Identifying malicious traffic under concept drift based on intraclass consistency enhanced variational autoencoder

作     者：Xiang LUO Chang LIU Gaopeng GOU Gang XIONG Zhen LI Binxing FANG 

作者机构：Institute of Information Engineering Chinese Academy of Sciences School of Cyber Security University of Chinese Academy of Sciences School of Computer Science and Technology Harbin Institute of Technology (Shenzhen) 

出 版 物：《Science China(Information Sciences)》 (中国科学:信息科学(英文版))

年 卷 期：2024年

核心收录：

学科分类：12[管理学] 1201[管理学-管理科学与工程(可授管理学、工学学位)] 0839[工学-网络空间安全] 08[工学] 081104[工学-模式识别与智能系统] 0835[工学-软件工程] 0811[工学-控制科学与工程] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：supported by National Key Research and Development Program of China (Grant No. 2021YFB3101400) 

摘      要：Accurate identification of malicious traffic is crucial for implementing effective defense countermeasures and has led to extensive research ***,the continuously evolving techniques employed by adversaries have introduced the issues of concept drift,which significantly affects the performance of existing *** tackle this challenge,some researchers have focused on improving the separability of malicious traffic representation and designing drift detectors to reduce the number of false ***,these methods often overlook the importance of enhancing the generalization and intraclass consistency in the ***,the detectors are not sufficiently sensitive to the variations among different malicious traffic classes,which results in poor performance and limited *** this paper,we propose intraclass consistency enhanced variational autoencoder with Class-Perception detector(ICE-CP) to identify malicious traffic under concept *** comprises two key modules during training:intraclass consistency enhanced (ICE) representation learning and Class-Perception (CP) detector *** the first module,we employ a variational autoencoder (VAE) in conjunction with Kullback-Leibler(KL)-divergence and cross-entropy loss to model the distribution of each input malicious traffic *** approach simultaneously enhances the generalization,interclass consistency,and intraclass differences in the learned ***,we obtain a compact representation and a trained classifier for nondrifting malicious *** the second module,we design the CP detector,which generates a centroid and threshold for each malicious traffic class separately based on the learned representation,depicting the boundaries between drifting and non-drifting malicious *** testing,we utilize the trained classifier to predict malicious traffic classes for the testing ***,we use the CP detector to detect the pote