网络应用流类别不平衡环境下的SSL加密应用流识别关键技术

doi:10.11959/j.issn.1000-0801.2015355

Abstract

Abstract:

Through a in-depth study about the reason of network class imbalance, a method called SMOTE was chosen over the data set sampling preprocess, making full use of the advantages which is high accuracy of traffic model feature matching identification and sorting out the encrypted SSL flow, and then using the clustering method and the SVM based on mutual information classification method to further identify SSL encryption specific application, like HTTPS/POPS etc. The hybrid method effectively combines the advantages of static feature matching and machine learning methods,to achieve the balance of classification method on accuracy and speed.

Key words: traffic identification, traffic analysis, behavior characterization, behavior modeling, behavior pattern

Xuejiao Chen,Pan Wang,Shidong3 Liu. Key Technology of SSL Encrypted Application Identification Under Imbalance of Application Class[J]. Telecommunications Science, 2015, 31(12): 83-89.

Figures/Tables 4

References 19

1	Bai Y B , Kobayashi H . Intrusion detection systems: technology and development. Proceedings of the 17th International Conference on Advanced Information Networking and Applications, Xi'an, China, 2003:27～29
2	Wright C , Monrose F , Masson G M . HMM profiles for network traffic classification. Proceedings of the ACM DMSEC, Washington DC, USA, 2004:9～15
3	Haffner P , Sen S , Spatscheck O , et al. ACAS: automated construction of application signatures. Proceedings of the ACM SIGCOMM, Philadelphia, USA, 2005:197～202
4	Moore A W , Zuev D . Internet traffic classification using Bayesian analysis techniques. Proceedings of the ACM SIGMETRICS, Banff, Alberta, Canada, 2005:50～60
5	Moore A , Papagiannaki K . Toward the accurate identification of network applications. Proceedings of the Passive＆Active Measurement Workshop, Boston, USA, 2005
6	Williams N , Zander S , Armitage G . A prelimenary performance comparison of five machine learning algorithms for practical IP traffic flow comparison. ACM SIGCOMM Computer Communication Review, 2006,36（5）:5～16
7	Zhang Y , Paxso V . Detecting back doors. Proceedings of the 9th USENIX Security Symposium, Denver, USA, 2000:157～170
8	Dreger H , Feldmann A , Mai M , et al. Dynamic application layer protocol analysis for network intrusion detection. Proceedings of the 15th USENIX Security Symposium, Vancouver, Canada, 2006:257～272
9	Early J , Brodley C , Rosenberg C . Behavioral authentication of server flows. Proceedings of the 19th Annual Computer Security Applications Conference, Las Vegas, USA, 2003:46～55
10	Karagiannis T , Papagiannaki K , Faloutsos M . BLINC:multilevel traffic classification in the dark. Proceedings of Applications, Technologies, Architectures, and Protocols for Computer Communications, Philadelphia, USA, 2005:229～240
12	Wright C V , Monrose F , Masson G M , et al. On inferring application protocol behaviors in encrypted network traffic. Journal of Machine Learning Research, 2006（7）:2745～2769
	Bernaille L , Teixeira R . Early recognition of encrypted applications. Proceedings of Passive and Active Measurement Conference（PAM）, Louvainla-neuve, Belgium, 2007
13	Alshammari R , Nur Z H A . A flow based approach for SSH traffic Detection. Proceedings of IEEE International Conference on Systems, Man and Cybernetics, Montreal, Canada, 2007,296～301
4	赵博，郭虹，刘勤让等. 基于加权累积和检验的加密流量盲识别算法. 软件学报 2013,24（6）:1334～1345 Zhao B , Guo H , Liu Q R , et al. Protocol independent identification of encrypted traffic based on weighted cumulative sum test.. Journal of Software, 2013,24（6）:1334～1345
15	何高峰，杨明，罗军舟等. Tor 匿名通信流量在线识别方法. 软件学报 2013,24（3）:540～556 He G F , Yang M , Luo J Z , et al. Online dentification of Tor anonymous communication traffic. Journal of Software, 2013,24（3）:540～556
16	王炜，程东年，马海龙 . 基于趋势感知协议指纹的Skype 加密流量识别算法. 计算机应用研究 2014（8）:64～71 Wang W , Cheng D N , Ma H L . Skype encrypted traffic identification based on trend-aware procotol fingerprints. Application Research of Computers, 2014（8）:64～71
17	王炜，程东年 . 基于M-序列检验的加密流量识别. 计算机工程与设计 2014,35（11）:3712～3716 Wang W , Cheng D N . M-serial test based encrypted traffic identification. Computer Engineerin and Design, 2014,35（11）:3712～3716
18	张宏莉，鲁刚 . 分类不平衡协议流的机器学习算法评估与比较. 软件学报 2102,23（6）:1500～1516 Zhang H L , Lu G . Machine learning algorithms classifying the imbalanced protocol flows: evaluation and comparison. ournal of Software, 2102,23（6）:1500～1516
19	Chawla N V , Bowyer K W Hall L O , et al, SMOTE: synthetic minority over-sampling technique. Journal of Artificial Intelligence Research, 2002,16（1）:321～357

