Abstract:The desperate increase of mobile malware has constituted a severe threat to user privacy, economic life, and cyberspace security. Existing anti-malware solutions have notice-able weaknesses due to the adoption of content analysisbased approaches. The main limitation of these approaches is that they rely on careful expert engineering and professional handcrafted input features. Some researchers have tried to solve this limitation by using deep learning models to automatically learn feature representations from raw traffic. In this paper, we explore a deep learning detection framework based on self-attention to discriminate between malicious and benign network traffic. As a major advantage with respect to the state-of-the-art methods, we point out that the attention mechanism can better learn the underlying features of malicious traffic in terms of flows and bytes. We design a dual-branch deep learning method that consists of a flow importance-discrimination branch and a byte importance-discrimination branch. The flow importance-discrimination branch calculates the attentions between flows to obtain the feature contributions of different flows, and the byte importance-discrimination branch builds the feature contributions of diverse bytes by considering the connections among all bytes of network payload. Both flow features and byte features are combined to enhance the representation ability of network traffic behaviors generated by mobile applications (apps). We evaluate proposed method using a publicly available dataset including 55,992 malicious traffic traces and 47,779 benign traffic traces. The experimental results demonstrate that our method is able to identify malicious apps with high accuracy, outperforming the baseline methods and the popular deep-learning models.

A Method Of Http Malicious Traffic Detection On Mobile Networks

Detecting unknown HTTP-based malicious communication behavior via generated adversarial flows and hierarchical traffic features

HTTP Malicious Traffic Detection Method Based on Hybrid Structure Deep Neural Network

A method based on hierarchical spatiotemporal features for trojan traffic detection

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

ContraMTD: an Unsupervised Malicious Network Traffic Detection Method Based on Contrastive Learning

HSTF-Model: An HTTP-based Trojan detection model via the Hierarchical Spatio-temporal Features of Traffics

Multi-field Relation Mining for Malicious HTTP Traffic Detection Based on Attention and Cross Network

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

Research on Malicious Traffic Detection Based on Word Embedding Algorithms and Neural Networks

A Dual-Branch Self-attention Method for Mobile Malware Detection Via Network Traffic

Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection

Deep and Spatio-Temporal Detection for Abnormal Traffic in Cloud Data Centers

A Novel Malware Traffic Classification Method Using Semi-Supervised Learning.

A Fast and Effective Detection of Mobile Malware Behavior Using Network Traffic.

HTMTAD: A Model to Detect Anomalies of CDN Traffic Based on Improved HTM Network

Transformer-Based Malicious Traffic Detection for Internet of Things

APT Traffic Detection Based on Time Transform

Leveraging Zero-Payload Packets to Detect Mobile Malware Based on Network Traffic.

A Human-in-the-Loop Anomaly Detection Architecture for Big Traffic Data of Cellular Network

Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior