基于层次时空特征与多头注意力的恶意加密流量识别

doi:10.19678/j.issn.1000-3428.0058517

计算机工程 ›› 2021, Vol. 47 ›› Issue (7): 101-108. doi: 10.19678/j.issn.1000-3428.0058517

基于层次时空特征与多头注意力的恶意加密流量识别

蒋彤彤¹, 尹魏昕², 蔡冰³, 张琨¹

1. 南京理工大学计算机科学与工程学院, 南京 210094;
2. 国家计算机网络与信息安全管理中心江苏分中心网络安全处, 南京 210019;
3. 国家计算机网络与信息安全管理中心江苏分中心技术保障处, 南京 210019

收稿日期:2020-06-02 修回日期:2020-07-03 发布日期:2020-07-10
作者简介:蒋彤彤(1996-),女,硕士研究生,主研方向为网络安全、深度学习;尹魏昕、蔡冰,高级工程师;张琨,教授、博士、博士生导师。
基金资助:
江苏省研究生科研与实践创新计划（SJCX18_0149）；南京理工大学自主科研专项（1181060420）；南京理工大学横向课题（1191061083）。

Encrypted Malicious Traffic Identification Based on Hierarchical Spatiotemporal Feature and Multi-Head Attention

JIANG Tongtong¹, YIN Weixin², CAI Bing³, ZHANG Kun¹

1. School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China;
2. Department of Network Security, Jiangsu Branch of National Computer Network and Information Security Management Center, Nanjing 210019, China;
3. Department of Technical Support, Jiangsu Branch of National Computer Network and Information Security Management Center, Nanjing 210019, China

Received:2020-06-02 Revised:2020-07-03 Published:2020-07-10

摘要/Abstract

摘要： 为实现互联网全面加密环境下的恶意加密流量精确检测，针对传统识别方法较依赖专家经验且对加密流量特征的区分能力不强等问题，提出一种基于层次时空特征与多头注意力（HST-MHSA）模型的端到端恶意加密流量识别方法。基于流量层次结构，结合长短时记忆网络和TextCNN有效整合加密流量的多尺度局部特征和双层全局特征，并引入多头注意力机制进一步增强关键特征的区分度。在公开数据集CICAndMal2017上的实验结果表明，HST-MHSA模型的流量识别F1值相较基准模型最高提升了16.77个百分点，漏报率比HAST-Ⅱ和HABBiLSTM模型分别降低了3.19和2.18个百分点，说明其对恶意加密流量具有更强的表征和识别能力。

关键词: 加密流量识别, 多头注意力机制, 恶意流量识别, 卷积神经网络, 长短时记忆网络

Abstract: To implement the full encryption of Internet,the accurate detection of encrypted malicious traffic is required,but traditional detection methods rely heavily on expert experience and perform poorly in distiguishment of encrypted traffic feature is not strong the representation of encrypted traffic.To address the problem,an end-to-end malicious encrypted traffic identification method based on Hierarchical Spatiotemporal feature and Multi-Head Self-Attention(HST-MHSA) model is proposed.By utilizing the hierarchical structure of traffic,the advantages of LSTM and TextCNN to integrate the multi-scale local features and two-layer global features of encrypted traffic are combined.In addition,the multi-head attention mechanism is introduced to further enhance the discrimination of the key features.Experimental results on the public dataset CICAndMal2017 show that the F1 value of HST-MHSA model is at most 16.77 percentage points higher than that of the benchmark model,and its Missed Alarm Rate(MAR) is 3.19 and 2.18 percentage points lower than that of the hierarchical model HAST-Ⅱ and HABBiLSTM model respectively,displaying its stronger ability to represent and identify encrypted malicious traffic.

Key words: encrypted traffic identification, multi-head attention mechanism, malicious traffic identification, Convolutional Neural Network(CNN), Long Short-Term Memory(LSTM) network

中图分类号:

TP393.08

蒋彤彤, 尹魏昕, 蔡冰, 张琨. 基于层次时空特征与多头注意力的恶意加密流量识别[J]. 计算机工程, 2021, 47(7): 101-108.

