重庆大学计算机学院,重庆 400044
张迪 女,1993年11月出生于贵州省毕节市。现为重庆大学计算机学院副教授、硕士生导师。主要研究方向为隐私保护、区块链、应用密码学。E-mail: dizhang@cqu.edu.cn
王皓 男,2001年8月出生于辽宁省海城市。现为重庆大学计算机学院硕士研究生。主要研究方向为隐私保护、应用密码学。E-mail: wang_hao@cqu.edu.cn
张颖 女,2002年4月出生于重庆市。现为重庆大学计算机学院硕士研究生。主要研究方向为信息安全。E-mail: zhang_ying@stu.cqu.edu.cn
乐俊青 男,1991年4月出生于江西省抚州市。现为重庆大学计算机学院副教授、硕士生导师。主要研究方向为隐私保护、联邦学习、信息安全。E-mail: junqingle@cqu.edu.cn
廖晓峰 男,1964年10月出生于重庆市。现为重庆大学计算机学院教授、博士生导师。主要研究方向为神经网络、隐私保护、密码学。E-mail: xfliao@cqu.edu.cn
收稿:2026-01-20,
录用:2026-03-09,
网络首发:2026-06-03,
纸质出版:2026-04-25
移动端阅览
张迪, 王皓, 张颖, 等. 基于预约束加密的可追溯加密恶意流量检测[J]. 电子学报, 2026, 54(04): 1481-1496.
ZHANG Di, WANG Hao, ZHANG Ying, et al. A Traceable and Encrypted Malicious Traffic Detection Scheme Based on Set Pre-Constrained Encryption[J]. Acta Electronica Sinica, 2026, 54(04): 1481-1496.
张迪, 王皓, 张颖, 等. 基于预约束加密的可追溯加密恶意流量检测[J]. 电子学报, 2026, 54(04): 1481-1496. DOI:10.12263/DZXB.20251051
ZHANG Di, WANG Hao, ZHANG Ying, et al. A Traceable and Encrypted Malicious Traffic Detection Scheme Based on Set Pre-Constrained Encryption[J]. Acta Electronica Sinica, 2026, 54(04): 1481-1496. DOI:10.12263/DZXB.20251051
随着超文本传输安全协议(HyperText Transfer Protocol Secure,HTTPS)、传输层安全协议(Transport Layer Security,TLS)等安全通信协议的广泛部署,网络流量内容在获得有效保护的同时,也使依赖明文分析的恶意流量检测技术难以直接应用,给密态流量检测带来了新挑战。基于可搜索加密等密码技术的现有检测方案,通过半解密等操作能助力实现密态流量检测。然而,这类方案的中间盒可能借助检测过程推断检测规则,关联用户通信行为,挖掘用户隐私信息,容易引发严峻的隐私泄漏风险。此外,随着检测规则规模与流量分段Token数量不断增长,现有方案中大量使用的双线性配对、多轮交互或者复杂预处理等高开销操作导致计算与通信负担显著加重,难以满足实时检测与大规模部署需求。针对上述问题,本文提出一种基于预约束加密的可追溯加密恶意流量检测方案——CipherSight,旨在面向端到端通信场景,构建兼顾隐私保护与高效检测的主动检测机制。该方案首先结合集合预约束加密、轻量级布谷鸟哈希与对称加密技术,对检测规则与传输流量进行保护,在不泄露流量明文与规则语义的前提下实现恶意Token匹配。其次,基于签名机制对双向通信会话密钥进行承诺与绑定,使接收方能够快速验证并筛选其所需密文流量,从而避免对非目标流量进行冗余解密,提升解密阶段效率与可靠性。进一步地,基于Diffie-Hellman问题,在流量Token密文中隐式嵌入发送方身份信息,仅当流量匹配恶意规则时,中间盒才能恢复有效身份标识并实现精确溯源,而对合规流量仍无法获得任何有用信息。CipherSight在保证通信用户匿名性及恶意规则隐私性的前提下,实现了密态恶意流量的精确检测和恶意传播者的溯源。理论分析表明,所提方案基于不可区分性选择明文攻击(INDistinguishable Chosen Plaintext Attack,IND-CPA)安全的对称加密满足流量机密性,基于会话密钥签名的不可伪造性选择消息攻击(Existential UnForgeability under Chosen Message Attack,EUF-CMA)的安全性满足流量不可链接性,检测规则机密性则继承集合预约束加密的Element-hiding与Set-hiding安全性质。实验结果表明,CipherSight在密钥生成、规则生成、流量检测和流量解密等阶段均展现出较优性能:相较于BlindIDS,检测和解密效率分别提升40倍和15倍以上;相较于近期相关方案Pine与PrivBox,检测和解密效率均提升约5倍;在大规模规则与Token场景下,方案检测时间对规则规模变化不敏感,表现出更好的扩展性与实用性。综上,CipherSight为加密网络环境下实现高效、隐私保护的密态恶意流量主动检测和溯源提供了一种可行的新方案。
With the widespread deployment of secure communication protocols such as hypertext transfer protocol secure (HTTPS) and transport layer security (TLS)
while network traffic contents have been effectively protected
malicious traffic detection techniques that rely on plaintext analysis have become difficult to apply directly
posing new challenges to encrypted traffic detection. Existing detection schemes based on searchable encryption and related cryptographic techniques have facilitated the detection of malicious traffic over encrypted data through operations such as partial decryption. However
middleboxes in such schemes may infer detection rules during the detection process
correlate users’ communication behaviors
and further mine users’ private information
thereby causing severe privacy leakage risks. In addition
