基于交互状态图的多粒度融合加密恶意流量检测
CSTR:
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

基金项目:

国家重点研发计划(2024YFC3308005)


Multi-granularity Fusion for Encrypted Malicious Traffic Detection Based on Interaction State Graph
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    加密技术的广泛应用给恶意活动提供了藏匿的机会, 对网络安全监测体系带来了巨大挑战. 现有的加密流量检测方法主要是在单个数据包级别提取统计流量特征, 因此可能会由于潜在的IP分片而破坏原始连续通信行为中隐含的特征. 此外, 大多数方法对于网络流的交互模式建模粒度较粗, 未能深入挖掘对等实体间的通信意图, 难以适应新型恶意软件通信行为和通信量的变化. 本文以交互为分析粒度, 提出了方法ISG-Net (interaction state graph-net), 该方法基于状态转换构建流量交互状态图, 并引入了融合流量时序信息的自注意力编码模型. 特别地, 本文通过交互状态图获取蕴含全局信息的交互状态表示, 然后对每次交互进行细粒度的特征提取, 以融合得到会话(双向流)的表示. 在3个数据集上的实验表明, 在加密恶意流量检测任务中, 本文方法在准确性、鲁棒性和容错性均优于现有算法.

    Abstract:

    The widespread adoption of encryption technology has given malicious activities a chance to hide, posing a great challenge to network security monitoring systems. Existing encrypted traffic detection methods primarily extract statistical traffic features at the individual packet level. However, this may disrupt the features implied in the original continuous communication behavior, due to potential IP fragmentation. Furthermore, most approaches model the interaction patterns between network flows at a relatively coarse granularity, failing to thoroughly explore the communication intent between peer entities. This study introduces a novel method, interaction state graph-net (ISG-Net), which uses interaction as the analysis granularity. ISG-Net constructs a traffic interaction state graph based on state transitions and applies a self-attentive encoder model to capture temporal traffic information. In particular, interaction state representations containing global information are obtained through the interaction state graph. Then, fine-grained features of each interaction are extracted to obtain the representation of the sessions (bidirectional flows). Experiments on three datasets demonstrate that the proposed method outperforms existing methods in terms of accuracy, robustness and fault tolerance in the task of encrypted malicious traffic detection.

    参考文献
    相似文献
    引证文献
引用本文

李含玥,郝俊值,吴承荣.基于交互状态图的多粒度融合加密恶意流量检测.计算机系统应用,,():1-11

复制
分享
相关视频

文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2025-07-16
  • 最后修改日期:2025-08-13
  • 录用日期:
  • 在线发布日期: 2025-12-19
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62661041 传真: Email:csa@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号