TrafCL: Robust Encrypted Malicious Traffic Detection via Contrastive Learning

Remote control malwares enable cyber attackers to achieve command and control over victim hosts, which are widely employed in ransomware attacks and espionage operations, jeopardizing personal privacy and state security. To effectively detect such malicious traffics holds high practical value. However, prior works have not adequately addressed the task due to challenges of encrypted traffics with misleading contents, incomplete sessions, and limited labels. To overcome these limitations, in this paper, we propose TrafCL, a contrastive learning framework for robust encrypted malicious traffic detection. In TrafCL, we first generate incomplete variants for the input session by Session Augmentation, then extract explicit session features with excluding misleading traffic contents by Triple-aspect Session Feature Extraction, and obtain session representations by Co-attention Session Encoder which fuses triple-aspect session features with capturing their interdependence. After that, we use a projection head to obtain final representations. TrafCL is pre-trained using unlabeled data to learn close representations for complete sessions and their incomplete variants, then fine-tuned on labeled data to detect encrypted malicious traffics. Experiment results show that TrafCL outperforms the best baseline by 11.35% and 6.71% in F1-scores on two datasets respectively.