ERNN: Error-Resilient RNN for Encrypted Traffic Detection towards Network-Induced Phenomena
Ziming Zhao,Zhaoxuan Li,Jialun Jiang,Fengyuan Yu,Fan Zhang,Congyuan Xu,Xinjie Zhao,Rui Zhang,Shize Guo
DOI: https://doi.org/10.1109/tdsc.2023.3242134
2023-01-01
IEEE Transactions on Dependable and Secure Computing
Abstract:Traffic detection systems based on machine learning have been proposed to defend against cybersecurity threats, such as intrusion attacks and malware. However, they did not take the impact of network-induced phenomena into consideration, such as packet loss, retransmission, and out-of-order. These phenomena will introduce additional misclassifications in the real world. In this paper, we present ${sf ERNN}$, a robust and end-to-end RNN model that is specially designed against network-induced phenomena. As its core, ${sf ERNN}$ is designed with a novel gating unit named as session gate that includes: (i) four types of actions to simulate common network-induced phenomena during model training; and (ii) the Mealy machine to update states of session gate that adjusts the probability distribution of network-induced phenomena. Taken together, ${sf ERNN}$ advances state-of-the-art by realizing the model robustness for network-induced phenomena in an error-resilient manner. We implement ${sf ERNN}$ and evaluate it extensively on both intrusion detection and malware detection systems. By practical evaluation with dynamic bandwidth utilization and different network topologies, we demonstrate that ${sf ERNN}$ can still identify 98.63% of encrypted intrusion traffic when facing about 16% abnormal packet sequences on a 10 Gbps dataplane. Similarly, ${sf ERNN}$ can still robustly identify more than 97% of the encrypted malware traffic in multi-user concurrency scenarios. ${sf ERNN}$ can realize $sim$4% accuracy more than SOTA methods. Based on the Integrated Gradients method, we interpret the gating mechanism can reduce the dependencies on local packets (termed dependency dispersion). Moreover, we demonstrate that ${sf ERNN}$ possesses superior stability and scalability in terms of parameter settings and feature selection.
computer science, information systems, software engineering, hardware & architecture