MTD-FRD: Malicious traffic detection method based on feature representation and conditional diffusion model

Abstract

With the rapid development of computer network, security issues are more serious. Malicious traffic detection can effectively discover the malicious behaviors in network activities through detecting the malicious traffic in large-scale network traffic, and it has become an important mean to maintain the cyberspace security. However, traditional malicious traffic detection methods analyze the traffic behavior by processing the network traffic in the formats such as PCAP, CSV and gray-scale images, they cannot fully extract the deep association information in network traffic, leading to the problems such as unclear feature representations. In addition, data imbalance problem existing in network traffic can cause the training of detection model to bias towards normal traffic, and further resulting in high false negatives and weakening the model’s ability to recognize new types of attacks, which seriously affects the accuracy of malicious traffic detection models. This paper proposes a malicious traffic detection method called MTD-FRD, which accurately detects the malicious traffic via introducing feature representation of RGB images, conditional diffusion model and bidirectional traffic channel attention long and short-term memory network (BTCA_LSTM). Firstly, the feature representation of RGB images is constructed for preserving the detailed structural features and distribution information of network traffic, which improves the feature characterization ability. And then, a network conditional diffusion model is proposed to denoise the original network traffic, which utilizes the distribution conditions of RGB images and their own features to generate the high-quality RGB images for solving the data imbalance problem. Finally, a BTCA_LSTM model is constructed to achieve efficient malicious traffic detection by extracting the fine-grained features, local features and contextual correlations in the RGB images after data augmentation. Experimental results on three widely used network traffic show that compared with five state-of-the-arts, the proposed MTD-FRD method is able to improve the TPR, F1-measure and Accuracy by 1.34%–7.51%, 1.40%–7.51% and 1.30%–12.28%, as well as reduce the FPR by 0.022%–0.484%, it also achieves more stable detection validity.