Encrypted traffic identification scheme based on sliding window and randomness features

LIU Jiachi; KUANG Boyu; SU Mang; XU Yaqian; FU Anmin

doi:10.11959/j.issn.2096-109x.2024056

您当前的位置：

首页 >

文章列表页 >

Encrypted traffic identification scheme based on sliding window and randomness features

Papers

- Encrypted traffic identification scheme based on sliding window and randomness features
- Chinese Journal of Network and Information Security Vol. 10, Issue 4, Pages: 98-108(2024)
- 作者机构：
  
  1.南京理工大学网络空间安全学院,江苏南京 210094
  2.南京理工大学计算机科学与工程学院,江苏南京 210094
  3.中国电子信息产业发展研究院,北京 100000
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62072239;62372236);Qing Lan Project of Jiangsu Province, Jiangsu Funding Program for Excellent Postdoctoral Talent
- DOI：10.11959/j.issn.2096-109x.2024056
  CLC： TP309.7
- Received：22 March 2024，
  
  Revised：2024-07-09，
  
  Published：25 August 2024
- 稿件说明：
移动端阅览
刘家池, 况博裕, 苏铓, 等. 基于滑动窗口和随机性特征的加密流量识别方案[J]. 网络与信息安全学报, 2024, 10(4): 98-108.

Format: LIU J C, KUANG B Y, SU M, et al. Encrypted traffic identification scheme based on sliding window and randomness features[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 98-108.
刘家池, 况博裕, 苏铓, 等. 基于滑动窗口和随机性特征的加密流量识别方案[J]. 网络与信息安全学报, 2024, 10(4): 98-108. DOI： 10.11959/j.issn.2096-109x.2024056.

Format: LIU J C, KUANG B Y, SU M, et al. Encrypted traffic identification scheme based on sliding window and randomness features[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 98-108. DOI： 10.11959/j.issn.2096-109x.2024056.

摘要

随着信息技术的发展，用户和组织对网络安全的关注度不断提高，数据加密传输逐渐成为主流，推动互联网中加密流量的比例不断攀升。然而，数据加密在保障隐私和安全的同时也成为非法内容逃避网络监管的手段。为实现加密流量的检测与分析，需要高效地识别出加密流量。但是，压缩流量的存在会严重干扰对加密流量的识别。针对上述问题，设计了基于滑动窗口和随机性特征的加密流量识别方案，以高效且准确地识别加密流量。具体来说，所提方案根据滑动窗口机制对会话中数据传输报文的有效载荷进行采样，获取能够反映原始流量信息模式的数据块序列，针对每个数据块使用随机性测度算法进行样本特征提取，为原始载荷构建随机性特征。此外，通过设计基于CART（classification and reqression tree）算法的决策树模型，在提高加密和压缩流量识别的准确率的同时，极大降低了针对加密流量识别的漏报率。基于对多个权威网站数据的随机抽样，构建均衡的数据集，并通过实验证明了所提方案的可行性和高效性。

Abstract

With the development of information technology

network security has increasingly become a focal point for users and organizations

and encrypted data transmission has gradually become mainstream. This trend has driven the proportion of encrypted traffic on the Internet to rise continuously. However

data encryption

while ensuring privacy and security

has also become a means for illegal content to evade network supervision. To achieve the detection and analysis of encrypted traffic

it has become necessary to efficiently identify encrypted traffic. However

the presence of compressed traffic has significantly interfered with the identification of encrypted traffic. To address this issue

an encrypted traffic identification scheme based on sliding windows and randomness features was designed to efficiently and accurately identify encrypted traffic. Specifically

the scheme involved sampling the payloads of data packets in sessions using a sliding window mechanism to obtain data block sequences that reflect the information patterns of the original traffic. For each data block

randomness measurement algorithms were utilized to extract sample features and construct randomness features for the original payload. Additionally

a decision tree model based on the CART algorithm was designed

which significantly improved the accuracy of identifying encrypted and compressed traffic and greatly reduced the false negative rate for encrypted traffic identification. A balanced dataset was constructed by randomly sampling data from several authoritative websites

and experiments demonstrated the feasibility and efficiency of the proposed scheme.

关键词

Keywords

references

潘吴斌 , 程光 , 郭晓军 , 等 . 网络加密流量识别研究综述及展望 [J ] . 通信学报 , 2016 , 37 ( 9 ): 154 - 167 .

PAN W B , CHENG G , GUO X J , et al . Review and perspective on encrypted traffic identification research [J ] . Journal on Communications , 2016 , 37 ( 9 ): 154 - 167 .

史国振 , 李昆阳 , 刘瑶 , 等 . 基于深度残差胶囊网络与注意力机制的加密流量识别方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 1 ): 32 - 41 .

SHI G Z , LI K Y , LIU Y , et al . Encrypted traffic identification method based on deep residual capsule network with attention mechanism [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 1 ): 32 - 41 .

JAYASANKAR U , THIRUMAL V , PONNURANGAM D . A survey on data compression techniques: from the perspective of data quality, coding schemes, data type and applications [J ] . Journal of King Saud University - Computer and Information Sciences , 2021 , 33 ( 2 ): 119 - 140 .

