Abstract:The focus on privacy protection has brought much-encrypted network traffic. However, attackers always abuse traffic encryption to conceal malicious behaviors. Although researchers have proposed several enlightening detection methods, they must enhance the generalization ability or improve detection performance. Our inspiration is that the packet header fields, as do the underlying grammatical rules for constructing sentences, have a strict order. We consider the original packet as text and devise a robust approach with natural language processing and a deep learning model to improve the generalization ability and detection performance. We capture the critical keywords as characteristic representations of the traffic and design an adaptive domain generalization algorithm with a new loss function. It is robust against various datasets by generating more malicious samples to augment the minority of malicious samples. Simultaneously, we design an efficient feature selection algorithm, which obtains an optimal feature subset and reduces feature dimensions by 75.3%. To evaluate our work, we conducted extensive experiments with open-source datasets (CICIDS 2017, CICDDoS 2019, and USTC-TFC 2016), the synthetic dataset from IoT-23, and Internet backbone traffic (CERNET). Experimental results demonstrate that our proposal improves detection accuracy by up to 22.8% compared to others not using domain generalization algorithms and achieves an average detection latency of 0.67 s in the backbone. Besides, our work applies to the Industrial Internet of Things (IIoT) environment. It can be deployed at edge nodes to provide network security support for IIoT devices.

Domainobserver: A Lightweight Solution For Detecting Malicious Domains Based On Dynamic Time Warping

Domainwatcher: Detecting Malicious Domains Based On Local And Global Textual Features

Learning from Time Series with Outlier Correction for Malicious Domain Identification.

Detecting Malicious Domains with Behavioral Modeling and Graph Embedding

MalHunter: Performing a Timely Detection on Malicious Domains Via a Single DNS Query.

An Analysis of the Domain Names Linked to the Important World Events using a Longitudinal Measurement Approach

Detecting Malicious Websites in Depth through Analyzing Topics and Web-pages

A Malicious Domains Detection Method Based on File Sandbox Traffic

HANDOM : Heterogeneous Attention Network Model for Malicious Domain Detection

Malicious domain detection based on multiple-dimensional features

Detecting Domain-Flux Malware Using Dns Failure Traffic

Network Detection of Malicious Domain Name Based on Adversary Model

Detecting Malware Based on Expired Command-And-Control Traffic

Identifying Malicious Web Domains Using Machine Learning Techniques with Online Credibility and Performance Data.

Discovering Malicious Domains through Alias-Canonical Graph

Malware Domains Detection by Monitoring Group Activities

Detecting Malicious Domain Names with Abnormal WHOIS Records Using Feature-Based Rules

Towards a Deep Learning Approach for Detecting Malicious Domains

Adaptive Malicious Url Detection: Learning In The Presence Of Concept Drifts

Real-time Detection of Malicious Web Pages Based on Statistical Learning

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning