Abstract:At present, the TLS cryptographic protocol is widely deployed. While protecting the security and integrity of transmitted information, it also makes the detection of malicious behavior more difficult. In recent years, researchers have proposed many encrypted malicious traffic detection methods. However, the existing approaches have some shortcomings. Firstly, although researchers have extracted multi-view features from different aspects, which can be divided into vectorized features based on feature engineering and image features based on original data, existing methods cannot fully integrate the features of different forms of expression. Secondly, most of the existing methods do not fully analyze the correlation between different encrypted traffic. Thirdly, the existing methods based on correlation analysis have low processing efficiency and cannot be applied to real networks. In the paper, we present MalDiscovery , a novel technique to discover encrypted malicious traffic to address all the above issues. For encrypted malicious traffic, MalDiscovery constructs an attribute KNN graph, in which encrypted sessions are used as nodes to construct a KNN graph according to the similarity of image features, and vectorized features are used as attributes of corresponding nodes. After that, the GraphSAGE model is used to collect relevant node information through correlation analysis to enrich the embeddings of each node. Finally, we achieve the accurate binary classification of nodes in the graph based on richer embeddings. We use extensive experiments to evaluate the proposed method, and the experiment results show that MalDiscovery can achieve an accuracy of about 99.9%, significantly outperforming all compared methods.

A Survey of Encrypted Malicious Traffic Detection*

An Encrypted Malicious Traffic Detection System Based on Neural Network

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey.

Active and Passive Attack Detection Methods for Malicious Encrypted Traffic

A Deep‐learning‐ and Reinforcement‐learning‐based System for Encrypted Network Malicious Traffic Detection

Malicious Encrypted Traffic Features Extraction Model Based on Unsupervised Feature Adaptive Learning

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

Feature Analysis of Encrypted Malicious Traffic

Against Malicious SSL/TLS Encryption: Identify Malicious Traffic Based on Random Forest

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

A Survey on Encrypted Traffic Identification

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Encrypted Malicious Traffic Detection Based on Ensemble Learning

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

Adversarial Malicious Encrypted Traffic Detection Based on Refined Session Analysis

Spatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection

SSL Malicious Traffic Detection Based On Multi-view Features.