文献类型：期刊文献

中文题名：基于CNN的加密C&C通信流量识别方法

英文题名：CNN-based Encrypted C&C Communication Traffic Identification Method

作者：程华[1];谢金鑫[1];陈立皇[1]

机构：[1]华东理工大学信息科学与工程学院

年份：2019

卷号：45

期号：8

起止页码：31

中文期刊名：计算机工程

外文期刊名：Computer Engineering

收录：CSTPCD;;Scopus;北大核心:【北大核心2017】；CSCD:【CSCD_E2019_2020】；

基金：赛尔网络下一代互联网技术创新项目(NGII20160606)

语种：中文

中文关键词：加密流量;C&C通信;https通信;卷积神经网络;密文字符表达

外文关键词：encrypted traffic;C& C communication;https communication;Convolutional Neural Network(CNN);ciphertext character expression

摘要：为实现恶意软件加密C& C通信流量的准确识别,分析正常网页浏览访问和C& C通信的https通信过程,发现恶意软件C& C通信的服务器独立性特征,提出https通信序列建模方法。针对加密通信的行为特点,利用密文十六进制字符的向量表示方法完成加密流量的向量化表达,并采用多窗口卷积神经网络提取加密C& C通信模式的特征,实现加密C& C通信数据流的识别与分类。实验结果表明,该方法识别恶意软件加密C& C流量的准确率高达91.07 %。
In order to achieve accurate identification of malware encrypted C& C communication traffic,this paper analyzes the https communication process of normal Webpage browsing access and C& C communication,discovers the server independence feature of malware C& C communication and proposes a sequence modeling method of https communication.Based on the behaviour characteristics of encrypted communication,a vector representation method for hexadecimal characters of ciphertext is used to implement a vectorized expression of encrypted traffic.Multi-window Convolutional Neural Network(CNN) is used to extract the pattern characteristics of encrypted C& C communication and realize the identification and classification of encrypted C& C communication data traffic.Experimental results show that the accuracy of identifying the encrypted C& C communication traffic of malware is 91.07 %.