Monitoring and Analysis of Encrypted Attack Traffic Based on Machine Learning

With the growing significance of network security, an increasing number of websites and applications are opting to encrypt their transmitted traffic. In order to provide an effective method for analyzing encrypted traffic, this paper uses the C4.5 decision tree algorithm to establish a model for classifying encrypted traffic. Based on the Moore feature set, we perform feature extraction for monitoring and analyzing encrypted traffic. We use Cfssubseteval, Gainratioattributeeval and Infogainattributeeval as evaluation functions to remove redundant features to obtain the optimal feature subset, thereby improving the performance of model detection. Experimental results show that the C4.5 decision tree algorithm after feature extraction can reduce the training time of the original algorithm by 50% while ensuring a certain accuracy. In addition, compared to other deep learning models, although the traditional C4.5 decision tree method may not have high accuracy, it is more efficient in processing large-scale data and holds potential research value in the future.