隐私保护的加密流量检测研究

Study on privacy preserving encrypted traffic detection

现有的加密流量检测技术缺少对数据和模型的隐私性保护,不仅违反了隐私保护法律法规,而且会导致严重的敏感信息泄露。主要研究了基于梯度提升决策树(GBDT)算法的加密流量检测模型,结合差分隐私技术,设计并实现了一个隐私保护的加密流量检测系统。在CICIDS2017数据集下检测了DDoS攻击和端口扫描的恶意流量,并对系统性能进行测试。实验结果表明,当隐私预算ε取值为1时,两个数据集下流量识别准确率分别为91.7%和92.4%,并且模型的训练效率、预测效率较高,训练时间为5.16 s和5.59 s,仅是GBDT算法的2~3倍,预测时间与GBDT算法的预测时间相近,达到了系统安全性和可用性的平衡。

Existing encrypted traffic detection technologies lack privacy protection for data and models,which will violate the privacy preserving regulations and increase the security risk of privacy leakage.A privacy-preserving encrypted traffic detection system was proposed.It promoted the privacy of the encrypted traffic detection model by combining the gradient boosting decision tree(GBDT)algorithm with differential privacy.The privacy-protected encrypted traffic detection system was designed and implemented.The performance and the efficiency of proposed system using the CICIDS2017 dataset were evaluated,which contained the malicious traffic of the DDoS attack and the port scan.The results show that when the privacy budget value is set to 1,the system accuracy rates are 91.7%and 92.4%respectively.The training and the prediction of our model is efficient.The training time of proposed model is 5.16 s and 5.59 s,that is only 2-3 times of GBDT algorithm.The prediction time is close to the GBDT algorithm.