Survey of encrypted malicious traffic detection based on deep learning

Mingfang ZHAI; Xingming ZHANG; Bo ZHAO

doi:10.11959/j.issn.2096-109x.2020034

您当前的位置：

首页 >

文章列表页 >

Survey of encrypted malicious traffic detection based on deep learning

Papers | 更新时间：2024-06-03

- Survey of encrypted malicious traffic detection based on deep learning
- Chinese Journal of Network and Information Security Vol. 6, Issue 3, Pages: 66-77(2020)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020034
  CLC： TP391.1
- Online First：2020-06，
  
  Published：15 June 2020
- 稿件说明：
移动端阅览
Mingfang ZHAI, Xingming ZHANG, Bo ZHAO. Survey of encrypted malicious traffic detection based on deep learning[J]. Chinese Journal of Network and Information Security, 2020, 6(3): 66-77.
DOI：

Mingfang ZHAI, Xingming ZHANG, Bo ZHAO. Survey of encrypted malicious traffic detection based on deep learning[J]. Chinese Journal of Network and Information Security, 2020, 6(3): 66-77. DOI： 10.11959/j.issn.2096-109x.2020034.

摘要

随着网络安全防范意识增强，加密通信占据主流，加密流量快速增长。流量加密在保护隐私的同时，也掩饰非法企图，改变威胁形式。深度学习作为机器学习领域的重要分支，是流量分类的有力工具。近年来，将深度学习方法应用于入侵检测的研究不断深入，取得良好效果。在深入调研文献的基础上，将加密恶意流量检测的步骤总结归纳为“六步法”的一般检测框架模型，结合模型对数据处理及检测算法进行回顾总结，指出各类算法模型的优缺点，并对未来研究方向进行展望，以期为下一步研究提供帮助。

Abstract

With the increasing awareness of network security

encrypted communication dominates and encrypted traffic grows rapidly.Traffic encryption

while protecting privacy

also masks illegal attempts and changes the form of threats.As one of the most important branch of machine learning

deep learning performs well in traffic classification.For several years

research on deep-learning based intrusion detection has been deepened and achieved good results.The steps of encrypted malicious traffic detection were introduced to be a general detection framework model named “six-step method”.Then

discussion and induction of data processing and detection algorithms were carried out combined with this model.Both advantages and disadvantages of various algorithm models were given as well.Finally

future research directions were pointed out with a view to providing assistance for further research.

关键词

Keywords

references

LV Y F . In 2018,lucky star network security report and trend outlook [J ] . Information Security Research , 2019 , 5 ( 3 ): 186 - 191 .

CNCERT 2018 China Internet network security situation report [R ] . 2018 .

GURUBARAN S . Cisco ETA–provides solution for detecting malware in encrypted traffic [EB ] .

LET’S ENCRYPT.Linux foundation collaborative projects [R ] .

HE G , XU B , ZHANG L , et al . Mobile app identification for encrypted network flows by traffic correlation [J ] . International Journal of Distributed Sensor Networks , 2018 , 14 ( 12 ): 1 - 17 .

ARNA M . Malware is moving heavily to HTTPS [EB ] .

BUJLOW T , CARELA-ESPAÑOL V BARLET-ROS P . Independent comparison of popular DPI tools for traffic classification [J ] . Computer Networks , 2015 , 76 : 75 - 89 .

WRIGHT C V , COULL S E , MONROSE F . Traffic morphing:an efficient defense against statistical traffic analysis [C ] // NDSS . 2009 : 237 - 250 .

VELAN P , ČERMÁK M , ČELEDA P , et al . A survey of methods for encrypted traffic classification and analysis [J ] . International Journal of Network Management , 2015 , 25 ( 5 ): 355 - 374 .

KRIZHEVSKY A , SUTSKEVER I , HINTON G . Imagenet classication with deep convolutional neural networks [J ] . Advances in neural information processing systems , 2012 , 25 ( 2 ): 84 - 90 .

CHO K , VAN-MERRIENBOER B , GULCEHRE C , et al . Learning phrase representations using RNN encoder-decoder for statistical machine translation [J ] . arXiv Preprint arXiv:1406.1078 , 2014

GRAVES A , MOHAMED A , HINTON G . Speech recognition with deep recurrent neural networks [C ] // 2013 IEEE International Conference on Acoustics,Speech and Signal Processing (ICASSP) . 2013 : 6645 - 6649 .

