머신러닝을 활용한 알려지지 않은 암호통신 프로토콜 식별 및 패킷 분류
Identification of Unknown Cryptographic Communication Protocoland Packet Analysis using Machine Learning
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
알려지지 않은 암호통신 프로토콜은 개인 및 데이터 프라이버시를 보장한다는 장점이 있을 수 있으나, 악의적 목적에 사용될 경우 기존의 네트워크 보안 장비를 이용하여 이를 식별하고 대응하는 것이 불가능에 가깝다. 특히, 실시간으로 오가는 방대한 양의 트래픽을 수작업으로 분석하는 데에는 한계가 존재한다. 따라서, 본 연구에서는 머신러닝 기법을 활용하여 알려지지 않은 암호통신 프로토콜의 패킷 식별과 패킷의 필드 구분을 시도한다. 순차 패턴과 계층적 군집화, 그리고 피어슨 상관계수를 활용하여 알려지지 않은 암호통신 프로토콜이라 하더라도 그 구조를 자동화하여 분석할 가능성을 확인한다.
Abstract
Unknown cryptographic communication protocols may have advantage of guaranteeing personal and data privacy, but when used for malicious purposes, it is almost impossible to identify and respond to using existing network security equipment. In particular, there is a limit to manually analyzing a huge amount of traffic in real time. Therefore, in this paper, we attempt to identify packets of unknown cryptographic communication protocols and separate fields comprising a packet by using machine learning techniques. Using sequential patterns analysis, hierarchical clustering, and Pearson’s correlation coefficient, we found that the structure of packets can be automatically analyzed even for an unknown cryptographic communication protocol.
참고문헌 (10)
- J. Sherry, "BlindBox: Deep Packet Inspection over Encrypted Traffic", ACM Conference on Special Interest Group on Data Communication (SIGCOMM), pp.213~226 (2015)
- C. Lan, "Embark:Securely Outsourcing Middleboxes to the Cloud", USENIX Symposium on Networked Systems Design and Implementation (NSDI), pp.255~273 (2016)
- J. Fan, "SPABox : Safeguarding Privacy During Deep Packet Inspection at a MiddleBox", IEEE, 2017, pp.25(6), 3753~3766
- J. Ning, "PrivDPI: Privacy-Preserving Encrypted Traffic Inspection with Reusable Obfuscated Rules", ACM SIGSAC Conference on Computer and Communications Security (CCS), pp.1657~1670 (2019)
- "QUIC Versions"[URL]
- Z. Chen, "Seq2Img: A sequence-to-image based approach towards IP traffic classification using convolutional neural networks", International Conference on Big Data (BigData), pp.1657~1670 (2017)
- W. Wang, "End-to-end encrypted traffic classification with one-dimensional convolution neural networks", International Conference on Intelligence and Security Informatics(ISI), pp.43~48 (2017)
- M. Lotfollahi, "Deep packet : a novel approach for encrypted traffic classification using deep learning", Methodologies and Application, 24(3), pp.1999~2012 (2019)
- "PyShark"[URL]
- J. Pei, "PrefixSpan : Mining Sequential Patterns Efficiently by Prefix-Projected Pattern Growth", International Conference on Data Engineering(ICDE), pp.215~224 (2001)