Encrypted Malware Detection Methodology without Decryption using Deep Learning based Approaches

Abstract

The proportion of encrypted web traffic is rapidly increasing. The widespread use of encrypted traffic on the Internet provides safe and secure communication between users and servers. However, cybercriminals are also employing encrypted traffic to conceal their malicious activities. Malware detection in encrypted traffic is an arduous task for security professionals due to the complex nature of encrypted traffic on the web. Traditional approaches need to decrypt the content of network traffic, check it for threats, re-encrypt the network traffic content, and send it to the server. This solution compromises the integrity of encryption and the user’s privacy and safety. DL is currently the most effective AI technology that can reduce the manual determination of feature sets to improve classification accuracy. This paper proposes a methodology by using DL algorithms for malware detection in encrypted traffic without decryption. With this architecture, the user’s privacy is maintained, and the efficiency of detecting threats in encrypted traffic is enhanced. Three deep learning techniques, namely, multilayer perceptron (MLP), 1D convolutional neural network (1-D CNN), and long short-term memory (LSTM), are tested on the CTU-13 malware dataset, which comprises flow based features of network traffic. Experimental results show that MLP based approach outperforms 1-D CNN, LSTM, and other existing approaches.

Self-Healing Networks: Adaptive Responses to Ransomware Attacks

“…The concept of network segmentation gained traction as a means to limit lateral movement within networks, a technique found particularly effective in large-scale enterprise environments, while encryption protocols, such as SSL/TLS, were widely adopted for securing data transmission, marking a shift towards data-centric security models [16,19,21]. With the advent of cloud computing, researchers explored security implications unique to cloud environments, leading to the development of specialized cloud security solutions [22,23]. The principle of least privilege was rigorously applied in access control models, significantly reducing the risk of unauthorized access to critical systems [2,21,24].…”