Metrics

Recommended 0

No Suggested Reading articles found!

[1]	Xuerong WANG, Zhengzhi TANG, Yinchuan LI, Meiyu QI, Jianbo ZHU, Liang ZHANG. Delay-sensitive traffic intellisense scheduling based on optimal decision tree [J]. Telecommunications Science, 2023, 39(4): 120-132.
[2]	Ming XU,Xue YANG,Jianwu ZHANG. A review of network traffic analysis targeting mobile devices [J]. Telecommunications Science, 2018, 34(4): 98-108.
[3]	Feng HUANG,Yao WANG,Li HUANG,Jiming YAO,Shidong LIU. Traffic identification of network business based on multi-layer cascade algorithm [J]. Telecommunications Science, 2015, 31(Z1): 249-253.
[4]	Yaguan Qian,Min Zhang. P2P Traffic Identification Based Over-Sampling Technique [J]. Telecommunications Science, 2014, 30(4): 109-113.
[5]	Shengyong Ding,Shiwu Min,Yongbing Fan. A Large Scale NetFlow Analysis System Based on Spark [J]. Telecommunications Science, 2014, 30(10): 48-51.
[6]	Jie Yin,Jingjing Bao,Wenjun Shen,Zhiting Peng. Research on Implementation Methods of Wired Access Service Resource Allocation Rules and Technologies [J]. Telecommunications Science, 2014, 30(10): 143-150.
[7]	Ou Liang,Chen Xun,Shen Chen,Huang Xiaoying and Lv Yi. Studies on Traffics Analysis and Prediction Technology for Carrier-Grade IP Network [J]. Telecommunications Science, 2013, 29(7): 24-29.
[8]	Hong Tang. A Large Scale Network Traffic Analysis System Design Based on the MapReduce Platform [J]. Telecommunications Science, 2013, 29(12): 155-157.
[9]	Shun Wu,Dan Su,Jia Wu,Kun Li,Dawei Xu,Yun Liu,Zheng Wei. Fine-Grained Network Traffic Identification Based on Tilera Platform [J]. Telecommunications Science, 2013, 29(11): 94-98.
[10]	Qiong Liu,Shiyin Li,Mengyun Liu,Xiujuan Wang. Study on P2P Streaming Media Network TV’s Communication Mechanisms [J]. Telecommunications Science, 2009, 25(6): 61-63.
[11]	Guoliang Yang. Analysis of International VoIP Traffic Characterization [J]. Telecommunications Science, 2007, 23(6): 7-15.

Key Technology of SSL Encrypted Application Identification Under Imbalance of Application Class

RichHTML

PDF下载

Knowledge

Cited

Abstract

Cite this article

share this article

Figures/Tables 4

References 19

Related Articles 11

Metrics

Recommended 0