基于分段熵分布的VPN加密流量检测与识别方法

Detection and recognition of VPN encrypted traffic based on segmented entropy distribution

为加强对VPN加密流量的有效监管,提高网络监管的效率效果,针对VPN加密流量报文信息缺失,流量特征混淆的特点,文章提出了一种基于分段熵分布的VPN加密流量检测与识别方法。该方法利用滑动窗口方法对VPN加密报文序列高熵、低熵区域进行划分,并以此作为流量特征,使用胶囊神经网络模型实现VPN加密流量的精准检测与识别。不同于现有的基于机器学习的加密流量检测方法,该方法针对VPN加密流量本身特性进行研究,具有方法的普适性。实验与对比分析证明,该方法识别准确率达99.87%,可以用于VPN加密流量检测识别。

In order to strengthen the effective supervision of VPN encrypted traffic and improve the efficiency of network supervision,the article proposes a method for detecting and identifying VPN encrypted traffic based on segmented entropy distribution in view of the lack of information in VPN encrypted traffic messages and the confusion of traffic characteristics.This method uses the sliding window method to divide the high-entropy and low-entropy regions of the VPN encrypted message sequence,which are taken as traffic characteristics.Then,this method uses the capsule neural network model to achieve accurate detection and identification of VPN encrypted traffic.Different from the existing encrypted traffic detection method based on machine learning,this method studies the characteristics of VPN encrypted traffic itself and has the universality of the method.Experiments and comparative analysis prove that the accuracy of this method is 99.87%.It can be used for VPN encrypted traffic detection and identification.