CHENG G , HU Y . Encrypted traffic identification based on N-gram entropy and cumulative sum test [C ] // Proceedings of the 13th International Conference on Future Internet Technologies . New York : ACM , 2018 : 1 - 6 .

DORFINGER P , PANHOLZER G , JOHN W . Entropy estimation for real-time encrypted traffic identification (short paper) [C ] // International Workshop on Traffic Monitoring and Analysis . Berlin, Heidelberg : Springer , 2011 : 164 - 171 .

WOOD D , APTHORPE N , FEAMSTER N . Cleartext data transmissions in consumer IoT medical devices [EB ] . arXiv Preprint arXiv: 1803.10147 , 2018 .

程光 , 陈玉祥 . 基于支持向量机的加密流量识别方法 [J ] . 东南大学学报(自然科学版) , 2017 , 47 ( 4 ): 655 - 659 .

CHENG G , CHEN Y X . Identification method of encrypted traffic based on support vector machine [J ] . Journal of Southeast University (Natural Science Edition) , 2017 , 47 ( 4 ): 655 - 659 .

HAHN D , APTHORPE N , FEAMSTER N . Detecting compressed cleartext traffic from consumer Internet of Things devices [EB ] . arXiv Preprint arXiv: 1805.02722 , 2018 .

TANG Z , ZENG X , SHENG Y . Entropy-based feature extraction algorithm for encrypted and non-encrypted compressed traffic classification [J ] . Int J Innov Comput Inf Control , 2019 , 15 : 845 - 860 .

陈子涵 , 程光 , 徐子恒 , 等 . 互联网加密流量检测、分类与识别研究综述 [J ] . 计算机学报 , 2023 , 46 ( 5 ): 1060 - 1085 .

CHEN Z H , CHENG G , XU Z H , et al . A survey on Internet encrypted traffic detection, classification and identification [J ] . Chinese Journal of Computers , 2023 , 46 ( 5 ): 1060 - 1085 .

CASINO F , CHOO K K R , PATSAKIS C . HEDGE: efficient traffic classification of encrypted and compressed packets [J ] . IEEE Transactions on Information Forensics and Security , 2019 , 14 ( 11 ): 2916 - 2926 .

GASPARI D F , HITAJ D , PAGNOTTA G , et al . Reliable detection of compressed and encrypted data [J ] . Neural Computing and Applications , 2022 , 34 ( 22 ): 20379 - 20393 .

SALEH M M , ALSLAIMAN M , SALMAN M I , et al . Combining raw data and engineered features for optimizing encrypted and compressed Internet of Things traffic classification [J ] . Computers & Security , 2023 , 130 : 103287 .

BHATTACHARJEE K , DAS S . A search for good pseudo-random number generators: Survey and empirical studies [J ] . Computer Science Review , 2022 , 45 : 100471 .

FU N , CHENG G , SU X Y . Accurate compressed traffic detection via traffic analysis using graph convolutional network based on graph structure feature [J ] . Computer Communications , 2023 , 207 : 128 - 139 .

李光松 , 李文清 , 李青 . 基于随机性特征的加密和压缩流量分类 [J ] . 吉林大学学报(工学版) , 2021 , 51 ( 4 ): 1375 - 1386 .

LI G S , LI W Q , LI Q . Encrypted and compressed traffic classification based on random feature set [J ] . Journal of Jilin University (Engineering and Technology Edition) , 2021 , 51 ( 4 ): 1375 - 1386 .

王勇 , 周慧怡 , 俸皓 , 等 . 基于深度卷积神经网络的网络流量分类方法 [J ] . 通信学报 , 2018 , 39 ( 1 ): 14 - 23 .

WANG Y , ZHOU H Y , FENG H , et al . Network traffic classification method basing on CNN [J ] . Journal on Communications , 2018 , 39 ( 1 ): 14 - 23 .

SIKOS L F . Packet analysis for network forensics: a comprehensive survey [J ] . Forensic Science International: Digital Investigation , 2020 , 32 : 200892 .

NIHAN S T . Karl pearsons chi-square tests [J ] . Educational Research and Reviews , 2020 , 15 ( 9 ): 575 - 580 .

LUENGO E A , OLIVARES B A , VILLALBA L J G , et al . Further analysis of the statistical independence of the NIST SP 800-22 randomness tests [J ] . Applied Mathematics and Computation , 2023 , 459 : 128222 .

JAMIL S , PIRAN M J , RAHMAN M , et al . Learning-driven lossy image compression: a comprehensive survey [J ] . Engineering Applications of Artificial Intelligence , 2023 , 123 : 106361 .

JAYASANKAR U , THIRUMAL V , PONNURANGAM D . A survey on data compression techniques: From the perspective of data quality, coding schemes, data type and applications [J ] . Journal of King Saud University - Computer and Information Sciences , 2021 , 33 ( 2 ): 119 - 140 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Encrypted traffic classification method based on convolutional neural network

Survey of side channel attack on encrypted network traffic

Survey of encrypted malicious traffic detection based on deep learning

Related Author

Rongna XIE

Zhuhong MA

Zongyu LI

Ye TIAN

Ding LI

Yuefei ZHU

Bin LU

Wei LIN

Related Institution

Information Engineering University

State Key Laboratory of Mathematical Engineering and Advanced Computing

⁰