Design And Implementation Of The HTTPS Page Classification Detection System Based On Feature Extraction

Traditional data flow classification method, the research on the classification of different network protocols and clear transmission occupies a large proportion, but, for the classification method based on the same protocol and encryption transmission less research.So, this thesis designed and implemented the system can be in a certain range, for encrypted page provides a feasible method of classification and recognition.And, according to the characters of protocol analysis and statistics and other relevant knowledge, design and implement a set of static page request about encryption response flow classification of complete system.We’ll be the first to obtain the data, then analysis its inherent attributes. We just need to get request response phase flow of data card.In order to reduce the capture data in the process of artificial operation, the thesis analyses the operation process in the process of data capture, and designed and implemented by means of behavior simulation data capture module;Corresponding packet capture, we can manually by wireshark network packet analysis software for the existence of one data flow has the characteristics of the genetic diversity, however, such detailed data flow analysis is also a huge workload, we designed and implemented for this feature extraction module, can according to the characteristics of the we found a small part of the powerful analytical ability of libnids, large-scale search for other data in the same or similar characteristics, in order to ensure that features more flexible, we also set a threshold value, using the similarity of fuzzy matching range;In this paper, the above analysis and to extract the characteristics of the prefix tree matching model is established, and through the characteristics of pretreatment and prefix tree pruning methods such as optimizing the classification model, has realized the online encryption quick sort of data flow testing.Through a test on system, the program can already within minutes class, specify the packet sample feature extracting and rapidly in the second grade classifying real-time traffic detection.And can be stable operation of the uninterrupted throughout the year.