Abstract:As an important direction for the evolution of next-generation wireless communication technology, 6G will comprehensively promote the wave of economic and social digitization. Services carried by 6G network will rely heavily on the sharing and processing of massive amounts of data between entities, data security is therefore of great importance. Currently, most network applications utilize SSL/TLS protocols to ensure the confidentiality and security of network communications, while encryption mechanism also brings huge challenges to network security supervision. Though encrypted malicious traffic detection in traditional networks has become a research hotspot, existing technologies cannot be directly applied in 6G networks. In a 6G network with massive, instant and unlimited communications between heterogeneous terminals, network communication behavior patterns are much more diversified, which makes the boundary between normal traffic and malicious traffic more blurred in 6G networks than in traditional networks. Existing studies either analyze encrypted traffic in isolation or aggregation, while they all ignore the rich correlations among encrypted traffic. To this end, we propose an encrypted malicious traffic detection framework based on the graph neural network towards the network security problem of future 6G networks, ET-RSGAT. First, considering the characteristics of super high speed and super large connection of 6G network, we design a simple feature extraction method of encrypted traffic: extracting the TLS handshake raw bytes and TLS record length sequence for one single encrypted session. Second, in view of the correlations of large numbers of heterogeneous terminals and the coexistence of multi-source heterogeneous data communication in 6G networks, we analyze the correlations between encrypted sessions from 2 aspects, which are service correlations and communication behavior correlations. Then we construct an encrypted traffic graph, named ETG. On the basis of ETG, we introduce a graph attention network to utilize the correlations between encrypted sessions to enrich the feature representation of nodes. With rich representation, we build the detection model based on a multi-layer perceptron to identify threats. Considering that the simulation environment of 6G networks is immature, we deploy a variety of heterogeneous terminal nodes and run various network services to simulate the 6G communication scenario, and design related experiments for the interconnection of many heterogeneous terminals in 6G networks. The evaluation and experimental results show that our method can obtain satisfactory detection results in both traditional network and simulated environment datasets.

A green computing method for encrypted IoT traffic recognition based on traffic fingerprint graphs

L-GraphSAGE: A Graph Neural Network-Based Approach for IoV Application Encrypted Traffic Identification

Edge Intelligence Based Identification and Classification of Encrypted Traffic of Internet of Things

Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks

TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification

FG-SAT: Efficient Flow Graph for Encrypted Traffic Classification under Environment Shifts

APT Encrypted Traffic Detection Method based on Two-Parties and Multi-Session for IoT

An encrypted traffic identification method based on multi-scale feature fusion

Bidirectional Flow-Based Image Representation Method for Detecting Network Traffic Service Categories

TGPrint: Attack Fingerprint Classification on Encrypted Network Traffic Based Graph Convolution Attention Networks

Accurate mobile-app fingerprinting using flow-level relationship with graph neural networks

Towards traffic supervision in 6G:a graph neural network-based encrypted malicious traffic detection method

Inferring Hidden IoT Devices and User Interactions Via Spatial-Temporal Traffic Fingerprinting

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

MATEC: A lightweight neural network for online encrypted traffic classification

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

Fingerprinting Mainstream IoT Platforms Using Traffic Analysis

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis

IoTTFID: An Incremental IoT Device Identification Model Based on Traffic Fingerprint

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach