FewFine: Few-shot Malware Traffic Classification Via Transfer Learning based on Fine-tuning Strategy

Malware traffic is constantly evolving and remains destructive. The detection and classification of malware traffic is crucial for maintaining cyberspace security. Only by swiftly and accurately detecting and classifying malware traffic can user privacy and cyberspace security be effectively protected.In this paper, we propose FewFine, an approach for few-shot malware traffic classification based on transfer learning. We initially pre-train a detection model and two classification models with substantial quantity of malware and application traffic samples. For classifying new types of malware traffic accurately and promptly, we utilize transfer learning based on fine-tuning strategy and freeze several blocks in the pre-trained model. Utilizing prior knowledge from the pre-trained models, we leverage few samples of novel classes to perform accurate malware detection and classification. We execute extensive experiments on publicly available datasets to evaluate the effectiveness of FewFine. In model pre-training, with considerable number of samples, the accuracy of malware detection and classification can reach 0.99. The pre-trained models are saved for fine-tuning. When detecting and classifying novel malware traffic, FewFine can achieve the accuracy of 0.95 leveraging only 10 samples per class through fine-tuning the pre-trained model. It outperforms methods under comparison in terms of accuracy and efficiency.