Cloud computing for malicious encrypted traffic analysis and collaboration

Tzung Han Jeng, Wen Yang Luo, Chuan Chiang Huang, Chien Chih Chen, Kuang Hung Chang, Yi Ming Chen

研究成果: 雜誌貢獻期刊論文同行評審

摘要

As the application of network encryption technology expands, malicious attacks will also be protected by encryption mechanism, increasing the difficulty of detection. This paper focuses on the analysis of encrypted traffic in the network by hosting long-day encrypted traffic, coupled with a weighted algorithm commonly used in information retrieval and SSL/TLS fingerprint to detect malicious encrypted links. The experimental results show that the system proposed in this paper can identify potential malicious SSL/TLS fingerprints and malicious IP which cannot be recognized by other external threat information providers. The network packet decryption is not required to help clarify the full picture of the security incident and provide the basis of digital identification. Finally, the new threat intelligence obtained from the correlation analysis of this paper can be applied to regional joint defense or intelligence exchange between organizations. In addition, the framework adopts Google cloud platform and microservice technology to form an integrated serverless computing architecture.

原文???core.languages.en_GB???
頁(從 - 到)12-29
頁數18
期刊International Journal of Grid and High Performance Computing
13
發行號3
DOIs
出版狀態已出版 - 1 7月 2021

指紋

深入研究「Cloud computing for malicious encrypted traffic analysis and collaboration」主題。共同形成了獨特的指紋。

引用此