Abstract:Malicious events pose a significant threat to the current increasingly interconnected Internet community. Detection based on features of network traffic and machine learning algorithms is a common approach to identify malicious events. The performance of approaches is associated with the used features and algorithms. In this paper, we propose MalFinder, an ensemble learning-based framework for malicious traffic detection. Considering the trend of network traffic encryption and the complexity of decrypting traffic, we utilize statistical features and sequence features to describe network traffic. We extend the dimensions of these two types of features to enhance their capability for representing traffic data. Feature importance analysis and contrast experiments illustrate the effectiveness of our new features. Among our selected classifiers suitable for malicious traffic detection, boosting-based classifiers XGBoost and LightGBM can reduce bias, and bagging-based classifier Random Forest can reduce variance. Stacking, which is the integration method of the classification results used in our framework, can improve the generalization ability of the method. MalFinder can achieve 96.58% F-measure and 95.44% accuracy in the malicious traffic detection task on a real-world dataset, whose results are better than those of comparison methods. In terms of unseen malicious traffic discovery, MalFinder still provides good performance with 93.46% F-measure and 91.04% accuracy, which even surpasses the results in the task of known malicious traffic detection of other comparative methods. With consideration of the scarcity of public data sets used for malicious traffic detection, we have exposed our self-built dataset for more extensive researches.

Identification of Malicious Encrypted Traffic Through Feature Fusion.

Open Set Identification of Malicious Encrypted Traffic Based on Multi-Feature Fusion

Network Traffic Classification Based on Multilevel Spatiotemporal Feature Fusion Enhancement

MLST-FENet: Network traffic classification based on multilevel spatiotemporal feature fusion enhancement

Multi-granularity Mobile Encrypted Traffic Classification Based on Fusion Features.

Encrypted Malicious Traffic Detection Based on Stacking and Multi-Feature Fusion

AFF_CGE: Combined Attention-Aware Feature Fusion and Communication Graph Embedding Learning for Detecting Encrypted Malicious Traffic

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

An Encrypted Malicious Traffic Detection System Based on Neural Network

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

MalFinder: An Ensemble Learning-based Framework For Malicious Traffic Detection

Meta-HFMD: A Hierarchical Feature Fusion Malware Detection Framework Via Multi-task Meta-learning

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

FusionTC: Encrypted App Traffic Classification Using Decision-Level Multimodal Fusion Learning of Flow Sequence

TCMal: A Hybrid Deep Learning Model for Encrypted Malicious Traffic Classification

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

A Distance-based Method for Building an Encrypted Malware Traffic Identification Framework

AS-DMF: A Lightweight Malware Encrypted Traffic Detection Method Based on Active Learning and Feature Selection

Feature Analysis of Encrypted Malicious Traffic