Tags:Anomaly detection, Deep Learning, GAN, Malicious traffic and Malware
Abstract:
With the booming of malware-based cyber-security incidents and the sophistication of attacks, previous detections based on malware sample analysis appear powerless due to time-consuming and labor-intensive analysis procedure. The existing detection methods based on traffic analysis rely heavily on the existing traffic patterns, which hinder detecting the zero-day attacks generated by malware variants. In this paper, we propose an approach based on deep learning referred to as TrafficGAN, which analyzes (HTTP) traffic sessions to distinguish between malware-related and normal traffic. We try to explore traffic patterns of malware variants by adding noise and category condition to generate various similar traffic. And then, we use discriminative model to seek the deviation between abnormal traffic and normal traffic by extracting the essential difference. We increase the diversity of data by generating samples adversarially, which enhances the robustness of the system to detect zero-day attacks. We conduct extensive experiments on the public dataset and our data collected for specific targets. The results demonstrate that our method achieves superior performance to other methods and protects specific targets from the susceptibility of malware.
Efficient Malware Originated Traffic Classification by Using Generative Adversarial Networks