Abstract:Nowadays, most network traffic is encrypted, which protects user privacy but hides attack traces, further hindering identifying attacks to inspect traffic packages. Machine Learning(ML) methods are widely applied to attack classification on encrypted traffic owing to no need for manual analysis. However, existing studies only concentrate on basic statistical features and cannot obtain the crucial attack behaviors hiding in the encrypted traffic. Worse still, attackers constantly update attack vectors to evade detection, which means outdated features extracted from historical traffic fail to recognize unseen attacks. As a solution, we propose an attack classification approach, attack finger print based on g raphs of t ime-window ( TGPrint ). We first filter normal traffic flows using ML models to eliminate the impact of useless, noisy data for attack classification and maintain suspicious traffic. Then, we create attack graphs to depict interaction behaviors of attack-victim hosts from suspicious traffic containing crucial attack behaviors. Besides, we divide a specific duration for each attack to precisely elaborate attack graphs, where temporal, statistical, and aggregate features are extracted to portray attack behaviors. Finally, we utilize Graph Neural Networks (GNNs) to mine and grasp the crucial behavior patterns from attack graphs to generate fingerprints and classify attacks, even unseen attacks. Extensive experiments are conducted on well-known datasets to verify our approach. It achieves a precision of 99% in attack classification on encrypted traffic, an average higher than other ML methods of 50%. Meanwhile, it classifies unseen attacks with an average accuracy of over 80% and has a strong robustness to false positives.

MPAF: Encrypted Traffic Classification With Multi-Phase Attribute Fingerprint

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

Classifying encrypted traffic using adaptive fingerprints with multi-level attributes

MATEC: A lightweight neural network for online encrypted traffic classification

Multi-Granularity Feature Fusion for Enhancing Encrypted Traffic Classification

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis

Efficiently and Effectively: A Two-stage Approach to Balance Plaintext and Encrypted Text for Traffic Classification

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

Fine-Grained Webpage Fingerprinting Using Only Packet Length Information of Encrypted Traffic

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

Flow-MAE: Leveraging Masked AutoEncoder for Accurate, Efficient and Robust Malicious Traffic Classification

A Fingerprint Enhancement and Second-Order Markov Chain Based Malicious Encrypted Traffic Identification Scheme

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

FusionTC: Encrypted App Traffic Classification Using Decision-Level Multimodal Fusion Learning of Flow Sequence

Unveiling encrypted traffic types through hierarchical network characteristics

TGPrint: Attack Fingerprint Classification on Encrypted Network Traffic Based Graph Convolution Attention Networks

Classifying Tor Traffic Encrypted Payload Using Machine Learning