Detecting unknown HTTP-based malicious communication behavior via generated adversarial flows and hierarchical traffic features

by   Xiaochun Yun, et al.

Malicious communication behavior is the network communication behavior generated by malware (bot-net, spyware, etc.) after victim devices are infected. Experienced adversaries often hide malicious information in HTTP traffic to evade detection. However, related detection methods have inadequate generalization ability because they are usually based on artificial feature engineering and outmoded datasets. In this paper, we propose an HTTP-based Malicious Communication traffic Detection Model (HMCD-Model) based on generated adversarial flows and hierarchical traffic features. HMCD-Model consists of two parts. The first is a generation algorithm based on WGAN-GP to generate HTTP-based malicious communication traffic for data enhancement. The second is a hybrid neural network based on CNN and LSTM to extract hierarchical spatial-temporal features of traffic. In addition, we collect and publish a dataset, HMCT-2020, which consists of large-scale malicious and benign traffic during three years (2018-2020). Taking the data in HMCT-2020(18) as the training set and the data in other datasets as the test set, the experimental results show that the HMCD-Model can effectively detect unknown HTTP-based malicious communication traffic. It can reach F1 = 98.66 HMCT-2020(19-20), F1 = 90.69 83.66 methods on average. This validates that HMCD-Model has the ability to discover unknown HTTP-based malicious communication behavior.


HSTF-Model: an HTTP-based Trojan Detection Model via the Hierarchical Spatio-Temporal Features of Traffics

HTTP-based Trojan is extremely threatening, and it is difficult to be ef...

A method based on hierarchical spatiotemporal features for trojan traffic detection

Trojans are one of the most threatening network attacks currently. HTTP-...

Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic

Machine learning (ML) is promising in accurately detecting malicious flo...

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

In this paper, we propose HyperVision, a realtime unsupervised machine l...

WebEye - Automated Collection of Malicious HTTP Traffic

With malware detection techniques increasingly adopting machine learning...

Joint Detection of Malicious Domains and Infected Clients

Detection of malware-infected computers and detection of malicious web d...

JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection

Machine learning is often used for malicious website detection, but an a...

Please sign up or login with your details

Forgot password? Click here to reset