基于深度学习的加密恶意流量检测研究

翟明芳; 张兴明; 赵博

doi:10.11959/j.issn.2096-109x.2020034

您当前的位置：

首页 >

文章列表页 >

基于深度学习的加密恶意流量检测研究

学术论文 | 更新时间：2024-06-03

- 基于深度学习的加密恶意流量检测研究
- Survey of encrypted malicious traffic detection based on deep learning
- 网络与信息安全学报 2020年6卷第3期页码：66-77
- 作者机构：
- 作者简介：
  
  [ "翟明芳（1986- ），男，河南巩义人，国家数字交换系统工程技术研究中心硕士生，主要研究方向为网络空间安全及深度学习算法" ]
  [ "张兴明（1963- ），男，河南新乡人，博士，国家数字交换系统工程技术研究中心教授，主要研究方向为网络空间安全、高性能计算、软硬件协同设计和深度学习" ]
  [ "赵博（1981- ），男，吉林公主岭人，博士，国家数字交换系统工程技术研究中心副研究员，主要研究方向为网络空间安全和拟态防御体系结构" ]
- 基金信息：
  
  高安全等级网络基础设施关键装备核心芯片及软件研发基金资助项目;High Level Security Network Infrastructure Key Equipment Core Chip and Software Development Fund Funding Project(2017ZX01030301)
- DOI：10.11959/j.issn.2096-109x.2020034
  中图分类号： TP391.1
- 网络首发：2020-06，
  
  纸质出版：2020-06-15
- 稿件说明：
移动端阅览
翟明芳, 张兴明, 赵博. 基于深度学习的加密恶意流量检测研究[J]. 网络与信息安全学报, 2020,6(3):66-77.

Mingfang ZHAI, Xingming ZHANG, Bo ZHAO. Survey of encrypted malicious traffic detection based on deep learning[J]. Chinese Journal of Network and Information Security, 2020, 6(3): 66-77.
翟明芳, 张兴明, 赵博. 基于深度学习的加密恶意流量检测研究[J]. 网络与信息安全学报, 2020,6(3):66-77. DOI： 10.11959/j.issn.2096-109x.2020034.

Mingfang ZHAI, Xingming ZHANG, Bo ZHAO. Survey of encrypted malicious traffic detection based on deep learning[J]. Chinese Journal of Network and Information Security, 2020, 6(3): 66-77. DOI： 10.11959/j.issn.2096-109x.2020034.

摘要

随着网络安全防范意识增强，加密通信占据主流，加密流量快速增长。流量加密在保护隐私的同时，也掩饰非法企图，改变威胁形式。深度学习作为机器学习领域的重要分支，是流量分类的有力工具。近年来，将深度学习方法应用于入侵检测的研究不断深入，取得良好效果。在深入调研文献的基础上，将加密恶意流量检测的步骤总结归纳为“六步法”的一般检测框架模型，结合模型对数据处理及检测算法进行回顾总结，指出各类算法模型的优缺点，并对未来研究方向进行展望，以期为下一步研究提供帮助。

Abstract

With the increasing awareness of network security

encrypted communication dominates and encrypted traffic grows rapidly.Traffic encryption

while protecting privacy

also masks illegal attempts and changes the form of threats.As one of the most important branch of machine learning

deep learning performs well in traffic classification.For several years

research on deep-learning based intrusion detection has been deepened and achieved good results.The steps of encrypted malicious traffic detection were introduced to be a general detection framework model named “six-step method”.Then

discussion and induction of data processing and detection algorithms were carried out combined with this model.Both advantages and disadvantages of various algorithm models were given as well.Finally

future research directions were pointed out with a view to providing assistance for further research.

关键词

Keywords

references

LV Y F . In 2018,lucky star network security report and trend outlook [J ] . Information Security Research , 2019 , 5 ( 3 ): 186 - 191 .

CNCERT 2018 China Internet network security situation report [R ] . 2018 .

GURUBARAN S . Cisco ETA–provides solution for detecting malware in encrypted traffic [EB ] .

LET’S ENCRYPT.Linux foundation collaborative projects [R ] .

HE G , XU B , ZHANG L , et al . Mobile app identification for encrypted network flows by traffic correlation [J ] . International Journal of Distributed Sensor Networks , 2018 , 14 ( 12 ): 1 - 17 .

ARNA M . Malware is moving heavily to HTTPS [EB ] .

BUJLOW T , CARELA-ESPAÑOL V BARLET-ROS P . Independent comparison of popular DPI tools for traffic classification [J ] . Computer Networks , 2015 , 76 : 75 - 89 .

