TY - JOUR
T1 - Encrypted Malicious Traffic Detection Based on Word2Vec
AU - Ferriyan, Andrey
AU - Thamrin, Achmad Husni
AU - Takeda, Keiji
AU - Murai, Jun
N1 - Funding Information:
Our sincere appreciation for the Indonesia government, particularly LPDP (Lembaga Pengelola Dana Pendidikan Indonesia = Indonesia Endowment Fund for Education) that provides the scholarship to study at Keio University.
Publisher Copyright:
© 2022 by the authors. Licensee MDPI, Basel, Switzerland.
PY - 2022/3/1
Y1 - 2022/3/1
N2 - Network-based intrusion detections become more difficult as Internet traffic is mostly en-crypted. This paper introduces a method to detect encrypted malicious traffic based on the Transport Layer Security handshake and payload features without waiting for the traffic session to finish while preserving privacy. Our method, called TLS2Vec, creates words from the extracted features and uses Long Short-Term Memory (LSTM) for inference. We evaluated our method using traffic from three malicious applications and a benign application that we obtained from two publicly available datasets. Our results showed that TLS2Vec is promising as a tool to detect such malicious traffic.
AB - Network-based intrusion detections become more difficult as Internet traffic is mostly en-crypted. This paper introduces a method to detect encrypted malicious traffic based on the Transport Layer Security handshake and payload features without waiting for the traffic session to finish while preserving privacy. Our method, called TLS2Vec, creates words from the extracted features and uses Long Short-Term Memory (LSTM) for inference. We evaluated our method using traffic from three malicious applications and a benign application that we obtained from two publicly available datasets. Our results showed that TLS2Vec is promising as a tool to detect such malicious traffic.
KW - Encrypted malicious traffic
KW - Network intrusion detection system
KW - Privacy preserving IDS
KW - TLS
UR - http://www.scopus.com/inward/record.url?scp=85125371602&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85125371602&partnerID=8YFLogxK
U2 - 10.3390/electronics11050679
DO - 10.3390/electronics11050679
M3 - Article
AN - SCOPUS:85125371602
SN - 2079-9292
VL - 11
JO - Electronics (Switzerland)
JF - Electronics (Switzerland)
IS - 5
M1 - 679
ER -