Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods

Qinglong Liang

doi:10.47297/taposatWSP2633-456924.20250608

PDF
导出
分享
收藏
专辑

Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods

6卷第8期

浏览量: 0 Downloads: 0

Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods
Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods
International Exchange College, Guangzhou Maritime University, Guangzhou, Guangdong, 510725, China
2025年6卷第8期页码：129-134
纸质出版：2025-08-30
DOI：10.47297/taposatWSP2633-456924.20250608
Accepted：

Scan QR Code

(2025). Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods. 科技理论与实践（英文版）, 6(8), 129-134.

Liang Qinglong.Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods[J].Theory and Practice of Science and Technology,2025,06(08):129-134.
(2025). Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods. 科技理论与实践（英文版）, 6(8), 129-134. DOI： 10.47297/taposatWSP2633-456924.20250608.

Liang Qinglong.Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods[J].Theory and Practice of Science and Technology,2025,06(08):129-134. DOI： 10.47297/taposatWSP2633-456924.20250608.

摘要

Abstract

To safeguard against numerous network attacks in environments where communication is not encrypted

an increasing number of online application services are adopting encrypted traffic to improve privacy and security. However

it was soon found that attackers could exploit secure communication channels to conduct cyber attacks. Traditional techniques

which rely on deep packet inspection to detect anomalous traffic

struggle to identify these types of attacks effectively. In recent years

the progress of artificial intelligence has prompted many researchers to apply AI-based approaches for detecting encrypted network traffic. This paper centers on the UNSW-NB15 dataset and provides a comprehensive retrospect of advancements in encrypted traffic anomaly detection techniques based on this dataset over the past few years. Initially

it categorizes and summarizes existing studies from three perspectives: traditional machine learning

deep learning

and unsupervised or semi-supervised learning methods

while comparing their performance in terms of classification accuracy

detection efficiency

and suitability for different scenarios. Furthermore

by evaluating and analyzing the experimental outcomes of these approaches on the UNSW-NB15 dataset

the paper highlights the strengths and limitations of various technical strategies. Finally

it outlines the current challenges and potential directions for future research in the field of encrypted traffic analysis.

关键词

Keywords

references

Keshvadi, S., Sharma, Y. Exploring HTTPS Certificate Ecosystem: Analyzing the Entire IPv4 Address Space. In: 2023 IEEE Canadian Conference on Electrical and Computer Engineering (CCECE), Regina, SK, Canada, 24-27 September 2023. pp. 547--552

Wang, W., Zhu, M., Zeng, X., Ye, X., Sheng, Y. Malware traffic classification using convolutional neural network for representation learning. In Proceedings of the 2017 International Conference on Information Networking (ICOIN), Da Nang, Vietnam, 11–13 January 2017; IEEE: New York, NY, USA, 2017; pp. 712–717.

Anderson B, Paul S, McGrew D. Deciphering malware's use of TLS (without decryption)[J]. Journal of Computer Virology and Hacking Techniques, 2018, 14(3): 195-211.

Sommer R, Paxson V. Outside the closed world: On using machine learning for network intrusion detection[C]. Proceeding of 2010 IEEE Symposium on Security and Privacy. Los Alamitos, CA: IEEE Computer Society, 2010: 305-316.

Shone, N., Ngoc, T. N., Phai, V. D., Shi, Q. (2018) A deep learning approach to network intrusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1): 41–50.

Thirimanne, S., Jayawardana, L., Yasakethu, L. (2022) Deep neural network based real-time intrusion detection system. SN Computer Science, 3: 145.

Tama, B. A., Lim, S. (2021) Ensemble learning for intrusion detection systems: A systematic mapping study and cross-benchmark evaluation. Computer Science Review, 40: 100388.

Kim D, Im H, Lee S. Adaptive autoencoder-based intrusion detection system with single threshold for CAN networks. Sensors . 2025;25(13):4174.

Moustafa N, Slay J. UNSW-NB15: A comprehensive data set for network intrusion detection systems[J]. Proceedings of the 4th International Conference on Cyber Security and Digital Forensics (CyberSec), 2015; pp. 1–6.

Liao H J, Lin C H R, Lin Y C, et al. Intrusion detection system: A comprehensive review[J ] . Journal of Network and Computer Applications , 2013, 36(1): 16-24.

Sommer, R., Paxson, V. (2010) Outside the closed world: On using machine learning for network intrusion detection. 2010 IEEE Symposium on Security and Privacy, pp. 305 – 316 .

Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A. A. (2009) A detailed analysis of the KDD CUP 99 data set. IEEE Symposium on Computational Intelligence for Security and Defe nse Applications, pp. 1 – 6 .

NSL-KDD dataset. University of New Brunswick. Available: http://www.unb.ca/cic/datasets/nsl.html

Sharafaldin, I., Lashkari, A. H., Ghorbani, A. A. (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSP, pp. 108 – 116 .

Cover T, Hart P. Nearest neighbor pattern classification[J]. IEEE Transactions on Information Theory, 1967, 13(1): 21-27.

Safavian S R, Landgrebe D. A survey of decision tree classifier methodology[J ] . IEEE Transactions on Systems, Man, and Cybernetics , 1991, 21(3): 660-674.

Al-Obeidat F, El-Alfy E S M. Hybrid multicriteria fuzzy classification of network traffic patterns, anomalies, and protocols[J ] . Personal and Ubiquitous Computing , 2019, 23(5-6): 777-791.

Biau G, Scornet E. A random forest guided tour[J ] . Test , 2016, 25(2): 197-227.

LeCun Y, Bottou L, Bengio Y, et al. Gradient-based learning applied to document recognition[J]. Proceedings of the IEEE, 1998, 86(11): 2278-2324.

Elman J L. Finding structure in time[J]. Cognitive Science, 1990, 14(2): 179-211.

Hochreiter S, Schmidhuber J. Long short-term memory. Neural Computation, 1997, 9(8): 1735-1780.

Zhang Y, Wang X, Li J, et al. An effective intrusion detection system based on wrapper feature selection and Multi-Head Attention Transformer . Scientific Reports, 2025, 15: 11348.

Alzahrani A, Alsaeedi A, Alharthi M, et al. IDS-MTran: A multi-scale Transformer model for intrusion detection systems . Scientific Reports, 2024, 14: 74214.

Jain A K, Murty M N, Flynn P J. Data clustering: a review[J]. ACM Computing Surveys, 1999, 31(3): 264-323.

Chapelle O, Schölkopf B, Zien A. (2006) Semi-supervised learning. Cambridge: MIT Press.

Ongsulee P. Artificial intelligence, machine learning and deep learning. Proceedings of the IEEE 15th International Conference on ICT and Knowledge Engineering (ICT&KE). IEEE, 2017: 1-6.

Xing J C, Wu C M. Detecting anomalies in encrypted traffic via deep dictionary learning[C ] . Proceeding of IEEE. IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) , 2 020: 734-739.

Kim M-G, Kim H. Anomaly detection in imbalanced encrypted traffic with few packet metadata-based feature extraction. Computer Modeling in Engineering & Sciences, 2024, 141(1): 585–607.

Xu R J, Wu G W, Wang W P, Gao X, He A, Zhang Z P. Applying self-supervised learning to network intrusion detection for network flows with graph neural network[J]. Computer Networks, 2024, 248: 110495.

SATTAR S, KHAN S, KHAN M I, et al. Anomaly detection in encrypted network traffic using self-supervised learning[J]. Scientific Reports, 2025, 15: 1-21

BAHLALI A R, BACHIR A, CHERIET A. Malicious encrypted network traffic detection using deep auto-encoder with a custom reconstruction loss[C]. Proceedings of the 2025 IEEE International Conference on Cyber Security and Privacy*, 2025: 1-10.

LIU M, YANG QC, LIU SL. Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics[J]. SENSORS, 2024, 24(20): 6507.

BAKHSHI T, GHITA B. Anomaly Detection in Encrypted Internet Traffic Using Hybrid Deep Learning[J]. SECURITY AND COMMUNICATION NETWORKS, 2021: 5363750.

BAHLALI A R, BACHIR A, LABED A. Self-Supervised Learning Meets Custom Autoencoder Classifier: A Semi-Supervised Approach for Encrypted Traffic Anomaly Detection[J]. IEEE ACCESS, 2025, 13: 139141-139154.

TUFAN E, TEZCAN C, ACARTÜRK C. Anomaly-Based Intrusion Detection by Machine Learning: A Case Study on Probing Attacks to an Institutional Network[J]. IEEE ACCESS, 2021, 9: 50078-50092.

MARFO W, TOSH D K, MOORE S V. Network Anomaly Detection Using Federated Learning[C]. Proceedings of 2022 IEEE Military Communications Conference (MILCOM). Rockville, MD, USA: IEEE, 2022: 1-6.

Moustafa N, Slay J. UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of Military Communications and Information Systems Conference (MilCIS). IEEE, 2015: 1-6.