The popularity of encryption mechanisms poses a great challenge to malicious
traffic detection. The reason is traditional detection techniques cannot work
without the decryption of encrypted traffic. Currently, research on encrypted
malicious traffic detection without decryption has focused on feature
extraction and the choice of machine learning or deep learning algorithms. In
this paper, we first provide an in-depth analysis of traffic features and
compare different state-of-the-art traffic feature creation approaches, while
proposing a novel concept for encrypted traffic feature which is specifically
designed for encrypted malicious traffic analysis. In addition, we propose a
framework for encrypted malicious traffic detection. The framework is a
two-layer detection framework which consists of both deep learning and
traditional machine learning algorithms. Through comparative experiments, it
outperforms classical deep learning and traditional machine learning
algorithms, such as ResNet and Random Forest. Moreover, to provide sufficient
training data for the deep learning model, we also curate a dataset composed
entirely of public datasets. The composed dataset is more comprehensive than
using any public dataset alone. Lastly, we discuss the future directions of
this research.

本文提出了一种用于恶意加密流量分析的新型加密流量特征，并比较不同的特征提取方法，同时提出了一个加密恶意流量检测框架，该框架包括深度学习和传统机器学习算法，经实验表明，这个框架的检测效果优于传统的深度学习和机器学习算法。

使用深度学习和其他机器学习算法进行加密恶意流量检测的特征挖掘

Feature Mining for Encrypted Malicious Traffic Detection with Deep  Learning and Other Machine Learning Algorithms

As people's demand for personal privacy and data security becomes a priority,
encrypted traffic has become mainstream in the cyber world. However, traffic
encryption is also shielding malicious and illegal traffic introduced by
adversaries, from being detected. This is especially so in the post-COVID-19
environment where malicious traffic encryption is growing rapidly. Common
security solutions that rely on plain payload content analysis such as deep
packet inspection are rendered useless. Thus, machine learning based approaches
have become an important direction for encrypted malicious traffic detection.
In this paper, we formulate a universal framework of machine learning based
encrypted malicious traffic detection techniques and provided a systematic
review. Furthermore, current research adopts different datasets to train their
models due to the lack of well-recognized datasets and feature sets. As a
result, their model performance cannot be compared and analyzed reliably.
Therefore, in this paper, we analyse, process and combine datasets from 5
different sources to generate a comprehensive and fair dataset to aid future
research in this field. On this basis, we also implement and compare 10
encrypted malicious traffic detection algorithms. We then discuss challenges
and propose future directions of research.

本文提出基于机器学习的加密恶意流量检测技术的通用框架，并提供系统评估。通过分析、处理和合并来自 5 个不同来源的数据集，生成综合公平数据集以帮助未来研究，实现和比较 10 种加密恶意流量检测算法，并讨论挑战和未来研究方向。

加密恶意流量检测的机器学习方法、数据集及比较研究

Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study

Encrypted traffic classification requires discriminative and robust traffic
representation captured from content-invisible and imbalanced traffic data for
accurate classification, which is challenging but indispensable to achieve
network security and network management. The major limitation of existing
solutions is that they highly rely on the deep features, which are overly
dependent on data size and hard to generalize on unseen data. How to leverage
the open-domain unlabeled traffic data to learn representation with strong
generalization ability remains a key challenge. In this paper,we propose a new
traffic representation model called Encrypted Traffic Bidirectional Encoder
Representations from Transformer (ET-BERT), which pre-trains deep
contextualized datagram-level representation from large-scale unlabeled data.
The pre-trained model can be fine-tuned on a small number of task-specific
labeled data and achieves state-of-the-art performance across five encrypted
traffic classification tasks, remarkably pushing the F1 of ISCX-Tor to 99.2%
(4.4% absolute improvement), ISCX-VPN-Service to 98.9% (5.2% absolute
improvement), Cross-Platform (Android) to 92.5% (5.4% absolute improvement),
CSTNET-TLS 1.3 to 97.4% (10.0% absolute improvement). Notably, we provide
explanation of the empirically powerful pre-training model by analyzing the
randomness of ciphers. It gives us insights in understanding the boundary of
classification ability over encrypted traffic. The code is available at:
this https URL.

本文提出了一种新颖的流量表示模型称为 ET-BERT，该模型在大规模未标记的数据上对 Deep contextualized datagram-level 进行预训练，然后在少量特定任务的有标签数据上进行微调，取得了在五个加密流量分类任务上的最新成果，尤其是在 ISCX-Tor 任务上的 99.2％的 F1 分数所达到的显着的提高是本文的重点，作者解释了预训练模型的强力原因，并分析了加密流量之间边界的分类能力，为未来的研究和应用提供了新的思路。