as the scale of detection rules and the number of traffic segmentation tokens continue to grow
the extensive use of high-overhead operations in existing schemes
such as bilinear pairings
multiple rounds of interaction
and complex preprocessing
significantly increases computational and communication burdens
making it difficult to meet the demands of real-time detection and large-scale deployment. To address these issues
this paper proposes CipherSight
a traceable encrypted malicious traffic detection scheme based on set pre-constrained encryption
which aims to construct an active detection mechanism for end-to-end communication scenarios that achieves both privacy preservation and efficient detection. Specifically
the scheme combines set pre-constrained encryption
lightweight cuckoo hashing
and symmetric encryption to protect detection rules and transmitted traffic
enabling malicious token matching without revealing traffic plaintext or rule semantics. It further uses a signing mechanism to commit and bind bidirectional session keys
allowing the receiver to quickly verify and filter ciphertext traffic intended for itself
thereby avoiding redundant decryption of non-target traffic and improving the efficiency and reliability of the decryption phase. Moreover
based on the Diffie-Hellman problem
sender identity information is implicitly embedded into traffic token ciphertexts
so that only when traffic matches malicious rules can the middlebox recover a valid identity tag and achieve precise traceability
while no useful information can be obtained from benign traffic. CipherSight realizes accurate encrypted malicious traffic detection and malicious sender tracing while preserving communication user anonymity and malicious rule privacy. Theoretical analysis shows that the proposed scheme satisfies traffic confidentiality based on a symmetric encryption being indistinguishable chosen plaintext attack (IND-CPA) security
that the scheme satisfies traffic unlinkability based on the existential unforgeability under chosen message attack (EUF-CMA) security of the session key signature
and that the confidentiality of detection rules inherits the element-hiding and set-hiding security properties of set pre-constrained encryption. Experimental results demonstrate that CipherSight achieves strong performance in key generation
rule generation
traffic detection
and traffic decryption: compared with BlindIDS
it improves detection and decryption efficiency by about 40 times and more than 15 times
respectively; compared with recent related schemes such as Pine and PrivBox
it improves both detection and decryption efficiency by about 5 times; and in large-scale rule and token scenarios
its detection time is insensitive to changes in rule size
showing better scalability and practicality. Overall
CipherSight provides a feasible new solution for achieving efficient
privacy-preserving active detection and traceability of malicious traffic in encrypted network environments.
Google . HTTPS encryption on the web [EB/OL ] . [ 2025-11-14 ] . https://transparencyreport.google.com/https/overview?hl=en https://transparencyreport.google.com/https/overview?hl=en .
