FastDet: Detecting Encrypted Malicious Traffic Faster via Early Exit

Encrypted malicious traffic detection, which aims to identify encrypted malicious traffic from vast amounts of network traffic, is critical to network security. Existing detection techniques are difficult to improve detection speed to meet the needs of practical applications while ensuring high detection rates. This paper proposes a fast detection approach - FastDet, to detect encrypted malicious traffic. Based on the observation that the most of the network traffic is benign, FastDet designs an early exit mechanism in the detection, resulting in a significant increase in average detection time. The experimental results on four datasets show that FastDet achieves significant efficiency while maintaining comparable detection accuracy. The paper further illustrates the effectiveness of FastDet by discussing the characteristics of encrypted benign and malicious traffic samples.