ETGuard: Malicious Encrypted Traffic Detection in Blockchain-based Power Grid Systems

TL;DR

This paper introduces ETGuard, a novel incremental learning framework for detecting malicious encrypted traffic in blockchain-based power grid systems, addressing the limitations of static models in dynamic attack environments.

Contribution

The paper presents a new framework that automatically detects and learns from malicious encrypted traffic, specifically designed for blockchain power grid systems, with a focus on incremental learning to prevent forgetting.

Findings

Achieved state-of-the-art performance on three benchmark datasets.

Constructed the first malicious encrypted traffic dataset for blockchain power grids.

Demonstrated the effectiveness of incremental learning in dynamic attack scenarios.

Abstract

The escalating prevalence of encryption protocols has led to a concomitant surge in the number of malicious attacks that hide in encrypted traffic. Power grid systems, as fundamental infrastructure, are becoming prime targets for such attacks. Conventional methods for detecting malicious encrypted packets typically use a static pre-trained model. We observe that these methods are not well-suited for blockchain-based power grid systems. More critically, they fall short in dynamic environments where new types of encrypted attacks continuously emerge. Motivated by this, in this paper we try to tackle these challenges from two aspects: (1) We present a novel framework that is able to automatically detect malicious encrypted traffic in blockchain-based power grid systems and incrementally learn from new malicious traffic. (2) We mathematically derive incremental learning losses to resist the forgetting of old attack patterns while ensuring the model is capable of handling new encrypted attack patterns. Empirically, our method achieves state-of-the-art performance on three different benchmark datasets. We also constructed the first malicious encrypted traffic dataset for blockchain-based power grid scenario. Our code and dataset are available at https://github.com/PPPmzt/ETGuard, hoping to inspire future research.