Frequency Domain Feature Based Robust Malicious Traffic Detection

Chuanpu Fu, Qi Li, Meng Shen, Ke Xu*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

15 Citations (Scopus)

Abstract

Machine learning (ML) based malicious traffic detection is an emerging security paradigm, particularly for zero-day attack detection, which is complementary to existing rule based detection. However, the existing ML based detection achieves low detection accuracy and low throughput incurred by inefficient traffic features extraction. Thus, they cannot detect attacks in realtime, especially in high throughput networks. Particularly, these detection systems similar to the existing rule based detection can be easily evaded by sophisticated attacks. To this end, we propose Whisper, a realtime ML based malicious traffic detection system that achieves both high accuracy and high throughput by utilizing frequency domain features. It utilizes sequential information represented by the frequency domain features to achieve bounded information loss, which ensures high detection accuracy, and meanwhile constrains the scale of features to achieve high detection throughput. In particular, attackers cannot easily interfere with the frequency domain features and thus Whisper is robust against various evasion attacks. Our experiments with 74 types of attacks demonstrate that, compared with the state-of-the-art systems, Whisper can accurately detect various sophisticated and stealthy attacks, achieving at most 18.36% improvement of AUC, while achieving two orders of magnitude throughput. Even under various evasion attacks, Whisper is still able to maintain around 90% detection accuracy.

Original languageEnglish
Pages (from-to)452-467
Number of pages16
JournalIEEE/ACM Transactions on Networking
Volume31
Issue number1
DOIs
Publication statusPublished - 1 Feb 2023

Keywords

  • Malicious traffic detection
  • frequency domain
  • machine learning

Fingerprint

Dive into the research topics of 'Frequency Domain Feature Based Robust Malicious Traffic Detection'. Together they form a unique fingerprint.

Cite this