BLATTA: Early Exploit Detection on Network Traffic with Recurrent Neural Networks

Abstract

Detecting exploits is crucial since the effect of undetected ones can be devastating. Identifying their presence on the network allows us to respond and block their malicious payload before they cause damage to the system. Inspecting the payload of network traffic may offer better performance in detecting exploits as they tend to hide their presence and behave similarly to legitimate traffic. Previous works on deep packet inspection for detecting malicious traffic regularly read the full length of application layer messages. As the length varies, longer messages will take more time to analyse, during which time the attack creates a disruptive impact on the system. Hence, we propose a novel early exploit detection mechanism that scans network traffic, reading only 35.21% of application layer messages to predict malicious traffic while retaining a 97.57% detection rate and a 1.93% false positive rate. Our recurrent neural network- (RNN-) based model is the first work to our knowledge that provides early prediction of malicious application layer messages, thus detecting a potential attack earlier than other state-of-the-art approaches and enabling a form of early warning system.

Network traffic prediction model based on ensemble empirical mode decomposition and multiple models

“…In recent years, with the development of deep learning theory, many network traffic prediction models based on deep learning have been proposed. These models include long short‐term memory (LSTM), 25,26 deep belief network (DBN), 27 convolutional neural network (CNN), 28 stacked autoencoders (SAE), 29 recurrent neural network (RNN), 30 and so forth. However, the training cost of regression prediction model based on deep learning is high, which requires a large number of training samples and time to achieve satisfactory degree.…”

Network traffic prediction method based on autoregressive integrated moving average and adaptive Volterra filter

“…These deep learning models include long shortterm memory, 20 deep belief network, 21 convolutional neural network (CNN), 22 and recurrent neural network (RNN). 23 Compared with the linear prediction model, the prediction performance of the nonlinear model has been improved, but it also has many shortcomings. The prediction model based on LSSVM or SVM needs small sample, but it is difficult to determine the key parameters of the prediction model.…”

“…In recent years, some network traffic models based on deep learning model are proposed and achieve some progress. These deep learning models include long short‐term memory, 20 deep belief network, 21 convolutional neural network (CNN), 22 and recurrent neural network (RNN) 23 . Compared with the linear prediction model, the prediction performance of the nonlinear model has been improved, but it also has many shortcomings.…”