Abstract:As an important direction for the evolution of next-generation wireless communication technology, 6G will comprehensively promote the wave of economic and social digitization. Services carried by 6G network will rely heavily on the sharing and processing of massive amounts of data between entities, data security is therefore of great importance. Currently, most network applications utilize SSL/TLS protocols to ensure the confidentiality and security of network communications, while encryption mechanism also brings huge challenges to network security supervision. Though encrypted malicious traffic detection in traditional networks has become a research hotspot, existing technologies cannot be directly applied in 6G networks. In a 6G network with massive, instant and unlimited communications between heterogeneous terminals, network communication behavior patterns are much more diversified, which makes the boundary between normal traffic and malicious traffic more blurred in 6G networks than in traditional networks. Existing studies either analyze encrypted traffic in isolation or aggregation, while they all ignore the rich correlations among encrypted traffic. To this end, we propose an encrypted malicious traffic detection framework based on the graph neural network towards the network security problem of future 6G networks, ET-RSGAT. First, considering the characteristics of super high speed and super large connection of 6G network, we design a simple feature extraction method of encrypted traffic: extracting the TLS handshake raw bytes and TLS record length sequence for one single encrypted session. Second, in view of the correlations of large numbers of heterogeneous terminals and the coexistence of multi-source heterogeneous data communication in 6G networks, we analyze the correlations between encrypted sessions from 2 aspects, which are service correlations and communication behavior correlations. Then we construct an encrypted traffic graph, named ETG. On the basis of ETG, we introduce a graph attention network to utilize the correlations between encrypted sessions to enrich the feature representation of nodes. With rich representation, we build the detection model based on a multi-layer perceptron to identify threats. Considering that the simulation environment of 6G networks is immature, we deploy a variety of heterogeneous terminal nodes and run various network services to simulate the 6G communication scenario, and design related experiments for the interconnection of many heterogeneous terminals in 6G networks. The evaluation and experimental results show that our method can obtain satisfactory detection results in both traditional network and simulated environment datasets.

GCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

Abnormal Network Traffic Detection Algorithm Based on Improved Convolutional Neural Network

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

Towards traffic supervision in 6G:a graph neural network-based encrypted malicious traffic detection method

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

GCN-TC: Combining Trace Graph with Statistical Features for Network Traffic Classification

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism

CGNN: Traffic Classification with Graph Neural Network

TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification

Encrypted Malware Traffic Detection Via Graph-based Network Analysis.

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Flow-based Encrypted Network Traffic Classification with Graph Neural Networks

A Survey of Encrypted Malicious Traffic Detection*

Spatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis