PaperlayerView exact revision on arXiv

Source-linked AI summary

Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis

Chuanpu Fu, Qi Li, Meng Shen, Ke Xu

arXiv:2106.14707v3cs.CRcs.LG

TL;DR

Existing machine-learning malicious-traffic detectors struggle to combine zero-day coverage with realtime throughput and robustness against evasion. Whisper uses compact frequency-domain representations of packet sequences and benign-pattern clustering to address these constraints. The paper reports accurate detection across diverse attacks, high throughput, and continued robustness under evasion attacks.

  • Problem

    Existing machine-learning detectors have limited throughput and robustness, restricting realtime high-rate detection and leaving them vulnerable to sophisticated evasion attacks.

  • Method

    Whisper encodes packet-feature sequences, applies frequency-domain analysis with bounded information loss, and uses lightweight statistical clustering of benign traffic patterns.

  • Results

    Whisper is presented as the first machine-learning system achieving realtime and robust malicious-traffic detection in high-throughput networks.

  • Takeaways & Limitations

    Frequency-domain features preserve fine-grained packet ordering while reducing feature redundancy, supporting accuracy, robustness, and high-throughput detection.

  • Takeaways & Limitations

    Whisper assumes no prior threat knowledge and does not address defenses against attacks after detection.

Abstract

from arXiv · show

Machine learning (ML) based malicious traffic detection is an emerging security paradigm, particularly for zero-day attack detection, which is complementary to existing rule based detection. However, the existing ML based detection has low detection accuracy and low throughput incurred by inefficient traffic features extraction. Thus, they cannot detect attacks in realtime especially in high throughput networks. Particularly, these detection systems similar to the existing rule based detection can be easily evaded by sophisticated attacks. To this end, we propose Whisper, a realtime ML based malicious traffic detection system that achieves both high accuracy and high throughput by utilizing frequency domain features. It utilizes sequential features represented by the frequency domain features to achieve bounded information loss, which ensures high detection accuracy, and meanwhile constrains the scale of features to achieve high detection throughput. Particularly, attackers cannot easily interfere with the frequency domain features and thus Whisper is robust against various evasion attacks. Our experiments with 42 types of attacks demonstrate that, compared with the state-of-theart systems, Whisper can accurately detect various sophisticated and stealthy attacks, achieving at most 18.36% improvement, while achieving two orders of magnitude throughput. Even under various evasion attacks, Whisper is still able to maintain around 90% detection accuracy.

1 INTRODUCTION

Existing malicious-traffic detectors trade off zero-day coverage, throughput, latency, and robustness against evasion. Whisper addresses these gaps with frequency-domain features that preserve sequential information while reducing feature scale and redundancy.

  • Motivation: Machine-learning detectors can identify zero-day traffic, but processing overhead often limits them to offline deployment and prevents realtime detection on high-rate traffic.Rule-based methods retain high throughput but cannot detect zero-day attacks.
  • Motivation: Packet-level methods are vulnerable to injected benign noise, while flow-level methods incur latency and rely on coarse statistics that evasion attacks can bypass.These limitations leave realtime robust machine-learning detection unavailable for practical deployment.
  • Approach: Whisper extracts fine-grained sequential traffic information in the frequency domain, aiming for low information loss and low feature redundancy.The design targets accurate, robust, and high-throughput detection simultaneously.
  • Approach: Its extraction pipeline encodes packet features as vectors, applies framed Discrete Fourier Transformation, and transforms the resulting frequency representation for statistical learning.Automatic encoding-vector selection uses constrained optimization and SMT solving to reduce manual parameter selection.
  • Analysis: Whisper’s theoretical framework analyzes information loss and feature efficiency relative to packet-level and traditional flow-level methods.The paper uses differential entropy analysis to study these properties.
  • Evaluation: Experiments replay 42 malicious-traffic datasets, including stealthy, multi-stage, and evasion attacks, to evaluate the prototype under high-throughput backbone traffic.The prototype is implemented with Intel’s Data Plane Development Kit.
  • Contribution: Whisper is presented as a machine-learning system for realtime and robust malicious-traffic detection in high-throughput networks.The contributions include frequency-domain analysis, automatic parameter selection, theoretical analysis, and prototype validation.

