Semi-Supervised Malware Traffic Classification Via Consistency Regularization and Pseudo-Labeling

Malware traffic classification (MTC) technology plays a crucial role in cyber security by serving as the first step of network intrusion detection system. Recently, deep learning has been successfully introduced into the field of network intrusion detection. However, its performance relies heavily on the quantity and quality of labeled samples, which are often difficult to obtain in real-world applications. To address these challenges, we propose semi-supervised MTC method based on consistency regularization and pseudo-labeling. This method utilizes unlabeled malware traffic data to improve the classification performance of the model. Specifically, we train the model using labeled malware traffic data. Then, weak data augmentation is performed on unlabeled traffic data and pseudo labels are generated through the model. Finally, the model predicts unlabeled data after strong data augmentation and compares it with pseudo labels. Model parameters are updated using losses from labeled and unlabeled samples. Experimental results demonstrate that our proposed method outperforms other classical classification approaches, including ladder networks, virtual adversarial training (VAT), convolutional neural network (CNN), and support vector machine (SVM), when the ratios of labeled samples range from 1% to 5%.