KTAG

KTAG is an AI-based traffic classification library of Kunpeng BoostKit for IDA. It can analyze encrypted traffic.

Figure 1 KTAG workflow

Encrypted Traffic Classification

Encrypted traffic classification includes flow aggregation, protocol detection, feature calculation, an AI engine, and a training tool package. It is optimized for Kunpeng features and can analyze both plaintext and encrypted traffic in real time. This addresses the limitations of conventional rule-based data distribution solutions that cannot analyze encrypted traffic, providing an end-to-end reference solution for the industry's common challenges.

Figure 2 Flow feature extraction

Figure 3 Encrypted traffic analysis

Key technologies:

Flow aggregation, protocol parsing, feature extraction, and AI inference.

Applicable scenarios:

Application classification, malicious content detection, traffic probe, etc.

Parent topic: Features