A Fingerprint Enhancement and Second-Order Markov Chain Based Malicious Encrypted Traffic Identification Scheme

Malicious encrypted traffic poses great threat to cyber security owing to encryption and the ability to bypass traditional traffic detection schemes. Malicious encrypted traffic identification is a challenging task and has attracted researchers' attention nowadays. Existing research way mainly extracts various statistical features of data-flow, which relies artificial experience heavily. To round the above problem. a fingerprint enhancement and second-order Markov chain based scheme is proposed in this paper, obtaining features more easily. Fingerprint enhancement is done to replace SSL fingerprint by refining data-flow's behavior. Then enhanced fingerprint is fed to second-order Markov chain to obtain dominating feature for identification model. To our best knowledge, this paper is the first one focusing on using fingerprint and second order Markov chain to simplify feature extraction. Finally, the proposed scheme is verified based on public dataset Stratosphere IPS.