Abstract:Malware traffic classification (MTC) is one of the important research topics in the field of cyber security. Existing MTC methods based on deep learning have been developed based on the assumption of enough high-quality samples and powerful computing resources. However, both are hard to obtain in real applications especially in availability of IoT. In this paper, we propose a few-shot MTC (FS-MTC) method combining knowledge transfer and neural architecture search (i.e. NAS-based FS-MTC) with limited training samples as well as acceptable computational resources, in order to mitigate the identified challenges. Specifically, our proposed method first converts the raw network traffic into traffic images through data pre-processing to serve as input data for the neural network. Second, we use neural architecture search to adaptively search for the effective feature extraction model on the source domain (including Edge-IIoTset, Bot-IoT, and benign USTC-TFC2016). Third, the searched model is pre-trained on source task to achieve the generic feature representation of malware traffic. Finally, we only use few-shot malware traffic samples to fine-tune the pre-trained model to quickly adapt to new types of MTC tasks in realistic network environments. The experimental results show that the proposed NAS-based FS-MTC method has great scalability and classification performance in different FS-MTC tasks, including 5-way K-shot USTC-TFC2016 dataset and 10-way K-shot CIC-IoT dataset. Compared with state-of-the-art methods in the field of malware classification, the proposed NAS-based FS-MTC has higher classification accuracy. Especially in the 1-shot case of the USTC-TFC2016 dataset, its average accuracy is as high as 86.91%.

A Novel Malware Traffic Classification Method Using Semi-Supervised Learning.

Malware Traffic Classification Using Domain Adaptation and Ladder Network for Secure Industrial Internet of Things

Self-Supervised Learning Malware Traffic Classification Based On Masked Auto-Encoder

A Cost-Sensitive Deep Learning-Based Approach for Network Traffic Classification

Enhanced Few-Shot Malware Traffic Classification via Integrating Knowledge Transfer With Neural Architecture Search

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

Detecting While Accessing:A Semi-Supervised Learning-Based Approach for Malicious Traffic Detection in Internet of Things

Malicious Traffic Classification in WSN using Deep Learning Approaches

Malware Analysis Using Machine Learning and Deep Learning Techniques

IoT Malware Network Traffic Classification using Visual Representation and Deep Learning

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

TSFN: A Novel Malicious Traffic Classification Method Using BERT and LSTM

DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

A SURVEY ON DEEP LEARNING TECHNIQUES FOR DARKNET TRAFFIC MALWARE DETECTION

Few-Shot Malware Classification via Attention-Based Transductive Learning Network

Analyzing Learning-based Encrypted Malware Traffic Classification with AutoML

Information and Communications Security: 21st International Conference, ICICS 2019, Beijing, China, December 15–17, 2019, Revised Selected Papers

Classifying Malware Represented As Control Flow Graphs Using Deep Graph Convolutional Neural Network

A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic.