Abstract:Malicious events pose a significant threat to the current increasingly interconnected Internet community. Detection based on features of network traffic and machine learning algorithms is a common approach to identify malicious events. The performance of approaches is associated with the used features and algorithms. In this paper, we propose MalFinder, an ensemble learning-based framework for malicious traffic detection. Considering the trend of network traffic encryption and the complexity of decrypting traffic, we utilize statistical features and sequence features to describe network traffic. We extend the dimensions of these two types of features to enhance their capability for representing traffic data. Feature importance analysis and contrast experiments illustrate the effectiveness of our new features. Among our selected classifiers suitable for malicious traffic detection, boosting-based classifiers XGBoost and LightGBM can reduce bias, and bagging-based classifier Random Forest can reduce variance. Stacking, which is the integration method of the classification results used in our framework, can improve the generalization ability of the method. MalFinder can achieve 96.58% F-measure and 95.44% accuracy in the malicious traffic detection task on a real-world dataset, whose results are better than those of comparison methods. In terms of unseen malicious traffic discovery, MalFinder still provides good performance with 93.46% F-measure and 91.04% accuracy, which even surpasses the results in the task of known malicious traffic detection of other comparative methods. With consideration of the scarcity of public data sets used for malicious traffic detection, we have exposed our self-built dataset for more extensive researches.

A Distance-based Method for Building an Encrypted Malware Traffic Identification Framework

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

MalFinder: An Ensemble Learning-based Framework For Malicious Traffic Detection

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Identification of Malicious Encrypted Traffic Through Feature Fusion.

A Novel Approach Based on Adaptive Online Analysis of Encrypted Traffic for Identifying Malware in IIoT

AS-DMF: A Lightweight Malware Encrypted Traffic Detection Method Based on Active Learning and Feature Selection

MalFCS: An effective malware classification framework with automated feature extraction based on deep convolutional neural networks

Android Malware Classification Approach Based on Host-Level Encrypted Traffic Shaping

Prototype-Based Malware Traffic Classification With Novelty Detection

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

An Encrypted Malicious Traffic Detection System Based on Neural Network

A Stacking-Based Classification Approach to Android Malware Using Host-Level Encrypted Traffic

Classification of Malware for Self-Driving Systems

Open Set Identification of Malicious Encrypted Traffic Based on Multi-Feature Fusion

Analyzing Learning-based Encrypted Malware Traffic Classification with AutoML

Imbalanced Malware Family Classification Using Multimodal Fusion and Weight Self-Learning

Malware traffic detection based on type II fuzzy recognition

Efficient Malware Originated Traffic Classification by Using Generative Adversarial Networks

Encrypted Malicious Traffic Detection Based on Stacking and Multi-Feature Fusion

Android Malware Identification Based on Traffic Analysis.