WRIGHT C V , COULL S E , MONROSE F . Traffic morphing:an efficient defense against statistical traffic analysis [C ] // NDSS . 2009 : 237 - 250 .

VELAN P , ČERMÁK M , ČELEDA P , et al . A survey of methods for encrypted traffic classification and analysis [J ] . International Journal of Network Management , 2015 , 25 ( 5 ): 355 - 374 .

KRIZHEVSKY A , SUTSKEVER I , HINTON G . Imagenet classication with deep convolutional neural networks [J ] . Advances in neural information processing systems , 2012 , 25 ( 2 ): 84 - 90 .

CHO K , VAN-MERRIENBOER B , GULCEHRE C , et al . Learning phrase representations using RNN encoder-decoder for statistical machine translation [J ] . arXiv Preprint arXiv:1406.1078 , 2014

GRAVES A , MOHAMED A , HINTON G . Speech recognition with deep recurrent neural networks [C ] // 2013 IEEE International Conference on Acoustics,Speech and Signal Processing (ICASSP) . 2013 : 6645 - 6649 .

BYEONW , BREUEL T M , RAUE F , et al . Scene labeling with LSTM recurrent neural networks [C ] // IEEE Conference on Computer Vision and Pattern Recognition . 2015 : 3547 - 3555 .

VINAYAKUMAR R , SOMAN K P , POORNACHANDRAN P . Applying convolutional neural network for network intrusion detection [C ] // IEEE International Conference on Advances in Computing,Communications and Informatics (ICACCI) . 2017 : 1222 - 1228 .

WANG W , SHENG Y Q , WANGJL , et al . HAST-IDS:learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection [J ] . IEEE Access , 2018 , 6 : 1792 - 1806 .

YUAN X Y , LI C H , LI X L . Deep defense:identifying DDoS attack via deep learning [C ] // 2017 IEEE International Conference on Smart Computing . 2017 :18.

LI Z P , QIN Z , HUANG K , et al . Intrusion detection using convolutional neural networks for representation learning [M ] // Neural Information Processing . 2017 : 858 - 866 .

YIN C L , ZHU Y F , FEI J L , et al . A deep learning approach for intrusion detection using recurrent neural networks [J ] . IEEE Access , 2017 , 5 : 21954 - 21961 .

ANDERSON B , PAUL S , MCGREW D . Deciphering malware’s use of TLS (without decryption) [J ] . Comput.Virol.Hacking Techn , 2018 , 14 ( 3 ): 195 - 211 .

BLAKE A , DAVID M . Identifying encrypted malware traffic with contextual flow data [C ] // ACM Workshop on Artificial Intelligence and Security (AISec) . 2016 : 35 - 46 .

GUANCHENG TECHNOLOGY . A report on the country's first detection engine for encrypted traffic [EB ] .

HE G , XU B , ZHU H . AppFA:a novel approach to detect malicious Android applications on the network [J ] . Security and Communication Networks , 2018 : 1 - 15 .

SHABTAI A , TENENBOIM C L , MIMRAN D , et al . Mobile malware detection through analysis of deviations in application network behavior [J ] . Computers ＆ Security , 2014 , 43 : 1 - 18 .

GARG S , PEDDOJU S K , SARJE A K . Network-based detection of Android malicious Apps [J ] . International Journal of Information Security , 2017 , 16 ( 4 ): 385 - 400 .

REZAEI S , LIU X . Deep learning for encrypted traffic classification:an overview [J ] . IEEE Commun Mag , 2019 , 57 ( 5 ): 76 - 81 .

WANG W , ZHU M , WANG J , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // IEEE Int Conf Intell Security Informat . 2017 : 43 - 48 .

OKADA Y , ATA S , NAKAMURA N , et al . Comparisons of machine learning algorithms for application identification of encrypted traffic [C ] // 10th IEEE International Conference on Machine Learning and Applications and Workshops . 2011 : 358 - 361 .

ZHAO B , GUO H , LIU Q R , et al . Protocol independent identification of encrypted traffic based on weighted cumulative sum test [J ] . Journal of Software , 2013 , 24 ( 6 ): 1334 - 1345 .

NIU W N , ZHUO Z L , ZHANG X S , et al . A heuristic statistical testing based approach for encrypted network traffic identification [J ] . IEEE Trans.Veh.Technol. , 2019 ， 68 ( 4 ).

JAIN A V , . Network traffic identification with convolutional neural networks [C ] // 2018 IEEE 16th Intl Conf on Dependable,Autonomic and Secure Computing,Washington:IEEE Computer Society (DASC) . 2018 : 1001 - 1007 .

KARAGIANNIS T , PAPAGIANNAKI K , FALOUTSOS M . BLINK:multilevel traffic classification in the dark [C ] // SIGCOMM' 05 . 2005 : 229 - 239 .

