网络应用层加密流量识别技术研究

发布时间：2018-02-15 08:24

本文关键词： 网络应用加密流量识别随机性特征提取趋势感知　出处：《解放军信息工程大学》2014年硕士论文　论文类型：学位论文

【摘要】：当前网络加密流量比例不断提高,而木马、社交应用等多以加密流量形式在网络中传播,给网络安全和网络管理带来了严峻挑战。因此有效识别网络应用层加密流量是识别恶意流量,实现网络管控的前提。现有网络应用层加密流量的识别方法主要存在以下三个问题：(1)网络中加密流量的比例相对明文流量很小,使得多数基于统计思想的加密流量识别方法易受到明文流量的干扰而导致识别精确度较低。(2)基于应用特征自动提取的识别方法时间复杂度较高。(3)基于传输层流级统计特征的经典协议指纹识别方法精确度较低。针对上述问题,本文依托国家863计划项目“面向三网融合的统一安全管控网络”的相关课题,对现有上述存在的技术问题进行了深入的分析和研究,提出了基于串行检验的网络加密流量识别算法ETI-ST,粗粒度识别网络协议不相关加密流量；然后针对不同应用场景识别方法的缺陷,分别提出基于ECLAT树结构的特征自动提取算法FEA-ET和基于指纹趋势感知的Skype协议识别算法ISP-FT,达到细粒度识别网络应用层加密流量的目的。论文所提方法都通过仿真实验进行了对比分析,验证了算法的有效性。具体研究工作如下：1.提出了基于串行检验的网络加密流量识别算法。针对多数基于统计思想的应用层加密流量识别方法易受到明文流量干扰的问题,根据网络加密流量的随机性特征,提出了基于串行检验的网络加密流量识别算法ETI-ST,该算法利用网络数据间的相关性对随机性评估的影响,采用串行检验方法对序列随机性进行量化。仿真实验表明：与现有基于熵的方法相比,ETI-ST的精确度可达到82.3%,提高了约15%。2.提出了基于ECLAT树结构的应用特征自动提取算法。针对现有应用特征自动提取方法时间复杂度高的问题,提出了基于ECLAT树结构的应用特征自动提取算法FEA-ET,并应用DPI技术来识别网络应用层加密流量。FEA-ET算法仅扫描一次待测网络加密流量集得到各位置频繁字节的支持度；构建ECLAT树结构,自动化挖掘不同数据报文的频繁字节串集。仿真实验表明：与经典的APRIORI算法相比,该算法减少了I/O负载,在特定参数下,时间复杂度平均降低了20%,提高了挖掘效率。3.提出了基于指纹趋势感知的Skype协议识别算法。针对基于传输层流级统计特征的经典协议指纹识别方法精确度较低的问题,本文通过研究私有加密协议Skype通联初期稳定的流级统计特征变化趋势,定义了趋势感知加权函数,提出了一种基于指纹趋势感知的Skype协议识别算法ISP-FT。仿真实验表明：与经典的协议指纹算法和C4.5算法相比,ISP-FT算法在召回率相差0.1%的前提下,精确度至少提高4%,准确率至少提高3.3%,且仅处理前6个数据包即可识别Skype协议,在一定程度上满足了实时性要求。
[Abstract]:At present, the proportion of network encrypted traffic is increasing, while Trojan horses, social applications, etc., spread in the network in the form of encrypted traffic. It brings a severe challenge to network security and network management. Therefore, to effectively identify network application layer encrypted traffic is to identify malicious traffic. The existing network application layer encryption traffic identification methods mainly have the following three problems: 1) the proportion of encrypted traffic in the network is very small compared with the plaintext flow. It makes most of the encrypted traffic recognition methods based on statistical thought easy to be interfered by plaintext traffic, which leads to low recognition accuracy.) the recognition method based on automatic extraction of application features has higher time complexity. 3) based on transport laminar flow level. The precision of the classical protocol fingerprint recognition method based on statistical features is low. Based on the national 863 project "the unified security management and control network for the three networks", this paper makes a deep analysis and research on the existing technical problems mentioned above. A network encryption traffic identification algorithm ETI-STbased on serial test is proposed, in which coarse-grained network protocol is used to identify the irrelevant encrypted traffic, and then the defects of different application scenarios are analyzed. An automatic feature extraction algorithm (FEA-ET) based on ECLAT tree structure and an ISP-FT-based Skype protocol recognition algorithm based on fingerprint trend perception are proposed, respectively, to achieve the purpose of fine-grained network application layer encryption. A comparative analysis was carried out. The effectiveness of the algorithm is verified. The specific research work is as follows: 1. A network encryption traffic identification algorithm based on serial test is proposed. In view of the problem that most of the application layer traffic identification methods based on statistics are susceptible to the interference of plaintext traffic, According to the randomness characteristics of network encrypted traffic, a network encryption traffic identification algorithm ETI-ST-based on serial test is proposed. The algorithm uses the correlation between network data to influence the randomness evaluation. The method of serial test is used to quantify the randomness of sequences. The simulation results show that the accuracy of ETI-ST can reach 82.3 compared with the existing methods based on entropy, and the accuracy of ETI-ST can be improved by about 15.2. The automatic feature extraction algorithm based on ECLAT tree structure is proposed. To solve the problem of high time complexity of existing automatic feature extraction methods, This paper presents an application feature extraction algorithm based on ECLAT tree structure, FEA-ET. and uses DPI technology to identify the network application layer encryption traffic. FEA-ET algorithm only scans the network encryption traffic set to be tested once to get the support of frequent bytes in each position, and constructs the ECLAT tree structure. The simulation results show that compared with the classical APRIORI algorithm, the algorithm reduces the I / O load, and under the specific parameters, the proposed algorithm can be used to automatically mine the frequent byte strings of different data packets. The average time complexity is reduced by 20%, and the mining efficiency is improved. (3) an Skype protocol recognition algorithm based on fingerprint trend perception is proposed, aiming at the problem of low accuracy of the classical protocol fingerprint recognition method based on the statistical features of transport laminar flow. In this paper, the trend of steady flow level statistical characteristics in the initial stage of private encryption protocol Skype connection is studied, and the trend perception weighting function is defined. An Skype protocol recognition algorithm based on fingerprint trend perception is proposed. The simulation results show that ISP-FT algorithm is 0.1% different from the classical fingerprint algorithm and C4.5 algorithm. The accuracy is improved by at least 4 and the accuracy is improved by at least 3.3, and the Skype protocol can be recognized by only processing the first 6 packets, which meets the requirement of real-time to some extent.
【学位授予单位】：解放军信息工程大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】