Cisco . Encrypted Traffic Analytics with the New Cisco Network and Secure Network Analytics At-a-Glance [EB/OL ] . [ 2025-11-14 ] . https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/at-a-glance-c45-740079.html https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/at-a-glance-c45-740079.html .
侯剑 , 鲁辉 , 刘方爱 , 等 . 加密恶意流量检测及对抗综述 [J ] . 软件学报 , 2024 , 35 ( 1 ): 333 - 355 .
Hou Jian , Lu Hui , Liu Fangai , et al . Detection and countermeasure of encrypted malicious traffic: A survey [J ] . Journal of Software , 2024 , 35 ( 1 ): 333 - 355 . (in Chinese)
Sherry J , Lan Chang , Popa R A , et al . BlindBox: Deep packet inspection over encrypted traffic [C ] // Proceedings of 2015 ACM Conference on Special Interest Group on Data Communication . New York : ACM , 2015 : 213 - 226 . DOI: 10.1145/2785956.2787502 http://dx.doi.org/10.1145/2785956.2787502
陆浩天 , 董育宁 , 全宇轩 . 一种基于双层模型和指标分布的恶意网络流持续检测和分类方法 [J ] . 电子学报 , 2025 , 53 ( 5 ): 1637 - 1649 .
Lu Haotian , Dong Yuning , Quan Yuxuan . A method for continuous detection and classification of malicious network traffic based on double-layer model and distribution of indexes [J ] . Acta Electronica Sinica , 2025 , 53 ( 5 ): 1637 - 1649 . (in Chinese)
周奕涛 , 张斌 , 刘自豪 . 基于多模态深度神经网络的应用层DDoS攻击检测模型 [J ] . 电子学报 , 2022 , 50 ( 2 ): 508 - 512 .
Zhou Yitao , Zhang Bin , Liu Zihao . Application layer DDoS detection model based on multimodal deep learning neural network [J ] . Acta Electronica Sinica , 2022 , 50 ( 2 ): 508 - 512 . (in Chinese)
Jarmoc J . SSL/TLS interception proxies and transitive trust [EB/OL ] . ( 2012-03-14 )[ 2025-11-14 ] . https://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-SSL_TLS_Interception-WP.pdf https://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-SSL_TLS_Interception-WP.pdf .
Han J , Kim S , Ha J , et al . SGX-Box: Enabling visibility on encrypted traffic using a secure middlebox module [C ] // Proceedings of the 1st Asia-Pacific Workshop on Networking . New York : ACM , 2017 : 99 - 105 . DOI: 10.1145/3106989.3106994 http://dx.doi.org/10.1145/3106989.3106994
Trach B , Krohmer A , Gregor F , et al . ShieldBox: Secure middleboxes using shielded execution [C ] // Proceedings of Symposium on SDN Research . New York : ACM , 2018 : 2 . DOI: 10.1145/3185467.3185469 http://dx.doi.org/10.1145/3185467.3185469
Goltzsche D , Rüsch S , Nieke M , et al . EndBox: Scalable middlebox functions using client-side trusted execution [C ] // Proceedings of the 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks . Piscataway : IEEE , 2018 : 386 - 397 . DOI: 10.1109/dsn.2018.00048 http://dx.doi.org/10.1109/dsn.2018.00048
Lan Chang , Sherry J , Popa R A , et al . Embark: Securely outsourcing middleboxes to the cloud [C ] // Proceedings of the 13th USENIX Symposium on Networked Systems Design and Implementation . Berkeley : USENIX Association , 2016 : 255 - 273 .
