Abstract
Malware that generates encrypted traffic presents a great threat to Internet security. The existing state-of-the-art malware traffic detection techniques based on deep learning (DL) ignore the heterogeneity of encrypted traffic, resulting in their inability to further improve detection performance. This paper applies multimodal DL to detect encrypted malware traffic, proposing a multimodal encrypted malware traffic detection (MEMTD) approach. MEMTD extracts features from three types of modal data—the transport layer security (TLS) handshake payload bytes (encryption behavior modal data), packet length sequence (spatial modal data), and packet arrival-time interval sequence (time modal data) of encrypted traffic. Moreover, an intermediate fusion mechanism is adopted in the MEMTD approach to mine the dependencies among modalities and fuse the discriminative traffic features, improving detection performance. The experimental results on datasets containing 8 malware families and normal traffic show that the MEMTD approach achieves 0.9996 macro-F1 and outperforms other single-modal DL detection methods.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Aslan, Ö.A., Samet, R.: A comprehensive review on malware detection approaches. IEEE Access 8, 6249–6271 (2020)
Anderson, B., Paul, S., McGrew, D.: Deciphering malware’s use of TLS (without decryption). J. Comput. Virol. Hacking Tech. 14(3), 195–211 (2018). https://doi.org/10.1007/s11416-017-0306-6
Shekhawat, A.S., Di Troia, F., Stamp, M.: Feature analysis of encrypted malicious traffic. Expert Syst. Appl. 125, 130–141 (2019)
Niu, W., Zhuo, Z., Zhang, X., Xiaojiang, D., Yang, G., Guizani, M.: A heuristic statistical testing based approach for encrypted network traffic identification. IEEE Trans. Veh. Technol. 68(4), 3843–3853 (2019)
Fang, Y., Xu, Y., Huang, C., Liu, L., Zhang, L.: Against malicious SSL/TLS encryption: identify malicious traffic based on random forest. In: Yang, X.-S., Sherratt, S., Dey, N., Joshi, A. (eds.) Fourth International Congress on Information and Communication Technology. AISC, vol. 1027, pp. 99–115. Springer, Singapore (2020). https://doi.org/10.1007/978-981-32-9343-4_10
Liu, C., He, L., Xiong, G., Cao, Z., Li, Z.: FS-Net: a flow sequence network for encrypted traffic classification. In: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pp. 1171–1179. IEEE (2019)
Liu, X., et al.: Attention-based bidirectional GRU networks for efficient https traffic classification. Inf. Sci. 541, 297–315 (2020)
Dong, C., Zhang, C., Zhigang, L., Liu, B., Jiang, B.: CETAnalytics: comprehensive effective traffic information analytics for encrypted traffic classification. Comput. Netw. 176, 107258 (2020)
Zou, Z., Ge, J., Zheng, H., Wu, Y., Han, C., Yao, Z.: Encrypted traffic classification with a convolutional long short-term memory neural network. In: 2018 IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS), pp. 329–334. IEEE (2018)
Huang, H., Deng, H., Chen, J., Han, L., Wang, W.: Automatic multi-task learning system for abnormal network traffic detection. Int. J. Emerging Technol. Learn. 13(4), 4–20 (2018). https://doi.org/10.3991/ijet.v13i04.8466https://online-journals.org/index.php/i-jet/article/view/8466
Congyuan, X., Shen, J., Xin, D.: A method of few-shot network intrusion detection based on meta-learning framework. IEEE Trans. Inf. Forensics Secur. 15, 3540–3552 (2020)
Tong, X., Tan, X., Chen, L., Yang, J., Zheng, Q.: BFSN: a novel method of encrypted traffic classification based on bidirectional flow sequence network. In: 2020 3rd International Conference on Hot Information-Centric Networking (HotICN), pp. 160–165. IEEE (2020)
Ramachandram, D., Taylor, G.W.: Deep multimodal learning: a survey on recent advances and trends. IEEE Signal Process. Mag. 34(6), 96–108 (2017)
Eitel, A., Springenberg, J.T., Spinello, L., Riedmiller, M., Burgard, W.: Multimodal deep learning for robust RGB-D object recognition. In: 2015 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pp. 681–687. IEEE (2015)
Ebrahimi Kahou, S., Michalski, V., Konda, K., Memisevic, R., Pal, C.: Recurrent neural networks for emotion recognition in video. In: Proceedings of the 2015 ACM on International Conference on Multimodal Interaction, pp. 467–474 (2015)
Aceto, G., Ciuonzo, D., Montieri, A., Pescapè, A.: MIMETIC: mobile encrypted traffic classification using multimodal deep learning. Comput. Netw. 165, 106944 (2019)
Kaya, A., Keceli, A.S., Catal, C., Yalic, H.Y., Temucin, H., Tekinerdogan, B.: Analysis of transfer learning for deep neural network based plant classification models. Comput. Electron. Agric. 158, 20–29 (2019)
Stratosphere: Stratosphere laboratory datasets (2015). https://www.stratosphereips.org/datasets-overview. Accessed 13 Mar 2020
Acknowledgment
This work was supported by the National key research and development program of China (Grant No. 2018YFB1800705).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 Springer Nature Switzerland AG
About this paper
Cite this paper
Zhang, X., Lu, J., Sun, J., Xiao, R., Jin, S. (2022). MEMTD: Encrypted Malware Traffic Detection Using Multimodal Deep Learning. In: Di Noia, T., Ko, IY., Schedl, M., Ardito, C. (eds) Web Engineering. ICWE 2022. Lecture Notes in Computer Science, vol 13362. Springer, Cham. https://doi.org/10.1007/978-3-031-09917-5_24
Download citation
DOI: https://doi.org/10.1007/978-3-031-09917-5_24
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-09916-8
Online ISBN: 978-3-031-09917-5
eBook Packages: Computer ScienceComputer Science (R0)