Spatio-Temporal Feature Encryption Malicious Traffic Detection via Attention Mechanism

The traditional encrypted malicious traffic detection algorithm via rules and manually extracted features faced the dilemma of low detection accuracy and excessive dependence on experience for extracting features. It made difficult to detect encrypted malicious traffic. Based on this, this paper proposes a 2-layer attention mechanism encrypted malicious traffic detection algorithm via the combination of spatiotemporal features. Specifically, first we use 1D-CNN and BiGRU to extract spatial features in encrypted traffic packets and temporal features between encrypted streams, respectively, which enriches the features of different dimensions. And then, the soft attention mechanism is focus on the encrypted data packets to extract feature. Ultimately, the second layer of soft attention mechanism is used for aggregating malicious features to experiments. The extraction and comparison experiments demonstrate that the encrypted malicious traffic detection model proposed in this paper is better than the existing methods in fine-grained encrypted malicious traffic detection performance.Meanwhile, the effectiveness of each module is proved by its own comparison experiments.