CoChat
Sign Up
Cited by 8Advanced Malware Detection TechniquesInternet Traffic Analysis and Secure E-votingNetwork Security and Intrusion Detection

AS‐DMF: A Lightweight Malware Encrypted Traffic Detection Method Based on Active Learning and Feature Selection

Open access
Huo, Yuehua, Zhao, Faqi, Zhang, Hangsheng, Zhuang, Shangyuan, Sun, Jiyan·2022·Wireless Communications and Mobile Computing
DOI 10.1155/2022/1556768
Open this paper in CoChat — free accountOpen PDF

Abstract

The sharp increasing volume of encrypted traffic generated by malware brings a huge challenge to traditional payload‐based malicious traffic detection methods. Solutions that based on machine learning and deep learning are becoming mainstream. However, the machine learning‐based methods are limited by manual‐design features, which have the problem of highly correlated multicollinearity. And both methods rely heavily on a large number of labeled samples, which needs lots of human effort. In this paper, we apply the active learning to the malicious encrypted traffic detection problem and propose AS‐DMF framework. AS‐DMF is a lightweight detection framework that combine the uncertainty sampling and density‐based query strategy to query the informative and representative instances from the sample set and then train them in a detection (DMF) model. Moreover, we propose a feature selection mechanism which can select the meaningful features of traffic efficiently. Our comprehensive experiments on the real‐word dataset indicate that AS‐DMF achieves lightweighting at both feature and data levels with a high performance of 0.9460 mAcc.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1155/2022/1556768

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Traditional rule-based monitoring detects only 60-70% of critical or important anomalies.

    “Traditional monitoring methods that use unchanging baselines and rule-based systems only find 6070% of important anomalies.”

    From AI-Enhanced Anomaly Detection and Automated Root-Cause Analysis for Enterprise Data Platforms (2026) · cites this paper as [2]

    The Introduction discusses the difficulty of detecting malicious encrypted traffic, while §4.2 reports metrics for the paper’s own detection methods. Neither passage addresses rule-based monitoring with unchanging baselines or a 60–70% detection rate for important anomalies; searches for those terms and figures found no supporting passage. (LLM, conf=0.75)

    Experimental — accuracy not yet measured

  • Traditional rule-based monitoring generates excessive false alerts.

    “These methods also create too many false alerts, which are notifications about problems that aren't actually happening, and overwhelm operations teams [2].”

    From AI-Enhanced Anomaly Detection and Automated Root-Cause Analysis for Enterprise Data Platforms (2026) · cites this paper as [2]

    Section 4.2 defines false-positive rate for the paper’s malware-traffic detection experiments, but does not say traditional rule-based monitoring produces excessive false alerts. The Introduction discusses deployment difficulty without linking false alerts to overwhelmed operations teams. Searches for rule-based monitoring, false alerts, and signature-based detection found no passage addressing that claim. (LLM, conf=0.75)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 29

