作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2025, Vol. 51 ›› Issue (12): 18-30. doi: 10.19678/j.issn.1000-3428.0252468

• 热点与综述 • 上一篇    下一篇

面向网络加密流量的增量式入侵检测关键技术研究综述

陈良臣1,2,3,4,*(), 傅德印1, 刘宝旭2, 高曙3, 张煦尧4   

  1. 1. 中国劳动关系学院计算机学院, 北京 100048
    2. 中国科学院信息工程研究所中国科学院网络测评技术重点实验室, 北京 100093
    3. 武汉理工大学计算机与人工智能学院, 湖北 武汉 430063
    4. 中国科学院自动化研究所多模态人工智能系统全国重点实验室, 北京 100049
  • 收稿日期:2025-05-21 修回日期:2025-08-13 出版日期:2025-12-15 发布日期:2025-12-16
  • 通讯作者: 陈良臣
  • 基金资助:
    中国劳动关系学院研究生教改项目(YJG2506); 国家重点研发计划(2023YFB2603800); 国家统计局全国统计科学研究项目(2022LY005); 中国科学院网络测评技术重点实验室课题(KFKT2022-003); 中国劳动关系学院科研项目(23XYJS016); 中国劳动关系学院教改项目(JG25016); 中国劳动关系学院教师学术团队项目(24JSTD016)

Review of Key Technologies of Incremental Intrusion Detection for Network Encrypted Traffic

CHEN Liangchen1,2,3,4,*(), FU Deyin1, LIU Baoxu2, GAO Shu3, ZHANG Xuyao4   

  1. 1. School of Computer, China University of Labor Relations, Beijing 100048, China
    2. Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
    3. School of Computer and Artificial Intelligence, Wuhan University of Technology, Wuhan 430063, Hubei, China
    4. State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, Beijing 100049, China
  • Received:2025-05-21 Revised:2025-08-13 Online:2025-12-15 Published:2025-12-16
  • Contact: CHEN Liangchen

摘要:

在网络空间安全威胁持续加剧的当下, 加密流量攻击的隐蔽性与零日漏洞利用的突发性, 致使传统入侵检测系统在动态网络环境中检测效能显著衰减。本文首先系统构建面向加密流量的增量式入侵检测技术分析框架, 从技术协同视角出发, 详细阐释各关键技术在增量式入侵检测中的协同逻辑与关联机制; 随后聚焦当前研究前沿, 分别从加密流量数据约简、加密恶意流量识别、未知加密恶意流量检测以及入侵检测模型的增量更新等4个关键技术领域展开深度研究和探索, 并对比分析各类方法的优缺点; 最后阐述面向加密流量的增量式入侵检测研究的未来发展趋势和面临的挑战。

关键词: 增量式入侵检测, 加密流量数据约简, 加密恶意流量识别, 未知加密恶意流量检测, 检测模型增量更新

Abstract:

As cyber threats continue to intensify, the concealment of encrypted traffic attacks and the suddenness of zero-day exploits have significantly reduced the detection efficiency of traditional intrusion detection systems. This review systematically constructs an incremental intrusion detection technology analysis framework for encrypted traffic and explains the synergy and correlation mechanisms of key technologies in incremental intrusion detection from a synergistic technology perspective. Focusing on current research frontiers, in-depth research and exploration are conducted in four key technical fields: encrypted traffic data reduction, encrypted malicious traffic identification, unknown encrypted malicious traffic detection, and incremental updates of intrusion detection models. The advantages and disadvantages of various methods are analyzed. Finally, future development trends and challenges are discussed.

Key words: incremental intrusion detection, encrypted traffic data reduction, encrypted malicious traffic identification, unknown encrypted malicious traffic detection, incremental update of detection models