Abstract:At present, the TLS cryptographic protocol is widely deployed. While protecting the security and integrity of transmitted information, it also makes the detection of malicious behavior more difficult. In recent years, researchers have proposed many encrypted malicious traffic detection methods. However, the existing approaches have some shortcomings. Firstly, although researchers have extracted multi-view features from different aspects, which can be divided into vectorized features based on feature engineering and image features based on original data, existing methods cannot fully integrate the features of different forms of expression. Secondly, most of the existing methods do not fully analyze the correlation between different encrypted traffic. Thirdly, the existing methods based on correlation analysis have low processing efficiency and cannot be applied to real networks. In the paper, we present MalDiscovery , a novel technique to discover encrypted malicious traffic to address all the above issues. For encrypted malicious traffic, MalDiscovery constructs an attribute KNN graph, in which encrypted sessions are used as nodes to construct a KNN graph according to the similarity of image features, and vectorized features are used as attributes of corresponding nodes. After that, the GraphSAGE model is used to collect relevant node information through correlation analysis to enrich the embeddings of each node. Finally, we achieve the accurate binary classification of nodes in the graph based on richer embeddings. We use extensive experiments to evaluate the proposed method, and the experiment results show that MalDiscovery can achieve an accuracy of about 99.9%, significantly outperforming all compared methods.

Encrypted Malicious Traffic Detection Based on Word2Vec

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

Research on Malicious Traffic Detection Based on Word Embedding Algorithms and Neural Networks

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

An Encrypted Malicious Traffic Detection System Based on Neural Network

Feature Analysis of Encrypted Malicious Traffic

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

A Communication-Channel-based Method for Detecting Deeply Camouflaged Malicious Traffic

TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel

A Survey of Encrypted Malicious Traffic Detection*

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Spatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Convolutional neural network-based identification of malicious traffic for TLS encryption

Deciphering Malware's use of TLS (without Decryption)

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

Active and Passive Attack Detection Methods for Malicious Encrypted Traffic

Classifying Tor Traffic Encrypted Payload Using Machine Learning