Graph-Based Detection of Encrypted Malicious Traffic with Spatio-Temporal Features

With the continuous advancement of information technology, the concerns regarding privacy and network communication security are growing. Many applications have adopted encryption to ensure the confidentiality of network communication. However, the use of encryption has also provided opportunities for attackers. Attackers have begun to use encryption to conceal malicious activities, which poses a significant challenge for traffic detection. Traditional traffic detection methods primarily operate at the packet-level or session-level granularity and often neglect to consider the interrelationships between multiple sessions, thereby falling short of capturing comprehensive communication patterns exhibited by malware. In the paper, we propose a graph-based detection of encrypted malicious traffic, known as HIG-RF. It utilizes the GraphSAGE algorithm to generate embedding, comprehensively capturing the behavior patterns of hosts. And then we use the Random Forest model to comprehensively assess the probability of host infection. Our experiments show that HIG-RF achieves over 98% classification accuracy and over 98.5% recall, outperforming other advanced models.