Abstract:With the increasing dimensionality of network traffic, extracting effective traffic features and improving the identification accuracy of different intrusion traffic have become critical in intrusion detection systems (IDS). However, both unsupervised and semisupervised anomalous traffic detection methods suffer from the drawback of ignoring potential correlations between features, resulting in an analysis that is not an optimal set. Therefore, in order to extract more representative traffic features as well as to improve the accuracy of traffic identification, this paper proposes a feature dimensionality reduction method combining principal component analysis and Hotelling’s T2 and a multilayer convolutional bidirectional long short-term memory (MSC_BiLSTM) classifier model for network traffic intrusion detection. This method reduces the parameters and redundancy of the model by feature extraction and extracts the dependent features between the data by a bidirectional long short-term memory (BiLSTM) network, which fully considers the influence between the before and after features. The network traffic is first characteristically downscaled by principal component analysis (PCA), and then the downscaled principal components are used as input to Hotelling’s T2 to compare the differences between groups. For datasets with outliers, Hotelling’s T2 can help identify the groups where the outliers are located and quantitatively measure the extent of the outliers. Finally, a multilayer convolutional neural network and a BiLSTM network are used to extract the spatial and temporal features of network traffic data. The empirical consequences exhibit that the suggested approach in this manuscript attains superior outcomes in precision, recall and F1-score juxtaposed with the prevailing techniques. The results show that the intrusion detection accuracy, precision, and F1-score of the proposed MSC_BiLSTM model for the CIC-IDS 2017 dataset are 98.71%, 95.97%, and 90.22%.

THS-IDPC: A three-stage hierarchical sampling method based on improved density peaks clustering algorithm for encrypted malicious traffic detection

A Survey of Encrypted Malicious Traffic Detection*

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Network Intrusion Detection Combined Hybrid Sampling With Deep Hierarchical Network

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Adversarial Malicious Encrypted Traffic Detection Based on Refined Session Analysis

HMMED: A Multimodal Model with Separate Head and Payload Processing for Malicious Encrypted Traffic Detection

HC-DTTSVM: A Network Intrusion Detection Method Based on Decision Tree Twin Support Vector Machine and Hierarchical Clustering

Network Intrusion Traffic Detection Based on Feature Extraction

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

Deep-Forest-Based Encrypted Malicious Traffic Detection

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

A method based on hierarchical spatiotemporal features for trojan traffic detection

3D-IDS: Doubly Disentangled Dynamic Intrusion Detection

Study on Privacy Preserving Encrypted Traffic Detection

Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic