An Encrypted Malicious Traffic Detection Method Based on Deeper Protocol Features

Network encryption protocols can protect user privacy and data security but can also provide an opportunity to conceal network attacks. To address feature loss and incompleteness in existing encrypted malicious traffic detection methods, this paper proposes a LightGBM-based detection method. By extracting statistical features and constructing deep TLS protocol features, it achieves high-precision detection for malicious encrypted traffic. In this method, statistical features are selected and calculated from traffic packet distributions, and TLS protocol features are constructed based on protocol knowledge and network business background. The combined features are input into a LightGBM model after using TargetEncoder to handle high-dimensional sparse features. Results of malicious and benign traffic distribution show that statistical and protocol features we selected and constructed have significant differences, proving that they are efficient for encrypted malicious traffic detection.