Yuan Xingliang , Wang Xinyu , Lin Jianxiong , et al . Privacy-preserving deep packet inspection in outsourced middleboxes [C ] // Proceedings of the 35th Annual IEEE International Conference on Computer Communications . Piscataway : IEEE , 2016 : 7524526 . DOI: 10.1109/infocom.2016.7524526 http://dx.doi.org/10.1109/infocom.2016.7524526
Asghar H J , Melis L , Soldani C , et al . SplitBox: Toward efficient private network function virtualization [C ] // Proceedings of 2016 Workshop on Hot Topics in Middleboxes and Network Function Virtualization . New York : ACM , 2016 : 7 - 13 . DOI: 10.1145/2940147.2940150 http://dx.doi.org/10.1145/2940147.2940150
Ren Hao , Litt H , Liu Dongxiao , et al . Toward efficient and secure deep packet inspection for outsourced middlebox [C ] // Proceedings of 2019 IEEE International Conference on Communications . Piscataway : IEEE , 2019 : 8761954 . DOI: 10.1109/icc.2019.8761954 http://dx.doi.org/10.1109/icc.2019.8761954
Canard S , Diop A , Kheir N , et al . BlindIDS: Market-compliant and privacy-friendly intrusion detection system over encrypted traffic [C ] // Proceedings of 2017 ACM on Asia Conference on Computer and Communications Security . New York : ACM , 2017 : 561 - 574 . DOI: 10.1145/3052973.3053013 http://dx.doi.org/10.1145/3052973.3053013
Ning Jianting , Poh G S , Loh J C , et al . PrivDPI: Privacy-preserving encrypted traffic inspection with reusable obfuscated rules [C ] // Proceedings of 2019 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2019 : 1657 - 1670 . DOI: 10.1145/3319535.3354204 http://dx.doi.org/10.1145/3319535.3354204
Fan Jingyuan , Guan Chaowen , Ren Kui , et al . SPABox: Safeguarding privacy during deep packet inspection at a middlebox [J ] . IEEE/ACM Transactions on Networking , 2017 , 25 ( 6 ): 3753 - 3766 . DOI: 10.1109/TNET.2017.2753044 http://dx.doi.org/10.1109/TNET.2017.2753044
Ning Jianting , Huang Xinyi , Poh G S , et al . Pine: Enabling privacy-preserving deep packet inspection on TLS with rule-hiding and fast connection establishment [C ] // Proceedings of the 25th European Symposium on Research in Computer Security . Heidelberg : Springer , 2020 : 3 - 22 . DOI: 10.1007/978-3-030-58951-6_1 http://dx.doi.org/10.1007/978-3-030-58951-6_1
Wu Pengfei , Ning Jianting , Huang Xinyi , et al . PrivBox: Privacy-preserving deep packet inspection with dual double-masking obfuscated rule generation [J ] . IEEE Transactions on Dependable and Secure Computing , 2025 , 22 ( 5 ): 4954 - 4970 . DOI: 10.1109/tdsc.2025.3557423 http://dx.doi.org/10.1109/tdsc.2025.3557423
Lee H , Smith Z , Lim J , et al . maTLS: How to make TLS middlebox-aware? [C ] // Proceedings of the 26th Annual Network and Distributed System Security Symposium . San Diego, CA, USA : The Internet Society , 2019 : 23547 . DOI: 10.14722/ndss.2019.23547 http://dx.doi.org/10.14722/ndss.2019.23547
Lai Shangqi , Yuan Xingliang , Sun Shifeng , et al . Practical encrypted network traffic pattern matching for secure middleboxes [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 4 ): 2609 - 2621 . DOI: 10.1109/tdsc.2021.3065652 http://dx.doi.org/10.1109/tdsc.2021.3065652
Wang Weicheng , Lee H , Huang Yan , et al . Towards efficient privacy-preserving deep packet inspection [C ] // Proceedings of the 28th European Symposium on Research in Computer Security . Heidelberg : Springer , 2023 : 166 - 192 . DOI: 10.1007/978-3-031-51476-0_9 http://dx.doi.org/10.1007/978-3-031-51476-0_9
Chen Dajiang , Wang Hao , Zhang Ning , et al . Privacy-preserving encrypted traffic inspection with symmetric cryptographic techniques in IoT [J ] . IEEE Internet of Things Journal , 2022 , 9 ( 18 ): 17265 - 17279 . DOI: 10.1109/jiot.2022.3155355 http://dx.doi.org/10.1109/jiot.2022.3155355