2 THREAT MODEL AND DESIGN GOALS

Whisper is designed as a middlebox plug-in that monitors mirrored traffic without affecting forwarding and without prior threat knowledge. Its goals are robust, accurate, task-agnostic realtime detection, while passive attacks without obvious traffic variance are outside scope.

  • Threat model: The detector receives replicated middlebox traffic through port mirroring and does not interfere with benign traffic forwarding.The system is intended to operate as a middlebox plug-in module.
  • Threat model: Whisper assumes no prior threat knowledge so that it can address zero-day attacks.Existing defenses may be deployed separately to throttle traffic identified as malicious.
  • Design goals: The system should determine whether ongoing traffic is benign or malicious, rather than classify its application or user origin.This defines the task as malicious-traffic detection instead of traffic classification.
  • Design goals: The design goals are robust accurate detection of varied zero-day and evasion attacks together with realtime, task-agnostic operation.The stated goals target limitations that are not well addressed in prior literature.

3 OVERVIEW OF WHISPER

Whisper reduces processing overhead by encoding packet-feature sequences as vectors and extracts their sequential information through frequency-domain analysis. A lightweight statistical clustering module then learns benign frequency patterns for detection.

  • Overview: Whisper encodes per-packet feature sequences as vectors to reduce the overhead of subsequent feature processing.The encoding also reduces the feature scale.
  • Overview: Frequency-domain analysis extracts fine-grained sequential information that supports accurate and robust detection.The representation is intended to remain unaffected by injected noise packets.
  • Overview: A statistical clustering module learns patterns of frequency-domain features using lightweight machine learning.The module is trained on benign traffic and computes clustering centers.

4 DESIGN DETAILS

Whisper converts packet-level traffic features into compact frequency-domain representations and detects deviations from benign patterns. Its pipeline combines automatic encoding, framed DFT processing, normalization, and benign-only statistical clustering.

  • 4.1 Frequency Feature Extraction Module: Whisper acquires per-packet features from packets in the same flow and organizes them in matrix S for frequency-domain extraction.Each matrix entry represents a property of a packet.
  • 4.1 Frequency Feature Extraction Module: A linear transformation encodes each packet’s features into a real-valued traffic vector, reducing feature scale and subsequent processing overhead.The encoding vector is selected automatically in a later module.
  • 4.1 Frequency Feature Extraction Module: The encoded vector is segmented into frames, then DFT extracts sequential information from each frame in the frequency domain.Framing constrains long-term packet dependence and reduces feature complexity.
  • 4.1 Frequency Feature Extraction Module: Complex DFT outputs are converted to real-valued features by modulus calculation, retaining the first half because the two halves are symmetric, followed by logarithmic transformation.The logarithm improves numerical stability and prevents floating-point overflow during training.
  • 4.1 Frequency Feature Extraction Module: In a visualization example using 1,500 packets, three per-packet features, and 30-packet frames, malicious-traffic regions appear significantly lighter than benign regions in RGB-mapped features.The example mixes 90% benign and 10% malicious WAN traffic.
  • 4.2 Automatic Encoding Vector Selection: The encoding vector is selected by optimizing bounded range and reduced mutual interference, with an equivalent SMT formulation used to approximate the solution.Constraints preserve ordering among encoded feature functions.
  • 4.3 Statistical Clustering Module: The clustering module trains on benign traffic, averages sampled frequency-feature windows, and learns clustering centers representing benign patterns.Window averaging is used to improve robustness and reduce false positives from extreme values.
  • 4.3 Statistical Clustering Module: During detection, traffic windows are assigned to their nearest benign clustering centers and classified as malicious when estimation error reaches the training-loss threshold.The threshold is defined as ϕ × train_loss.

