基于M-序列检验的加密流量识别

M-serial test based encrypted traffic identification

为更好地进行网络管理和网络安全维护,通过研究加密流量的内容统计特征,提出基于M-序列检验的网络数据随机性评估算法(network data randomness estimation,NDRE)以识别加密流量。采用M-序列检验方法对序列随机性进行量化;根据负载序列长度,自适应训练得到最优化参数集;利用最小风险贝叶斯准则,对加密流量进行识别。实验结果表明,与基于熵的方法相比,在控制一定计算复杂度的情况下,NDRE精确度有较大提高。

To manage the network and maintain the network security, the study on identifying the network encrypted traffic was carried out and the M-serial test based network data randomness estimation algorithm （NDRE） was proposed by studying the content statistical characteristics. The M-serial test method was used to quantify the randomness of the sequence. The most optimized set of parameters was self-adaptively trained and obtained depending on the length of the payload sequence. The minimum risk Bayes was utilized to identify the encrypted traffic. Experimental results show that compared with the entropy-based me- thod, the precision of the NDRE is better when the computational complexity was controlled within a certain reasonable range.