Markov Chain Based Encrypted Sream Identification System Research And Implement

In recent years, with the development of Internet and mobile Internet technology, user privacy and application data security has been widespread concerned. In order to ensure the security of data during transmission, crypto methods has been widely applied to the data transmission protocol. However, secure transmission protocols also can be used by malicious users to transmit data by the security transmission channel to hide their malicious intent. Therefore, how to identify malicious traffic from all encrypted traffic brings challenge.Firstly, the study of network traffic identification technology, including port-based classification, deep packet inspection, flow features based methods, prot based methods and markov chain based method have been studied. Then we detailed analysis the advantages and disadvantages of these methods. Then we make a detailed study and analysis of the encrypted stream recognition model based on Markov chain. Aiming to achieve encrypted traffic identification system using Markov chain as the basic model. Finally we do the effectiveness of the verification system through experiments.The main features of the system include:(1)Automatic collection of network traffic and store traffic into database. Our system use both hardware and software to collect network traffic and use database to provide reliable storage.(2)Automatic building of application fingerprint. The system only needs to input the collected network traffic files and can automatically establish the fingerprint of applications.(3)Real-time recognition of SSL traffic. Our system can identify SSL streams in real time. The system can know the IP address and the name of the application which the stream belongs.