提出BGA框架,从高熵加密流量中精准提取恶意签名,抗噪声且适合工业边缘部署。
BGA: A noise-immune neural distillation framework for malicious signature extraction in high-entropy encrypted flows

- 用ANOVA分离控制特征与加密噪声,再用WGAN-GP生成少数类样本解决数据不平衡。
- 在86,878条流记录上,对罕见攻击的检测召回率提升43.2%,关键指标超95.2%。
- 结构抗干扰强,推理延迟仅0.2820毫秒,适合实时部署于工业边缘设备。
为缓解高熵TLS 1.3流量中的注意力稀释问题,本文提出BGA——一种抗噪声的神经蒸馏框架,用于加密威胁情报中的恶意签名提取。首先采用方差分析(ANOVA)将高区分度的控制平面特征(如工业设定点)与随机加密噪声解耦;针对包含86,878条流记录语料库中存在的极端类别不平衡问题,引入带梯度惩罚的Wasserstein GAN(WGAN-GP)模块,通过1-Lipschitz约束合成高保真少数样本,使罕见的恶意状态命令注入(MSCI)攻击检测召回率提升43.2%。BGA核心架构结合双向长短期记忆网络(BiLSTM)捕捉时序依赖,以及自适应门控多头注意力机制,该门控单元作为神经滤波器,动态抑制加密伪影并增强恶意信号。在CIC-IDS-2018与Edge-IIoT基准上的大量实验表明,所有关键指标均超过95.2%。此外,噪声注入压力测试显示,相较于原始Transformer,BGA性能优势达8.57%;其极低推理延迟(0.2820毫秒,理论估算ARM平台为1.6920毫秒)表明其具备在异构工业边缘网关上实时运行的潜力,为未来硬件实现提供了有前景的架构基线。
原文摘要 · Abstract (English)
To mitigate attention dilution in high-entropy TLS 1.3 flows, we propose BGA, a noise-immune neural distillation framework for encrypted threat intelligence.The methodology first employs Analysis of Variance (ANOVA) to decouple high-discriminatory control-plane features - specifically industrial setpoints - from stochastic cryptographic noise. To resolve the extreme class imbalance within a corpus of 86,878 flow records, a Wasserstein GAN with Gradient Penalty (WGAN-GP) module, enforcing the 1-Lipschitz constraint, is integrated to synthesize high-fidelity minority samples, elevating the detection recall of rare Malicious State Command Injections(MSCI) attacks by 43.2%. At its core, the BGA architecture integrates Bidirectional Long Short-Term Memory (BiLSTM) for temporal dependency extraction and an Adaptive Gated Multi-Head Attention mechanism. This gated unit functions as a neural filter to dynamically suppress encryption artifacts while amplifying malicious signatures. Extensive evaluations on CIC-IDS-2018 and Edge-IIoT benchmarks demonstrate a performance ceiling exceeding 95.2% across all key metrics. Furthermore, noise-injection stress tests confirm BGAs superior structural resilience with a 8.57% performance margin over vanilla Transformers, while its ultra-low inference latency of 0.2820 ms (estimated 1.6920 ms via theoretical scaling for ARM) indicates a high potential for real-time feasibility on heterogeneous industrial edge gateways, providing a promising architectural baseline for future hardware implementation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。