JIANG Tongtong, YIN Weixin, CAI Bing, ZHANG Kun. Encrypted Malicious Traffic Identification Based on Hierarchical Spatiotemporal Feature and Multi-Head Attention[J]. Computer Engineering, 2021, 47(7): 101-108.

https://www.ecice06.com/CN/Y2021/V47/I7/101

图/表 11

20210721090235

20210721090239

20210721090242

20210721090245

20210721090249

20210721090252

20210721090255

20210721090259

20210721090303

20210721090306

20210721090309

参考文献

[1] Cisco.Encrypted traffic analytics white paper[EB/OL].[2020-05-07].https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/nb-09-encrytd-traf-anlytcs-wp-cte-en.pdf.
[2] 王健.基于HTTP的僵尸网络C&C流量检测方法研究[D].成都:电子科技大学,2019. WANG J.Research on HTTP botnet C&C Traffic Detection Method[D].Chengdu:University of Electronic Science and Technology,2019.(in Chinese)
[3] Gartner.Encrypted Web traffic[EB/OL].[2020-05-07].https://www.gartner.com/en/documents/3869861.
[4] REZAEI S,LIU X.Deep learning for encrypted traffic classification:an overview[J].IEEE Communications Magazine,2019,57(5):76-81.
[5] ANDERSON B,PAUL S,MCGREW D.Deciphering malware's use of TLS(without decryption)[J].Journal of Computer Virology and Hacking Techniques,2018,14(3):195-211.
[6] LIU J,ZENG Y,SHI J,et al.MalDetect:a structure of encrypted malware traffic detection[J].CMC-Computers,Materials & Continua,2019,60(2):721-739.
[7] YU T D,ZOU F T,LI L S,et al.An encrypted malicious traffic detection system based on neural network[C]//Proceedings of 2019 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery.Washington D.C.,USA:IEEE Press,2019:62-70.
[8] BAZUHAIR W,LEE W.Detecting malign encrypted network traffic using Perlin noise and convolutional neural network[EB/OL].[2020-05-07].https://www.researchgate.net/publication/339903495_Detecting_Malign_Encrypted_Network_Traffic_Using_Perlin_Noise_and_Convolutional_Neural_Network.
[9] 胡斌,周志洪,姚立红,等.基于报文负载和流指纹联合特征的TLS恶意流量检测[J].计算机工程,2020,46(11):157-163. HU B,ZHOU Z H,YAO L H,et al.TLS malicious traffic detection based on combined features of packet payload and stream fingerprints[J].Computer Engineering,2020,46(11):157-163.(in Chinese)
[10] WANG W,ZHU M,ZENG X W,et al.Malware traffic classification using convolutional neural network for representation learning[C]//Proceedings of International Conference on Information Networking.Washington D.C.,USA:IEEE Press,2017:712-717.
[11] 王攀,陈雪娇.基于堆栈式自动编码器的加密流量识别方法[J].计算机工程,2018,44(11):140-147,153. WANG P,CHEN X J.SAE-based encrypted traffic identification method[J].Computer Engineering,2018,44(11):140-147,153.(in Chinese)
[12] CHENG H,XIE J X,CHEN L H.CNN-based encrypted C&C communication traffic identification method[J].Computer Engineering,2019,45(8):31-34,41.(in Chinese)程华,谢金鑫,陈立皇.基于CNN的加密C&C通信流量识别方法[J].计算机工程,2019,45(8):31-34,41.
[13] ILIYASU A S,DENG H.Semi-supervised encrypted traffic classification with deep convolutional generative adversarial networks[J].IEEE Access,2020,8:118-126.
[14] GUO L L,WU Q Q,LIU S L,et al.Deep learning-based real-time VPN encrypted traffic identification methods[J].Journal of Real-Time Image Processing,2020,17(1):103-114.
[15] VASWANI A,SHAZEER N,PARMAR N,et al.Attention is all you need[C]//Proceedings of the 31st International Conference on Neural Information Processing Systems.Berlin,Germany:Springer,2017:5998-6008.
[16] WANG W,SHENG Y Q,WANG J J,et al.HAST-IDS:learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[J].IEEE Access,2018,6:1792-1806.
[17] KIM Y.Convolutional neural networks for sentence classification[EB/OL].[2020-05-07].https://arxiv.org/abs/1408.5882.
[18] LASHKARI A H,KADIR A F A,TAHERI L,et al.Toward developing a systematic approach to generate benchmark android malware datasets and classification[C]//Proceedings of 2018 International Carnahan Conference on Security Technology.Washington D.C.,USA:IEEE Press,2018:1-8.
[19] WANG W,ZHU M,WANG J,et al.End-to-end encrypted traffic classification with one-dimensional convolution neural networks[C]//Proceedings of 2017 IEEE International Conference on Intelligence and Security Informatics.Washington D.C.,USA:IEEE Press,2017:22-27.
[20] 刘冲.基于深度学习的流量分类系统[D].北京:北京邮电大学,2019. LIU C.Traffic classification system based on deep learning[D].Beijing:Beijing University of Posts and Telecommunications,2019.(in Chinese)

选择文件类型/文献管理软件名称

选择包含的内容

基于层次时空特征与多头注意力的恶意加密流量识别

Encrypted Malicious Traffic Identification Based on Hierarchical Spatiotemporal Feature and Multi-Head Attention

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	王志浩, 钱沄涛. 基于Swin Transformer的双流遥感图像时空融合超分辨率重建[J]. 计算机工程, 2024, 50(9): 33-45.
[2]	李俊俊, 董建刚, 李坤. 基于Kubernetes的集群节能策略研究[J]. 计算机工程, 2024, 50(9): 82-91.
[3]	张鲁, 田春伟, 宋焕生, 刘侍刚. 用于低剂量CT图像去噪的多级双树复小波网络[J]. 计算机工程, 2024, 50(9): 266-275.
[4]	高煜宝, 文志诚. 基于注意力机制的双路解码器图像去噪方法[J]. 计算机工程, 2024, 50(9): 324-332.
[5]	王蕾, 党时鹏, 潘丰. 基于卷积神经网络的隐匿性旁路预测模型[J]. 计算机工程, 2024, 50(8): 40-49.
[6]	耿丽丽, 牛保宁. 基于通道相似度熵的卷积神经网络裁剪[J]. 计算机工程, 2024, 50(7): 133-143.
[7]	张洋, 刘畅, 李少青. 基于可控制性度量的图神经网络门级硬件木马检测方法[J]. 计算机工程, 2024, 50(7): 164-173.
[8]	牛瑞婷, 严天峰, 高锐, 王映植. 低信噪比下基于深度学习TCNN-MobileNet的调制识别[J]. 计算机工程, 2024, 50(7): 204-215.
[9]	张溢文, 蔡满春, 陈咏豪, 朱懿, 姚利峰. 融合空间特征的多尺度深度伪造检测方法[J]. 计算机工程, 2024, 50(7): 240-250.
[10]	逯焕宇, 张永宏, 马光义, 谢东林, 田伟. 基于半监督对抗学习的遥感图像水体提取[J]. 计算机工程, 2024, 50(7): 251-263.
[11]	于洋, 孙芳芳, 吕华, 李扬, 王晓民. 基于多尺度时空注意力网络的微表情检测方法[J]. 计算机工程, 2024, 50(6): 228-235.
[12]	代巍, 王丰羽, 冀常鹏. 基于情感增强与双图卷积网络的方面级情感分析[J]. 计算机工程, 2024, 50(5): 120-127.
[13]	张雷, 沈国琛, 欧冬秀. 用于热成像数据的卷积神经网络特征图筛选方法[J]. 计算机工程, 2024, 50(4): 31-40.
[14]	张雷, 沈国琛, 欧冬秀. 用于热成像数据的卷积神经网络特征图筛选方法[J]. 计算机工程, 2024, 50(4): 31-40.
[15]	李政学, 李枝名, 彭德中, 陈杰. 基于特征对比学习和图卷积的社交网络用户分类[J]. 计算机工程, 2024, 50(4): 258-266.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于层次时空特征与多头注意力的恶意加密流量识别

Encrypted Malicious Traffic Identification Based on Hierarchical Spatiotemporal Feature and Multi-Head Attention

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献

相关文章 15

编辑推荐

Metrics

本文评价