Machine learning for encrypted malicious traffic detection: Approaches, datasets and comparative study

Artificial Intelligence-Based Anomaly Detection Technology over Encrypted Traffic: A Systematic Literature Review

As cyber-attacks increase in unencrypted communication environments such as the traditional Internet, protected communication channels based on cryptographic protocols, such as transport layer security (TLS), have been introduced to the Internet. Accordingly, attackers have been carrying out cyber-attacks by hiding themselves in protected communication channels. However, the nature of channels protected by cryptographic protocols makes it difficult to distinguish between normal and malicious network traffic behaviors. This means that traditional anomaly detection models with features from packets extracted a deep packet inspection (DPI) have been neutralized. Recently, studies on anomaly detection using artificial intelligence (AI) and statistical characteristics of traffic have been proposed as an alternative. In this review, we provide a systematic review for AI-based anomaly detection techniques over encrypted traffic. We set several research questions on the review topic and collected research according to eligibility criteria. Through the screening process and quality assessment, 30 research articles were selected with high suitability to be included in the review from the collected literature. We reviewed the selected research in terms of dataset, feature extraction, feature selection, preprocessing, anomaly detection algorithm, and performance indicators. As a result of the literature review, it was confirmed that various techniques used for AI-based anomaly detection over encrypted traffic were used. Some techniques are similar to those used for AI-based anomaly detection over unencrypted traffic, but some technologies are different from those used for unencrypted traffic.

Malicious Traffic Identification with Self-Supervised Contrastive Learning

As the demand for Internet access increases, malicious traffic on the Internet has soared also. In view of the fact that the existing malicious-traffic-identification methods suffer from low accuracy, this paper proposes a malicious-traffic-identification method based on contrastive learning. The proposed method is able to overcome the shortcomings of traditional methods that rely on labeled samples and is able to learn data feature representations carrying semantic information from unlabeled data, thus improving the model accuracy. In this paper, a new malicious traffic feature extraction model based on a Transformer is proposed. Employing a self-attention mechanism, the proposed feature extraction model can extract the bytes features of malicious traffic by performing calculations on the malicious traffic, thereby realizing the efficient identification of malicious traffic. In addition, a bidirectional GLSTM is introduced to extract the timing features of malicious traffic. The experimental results show that the proposed method is superior to the latest published methods in terms of accuracy and F1 score.

A novel hybrid machine learning approach for traffic sign detection using CNN-GRNN

The traffic signal recognition model plays a significant role in the intelligent transportation model, as traffic signals aid the drivers to driving the more professional with awareness. The primary goal of this paper is to proposea model that works for the recognition and detection of traffic signals. This work proposes the pre-processing and segmentation approach applying machine learning techniques are occurred recent trends of study. Initially, the median filter & histogram equalization technique is utilized for pre-processing the traffic signal images, and also information of the figures being increased. The contrast of the figures upgraded, and information about the color shape of traffic signals are applied by the model. To localize the traffic signal in the obtained image, then this region of interest in traffic signal figures are extracted. The traffic signal recognition and classification experiments are managed depending on the German Traffic Signal Recognition Benchmark-(GTSRB). Various machine learning techniques such as Support Vector Machine (SVM), Extreme Learning Machine (ELM), Linear Discriminant Analysis (LDA), Principal Component Analysis (PCA), Convolutional neural network (CNN)- General Regression Neural Network (GRNN) is used for the classification process. Finally, the obtained results will be compare in terms of the performance metrics like accuracy, F1 score, kappa score, jaccard score, sensitivity, specificity, recall, and precision. The result shows that CNN-GRNN with ML techniques by attaining 99.41% accuracy compare to other intelligent methods. In this proposed technique is used for detecting and classifying various categories of traffic signals to improve the accuracy and effectiveness of the system.