Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine Learning
In recent years, with the development of modern network, in order to avoid threats caused by cyber attacks, it is important to understand how to implement effective security measures. Malicious traffic detection is an advanced technique, it employs several approaches to distinguish traffic whether i...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2024-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10376060/ |
| _version_ | 1797361523504447488 |
|---|---|
| author | Zhenguo Hu Hirokazu Hasegawa Yukiko Yamaguchi Hajime Shimada |
| author_facet | Zhenguo Hu Hirokazu Hasegawa Yukiko Yamaguchi Hajime Shimada |
| author_sort | Zhenguo Hu |
| collection | DOAJ |
| description | In recent years, with the development of modern network, in order to avoid threats caused by cyber attacks, it is important to understand how to implement effective security measures. Malicious traffic detection is an advanced technique, it employs several approaches to distinguish traffic whether it is benign or malicious. Traditional malicious traffic detection methods are usually based on pre-defined signatures. However, limited by the size and timeliness of the signature library, they are usually unable to detect unknown cyber attacks such as zero-day attacks or new malware variants. In order to solve this problem, we propose a machine learning based method to detect realtime malicious traffic. It is divided into two parts: feature extraction on FPGA and abnormal traffic detection on Linux host machine. On the feature extraction part, instead of using conventional network traffic features, we propose a frequency transformation based feature extraction method to extract frequency domain features from network traffic. At the same time, in order to improve the speed of feature extraction and reduce CPU resource usage, we implement the processes required for feature extraction inside the FPGA board. On the abnormal traffic detection part, we use AF-Packet and ring buffer to capture the features, and load a pre-trained model into the CatBoost framework in advance to execute inference process. We evaluate our proposed system on a Xilinx Alveo U50 accelerator card and a Linux host machine. The evaluation results show that we achieve about 0.98 detection accuracy with low resource usage and good realtime detection throughput. |
| first_indexed | 2024-03-08T15:54:54Z |
| format | Article |
| id | doaj.art-af7fd673036e44c197d0b9ee5a4dc55a |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-08T15:54:54Z |
| publishDate | 2024-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-af7fd673036e44c197d0b9ee5a4dc55a2024-01-09T00:04:06ZengIEEEIEEE Access2169-35362024-01-01122648265910.1109/ACCESS.2023.334823410376060Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine LearningZhenguo Hu0https://orcid.org/0009-0005-1889-0720Hirokazu Hasegawa1Yukiko Yamaguchi2Hajime Shimada3Graduate School of Informatics, Nagoya University, Nagoya, JapanCenter for Strategic Cyber Resilience Research and Development, National Institute of Informatics, Tokyo, JapanInformation Technology Center, Nagoya University, Nagoya, JapanInformation Technology Center, Nagoya University, Nagoya, JapanIn recent years, with the development of modern network, in order to avoid threats caused by cyber attacks, it is important to understand how to implement effective security measures. Malicious traffic detection is an advanced technique, it employs several approaches to distinguish traffic whether it is benign or malicious. Traditional malicious traffic detection methods are usually based on pre-defined signatures. However, limited by the size and timeliness of the signature library, they are usually unable to detect unknown cyber attacks such as zero-day attacks or new malware variants. In order to solve this problem, we propose a machine learning based method to detect realtime malicious traffic. It is divided into two parts: feature extraction on FPGA and abnormal traffic detection on Linux host machine. On the feature extraction part, instead of using conventional network traffic features, we propose a frequency transformation based feature extraction method to extract frequency domain features from network traffic. At the same time, in order to improve the speed of feature extraction and reduce CPU resource usage, we implement the processes required for feature extraction inside the FPGA board. On the abnormal traffic detection part, we use AF-Packet and ring buffer to capture the features, and load a pre-trained model into the CatBoost framework in advance to execute inference process. We evaluate our proposed system on a Xilinx Alveo U50 accelerator card and a Linux host machine. The evaluation results show that we achieve about 0.98 detection accuracy with low resource usage and good realtime detection throughput.https://ieeexplore.ieee.org/document/10376060/FPGAmalicious traffic detectionmachine learning |
| spellingShingle | Zhenguo Hu Hirokazu Hasegawa Yukiko Yamaguchi Hajime Shimada Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine Learning IEEE Access FPGA malicious traffic detection machine learning |
| title | Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine Learning |
| title_full | Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine Learning |
| title_fullStr | Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine Learning |
| title_full_unstemmed | Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine Learning |
| title_short | Enhancing Detection of Malicious Traffic Through FPGA-Based Frequency Transformation and Machine Learning |
| title_sort | enhancing detection of malicious traffic through fpga based frequency transformation and machine learning |
| topic | FPGA malicious traffic detection machine learning |
| url | https://ieeexplore.ieee.org/document/10376060/ |
| work_keys_str_mv | AT zhenguohu enhancingdetectionofmalicioustrafficthroughfpgabasedfrequencytransformationandmachinelearning AT hirokazuhasegawa enhancingdetectionofmalicioustrafficthroughfpgabasedfrequencytransformationandmachinelearning AT yukikoyamaguchi enhancingdetectionofmalicioustrafficthroughfpgabasedfrequencytransformationandmachinelearning AT hajimeshimada enhancingdetectionofmalicioustrafficthroughfpgabasedfrequencytransformationandmachinelearning |