{'fraction_non_alphanumeric': 0.022727272727272728, 'fraction_numerical': 0.0, 'mean_word_length': 5.188755020080321, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
One-Shot Detection of Malicious TLS Traffic

Network security protocols (such as Transport Layer Security, TLS) are increasingly used by hackers to evade detection. The detection of encrypted malicious traffic is becoming a critical task for cyber security. To accomplish this task, researchers have proposed several machine learning or deep learning based methods. However, existing methods require a huge amount of malicious flows as annotated samples, which is difficult or even impossible to obtain for emerging attacks. In this paper, we propose a novel method to detect malicious TLS traffic with only one sample, i.e., one annotated malicious flow. Our observation is that there are a large number of benign HTTPS (HTTP+TLS) flows in the network, and these flows are similar but with subtle differences in behavior. If a model can efficiently distinguish different HTTPS flows by traffic behavior, it should know how to extract inherent characteristics of TLS traffic. Based on the observation, we visit Alexa top websites and train ResNet models in conjunction with statistical traffic data. The obtained conjunction models are used as the feature extractor for malicious TLS flows. To achieve one-shot classification, we further train a feed-forward neural network to transfer the extracted features to a classification decision boundary of the support vector machine (SVM). We test our approach with a thorough set of experiments, and the experimental results show that our approach significantly outperforms the baseline methods.