Malicious traffic constantly threatens the security and stability of networks. However, most existing identification methods based on traditional machine learning and deep learning leverage statistical features of an entire flow, which delays the identification. Although a few studies have started to focus on early identification, they do not make full use of flow information, resulting in issues with performance or timeliness. In this paper, we propose EAMTI, a novel method toward Early and Accurate Malicious Traffic Identification. We construct feature sequences based on byte frequency vectorization and directional information of bidirectional flows to represent network flows. Our representation method preserves rich packet-level information and flow-level sequential characteristics. A bidirectional Gated Recurrent Unit (GRU) model is constructed to process feature sequence samples and perform accurate identification. Our experimental results on the CICIDS2017 dataset show that EAMTI can construct representative feature sequences using only 6 initial packets, and it outperforms the existing methods in terms of accuracy, recall, precision, and F1-score.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

EAMTI: A Novel Method Toward Early and Accurate Malicious Traffic Identification

  • Yuyang Shen,
  • Jun Tao,
  • Linxiao Yu,
  • Yuantu Luo

摘要

Malicious traffic constantly threatens the security and stability of networks. However, most existing identification methods based on traditional machine learning and deep learning leverage statistical features of an entire flow, which delays the identification. Although a few studies have started to focus on early identification, they do not make full use of flow information, resulting in issues with performance or timeliness. In this paper, we propose EAMTI, a novel method toward Early and Accurate Malicious Traffic Identification. We construct feature sequences based on byte frequency vectorization and directional information of bidirectional flows to represent network flows. Our representation method preserves rich packet-level information and flow-level sequential characteristics. A bidirectional Gated Recurrent Unit (GRU) model is constructed to process feature sequence samples and perform accurate identification. Our experimental results on the CICIDS2017 dataset show that EAMTI can construct representative feature sequences using only 6 initial packets, and it outperforms the existing methods in terms of accuracy, recall, precision, and F1-score.