MF-Net: Encrypted Malicious Traffic Detection Based on Multi-flow Temporal Features

Malicious attacks on the network continue to increase, seriously undermining cyberspace security. As the cost of Transport Layer Security(TLS) deployment decreases, attackers generally use encrypted traffic for camouflage to avoid network intrusion detection. Existing malicious traffic detection methods mainly focus on extracting traffic features at the single-flow level, but they have lost their effectiveness due to frequent malware updates and traffic obfuscation. In this paper, we propose MF-Net, an encrypted malicious traffic detection method based on multi-flow temporal features. We present a traffic representation named Multi-Flow Bytes Picture (MFBytesPic), which leverages the temporal features among multiple flows. Using MFBytesPic, we design a powerful Siamese Neural Network based classifier to effectively identify malicious traffic. In order to prove the effectiveness of MF-Net, we use a public dataset provided by Qi An Xin for experimental evaluation. Experimental results show that MF-Net outperforms Graph Neural Network based multi-flow method. MF-Net can achieve 98.13% accuracy and 98.10% F1 score using 5 flows, which enables effective encrypted malicious traffic detection.