AS‐DMF: A Lightweight Malware Encrypted Traffic Detection Method Based on Active Learning and Feature Selection
Yuehua Huo, Faqi Zhao, Hangsheng Zhang, Shangyuan Zhuang, Jiyan Sun · Wireless Communications and Mobile Computing · 2022
The sharp increasing volume of encrypted traffic generated by malware brings a huge challenge to traditional payload‐based malicious traffic detection methods. Solutions that based on machine learning and deep learning are becoming mainstream. However, the machine learning‐based methods are limited by manual‐design features, which have the problem of highly correlated multicollinearity. And both methods rely heavily on a large number of labeled samples, which needs lots of human effort. In this paper, we apply the active learning to the malicious encrypted traffic detection problem and propose AS‐DMF framework. AS‐DMF is a lightweight detection framework that combine the uncertainty sampling and density‐based query strategy to query the informative and representative instances from the sample set and then train them in a detection (DMF) model. Moreover, we propose a feature selection mechanism which can select the meaningful features of traffic efficiently. Our comprehensive experiments on the real‐word dataset indicate that AS‐DMF achieves lightweighting at both feature and data levels with a high performance of 0.9460 mAcc.