Tsinghua University

Chuanpu Fu

Ke Xu

Qi Li

A method for detecting hidden malicious traffic based on a traffic interaction map and a device are provided. The method includes monitoring traffic passing through a gateway by a detection system operating in the gateway; obtaining a data packet granularity feature by performing feature extraction of granularity of a data packet on the traffic monitored; constructing a traffic interaction map according to the data packet granularity feature to represent a long-term interaction mode of the traffic by a graph structure of the traffic interaction map; and detecting an abnormal local structure on the traffic interaction map by a detection algorithm of graph learning based on the traffic interaction map, and marking the abnormal local structure as the corresponding hidden malicious traffic.

Growing community of inventors

Beijing, China

Chuanpu Fu