Few-Shot Malware Traffic Classification Method Using Network Traffic and Meta Transfer Learning

IEEE Vehicular Technology Conference, pp. 1–5

Abstract

Malware traffic classification (MTC) is a very important component of cyber security, and a number of the MTC techniques are based on deep learning (DL) with a strong capability of feature mining and classification. However, these DL-based MTC methods are heavily dependent on a large amount of network traffic samples. In the few-shot scenarios, these methods usually overfit and have poor classification performance. Considering that the update cycle of malware is faster and faster, and there are more and more types of malware, collecting enough training samples for all malware is very challenging, if not impossible. In this paper, a novel few-shot MTC(FS-MTC) method is proposed based on convolutional neural network (CNN) and model-agnostic meta-learning (MAML) algorithm. Specifically, the CNN is trained on samples from normal softwares by MAML rather than the conventional optimization methods, then the CNN is finetuned by a few samples from malware for MTC. Simulation results show that our proposed MAML-based FS-MTC can outperform the traditional MTC methods. The performance of our proposed method can reach up to 95.69%.

Authors 6

1. Hanyi Guo

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering,NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China

2. Xixi Zhang

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering,NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China

3. Yu Wang

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering,NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China

4. Bamidele Adebisi

   Manchester Metropolitan University

   Affiliation as printed

   Manchester Metropolitan University,Faculty of Science and Engineering,Manchester,United Kingdom

   Faculty of Science and Engineering, Manchester Metropolitan University, Manchester, United Kingdom

5. Haris Gacanin Aachen Institute for Communication Technologies and Embedded Systems

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University,Institute for Communication Technologies and Embedded Systems,Aachen,Germany

   Institute for Communication Technologies and Embedded Systems, RWTH Aachen University, Aachen, Germany

6. Guan Gui

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering,NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China