Open Set Recognition for Malware Traffic via Predictive Uncertainty
Existing machine learning-based malware traffic recognition techniques can effectively detect abnormal behaviors in the network. However, almost all of them focus on a closed-set scenario in which the data used for training and testing come from the same label space. Since sophisticated malware and...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-01-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/12/2/323 |
| _version_ | 1797443503255453696 |
|---|---|
| author | Xue Li Jinlong Fei Jiangtao Xie Ding Li Heng Jiang Ruonan Wang Zan Qi |
| author_facet | Xue Li Jinlong Fei Jiangtao Xie Ding Li Heng Jiang Ruonan Wang Zan Qi |
| author_sort | Xue Li |
| collection | DOAJ |
| description | Existing machine learning-based malware traffic recognition techniques can effectively detect abnormal behaviors in the network. However, almost all of them focus on a closed-set scenario in which the data used for training and testing come from the same label space. Since sophisticated malware and advanced persistent threats are evolving, it is impossible to exhaust all attacks to train a complete recognition model under the existing technical conditions. Therefore, recognition in the real network is an open-set problem, i.e., the recognition system should identify unknown and unseen attacks at test time. In this paper, we propose an uncertainty-aware method to identify known malicious traffic accurately and handle unknown traffic effectively. This method employs predictive uncertainty in deep learning as an indicator for unknown class detection. The predictive uncertainty represents the confidence in neural network predictions. In particular, the Deep Evidence Malware Traffic Recognition (DEMTR) model is presented to provide the multi-classification probability and predictive uncertainty in open-set scenarios using evidential deep learning. We demonstrate the performance of DEMTR on the MCFP dataset. Experimental results indicate that the proposed model outperforms the baseline methods in accuracy and F<sub>1</sub>-score. |
| first_indexed | 2024-03-09T12:57:02Z |
| format | Article |
| id | doaj.art-84fd411bdfde4dea8bba02bec2d56d0f |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-03-09T12:57:02Z |
| publishDate | 2023-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-84fd411bdfde4dea8bba02bec2d56d0f2023-11-30T21:58:52ZengMDPI AGElectronics2079-92922023-01-0112232310.3390/electronics12020323Open Set Recognition for Malware Traffic via Predictive UncertaintyXue Li0Jinlong Fei1Jiangtao Xie2Ding Li3Heng Jiang4Ruonan Wang5Zan Qi6State Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University, Zhengzhou 450001, ChinaState Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University, Zhengzhou 450001, ChinaState Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University, Zhengzhou 450001, ChinaState Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University, Zhengzhou 450001, ChinaNational Digital Switching System Engineering Technological Research Center, PLA Information Engineering University, Zhengzhou 450001, ChinaState Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University, Zhengzhou 450001, ChinaState Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University, Zhengzhou 450001, ChinaExisting machine learning-based malware traffic recognition techniques can effectively detect abnormal behaviors in the network. However, almost all of them focus on a closed-set scenario in which the data used for training and testing come from the same label space. Since sophisticated malware and advanced persistent threats are evolving, it is impossible to exhaust all attacks to train a complete recognition model under the existing technical conditions. Therefore, recognition in the real network is an open-set problem, i.e., the recognition system should identify unknown and unseen attacks at test time. In this paper, we propose an uncertainty-aware method to identify known malicious traffic accurately and handle unknown traffic effectively. This method employs predictive uncertainty in deep learning as an indicator for unknown class detection. The predictive uncertainty represents the confidence in neural network predictions. In particular, the Deep Evidence Malware Traffic Recognition (DEMTR) model is presented to provide the multi-classification probability and predictive uncertainty in open-set scenarios using evidential deep learning. We demonstrate the performance of DEMTR on the MCFP dataset. Experimental results indicate that the proposed model outperforms the baseline methods in accuracy and F<sub>1</sub>-score.https://www.mdpi.com/2079-9292/12/2/323machine learningmalware traffic recognitionopen-setpredictive uncertainty |
| spellingShingle | Xue Li Jinlong Fei Jiangtao Xie Ding Li Heng Jiang Ruonan Wang Zan Qi Open Set Recognition for Malware Traffic via Predictive Uncertainty Electronics machine learning malware traffic recognition open-set predictive uncertainty |
| title | Open Set Recognition for Malware Traffic via Predictive Uncertainty |
| title_full | Open Set Recognition for Malware Traffic via Predictive Uncertainty |
| title_fullStr | Open Set Recognition for Malware Traffic via Predictive Uncertainty |
| title_full_unstemmed | Open Set Recognition for Malware Traffic via Predictive Uncertainty |
| title_short | Open Set Recognition for Malware Traffic via Predictive Uncertainty |
| title_sort | open set recognition for malware traffic via predictive uncertainty |
| topic | machine learning malware traffic recognition open-set predictive uncertainty |
| url | https://www.mdpi.com/2079-9292/12/2/323 |
| work_keys_str_mv | AT xueli opensetrecognitionformalwaretrafficviapredictiveuncertainty AT jinlongfei opensetrecognitionformalwaretrafficviapredictiveuncertainty AT jiangtaoxie opensetrecognitionformalwaretrafficviapredictiveuncertainty AT dingli opensetrecognitionformalwaretrafficviapredictiveuncertainty AT hengjiang opensetrecognitionformalwaretrafficviapredictiveuncertainty AT ruonanwang opensetrecognitionformalwaretrafficviapredictiveuncertainty AT zanqi opensetrecognitionformalwaretrafficviapredictiveuncertainty |