Abstract:In recent years, with the widespread use of encrypted traffic communication technology, network traffic encryption has been gradually becoming a standard of communication. This phenomenon has a great impact on traditional traffic detection methods, especially on anomaly detection methods, which are highly dependent on the type of network protocol types and traffic data. By surveying the existing encrypted traffic classification and analyzing these methods, we found that there are two main methods for detection: payload-based detection and feature-based detection. On this basis, this paper puts forward an Encrypted Malicious Traffic Detection System which is based on multi-AEs(Autoencoder). We use malicious sandbox for traffic data collection, mark malicious flow and normal flow with labels. After that, we use multilayer networks of AEs for feature extraction and training classifier model. Our system analyzes the feature of cryptographic protocol from handshake phase to Authentication phase on the basis of existing research, and we extract the traffic feature for a better classification by further expanding flow feature vector to the higher dimensions. In addition, we compared the performance of our model with the traditional learning model under the same environment. The experimental results showed that our system had higher detection accuracy and lower loss rate. We also studied the influence of dataset imbalance on results in the detection of encrypted traffic by several experiments. According to the experimental evaluation, dataset imbalance will lead to the decrease of positive rate.

MT-FlowFormer: A Semi-Supervised Flow Transformer for Encrypted Traffic Classification

Flow Transformer: A Novel Anonymity Network Traffic Classifier with Attention Mechanism

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

Flow-based Encrypted Network Traffic Classification with Graph Neural Networks

Yet Another Traffic Classifier: A Masked Autoencoder Based Traffic Transformer with Multi-Level Flow Representation.

FG-SAT: Efficient Flow Graph for Encrypted Traffic Classification under Environment Shifts

SAFSN: A Self-Attention Based Neural Network for Encrypted Mobile Traffic Classification

BFSN: A Novel Method of Encrypted Traffic Classification Based on Bidirectional Flow Sequence Network

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

Flow-MAE: Leveraging Masked AutoEncoder for Accurate, Efficient and Robust Malicious Traffic Classification

FusionTC: Encrypted App Traffic Classification Using Decision-Level Multimodal Fusion Learning of Flow Sequence

A Novel Self-Supervised Framework Based on Masked Autoencoder for Traffic Classification

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

An Encrypted Malicious Traffic Detection System Based on Neural Network

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification

A Novel Traffic Classifier with Attention Mechanism for Industrial Internet of Things

Few-shot encrypted traffic classification via multi-task representation enhanced meta-learning

SSCMT-ETC: A Semi-Supervised Contrastive Mean Teacher Model for Encrypted Traffic Classification

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder