Anomaly detection in encrypted network traffic using self-supervised learning.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Traditional anomaly detection methods fail with encrypted traffic due to payload inspection limitations.
• Encryption enhances privacy but hinders the effectiveness of conventional security measures.
• Need for advanced techniques to detect anomalies in encrypted network communications.

Purpose of the Study:

• Introduce ET-SSL, a new method for anomaly detection in encrypted network traffic.
• Leverage self-supervised contrastive learning for effective anomaly identification.
• Develop a solution that bypasses the need for labeled datasets and payload analysis.

Main Methods:

• Utilize self-supervised contrastive learning to extract informative representations from flow-level statistical features.
• Employ packet length, inter-arrival time, flow duration, and protocol metadata for analysis.
• Extend SSL-based traffic classification to enhance detection performance with low computational complexity.

Main Results:

• Achieved 96.8% accuracy, 92.7% true positive rate (TPR), and 1.2% false positive rate (FPR) on benchmark datasets (CIC-Darknet2020, ISCX VPN, UNSW-NB15).
• Demonstrated real-time anomaly detection capabilities with 15-25 ms latency and processing speeds up to 10 Gbps.
• Effectively detects zero-day attacks in dynamic network environments.

Conclusions:

• ET-SSL provides a paradigm for private and energy-efficient anomaly detection in encrypted traffic.
• The method offers superior scalability and effectiveness compared to existing techniques, especially for zero-day threats.
• ET-SSL is suitable for high-speed, resource-constrained environments requiring robust security.