Abstract:At present, the TLS cryptographic protocol is widely deployed. While protecting the security and integrity of transmitted information, it also makes the detection of malicious behavior more difficult. In recent years, researchers have proposed many encrypted malicious traffic detection methods. However, the existing approaches have some shortcomings. Firstly, although researchers have extracted multi-view features from different aspects, which can be divided into vectorized features based on feature engineering and image features based on original data, existing methods cannot fully integrate the features of different forms of expression. Secondly, most of the existing methods do not fully analyze the correlation between different encrypted traffic. Thirdly, the existing methods based on correlation analysis have low processing efficiency and cannot be applied to real networks. In the paper, we present MalDiscovery , a novel technique to discover encrypted malicious traffic to address all the above issues. For encrypted malicious traffic, MalDiscovery constructs an attribute KNN graph, in which encrypted sessions are used as nodes to construct a KNN graph according to the similarity of image features, and vectorized features are used as attributes of corresponding nodes. After that, the GraphSAGE model is used to collect relevant node information through correlation analysis to enrich the embeddings of each node. Finally, we achieve the accurate binary classification of nodes in the graph based on richer embeddings. We use extensive experiments to evaluate the proposed method, and the experiment results show that MalDiscovery can achieve an accuracy of about 99.9%, significantly outperforming all compared methods.

SSL Malicious Traffic Detection Based On Multi-view Features.

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

Malicious Encrypted Traffic Features Extraction Model Based on Unsupervised Feature Adaptive Learning

Against Malicious SSL/TLS Encryption: Identify Malicious Traffic Based on Random Forest

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

A Survey of Encrypted Malicious Traffic Detection*

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

Deep-Forest-Based Encrypted Malicious Traffic Detection

Detecting Malicious TLS Network Traffic Based on Communication Channel Features

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

A Communication-Channel-based Method for Detecting Deeply Camouflaged Malicious Traffic

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

An Encrypted Malicious Traffic Detection System Based on Neural Network

Open Set Identification of Malicious Encrypted Traffic Based on Multi-Feature Fusion

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

Detecting Malignant TLS Servers Using Machine Learning Techniques

Encrypted Malicious Traffic Detection Based on Ensemble Learning

Mobile Application Identification Over HTTPS Traffic Based on Multi-view Features