Abstract:With the rapid increase in amount of network encrypted traffic and malware samples using encryption to evade identification, detecting encrypted malicious traffic presents challenges. The quality of the encrypted traffic sampling method directly affects the result of malware detection, but most existing machine learning methods for sampling flow-based encrypted traffic data are inherently inaccurate. To solve these problems, an innovative three-stage hierarchical sampling approach based on the improved density peaks clustering algorithm (THS-IDPC) is proposed to enhance the accuracy and efficiency of encrypted malicious traffic detection model. First, we propose an improved density peaks clustering algorithm based on grid screening, custom center decision value and mutual neighbor degree (DPC-GS-MND). In DPC-GS-MND, grid screening effectively reduces the computational complexity and mutual neighbor degree improves the clustering accuracy. Then, we extract and research the three categories features of encrypted traffic data related to malicious activities, and adopt a three-layer hierarchical clustering algorithm based on DPC-GS-MND. Finally, a three-stage sampling approach based on the three-layer hierarchical clustering algorithm (THS-IDPC) is proposed to sample the encrypted traffic data for further deep detection. The experimental results demonstrated that the proposed THS-IDPC is very effective to reduce normal traffic from massive network encrypted traffic simultaneously, and the encrypted malicious traffic detection model with THS-IDPC sampling method can detect multiple encrypted malicious traffic families with higher accuracy and efficiency. Meanwhile, DPC-GS-MND and THS-IDPC have good application prospects in network intrusion detection system under the big data environment.

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

A Survey of Encrypted Malicious Traffic Detection*

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

Feature Analysis of Encrypted Malicious Traffic

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Mobile Application Identification Over HTTPS Traffic Based on Multi-view Features

Spatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

Deep learning-based real-time VPN encrypted traffic identification methods

A Fingerprint Enhancement and Second-Order Markov Chain Based Malicious Encrypted Traffic Identification Scheme

Deep-Forest-Based Encrypted Malicious Traffic Detection

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

Convolutional neural network-based identification of malicious traffic for TLS encryption

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

THS-IDPC: A three-stage hierarchical sampling method based on improved density peaks clustering algorithm for encrypted malicious traffic detection

TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel