Poster Abstract: Encrypted Malware Traffic Detection Using Incremental Learning

Inseop Lee, Heejun Roh, Wonjun Lee

202021 citationsDOI

Abstract

Even though the growing adoption of TLS protocol empowers web traffic to secure privacy, attackers also leverage the TLS to evade from detection, and this makes detecting threats from the encrypted traffic a crucial task. In this paper, we propose an effective encrypted malware traffic detection method that maintains sufficient performance level by periodic updates using machine learning. The proposed method employs incremental algorithms trained by 31 flow features from TLS, HTTP, and DNS. Experimental results show that the incremental Support Vector Machine with Stochastic Gradient Descent algorithm is suitable for the detection method amongst three algorithms, by off-line and on-line accuracy at a low false discovery rate.

Topics & Concepts

Computer scienceMalwareEncryptionLeverage (statistics)Traffic classificationSupport vector machineProtocol (science)Data miningArtificial intelligenceStochastic gradient descentMachine learningComputer securityComputer networkNetwork packetPathologyMedicineArtificial neural networkAlternative medicineNetwork Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingAdvanced Malware Detection Techniques