5 THEORETICAL ANALYSIS

The theoretical analysis models information loss in traffic feature extraction and compares Whisper with packet-level and traditional flow-level methods. It also analyzes Whisper’s feature scale, compression, and computational complexity.

  • Traffic Feature Differential Entropy Model: The traffic feature differential entropy model evaluates feature-extraction efficiency by measuring information loss from an information-theoretic perspective.It models packet-level features as a stochastic process and extracted features as state random variables.
  • Analysis of Traditional Flow-level Detection Methods: Traditional flow-level methods lose information approximately linearly as the per-packet feature sequence length increases.The analysis states that this limits their ability to extract traffic features accurately.
  • Analysis of Whisper: Whisper encodes per-packet features as vectors and applies DFT to extract frequency-domain features, with the information-loss estimate formulated under a stationary zero-mean Gaussian-process assumption.The encoding vector’s elements are denoted w_i in the analysis.
  • Analysis of Whisper: Whisper reduces information loss relative to traditional flow-level methods using average, min-max, and variance features.The reduction for average features is described as increasing more than linearly, enabling more effective feature extraction from ongoing traffic.
  • Analysis of Whisper: Whisper almost has no information loss relative to packet-level methods when the number of packets used for feature extraction is large.The packet-level methods remain disadvantaged by their large feature scale and resulting machine-learning overhead.
  • Feature Scale Reduction and Overhead: Whisper compresses per-packet features to reduce processing overhead, while its feature-extraction complexity is proportional to the number of packets N and uses no operation above quadratic complexity.Matrix multiplications dominate encoding overhead, whereas DFT on frames has relatively lower computation and memory overhead because of FFT.

6 EXPERIMENTAL EVALUATION

Whisper is evaluated on 42 real-world attacks for detection accuracy, robustness to evasion, latency, and throughput. Across these experiments, frequency-domain features support accurate, robust, and realtime detection.

  • Detection Accuracy: Whisper detects all 14 evaluated attacks with AUC values from 0.932 to 0.999 and EER within 0.201.
  • Detection Accuracy: 0.06% AUC decreased for Whisper when burst intervals increased in low-rate TCP DoS attacks, compared with larger decreases for the baselines.The reported decreases were 9.0% for Kitsune, 7.0% for FSC, and 0.10% for FAE.
  • Detection Accuracy: At most 15.72% AUC and 95.79% EER improvements over packet-level features were achieved using the same auto-encoder.Compared with flow-level statistics clustering, Whisper achieved at most 65.26% AUC and 98.80% EER improvements.
  • Robustness of Detection: Whisper maintained robust detection under benign-traffic injection, with at most 10.46% AUC decrease and 1.87 times EER increase.The averaged AUC decrease across injection ratios was bounded by 3.0%, while other systems could be evaded.
  • Robustness of Detection: Whisper’s frequency-domain features preserve fine-grained sequential information that remains different for malicious and benign traffic under evasion.Flow-level statistics can remain similar when malicious traffic is disguised as benign, whereas Whisper uses sequential information as context.
  • Detection Latency and Throughput: Whisper achieved 0.047–0.133 second overall detection latency, 0.0361 second average processing latency, and 11.35–13.22 Gbps average throughput.Kitsune achieved 112.52 Mbps, while Whisper and FAE reached around 1.27 ×10^6 PPS.

7 RELATED WORK

Machine-learning-based NIDS complements signature-based detection by identifying zero-day attacks, while traffic classification applies ML to infer properties from encrypted and anonymized traffic.

