A Few-Shot Malicious Encrypted Traffic Detection Approach Based on Model-Agnostic Meta-Learning

Abstract

Existing malicious encrypted traffic detection approaches need to be trained with many samples to achieve effective detection of a specified class of encrypted traffic data. With the rapid development of encryption technology, various new types of encrypted traffic are emerging and difficult to label. Therefore, it is an urgent problem to train a deep learning model using only a small number of samples to detect new classes of malicious encrypted traffic. This paper proposes a few-shot malicious encrypted traffic detection (FMETD) approach based on model-agnostic meta-learning (MAML), integrating feature selection and classification into an end-to-end framework. The FMETD approach first converts the raw traffic data into two-dimensional grayscale images. Then, FMETD trains a deep learning model (2D-CNN) using the MAML, which is to learn an optimal set of model initialization parameters for the model from a set of classification tasks consisting of grayscale images. The model with this set of parameters can detect new classes of maliciously encrypted traffic data efficiently with a few samples by a few iterations steps. The experimental results show that the FMETD approach has 99.8% accuracy for two-class classification encrypted traffic and 98.5% average accuracy for multi-classification. When the number of grayscale images of each class in the support set and validation set is reduced to 20, the accuracy of our approach to multi-class classification is 97.9% for new classes of traffic.

Artificial Intelligence-Based Anomaly Detection Technology over Encrypted Traffic: A Systematic Literature Review

“…In addition, CICFlowMeter considers the distribution of packet lengths and produces features such as average packet length, change in packet length, and entropy. Various research has proposed anomaly detection models over encrypted traffic using statistical features extracted by CICFlowMeter [20,[27][28][29][30][31][32]57].…”

“…[43] removed network packets that were not relevant to the detection of encrypted malicious traffic, such as Address Resolution Protocol and Internet Control Message Protocol packets, as well as redundant, corrupt, unnecessary, or incompletely captured information. In [24,30,39], the authors excluded special information, such as SNI and some header information, which they believed interfered with the classification of normal and abnormal data.…”

“…In particular, network traffic is typical time series data, so preprocessing is essential. Length normalization is generally essential in machine learning and deep learning, where models require input of the same length in [12,21,24,30,54] the data length was normalized to 784 bytes for the purpose of transforming one-dimensional data into two-dimensional data, and [26,34,50] generated the same length of input data for network traffic data through normalization to a user-specified length and used it for anomaly detection experiments.…”

“…Bakhshi et al [6] used one-hot encoding to convert categorical data to numeric data and then performed anomaly detection. Additionally, a method of converting network packets into two-dimensional tensors is used for models that require two-dimensional data as input, such as a 2D convolutional neural network (CNN) [24,30,45,54]. In addition, a method of converting two-dimensional array data into images can be used to utilize AI models specialized for images for network traffic-based anomaly detection [24,26,30,36,39,54].…”