AFF_CGE: Combined Attention-Aware Feature Fusion and Communication Graph Embedding Learning for Detecting Encrypted Malicious Traffic
Source abstract
Abstract
While encryption enhances data security, it also presents significant challenges for network traffic analysis, especially in detecting malicious activities. To tackle this challenge, this paper introduces combined Attention-aware Feature Fusion and Communication Graph Embedding Learning (AFF_CGE), an advanced representation learning framework designed for detecting encrypted malicious traffic. By leveraging an attention mechanism and graph neural networks, AFF_CGE extracts rich semantic information from encrypted traffic and captures complex relations between communicating nodes. Experimental results reveal that AFF_CGE substantially outperforms traditional methods, improving F1-scores by 5.3% through 22.8%. The framework achieves F1-scores ranging from 0.903 to 0.929 across various classifiers, exceeding the performance of state-of-the-art techniques. These results underscore the effectiveness and robustness of AFF_CGE in detecting encrypted malicious traffic, demonstrating its superior performance.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Internet Traffic Analysis and Secure E-voting · Network Security and Intrusion Detection · Cybercrime and Law Enforcement Studies
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Software, Nanchang University, Nanchang 330031, China
School of Software and Internet of Things Engineering, Jiangxi University of Finance and Economics, Nanchang 330013, China
Funding
National Natural Science Foundation of China · Natural Science Foundation of Jiangxi Province of China · Key Laboratory of Data Protection and Intelligent Management, Ministry of Education, Sichuan University · Jiangxi Provincial Key Laboratory of Data Security Technology · Finance Science and Technology Special “Contract System” Project of Jiangxi Province
References (31)
Show source-provided references
1. Lee, H.K., Malkin, T., and Nahum, E. (2007, January 24–26). Cryptographic strength of SSL/TLS servers: Current and recent practices. Proceedings of the 7th ACM SIGCOMM conference on Internet Measurement, San Diego, CA, USA.10.1145/1298306.1298318 ↗
2. (2023, December 25). Transparencyreport. Available online: https://transparencyreport.google.com/https/overview.
3. Nabeel, M. (2017, January 25–30). The many faces of end-to-end encryption and their security analysis. Proceedings of the 2017 IEEE International Conference on Edge Computing (EDGE), Honolulu, HI, USA.10.1109/IEEE.EDGE.2017.47 ↗
4. Etienne, L. (2024, July 28). Malicious Traffic Detection in Local Networks with Snort. Available online: https://infoscience.epfl.ch/handle/20.500.14299/42746.
5. (2024, July 28). Snort IDS. Available online: https://snort.org/.
6. Papadogiannaki, E., Deyannis, D., and Ioannidis, S. (2020, January 14–16). Head (er) hunter: Fast intrusion detection using packet metadata signatures. Proceedings of the 2020 IEEE 25th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), Pisa, Italy.10.1109/CAMAD50429.2020.9209308 ↗
7. Macedo, E. (2022). Signature-Based IDS for Encrypted C2 Traffic Detection. [Ph.D. Thesis, Universidade do Porto].
8. Hybrid intrusion detection and signature generation using deep recurrent neural networks10.1007/s00521-019-04187-9 ↗
9. Deep learning approach for detecting malicious activities over encrypted secure channels10.1109/ACCESS.2021.3064561 ↗
10. Lin, W., Wang, T., Chen, C., Zhao, Y., and Zhou, W. (2023, January 1–3). REDA: Malicious Traffic Detection Based on Record Length and Frequency Domain Analysis. Proceedings of the 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Exeter, UK.10.1109/TrustCom60117.2023.00101 ↗
11. Sundararajan, D. (2001). The Discrete Fourier Transform: Theory, Algorithms and Applications, World Scientific.10.1142/9789812810298 ↗
12. Machine learning for encrypted malicious traffic detection: Approaches, datasets and comparative study10.1016/j.cose.2021.102542 ↗
13. Malicious Encryption Traffic Detection Based on NLP
14. Liu, X., and Liu, J. (2021). Malicious traffic detection combined deep neural network with hierarchical attention mechanism. Sci. Rep., 11.10.1038/s41598-021-91805-z ↗
15. Ferriyan, A., Thamrin, A.H., Takeda, K., and Murai, J. (2022). Encrypted malicious traffic detection based on Word2Vec. Electronics, 11.10.3390/electronics11050679 ↗
16. Shi, Z., Luktarhan, N., Song, Y., and Yin, H. (2023). Tsfn: A novel malicious traffic classification method using bert and lstm. Entropy, 25.10.3390/e25050821 ↗
17. A review of recurrent neural networks: LSTM cells and network architectures10.1162/neco_a_01199 ↗
18. Gallagher, B.M., Iliofotou, M., Eliassi-Rad, T., and Faloutsos, M. (2010, January 14–19). Link homophily in the application layer and its usage in traffic classification. Proceedings of the 2010 Proceedings IEEE INFOCOM, San Diego, CA, USA.10.1109/INFCOM.2010.5462239 ↗
19. Fu, Z., Liu, M., Qin, Y., Zhang, J., Zou, Y., Yin, Q., and Duan, H. (2022, January 26–28). Encrypted malware traffic detection via graph-based network analysis. Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses, Limassol, Cyprus.10.1145/3545948.3545983 ↗
20. Graph based encrypted malicious traffic detection with hybrid analysis of multi-view features10.1016/j.ins.2023.119229 ↗
21. Ren, G., Cheng, G., and Fu, N. (2023). Accurate encrypted malicious traffic identification via traffic interaction pattern using graph convolutional network. Appl. Sci., 13.10.3390/app13031483 ↗
22. Flowmeter, Z. (2024, January 02). Zeek Flowmeter. Available online: https://github.com/zeek-flowmeter/zeek-flowmeter.
23. Zeek Network Security Monitor (2024, January 02). Zeek: The Network Security Monitor. Available online: https://github.com/zeek/zeek.
24. Qianxin Data Center (2024, January 02). Malicious Stream Data. Available online: https://datacon.qianxin.com/opendata/maliciousstream.
25. Yun, S., Jeong, M., Kim, R., Kang, J., and Kim, H.J. (2019). Graph transformer networks. arXiv.
26. GCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection10.1155/2022/4274139 ↗
27. Canadian Institute for Cybersecurity (2024, October 23). ISCX Botnet Dataset 2014. Available online: https://www.unb.ca/cic/datasets/botnet.html.
28. Kwon, H., and Kim, S. (2023). Dual-Mode Method for Generating Adversarial Examples to Attack Deep Neural Networks. IEEE Access.10.1109/ACCESS.2023.3245632 ↗
29. Adversarial image perturbations with distortions weighted by color on deep neural networks10.1007/s11042-022-12941-w ↗
30. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017). Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv.
31. Rauber, J., Brendel, W., and Bethge, M. (2017). Foolbox v0.8.0: A Python toolbox to benchmark the robustness of machine learning models. arXiv.