BYEONW , BREUEL T M , RAUE F , et al . Scene labeling with LSTM recurrent neural networks [C ] // IEEE Conference on Computer Vision and Pattern Recognition . 2015 : 3547 - 3555 .

VINAYAKUMAR R , SOMAN K P , POORNACHANDRAN P . Applying convolutional neural network for network intrusion detection [C ] // IEEE International Conference on Advances in Computing,Communications and Informatics (ICACCI) . 2017 : 1222 - 1228 .

WANG W , SHENG Y Q , WANGJL , et al . HAST-IDS:learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection [J ] . IEEE Access , 2018 , 6 : 1792 - 1806 .

YUAN X Y , LI C H , LI X L . Deep defense:identifying DDoS attack via deep learning [C ] // 2017 IEEE International Conference on Smart Computing . 2017 :18.

LI Z P , QIN Z , HUANG K , et al . Intrusion detection using convolutional neural networks for representation learning [M ] // Neural Information Processing . 2017 : 858 - 866 .

YIN C L , ZHU Y F , FEI J L , et al . A deep learning approach for intrusion detection using recurrent neural networks [J ] . IEEE Access , 2017 , 5 : 21954 - 21961 .

ANDERSON B , PAUL S , MCGREW D . Deciphering malware’s use of TLS (without decryption) [J ] . Comput.Virol.Hacking Techn , 2018 , 14 ( 3 ): 195 - 211 .

BLAKE A , DAVID M . Identifying encrypted malware traffic with contextual flow data [C ] // ACM Workshop on Artificial Intelligence and Security (AISec) . 2016 : 35 - 46 .

GUANCHENG TECHNOLOGY . A report on the country's first detection engine for encrypted traffic [EB ] .

HE G , XU B , ZHU H . AppFA:a novel approach to detect malicious Android applications on the network [J ] . Security and Communication Networks , 2018 : 1 - 15 .

SHABTAI A , TENENBOIM C L , MIMRAN D , et al . Mobile malware detection through analysis of deviations in application network behavior [J ] . Computers ＆ Security , 2014 , 43 : 1 - 18 .

GARG S , PEDDOJU S K , SARJE A K . Network-based detection of Android malicious Apps [J ] . International Journal of Information Security , 2017 , 16 ( 4 ): 385 - 400 .

REZAEI S , LIU X . Deep learning for encrypted traffic classification:an overview [J ] . IEEE Commun Mag , 2019 , 57 ( 5 ): 76 - 81 .

WANG W , ZHU M , WANG J , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // IEEE Int Conf Intell Security Informat . 2017 : 43 - 48 .

OKADA Y , ATA S , NAKAMURA N , et al . Comparisons of machine learning algorithms for application identification of encrypted traffic [C ] // 10th IEEE International Conference on Machine Learning and Applications and Workshops . 2011 : 358 - 361 .

ZHAO B , GUO H , LIU Q R , et al . Protocol independent identification of encrypted traffic based on weighted cumulative sum test [J ] . Journal of Software , 2013 , 24 ( 6 ): 1334 - 1345 .

NIU W N , ZHUO Z L , ZHANG X S , et al . A heuristic statistical testing based approach for encrypted network traffic identification [J ] . IEEE Trans.Veh.Technol. , 2019 ， 68 ( 4 ).

JAIN A V , . Network traffic identification with convolutional neural networks [C ] // 2018 IEEE 16th Intl Conf on Dependable,Autonomic and Secure Computing,Washington:IEEE Computer Society (DASC) . 2018 : 1001 - 1007 .

KARAGIANNIS T , PAPAGIANNAKI K , FALOUTSOS M . BLINK:multilevel traffic classification in the dark [C ] // SIGCOMM' 05 . 2005 : 229 - 239 .

GIL G D , LASHKARI A H , MAMUN M , et al . Characterization of encrypted and VPN trafc using time-related features [C ] // 2nd International Conference on Information Systems Security and Privacy (ICISSP 2016) . 2016 : 19 - 21 .

WANG W , ZENG X , YE X , et al . Malware traffic classification using convolutional neural network for representation learning [C ] // The 31st International Conference on Information Networking(ICOIN) . 2017 : 712 - 717 .

