Identification of Encrypted and Malicious Network Traffic Based on One-Dimensional Convolutional Neural Network

Abstract

The rapid development of the internet has brought a significant increase in network traffic, but the efficiency of categorizing different types of network traffic has lagged behind, which has downgraded cyber security. How to identify different dimensions of network traffic data with more efficiency and accuracy remains a challenging issue. We design a convolutional neural network model HexCNN-1D that combines normalized processing and attention mechanisms. By adding the attention mechanism modules Global Attention Block (GAB) and Category Attention Block (CAB), different dimensions were introduced to classify and recognize network traffic. By extracting effective load information from hexadecimal network traffic, we designed to identify most of the network traffic, including encrypted and malicious traffic data. The experimental results show that the average accuracy is 98.8%. This method can greatly improve the recognition rate of different dimensions of network traffic data.

AI-Enhanced VPN Security Framework: Integrating Open-Source Threat Intelligence and Machine Learning to Secure Digital Networks

“…Significant efforts have been explored in utilizing traditional ML algorithms to better understand and secure VPN traffic. For instance, Logistic Regression, Support Vector Machine (SVM), and Naive Bayes have been widely used for their ability to classify and predict outcomes based on historical data, which is crucial for identifying anomalous patterns that may indicate security breaches (Zhou, Y. et al 2023), (Bagui, S. et al2017). Furthermore, the k-Nearest Neighbors (kNN) algorithm has been applied for its simplicity and effectiveness in classification tasks by comparing new data points with known data points (Bagui, S. et al 2017).…”

“…Encrypted traffic analysis has become more sophisticated with the application of deep learning models. Works by Zhou et al (2023) introduce one-dimensional convolutional neural networks for efficient and accurate traffic classification. Research by Naas and Fesl (2023) introduced a novel dataset for VPN traffic analysis, which could significantly aid in the development of ML models tailored for VPN security.…”

“…• Random Forest (RF) -The Random Forest algorithm (Zhou, Y. et al 2023, Bagui, S. et al 2017) is an ensemble learning method used for classification tasks, which constructs multiple decision trees during training and outputs the class that is the mode of the classes predicted by individual trees. It aims to improve prediction accuracy and control over-fitting by averaging the results of several trees, each created on randomly selected subsets of the data.…”

“…• K-Nearest Neighbors (KNN) -K-Nearest Neighbors (KNN) is a straightforward and widely used classification algorithm (Zhou, Y. et al 2023, Bagui, S. et al 2017, Lichy, A. et al 2022) that predicts the label of a data point by looking at the 'k' closest labeled data points and choosing the most common label among them. This non-parametric method operates by calculating the distance (often Euclidean) between points and aggregating the categories of nearest neighbour data points.…”