基于多任务特征学习的网络加密流量识别算法-《计算机技术与发展》

文章信息/Info

Title:: Network Encrypted Traffic Identification Based onMulti-task Feature Learning

作者:: 孟娟¹ ; 孟鹏² ; 缪志敏³ ; 李晨溪¹ ; 钱明远¹; 1. 解放军 31108 部队,江苏南京 210016;
2. 湖北科技学院,湖北咸宁 437000;
3. 解放军陆军工程大学,江苏南京 210007

Author(s):: MENG Juan¹ ; MENG Peng² ; MIAO Zhi-min³ ; LI Chen-xi¹ ; QIAN Ming-yuan¹; 1. PLA 31108,Nanjing 210016,China;
2. Hubei University of Science and Technology,Xianning 437000,China;
3. Army Engineering University of PLA,Nanjing 210007,China

Keywords:: encrypted traffic identification; randomness; NIST test; feature selection; multi-task feature learning

摘要:: 加密数据流难以从其数据内容进行监管,但却是非法数据、敏感信息监管的重要对象。目前对加密数据流识别的研究大多依据特定的加密传输协议,主要通过端口匹配识别、深度包检测、深入流检测等来进行识别,这些方法实施的前提是加密协议已知,并未给出一种通用的加密数据流识别方法。对当前加密数据流识别技术进行了分析,分析加密数据流外在数据形式中所蕴含的内在属性信息,遵循“随机性特征—盲识别” 的研究思路,研究一种通用的网络加密流量识别方法,利用加密流量的随机性特征,提出基于多任务特征学习的网络加密流量识别算法。该算法利用 l_2,1 正则化项对一组相关任务进行联合特征学习。实验结果表明:该算法可有效识别网络加密流量,识别精度可达到 80% 以上。

Abstract:: It’s difficult to regulate the encrypted traffic from the content, but it is an important target to regulate the illegal data and sensitive information. Current researches on the encrypted traffic identification are more for specific encryption protocol,mainly through port information, load characteristics and flow characteristics. The implementation premise of these methods is that the encryption protocol is known. There is not a general method for the encrypted traffic identification. The technology of encrypted traffic identification is analyzed, followed the "randomness feature-protocol independent identification" research idea by analyzing the encrypted traffic inherent attribute information,and a general method of encrypted traffic identification is studied. Utilizing the randomness characteristics,a multi-task feature learning formulation is proposed to identify encrypted traffic,which captures the intrinsic relatedness among different tasks by a l_2,1-norm regularized multi-task feature learning model. Experiment shows that the identification accuracy of the proposed algorithm can get above 80% for encrypted traffic identification.