  • Machine-learning-based NIDS can detect zero-day attacks that signature-based systems have not uncovered.
  • Whisper’s detection latency is evaluated using CDFs of overall and processing latency plus box plots for latency across steps.
  • Whisper’s throughput is compared with FAE and Kitsune using a CDF and average throughput.
  • Traffic classification uses machine learning for tasks including web fingerprinting, mobile-application fingerprinting, and encrypted-DNS traffic classification.

8 CONCLUSION

Whisper uses frequency-domain analysis to exploit sequential traffic information for robust realtime malicious-traffic detection. The paper reports high accuracy and throughput, supported by bounded information loss and experiments across attacks.

  • Whisper uses frequency-domain analysis to represent sequential traffic information for robust attack detection.
  • Whisper encodes per-packet feature sequences as vectors, applies DFT, and uses lightweight clustering for efficient attack detection.
  • Whisper’s frequency-domain features have bounded information loss, which the paper identifies as a prerequisite for accuracy and robustness.
  • 0.999 AUC accuracy within 0.06 second and around 13.22 Gbps throughput are reported for Whisper.

A PROOF OF THEOREM 1

The proof models minimum-based flow-level feature extraction by comparing the entropy of the full packet-feature sequence with the entropy retained by its minimum.

  • Hpacket represents the overall differential entropy of the sampling sequence as the sum of each random variable’s differential entropy.
  • For minimum-based extraction, Hflow−min is the entropy of the sample having the sequence’s minimum value.
  • ΔHflow−min measures information loss as the difference between overall sequence entropy and minimum-feature entropy.
  • The proof analyzes expected information loss and derives a lower bound using Jensen’s inequality.
  • The same proof procedure is applied to maximum-based features to complete Theorem 1.

B PROOF OF THEOREM 2 AND THEOREM 3

The proofs analyze entropy loss for average- and variance-based flow features under Gaussian-process assumptions, deriving bounds or approximations for the resulting information loss.

  • Average features: The average of the sampled sequence is modeled as a Gaussian random variable for average-feature extraction.
  • Average features: Hflow−avg and ΔHflow−avg denote the average feature’s differential entropy and its information loss, respectively.
  • Average features: The average-feature loss reaches its maximum when the sequence variances are constant, while the bounds coincide when σ(i) = 1/K.
  • Variance features: The variance feature is modeled using a chi-square distribution under a strictly stationary, zero-mean Gaussian process with constant variance.
  • Variance features: The variance-feature information loss is approximated for sufficiently large N using Gamma, Digamma, harmonic-series, and Stirling-formula relationships.

D PROOF OF THEOREM 5 AND THEOREM 6

Whisper extracts frequency-domain features from per-packet sampling sequences through scaling, DFT, modulus, and logarithmic transformations, then estimates their entropy and information loss.

  • Whisper assumes the Gaussian process is strictly stationary with zero mean and analyzes one per-packet feature sampling sequence.
  • The extraction pipeline scales the sampling sequence, applies a DFT, computes the modulus, and performs a logarithmic transformation.The resulting features are denoted R, with R_i = ln(P_i + 1)/C.
  • The DFT scaling property F(w s) = wF(s) supports the analysis of the transformed frequency-domain features.
  • The analysis estimates the differential entropy of Whisper’s frequency-domain features while ignoring the logarithmic transformation’s impact.
  • The proof derives an estimate of Whisper’s differential entropy loss, denoted ΔHWhisper, from entropy properties and inequalities.

E THE DETAILED RESULTS OF ROBUST EVALUATION

Whisper remains accurate when malicious traffic is mixed with benign traffic and when attackers use more sophisticated traffic-manipulation strategies.

  • Injected benign traffic has negligible effects on Whisper’s detection accuracy across seven malicious-traffic types and four injection ratios.
  • The robust evaluation tests benign-traffic injection, malicious-packet rate changes, and packet-length manipulation based on benign TLS traffic.
  • Figure 10 reports detection accuracy under sophisticated evasion strategies involving multiple benign-traffic types and TLS-based traffic patterns.
Loading 2106.14707v3…