The sharp increasing volume of encrypted traffic generated by malware brings a huge challenge to traditional payload-based malicious traffic detection methods. Solutions that based on machine learning and deep learning are becoming mainstream. However, the machine learning-based methods are limited by manual-design features, which have the problem of highly correlated multicollinearity. And both methods rely heavily on a large number of labeled samples, which needs lots of human effort. In this paper, we apply the active learning to the malicious encrypted traffic detection problem and propose AS-DMF framework. AS-DMF is a lightweight detection framework that combine the uncertainty sampling and density-based query strategy to query the informative and representative instances from the sample set and then train them in a detection (DMF) model. Moreover, we propose a feature selection mechanism which can select the meaningful features of traffic efficiently. Our comprehensive experiments on the real-word dataset indicate that AS-DMF achieves lightweighting at both feature and data levels with a high performance of 0.9460 mAcc.

No abstract

A vehicle charging network system has to access large-scale heterogeneous terminals to collect charging pile status information, which may also give malicious terminals an opportunity to access. Though some general access authentication solutions aimed at only allowing trusted terminals have been proposed, they are difficult to work with in a vehicle charging network system. First, among various heterogeneous terminals with significant differences in computing capabilities, there are inevitably terminals that cannot support computations required for cryptography-based access authentication schemes. Second, though access authentication schemes based on device fingerprints are independent of terminal computing capabilities, their authentication performance is weak in robustness and high in overhead. Third, the access authentication delay is huge since the system cannot withstand heavy concurrent access requests from large-scale terminals. To address the above problems, we propose a reliable and lightweight trusted access authentication solution for terminals in the vehicle charging network system. By cloud, edge, and local servers cooperating to execute authentication tasks, our Cloud-Edge-End Collaborative architecture effectively alleviates the authentication delay caused by high concurrent requests. Each server in the architecture deploys our well-designed unified trusted access authentication (UATT) model based on device fingerprints. With ingenious data construction and the powerful swin-transformer network, the UATT model can provide robust and low-overhead authentication services for heterogeneous terminals. To minimize authentication latency, we further design an A2C-based authentication task scheduling scheme to decide which server executes the current task. Comprehensive experiments demonstrate our solution can authenticate terminals with an accuracy higher than 98% while reducing the required data packets by two orders of magnitude, and it can effectively reduce authentication latency.