Artificial Intelligence Multi-Model Based Detection of Malicious Encrypted Traffic

As encrypted traffic is used more and more widely, in order to solve the problem that malware uses encrypted traffic for covert communication, which makes traditional traffic threat detection methods ineffective and the user network and information security cannot be effectively guaranteed. Introducing traditional machine learning methods, researched and analyzed all features generated during TLS protocol communication in a fine-grained manner, and used feature engineering to extract features that can be used to distinguish attack traffic from benign traffic. At the same time, to adapt to different network scenarios and improve the density of useful features, The features were divided into stream features, handshake features, certificate features and domain name features, and four different sub-models were trained based on the four features. The final detection result was the weighted average sum of the four sub-models. Experimental results show that the model can effectively identify attack behaviors in encrypted traffic.