Bkakria A , Cuppens N , Cuppens F . Privacy-preserving pattern matching on encrypted data [C ] // Proceedings of the 26th International Conference on the Theory and Application of Cryptology and Information Security . Heidelberg : Springer , 2020 : 191 - 220 . DOI: 10.1007/978-3-030-64834-3_7 http://dx.doi.org/10.1007/978-3-030-64834-3_7
Desmoulins N , Fouque P A , Onete C , et al . Pattern matching on encrypted streams [C ] // Proceedings of the 24th International Conference on the Theory and Application of Cryptology and Information Security . Heidelberg : Springer , 2018 : 121 - 148 . DOI: 10.1007/978-3-030-03326-2_5 http://dx.doi.org/10.1007/978-3-030-03326-2_5
Liu Qin , Peng Yu , Jiang Hongbo , et al . SlimBox: Lightweight packet inspection over encrypted traffic [J ] . IEEE Transactions on Dependable and Secure Computing , 2023 , 20 ( 5 ): 4359 - 4371 . DOI: 10.1109/tdsc.2022.3222533 http://dx.doi.org/10.1109/tdsc.2022.3222533
Yao Jing , Meng Xiangyi , Zheng Yifeng , et al . Privacy-preserving content-based similarity detection over in-the-cloud middleboxes [J ] . IEEE Transactions on Cloud Computing , 2023 , 11 ( 2 ): 1854 - 1870 . DOI: 10.1109/tcc.2022.3169329 http://dx.doi.org/10.1109/tcc.2022.3169329
Guo Yu , Wang Cong , Jia Xiaohua . Enabling secure and dynamic deep packet inspection in outsourced middleboxes [C ] // Proceedings of the 6th International Workshop on Security in Cloud Computing . New York : ACM , 2018 : 49 - 55 . DOI: 10.1145/3201595.3201601 http://dx.doi.org/10.1145/3201595.3201601
Guo Yu , Wang Mingyue , Wang Cong , et al . Privacy-preserving packet header checking over in-the-cloud middleboxes [J ] . IEEE Internet of Things Journal , 2020 , 7 ( 6 ): 5359 - 5370 . DOI: 10.1109/jiot.2020.2978261 http://dx.doi.org/10.1109/jiot.2020.2978261
Kim J , Camtepe S , Baek J , et al . P2DPI: Practical and privacy-preserving deep packet inspection [C ] // Proceedings of 2021 ACM Asia Conference on Computer and Communications Security . New York : ACM , 2021 : 135 - 146 . DOI: 10.1145/3433210.3437525 http://dx.doi.org/10.1145/3433210.3437525
Long Zhentao , Wu Pengfei , Zhang Kai , et al . Verifiable and privacy-preserving deep packet inspection for multiple rule service providers [C ] // Proceedings of the 21st International Conference on Information Security and Cryptology . Heidelberg : Springer , 2025 : 275 - 295 . DOI: 10.1007/978-981-95-6203-9_15 http://dx.doi.org/10.1007/978-981-95-6203-9_15
Feng Jingyu , Zhang Jing , Zhang Wenbo , et al . Detecting malicious encrypted traffic with privacy set intersection in cloud-assisted industrial internet [J ] . Journal of Information Security and Applications , 2024 , 85 : 103831 . DOI: 10.1016/j.jisa.2024.103831 http://dx.doi.org/10.1016/j.jisa.2024.103831
Deng Minjun , Zhang Kai , Wu Pengfei , et al . DCDPI: Dynamic and continuous deep packet inspection in secure outsourced middleboxes [J ] . IEEE Transactions on Cloud Computing , 2023 , 11 ( 4 ): 3510 - 3524 . DOI: 10.1109/tcc.2023.3293134 http://dx.doi.org/10.1109/tcc.2023.3293134
Zhou Chengjin , Xiang Qiao , Pu Lingjun , et al . NetDPI: Efficient deep packet inspection via filtering-plus-verification in programmable 5G data plane for multi-access edge computing [J ] . IEEE Transactions on Mobile Computing , 2024 , 23 ( 12 ): 15031 - 15047 . DOI: 10.1109/tmc.2024.3450691 http://dx.doi.org/10.1109/tmc.2024.3450691
Shen Meng , Wu Jinhe , Ye Ke , et al . Robust detection of malicious encrypted traffic via contrastive learning [J ] . IEEE Transactions on Information Forensics and Security , 2025 , 20 : 4228 - 4242 . DOI: 10.1109/TIFS.2025.3560560 http://dx.doi.org/10.1109/TIFS.2025.3560560
Allami A , Nicewarner T , Goss K , et al . Oblivious and distributed firewall policies for securing firewalls from malicious attacks [J ] . Computers & Security , 2025 , 150 : 104201 . DOI: 10.1016/j.cose.2024.104201 http://dx.doi.org/10.1016/j.cose.2024.104201
谢丽霞 , 魏晨阳 , 杨宏宇 , 等 . 基于多维度动态加权alpha图像融合与特征增强的恶意软件检测方法 [J ] . 电子学报 , 2025 , 53 ( 3 ): 849 - 863 .
