基于支持向量机的加密流量识别方法

发布时间：2018-02-27 04:30

本文关键词： 加密流量识别相对熵蒙特卡洛仿真支持向量机　出处：《东南大学学报(自然科学版)》2017年04期 　论文类型：期刊论文

【摘要】：针对现有的加密流量识别方法难以区分加密流量和非加密压缩文件流量的问题,对互联网中的加密流量、txt流量、doc流量、jpg流量和压缩文件流量进行分析,发现基于信息熵的方法能够有效地将低熵值数据流和高熵值数据流区分开.但该方法不能识别每个字节是随机的而全部流量是伪随机的非加密压缩文件流量,因此采用相对熵特征向量{h_0,h_1,h_2,h_3}区分低熵值数据流和高熵值数据流,采用蒙特卡洛仿真方法估计π值的误差p_(error)来区分局部随机流量和整体随机流量.最终提出基于支持向量机的加密流量和非加密流量的识别方法 SVM-ID,并将特征子空间鐖SVM={h_0,h_1,h_2,h_3,p_(error)}作为SVM-ID方法的输入.将SVM-ID方法和相对熵方法进行对比实验,结果表明,所提方法不仅能够很好地识别加密流量,还能区分加密流量和非加密的压缩文件流量.
[Abstract]:In view of the problem that it is difficult to distinguish the encrypted traffic from the non-encrypted compressed file traffic by the existing encryption traffic identification methods, this paper analyzes the encrypted traffic and the compressed file traffic in the Internet, such as the encrypted traffic, the txt flow, the doc flow, the jpg traffic, and the compressed file traffic. It is found that the method based on information entropy can effectively distinguish low entropy data stream from high entropy data stream, but this method can not recognize that every byte is random and all traffic is pseudorandom unencrypted compressed file traffic. Therefore, the low entropy data stream and the high entropy value data stream are distinguished by using the relative entropy eigenvector {hash0h1hhhhs2hh3}. Monte Carlo simulation method is used to estimate the error of 蟺 value to distinguish local random traffic from global random flow. Finally, SVM-ID-based recognition method of encrypted and non-encrypted traffic based on support vector machine is proposed, and the feature subspace is subspace. As an input to the SVM-ID method, the SVM-ID method is compared with the relative entropy method. The results show that the proposed method can not only identify the encrypted traffic, but also distinguish the encrypted traffic from the non-encrypted compressed file traffic.
【作者单位】：东南大学计算机科学与工程学院;东南大学教育部计算机网络与信息集成重点实验室;
【基金】：国家高技术研究发展计划(863计划)资助项目(2015AA015603) 国家自然科学基金资助项目(61602114) 中兴通讯研究基金资助项目软件新技术与产业化协同创新中心资助项目
【分类号】：TP18;TP393.06

【相似文献】