GUANGZHOU UNIVERSITY

Disclosed is a system for classifying encrypted traffic based on a data packet. The system includes a traffic capture module, a traffic analysis module, and a traffic classification module. The system collects data packets from a network flow to construct a machine learning model, so as to classify encrypted traffic and identify normal traffic and malicious traffic. In a process of constructing a feature matrix, basic spatial-temporal features, header features, load features, and statistical features are obtained. In addition, behavioral features of the data packets are obtained and used to demonstrate differences between the normal traffic and the malicious traffic. Moreover, the present disclosure focuses on a difference between different versions of an encryption protocol, especially a transport layer security (TLS) protocol, and introduces the difference into a model for analysis, so that the system classifies encrypted traffic in a more efficient manner.

Disclosed is a system for classifying encrypted traffic based on a data packet. The system includes a traffic capture module, a traffic analysis module, and a traffic classification module. The system collects data packets from a network flow to construct a machine learning model, so as to classify encrypted traffic and identify normal traffic and malicious traffic. In a process of constructing a feature matrix, basic spatial-temporal features, header features, load features, and statistical features are obtained. In addition, behavioral features of the data packets are obtained and used to demonstrate differences between the normal traffic and the malicious traffic. Moreover, the present disclosure focuses on a difference between different versions of an encryption protocol, especially a transport layer security (TLS) protocol, and introduces the difference into a model for analysis, so that the system classifies encrypted traffic in a more efficient manner.

The disclosure discloses a method for bidirectional authorization of a blockchain-based resource public key infrastructure, aiming at solving security threat problems that a legal BGP route is illegal and a legal IP address is blocked caused by malicious operations. A technical solution is as follows: constructing a blockchain-based resource public key infrastructure system RPKIB composed of a resource issuer, a resource transaction application client, a resource receiver and a blockchain network; changing any operation of issuing, revoking, overwriting and modifying of a resource certificate by the resource issuer into a bidirectional authorization mode, and implementing the operation of the resource certificate only when the issuer and the receiver both agree; and carrying out, by the issuer, operations of a resource certificate RC and route origin authorization ROA as transactions that are carried out through the blockchain network, and distinguishing whether the operations are malicious behaviors or normal operations.