Network Traffic Risk Identification Based on Deep Learning Model

In the realm of network traffic analysis, ensuring system security requires accurate identification of risks posed by various attacks. A notable trend is attackers’ exploitation of the HTTPs protocol to conceal malicious activities and evade detection. Current methods, tailored for predefined scenarios, struggle to detect unknown malicious traffic. These methods often rely solely on statistical features or raw bytes, limiting their effectiveness. Our research introduces a novel approach that seamlessly integrates raw byte information and statistical features to pinpoint camouflaged malware traffic within HTTPs flows. This approach consists of two interconnected sub-networks: PF-net, which extracts latent features from raw bytes, and RE-net, which reconstructs these features and determines an optimal threshold for accurate classification. Extensive experiments show our approach outperforms baseline methods on MTA and STRA datasets, achieving F1-scores of 0.849 and 0.935, respectively. An optimal threshold of 1.0 offers consistent performance, balancing false positives and negatives.