Detection of SSL/TLS protocol attacks based on flow spectrum theory
Network attack detection plays a vital role in network security. Existing detection approaches focus on typical attack behaviors, such as Botnets and SQL injection. The widespread use of the SSL/TLS encryption protocol arises some emerging attack strategies against the SSL/TLS protocol. With the ne...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
POSTS&TELECOM PRESS Co., LTD
2022-02-01
|
| Series: | 网络与信息安全学报 |
| Subjects: | |
| Online Access: | http://www.infocomm-journal.com/cjnis/CN/10.11959/j.issn.2096-109x.2022004 |
| _version_ | 1819104749616627712 |
|---|---|
| author | GUO Shize,ZHAO Ziming,ZHAO Xinjie ZHANG Fan SONG Zhuoxue WANG Xiaojuan LUO Xiangyang |
| author_facet | GUO Shize,ZHAO Ziming,ZHAO Xinjie ZHANG Fan SONG Zhuoxue WANG Xiaojuan LUO Xiangyang |
| author_sort | GUO Shize,ZHAO Ziming,ZHAO Xinjie |
| collection | DOAJ |
| description | Network attack detection plays a vital role in network security. Existing detection approaches focus on typical attack behaviors, such as Botnets and SQL injection. The widespread use of the SSL/TLS encryption protocol arises some emerging attack strategies against the SSL/TLS protocol. With the network traffic collection environment that built upon the implements of popular SSL/TLS attacks, a network traffic dataset including four SSL/TLS attacks, as well as benign flows was controlled. Considering the problems that limited observability of existing detection and limited separation of the original-flow spatiotemporal domains, a flow spectrum theory was proposed to map the threat behavior in the cyberspace from the original spatiotemporal domain to the transformed domain through the process of “potential change” and obtain the “potential variation spectrum”. The flow spectrum theory is based on a set of separable and observable feature representations to achieve efficient analysis of network flows. The key to the application of flow spectrum theory in actual cyberspace threat behavior detection is to find the potential basis matrix for a specific threat network flow under the condition of a given transformation operator. Since the SSL/TLS protocol has a strong timing relationship and state transition process in the handshake phase, and there are similarities between some SSL/TLS attacks, the detection of SSL/TLS attacks not only needs to consider timing context information, but also needs to consider the high-separation representation of TLS network flows. Based on the flow spectrum theory, the threat template idea was used to extract the potential basis matrix, and the potential basis mapping based on the long-short-term memory unit was used to map the SSL/TLS attack network flow to the flow spectrum domain space. On the self-built SSL/TLS attack network flow data set, the validity of the flow spectrum theory is verified by means of classification performance comparison, potential variation spectrum dimensionality reduction visualization, threat behavior feature weight evaluation, threat behavior spectrum division assessment, and potential variation base matrix heatmap visualization. |
| first_indexed | 2024-12-22T02:11:18Z |
| format | Article |
| id | doaj.art-69021e50435740a89aec2e47cfb3b925 |
| institution | Directory Open Access Journal |
| issn | 2096-109X |
| language | English |
| last_indexed | 2024-12-22T02:11:18Z |
| publishDate | 2022-02-01 |
| publisher | POSTS&TELECOM PRESS Co., LTD |
| record_format | Article |
| series | 网络与信息安全学报 |
| spelling | doaj.art-69021e50435740a89aec2e47cfb3b9252022-12-21T18:42:23ZengPOSTS&TELECOM PRESS Co., LTD网络与信息安全学报2096-109X2022-02-0181304010.11959/j.issn.2096−109x.2022004Detection of SSL/TLS protocol attacks based on flow spectrum theoryGUO Shize,ZHAO Ziming,ZHAO Xinjie0ZHANG Fan1SONG Zhuoxue2WANG Xiaojuan3LUO Xiangyang4 College of Computer Science and Technology, Zhejiang University, Hangzhou 310027, China ; School of Cyber Science and Technology, Zhejiang University, Hangzhou 310027, China ;College of Control Science and Engineering, Zhejiang University, Hangzhou 310027, ChinaCollege of Computer Science and Technology, Zhejiang University, Hangzhou 310027, China ; School of Cyber Science and Technology, Zhejiang University, Hangzhou 310027, China ;College of Control Science and Engineering, Zhejiang University, Hangzhou 310027, China; Zhejiang Key Laboratory