A novel encrypted traffic detection model based on detachable convolutional GCN-LSTM.

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Traditional methods struggle with encrypted malicious traffic due to limited feature extraction.
• Network encryption adoption necessitates advanced detection techniques.

Purpose of the Study:

• To propose an effective model for malicious encrypted traffic detection.
• To enhance the identification of structural and behavioral characteristics in encrypted flows.

Main Methods:

• Developed a Detachable Convolutional GCN-LSTM (DC-GL) model.
• Integrated protocol-layer and statistical traffic features into graph-structured data.
• Employed Graph Convolutional Network (GCN) for structural dependencies and Long Short-Term Memory (LSTM) for temporal dynamics.
• Incorporated detachable convolution and an attention mechanism for efficiency and feature enhancement.

Main Results:

• The DC-GL model demonstrated superior performance over mainstream approaches.
• Achieved higher accuracy, recall, and robustness in detecting malicious encrypted traffic.
• Exhibited faster convergence compared to existing methods.

Conclusions:

• The DC-GL model offers a promising and effective solution for malicious encrypted traffic detection.
• The integration of GCN, LSTM, detachable convolution, and attention mechanisms enhances detection capabilities.