An Unsupervised Representation Learning Method for MTC Using Masked Autoencoder

Malware traffic classification (MTC) is one of the promising methods to ensure the cybersecurity, which involves identifying and categorizing network traffic to distinguish between benign and malicious activity. Traditional MTC methods, such as port-based and DPI-based approaches, have become obsolete due to their limitations. The deep learning (DL) based methods attract much attention due to their strong feature mining ability. Nevertheless, these methods depend on abundant labeled training samples, which can be expensive to obtain. To address this problem, this paper proposes a novel unsupervised method for MTC with the framework of masked autoencoder. The proposed method is able to mine features from large amounts of unlabeled data, eliminating the reliance on labels. The random mask strategy in the method can effectively reduce the redundant information in the sample, which accelerates the training process and improves the classification performance. Experiments show that our method surpasses the performance of existing unsupervised MTC methods by directly applying the features extracted from the model after pre-training to clustering. Moreover, it also can achieve good classification performance with supervised fine-tuning on a small labeled dataset.