Machine learning based fileless malware traffic classification using image visualization  

作　　者：Fikirte Ayalke Demmese Ajaya Neupane Sajad Khorsandroo May Wang Kaushik Roy Yu Fu 

机构地区：[1]Department of Computer Science,College of Engineering,North Carolina A&T State University,1601 E Market St,Greensboro,NC 27411,USA [2]Palo Alto Networks,Inc.,3000 Tannery Way,Santa Clara,CA 95054,USA

出　　处：《Cybersecurity》2024年第4期1-18,共18页网络空间安全科学与技术（英文）

基　　金：supported in part by NSF Grants#2113945 and#2200538 and a generous financial and technical support from Palo Alto Networks,Inc.

摘　　要：In today's interconnected world,network traffic is replete with adversarial attacks.As technology evolves,these attacks are also becoming increasingly sophisticated,making them even harder to detect.Fortunately,artificial intelli-gence(Al)and,specifically machine learning(ML),have shown great success in fast and accurate detection,classifica-tion,and even analysis of such threats.Accordingly,there is a growing body of literature addressing how subfields of Al/ML(e.g.,natural language processing(NLP))are getting leveraged to accurately detect evasive malicious patterns in network traffic.In this paper,we delve into the current advancements in ML-based network traffic classification using image visualization.Through a rigorous experimental methodology,we first explore the process of network traffic to image conversion.Subsequently,we investigate how machine learning techniques can effectively leverage image visualization to accurately classify evasive malicious traces within network traffic.Through the utilization of production-level tools and utilities in realistic experiments,our proposed solution achieves an impressive accuracy rate of 99.48%in detecting fileless malware,which is widely regarded as one of the most elusive classes of malicious software.

关 键 词：Network security Traffic classification Fileless malware Image visualization Machine learning INTRUSION 

分 类 号：TP391.41[自动化与计算机技术—计算机应用技术] TP181[自动化与计算机技术—计算机科学与技术]