The popularity of encryption mechanisms poses a great challenge to malicious
traffic detection. The reason is traditional detection techniques cannot work
without the decryption of encrypted traffic. Currently, research on encrypted
malicious traffic detection without decryption has focused on feature
extraction and the choice of machine learning or deep learning algorithms. In
this paper, we first provide an in-depth analysis of traffic features and
compare different state-of-the-art traffic feature creation approaches, while
proposing a novel concept for encrypted traffic feature which is specifically
designed for encrypted malicious traffic analysis. In addition, we propose a
framework for encrypted malicious traffic detection. The framework is a
two-layer detection framework which consists of both deep learning and
traditional machine learning algorithms. Through comparative experiments, it
outperforms classical deep learning and traditional machine learning
algorithms, such as ResNet and Random Forest. Moreover, to provide sufficient
training data for the deep learning model, we also curate a dataset composed
entirely of public datasets. The composed dataset is more comprehensive than
using any public dataset alone. Lastly, we discuss the future directions of
this research.

本文提出了一种用于恶意加密流量分析的新型加密流量特征，并比较不同的特征提取方法，同时提出了一个加密恶意流量检测框架，该框架包括深度学习和传统机器学习算法，经实验表明，这个框架的检测效果优于传统的深度学习和机器学习算法。

使用深度学习和其他机器学习算法进行加密恶意流量检测的特征挖掘

Feature Mining for Encrypted Malicious Traffic Detection with Deep  Learning and Other Machine Learning Algorithms

As people's demand for personal privacy and data security becomes a priority,
encrypted traffic has become mainstream in the cyber world. However, traffic
encryption is also shielding malicious and illegal traffic introduced by
adversaries, from being detected. This is especially so in the post-COVID-19
environment where malicious traffic encryption is growing rapidly. Common
security solutions that rely on plain payload content analysis such as deep
packet inspection are rendered useless. Thus, machine learning based approaches
have become an important direction for encrypted malicious traffic detection.
In this paper, we formulate a universal framework of machine learning based
encrypted malicious traffic detection techniques and provided a systematic
review. Furthermore, current research adopts different datasets to train their
models due to the lack of well-recognized datasets and feature sets. As a
result, their model performance cannot be compared and analyzed reliably.
Therefore, in this paper, we analyse, process and combine datasets from 5
different sources to generate a comprehensive and fair dataset to aid future
research in this field. On this basis, we also implement and compare 10
encrypted malicious traffic detection algorithms. We then discuss challenges
and propose future directions of research.

本文提出基于机器学习的加密恶意流量检测技术的通用框架，并提供系统评估。通过分析、处理和合并来自 5 个不同来源的数据集，生成综合公平数据集以帮助未来研究，实现和比较 10 种加密恶意流量检测算法，并讨论挑战和未来研究方向。