Deep-Forest-Based Encrypted Malicious Traffic Detection

The SSL/TLS protocol is widely used in data encryption transmission. Aiming at the problem of detecting SSL/TLS-encrypted malicious traffic with small-scale and unbalanced training data, a deep-forest-based detection method called DF-IDS proposed this paper. According to characteristics SSL/TSL protocol, network was split into sessions according 5-tuple information. Each session then transformed two-dimensional image as input deep-learning classifier. In order avoid information loss improve efficiency, multi-grained cascade forest (gcForest) framework simplified only structure, which named (CaForest). By integrating random extra trees CaForest framework, an end-to-end high-precision detector for encrypted realized. Compared other deep-learning-based methods, experimental results showed that rate 6.87% 29.5% higher than methods on dataset. advantage more obvious multi-classification case.