In network system construction, the issue of network traffic security is of paramount importance. Against the backdrop of strengthening national cybersecurity, traffic inspection plays a significant role in continuously enhancing the security capabilities of network systems. However, as more and more traffic is transmitted using the HTTP protocol over SSL/TLS encryption, this not only provides protection for legitimate communications but also facilitates covert attacks by malicious actors. Traditional traffic detection systems (such as Snort and Suricata) struggle with the challenge of inspecting encrypted traffic, and their detection rules are typically configured based on known attack patterns, making them less effective against evolving new types of attacks.
To address the aforementioned issues, this paper innovatively proposes a comprehensive traffic detection frame. The main contributions of this work are summarized in three parts:
1.Real-time Traffic Decryption and Detection Framework: We have designed and implemented an efficient real-time traffic decryption and detection architecture that cleverly integrates man-in-the-middle proxy technology to enable real-time decryption of HTTPS encrypted traffic.
2. Model Training and Validation Using an SQL Injection Dataset: To validate the effectiveness of the framework, we utilized a dataset containing SQL injection attacks to train the detection model and applied it within the framework to evaluate its capability to detect unknown attack traffic.
3. For the development and testing of the SnortML plugin: To enable real-time traffic feature extraction in SnortML, we added feature extraction capabilities to the SnortML detector and used the tcpreplay tool to simulate complex network traffic scenarios.
Through our research, we have achieved automatic detection and efficient defense against real-time, encrypted, and potentially unknown attack traffic. Experimental result clearly demonstrate that the framework has significantly improved the accuracy of encrypted traffic detection, providing strong technical support and innovative ideas for building a safer and more robust network environment.
