arXiv:2409.11254cs.CRcs.LG2024-09被引 17

用少量样本识别新型恶意包,提升网络安全防御能力。

Towards Novel Malicious Packet Recognition: A Few-Shot Learning Approach

  • 结合大语言模型与少样本学习,从少量标注数据中识别未知恶意流量。
  • 在两个数据集上平均准确率达86.35%,F1分数达86.40%。
  • 适合应对零日攻击和资源有限的IoT环境下的恶意检测场景。

随着网络复杂性和连通性的增加,新型恶意软件检测方法的需求日益迫切。传统安全防御对现代高级攻击已显乏力。深度包检测(DPI)成为强化网络安全的关键技术,不仅分析包头,还深入内容,提供全面的网络流量洞察。本文提出一种新方法,利用预训练的大语言模型(LLM)提取数据包嵌入,并结合少量未见恶意类型样本进行少样本学习。该方法使模型适应不同恶意行为表征,生成鲁棒的嵌入表示。在提取嵌入后,采用少样本学习策略,在极小标注数据下提升性能。实验基于两个知名数据集,聚焦于网络流量及物联网(IoT)环境中的恶意类型识别。结果表明,该方法在两类恶意类型上平均准确率达86.35%,F1分数为86.40%。

原文摘要 · Abstract (English)

As the complexity and connectivity of networks increase, the need for novel malware detection approaches becomes imperative. Traditional security defenses are becoming less effective against the advanced tactics of today's cyberattacks. Deep Packet Inspection (DPI) has emerged as a key technology in strengthening network security, offering detailed analysis of network traffic that goes beyond simple metadata analysis. DPI examines not only the packet headers but also the payload content within, offering a thorough insight into the data traversing the network. This study proposes a novel approach that leverages a large language model (LLM) and few-shot learning to accurately recognizes novel, unseen malware types with few labels samples. Our proposed approach uses a pretrained LLM on known malware types to extract the embeddings from packets. The embeddings are then used alongside few labeled samples of an unseen malware type. This technique is designed to acclimate the model to different malware representations, further enabling it to generate robust embeddings for each trained and unseen classes. Following the extraction of embeddings from the LLM, few-shot learning is utilized to enhance performance with minimal labeled data. Our evaluation, which utilized two renowned datasets, focused on identifying malware types within network traffic and Internet of Things (IoT) environments. Our approach shows promising results with an average accuracy of 86.35% and F1-Score of 86.40% on different malware types across the two datasets.

恶意软件检测少样本学习大语言模型DPI

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。