Abstract:The focus on privacy protection has brought much-encrypted network traffic. However, attackers always abuse traffic encryption to conceal malicious behaviors. Although researchers have proposed several enlightening detection methods, they must enhance the generalization ability or improve detection performance. Our inspiration is that the packet header fields, as do the underlying grammatical rules for constructing sentences, have a strict order. We consider the original packet as text and devise a robust approach with natural language processing and a deep learning model to improve the generalization ability and detection performance. We capture the critical keywords as characteristic representations of the traffic and design an adaptive domain generalization algorithm with a new loss function. It is robust against various datasets by generating more malicious samples to augment the minority of malicious samples. Simultaneously, we design an efficient feature selection algorithm, which obtains an optimal feature subset and reduces feature dimensions by 75.3%. To evaluate our work, we conducted extensive experiments with open-source datasets (CICIDS 2017, CICDDoS 2019, and USTC-TFC 2016), the synthetic dataset from IoT-23, and Internet backbone traffic (CERNET). Experimental results demonstrate that our proposal improves detection accuracy by up to 22.8% compared to others not using domain generalization algorithms and achieves an average detection latency of 0.67 s in the backbone. Besides, our work applies to the Industrial Internet of Things (IIoT) environment. It can be deployed at edge nodes to provide network security support for IIoT devices.

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

An Encrypted Malicious Traffic Detection System Based on Neural Network

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

A Distance-based Method for Building an Encrypted Malware Traffic Identification Framework

Encrypted Network Traffic Classification: A Data Driven Approach

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

Android Malware Classification Approach Based on Host-Level Encrypted Traffic Shaping

Identification of Malicious Encrypted Traffic Through Feature Fusion.

Analyzing Learning-based Encrypted Malware Traffic Classification with AutoML

A Survey of Encrypted Malicious Traffic Detection*

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

Against Malicious SSL/TLS Encryption: Identify Malicious Traffic Based on Random Forest

Feature Analysis of Encrypted Malicious Traffic

Classifying Tor Traffic Encrypted Payload Using Machine Learning

A Novel Flow-Vector Generation Approach for Malicious Traffic Detection

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

Certificate-aware Encrypted Traffic Classification Using Second-Order Markov Chain

Encrypted Malicious Traffic Detection Based on Ensemble Learning

A Novel Algorithm for Encrypted Traffic Classification Based on Sliding Window of Flow's First N Packets

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach