|
Traffic security is one of the important topic in cyber security of smart city. With the widespread use of encrypted traffic, more and more malware prefers to use encrypted traffic to transmit malicious information. Since the transmission content is not visible, the traditional detection method based on deep packet inspection is not effective anymore. In this paper, by analyzing the protocol and the sessions of malicious encrypted traffic and benign traffic, a weight naive Bayes-based method for detecting malware encrypted traffic and classifying malware family is proposed. The method construct a hybrid fingerprint for each malware family traffic and benign traffic. First a hybrid fingerprint-based identification is performed to distinguish between malware families and benign applications. Second, a feature generalization method is adopted to improve the robustness of the fingerprint. Finally, for indistinguishable fingerprints, the target host information characteristic, combined weighted Bayesian is used to distinguish different benign applications and malicious families.
|
