A Method of Detecting the Abnormal Encrypted Traffic Based on Machine Learning and Behavior Characteristics

Abstract

Classification of network traffic using port-based or deep packet-based analysis is becoming increasingly difficult with many peer-to-peer(P2P) applications using dynamic port numbers, especially in massive data streams. In view of the problem that traditional method cannot be self-learning and self-evolving in dynamic networks, this paper proposed an abnormally encrypted traffic detection method based on machine learning and behavior characteristics, this approach can not only identify unknown abnormal traffic, but eliminate specific feature extraction in advance, which can effectively improve the accuracy of the abnormal encrypted traffic detection system. In this paper, we processed the network traffic data with using a machine learning approach combined behavior characteristics of applications, the experimental results show that in the complex network, the abnormal encrypted data stream detection method based on machine learning and behavior characteristics has higher recognition accuracy and can more effectively solve the problem of abnormally encrypted traffic identification.