of Blockchain and Cyberspace Governance, Hangzhou 310027, China College of Computer Science and Technology, Zhejiang University, Hangzhou 310027, China ; School of Cyber Science and Technology, Zhejiang University, Hangzhou 310027, China ;College of Control Science and Engineering, Zhejiang University, Hangzhou 310027, China;Engineering Laboratory of Mobile Security of Zhejiang Province, Hangzhou 310027, Chine School of Electronic Engineering, Beijing University of Posts and Telecommunications, Beijing 100876, China Information Engineering University, Key Laboratory of Cyberspace Situation Awareness of Henan Province, Zhengzhou 450001, China Network attack detection plays a vital role in network security. Existing detection approaches focus on typical attack behaviors, such as Botnets and SQL injection. The widespread use of the SSL/TLS encryption protocol arises some emerging attack strategies against the SSL/TLS protocol. With the network traffic collection environment that built upon the implements of popular SSL/TLS attacks, a network traffic dataset including four SSL/TLS attacks, as well as benign flows was controlled. Considering the problems that limited observability of existing detection and limited separation of the original-flow spatiotemporal domains, a flow spectrum theory was proposed to map the threat behavior in the cyberspace from the original spatiotemporal domain to the transformed domain through the process of “potential change” and obtain the “potential variation spectrum”. The flow spectrum theory is based on a set of separable and observable feature representations to achieve efficient analysis of network flows. The key to the application of flow spectrum theory in actual cyberspace threat behavior detection is to find the potential basis matrix for a specific threat network flow under the condition of a given transformation operator. Since the SSL/TLS protocol has a strong timing relationship and state transition process in the handshake phase, and there are similarities between some SSL/TLS attacks, the detection of SSL/TLS attacks not only needs to consider timing context information, but also needs to consider the high-separation representation of TLS network flows. Based on the flow spectrum theory, the threat template idea was used to extract the potential basis matrix, and the potential basis mapping based on the long-short-term memory unit was used to map the SSL/TLS attack network flow to the flow spectrum domain space. On the self-built SSL/TLS attack network flow data set, the validity of the flow spectrum theory is verified by means of classification performance comparison, potential variation spectrum dimensionality reduction visualization, threat behavior feature weight evaluation, threat behavior spectrum division assessment, and potential variation base matrix heatmap visualization. http://www.infocomm-journal.com/cjnis/CN/10.11959/j.issn.2096-109x.2022004ssl/tls attacksnetwork traffic detectionflow spectrum theorylong short-term memory |
| spellingShingle | GUO Shize,ZHAO Ziming,ZHAO Xinjie ZHANG Fan SONG Zhuoxue WANG Xiaojuan LUO Xiangyang Detection of SSL/TLS protocol attacks based on flow spectrum theory 网络与信息安全学报 ssl/tls attacks network traffic detection flow spectrum theory long short-term memory |
| title | Detection of SSL/TLS protocol attacks based on flow spectrum theory |
| title_full | Detection of SSL/TLS protocol attacks based on flow spectrum theory |
| title_fullStr | Detection of SSL/TLS protocol attacks based on flow spectrum theory |
| title_full_unstemmed | Detection of SSL/TLS protocol attacks based on flow spectrum theory |
| title_short | Detection of SSL/TLS protocol attacks based on flow spectrum theory |
| title_sort | detection of ssl tls protocol attacks based on flow spectrum theory |
| topic | ssl/tls attacks network traffic detection flow spectrum theory long short-term memory |
| url | http://www.infocomm-journal.com/cjnis/CN/10.11959/j.issn.2096-109x.2022004 |
| work_keys_str_mv | AT guoshizezhaozimingzhaoxinjie detectionofssltlsprotocolattacksbasedonflowspectrumtheory AT zhangfan detectionofssltlsprotocolattacksbasedonflowspectrumtheory AT songzhuoxue detectionofssltlsprotocolattacksbasedonflowspectrumtheory AT wangxiaojuan detectionofssltlsprotocolattacksbasedonflowspectrumtheory AT luoxiangyang detectionofssltlsprotocolattacksbasedonflowspectrumtheory |