Abstract:In the studies of intrusion detection/prevention systems (IDS/IPS) and network security situational awareness, malicious traffic detection has been given significantly more attention to prevent malicious traffic. Meanwhile, with the development of machine learning technology, an increasing number of algorithms and models have been employed for attack detection. Previous studies generally used common and typical machine learning models such as SVM, KNN, or a random forest. However, the bottleneck of these types of approaches is two-fold. The input of the model is constructed using the feature engineering method of artificially designed representation, which requires a substantial amounts expertise. Additionally, most detection methods ignore the temporal information between network packets in one micro-flow. In this paper, we regard malicious traffic detection as a classification task and propose a hybrid model that combines a recurrent neural network (RNN) with restricted Boltzmann machines (RBM) which take byte-level raw data as input without feature engineering. Specifically, distributed embedding is utilized to pre-process network data to make it more suitable for deep neural network models. Subsequently, an RBM model is used to extract the feature vectors of the network packets and an RNN model is used to extract the flow feature vector. Finally, the flow vectors are sent to the Softmax layer to obtain the detection result. Experiments based on the ISCX-2012 and DARPA-1998 published datasets show that our proposed RNN-RBM model has a greater detection accuracy, recall rate, and lower false alarm rate than most traditional machine learning models. This proves the effectiveness of the proposed RNN-RBM model in malicious traffic detection.

Research on Malicious Traffic Detection Based on Word Embedding Algorithms and Neural Networks

Abnormal Network Traffic Detection Algorithm Based on Improved Convolutional Neural Network

An Encrypted Malicious Traffic Detection System Based on Neural Network

Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection

HTTP Malicious Traffic Detection Method Based on Hybrid Structure Deep Neural Network

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Encrypted Malicious Traffic Detection Based on Word2Vec

Detecting Malicious Web Requests Using an Enhanced TextCNN.

Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

A Survey of Encrypted Malicious Traffic Detection*

GraphMal: A Network Malicious Traffic Identification Method Based on Graph Neural Network

ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism

Malicious URL Detection Based on Improved Multilayer Recurrent Convolutional Neural Network Model

A Method Of Http Malicious Traffic Detection On Mobile Networks

Malicious Traffic Classification in WSN using Deep Learning Approaches

Effective detection of mobile malware behavior based on explainable deep neural network

Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

Malicious Encrypted Traffic Features Extraction Model Based on Unsupervised Feature Adaptive Learning

Detecting unknown HTTP-based malicious communication behavior via generated adversarial flows and hierarchical traffic features

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics