Abstract
The rapid growth of malware and its variants has a significant detrimental effect on the security of the Internet infrastructure. In recent years, deep learning-based methods have demonstrated significant success in malware detection. Nonetheless, there are concerns regarding the requirement for substantial labeled data and the feature selection methods used in present approaches. In this paper, we propose a semi-supervised learning-based method for malware traffic classification, which exploits the raw bitmap representation of malware traffic. We employ stacked bi-LSTM to learn the feature representation of malware traffic and adopt semi-supervised learning (SSL) to enhance the model performance by leveraging unlabeled traffic. Pseudo-labeling and consistency regularization are used to produce pseudo-labels, which can compute unsupervised loss. The loss function consists of two terms: a supervised loss applied to labeled data and an unsupervised loss, which are combined together for model training. Experiments indicate that our method is capable of classifying malware traffic with satisfactory accuracy.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
malware-traffic-analysis.net, https://www.malware-traffic-analysis.net/
Number of malware attacks per year 2022 | statista. https://www.statista.com/statistics/873097/malware-attacks-per-year-worldwide/
scikit-learn: machine learning in python. https://scikit-learn.org/stable/
Aouedi, O., Piamrat, K., Bagadthey, D.: A semi-supervised stacked autoencoder approach for network traffic classification. In: 2020 IEEE 28th International Conference on Network Protocols (ICNP), pp. 1–6. IEEE (2020)
Bovenzi, G., Cerasuolo, F., Montieri, A., Nascita, A., Persico, V., Pescapé, A.: A comparison of machine and deep learning models for detection and classification of android malware traffic. In: 2022 IEEE Symposium on Computers and Communications (ISCC), pp. 1–6. IEEE (2022)
Chen, Z., et al.: Machine learning based mobile malware detection using highly imbalanced network traffic. Inf. Sci. 433, 346–364 (2018)
Gezer, A., Warner, G., Wilson, C., Shrestha, P.: A flow-based approach for trickbot banking trojan detection. Comput. Secur. 84, 179–192 (2019)
He, M., Wang, X., Zhou, J., Xi, Y., Jin, L., Wang, X.: Deep-feature-based autoencoder network for few-shot malicious traffic detection. Secur. Commun. Netw. 2021, 1–13 (2021)
Holland, J., Schmitt, P., Feamster, N., Mittal, P.: New directions in automated traffic analysis. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 3366–3383 (2021)
Lee, D.H., et al.: Pseudo-label: The simple and efficient semi-supervised learning method for deep neural networks. In: Workshop on challenges in representation learning, ICML. vol. 3, p. 896 (2013)
Li, S., Zhang, Q., Wu, X., Han, W., Tian, Z.: Attribution classification method of apt malware in Iot using machine learning techniques. Secur. Commun. Netw. 2021, 1–12 (2021)
Marín, G., Casas, P., Capdehourat, G.: Deep in the dark-deep learning-based malware traffic detection without expert knowledge. In: 2019 IEEE Security and Privacy Workshops (SPW), pp. 36–42. IEEE (2019)
Rios, A.L.G., Li, Z., Xu, G., Alonso, A.D., Trajković, L.: Detecting network anomalies and intrusions in communication networks. In: 2019 IEEE 23rd International Conference on Intelligent Engineering Systems (INES), pp. 000029–000034. IEEE (2019)
Sajjadi, M., Javanmardi, M., Tasdizen, T.: Regularization with stochastic transformations and perturbations for deep semi-supervised learning. In: Advances in Neural Information Processing Systems 29 (2016)
Shone, N., Ngoc, T.N., Phai, V.D., Shi, Q.: A deep learning approach to network intrusion detection. IEEE Trans. Emerg. Topics Comput. Intell. 2(1), 41–50 (2018)
Sohn, K.: Fixmatch: simplifying semi-supervised learning with consistency and confidence. Adv. Neural. Inf. Process. Syst. 33, 596–608 (2020)
Stratosphere: Stratosphere laboratory datasets (2015), retrieved March 13, 2020. https://www.stratosphereips.org/datasets-overview
Wang, S., Yan, Q., Chen, Z., Yang, B., Zhao, C., Conti, M.: Detecting android malware leveraging text semantics of network flows. IEEE Trans. Inf. Forensics Secur. 13(5), 1096–1109 (2017)
Wang, W., Zhu, M., Zeng, X., Ye, X., Sheng, Y.: Malware traffic classification using convolutional neural network for representation learning. In: 2017 International Conference On Information Networking (ICOIN), pp. 712–717. IEEE (2017)
Xu, C., Shen, J., Du, X.: A method of few-shot network intrusion detection based on meta-learning framework. IEEE Trans. Inf. Forensics Secur. 15, 3540–3552 (2020)
Yan, A., et al.: Network-based malware detection with a two-tier architecture for online incremental update. In: 2020 IEEE/ACM 28th International Symposium on Quality of Service (IWQoS), pp. 1–10. IEEE (2020)
Acknowledgements
We thank the anonymous reviewers for their insightful comments. The corresponding author is Xi Wang.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Ma, J., Xu, X., Zang, T., Wang, X., Feng, B., Li, X. (2024). A Semi-supervised Learning Method for Malware Traffic Classification with Raw Bitmaps. In: Gao, H., Wang, X., Voros, N. (eds) Collaborative Computing: Networking, Applications and Worksharing. CollaborateCom 2023. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 562. Springer, Cham. https://doi.org/10.1007/978-3-031-54528-3_19
Download citation
DOI: https://doi.org/10.1007/978-3-031-54528-3_19
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-54527-6
Online ISBN: 978-3-031-54528-3
eBook Packages: Computer ScienceComputer Science (R0)