Abstract: Disclosed is a system for classifying encrypted traffic based on a data packet. The system includes a traffic capture module, a traffic analysis module, and a traffic classification module. The system collects data packets from a network flow to construct a machine learning model, so as to classify encrypted traffic and identify normal traffic and malicious traffic. In a process of constructing a feature matrix, basic spatial-temporal features, header features, load features, and statistical features are obtained. In addition, behavioral features of the data packets are obtained and used to demonstrate differences between the normal traffic and the malicious traffic. Moreover, the present disclosure focuses on a difference between different versions of an encryption protocol, especially a transport layer security (TLS) protocol, and introduces the difference into a model for analysis, so that the system classifies encrypted traffic in a more efficient manner.

Abstract: An Android penetration method and device for implementing silent installation based on accessibility services. The method includes: acquiring a second target application by adding a load program to a first target application and adding penetration permissions using an Android decompilation technology; and implementing silent installation of the second target application using an accessibility service technology.

Abstract: Disclosed is a system for classifying encrypted traffic based on a data packet. The system includes a traffic capture module, a traffic analysis module, and a traffic classification module. The system collects data packets from a network flow to construct a machine learning model, so as to classify encrypted traffic and identify normal traffic and malicious traffic. In a process of constructing a feature matrix, basic spatial-temporal features, header features, load features, and statistical features are obtained. In addition, behavioral features of the data packets are obtained and used to demonstrate differences between the normal traffic and the malicious traffic. Moreover, the present disclosure focuses on a difference between different versions of an encryption protocol, especially a transport layer security (TLS) protocol, and introduces the difference into a model for analysis, so that the system classifies encrypted traffic in a more efficient manner.

Abstract: Embodiments of the present invention provides an Android penetration method and device for implementing silent installation based on accessibility services. The method includes: acquiring a second target application by adding a load program to a first target application and adding penetration permissions using an Android decompilation technology; and implementing silent installation of the second target application using an accessibility service technology. The embodiment of the present invention enables a terminal to perform silent penetration test without root and user interaction. The embodiments of the present invention can also improve the stability of the penetration session.