:a scalable tree boosting system [C ] // The 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2016 .

Views

3428

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Personal data privacy protection method based onvertical partitioning

Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis

Related Author

ZUO Peng

CHEN Yong

KONG Kaichuan

HE Ming

HOU Ronghao

LI Qinghao

LIU Chunling

TANG Yonghe

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

School of Medical Information, Wannan Medical College

School of Physics and Electronic Information, Anhui Normal University

⁰