C&C Encrypted Traffic Detection Based on Business Baseline Model and Joint Similarity

This study proposes an encrypted traffic detection method based on a business baseline model and joint similarity. First, by extracting network traffic features, a business baseline model for normal traffic is constructed, and support vector machine (SVM) is used for classification to determine whether the traffic is normal or anomalous. Additionally, the study introduces the joint similarity method to further improve the accuracy of encrypted traffic detection. Joint similarity combines multi-dimensional features and calculates the similarity between traffic flows to detect anomalous traffic that deviates from the overall pattern. Experimental results show that the SVM-based business baseline model performs well in encrypted traffic detection, and when combined with the joint similarity method, the detection accuracy improves significantly, achieving the detection of over 99.9% of encrypted traffic. This method effectively addresses the challenges of encrypted traffic detection in traditional traffic analysis and has high practical value and potential for wider application.