TSFN: A Novel Malicious Traffic Classification Method Using BERT and LSTM.

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Traffic classification is crucial for network anomaly detection and security.
• Existing methods like statistical and deep learning approaches have limitations regarding feature engineering and data dependency.
• Current BERT-based methods overlook essential time-series traffic features.

Purpose of the Study:

• To propose a novel BERT-based Time-Series Feature Network (TSFN) model.
• To address limitations in existing malicious traffic classification methods.
• To improve the accuracy of detecting malicious network traffic.

Main Methods:

• A BERT model-based Packet encoder captures global traffic features using an attention mechanism.
• A Long Short-Term Memory (LSTM) model extracts temporal features from traffic.
• The TSFN model integrates global and time-series features for a comprehensive representation.

Main Results:

• The TSFN model effectively captures both global and time-series features of network traffic.
• Experimental results on the USTC-TFC dataset demonstrate significant improvements in classification accuracy.
• Achieved an F1 score of 99.50%, indicating high performance in malicious traffic classification.

Conclusions:

• Integrating time-series features significantly enhances malicious traffic classification accuracy.
• The proposed BERT-based TSFN model offers a robust solution for network security.
• This approach provides a more effective method for network anomaly detection.