Uncrewed aerial vehicle (UAV) networks are increasingly exposed to widespread and various network attacks due to their fully distributed nature and the limited defensive capabilities of individual devices. Existing defense strategies rely on network connectivity and UAV status information, which overlook information of network traffic. Malicious traffic detection offers a promising solution to achieve fine-grained attack detection. However, the dynamic nature and complexity of UAV networks limit the effectiveness of traditional traffic detection methods. Current approaches either fail to fully exploit the raw characteristics of traffic or do not consider the timeliness requirements of UAV networks. To address these challenges, we propose a novel twin graph encoder neural network, which can extract features of raw traffic bytes for efficient traffic detection. First, we propose a decoupled architecture for model training and inference to enable efficient detection of malicious traffic in UAV networks. Second, we propose a novel modeling method that models traffic as the co-occurrence graph and word frequency graph based on raw bytes. Then, we propose TGE-ETD, a Twin Graph Encoder for Encrypted Traffic Detection. TGE-ETD consists of a set of twin graph encoders that effectively extract intrinsic traffic features from graphs constructed from raw bytes. In addition, TGE-ETD employs a global attention pooling mechanism to effectively distinguish the feature contributions of different bytes. Finally, we conducted extensive experiments on a real UAV traffic dataset and four real-world network traffic datasets. TGE-ETD achieved an improvement of 1%-20% over the baseline methods by reducing the number of parameters by 20 times. Tested on multiple UAV hardware devices, TGE-ETD can achieve millisecond-level traffic detection.
原文链接
分享
引用
