TY - GEN
T1 - Poster abstract
T2 - 2020 IEEE INFOCOM Conference on Computer Communications Workshops, INFOCOM WKSHPS 2020
AU - Lee, Insup
AU - Roh, Heejun
AU - Lee, Wonjun
N1 - Funding Information:
ACKNOWLEDGMENT This work was supported by the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (No. 2019R1A2C2088812). Wonjun Lee is the corresponding author.
Publisher Copyright:
© 2020 IEEE.
PY - 2020/7
Y1 - 2020/7
N2 - Even though the growing adoption of TLS protocol empowers web traffic to secure privacy, attackers also leverage the TLS to evade from detection, and this makes detecting threats from the encrypted traffic a crucial task. In this paper, we propose an effective encrypted malware traffic detection method that maintains sufficient performance level by periodic updates using machine learning. The proposed method employs incremental algorithms trained by 31 flow features from TLS, HTTP, and DNS. Experimental results show that the incremental Support Vector Machine with Stochastic Gradient Descent algorithm is suitable for the detection method amongst three algorithms, by off-line and on-line accuracy at a low false discovery rate.
AB - Even though the growing adoption of TLS protocol empowers web traffic to secure privacy, attackers also leverage the TLS to evade from detection, and this makes detecting threats from the encrypted traffic a crucial task. In this paper, we propose an effective encrypted malware traffic detection method that maintains sufficient performance level by periodic updates using machine learning. The proposed method employs incremental algorithms trained by 31 flow features from TLS, HTTP, and DNS. Experimental results show that the incremental Support Vector Machine with Stochastic Gradient Descent algorithm is suitable for the detection method amongst three algorithms, by off-line and on-line accuracy at a low false discovery rate.
KW - Encrypted Malware Detection
KW - Incremental Learning
KW - Machine Learning
KW - Transport Layer Security
UR - http://www.scopus.com/inward/record.url?scp=85091532568&partnerID=8YFLogxK
U2 - 10.1109/INFOCOMWKSHPS50562.2020.9162971
DO - 10.1109/INFOCOMWKSHPS50562.2020.9162971
M3 - Conference contribution
AN - SCOPUS:85091532568
T3 - IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2020
SP - 1348
EP - 1349
BT - IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2020
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 6 July 2020 through 9 July 2020
ER -