基于对抗训练的加密恶意流量检测技术研究

周 　悦
上海市计算机软件测评重点实验室;上海计算机软件技术开发中心

摘要

针对加密恶意流量的检测问题，本文研究了基于对抗训练的加密恶意流量检测技术。首先使用真实的样本
训练基于深度学习技术的原始检测模型，随后根据真实样本生成对抗样本，并使用对抗样本继续训练模型。实验表
明本文所提方法能够有效减少数据集对深度学习模型的影响，增强检测模型对加密恶意流量的检测能力。

关键词

加密流量；网络入侵检测；深度学习；对抗训练

参考

[1] Threats in encrypted traffic [EB/OL]. https://blogs.

cisco.com/security/threats-in-encrypted-traffic.

[2] S. Lee, J. Park, S. Yoon and M. Kim. High

performance payload signature-based Internet traffic

classification system[C]. 2015 17th Asia-Pacific Network

Operations and Management Symposium (APNOMS), 2015:

491-494.

[3] S. Rezaei and X. Liu. Deep Learning for

Encrypted Traffic Classification: An Overview[J]. in IEEE

Communications Magazine, 2019, 57(5): 76-81.

[4] R. Sommer and V. Paxson. Outside the Closed

World: On Using Machine Learning for Network Intrusion

Detection[C]. 2010 IEEE Symposium on Security and Privacy,

2010: 305-316.

[5] J. A. Abraham and V. R. Bindu. Intrusion Detection

and Prevention in Networks Using Machine Learning and

Deep Learning Approaches: A Review[C]. 2021 International

Conference on Advancements in Electrical, Electronics,

Communication, Computing and Automation (ICAECA),

Coimbatore, India, 2021: 1-4

[6] J. Lansky et al. Deep Learning-Based Intrusion

Detection Systems: A Systematic Review [J]. IEEE Access,

2021, 9:101574-101599.

[7] L. Vu, et al. Time Series Analysis for Encrypted

Traffic Classification: A Deep Learning Approach[C]. 2018

18th International Symposium on Communications and

Information Technologies (ISCIT), 2018: 121-126.

[8] Zhou, Zhi-Hua, and Ji Feng. Deep forest: Towards

an alternative to deep neural networks [EB/OL]. 2017, arXiv

preprint arXiv:1702.08835.

[9] C. Szegedy, V. Vanhoucke, S. Ioffe, et.al. Rethinking

the Inception Architecture for Computer Vision [C]. 2016

IEEE Conference on Computer Vision and Pattern Recognition

(CVPR), Las Vegas, NV, USA, 2016, 2818-2826.

[10] J. Su, D. V. Vargas and K. Sakurai. One Pixel Attack

for Fooling Deep Neural Networks[J]. in IEEE Transactions on

Evolutionary Computation, 2019, 23(5): 828-841.

[11] Maria Jose Erquiaga, MCFP dataset[OL], https://

mcfp.felk.cvut.cz/publicDatasets/

[12] ISCX Vpn-nonVpn dataset[OL], http://www.unb.ca/

cic/datasets/vpn.html