基于CNN⁃SIndRNN的恶意TLS流量快速识别方法

Fast Identification Method of Malicious TLS Traffic Based on CNN-SIndRNN

传统浅层机器学习方法在识别恶意TLS流量时依赖专家经验且流量表征不足,而现有的深度神经网络检测模型因层次结构复杂导致训练时间过长。提出一种基于CNN-SIndRNN端到端的轻量级恶意加密流量识别方法,使用多层一维卷积神经网络提取流量字节序列局部模式特征,并利用全局最大池化降维以减少计算参数。为增强流量表征,设计一种改进的循环神经网络用于捕获流量字节长距离依赖关系。在此基础上,采用独立循环神经网络IndRNN单元代替传统RNN循环单元,使用切片并行计算结构代替传统RNN的串行计算结构,并将两种类型深度神经网络所提取的特征拼接作为恶意TLS流量表征。在CTU-Maluware-Capure公开数据集上的实验结果表明,该方法在二分类实验上F1值高达0.9657,在多分类实验上整体准确率为0.8489,相比BotCatcher模型训练时间与检测时间分别节省了98.47%和98.28%。

Traditional shallow machine learning methods for identifying malicious TLS traffic rely heavily on expert experience,and perform poorly in traffic representation.In addition,the training of the existing deep neural network detection models is time-consuming due to the deepened hierarchical structure.To address the problem,a lightweight end-to-end method for malicious encrypted traffic detection is proposed based on CNN-SIndRNN.The method employs a multi-layer onedimensional convolutional neural network to extract the local pattern features of a traffic byte sequence,and uses global maximum pooling to reduce dimensions to simplify computational parameters.At the same time,to enhance traffic representation,an improved recurrent neural network is designed in parallel to capture the long-distance dependence of traffic bytes.On this basis,the Independent Recurrent Neural Network(IndRNN)unit is used to replace the traditional Recurrent Neural Network(RNN)unit,and the sliced parallel computing structure is adopted to replace the serial computing structure of the traditional RNN.Then,the features extracted from the two types of deep neural networks are spliced to represent the malicious TLS traffic.The effectiveness of the proposed method is verified on two open datasets.The experimental results show that the method exhibits a F1 score of 0.9657 in the binary classification experiment.Its overall accuracy rate reaches 84.89%in the multi-classification experiment.Compared with the model of BotCatcher,CNN-SIndRNN model improves the classification performance while reducing the training time by 98.47%and test time by 98.28%.