Abstract:Traffic detection systems based on machine learning have been proposed to defend against cybersecurity threats, such as intrusion attacks and malware. However, they did not take the impact of network-induced phenomena into consideration, such as packet loss, retransmission, and out-of-order. These phenomena will introduce additional misclassifications in the real world. In this paper, we present ${sf ERNN}$, a robust and end-to-end RNN model that is specially designed against network-induced phenomena. As its core, ${sf ERNN}$ is designed with a novel gating unit named as session gate that includes: (i) four types of actions to simulate common network-induced phenomena during model training; and (ii) the Mealy machine to update states of session gate that adjusts the probability distribution of network-induced phenomena. Taken together, ${sf ERNN}$ advances state-of-the-art by realizing the model robustness for network-induced phenomena in an error-resilient manner. We implement ${sf ERNN}$ and evaluate it extensively on both intrusion detection and malware detection systems. By practical evaluation with dynamic bandwidth utilization and different network topologies, we demonstrate that ${sf ERNN}$ can still identify 98.63% of encrypted intrusion traffic when facing about 16% abnormal packet sequences on a 10 Gbps dataplane. Similarly, ${sf ERNN}$ can still robustly identify more than 97% of the encrypted malware traffic in multi-user concurrency scenarios. ${sf ERNN}$ can realize $sim$4% accuracy more than SOTA methods. Based on the Integrated Gradients method, we interpret the gating mechanism can reduce the dependencies on local packets (termed dependency dispersion). Moreover, we demonstrate that ${sf ERNN}$ possesses superior stability and scalability in terms of parameter settings and feature selection.

CECoR-Net: A Character-Level Neural Network Model for Web Attack Detection.

KerbNet: A QoE-aware Kernel-Based Backdoor Attack Framework

Detecting Malicious Web Requests Using an Enhanced TextCNN.

ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism

Detecting command injection attacks in web applications based on novel deep learning methods

A Malicious Code Detection Method Based on Stacked Depthwise Separable Convolutions and Attention Mechanism

CANET: A hierarchical CNN-Attention model for Network Intrusion Detection

HDCBAN: Hybrid Neural Network for Network Intrusion Detection System

Anomaly-Based Web Attack Detection: A Deep Learning Approach

A revolutionary approach to use convolutional spiking neural networks for robust intrusion detection

Cybernet Model: A New Deep Learning Model for Cyber DDoS Attacks Detection and Recognition

Network Anomaly Intrusion Detection Based on Deep Learning Approach

CCBLA: a Lightweight Phishing Detection Model Based on CNN, BiLSTM, and Attention Mechanism

A New Hybrid Approach for C&C Channel Detection

Evolving Deep Convolutional Neural Network for Intrusion Detection Based on NEAT.

ERNN: Error-Resilient RNN for Encrypted Traffic Detection towards Network-Induced Phenomena

A novel architecture for web-based attack detection using convolutional neural network

Hybrid CNN-LSTM model combined with feature selection and SMOTE for detection of network attacks

Anomaly-Based Web Attack Detection

Malicious URL Detection Based on Improved Multilayer Recurrent Convolutional Neural Network Model

Neural-FacTOR: Neural Representation Learning for Website Fingerprinting Attack over TOR Anonymity