Guangzhou University

China Railway Construction Heavy Industry Corporation Limited

Qianlong Xiao

Zhihong Tian

Shen Su

Xiaoya Ni

Rongrong Chen

Minghao Hu

Guangxia Xu

Jiaxu Xing

Jing Qiu

Fei Tang

Lihua Yin

Chengliang Gao

Feixiang Liu

Jie Ding

Zhongbao Wen

Cheng Zhang

Shuaikun Zhang

Hua Liu

Yongliang Cheng

Kai Wang

Disclosed is a system for classifying encrypted traffic based on a data packet. The system includes a traffic capture module, a traffic analysis module, and a traffic classification module. The system collects data packets from a network flow to construct a machine learning model, so as to classify encrypted traffic and identify normal traffic and malicious traffic. In a process of constructing a feature matrix, basic spatial-temporal features, header features, load features, and statistical features are obtained. In addition, behavioral features of the data packets are obtained and used to demonstrate differences between the normal traffic and the malicious traffic. Moreover, the present disclosure focuses on a difference between different versions of an encryption protocol, especially a transport layer security (TLS) protocol, and introduces the difference into a model for analysis, so that the system classifies encrypted traffic in a more efficient manner.

System for classifying encrypted traffic based on data packet

Growing community of inventors

Guangdong, China

Qianlong Xiao