META: Multi-classified encrypted traffic anomaly detection with fine-grained flow and interaction analysis

The pervasive implementation of encryption mechanisms has introduced considerable obstacles to anomalous traffic detection, rendering conventional attack detection methodologies that rely on packet payload characteristics ineffectual. In the absence of plaintext information, current anomaly encrypted traffic detection mainly relies on traffic data analysis to identify and characterize anomalous attack patterns in encrypted traffic, employing machine learning or deep learning models. However, the existing methods still suffer from limited detection capabilities, especially the ability to classify multi-class attacks due to insufficient internal and external features. In this paper, we propose a Multi-classified Encrypted Traffic Anomaly Detection (META) method. META refines and extends the available feature dimensions in encrypted traffic by leveraging two key aspects: the internal interaction behavior information within the traffic and the external interaction behavior information in network topology. Specifically, an in-depth examination of the internal packet interaction features is undertaken, resulting in a novel feature set, designated as META-Features, encompassing 278 fine-grained statistical features. Furthermore, a Graph Neural Network (GNN) is employed to learn the external interaction behavior in the network topology from the embedding of the IP node graph and flow edge graph. The results of the experiments demonstrate that the refined feature set META-Features significantly enhances the model’s detection capabilities. Thereby, the META-GNN model exhibits superior performance compared to the traditional approaches, with an accuracy of 91.90% and an F1-score of 87.41%.