Abstract:As an important direction for the evolution of next-generation wireless communication technology, 6G will comprehensively promote the wave of economic and social digitization. Services carried by 6G network will rely heavily on the sharing and processing of massive amounts of data between entities, data security is therefore of great importance. Currently, most network applications utilize SSL/TLS protocols to ensure the confidentiality and security of network communications, while encryption mechanism also brings huge challenges to network security supervision. Though encrypted malicious traffic detection in traditional networks has become a research hotspot, existing technologies cannot be directly applied in 6G networks. In a 6G network with massive, instant and unlimited communications between heterogeneous terminals, network communication behavior patterns are much more diversified, which makes the boundary between normal traffic and malicious traffic more blurred in 6G networks than in traditional networks. Existing studies either analyze encrypted traffic in isolation or aggregation, while they all ignore the rich correlations among encrypted traffic. To this end, we propose an encrypted malicious traffic detection framework based on the graph neural network towards the network security problem of future 6G networks, ET-RSGAT. First, considering the characteristics of super high speed and super large connection of 6G network, we design a simple feature extraction method of encrypted traffic: extracting the TLS handshake raw bytes and TLS record length sequence for one single encrypted session. Second, in view of the correlations of large numbers of heterogeneous terminals and the coexistence of multi-source heterogeneous data communication in 6G networks, we analyze the correlations between encrypted sessions from 2 aspects, which are service correlations and communication behavior correlations. Then we construct an encrypted traffic graph, named ETG. On the basis of ETG, we introduce a graph attention network to utilize the correlations between encrypted sessions to enrich the feature representation of nodes. With rich representation, we build the detection model based on a multi-layer perceptron to identify threats. Considering that the simulation environment of 6G networks is immature, we deploy a variety of heterogeneous terminal nodes and run various network services to simulate the 6G communication scenario, and design related experiments for the interconnection of many heterogeneous terminals in 6G networks. The evaluation and experimental results show that our method can obtain satisfactory detection results in both traditional network and simulated environment datasets.

Encrypted Malware Traffic Detection Via Graph-based Network Analysis.

MateGraph: Toward Mobile Malware Detection Through Traffic Behavior Graph.

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Intelligent Malware Detection Based on Graph Convolutional Network

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

Discovering Malicious Signatures in Software from Structural Interactions

MalGraph: Hierarchical Graph Neural Networks for Robust Windows Malware Detection

Accurate Encrypted Malicious Traffic Identification via Traffic Interaction Pattern Using Graph Convolutional Network

Towards traffic supervision in 6G:a graph neural network-based encrypted malicious traffic detection method

Detecting malware based on DNS graph mining

GraphMal: A Network Malicious Traffic Identification Method Based on Graph Neural Network

Malware Detection with Directed Cyclic Graph and Weight Merging

An unknown malware detection scheme based on the features of graph

GCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection

A Survey on Malware Detection with Graph Representation Learning

A Survey of Encrypted Malicious Traffic Detection*

Detecting Malware Using Graph Embedding and DNN