Encrypted Malicious Network Traffic Detection: Leveraging Attention Mechanism and Markov Chain Sequencing
Sileshi Nibret Zeleke, Amsalu Fentie Jember, Mario A. Bochicchio · 2024
Encrypted malware traffic presents a considerable challenge, as traditional signature-based detection methods are incapable of inspecting the contents of such traffic, while deep packet inspection systems are often criticized for compromising the privacy of the payload. In this study, we propose a novel approach for detecting encrypted malware through the application of Markov chain (MC) sequencing of packet inter-arrival times and lengths. We utilize a temporal convolutional network (TCN) integrated with a multi-head attention mechanism to effectively capture dependencies within the dynamics of network traffic. The attention mechanism allows the model to concentrate on critical state transitions. We evaluate our approach using an encrypted network traffic dataset, and the results indicate that it achieves an accuracy of 93.08%, an F1-score of 93.13%, a precision of 93.98%, and a recall of 92.29%. Our method demonstrates high accuracy, precision, and F1-score, surpassing several baseline models. These results highlight the effectiveness and practical applicability of our proposed approach in detecting encrypted malware, thereby providing a robust solution to the challenges posed by encrypted communications in the field of cybersecurity.