LOTFOLLAHI M , et al . Deep packet:a novel approach for encrypted traffic classification using deep learning [J ] . arXiv:1709.02656 , 2017

YUAN X , LI C , LI X , . Deepdefense:identifying DDoS attack via deep learning [C ] // 2017 IEEE International Conference Smart Computing (SMARTCOMP) . 2017 : 1 - 8 .

NYCHIS G , SEKAR V , ANDERSEN D , et al . An empirical evaluation of entropy-based traffic anomaly detection [J ] . The 8th ACM Computing Surveys , 2007 , 39 ( 1 ): 1 - 42 .

KOCH R , GOLLING M , RODOSEK G D . Behavior based intrusion detection in encrypted environments [J ] . Communications Magazine , 2014 , 52 ( 7 ): 124 - 131 .

IVAN T , LUIS D C , ALEJANDRO C B . Hunting malicious TLS certificates with deep neural networks [C ] // The 11th ACM Workshop on Articial Intelligence and Security . 2018 : 64 - 73 .

FRANTISEK S , SEBASTIAN G . Machine learning for network HTTPS analysis [C ] // BRUCON Conference . 2017 :5.

GHARIB A , SHARAFALDIN I , HABIBI L A , et al . An evaluation framework for intrusion detection dataset [C ] // 2016 International Conference on Information Science and Security (ICISS) . 2016 : 1 - 6 .

GUYON I , ELISSEEFF A . An introduction to variable and feature selection [J ] . Mach Learn Res , 2003 ( 3 ): 1157 - 1182 .

FERREIRA D C , VAZQUEZ F I , VORMAYR G , et al . A meta-analysis approach for feature selection in network traffic research [C ] // Reproducibility Workshop (Reproducibility’17) . 2017 : 17 - 20 .

PAN W B , CHENG G , GUO X J , et al . Review and perspective on encrypted traffic identification research [J ] . Journal on Communications , 2016 , 37 ( 9 ): 154 - 167 .

PATEL S , SONDHI J . A review of intrusion detection techniqueusing various technique of machine learning and feature optimization technique [J ] . International Journal of Computer Applications , 2014 , 93 ( 14 ): 43 - 47 .

MEGHDOURI F , ZSEBY T , IGLESIAS F . Analysis of lightweight feature vectors for attack detection in network traffic [J ] . Applied Sciences , 2018 , 8 ( 11 ):219.

PRASSE P , MACHLICA L , PEVNY T , et al . Malware detection by analysing encrypted network traffic with neural networks [C ] // European Conference on Machine Learning and Knowledge Discovery in Databases . 2017 : 73 - 88 .

TORROLEDO I , CAMACHO L D , BAHNSEN A C . Hunting malicious TLS certificates with deep neural networks [C ] // 11th ACM Workshop Artif.Intell.Secur . 2018 : 64 - 73 .

LOTFOLLAHI M , ZADE R S H , SIAVOSHANI M J , et al . Deep packet:a novel approach for encrypted traffic classification using deep learning [J ] . eprint arXiv:1709.02656 , 2017 .

PASCANU R , STOKES J W , SANOSSIAN H , et al . Malware classification with recurrent networks [C ] // 40th Int Conf on Acoustics,Speech and Signal Processing . 2015 : 1916 - 1920 .

ZENG Y , GU H , WEI W , et al . Deep-full-range:a deep learning based network encrypted traffic classification and intrusion detection framework [J ] . IEEE Access , 2019 :1.

REZAEI S , LIU X . How to achieve high classification accuracy with just a few labels:a semi-supervised approach using sampled packets [J ] . arXiv preprint arXiv:1812.09761 , 2018

ERMAN J , MAHANTI A , ARLITT M . Byte me:a case for byte accuracy in traffic classification [C ] // 3rd Annual ACM Workshop on Mining Network Data(MineNet ’07) . 2007 : 35 - 38 .

HE Y . Research on confrontational learning for industrial controlsystem intrusion detection [D ] . Zhejiang:Zhejiang University , 2019 .

Views

2873

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Encrypted traffic classification method based on convolutional neural network

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Multi-task adversarial attribution method based on hierarchical structure

Related Author

Rongna XIE

Zhuhong MA

Zongyu LI

Ye TIAN

Guo Kai

Wang Heng

Ma Ziqiang

HOU Ronghao

Related Institution

School of Information Engineering, Ningxia University

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Computer Science, Nanjing University of Posts and Telecommunications

⁰