GIL G D , LASHKARI A H , MAMUN M , et al . Characterization of encrypted and VPN trafc using time-related features [C ] // 2nd International Conference on Information Systems Security and Privacy (ICISSP 2016) . 2016 : 19 - 21 .

WANG W , ZENG X , YE X , et al . Malware traffic classification using convolutional neural network for representation learning [C ] // The 31st International Conference on Information Networking(ICOIN) . 2017 : 712 - 717 .

LOTFOLLAHI M , et al . Deep packet:a novel approach for encrypted traffic classification using deep learning [J ] . arXiv:1709.02656 , 2017

YUAN X , LI C , LI X , . Deepdefense:identifying DDoS attack via deep learning [C ] // 2017 IEEE International Conference Smart Computing (SMARTCOMP) . 2017 : 1 - 8 .

NYCHIS G , SEKAR V , ANDERSEN D , et al . An empirical evaluation of entropy-based traffic anomaly detection [J ] . The 8th ACM Computing Surveys , 2007 , 39 ( 1 ): 1 - 42 .

KOCH R , GOLLING M , RODOSEK G D . Behavior based intrusion detection in encrypted environments [J ] . Communications Magazine , 2014 , 52 ( 7 ): 124 - 131 .

IVAN T , LUIS D C , ALEJANDRO C B . Hunting malicious TLS certificates with deep neural networks [C ] // The 11th ACM Workshop on Articial Intelligence and Security . 2018 : 64 - 73 .

FRANTISEK S , SEBASTIAN G . Machine learning for network HTTPS analysis [C ] // BRUCON Conference . 2017 :5.

GHARIB A , SHARAFALDIN I , HABIBI L A , et al . An evaluation framework for intrusion detection dataset [C ] // 2016 International Conference on Information Science and Security (ICISS) . 2016 : 1 - 6 .

GUYON I , ELISSEEFF A . An introduction to variable and feature selection [J ] . Mach Learn Res , 2003 ( 3 ): 1157 - 1182 .

FERREIRA D C , VAZQUEZ F I , VORMAYR G , et al . A meta-analysis approach for feature selection in network traffic research [C ] // Reproducibility Workshop (Reproducibility’17) . 2017 : 17 - 20 .

PAN W B , CHENG G , GUO X J , et al . Review and perspective on encrypted traffic identification research [J ] . Journal on Communications , 2016 , 37 ( 9 ): 154 - 167 .

PATEL S , SONDHI J . A review of intrusion detection techniqueusing various technique of machine learning and feature optimization technique [J ] . International Journal of Computer Applications , 2014 , 93 ( 14 ): 43 - 47 .

MEGHDOURI F , ZSEBY T , IGLESIAS F . Analysis of lightweight feature vectors for attack detection in network traffic [J ] . Applied Sciences , 2018 , 8 ( 11 ):219.

PRASSE P , MACHLICA L , PEVNY T , et al . Malware detection by analysing encrypted network traffic with neural networks [C ] // European Conference on Machine Learning and Knowledge Discovery in Databases . 2017 : 73 - 88 .

TORROLEDO I , CAMACHO L D , BAHNSEN A C . Hunting malicious TLS certificates with deep neural networks [C ] // 11th ACM Workshop Artif.Intell.Secur . 2018 : 64 - 73 .

LOTFOLLAHI M , ZADE R S H , SIAVOSHANI M J , et al . Deep packet:a novel approach for encrypted traffic classification using deep learning [J ] . eprint arXiv:1709.02656 , 2017 .

PASCANU R , STOKES J W , SANOSSIAN H , et al . Malware classification with recurrent networks [C ] // 40th Int Conf on Acoustics,Speech and Signal Processing . 2015 : 1916 - 1920 .

ZENG Y , GU H , WEI W , et al . Deep-full-range:a deep learning based network encrypted traffic classification and intrusion detection framework [J ] . IEEE Access , 2019 :1.

REZAEI S , LIU X . How to achieve high classification accuracy with just a few labels:a semi-supervised approach using sampled packets [J ] . arXiv preprint arXiv:1812.09761 , 2018

ERMAN J , MAHANTI A , ARLITT M . Byte me:a case for byte accuracy in traffic classification [C ] // 3rd Annual ACM Workshop on Mining Network Data(MineNet ’07) . 2007 : 35 - 38 .

HE Y . Research on confrontational learning for industrial controlsystem intrusion detection [D ] . Zhejiang:Zhejiang University , 2019 .

浏览量

2873

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于卷积神经网络的加密流量分类方法

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于分层结构的多任务对抗样本归因方法