Cross-Layer Profiling of Encrypted Network Data for Anomaly Detection

Feature mining for encrypted malicious traffic detection with deep learning and other machine learning algorithms

“…Many authors have also proposed their novel feature creation approaches and grouping method to extract required features. Meghdouri et al [11] proposed a novel cross-layer feature representation of encrypted traffic under TLS and IPSec protocols. The authors defined three modes of extracting flows: Application flows, conversation flows, and End-point flows.…”

“…A novel cross-layer feature representation method under TLS and Internet Protocol Security (IPSec) protocols is proposed by Meghdouri et al [11] 7 different machine learning algorithms are selected from Stergiopoulos et al [12] to test the performance of their proposed Transmission Control Protocol (TCP) side channel features. 99.80% accuracy under the decision tree method is achieved under a composed dataset from CTU-13 [18], FIRST [20], and Milicenso [21].…”

“…Such an imagelike feature set is fed into CNN models. Although the features they created in [11] [6] are specific features for encrypted traffic, only TLS/SSL/IPSec protocols are considered. Once the traffic contains other encrypted protocols, such features are no longer applicable.…”