A method based on hierarchical spatiotemporal features for trojan traffic detection

TL;DR

This paper introduces a neural network model leveraging hierarchical spatiotemporal features for detecting HTTP-based Trojan traffic, achieving high accuracy and incorporating expert knowledge to enhance self-learning.

Contribution

The paper presents a novel HSTF-Model that combines deep learning with expert features for improved Trojan traffic detection, along with a new dataset BTHT.

Findings

F1 score of 99.4% on real traffic

Effective detection of concealed Trojan traffic

Integration of deep learning and expert knowledge

Abstract

Trojans are one of the most threatening network attacks currently. HTTP-based Trojan, in particular, accounts for a considerable proportion of them. Moreover, as the network environment becomes more complex, HTTP-based Trojan is more concealed than others. At present, many intrusion detection systems (IDSs) are increasingly difficult to effectively detect such Trojan traffic due to the inherent shortcomings of the methods used and the backwardness of training data. Classical anomaly detection and traditional machine learning-based (TML-based) anomaly detection are highly dependent on expert knowledge to extract features artificially, which is difficult to implement in HTTP-based Trojan traffic detection. Deep learning-based (DL-based) anomaly detection has been locally applied to IDSs, but it cannot be transplanted to HTTP-based Trojan traffic detection directly. To solve this problem, in this paper, we propose a neural network detection model (HSTF-Model) based on hierarchical spatiotemporal features of traffic. Meanwhile, we combine deep learning algorithms with expert knowledge through feature encoders and statistical characteristics to improve the self-learning ability of the model. Experiments indicate that F1 of HSTF-Model can reach 99.4% in real traffic. In addition, we present a dataset BTHT consisting of HTTP-based benign and Trojan traffic to facilitate related research in the field.