Malicious Traffic Identification with Self-Supervised Contrastive Learning.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Increasing internet access has led to a surge in malicious network traffic.
• Existing malicious traffic identification methods often suffer from low accuracy and rely heavily on labeled data.

Purpose of the Study:

• To propose a novel malicious traffic identification method leveraging contrastive learning.
• To overcome the limitations of traditional methods that require labeled samples.
• To enhance the accuracy of malicious traffic identification by learning semantic features from unlabeled data.

Main Methods:

• A new malicious traffic feature extraction model based on the Transformer architecture is proposed.
• A self-attention mechanism within the Transformer model extracts byte-level features from malicious traffic.
• A bidirectional Gated Long Short-Term Memory (GLSTM) network is employed to capture temporal features.

Main Results:

• The proposed method demonstrates superior performance compared to state-of-the-art techniques.
• Experimental results show significant improvements in accuracy and F1 score.
• The contrastive learning approach effectively learns feature representations from unlabeled data.

Conclusions:

• The developed contrastive learning-based method offers a more accurate and efficient approach to malicious traffic identification.
• The integration of Transformer and GLSTM models effectively extracts both semantic and temporal features.
• This research contributes to improving network security in the face of escalating cyber threats.