基于信息熵的加密会话检测方法

传统协议分析方法在检测网络加密会话时大都通过端口识别,在加密应用使用非常规端口或者在周知明文端口出现加密流量时无法进行有效的检测.为此,提出基于信息熵的加密会话检测方法.该方法先对数据流按端口进行会话重组,再计算会话数据包字符熵,进而统计出整个会话字符熵,判断熵值是否属于训练模型正态分布置信区间,通过信息分布均匀度来检测加密会话.实验表明,该方法无需特征指纹库,且检测准确率高,并能实现实时检测和处理.

Encrypted Session Detection Approach Based on Information Entropy

Traditional protocol analysis algorithms detect the network encrypted session through the port.It cannot work when encrypted session uses unknown port or encrypted traffic appeares at known plaintext port.To this end,we put forward a detection approach of encrypted session based on information entropy.Firstly it reorganizes net flow according to the port,then calculates the entropy of each packet and statistical entropy value of the entire session,at last determines whether the value belongs to the normal distribution confidence interval,and identifies the encrypted session through character distribution uniformity.Experiments show that the approach does not need fingerprint database,and can achieve higher correct detection rate,real-time detection and processing.