  1. B. Anderson, S. Paul, and D. McGrew, "Deciphering malware's use of TLS (without decryption)," Journal of Computer Virol- ogy and Hacking Techniques, vol. 14, no. 3, pp. 195-211, 2018.
  2. B. Anderson and D. McGrew, "Machine learning for encrypted malware traffic classification: accounting for noisy labels and non-stationarity," in Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1723-1732, Halifax, NS, Canada, 2017.
  3. T. Radivilova, L. Kirichenko, D. Ageyev, M. Tawalbeh, and V. Bulakh, "Decrypting SSL-TLS traffic for hidden threats detection," in 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT), pp. 143-146, Kyiv, Ukraine, May, 2018.
  4. Y. Zeng, H. Gu, W. Wei, and Y. Guo, "Deep-full-range: a deep learning based network encrypted traffic classification and intrusion detection framework," IEEE Access, vol. 7, pp. 45182-45190, 2019.
  5. E. Papadogiannaki and S. Ioannidis, "A survey on encrypted network traffic analysis applications, techniques, and counter- measures," ACM Computing Surveys, vol. 54, no. 6, pp. 1-35, 2021.
  6. C. Liu, L. He, G. Xiong, Z. Cao, and Z. Li, "FS-Net: a flow sequence network for encrypted traffic classification," in IEEE INFOCOM 2019 -IEEE Conference on Computer Communica- tions, pp. 1171-1179, Paris, France, June 2019.
  7. S. Rezaei and X. Liu, "Deep learning for encrypted traffic clas- sification: an overview," IEEE Communications Magazine, vol. 57, no. 5, pp. 76-81, 2019.
  8. Y. Yang, C. Kang, G. Gou, Z. Li, and G. Xiong, "TLS/SSL encrypted traffic classification with autoencoder and convolu- tional neural network," in 2018 IEEE 20th International Con- ference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS), pp. 362-369, Exeter, UK, January 2019.
  9. I. Torroledo, L. D. Camacho, and A. C. Bahnsen, "Hunting malicious TLS certificates with deep neural networks," in Pro- ceedings of the 11th ACM Workshop on Artificial Intelligence and Security (AISec '18), pp. 64-73, Toronto, Canada, October, 2018.
  10. V. L. Nguyen, M. H. Shaker, and E. Hullermeier, "How to mea- sure uncertainty in uncertainty sampling for active learning," Machine Learning, vol. 111, no. 1, pp. 89-122, 2022.
  11. R. Dai, C. Gao, B. Lang, L. Yang, H. Liu, and S. Chen, "SSL malicious traffic detection based on multi-view features," in Proceedings of the 2019 the 9th International Conference on 13 Wireless Communications and Mobile Computing Communication and Network Security, pp. 40-46, Chongqing, China, November, 2019.
  12. B. Anderson and D. McGrew, "Identifying encrypted malware traffic with contextual flow data," in Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, pp. 35-46, Vienna, Austria, October, 2016.
  13. K. C. Pai, S. Mitra, and M. Chari, "Novel TLS signature extrac- tion for malware detection," in Proceedings of the 2020 IEEE International Conference on Electronics, Computing and Com- munication Technologies (CONECCT), pp. 1-3, Bangalore, India, July, 2020.
  14. J. Guo, Y. Sang, P. Chang, X. Xu, and Y. Zhang, "MGEL: a robust malware encrypted traffic detection method based on ensemble learning with multi-grained features," Computa- tional Science -ICCS, vol. 12743, pp. 195-208, 2021.
  15. H. Yang, Q. He, Z. Liu, and Q. Zhang, "Malicious encryption traffic detection based on NLP," Security and Communication Networks, vol. 2021, Article ID 9960822, no10 pages, 2021.
  16. T. Yu, F. Zou, L. Li, and P. Yi, "An encrypted malicious traffic detection system based on neural network," in 2019 Interna- tional Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), pp. 62-70, Guilin, China, October, 2019.
  17. M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and H. Janicke, "Deep learning for cyber security intrusion detection: approaches, datasets, and comparative study," Journal of Infor- mation Security and Applications, vol. 50, article 102419, 2020.
  18. X. Q. Zhang, M. Zhao, J. Y. Wang, S. Li, Y. Zhou, and S. Zhu, "Deep-forest-based encrypted malicious traffic detection," Electronics, vol. 11, no. 7, p. 977, 2022.
  19. Y. C. Chen, Y. J. Li, A. Tseng, and T. Lin, "Deep learning for malicious flow detection," in 2017 IEEE 28th Annual Interna- tional Symposium on Personal of Indoor, and Mobile Radio Communications (PIMRC), pp. 1-7, Montreal, QC, Canada, October, 2017.
  20. M. Fang, Y. Li, and T. Cohn, Learning How to Active Learn: A Deep Reinforcement Learning Approach, EMNLP, 2017.
  21. P. Liu, L. Wang, R. Ranjan, G. He, and L. Zhao, "A survey on active deep learning: from model driven to data driven," ACM Computing Surveys (CSUR), vol. 54, no. 10s, pp. 1-34, 2022.
  22. S. Ebert, M. Fritz, and B. Schiele, "ALF: a reinforced active learning formulation for object class recognition," in 2012 IEEE Conference on Computer Vision and Pattern Recognition, pp. 3626-3633, Providence, RI, USA, June 2012.
  23. D. Zha, K. H. Lai, M. Wan, and X. Hu, "Meta-AAD: active anomaly detection with deep reinforcement learning," in 2020 IEEE International Conference on Data Mining (ICDM), pp. 771-780, Sorrento, Italy, November, 2020.
  24. M. Wang, F. Min, Z. H. Zhang, and Y. X. Wu, "Active learning through density clustering," Expert Systems with Applications, vol. 85, pp. 305-317, 2017.
  25. Y. Shi, Z. Yu, W. Cao, C. L. P. Chen, H. S. Wong, and G. Han, "Fast and effective active clustering ensemble based on density peak," IEEE Transactions on Neural Networks and Learning Systems, vol. 32, no. 8, pp. 3593-3607, 2021.
  26. K. Konyushkova, S. Raphael, and F. Pascal, "Learning active learning from data," Advances in Neural Information Process- ing Systems, vol. 30, 2017.
  27. S. J. Huang, R. Jin, and Z. H. Zhou, "Active learning by query- ing informative and representative examples," IEEE Transac- tions on Pattern Analysis and Machine Intelligence, vol. 36, no. 10, pp. 1936-1949, 2014.
  28. F. Pedregosa, G. Varoquaux, A. G. Alexandre et al., "Scikit- learn: machine learning in Python," The Journal of machine Learning research, vol. 12, pp. 2825-2830, 2011.
  29. Y.-P. Tang, G.-X. Li, and S.-J. Huang, "ALiPy: active learning in Python," 2019, https://arxiv.org/abs/1901.03802. · arXiv

Cited by

Sorted by citations

Authors
Huo, Y., Zhao, F., Zhang, H., Zhuang, S., & Sun, J.
Affiliations
  • China University of Mining and Technology - Beijing (CN)
  • Chinese Academy of Sciences (CN)
Corresponding author
Huo, Yuehua
ORCID
Venue
Wireless Communications and Mobile Computing
Publisher
Wiley
Published
2022-01
Volume
2022
Issue
1
ISSN
  • 1530-8669 (ISSN-L)
  • 1530-8677
DOI
10.1155/2022/1556768
OpenAlex
W4296578748
Cited by
8
References
0
Citations by year
2026: 4 · 2025: 2 · 2024: 2
FWCI
0.46
Type
journal article
Language
en
Open access
Licence
Locations
Wireless Communications and Mobile Computing (publishedVersion, cc-by)
Funders
National Key Research and Development Program of China (2016YFC0801800)
Topics
  • Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
malware detection, encrypted traffic, malicious traffic detection, active learning (machine learning), uncertainty sampling, feature selection, multicollinearity, network traffic classification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review