用专家混合模型应对加密流量图漂移，提升恶意检测精度
MalMoE: Mixture-of-Experts Enhanced Encrypted Malicious Traffic Detection Under Graph Drift
- 引入专家混合机制，动态选择适配图漂移的检测模型
- 在真实与合成数据集上实现高精度实时检测，性能优于基线
- 适合网络安全领域研究者和工业界部署人员参考
加密技术广泛用于网络传输以保障安全，但也使包载荷不可见，给恶意流量检测带来挑战。基于图的方法通过建模多主机交互提升检测精度，但普遍面临图漂移问题——图的流统计或拓扑信息随时间变化。为此，本文提出MalMoE系统，采用混合专家（MoE）架构，根据实际漂移情况动态选择最优专家模型。设计了类似1跳-GNN的专家模型，分别处理不同类型的图漂移；重新设计门控模型，依据当前漂移特征进行专家路由。系统采用两阶段稳定训练策略并结合数据增强，有效指导门控模型的路径选择。在开源、合成及真实数据集上的实验表明，MalMoE能实现精准且实时的恶意流量检测。
原文摘要 · Abstract (English)
Encryption has been commonly used in network traffic to secure transmission, but it also brings challenges for malicious traffic detection, due to the invisibility of the packet payload. Graph-based methods are emerging as promising solutions by leveraging multi-host interactions to promote detection accuracy. But most of them face a critical problem: Graph Drift, where the flow statistics or topological information of a graph change over time. To overcome these drawbacks, we propose a graph-assisted encrypted traffic detection system, MalMoE, which applies Mixture of Experts (MoE) to select the best expert model for drift-aware classification. Particularly, we design 1-hop-GNN-like expert models that handle different graph drifts by analyzing graphs with different features. Then, the redesigned gate model conducts expert selection according to the actual drift. MalMoE is trained with a stable two-stage training strategy with data augmentation, which effectively guides the gate on how to perform routing. Experiments on open-source, synthetic, and real-world datasets show that MalMoE can perform precise and real-time detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。