Malicious Encrypted Traffic Detection with Transformer and Dual-Layer Meta-update Incremental Learning
摘要
Malicious encrypted packet sequence (traffic) detection has long been a compelling yet challenging task. Current approaches for malicious encrypted packet detection utilize static pre-trained models that excel at identifying known malicious features. They fall short in dynamic environments where new types of encrypted attacks continuously emerge. Furthermore, existing methods heavily rely on the network itself to search for optimal parameters, lacking rigorous theoretical constraints to ensure that the parameters are optimized in the right direction. In this work, we try to tackle these challenges using two key designs. (1) We present a novel framework that captures fine-grained feature patterns while balancing the relationship between new and old data via incremental learning. (2) Based on rigorous mathematical proofs, we establish convergence bounds and stability guarantees to mitigate catastrophic forgetting while maintaining learning efficiency. Our method achieves state-of-the-art performance on three datasets.