Xie Lixia , Wei Chenyang , Yang Hongyu , et al . Malware detection method based on multi-dimensional dynamic weighted alpha image fusion and feature enhancement [J ] . Acta Electronica Sinica , 2025 , 53 ( 3 ): 849 - 863 . (in Chinese)
Fu Chuanpu , Li Qi , Shen Meng , et al . Frequency domain feature based robust malicious traffic detection [J ] . ACM Transactions on Networking , 2023 , 31 ( 1 ): 452 - 467 . DOI: 10.1109/tnet.2022.3195871 http://dx.doi.org/10.1109/tnet.2022.3195871
Fu Chuanpu , Li Qi , Xu Ke . Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis [C ] // Proceedings of the 30th Annual Network and Distributed System Security Symposium . San Diego : The Internet Society , 2023 : 1 - 18 . DOI: 10.14722/ndss.2023.23080 http://dx.doi.org/10.14722/ndss.2023.23080
Bartusek J , Garg S , Jain A , et al . End-to-end secure messaging with traceability only for illegal content [C ] // Proceedings of the 42nd Annual International Conference on the Theory and Applications of Cryptographic Techniques . Heidelberg : Springer , 2023 : 35 - 66 . DOI: 10.1007/978-3-031-30589-4_2 http://dx.doi.org/10.1007/978-3-031-30589-4_2
Naor M , Reingold O . Number-theoretic constructions of efficient pseudo-random functions [J ] . Journal of the ACM , 2004 , 51 ( 2 ): 231 - 262 . DOI: 10.1145/972639.972643 http://dx.doi.org/10.1145/972639.972643
Pagh R , Rodler F F . Cuckoo hashing [J ] . Journal of Algorithms , 2004 , 51 ( 2 ): 122 - 144 . DOI: 10.1016/j.jalgor.2003.12.002 http://dx.doi.org/10.1016/j.jalgor.2003.12.002
Xie Yumeng , Fan Qing , Zhang Chuan , et al . Accountable and secure threshold EdDSA signature and its applications [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 7033 - 7046 . DOI: 10.1109/tifs.2024.3428848 http://dx.doi.org/10.1109/tifs.2024.3428848
Anon . Cuckoo filter [EB/OL ] . [ 2025-11-14 ] . https://github.com/axiomhq/rust-cuckoofilter.git https://github.com/axiomhq/rust-cuckoofilter.git .
Anon . mcl [EB/OL ] . [ 2025-11-14 ] . https://github.com/herumi/mcl.git https://github.com/herumi/mcl.git .
Anon . OpenSSL implementation integrating MT-DPI with TLS [EB/OL ] . [ 2025-11-14 ] . https://github.com/mt-dpi/openssl-integration.git https://github.com/mt-dpi/openssl-integration.git .
0
浏览量
6
下载量
0
CSCD
关联资源
相关文章
相关作者
相关机构
京公网安备11010802024621