在使用自主监督学习的加密网络流量中检测异常
Sadaf Sattar1, Shumaila Khan2, Muhammad Ismail Khan3
1Department of Computer Science and Information Technology, The Superior University, Lahore, Pakistan.
Scientific reports
|July 22, 2025
概括
ET-SSL是一种用于加密网络流量异常检测的新方法,使用自我监督的对比学习. 它在没有标记数据的情况下实现高精度,提供高效的实时检测,以提高隐私和安全性.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 网络安全 网络安全
背景情况:
- 由于有效载荷检查的限制,传统的异常检测方法在加密流量中失败.
- 加密增强了隐私,但阻碍了传统安全措施的有效性.
- 需要先进的技术来检测加密网络通信中的异常.
研究的目的:
- 引入ET-SSL,一种用于在加密网络流量中检测异常的新方法.
- 利用自我监督的对比学习来有效识别异常.
- 开发一种绕过标记数据集和有效负载分析的解决方案.
主要方法:
- 利用自我监督的对比学习,从流量级统计特征中提取信息表示.
- 使用数据包长度,到达间时间,流程持续时间和协议元数据进行分析.
- 扩展基于SSL的流量分类,以提高低计算复杂度的检测性能.
主要成果:
- 在基准数据集 (CIC-Darknet2020,ISCX VPN,UNSW-NB15) 上实现了96.8%的准确性,92.7%的真实阳性率 (TPR) 和1.2%的假阳性率 (FPR).
- 具有实时异常检测能力,延迟时间为15-25毫秒,处理速度高达10 Gbps.
- 在动态网络环境中有效检测零日攻击.
结论:
- 在加密流量中,ET-SSL为私有和节能的异常检测提供了一个范例.
- 与现有技术相比,该方法提供了更好的可扩展性和有效性,特别是在零日威胁方面.
- ET-SSL适用于高速,资源有限的环境,需要强大的安全性.
相关概念视频
02:28Leaky Scanning
During most eukaryotic translation processes, the small 40S ribosome subunit scans an mRNA from its 5' end until it encounters the first start AUG codon. The large 60S ribosomal subunit then joins the smaller one to initiate protein synthesis. The location of the translation initiation is largely determined by the nucleotides near the start codon as there may be multiple translation initiation sites present on the mRNA. Marilyn Kozak discovered that the sequence RCCAUGG (where R stands for...
01:18Signal Flow Graphs
Signal-flow graphs offer a streamlined and intuitive approach to representing control systems, providing an alternative to traditional block diagrams. These graphs use branches to symbolize systems and nodes to represent signals, effectively illustrating the relationships and interactions within the system.
In a signal-flow graph, branches denote the system's transfer functions, while nodes represent the signals. The direction of signal flow is indicated by arrows, with the corresponding...
In a signal-flow graph, branches denote the system's transfer functions, while nodes represent the signals. The direction of signal flow is indicated by arrows, with the corresponding...
01:28Pipe Flowrate Measurement: Problem Solving
A spray tank system is engineered to uniformly distribute a pest-control liquid across plants by using a pressurized mechanism. The tank, pressurized to 150 kPa, holds the pesticide at a height of 0.80 meters. Liquid flows from the tank through a 1.9 meter pipe with a diameter of 0.015 meters, angled at 0.698 radians, ultimately reaching a 0.007 meter nozzle that sprays the pesticide. Accurate calculation of the system's flow rate is crucial to ensure uniform application, and this is achieved...
01:27Uniform Depth Channel Flow
Uniform depth channel flow keeps fluid depth consistent along channels such as irrigation canals. In natural channels, such as rivers, approximate uniform flow is often assumed. This condition occurs when the channel’s bottom slope matches the energy slope, balancing potential energy lost from gravity with head loss due to shear stress. This balance prevents depth changes along the channel length, resulting in a steady, uniform flow.Uniform flow in open channels with a constant cross-section...
01:18Uniform Depth Channel Flow: Problem Solving
To calculate the flow rate for a trapezoidal channel, first, identify the bottom width, side slope, and flow depth of the channel. The cross-sectional area (A) corresponding to the depth of flow (y), channel bottom width (B), and side slope (θ) is determined by:Next, calculate the wetted perimeter, which includes the bottom width and the sloped side lengths in contact with the water. Using the values of the cross-sectional area and the wetted perimeter, determine the hydraulic radius by...
01:24Rapidly Varying Flow
Rapidly varying flow (RVF) in open channels is characterized by abrupt changes in flow depth over a short distance, with the rate of depth change relative to distance often approaching unity. These flows are inherently complex due to their transient and multi-dimensional nature, making exact analysis difficult. However, approximate solutions using simplified models provide valuable insights into their behavior.Key Features of Rapidly Varying FlowRVF is commonly observed in scenarios involving...