Malicious Encrypted Traffic Detection Method Based on Spatial-Temporal Features and Cost Sensitivity

Traditional methods for detecting malicious encrypted traffic are constrained by the rigidity of rules and the limitations of manual intervention, making it difficult to cope with the increasingly complex and dynamic nature of malicious encrypted traffic. Additionally, in real network environments, there often exists an imbalance in malicious encrypted traffic data, while existing models exhibit partiality in feature extraction. To address these issues, we propose a malicious encrypted traffic detection method based on spatial-temporal features and cost sensitivity (CSSTM). This method combines 1D-CNN and Bi-LSTM to extract spatial-temporal features comprehensively and deeply from different dimensions of malicious encrypted traffic. Furthermore, it improves the traditional cross-entropy loss function to make it cost-sensitive, reducing the impact of data imbalance without altering the data distribution. The experimental results reveal that on the CICIDS2017 and ISCXVPN2017 datasets, the CSSTM model achieves impressive F1 scores of 96.81 % and 94.19% respectively. Comparative experiments with other methods further validate that the proposed approach comprehensively characterizes the features of malicious encrypted traffic and effectively addresses the data imbalance issue.