电信科学 ›› 2015, Vol. 31 ›› Issue (12): 83-89.doi: 10.11959/j.issn.1000-0801.2015355

• 研究与开发 • 上一篇    下一篇

网络应用流类别不平衡环境下的SSL加密应用流识别关键技术

陈雪娇1,王攀2,刘世栋3   

  1. 1 南京信息职业技术学院 南京210023
    2 南京邮电大学 南京210003
    3 国网智能电网研究院 南京210003
  • 出版日期:2015-12-20 发布日期:2017-03-27
  • 基金资助:
    2013 江苏省六大人才高峰计划项目;2013 国家发展和改革委员会信息安全专项资助项目;国家电网公司2014 年科技项目“电力信息通信网络流量预测和管道智能化关键技术研究及应用”;2015 江苏省产学研前瞻性联合研究项目

Key Technology of SSL Encrypted Application Identification Under Imbalance of Application Class

Xuejiao Chen1,Pan Wang2,Shidong3 Liu3   

  1. 1 Nanjing College of Information Technology, Nanjing 210023, China
    2 Nanjing University of Posts and Telecommunications, Nanjing 210003
    3 State Grid Smart Grid Research Institute, Nanjing 210003, China
  • Online:2015-12-20 Published:2017-03-27
  • Supported by:
    2013 Six Talent Peaks Project in Jiangsu Province;2013 Information Security Special Funds of the National Developmen and Reform Commission;State Grid 2014 Science and Technology Project “ Research and Application of Network Traffic Prediction and Smart Pipe Key Technologies for Electric Power Information Communication Network”;2015 Industrialization， Education and Research Joint Prospective Project

在线阅读

3

PDF下载

602

被引次数

4

摘要：

通过深入研究网络类别不平衡的原因，选择SMOTE（synthetic minority over-sampling technique）过抽样方法对数据集进行预处理，并充分利用特征匹配高准确性的优点识别和分拣出SSL 加密流，进而利用基于互信息最大化的聚类方法和SVM分类方法进一步识别SSL加密应用，这种混合方法有效地结合了静态特征匹配和机器学习方法的优点，达到识别分类方法在准确性和识别速度的均衡。

关键词: 流量识别, ；流量分析, 行为特征, 行为建模, 行为模型

Abstract:

Through a in-depth study about the reason of network class imbalance, a method called SMOTE was chosen over the data set sampling preprocess, making full use of the advantages which is high accuracy of traffic model feature matching identification and sorting out the encrypted SSL flow, and then using the clustering method and the SVM based on mutual information classification method to further identify SSL encryption specific application, like HTTPS/POPS etc. The hybrid method effectively combines the advantages of static feature matching and machine learning methods,to achieve the balance of classification method on accuracy and speed.

Key words: traffic identification, traffic analysis, behavior characterization, behavior modeling, behavior pattern

No Suggested Reading articles found!