Research On Technology Of Mobile Application Identification Based On Encrypted Traffic Analysis And Deep Learning

In recent years,mobile Internet has become an indispensable part of people's daily life and work.Providing differentiated QOS services for different mobile application has become one of the important tasks of network operation departments.For security purposes such as privacy protection,mobile applications often employ encryption technology.That makes the identification of mobile applications more challenging.Therefore,identification of mobile applications based on ciphertext traffic has become a research hotspot in academic circles and industry at home and abroad.Based on the encryption traffic analysis and deep learning related technologies,this paper improves and innovates the three components of data preprocessing,encrypted data stream feature extraction and encrypted data stream algorithm modeling in mobile application identification technology.as follows:(1)In order to filter similar encrypted stream generated by different mobile applications,we propose a cluster purity analysis algorithm.Firstly,the algorithm uses the density clustering algorithm named DBSCAN to cluster all the encrypted stream samples.Then,the information entropy of each cluster is calculated as the purity of the cluster.Finally,according to the experiment,the entropy threshold is set to filter the cluster samples with large information entropy,and the filtering of similar interference samples is realized.(2)Aiming at the feature extraction stage of encrypted stream,a feature extraction scheme combining the header information of encrypted packet and payload information is proposed.The scheme abstracts the encrypted stream into a packet time series,extracts the plaintext information such as the packet length,the port number,and the TCP window at the head of the data packet as the packet header feature,and calculates a plurality of consecutive byte information entropies of the ciphertext data payload as the payload feature.Finally,the head feature and payload feature of each packet in the data stream are combined into a feature vector,and the feasibility and effectiveness of the feature extraction scheme are verified by LSTM algorithm.(3)For the modeling phase of the encrypted stream algorithm,a Convolutional-LSTM mobile application recognition algorithm combining convolutional neural network and LSTM is proposed.The algorithm treats the encrypted stream feature matrix as grayscale image,uses convolutional neural network to capture the local correlation between adjacent features,uses LSTM algorithm to learn the timing relationship of encrypted data stream,and applies Dropout and regularization to prevent the over-fitting.Finally,the mobile application type recognition under the Android platform is realized.These three improvements and innovations proposed in this paper are effective to realize the mobile application recognition under the Android platform.Experiments show that the accuracy and recall rate of our algorithm are higher than previous work.Finally,the paper puts forward the shortcomings of the method and the future research direction.