基于隐马尔可夫模型的加密恶意流量检测

Encrypted Malicious Traffic Detection Based on Hidden Markov Model

近年来,随着网络加密技术的普及,使用网络加密技术的恶意攻击事件也在逐年增长,依赖于数据包内容的传统检测方法如今已经无法有效地应对隐藏在加密流量中的恶意软件攻击.为了能够应对不同协议下的加密恶意流量检测,提出了基于ProfileHMM的加密恶意流量检测算法.该方法利用生物信息学上的基因序列比对分析,通过匹配关键基因子序列,实现识别加密攻击流量的能力.通过使用开源数据集在不同条件下进行实验,结果表明了算法的有效性.此外,设计了两种规避检测的方法,通过实验验证了算法具有较好的抗规避检测的能力.与已有研究相比,该工作具有应用场景广泛以及检测准确率较高的特点,为基于加密流量的恶意软件检测研究领域提供了一种较为有效的解决方案.

In recent years,with the popularization of network encryption technology,malicious attacks using network encryption technology have increased year by year.Traditional detection methods that rely on the content of data packets are now unable to effectively deal with malware attacks hidden in encrypted traffic.In order to deal with the detection of encrypted malicious traffic under different protocols,this study proposes an encrypted malicious traffic detection algorithm based on profile HMM.This method uses the genetic sequence comparison analysis in bioinformatics to realize the identification of encrypted attack traffic by matching key gene sub-sequences.Open source datasets are used to conduct experiments under different conditions,the results demonstrate the effectiveness of the algorithm.In addition,two methods of evasion detection are designed,and experiments have also verified that the algorithm has a better performance to resist evasion detection.Compared with the existing research,the work of this study has a wide range of application scenarios and higher detection accuracy.It provides a more effective solution to the research field of malware detection based on encrypted traffic.