Abstract:In recent years, with the widespread use of encrypted traffic communication technology, network traffic encryption has been gradually becoming a standard of communication. This phenomenon has a great impact on traditional traffic detection methods, especially on anomaly detection methods, which are highly dependent on the type of network protocol types and traffic data. By surveying the existing encrypted traffic classification and analyzing these methods, we found that there are two main methods for detection: payload-based detection and feature-based detection. On this basis, this paper puts forward an Encrypted Malicious Traffic Detection System which is based on multi-AEs(Autoencoder). We use malicious sandbox for traffic data collection, mark malicious flow and normal flow with labels. After that, we use multilayer networks of AEs for feature extraction and training classifier model. Our system analyzes the feature of cryptographic protocol from handshake phase to Authentication phase on the basis of existing research, and we extract the traffic feature for a better classification by further expanding flow feature vector to the higher dimensions. In addition, we compared the performance of our model with the traditional learning model under the same environment. The experimental results showed that our system had higher detection accuracy and lower loss rate. We also studied the influence of dataset imbalance on results in the detection of encrypted traffic by several experiments. According to the experimental evaluation, dataset imbalance will lead to the decrease of positive rate.

ARCA: Traffic Classification Method Based on Automatic Reverse and Cluster Analysis

Automatic Protocol Reverse Engineering for Industrial Control Systems with Dynamic Taint Analysis

MCC: A Message and Command Correlation method for identifying new interactive protocols via session analyses

Encrypted Traffic Classification Based on Traffic Reconstruction

Unidirectional Encrypted Traffic Classification: A Survey

Composite Lightweight Traffic Classification System for Network Management

Characterizing Application Behaviors for Classifying P2p Traffic

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

Hybrid Internet Traffic Classification Technique

Real-Time P2P Traffic Identification

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

IP Packet-Level Encrypted Traffic Classification Using Machine Learning with a Light Weight Feature Engineering Method

Application traffic classification based on command exchange mode of TCP flows

Classifying encrypted traffic using adaptive fingerprints with multi-level attributes

REVERSE AUTOMATED ANALYSIS OF APT TROJAN NETWORK PROTOCOL

An Encrypted Malicious Traffic Detection System Based on Neural Network

APPCLASSIFIER - Automated App Inference on Encrypted Traffic via Meta Data Analysis.

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

Traffic Classification - Towards Accurate Real Time Network Applications

A Heuristic Statistical Testing Based Approach for Encrypted Network Traffic Identification.