Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics.

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Encrypted network traffic is growing exponentially, complicating malicious activity detection.
• Imbalanced data distribution and small-scale malicious traffic challenge existing detection methods.
• Current methods often fail to detect covert malicious behaviors due to reliance on single-feature classifications.

Purpose of the Study:

• To develop a novel semi-supervised approach for identifying malicious encrypted network traffic.
• To leverage multimodal traffic characteristics for enhanced detection capabilities.
• To improve the robustness and accuracy of detecting anomalies and unknown attacks in encrypted traffic.

Main Methods:

• A semi-supervised learning approach integrating sequence and topological traffic information.
• Dual neural networks for independent learning of sequence and topological features.
• A joint training strategy minimizing autoencoder reconstruction error and classification loss.
• A confidence-estimation module for enhanced detection of unknown attacks.

Main Results:

• The proposed method achieves a multifaceted representation of encrypted traffic by integrating sequence and topological information.
• The dual-feature extraction enhances the model's robustness in detecting anomalies.
• Outperformed existing models by 3.49% and 5.69% in F1 score at 1% and 0.1% labeling rates, respectively.
• Demonstrated effectiveness in detecting unknown attacks and performing under various training set label ratios.

Conclusions:

• The novel semi-supervised method effectively identifies malicious encrypted traffic using multimodal characteristics.
• Integrating sequence and topological features significantly improves detection accuracy, especially with limited labeled data.
• The approach offers a robust solution for detecting both known and unknown malicious activities in encrypted networks.