Malware traffic classification using convolutional neural network for representation learning

TLDR

Traffic classification is the first step for network anomaly detection or network‑based intrusion detection systems and plays an important role in network security. The study proposes a new AI‑based taxonomy and a convolutional neural network method that treats traffic data as images for malware classification. The method trains a CNN directly on raw traffic data represented as images, eliminating the need for hand‑crafted features. The approach, the first to apply representation learning to malware traffic classification with raw data, achieved sufficient accuracy across two scenarios and three classifier types, with session‑level, full‑layer representations performing best after eight experiments.

Abstract

Traffic classification is the first step for network anomaly detection or network based intrusion detection system and plays an important role in network security domain. In this paper we first presented a new taxonomy of traffic classification from an artificial intelligence perspective, and then proposed a malware traffic classification method using convolutional neural network by taking traffic data as images. This method needed no hand-designed features but directly took raw traffic as input data of classifier. To the best of our knowledge this interesting attempt is the first time of applying representation learning approach to malware traffic classification using raw traffic data. We determined that the best type of traffic representation is session with all layers through eight experiments. The method is validated in two scenarios including three types of classifiers and the experiment results show that our proposed method can satisfy the accuracy requirement of practical application.