加密流量识别技术综述

崔苏苏; 刘宝旭; 董聪; 姜波; 卢志刚; 张辰

引用本文：

崔苏苏,刘宝旭,董聪,姜波,卢志刚,张辰.加密流量识别技术综述[J].信息安全学报,2026,11(3):213-237 [点击复制]
CUI Susu,LIU Baoxu,DONG Cong,JIANG Bo,LU Zhigang,ZHANG Chen.Overview of Encrypted Traffic Identification Technology[J].Journal of Cyber Security,2026,11(3):213-237 [点击复制]

本文已被：浏览 196次下载 183次	码上扫一扫！
加密流量识别技术综述
崔苏苏^1,2, 刘宝旭^1,2, 董聪^1,2, 姜波^1,2, 卢志刚^1,2, 张辰¹
字体:加大+\|默认\|缩小-
(1.中国科学院信息工程研究所北京中国 100093;2.中国科学院大学网络空间安全学院北京中国 100049)

摘要:

流量识别技术作为网络防护和管理的关键手段,可帮助网络管理员及时阻止恶意行为的传播和进行网络资源的优化。当前,随着数据安全意识的增强,网络服务和应用普遍采用加密协议来保障通信内容的安全。这些加密协议旨在保护通信内容,并增加额外的数据机密性。虽然该方法可以有效增强数据的保密性,但同时也给网络管理带来新的挑战。通信内容在经过加密算法的变化后,载荷不再具有明显的字符特征,因此传统的流量识别方法无法对加密流量进行有效识别。为此,研究人员针对加密流量识别技术进行了大量研究。本文首先对流量识别的基础概念进行了介绍,包括识别对象和主流加密协议的调研;然后根据不同的场景需求,基于协议栈由底向上的角度对当前需求较为迫切的加密任务进行了梳理;其次通过对当前现有的加密流量识别方法进行归纳比较,从基于深度包检测、基于传统机器学习、基于深度学习三个方面对加密流量识别方法进行综述;基于多维信息融合以及深度学习强大学习能力的优势,多模式混合方法有望在未来成为加密流量识别方法的突破性技术;最后,本文基于当前研究进展对加密流量识别技术的未来发展方向进行研究展望,旨在帮助学术研究人员和行业专业人士在快速发展的数字环境中认识加密流量识别的复杂性和挑战。

关键词: 加密流量识别加密协议统计特征机器学习深度学习

DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.15

投稿时间：2021-03-03修订日期：2021-04-20

基金项目:本课题得到国家重点研发计划(No.2019QY1300),CCF-绿盟科技“鲲鹏”科研基金(No.2020010),中国科学院青年创新促进会(No.2021156),中国科学院战略性先导科技专项C类(No.XDC02040100),国家自然科学基金青年科学基金项目(No.61802404)的资助。这项工作也得到了中国科学院网络评估技术重点实验室和北京市网络安全与保护技术重点实验室的部分支持。

Overview of Encrypted Traffic Identification Technology

CUI Susu^1,2, LIU Baoxu^1,2, DONG Cong^1,2, JIANG Bo^1,2, LU Zhigang^1,2, ZHANG Chen¹

(1.Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China;2.School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China)

Abstract:

Traffic identification technologies have evolved as a key component for modern network protection and management systems. These technologies enable network administrators to promptly detect and halt the spread of malicious activities, as well as carry out critical optimizations of network resources. In recent years, the growing emphasis on data security has led to the widespread adoption of encryption protocols across various network services and applications. These encryption protocols are engineered to secure the content of communications and add an extra layer of data confidentiality. Although this method can effectively enhance the confidentiality of data, it also brings new challenges to network management. After the change of encryption algorithm, the payload no longer has obvious character features, so the traditional traffic identification methods cannot effectively identify the encrypted traffic. For this reason, researchers have conducted a lot of research on encrypted traffic identification techniques. In this paper, we firstly introduce the basic concept of traffic identification, including the research of identification objects and mainstream encryption protocols; then we sort out the current urgent encryption tasks based on the bottom-up perspective of the protocol stack according to different scenarios. Secondly, we summarize and compare the current existing encrypted traffic identification methods, and compare the encrypted traffic identification methods based on deep packet inspection, traditional machine learning, and deep learning. Based on the advantages of multi-dimensional information fusion and the powerful learning ability of deep learning, the multi-modal hybrid method is expected to be a breakthrough technology for encrypted traffic recognition in the future. Conclusively, in light of current research advancements, this paper provides a forward-looking perspective on the future development vectors for encrypted traffic identification technologies. It aims to serve as a cornerstone document, assisting both academic researchers and industry professionals in navigating the complexities and challenges of encrypted traffic identification in a rapidly evolving digital landscape.

Key words: encrypted traffic identification encryption protocols statistical features machine learning deep learning