Abstract:Encrypted network traffic is the principal foundation of secure network communication, and it can help ensure the privacy and integrity of confidential information. However, it hides the characteristics of the data, increases the difficulty of detecting malicious traffic, and protects such malicious behavior. Therefore, encryption alone cannot fundamentally guarantee information security. It is also necessary to monitor traffic to detect malicious actions. At present, the more commonly used traffic classification methods are the method based on statistical features and the method based on graphs. However, these two methods are not always reliable when they are applied to the problem of encrypted malicious traffic detection due to their limitations. The former only focuses on the internal information of the network flow itself and ignores the external connections between the network flows. The latter is just the opposite. This paper proposes an encrypted malicious traffic detection method based on a graph convolutional network (GCN) called GCN-ETA, which considers the statistical features (internal information) of network flows and the structural information (external connections) between them. GCN-ETA consists of two parts: a feature extractor that uses an improved GCN and a classifier that uses a decision tree. Improving on the traditional GCN, the effect and speed of encrypted malicious traffic detection can be effectively improved and the deployment of the detection model in the real environment is increased, which provides a reference for the application of GCN in similar scenarios. This method has achieved excellent performance in experiments using real-world encrypted network traffic data for malicious traffic detection, with the accuracy, AUC, and F1-score exceeding 98% and more than 1,300 flows detected per second.

AFF_CGE: Combined Attention-Aware Feature Fusion and Communication Graph Embedding Learning for Detecting Encrypted Malicious Traffic

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

Spatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection

GCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

Multi-Granularity Feature Fusion for Enhancing Encrypted Traffic Classification

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

MGEL: A Robust Malware Encrypted Traffic Detection Method Based on Ensemble Learning with Multi-grained Features

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

A Survey of Encrypted Malicious Traffic Detection*

An encrypted traffic identification method based on multi-scale feature fusion

FusionTC: Encrypted App Traffic Classification Using Decision-Level Multimodal Fusion Learning of Flow Sequence

SAFSN: A Self-Attention Based Neural Network for Encrypted Mobile Traffic Classification

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

Encrypted Application Classification with Convolutional Neural Network